Pod拉取私有项目镜像案例之secret

1.响应式创建harbor的认证信息
[root@master231 secrets]# kubectl create secret docker-registry oldboyedu-harbor --docker-username=admin --docker-password=1 --docker-email=admin@oldboyedu.com --docker-server=harbor.oldboyedu.com

    
    
    2.声明式创建harbor的认证信息
        方法一:
[root@master231 secrets]# kubectl get secrets  oldboyedu-harbor -o yaml > 02-secret-harbor.yaml
[root@master231 secrets]# 
[root@master231 secrets]# cat 02-secret-harbor.yaml  # 保留以下字段即可
apiVersion: v1
data:
  .dockerconfigjson: eyJhdXRocyI6eyJoYXJib3Iub2xkYm95ZWR1LmNvbSI6eyJ1c2VybmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiIxIiwiZW1haWwiOiJhZG1pbkBvbGRib3llZHUuY29tIiwiYXV0aCI6IllXUnRhVzQ2TVE9PSJ9fX0=
kind: Secret
metadata:
  name: oldboyedu-harbor
  namespace: default
type: kubernetes.io/dockerconfigjson
[root@master231 secrets]# 

        方法二:  (反推法)
            1.先对数据解析解码，得到原始数据。
[root@master231 pod]# echo eyJhdXRocyI6eyJoYXJib3Iub2xkYm95ZWR1LmNvbSI6eyJ1c2VybmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiIxIiwiZW1haWwiOiJhZG1pbkBvbGRib3llZHUuY29tIiwiYXV0aCI6IllXUnRhVzQ2TVE9PSJ9fX0= | base64 -d | more 
{"auths":{"harbor.oldboyedu.com":{"username":"admin","password":"1","email":"admin@oldboyedu.com","auth":"YWRtaW46MQ=="}}}
[root@master231 pod]# 

                得到的数据如下，发现还有一层数据为解码
{"auths":{"harbor.oldboyedu.com":{"username":"admin","password":"1","email":"admin@oldboyedu.com","auth":"YWRtaW46MQ=="}}}

            2.对上一步的auth字段进行解码
[root@master231 pod]# echo YWRtaW46MQ==  | base64 -d | more 
admin:1
[root@master231 pod]# 

            3.得出最终的数据为:
{"auths":{"harbor.oldboyedu.com":{"username":"admin","password":"1","email":"admin@oldboyedu.com","auth":"admin:1"}}}

        综上所述，我们就可以根据上面的步骤倒着来就可以手写资源清单啦，具体如下:
            1.编写json格式字符串，以jasonyin用户为例。
{"auths":{"harbor.oldboyedu.com":{"username":"jasonyin","password":"Linux@2023","email":"jasonyin@oldboyedu.com","auth":"jasonyin:Linux@2023"}}}

            2.对auth字段进行编码
[root@master231 pod]# echo -n jasonyin:Linux@2023 | base64 
amFzb255aW46TGludXhAMjAyMw==
[root@master231 pod]# 

                得到数据如下:
{"auths":{"harbor.oldboyedu.com":{"username":"jasonyin","password":"Linux@2023","email":"jasonyin@oldboyedu.com","auth":"amFzb255aW46TGludXhAMjAyMw=="}}}

            3.对整体字符串再次进行编码（注意，echo后面的数据最好加上单引号，否则可能后续操作会失败！）
[root@master231 pod]# echo -n '{"auths":{"harbor.oldboyedu.com":{"username":"jasonyin","password":"Linux@2023","email":"jasonyin@oldboyedu.com","auth":"amFzb255aW46TGludXhAMjAyMw=="}}}' | base64 
eyJhdXRocyI6eyJoYXJib3Iub2xkYm95ZWR1LmNvbSI6eyJ1c2VybmFtZSI6Imphc29ueWluIiwicGFzc3dvcmQiOiJMaW51eEAyMDIzIiwiZW1haWwiOiJqYXNvbnlpbkBvbGRib3llZHUuY29tIiwiYXV0aCI6ImFtRnpiMjU1YVc0NlRHbHVkWGhBTWpBeU13PT0ifX19
[root@master231 pod]# 

            4.编写配置文件的资源清单
[root@master231 secrets]# cat 03-secrets-jasonyin.yaml 
apiVersion: v1
kind: Secret
metadata:
  name: oldboyedu-harbor-jasonyin
type: kubernetes.io/dockerconfigjson
data:
  .dockerconfigjson: eyJhdXRocyI6eyJoYXJib3Iub2xkYm95ZWR1LmNvbSI6eyJ1c2VybmFtZSI6Imphc29ueWluIiwicGFzc3dvcmQiOiJMaW51eEAyMDIzIiwiZW1haWwiOiJqYXNvbnlpbkBvbGRib3llZHUuY29tIiwiYXV0aCI6ImFtRnpiMjU1YVc0NlRHbHVkWGhBTWpBeU13PT0ifX19
[root@master231 secrets]# 

            5.验证测试（注意，请确保你创建的用户必须在harbor中对相应的项目有访问权限！）
[root@master231 pod]# cat 32-pods-harbor-secrets.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: linux86-secrets-harbor-001
spec:
  # 指定harbor的secret认证信息，可以指定多个。
  imagePullSecrets:
  # - name: oldboyedu-harbor
  - name: oldboyedu-harbor-jasonyin
  containers:
  - name: web
    image: harbor.oldboyedu.com/oldboyedu-apps/apps:v1
    # 指定镜像的拉取策略，若不指定，当tag为latest时，默认是Always，当tag非latest时，则默认策略为IfNotPresent
    imagePullPolicy: Always
    # imagePullPolicy: IfNotPresent
[root@master231 pod]# 
[root@master231 pod]# kubectl apply -f 32-pods-harbor-secrets.yaml 
pod/linux86-secrets-harbor-001 created
[root@master231 pod]# 

    3.Pod引用secret案例是否生效
[root@master231 pod]# cat 32-pods-harbor-secrets.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: linux86-secrets-harbor-001
spec:
  # 指定harbor的secret认证信息，可以指定多个。
  imagePullSecrets:
  - name: oldboyedu-harbor
  containers:
  - name: web
    image: harbor.oldboyedu.com/oldboyedu-apps/apps:v1
    # 指定镜像的拉取策略，若不指定，当tag为latest时，默认是Always，当tag非latest时，则默认策略为IfNotPresent
    imagePullPolicy: Always
    # imagePullPolicy: IfNotPresent