k8s配置管理

Secret

作用：加密数据存在etcd中，让Pod容器以挂载Volume方式进行访问。
场景：凭证
创建secret加密数据：

apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Qpaque
data:
  username: ssvdve
  password: wsfefgeg

kubectl create -f secret.yaml
kubectl get secret

以变量形式挂载到Pod容器中：

apiVersion: v1
kind: Pod
metadata:
  name: myPod
spec:
  containers:
  - name: nginx
    image: nginx
    env: 
      - name: SECRET_USERNAME
        valueFrom:
          secretKeyRef:
            name: mySecret
            key: username
      - name: SECRET_PASSWORD
        valueFrom:
          secretKeyRef:
            name: mySecret
            key: password

kubectl apply -f secret-val.yaml
kubectl exec -it myPod bash
echo $SECRET_USERNAME

以Volume形式挂载Pod容器中

apiVersion: v1
kind: Pod
metadata: 
  name: mypod
spec:
  containers:
  - name: nginx
    image: nginx
    volumeMounts:
    - name: foo
      mountPath: "/etc/foo"
      readOnly: true
  volumes:
  - name: foo
    secret:
      secretName: mysecret

kubectl apply -f secret-val.yaml
kubectl exec -it mypod bash
ls /etc/foo
cat username

ConfigMap

作用：存储不加密数据到etcd中，让Pod以变量或者Volume挂载到容器中。
场景：配置文件

创建配置文件：

redis.host=127.0.0.1
redis.port=6379
redis.password=123456

kubectl create configmap redis-config --from-file=redis.properties
kubectl get cm
kubectl describe cm redis-config

以Volume形式挂载Pod容器中

apiVersion: v1
kind: Pod
metadata:
  name: mypod
spec:
  containers:
    - name: busybox
      image: busybox
      command: ["/bin/sh","-c","cat /etc/config/redis.properties"]
      volumeMounts:
      - name: config-volume
        mountPath: /etc/config
  volumes:
    - name: config-volume
      configMap:
        name: redis-config
  restartPolicy: Never

kubectl apply -f cm.yaml
kubectl logs mypod

以变量形式挂载到Pod容器中

apiVersion: v1
kind: ConfigMap
metadata: 
  name: myconfig
  namespace: default
data:
  special.level: info
  special.type: hello

kubectl apply -f myconfig.yaml
kubectl get cm

apiVersion: v1
kind: Pod
metadata:
  name: mypod
spec: 
  containers:
    - name: busybox
      image: busybox
      command: ["/bin/sh","-c","echo $(LEVEL) $(TYPE)"]
      env:
        - name: LEVEL
          valueFrom:
            configMapKeyRef:
              name: myconfig
              key: special.level
        - name: TYPE
          valueFrom:
            configMapKeyRef:
              name: myconfig
              key: special.type
restartPolicy: Never

kubectl apply -f config-var.yaml
kubectl get pods
kubectl logs mypod