Secret
作用:加密数据存在etcd中,让Pod容器以变量或者Volume方式挂载到容器中
场景:凭证
//将admin进行base64编码
echo -n "admin" | base64
//1.创建Secret加密数据
//Secret.yaml
apiVersion: v1
kind: Secret
metadata:
name: mysecret
type: Opaque
data:
username: YWRtaW4
password: MWYy2DF1MmU2N2Rm
//执行Secret.yaml文件,创建Secret加密数据
kubectl apply -f Secret.yaml
//查看创建成功的secret
kubectl get secret
//2.以变量的形式挂载到pod容器
//Secret-var.yaml
apiVersion: v1
kind: Pod
metadata:
name: mypod
spec:
containers:
- name: nginx
image: nginx
env:
-name: SECRET_USERNAME
valueFrom:
secretKeyRef:
name: mysecret
key: username
-name: SECRET_PASSWORD
valueFrom:
secretKeyRef:
name: mysecret
key: password
//执行Secret-var.yaml文件
kubectl apply -f Secret-var.yaml
//查看pod
kubectl get pods
//进入容器中查看
kubectl exec -it mypod bash
//查看账号
echo $SECRET_USERNAME
//查看密码
echo $SECRET_PASSWORD
//3.以Volume的形式挂载到pod容器
//Secret-val.yaml
apiVersion: v1
kind: Pod
metadata:
name: mypod
spec:
containers:
- name: nginx
image: nginx
volumeMounts:
- name: foo
mountPath: "/etc/foo"
readlOnly: true
volumes:
- name: foo
secret:
secretName: mysecret
//执行Secret-val.yaml文件
kubectl apply -f Secret-val.yaml
//查看pod
kubectl get pods
//进入新创建的容器中
kubectl exec -it mypod-(容器名称) bash
ls /etc/foo
cd /etc/foo
cat password
cat username
ConfigMap
作用:存储不加密数据到etcd,让pod以变量或者Volume 挂载到容器中
场景:配置文件
//1.创建配置文件
//redis.properties
redis.host=127.0.0.1
redis.port=6379
redis.password=123456
//2.创建ConfigMap
kubectl create ConfigMap redis-config --from-file=redis.properties
//查看刚刚创建的configmap
kubectl get configmap(cm)
//查看详细信息
kubectl describe cm redis-config
//3.以Volume挂载到pod容器中
//cm.yaml
apiVersion: v1
kind: Pod
metadata:
name: mypod
sepc:
containers:
- name: busybox
image: busybox
command: [ "/bin/sh","-c","cat /etc/config/redis.properties" ]
volumeMounts:
- name: config-volume
mountPath: /etc/config
volumes:
- name: config-volume
configMap:
name: redis-config
restartPolicy: Never
//执行创建
kubectl apply -f cm.yaml
//查看日志,输出了配置文件内容
kubectl logs mypod
//4.以变量形式挂载到pod容器
(1)创建yaml,声明变量信息configmap创建
//myconfig.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: myconfig
namespace: default
data:
special.level: info
special.type: hello
kubectl apply -f myconfigmap.yaml
kubectl get cm
(2)以变量形式挂载
//config-var.yaml
apiVersion: v1
kind: Pod
metadata:
name: mypod
spec:
containers:
- name: busybox
image: busybox
command: [ "/bin/sh", "-c", "echo $(LEVEL) $(TYPE)" ]
env:
- name: LEVEL
valueFrom:
configMapKeyRef:
name: myconfig
key: special.level
- name: TYPE
valueFrom:
configMapKeyRef:
name: myconfig
key: special.type
restartPolicy: Never
kubectl apply -f config-var.yaml
kubectl get pods
kubectl logs mypod
kubectl get cm