k8s-配置管理

Secret

作用：加密数据存在etcd中，让Pod容器以变量或者Volume方式挂载到容器中

场景：凭证

//将admin进行base64编码
echo -n "admin" | base64

//1.创建Secret加密数据
//Secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Opaque
data:
  username: YWRtaW4
  password: MWYy2DF1MmU2N2Rm


//执行Secret.yaml文件，创建Secret加密数据
kubectl apply -f Secret.yaml


//查看创建成功的secret
kubectl get secret



//2.以变量的形式挂载到pod容器
//Secret-var.yaml
apiVersion: v1 
kind: Pod 
metadata:
  name: mypod
spec:
  containers:
  - name: nginx
    image:  nginx
    env:
      -name: SECRET_USERNAME
        valueFrom:
          secretKeyRef:
            name: mysecret
            key: username
      -name: SECRET_PASSWORD
        valueFrom:
          secretKeyRef:
            name: mysecret
            key: password


//执行Secret-var.yaml文件
kubectl apply -f Secret-var.yaml


//查看pod
kubectl get pods


//进入容器中查看
kubectl exec -it mypod bash
//查看账号
echo $SECRET_USERNAME
//查看密码
echo $SECRET_PASSWORD



//3.以Volume的形式挂载到pod容器
//Secret-val.yaml
apiVersion: v1 
kind: Pod 
metadata:
  name: mypod
spec:
  containers:
  - name: nginx
    image:  nginx
    volumeMounts:
    - name: foo
      mountPath: "/etc/foo"
      readlOnly: true
  volumes:
  - name: foo
    secret:
      secretName: mysecret


//执行Secret-val.yaml文件
kubectl apply -f Secret-val.yaml


//查看pod
kubectl get pods


//进入新创建的容器中
kubectl exec -it mypod-(容器名称) bash

ls /etc/foo
cd /etc/foo
cat password
cat username

ConfigMap

作用：存储不加密数据到etcd，让pod以变量或者Volume 挂载到容器中

场景：配置文件

//1.创建配置文件

//redis.properties
redis.host=127.0.0.1
redis.port=6379
redis.password=123456


//2.创建ConfigMap
kubectl create ConfigMap redis-config --from-file=redis.properties

//查看刚刚创建的configmap
kubectl get configmap(cm)

//查看详细信息
kubectl describe cm redis-config



//3.以Volume挂载到pod容器中

//cm.yaml
apiVersion: v1 
kind: Pod
metadata: 
  name: mypod
sepc:
  containers:
  - name: busybox
    image: busybox
    command: [ "/bin/sh","-c","cat /etc/config/redis.properties" ]
    volumeMounts:
    - name: config-volume
      mountPath: /etc/config
  volumes:
    - name: config-volume
      configMap:
        name: redis-config
  restartPolicy: Never


//执行创建
kubectl apply -f cm.yaml

//查看日志，输出了配置文件内容
kubectl logs mypod



//4.以变量形式挂载到pod容器
  
（1）创建yaml，声明变量信息configmap创建

//myconfig.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: myconfig
  namespace: default
data:
  special.level: info
  special.type: hello


kubectl apply -f myconfigmap.yaml

kubectl get cm


（2）以变量形式挂载

//config-var.yaml
apiVersion: v1
kind: Pod
metadata:
  name: mypod
spec:
  containers:
    - name: busybox
      image: busybox
      command: [ "/bin/sh", "-c", "echo $(LEVEL) $(TYPE)" ]
      env:
        - name: LEVEL
          valueFrom:
            configMapKeyRef:
              name: myconfig
              key: special.level
        - name: TYPE
          valueFrom:
            configMapKeyRef:
              name: myconfig
              key: special.type
  restartPolicy: Never


kubectl apply -f config-var.yaml

kubectl get pods

kubectl logs mypod

kubectl get cm