kubernetes存储-secrets

目录

一、从文件创建

二、编写yaml文件

三、将Secret挂载到Volume中

四、向指定路径映射 secret 密钥

五、将Secret设置为环境变量

六、存储docker registry的认证信息

---

       Kubernetes中的Secrets是用于存储敏感信息的一种对象类型，例如密码、令牌、证书等。Secrets可以以编码、加密或未加密的形式存储。使用Secrets可以保护敏感信息不被直接暴露在Pod定义中，从而增加了应用程序的安全性。

一、从文件创建

echo -n 'admin' > ./username.txt
echo -n '123456' > ./password.txt
kubectl create secret generic db-user-pass --from-file=./username.txt --from-file=./password.txt
kubectl get secrets db-user-pass -o yaml
echo MTIzNDU2 | base64 -d

二、编写yaml文件

echo -n 'admin' | base64
echo -n '123456' | base64
vim mysecret.yaml

apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Opaque
data:
  username: YWRtaW4=                    #必须编码后的值
  password: MTIzNDU2

kubectl apply -f mysecret.yaml
kubectl get secrets mysecret -o yaml

 

三、将Secret挂载到Volume中

vim pod1.yaml

apiVersion: v1
kind: Pod
metadata:
  name: mysecret
spec:
  containers:
  - name: nginx
    image: nginx
    volumeMounts:
    - name: secrets
      mountPath: "/secret"
      readOnly: true
  volumes:
  - name: secrets
    secret:
      secretName: mysecret

kubectl apply  -f pod1.yaml
kubectl get pod
kubectl exec  mysecret -- ls /secret
kubectl delete  -f pod1.yaml

 

四、向指定路径映射 secret 密钥

vim pod2.yaml

apiVersion: v1
kind: Pod
metadata:
  name: mysecret
spec:
  containers:
  - name: nginx
    image: nginx
    volumeMounts:
    - name: secrets
      mountPath: "/secret"
      readOnly: true
  volumes:
  - name: secrets
    secret:
      secretName: mysecret
      items:
      - key: username
        path: my-group/my-username

kubectl apply -f pod2.yaml
kubectl exec  mysecret -- cat /secret/my-group/my-username
kubectl delete  -f pod2.yaml

 

五、将Secret设置为环境变量

vim pod3.yaml

apiVersion: v1
kind: Pod
metadata:
  name: secret-env
spec:
  containers:
  - name: pod3
    image: busybox
    command: ["/bin/sh", "-c", "env"]
    env:
      - name: SECRET_USERNAME
        valueFrom:
          secretKeyRef:
            name: mysecret
            key: username
      - name: SECRET_PASSWORD
        valueFrom:
          secretKeyRef:
            name: mysecret
            key: password
  restartPolicy: Never

kubectl apply -f pod3.yaml
kubectl logs secret-env

六、存储docker registry的认证信息

新建私有仓库

 

kubectl create secret docker-registry myregistrykey --docker-server=reg.westos.org --docker-username=admin --docker-password=123456 --docker-email=yyl@westos.org
vim pod4.yaml

apiVersion: v1
kind: Pod
metadata:
  name: mypod
spec:
  containers:
    - name: game2048
      image: reg.westos.org/westos/game2048
  imagePullSecrets:
    - name: myregistrykey

kubectl apply -f pod4.yaml
kubectl get pod

推荐把registrykey绑定到sa，这样yaml文件中就可以不用指定，更加安全。

kubectl patch serviceaccount default -p '{"imagePullSecrets": [{"name": "myregistrykey"}]}'
kubectl describe sa default