1 Secret 存在意义
Secret 解决了密码、token、密钥等敏感数据的配置问题,而不需要把这些敏感数据暴露到镜像或者 Pod Spec中。Secret 可以以 Volume或者环境变量的方式使用
2 Secret 有三种类型
- Service Account:用来访问 Kubernetes API,由 Kubernetes 自动创建,并且会自动挂载到 Pod的/run/secrets/kubernetes.io/serviceaccount目录中
- Opaque:base64编码格式的Secret,用来存储密码、密钥等
- kubernetes.io/dockerconfigjson:用来存储私有 docker registry 的认证信息
3 Service Account
Service Account 用来访问 Kubernetes API,由 Kubernetes 自动创建,并且会自动挂载到 Pod的/run/secrets/kubernetes.io/serviceaccount目录中
4、Opaque Secret
Opaque 类型的数据是一个 map 类型,要求 value 是 base64 编码格式:
[root@wyl01 secrets]# echo -n"admin" | base64
YWRtaW4=
[root@wyl01 secrets]# echo -n"123456" | base64
MTIzNDU2
[root@wyl01 secrets]# cat mysecrets.yaml
apiVersion: v1
kind: Secret
metadata:
name: mysecret
type: Opaque
data:
password: MTIzNDU2
username: YWRtaW4=
[root@wyl01 secrets]# kubectl describe secrets mysecret
Name: mysecret
Namespace: default
Labels: <none>
Annotations:
Type: Opaque
Data
====
password: 6 bytes
username: 5 bytes
将 Secret 挂载到 Volume 中
[root@wyl01 secrets]# cat test1-secrets-pod.yaml
apiVersion: v1
kind: Pod
metadata:
name: test1-secret-pod
labels:
name: secret-test
spec:
volumes:
- name: secrets
secret:
secretName: mysecret
containers:
- image: ikubernetes/myapp:v1
name: db
volumeMounts:
- name: secrets
mountPath: "/etc/secrets"
readOnly: true
[root@wyl01 ~]# kubectl get pod -owide --show-labels |grep test1
test1-secret-pod 1/1 Running 0 28s 10.244.2.24 wyl01-hf-aiui <none> <none> name=secret-test
将 Secret 导出到环境变量中
[root@wyl01 secrets]# cat test2-secrets-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: pod-deployment
spec:
replicas: 2
selector:
matchLabels:
app: pod-deployment
template:
metadata:
labels:
app: pod-deployment
spec:
containers:
- name: pod-1
image: ikubernetes/myapp:v1
ports:
- containerPort: 80
env:
- name: TEST_USER
valueFrom:
secretKeyRef:
name: mysecret
key: username
- name: TEST_PASSWORD
valueFrom:
secretKeyRef:
name: mysecret
key: password