Secret存在意义
Secret解决了密码、token、密钥等敏感数据的配置问题,而不需要把这些敏感数据暴露到镜像或者Pod Spec中。Secret可以以Volume或者环境变量的方式使用
secret有三种类型:
-
Service Account :用来访问Kubernetes API,由Kubernetes自动创建,并且会自动挂载到Pod的 /run/secrets/kubernetes.io/serviceaccount目录中
-
Opaque : base64编码格式的Secret,用来存储密码、密钥等
-
kubernetes.io/dockerconfigison :用来存储私有docker registry的认证信息
Service Account
Service Account用来访问Kubernetes API,由Kubernetes自动创建,并且会自动挂载到Pod的 /run/secrets/kubernetes.io/serviceaccount目录中
[root@k8s-master01 ~]# kubectl exec kube-proxy-hjkqb -n kube-system -it -- ls /run/secrets/kubernetes.io/serviceaccount
ca.crt namespace token
kubectl exec kube-proxy-hjkqb -n kube-system -it -- /bin/sh cd /run/secrets/kubernetes.io/serviceaccount
cat ca.crt
kubectl get pod -n kube-system
kubectl exec kube-proxy-hjkqb -n kube-system -it -- /bin/sh
Opaque Secret
Ⅰ、 创建说明
Opaque类型的数据是一个map类型,要求value是base64编码格式:
[root@k8s-master01 ~]# echo -n "admin" | base64
YWRtaW4=
[root@k8s-master01 ~]# echo -n "admin123" | base64
YWRtaW4xMjM=
[root@k8s-master01 ~]# echo -n "YWRtaW4xMjM=" | base64 -d
admin123
[root@k8s-master01 ~]# base64 --help
secrets.yaml
apiVersion: v1
kind: Secret
metadata:
name: mysecret
type: Opaque
data:
password: YWRtaW4xMjM=
username: YWRtal4=
kubectl get secret
Ⅱ、使用方式
1、将Secret挂载到volume中
apiVersion: v1
kind: Pod
metadata:
labels:
name: seret-test
name: seret-test
spec:
volumes:
- name: secrets
secret:
secretName: mysecret
containers:
- image: hub.atguigu.com/library/myapp:v1
name: db
volumeMounts:
- name: secrets
mountPath: "/etc/secrets"
readOnly: true
kubectl exec seret-test -it -- /bin/sh
/ # cd /etc/secrets/
/etc/secrets # ls
password username
/etc/secrets # cat username
/etc/secrets # cat password
admin123
2、将Secret导出到环境变量中
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: pod-deployment
spec:
replicas: 2
template:
metadata:
labels:
app: pod-deployment
spec:
containers:
- name: pod-1
image: hub.atguigu.com/library/myapp:v1
ports:
- containerPort: 80
env:
- name: TEST_USER
valueFrom:
secretKeyRef:
name: mysecret
key: username
- name: TEST_PASSWORD
valueFrom:
secretKeyRef:
name: mysecret
key: password
[root@k8s-master01 ~]# kubectl exec pod-deployment-57cf4db6cc-68j9r -it -- /bin/sh
/ # echo $TEST_USER
admj^
/ # echo $TEST_PASSWORD
admin123
/ #
kubernetes.io/dockerconfigjson
使用Kuberctl创建docker registry认证的secret
kubectl create secret docker-registry myregistrykey --docker-server=DOCKER REGISTRY SERVER- docker-username-DOCKER USER--docker-password-DOCKER PASSWORD ---docker-emai1-DOCKER EMAIL secret "myregistrykey" created.
在创建Pod的时候,通过imagePullsecrets来引用刚创建的myregistrykey
apiVersion: v1
kind: Pod
metadata:
name: foo
spec:
containers:
name: foo
image: hub.atguigu.com/library/myapp:v1
imagePullsecrets:
name: myregistrykey