如何在kubernetes中将secret标记为可选或必选？

 

目录

使用环境变量方式创建带有secret的pod

创建username为bob的secret

创建带有secret的pod

返回信息 

 解释  Optional: false

源码说明

在kubernetes中将secret标记为可选或必选？

---

使用环境变量方式创建带有secret的pod

创建username为bob的secret

kubectl create secret generic super-secret --from-literal=username=bob  

创建带有secret的pod

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: pod-secrets-via-env
  name: pod-secrets-via-env
spec:
  volumes:
  - name: super-secret
    secret:
      secretName: super-secret
  containers:
  - image: redis
    name: pod-secrets-via-env
    resources: {}
    env:
    - name: CREDENTIALS
      valueFrom:
        secretKeyRef:
          name: super-secret
          key: username
  dnsPolicy: ClusterFirst
  restartPolicy: Always
status: {}

返回信息 

$ kubectl describe pod pod-secrets-via-env
Name:         pod-secrets-via-env
Namespace:    default
Priority:     0
Node:         minikube/172.17.0.10
Start Time:   Tue, 28 Apr 2020 08:53:31 +0000
Labels:       run=pod-secrets-via-env
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"v1","kind":"Pod","metadata":{"annotations":{},"creationTimestamp":null,"labels":{"run":"pod-secrets-via-env"},"name":"pod-s...
Status:       Running
IP:           172.18.0.4
IPs:
  IP:  172.18.0.4
Containers:
  pod-secrets-via-env:
    Container ID:   docker://6175f7ac701a68852609a1d4a023153033929b24d1fbbab45ca639ea36c054d6
    Image:          redis
    Image ID:       docker-pullable://redis@sha256:157a95b41b0dca8c308a33489dfdb28019e033110320414b4b16fad7d28c0f9f
    Port:           
    Host Port:      
    State:          Running
      Started:      Tue, 28 Apr 2020 08:53:41 +0000
    Ready:          True
    Restart Count:  0
    Environment:
      CREDENTIALS:    Optional: false
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-5qltp (ro)
Conditions:
  Type              Status
  Initialized       True
  Ready             True
  ContainersReady   True
  PodScheduled      True
Volumes:
  super-secret:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  super-secret
    Optional:    false
  default-token-5qltp:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-5qltp
    Optional:    false
QoS Class:       BestEffort
Node-Selectors:  
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:
  Type    Reason     Age   From               Message
  ----    ------     ----  ----               -------
  Normal  Scheduled  12m   default-scheduler  Successfully assigned default/pod-secrets-via-env to minikube
  Normal  Pulling    12m   kubelet, minikube  Pulling image "redis"
  Normal  Pulled     12m   kubelet, minikube  Successfully pulled image "redis"
  Normal  Created    12m   kubelet, minikube  Created container pod-secrets-via-env
  Normal  Started    12m   kubelet, minikube  Started container pod-secrets-via-env

 解释  Optional: false

要将secret作为环境变量使用在pod中，除非将secret标记为可选，否则必须先创建secret。

引用不存在的secret将阻止容器启动。

 - name: ENV_NAME
    valueFrom:
      secretKeyRef:
        name: 
        key: 
        optional: true

源码说明

// SecretKeySelector selects a key of a Secret.
type SecretKeySelector struct {
	// The name of the secret in the pod's namespace to select from.
	LocalObjectReference
	// The key of the secret to select from.  Must be a valid secret key.
	Key string
	// Specify whether the Secret or it's key must be defined
	// +optional
	Optional *bool
}

在kubernetes中将secret标记为可选或必选？

 optional设置为false或 true即可，默认是false

参考链接：

https://github.com/kubernetes/kubernetes/blob/e9e190c57c61a88a2ba96c4b0688b8eb3a8945a8/pkg/apis/core/types.go#L1762