Kerbernetes使用Secret资源配置铭感信息

　　　　　　　　　　　　　Kerbernetes使用Secret资源配置铭感信息

　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　作者：尹正杰

版权声明：原创作品，谢绝转载！否则将追究法律责任。 

 

　　Sercret的使用逻辑和ConfigMap并没什么区别，唯一不同的是Secret的数据是被base64编码后存储的。

一.基于环境变量引用Secret(保存MySQL的密码)案例

1>.查看secret的帮助信息

　　secret存在三种类型:
　　　　docker-registry:
　　　　　　用于提供docker镜像仓库的认证配置。

　　　　generic: 
　　　　　　比较通用的配置，即保存私有的铭感信息，比如MySQL的root密码，Redis进行同步的密码等。
　　　　　　
　　　　tls:
　　　　　　专用于把ssl/tls中的x509格式的证书和私钥打包进一个secret当中。
　　　　　　这个证书和私钥本身就是base64编码的，因此它可能需要特有的逻辑来组织，而且不管你的证书和私钥源文件名称叫什么，在secret的tls创建时证书文件名称时必须叫"tls.crt",私钥文件名称只能叫"tls.key"

[[email protected] ~]# kubectl create secret -h
Create a secret using specified subcommand.

Available Commands:
  docker-registry Create a secret for use with a Docker registry
  generic         Create a secret from a local file, directory or literal value
  tls             Create a TLS secret

Usage:
  kubectl create secret [flags] [options]

Use "kubectl  --help" for more information about a given command.
Use "kubectl options" for a list of global command-line options (applies to all commands).
[[email protected] ~]# 
[[email protected] ~]# 

[[email protected] ~]# kubectl create secret -h

2>.以命令行方式创建secret资源

[[email protected] ~]# kubectl create secret generic mysql-root-password -n yinzhengjie-config --from-literal=password=yinzhengjie
secret/mysql-root-password created
[[email protected] ~]# 
[[email protected] ~]# kubectl get secret mysql-root-password -n yinzhengjie-config
NAME                  TYPE     DATA   AGE
mysql-root-password   Opaque   1      22s
[[email protected] ~]# 

[[email protected] ~]# kubectl create secret generic mysql-root-password -n yinzhengjie-config --from-literal=password=yinzhengjie

[[email protected] ~]# kubectl get secret mysql-root-password -n yinzhengjie-config -o yaml
apiVersion: v1
data:
  password: eWluemhlbmdqaWU=
kind: Secret
metadata:
  creationTimestamp: "2020-02-11T17:09:22Z"
  name: mysql-root-password
  namespace: yinzhengjie-config
  resourceVersion: "617061"
  selfLink: /api/v1/namespaces/yinzhengjie-config/secrets/mysql-root-password
  uid: c992fb82-86be-4c10-96dc-4ff603393bca
type: Opaque
[[email protected] ~]# 
[[email protected] ~]# 

[[email protected] ~]# kubectl get secret mysql-root-password -n yinzhengjie-config -o yaml

[[email protected] ~]# kubectl get secret mysql-root-password -n yinzhengjie-config -o yaml
apiVersion: v1
data:
  password: eWluemhlbmdqaWU=
kind: Secret
metadata:
  creationTimestamp: "2020-02-11T17:09:22Z"
  name: mysql-root-password
  namespace: yinzhengjie-config
  resourceVersion: "617061"
  selfLink: /api/v1/namespaces/yinzhengjie-config/secrets/mysql-root-password
  uid: c992fb82-86be-4c10-96dc-4ff603393bca
type: Opaque
[[email protected] ~]# 
[[email protected] ~]# echo eWluemhlbmdqaWU= | base64 -d | xargs echo 
yinzhengjie
[[email protected] ~]# 
[[email protected] ~]# kubectl get secret  -n yinzhengjie-config
NAME                  TYPE                                  DATA   AGE
default-token-v9khz   kubernetes.io/service-account-token   3      41h
mysql-root-password   Opaque                                1      4m22s
[[email protected] ~]# 
[[email protected] ~]# 

[[email protected] ~]# echo eWluemhlbmdqaWU= | base64 -d | xargs echo

3>.创建pod并引用创建的secret

[[email protected] ~]# vim /yinzhengjie/data/k8s/manifests/basic/secret/mysql-pod.yaml
[[email protected] ~]# 
[[email protected] ~]# cat /yinzhengjie/data/k8s/manifests/basic/secret/mysql-pod.yaml
apiVersion: v1
kind: Pod
metadata:
  name: mysql
  namespace: yinzhengjie-config
spec:
  containers:
  - name: mysql
    image: mysql:5.6
    env:
    - name: MYSQL_ROOT_PASSWORD
      valueFrom:
        secretKeyRef:
          key: password
          name: mysql-root-password
[[email protected] ~]# 

[[email protected] ~]# vim /yinzhengjie/data/k8s/manifests/basic/secret/mysql-pod.yaml

[[email protected] ~]# kubectl apply -f /yinzhengjie/data/k8s/manifests/basic/secret/mysql-pod.yaml
pod/mysql created
[[email protected] ~]# 
[[email protected] ~]# kubectl get pods  -n yinzhengjie-config
NAME           READY   STATUS    RESTARTS   AGE
mynginx        1/1     Running   1          40h
mysql          1/1     Running   0          57s
pod-cfg-dome   1/1     Running   1          41h
[[email protected] ~]# 
[[email protected] ~]# 

[[email protected] ~]# kubectl apply -f /yinzhengjie/data/k8s/manifests/basic/secret/mysql-pod.yaml

[[email protected] ~]# kubectl get pods  -n yinzhengjie-config
NAME           READY   STATUS    RESTARTS   AGE
mynginx        1/1     Running   1          40h
mysql          1/1     Running   0          7m14s
pod-cfg-dome   1/1     Running   1          41h
[[email protected] ~]# 
[[email protected] ~]# 
[[email protected] ~]# kubectl describe pods mysql -n yinzhengjie-config
Name:         mysql
Namespace:    yinzhengjie-config
Priority:     0
Node:         node201.yinzhengjie.org.cn/172.200.1.201
Start Time:   Wed, 12 Feb 2020 01:27:12 +0800
Labels:       
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"v1","kind":"Pod","metadata":{"annotations":{},"name":"mysql","namespace":"yinzhengjie-config"},"spec":{"containers":[{"env"...
Status:       Running
IP:           10.244.1.33
IPs:
  IP:  10.244.1.33
Containers:
  mysql:
    Container ID:   docker://f970431d35c85ab7a57f0bb4b44207329878b515e723ae9498cb3fdb35585d21
    Image:          mysql:5.6
    Image ID:       docker-pullable://mysql@sha256:bef096aee20d73cbfd87b02856321040ab1127e94b707b41927804776dca02fc
    Port:           
    Host Port:      
    State:          Running
      Started:      Wed, 12 Feb 2020 01:27:35 +0800
    Ready:          True
    Restart Count:  0
    Environment:
      MYSQL_ROOT_PASSWORD:  'password' in secret 'mysql-root-password'>  Optional: false
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-v9khz (ro)
Conditions:
  Type              Status
  Initialized       True 
  Ready             True 
  ContainersReady   True 
  PodScheduled      True 
Volumes:
  default-token-v9khz:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-v9khz
    Optional:    false
QoS Class:       BestEffort
Node-Selectors:  
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:
  Type    Reason     Age        From                                 Message
  ----    ------     ----       ----                                 -------
  Normal  Scheduled    default-scheduler                    Successfully assigned yinzhengjie-config/mysql to node201.yinzhengjie.org.cn
  Normal  Pulling    7m23s      kubelet, node201.yinzhengjie.org.cn  Pulling image "mysql:5.6"
  Normal  Pulled     7m1s       kubelet, node201.yinzhengjie.org.cn  Successfully pulled image "mysql:5.6"
  Normal  Created    7m1s       kubelet, node201.yinzhengjie.org.cn  Created container mysql
  Normal  Started    7m1s       kubelet, node201.yinzhengjie.org.cn  Started container mysql
[[email protected] ~]# 
[[email protected] ~]# 

[[email protected] ~]# kubectl describe pods mysql -n yinzhengjie-config

4>.连接Pod中的MySQL容器并验证密码

[[email protected] ~]# kubectl get pods  -n yinzhengjie-config
NAME           READY   STATUS    RESTARTS   AGE
mynginx        1/1     Running   1          40h
mysql          1/1     Running   0          4m47s
pod-cfg-dome   1/1     Running   1          41h
[[email protected] ~]# 
[[email protected] ~]# kubectl exec -it mysql -n yinzhengjie-config -- /bin/sh
# 
# printenv
KUBERNETES_SERVICE_PORT=443
KUBERNETES_PORT=tcp://10.96.0.1:443
HOSTNAME=mysql
MYSQL_MAJOR=5.6
HOME=/root
MYSQL_ROOT_PASSWORD=yinzhengjie
TERM=xterm
KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
MYSQL_VERSION=5.6.47-1debian9
KUBERNETES_PORT_443_TCP_PORT=443
KUBERNETES_PORT_443_TCP_PROTO=tcp
KUBERNETES_SERVICE_PORT_HTTPS=443
KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443
GOSU_VERSION=1.7
KUBERNETES_SERVICE_HOST=10.96.0.1
PWD=/
# 
# mysql -pyinzhengjie
Warning: Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 3
Server version: 5.6.47 MySQL Community Server (GPL)

Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> 

[[email protected] ~]# kubectl exec -it mysql -n yinzhengjie-config -- /bin/sh

5>.基于配置文件引用Secret实现配置容器(和配置ConfigMap步骤类似)

[[email protected] ~]# kubectl explain pods.spec.volumes.secret
KIND:     Pod
VERSION:  v1

RESOURCE: secret