k8s-配置管理configmap&secret
ConfigMap的定义：
一般用ConfigMap去管理一些配置文件、或者一些大量的环境变量信息
eg：
ConfigMap将配置和Pod分开，nginx镜像，生成实例后，会有一个nginx.conf
就可以读取configmap.nginx进行配置
总结：更易于配置文件的更改和管理
Secret的定义：
更倾向于存储和共享敏感、加密的配置信息
Secret用途：
ImagePullSecret：Pod拉取私有镜像仓库时，使用的账户密码，里面的账户信息，会传递给kubectl，然后kubectl就可以拉取有密码的仓库里的镜像
官网示例地址
https://v1-21.docs.kubernetes.io/zh/docs/tasks/configure-pod-container/configure-pod-configmap/
基于目录创建 ConfigMap
# 创建本地目录
mkdir -p configure-pod-container/configmap/
# 将实例文件下载到 `configure-pod-container/configmap/` 目录
wget https://kubernetes.io/examples/configmap/game.properties -O configure-pod-container/configmap/game.properties
wget https://kubernetes.io/examples/configmap/ui.properties -O configure-pod-container/configmap/ui.properties
# 查看下载文件
[root@k8s-master01 ~]# cat configure-pod-container/configmap/game.properties
enemies=aliens
lives=3
enemies.cheat=true
enemies.cheat.level=noGoodRotten
secret.code.passphrase=UUDDLRLRBABAS
secret.code.allowed=true
secret.code.lives=30
[root@k8s-master01 ~]# cat configure-pod-container/configmap/ui.properties
color.good=purple
color.bad=yellow
allow.textmode=true
how.nice.to.look=fairlyNice
# 创建 configmap
kubectl create configmap game-config --from-file=configure-pod-container/configmap/
# 查看创建的configmap game-configs
[root@k8s-master01 ~]# kubectl describe configmaps game-config
Name: game-config
Namespace: default
Labels:
Annotations:
Data
====
game.properties:
----
enemies=aliens
lives=3
enemies.cheat=true
enemies.cheat.level=noGoodRotten
secret.code.passphrase=UUDDLRLRBABAS
secret.code.allowed=true
secret.code.lives=30
ui.properties:
----
color.good=purple
color.bad=yellow
allow.textmode=true
how.nice.to.look=fairlyNice
Events:
# 第二种configmap的的查询方式
[root@k8s-master01 ~]# kubectl get configmaps game-config -o yaml
apiVersion: v1
data:
game.properties: |-
enemies=aliens
lives=3
enemies.cheat=true
enemies.cheat.level=noGoodRotten
secret.code.passphrase=UUDDLRLRBABAS
secret.code.allowed=true
secret.code.lives=30
ui.properties: |
color.good=purple
color.bad=yellow
allow.textmode=true
how.nice.to.look=fairlyNice
kind: ConfigMap
metadata:
creationTimestamp: "2022-11-03T02:33:02Z"
name: game-config
namespace: default
resourceVersion: "917036"
uid: a7cba98c-19c3-4ead-ab9a-a22138806a21
基于文件创建 ConfigMap
[root@k8s-master01 ~]# kubectl create cm game-ui-cm --from-file=configure-pod-container/configmap/ui.properties
configmap/game-ui-cm created
[root@k8s-master01 ~]# kubectl describe cm game-ui-cm
Name: game-ui-cm
Namespace: default
Labels:
Annotations:
Data
====
ui.properties:
----
color.good=purple
color.bad=yellow
allow.textmode=true
how.nice.to.look=fairlyNice
Events:
# ConfigMap 中使用的键名
[root@k8s-master01 ~]# kubectl create cm game-ui-custom-name --from-file=ui-pro=configure-pod-container/configmap/ui.properties
configmap/game-ui-custom-name created
[root@k8s-master01 ~]# kubectl describe cm game-ui-custom-name
Name: game-ui-custom-name
Namespace: default
Labels:
Annotations:
Data
====
ui-pro: # 名称已更改
----
color.good=purple
color.bad=yellow
allow.textmode=true
how.nice.to.look=fairlyNice
Events:
# 你可以多次使用 --from-file 参数，从多个数据源创建 ConfigMap。
kubectl create configmap game-config-2 --from-file=configure-pod-container/configmap/game.properties --from-file=configure-pod-container/configmap/ui.properties
使用 --from-env-file 选项从环境文件创建 ConfigMap
[root@k8s-master01 ~]# cat configure-pod-container/configmap/game-env-file.properties
enemies=aliens
lives=3
allowed="true"
[root@k8s-master01 ~]# kubectl create configmap game-config-env-file \
> --from-env-file=configure-pod-container/configmap/game-env-file.properties
configmap/game-config-env-file created
[root@k8s-master01 ~]# kubectl get configmap game-config-env-file -o yaml
apiVersion: v1
data:
allowed: '"true"'
enemies: aliens
lives: "3"
kind: ConfigMap
metadata:
creationTimestamp: "2022-11-03T02:56:52Z"
name: game-config-env-file
namespace: default
resourceVersion: "920480"
uid: 79cb22b3-0eda-4646-9b12-ab0a1508ba32
注意： 当多次使用 --from-env-file 来从多个数据源创建 ConfigMap 时，仅仅最后一个 env 文件有效。
根据字面值创建 ConfigMap
kubectl create configmap special-config --from-literal=special.how=very --from-literal=special.type=charm
[root@k8s-master01 ~]# kubectl get configmaps special-config -o yaml
apiVersion: v1
kind: ConfigMap
metadata:
creationTimestamp: 2016-02-18T19:14:38Z
name: special-config
namespace: default
resourceVersion: "651"
selfLink: /api/v1/namespaces/default/configmaps/special-config
uid: dadce046-d673-11e5-8cd0-68f728db1985
data:
special.how: very
special.type: charm
基于生成器创建 ConfigMap
自 1.14 开始，kubectl 开始支持 kustomization.yaml。 你还可以基于生成器创建 ConfigMap，然后将其应用于 API 服务器上创建对象。 生成器应在目录内的 kustomization.yaml 中指定。
基于文件生成 ConfigMap
例如，要从 configure-pod-container/configmap/kubectl/game.properties 文件生成一个 ConfigMap：
# 创建包含 ConfigMapGenerator 的 kustomization.yaml 文件
cat <./kustomization.yaml
configMapGenerator:
- name: game-config-4
files:
- configure-pod-container/configmap/kubectl/game.properties
EOF
[root@k8s-master01 ~]# kubectl apply -k .
configmap/game-config-4-tbg7c4gc77 created
[root@k8s-master01 ~]# kubectl get configmap
NAME DATA AGE
game-config 2 61m
game-config-4-tbg7c4gc77 1 81s
game-config-env-file 3 38m
game-ui-cm 1 49m
game-ui-custom-name 1 45m
kube-root-ca.crt 1 50d
[root@k8s-master01 ~]# kubectl describe configmaps/game-config-4-tbg7c4gc77
Name: game-config-4-tbg7c4gc77
Namespace: default
Labels:
Annotations:
Data
====
game.properties:
----
enemies=aliens
lives=3
enemies.cheat=true
enemies.cheat.level=noGoodRotten
secret.code.passphrase=UUDDLRLRBABAS
secret.code.allowed=true
secret.code.lives=30
Events:
请注意，生成的 ConfigMap 名称具有通过对内容进行散列而附加的后缀， 这样可以确保每次修改内容时都会生成新的 ConfigMap。
在 ConfigMap 生成器，你可以定义一个非文件名的键名。 例如，从 configure-pod-container/configmap/game.properties 文件生成 ConfigMap， 但使用 game-special-key 作为键名：
# 创建包含 ConfigMapGenerator 的 kustomization.yaml 文件
cat <./kustomization.yaml
configMapGenerator:
- name: game-config-5
files:
- game-special-key=configure-pod-container/configmap/kubectl/game.properties
EOF
kubectl apply -k .
configmap/game-config-5-m67dt67794 created
要基于字符串 special.type=charm 和 special.how=very 生成 ConfigMap， 可以在 kusotmization.yaml 中配置 ConfigMap 生成器：
# 创建带有 ConfigMapGenerator 的 kustomization.yaml 文件
cat <./kustomization.yaml
configMapGenerator:
- name: special-config-2
literals:
- special.how=very
- special.type=charm
EOF
[root@k8s-master01 ~]# kubectl apply -k .
configmap/special-config-2-2b86tk8fhm created
[root@k8s-master01 ~]# kubectl get cm
NAME DATA AGE
game-config 2 4h17m
game-config-4-tbg7c4gc77 1 3h17m
game-config-env-file 3 3h53m
game-ui-cm 1 4h5m
game-ui-custom-name 1 4h1m
kube-root-ca.crt 1 50d
special-config-2-2b86tk8fhm 2 38s
使用 ConfigMap 数据定义容器环境变量
1、在 ConfigMap 中将环境变量定义为键值对:
kubectl create configmap special-config --from-literal=special.how=very
2、将 ConfigMap 中定义的 special.how 值分配给 Pod 规范中的 SPECIAL_LEVEL_KEY 环境变量。
apiVersion: v1
kind: Pod
metadata:
name: dapi-test-pod
spec:
containers:
- name: test-container
image: busybox:1.28
command: [ "/bin/sh", "-c", "env" ]
env:
# Define the environment variable
- name: SPECIAL_LEVEL_KEY
valueFrom:
configMapKeyRef:
# The ConfigMap containing the value you want to assign to SPECIAL_LEVEL_KEY
name: special-config
# Specify the key associated with the value
key: special.how
restartPolicy: Never
[root@k8s-master01 ~]# vim pod-single-configmap-env-variable.yaml
apiVersion: v1
kind: Pod
metadata:
name: dapi-test-pod
spec:
containers:
- name: test-container
image: busybox:1.28
command: [ "/bin/sh", "-c", "env" ]
env:
# Define the environment variable
- name: SPECIAL_LEVEL_KEY
valueFrom:
configMapKeyRef:
# The ConfigMap containing the value you want to assign to SPECIAL_LEVEL_KEY
name: special-config
# Specify the key associated with the value
key: special.how
restartPolicy: Never
# 创建pod
[root@k8s-master01 ~]# kubectl create -f pod-single-configmap-env-variable.yaml
pod/dapi-test-pod created
# 已经创建完成并且退出
[root@k8s-master01 ~]# kubectl get po
NAME READY STATUS RESTARTS AGE
busybox 1/1 Running 121 50d
dapi-test-pod 0/1 Completed 0 73s
nginx-66bbc9fdc5-dhrgc 1/1 Running 5 4d17h
nginx-66bbc9fdc5-lh7vw 1/1 Running 5 4d17h
# 查看日志
[root@k8s-master01 ~]# kubectl get po
NAME READY STATUS RESTARTS AGE
busybox 1/1 Running 121 50d
dapi-test-pod 0/1 Completed 0 73s
nginx-66bbc9fdc5-dhrgc 1/1 Running 5 4d17h
nginx-66bbc9fdc5-lh7vw 1/1 Running 5 4d17h
[root@k8s-master01 ~]# kubectl logs dapi-test-pod
KUBERNETES_PORT=tcp://192.168.0.1:443
NGINX_SVC_SERVICE_HOST=192.168.193.36
KUBERNETES_SERVICE_PORT=443
HOSTNAME=dapi-test-pod
NGINX_SVC_EXTERNAL_SERVICE_HOST=192.168.77.183
SHLVL=1
HOME=/root
NGINX_SVC_SERVICE_PORT=80
NGINX_SVC_PORT=tcp://192.168.193.36:80
NGINX_SVC_EXTERNAL_PORT=tcp://192.168.77.183:80
NGINX_SVC_EXTERNAL_SERVICE_PORT=80
NGINX_SVC_PORT_80_TCP_ADDR=192.168.193.36
NGINX_SVC_PORT_80_TCP_PORT=80
NGINX_SVC_EXTERNAL_PORT_80_TCP_ADDR=192.168.77.183
NGINX_SVC_PORT_80_TCP_PROTO=tcp
KUBERNETES_PORT_443_TCP_ADDR=192.168.0.1
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
NGINX_SVC_EXTERNAL_PORT_80_TCP_PORT=80
NGINX_SVC_EXTERNAL_PORT_80_TCP_PROTO=tcp
KUBERNETES_PORT_443_TCP_PORT=443
KUBERNETES_PORT_443_TCP_PROTO=tcp
NGINX_SVC_PORT_443_TCP_ADDR=192.168.193.36
NGINX_SVC_PORT_80_TCP=tcp://192.168.193.36:80
SPECIAL_LEVEL_KEY=very # 此处已经打印出来
NGINX_SVC_PORT_443_TCP_PORT=443
NGINX_SVC_PORT_443_TCP_PROTO=tcp
NGINX_SVC_EXTERNAL_PORT_80_TCP=tcp://192.168.77.183:80
KUBERNETES_SERVICE_PORT_HTTPS=443
KUBERNETES_PORT_443_TCP=tcp://192.168.0.1:443
NGINX_SVC_SERVICE_PORT_HTTP=80
KUBERNETES_SERVICE_HOST=192.168.0.1
PWD=/
NGINX_SVC_EXTERNAL_SERVICE_PORT_HTTP=80
NGINX_SVC_SERVICE_PORT_HTTPS=443
NGINX_SVC_PORT_443_TCP=tcp://192.168.193.36:443
将 ConfigMap 中的所有键值对配置为容器环境变量
创建一个包含多个键值对的 ConfigMap
[root@k8s-master01 ~]# vim configmap-multikeys.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: special-config
namespace: default
data:
SPECIAL_LEVEL: very
SPECIAL_TYPE: charm
创建 ConfigMap:
[root@k8s-master01 ~]# kubectl create -f configmap-multikeys.yaml
configmap/special-config created
使用 envFrom 将所有 ConfigMap 的数据定义为容器环境变量，ConfigMap 中的键成为 Pod 中的环境变量名称
[root@k8s-master01 ~]# vim pod-configmap-envFrom.yaml
apiVersion: v1
kind: Pod
metadata:
name: dapi-test-pod
spec:
containers:
- name: test-container
image: busybox:1.28
command: [ "/bin/sh", "-c", "env" ]
envFrom:
- configMapRef:
name: special-config
restartPolicy: Never
[root@k8s-master01 ~]# kubectl create -f pod-configmap-envFrom.yaml
pod/dapi-test-pod created
[root@k8s-master01 ~]# kubectl logs dapi-test-pod
KUBERNETES_SERVICE_PORT=443
NGINX_SVC_SERVICE_HOST=192.168.193.36
KUBERNETES_PORT=tcp://192.168.0.1:443
HOSTNAME=dapi-test-pod
NGINX_SVC_EXTERNAL_SERVICE_HOST=192.168.77.183
SHLVL=1
HOME=/root
NGINX_SVC_SERVICE_PORT=80
NGINX_SVC_PORT=tcp://192.168.193.36:80
SPECIAL_LEVEL=very # 已生效
NGINX_SVC_EXTERNAL_PORT=tcp://192.168.77.183:80
NGINX_SVC_EXTERNAL_SERVICE_PORT=80
NGINX_SVC_PORT_80_TCP_ADDR=192.168.193.36
NGINX_SVC_PORT_80_TCP_PORT=80
NGINX_SVC_EXTERNAL_PORT_80_TCP_ADDR=192.168.77.183
NGINX_SVC_PORT_80_TCP_PROTO=tcp
KUBERNETES_PORT_443_TCP_ADDR=192.168.0.1
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
NGINX_SVC_EXTERNAL_PORT_80_TCP_PORT=80
NGINX_SVC_EXTERNAL_PORT_80_TCP_PROTO=tcp
KUBERNETES_PORT_443_TCP_PORT=443
KUBERNETES_PORT_443_TCP_PROTO=tcp
NGINX_SVC_PORT_443_TCP_ADDR=192.168.193.36
NGINX_SVC_PORT_80_TCP=tcp://192.168.193.36:80
NGINX_SVC_PORT_443_TCP_PORT=443
NGINX_SVC_EXTERNAL_PORT_80_TCP=tcp://192.168.77.183:80
NGINX_SVC_PORT_443_TCP_PROTO=tcp
KUBERNETES_PORT_443_TCP=tcp://192.168.0.1:443
KUBERNETES_SERVICE_PORT_HTTPS=443
KUBERNETES_SERVICE_HOST=192.168.0.1
NGINX_SVC_SERVICE_PORT_HTTP=80
PWD=/
SPECIAL_TYPE=charm # 已生效
NGINX_SVC_EXTERNAL_SERVICE_PORT_HTTP=80
NGINX_SVC_PORT_443_TCP=tcp://192.168.193.36:443
NGINX_SVC_SERVICE_PORT_HTTPS=443
使用存储在 ConfigMap 中的数据填充数据卷
在 Pod 规约的 volumes 部分下添加 ConfigMap 名称。 这会将 ConfigMap 数据添加到指定为 volumeMounts.mountPath 的目录（在本例中为 /etc/config）。 command 部分引用存储在 ConfigMap 中的 special.level。
[root@k8s-master01 ~]# vim pod-configmap-volume.yaml
apiVersion: v1
kind: Pod
metadata:
name: dapi-test-pod
spec:
containers:
- name: test-container
image: busybox:1.28
command: [ "/bin/sh", "-c", "sleep 3600" ]
volumeMounts:
- name: config-volume
mountPath: /mnt/1
- name: contain-filename
mountPath: /mnt/2
volumes:
- name: config-volume
configMap:
# Provide the name of the ConfigMap containing the files you want
# to add to the container
name: special-config
- name: contain-filename
configMap:
name: game-ui-custom-name
restartPolicy: Never
# 查看挂载的configmap
[root@k8s-master01 ~]# kubectl describe cm special-config
Name: special-config
Namespace: default
Labels: >
Annotations: >
Data
====
SPECIAL_LEVEL:
----
very
SPECIAL_TYPE:
----
charm
Events: >
[root@k8s-master01 ~]# kubectl describe cm game-ui-custom-name
Name: game-ui-custom-name
Namespace: default
Labels: >
Annotations: >
Data
====
ui-pro:
----
color.good=purple
color.bad=yellow
allow.textmode=true
how.nice.to.look=fairlyNice
Events: >
[root@k8s-master01 ~]# kubectl create -f pod-configmap-volume.yaml
pod/dapi-test-pod created
[root@k8s-master01 ~]# kubectl get po
NAME READY STATUS RESTARTS AGE
busybox 1/1 Running 122 50d
dapi-test-pod 1/1 Running 0 17s
nginx-66bbc9fdc5-dhrgc 1/1 Running 5 4d18h
nginx-66bbc9fdc5-lh7vw 1/1 Running 5 4d18h
[root@k8s-master01 ~]# kubectl exec -it dapi-test-pod -- sh # 进入容器查看挂载点
/ # ls
bin dev etc home mnt proc root sys tmp usr var
/ # cd mnt/
/mnt # ls
1 2
/mnt # cd 1
/mnt/1 # ls
SPECIAL_LEVEL SPECIAL_TYPE
/mnt/1 # cat SPECIAL_LEVEL
very
/mnt/1 # cd ..
/mnt # ls
1 2
/mnt # cd 2
/mnt/2 # ls
ui-pro
/mnt/2 # cat ui-pro
color.good=purple
color.bad=yellow
allow.textmode=true
how.nice.to.look=fairlyNice
/mnt/2 #
注意： 如果在 /etc/config/ 目录中有一些文件，它们将被删除。
subPath挂载，目录下的内容不会被删除
configmap&secret热更新
[root@k8s-master01 ~]# kubectl get cm
NAME DATA AGE
game-config 2 28h
game-config-4-tbg7c4gc77 1 27h
game-config-env-file 3 28h
game-ui-cm 1 28h
game-ui-custom-name 1 28h
kube-root-ca.crt 1 51d
special-config 2 22h
special-config-2-2b86tk8fhm 2 24h
[root@k8s-master01 ~]# kubectl edit cm game-config # 更新
Edit cancelled, no changes made.
configmap&secret常用热更新的第二中方式
将 ConfigMap 数据添加到数据卷中的特定路径
使用 path 字段为特定的 ConfigMap 项目指定预期的文件路径。 在这里，ConfigMap中，键值 SPECIAL_LEVEL 的内容将挂载在 config-volume 数据卷中 /etc/config/keys 文件下。
apiVersion: v1
kind: Pod
metadata:
name: dapi-test-pod
spec:
containers:
- name: test-container
image: k8s.gcr.io/busybox
command: [ "/bin/sh","-c","cat /etc/config/keys" ]
volumeMounts:
- name: config-volume
mountPath: /etc/config
volumes:
- name: config-volume
configMap:
name: special-config
items:
- key: SPECIAL_LEVEL
path: keys # keys就是变成了目录名称
restartPolicy: Never
secret配置同上，可以查看官网：
https://v1-21.docs.kubernetes.io/zh/docs/tasks/configmap-secret/managing-secret-using-kubectl/