k8s----15、配置管理-Secret

1、Secret

• 作用：加密数据存在etcd里面，让pod以变量或者挂载volume的方式进行访问。
• 场景：做一些凭证

2、base64编码

• 常用的一种编码方式

  [root@master k8ssecret]# echo -n 'password' | base64
  cGFzc3dvcmQ=
  

3、创建secret加密数据

[root@master k8ssecret]# cat secret.yaml    # 创建加密凭证的yaml文件
apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Opaque
data:
  username: YWRtaW4=
  password: cGFzc3dvcmQ=

[root@master k8ssecret]# kubectl apply -f secret.yaml 
secret/mysecret created 
[root@master k8ssecret]# kubectl get secrets    # 查看secret
NAME                  TYPE                                  DATA   AGE
default-token-6dscg   kubernetes.io/service-account-token   3      62d
mysecret              Opaque                                2      5s

4、将secret挂载到pod内

4.1 以变量形式挂载

[root@master k8ssecret]# cat sercet-val.yaml 
apiVersion: v1
kind: Pod
metadata: 
  name: mypod1
spec:
  containers:
  - name: nginx
    image: nginx
    env:
      - name: SECRET_USERNAME   ##变量形式挂载进pod
        valueFrom:
          secretKeyRef:
            name: mysecret
            key: username
      - name: SECRET_PASSWORD
        valueFrom:
          secretKeyRef:
            name: mysecret
            key: password

[root@master k8ssecret]# kubectl exec -it mypod1 bash
root@mypod1:/# echo $SECRET_USERNAME
admin
root@mypod1:/# echo $SECRET_PASSWORD
password
[root@master k8ssecret]# kubectl get pod
NAME            READY   STATUS    RESTARTS   AGE
mypod1          1/1     Running   0          33s

4.2 以volume形式挂载

[root@master k8ssecret]# cat secret-val.yaml 
apiVersion: v1
kind: Pod
metadata: 
  name: mypod2
spec:
  containers:
  - name: nginx
    image: nginx
    volumeMounts:
    - name: foo
      mountPath: "/etc/foo"
      readOnly: true
  volumes:
  - name: foo
    secret:
      secretName: mysecret
[root@master k8ssecret]# kubectl apply -f secret-val.yaml 

[root@master k8ssecret]# kubectl get pod
NAME            READY   STATUS    RESTARTS   AGE
mypod2          1/1     Running   0          34s

[root@master k8ssecret]# kubectl exec -it mypod2 bash 
root@mypod2:/# cat /etc/foo/username 
adminroot@mypod2:/# cat /etc/foo/password 
passwordroot@mypod2:/#