Kubernetes之Secrets与Config Maps
Secrets
Secrets是一个包含敏感数据的对象，例如我们常用的密码，令牌或密钥等, 我们编写yaml如果直接明文这些信息则会将我们的敏感信息暴漏在我们的脚本中; 所以将其放置在Secret对象中可以更好地控制它的使用方式，并降低意外暴露的风险。
Pod可以引用我们事先创建好的Secrets键值对到环境变量, 通过获取环境变量的键值对动态更新我们Pod的环境配置, 从而实现动态配置更新.
1. 创建一个secret
# kubectl create secret generic secret-demo --from-literal='password=countonme'
2. 查看创建好的secret
# kubectl get secret secret-demo
NAME TYPE DATA AGE secret-demo Opaque 1 13s
3.创建一个Pod并引用这个secret
# vi secret-env-pod.yaml
apiVersion: v1
kind: Pod
metadata:
name: httpd-pod
spec:
containers:
- image: httpd
name: httpd
imagePullPolicy: Always
env:
- name: PASSWORD
valueFrom:
secretKeyRef:
name: secret-demo
key: password
# kubectl create -f secret-env-pod.yaml
4.查看secret
# kubectl describe secret
5.查看变量是否引入Pod
# kubectl exec -ti httpd-pod env
PATH=/usr/local/apache2/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=httpd-pod TERM=xterm PASSWORD=countonme KUBERNETES_SERVICE_PORT_HTTPS=443 KUBERNETES_PORT=tcp://10.96.0.1:443 KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443 KUBERNETES_PORT_443_TCP_PROTO=tcp KUBERNETES_PORT_443_TCP_PORT=443 KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1 KUBERNETES_SERVICE_HOST=10.96.0.1 KUBERNETES_SERVICE_PORT=443 HTTPD_PREFIX=/usr/local/apache2 NGHTTP2_VERSION=1.18.1-1 OPENSSL_VERSION=1.0.2l-1~bpo8+1 HTTPD_VERSION=2.4.29 HTTPD_SHA256=777753a5a25568a2a27428b2214980564bc1c38c1abf9ccc7630b639991f7f00 HTTPD_PATCHES= APACHE_DIST_URLS=https://www.apache.org/dyn/closer.cgi?action=download&filename= HOME=/root
可以看到Pod的环境变量里已经引入一组键值对PASSWORD=countonme
6.向Pod挂载目录写入secret文件.
# vi secret-vol-pod.yaml
apiVersion: v1
kind: Pod
metadata:
name: httpd-pod-secret-vol
spec:
containers:
- image: httpd
name: httpd
imagePullPolicy: Always
volumeMounts:
- name: secret
mountPath: "/mnt"
readOnly: true
volumes:
- name: secret
secret:
secretName: secret-demo
# kubectl create -f secret-vol-pod.yaml
# kubectl exec -it httpd-pod-secret-vol cat /mnt/password
countonme
可以看到该Pod下面有一个文件名为password, 内容为countonme的文本文件.
Config Map
1.创建config map
# vi cfgmap-demo.yaml
apiVersion: v1 data: database: db.example.com db_port: "3306" http_url: http://www.example.com kind: ConfigMap metadata: name: cfgmap-demo
# kubectl create -f cfgmap-demo.yaml
2.查看config map
# kubectl get configmap cfgmap-demo -o yaml
apiVersion: v1 data: database: db.example.com db_port: "3306" http_url: http://www.example.com kind: ConfigMap metadata: creationTimestamp: 2018-02-24T07:11:01Z name: cfgmap-demo namespace: default resourceVersion: "1064654" selfLink: /api/v1/namespaces/default/configmaps/cfgmap-demo uid: de9248d1-1931-11e8-9e24-00163e0e24bf
3. 修改config map
# vi cfgmap-demo.yaml
添加一行键值对
apiVersion: v1 data: database: db.example.com db_port: "3306" http_url: http://www.example.com http_port: "80" kind: ConfigMap metadata: name: cfgmap-demo
更新config map
# kubectl replace -f cfgmap-demo.yaml
查看更新后的config map
# kubectl get configmap cfgmap-demo -o yaml
apiVersion: v1 data: database: db.example.com db_port: "3306" http_port: "80" http_url: http://www.example.com kind: ConfigMap metadata: creationTimestamp: 2018-02-24T07:11:01Z name: cfgmap-demo namespace: default resourceVersion: "1065520" selfLink: /api/v1/namespaces/default/configmaps/cfgmap-demo uid: de9248d1-1931-11e8-9e24-00163e0e24bf
4.创建一个Pod并引用这个config map
# vi cfgmap-env-pod.yaml
apiVersion: v1
kind: Pod
metadata:
name: cfgmap-httpd-pod
spec:
containers:
- image: httpd
name: httpd
imagePullPolicy: Always
envFrom:
- configMapRef:
name: cfgmap-demo
# kubectl create -f cfgmap-env-pod.yaml
5.查看config map的键值对是否引入Pod
# kubectl exec -ti cfgmap-httpd-pod env
PATH=/usr/local/apache2/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=cfgmap-httpd-pod TERM=xterm db_port=3306 http_port=80 http_url=http://www.example.com database=db.example.com KUBERNETES_SERVICE_PORT_HTTPS=443 KUBERNETES_PORT=tcp://10.96.0.1:443 KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443 KUBERNETES_PORT_443_TCP_PROTO=tcp KUBERNETES_PORT_443_TCP_PORT=443 KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1 KUBERNETES_SERVICE_HOST=10.96.0.1 KUBERNETES_SERVICE_PORT=443 HTTPD_PREFIX=/usr/local/apache2 NGHTTP2_VERSION=1.18.1-1 OPENSSL_VERSION=1.0.2l-1~bpo8+1 HTTPD_VERSION=2.4.29 HTTPD_SHA256=777753a5a25568a2a27428b2214980564bc1c38c1abf9ccc7630b639991f7f00 HTTPD_PATCHES= APACHE_DIST_URLS=https://www.apache.org/dyn/closer.cgi?action=download&filename= HOME=/root
可以看到我们Config map下的所有键值对已经成功引入Pod环境变量.
相关代码:
https://git.showerlee.com/showerlee/kube-deploy
Finished...
本文链接:http://www.showerlee.com/archives/2308
继续浏览:k8s
还没有评论，快来抢沙发！