容器编排系统K8s之ConfigMap、Secret资源
在k8s上一切皆对象，我们需要把对应的配置信息通过对应资源初始化为一个对象，然后通过pod调用对应的对象，从而实现向pod里的容器提供配置，这种能够把配置信息初始化为一个对象并被pod所调用的资源有两个，分别是configmap和secret；configmap和secret资源都是用来向pod提供配置信息的资源，两者用法都很相似，唯一不同的是configmap主要用于提供非敏感配置的资源，secret主要用来提供敏感配置的资源；简单讲就是configmap不加密，secret要对敏感配置做加密处理（严格上不叫加密，它是把对应敏感数据做base64编码处理）；
前文我们了解了k8s上的pv/pvc/sc资源的使用和相关说明，回顾请参考：https://www.cnblogs.com/qiuhom-1874/p/14188621.html；今天我们主要来聊一下k8s上配置应用相关话题；
在说configmap和secret资源之前，我们先来回顾下在docker环境下怎么给容器提供配置信息；在docker容器里我们要给容器里的应用提供配置的方式有两种，一种是通过环境变量的方式，把对应容器里跑的程序的某些属性通过一个环境变量传递给容器运行时的环境中去，这样容器启动时，读取对应的环境变量，对应容器里的应用程序就会根据我们传递的环境变量来启动对应的程序，从而实现配置容器里应用程序的目的；这种能够通过环境变量向容器里的应用传递配置的前提是对应应用程序支持；第二种方式就是通过存储卷的方式，把外部的配置文件直接通过存储卷的方式挂载到容器里的应用程序对应位置，对应程序在启动时，通过读取挂载的配置文件，从而实现配置容器里的应用程序的目的；这两种方式都有一个特点，只能在初始化容器时做，一旦一个容器初始化完成以后，修改对应的配置，必须要重新初始化容器，对应配置才能生效；对于k8s上的pod来说，也是类似的逻辑；第一通过环境变量的方式，第二通过存储卷的方式；不同于docker容器，在k8s上一切皆对象，我们需要把对应的配置信息通过对应资源初始化为一个对象，然后通过pod调用对应的对象，从而实现向pod里的容器提供配置，这种能够把配置信息初始化为一个对象并被pod所调用的资源有两个，分别是configmap和secret；configmap和secret资源都是用来向pod提供配置信息的资源，两者用法都很相似，唯一不同的是configmap主要用于提供非敏感配置的资源，secret主要用来提供敏感配置的资源；简单讲就是configmap不加密，secret要对敏感配置做加密处理（严格上不叫加密，它是把对应敏感数据做base64编码处理）；
configmap资源对象的创建和使用
configmap是k8s上的一个标准资源，我们可以通过命令的方式来创建，也可以通过定义资源清单的方式来创建；
configmap通过create命令来创建的语法格式
Usage: kubectl create configmap NAME [--from-file=[key=]source] [--from-literal=key1=value1] [--dry-run=server|client|none] [options]
提示：configmap对象的创建主要指定对应configmap对象的名称，以及把对应配置信息传递给对应对象；configmap对象支持从命令行直接获取用户给定的kv配置信息，也支持通过读取一个配置文件的内容来获取对应配置；--from-file选项表示，对应配置信息从文件获取，默认我们直接指定一个配置文件的文件名称，它会把文件的基名（不包含路径名称）当作对应配置信息的key，把文件内容当作对应key的值；--from-literal选项表示，对应配置信息从用户在命令给定的key和value获取；
示例：通过命令的方式创建configmap资源对象，并在命令行向其传递kv配置；
[root@master01 ~]# kubectl create cm configmap-demo --from-literal=key1=value1 --from-literal=key2=value2 configmap/configmap-demo created [root@master01 ~]# kubectl get cm NAME DATA AGE configmap-demo 2 8s kube-root-ca.crt 1 4d2h [root@master01 ~]# kubectl describe cm configmap-demo Name: configmap-demo Namespace: default Labels: <none> Annotations: <none> Data ==== key1: ---- value1 key2: ---- value2 Events: <none> [root@master01 ~]#
提示：configmap可以简写为cm；--from-literal选项可以多次使用，每次指定一个配置项；从上面的显示看，对应configmap-demo这个对象保存了两个配置，分别是key1=value1、key2=value2；
定义pod应用configmap对象
[root@master01 ~]# cat nginx-demo.yaml
apiVersion: v1
kind: Pod
metadata:
name: nginx-demo
namespace: default
labels:
app: nginx
rel: stable
spec:
containers:
- name: nginx-demo
image: nginx:1.14-alpine
env:
- name: FIRST_KEY
valueFrom:
configMapKeyRef:
name: configmap-demo
key: key1
- name: SECOND_KEY
valueFrom:
configMapKeyRef:
name: configmap-demo
key: key2
[root@master01 ~]#
提示：以上配置清单主要在nginx-demo容器里通过configmap向对应容器的运行环境传递两个环境变量；FIRST_KEY这个环境变量的值对应configmap对象里保存的key1这个键的值；SECOND_KEY这个环境变量的值对应configmap对象里的key2这个键的值；
应用资源清单
[root@master01 ~]# kubectl apply -f nginx-demo.yaml
pod/nginx-demo created
[root@master01 ~]# kubectl get pods
NAME READY STATUS RESTARTS AGE
nginx-demo 0/1 ContainerCreating 0 8s
[root@master01 ~]# kubectl get pods -w
NAME READY STATUS RESTARTS AGE
nginx-demo 0/1 ContainerCreating 0 17s
nginx-demo 1/1 Running 0 17s
^C[root@master01 ~]# kubectl describe pod nginx-demo
Name: nginx-demo
Namespace: default
Priority: 0
Node: node03.k8s.org/172.16.11.6
Start Time: Sat, 26 Dec 2020 22:28:10 +0800
Labels: app=nginx
rel=stable
Annotations: <none>
Status: Running
IP: 10.244.3.8
IPs:
IP: 10.244.3.8
Containers:
nginx-demo:
Container ID: docker://63cf5421b597f9dcd1169193c248091c62183ba18ec565122e242a53045d3112
Image: nginx:1.14-alpine
Image ID: docker-pullable://nginx@sha256:485b610fefec7ff6c463ced9623314a04ed67e3945b9c08d7e53a47f6d108dc7
Port: <none>
Host Port: <none>
State: Running
Started: Sat, 26 Dec 2020 22:28:26 +0800
Ready: True
Restart Count: 0
Environment:
FIRST_KEY: <set to the key 'key1' of config map 'configmap-demo'> Optional: false
SECOND_KEY: <set to the key 'key2' of config map 'configmap-demo'> Optional: false
Mounts:
/var/run/secrets/kubernetes.io/serviceaccount from default-token-8qs4l (ro)
Conditions:
Type Status
Initialized True
Ready True
ContainersReady True
PodScheduled True
Volumes:
default-token-8qs4l:
Type: Secret (a volume populated by a Secret)
SecretName: default-token-8qs4l
Optional: false
QoS Class: BestEffort
Node-Selectors: <none>
Tolerations: node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal Scheduled 35s default-scheduler Successfully assigned default/nginx-demo to node03.k8s.org
Normal Pulling 32s kubelet Pulling image "nginx:1.14-alpine"
Normal Pulled 20s kubelet Successfully pulled image "nginx:1.14-alpine" in 12.059556374s
Normal Created 20s kubelet Created container nginx-demo
Normal Started 19s kubelet Started container nginx-demo
[root@master01 ~]#
提示：从上面pod的详细信息可以看到在对应Environment字段下多了两个环境变量，分别是FIRST_KEY和SECOND_KEY；
验证：进入对应pod，看看环境变量是否有FIRST_KEY和SECOND_KEY，对应值是否是configmap对象中的值
提示：可以看到在对应pod的环境变量中有我们传递的两个环境变量，对应的值也是我们在configmap对象中定义的值；
示例：通过命令的方式创建configmap资源对象，并通过配置文件向其传递配置信息；
准备配置文件
[root@master01 ~]# cat www-k8s-org.conf
server {
server_name www.k8s.org;
listen 80;
location / {
root "/www/html";
}
}
[root@master01 ~]# cat bbs-k8s-org.conf
server {
server_name bbs.k8s.org;
listen 80;
location / {
root "/bbs/html";
}
}
[root@master01 ~]#
创建configmap对象，并把上面两个配置文件信息传递给configmap对象
[root@master01 ~]# kubectl create cm nginx-conf --from-file=./www-k8s-org.conf --from-file=bbs-conf=./bbs-k8s-org.conf
configmap/nginx-conf created
[root@master01 ~]# kubectl get cm
NAME DATA AGE
configmap-demo 2 47m
kube-root-ca.crt 1 4d2h
nginx-conf 2 11s
[root@master01 ~]# kubectl describe cm nginx-conf
Name: nginx-conf
Namespace: default
Labels: <none>
Annotations: <none>
Data
====
bbs-conf:
----
server {
server_name bbs.k8s.org;
listen 80;
location / {
root "/bbs/html";
}
}
www-k8s-org.conf:
----
server {
server_name www.k8s.org;
listen 80;
location / {
root "/www/html";
}
}
Events: <none>
[root@master01 ~]#
提示：可以看到cm对象创建成功，并且成功把对应的配置文件内容当作对应key传递给cm对象了；在创建cm对象时，要使用--from-file选项来指定从文件加载配置信息，如果只指定了文件名，则以文件基名作为对应key，其文件内容作为对应key的值；
定义pod挂载configmap对象中的配置文件信息
[root@master01 ~]# cat nginx-demo2.yaml
apiVersion: v1
kind: Pod
metadata:
name: nginx-demo2
namespace: default
labels:
app: nginx
rel: stable
spec:
containers:
- name: nginx-demo
image: nginx:1.14-alpine
volumeMounts:
- name: website-conf
mountPath: /etc/nginx/conf.d/
volumes:
- name: website-conf
configMap:
name: nginx-conf
items:
- key: www-k8s-org.conf
path: www-k8s-org.conf
mode: 0644
- key: bbs-conf
path: bbs-k8s-org.conf
mode: 0644
[root@master01 ~]#
提示：以上配置信息表示把configmap对象中的两个配置信息，都以文件的方式挂载到/etc/nginx/conf.d/目录下；configmap类型存储卷它会把configmap中的对象以文件的形式挂载到对应pod；其中spec.volumes.configMap.items.key字段用于指定configmap对象中的key；path用于指定把对应的key映射的文件名称；mode是用于指定对应文件的权限信息；
应用配置清单
[root@master01 ~]# kubectl apply -f nginx-demo2.yaml
pod/nginx-demo2 created
[root@master01 ~]# kubectl get pods -w
NAME READY STATUS RESTARTS AGE
nginx-demo 1/1 Running 0 47m
nginx-demo2 1/1 Running 0 8s
^C[root@master01 ~]# kubectl describe pod nginx-demo2
Name: nginx-demo2
Namespace: default
Priority: 0
Node: node02.k8s.org/172.16.11.5
Start Time: Sat, 26 Dec 2020 23:15:29 +0800
Labels: app=nginx
rel=stable
Annotations: <none>
Status: Running
IP: 10.244.2.8
IPs:
IP: 10.244.2.8
Containers:
nginx-demo:
Container ID: docker://38781957cabf78616c7d826664009c215d3ef7105955e722e5e0104eca636ab0
Image: nginx:1.14-alpine
Image ID: docker-pullable://nginx@sha256:485b610fefec7ff6c463ced9623314a04ed67e3945b9c08d7e53a47f6d108dc7
Port: <none>
Host Port: <none>
State: Running
Started: Sat, 26 Dec 2020 23:15:34 +0800
Ready: True
Restart Count: 0
Environment: <none>
Mounts:
/etc/nginx/conf.d/ from website-conf (rw)
/var/run/secrets/kubernetes.io/serviceaccount from default-token-8qs4l (ro)
Conditions:
Type Status
Initialized True
Ready True
ContainersReady True
PodScheduled True
Volumes:
website-conf:
Type: ConfigMap (a volume populated by a ConfigMap)
Name: nginx-conf
Optional: false
default-token-8qs4l:
Type: Secret (a volume populated by a Secret)
SecretName: default-token-8qs4l
Optional: false
QoS Class: BestEffort
Node-Selectors: <none>
Tolerations: node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal Scheduled 21s default-scheduler Successfully assigned default/nginx-demo2 to node02.k8s.org
Normal Pulled 18s kubelet Container image "nginx:1.14-alpine" already present on machine
Normal Created 18s kubelet Created container nginx-demo
Normal Started 17s kubelet Started container nginx-demo
[root@master01 ~]#
进入nginx-demo2容器，看看对应/etc/nginx/conf.d/目录下是否有两个我们指定的配置文件？对应文件内容是否是cm对象中对应key的内容？
[root@master01 ~]# kubectl exec -it nginx-demo2 -- /bin/sh
/ # cd /etc/nginx/conf.d/
/etc/nginx/conf.d # ls
bbs-k8s-org.conf www-k8s-org.conf
/etc/nginx/conf.d # cat www-k8s-org.conf
server {
server_name www.k8s.org;
listen 80;
location / {
root "/www/html";
}
}
/etc/nginx/conf.d # cat bbs-k8s-org.conf
server {
server_name bbs.k8s.org;
listen 80;
location / {
root "/bbs/html";
}
}
/etc/nginx/conf.d #
提示：可以看到在对应pod容器里，在/etc/nginx/conf.d/目录下有两个配置文件，这两个配置文件就是我们定义pod时挂载configmap存储卷定义的文件名称；对应文件内容也是cm对象中保存的文件内容；
测试：修改对应cm资源的配置信息，看看对应引用了该cm资源对象的pod是否会更新配置信息？
提示：在线修改cm对象配置信息，可以使用edit命令来修改指定cm对象即可；修改完成后保存退出对应配置就会立即更新到cm对象；以上主要修改了bbs-conf键中的listen 80修改为8080；
验证：查看对应cm对象，看看配置信息是否更新？
提示：可以看到对应cm对象中的配置信息已经被更新；
验证：看看对应引用该cm对象中的配置信息的pod是否更新了配置？是否重载了对应配置？
提示：对应pod配置文件信息已经更新，但是并没有应用新配置；像这种情况我们还得自己手动进入到对应的容器里重载配置；
示例：使用配置清单创建cm对象
[root@master01 ~]# cat configmap-demo.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: test-cm-demo
namespace: default
data:
website-conf: |
server {
server_name bbs.k8s.org;
listen 80;
location / {
root "/bbs/html";
}
}
[root@master01 ~]#
提示：cm对象在没有spec字段，却而代之的是data字段，该字段主要用来定义对应kv配置信息；key可以是任意合法名称，对应的值可以是一个文件内容；如果对应内容需要多行来书写，需要在对应的key后面加上 “|”；
应用配置清单
[root@master01 ~]# kubectl apply -f configmap-demo.yaml
configmap/test-cm-demo created
[root@master01 ~]# kubectl get cm
NAME DATA AGE
configmap-demo 2 82m
kube-root-ca.crt 1 4d3h
nginx-conf 2 35m
test-cm-demo 1 5s
[root@master01 ~]# kubectl describe cm test-cm-demo
Name: test-cm-demo
Namespace: default
Labels: <none>
Annotations: <none>
Data
====
website-conf:
----
server {
server_name bbs.k8s.org;
listen 80;
location / {
root "/bbs/html";
}
}
Events: <none>
[root@master01 ~]#
提示：可以看到对应的cm对象已经成功被创建，并且里面保存了我们在定义cm时的配置信息；
Secret资源的创建和使用
secret资源和configmap资源的用法都很类似，可以在命令行中通过create命令来创建，也可以通过定义资源清单来创建，其使用方式和configmap也很类似；
secret资源通过create命令来创建的语法格式
[root@master01 ~]# kubectl create secret Create a secret using specified subcommand. Available Commands: docker-registry Create a secret for use with a Docker registry generic Create a secret from a local file, directory or literal value tls Create a TLS secret Usage: kubectl create secret [flags] [options] Use "kubectl <command> --help" for more information about a given command. Use "kubectl options" for a list of global command-line options (applies to all commands). [root@master01 ~]#
提示：secret资源有三种类型，分别是docker-registry、generis、tls；其中docker-registry类型主要用来创建保存私有镜像仓库中需要用到的认证信息，比如用户名称，用户密码，仓库地址，用户邮件信息等等；generis类型是比较通用的一种类型，它可以从一个文件中加载信息，也可以从命令行中获取对应的kv配置信息；tls类型主要用来保存证书相关的证书，私钥；在前边我们使用ingress资源时，在应用对应的证书和私钥时，就是通过tls类型的secret资源对象来向其ingress资源对象传递证书和私钥文件信息；
创建docker-registry类型的secret资源的语法格式
Usage: kubectl create secret docker-registry NAME --docker-username=user --docker-password=password --docker-email=email [--docker-server=string] [--from-literal=key1=value1] [--dry-run=server|client|none] [options]
示例：使用create命令来创建一个docker-registry类型的secret资源对象
[root@master01 ~]# kubectl create secret docker-registry docker-registry.io --docker-username=qiuhom --docker-password=Admin123.com --docker-server=docker-registry.io
secret/docker-registry.io created
[root@master01 ~]# kubectl get secret
NAME TYPE DATA AGE
default-token-xvd4c kubernetes.io/service-account-token 3 18d
docker-registry.io kubernetes.io/dockerconfigjson 1 15s
www-myapp-com-ingress-secret kubernetes.io/tls 2 4d22h
[root@master01 ~]# kubectl describe secret docker-registry.io
Name: docker-registry.io
Namespace: default
Labels: <none>
Annotations: <none>
Type: kubernetes.io/dockerconfigjson
Data
====
.dockerconfigjson: 118 bytes
[root@master01 ~]# kubectl get secret docker-registry.io -o yaml
apiVersion: v1
data:
.dockerconfigjson: eyJhdXRocyI6eyJkb2NrZXItcmVnaXN0cnkuaW8iOnsidXNlcm5hbWUiOiJxaXVob20iLCJwYXNzd29yZCI6IkFkbWluMTIzLmNvbSIsImF1dGgiOiJjV2wxYUc5dE9rRmtiV2x1TVRJekxtTnZiUT09In19fQ==
kind: Secret
metadata:
creationTimestamp: "2020-12-26T16:40:56Z"
managedFields:
- apiVersion: v1
fieldsType: FieldsV1
fieldsV1:
f:data:
.: {}
f:.dockerconfigjson: {}
f:type: {}
manager: kubectl-create
operation: Update
time: "2020-12-26T16:40:56Z"
name: docker-registry.io
namespace: default
resourceVersion: "392306"
uid: ac9e425f-95e7-4c34-b161-c621ad2b0a8a
type: kubernetes.io/dockerconfigjson
[root@master01 ~]#
提示：从上面对应secret资源对象中输出为yaml格式的配置中可以看到，对应data字段输出的是一个base64编码后的字符串；其实里面的内容就是我们创建secret资源对象时指定的内容；如下
[root@master01 ~]# echo eyJhdXRocyI6eyJkb2NrZXItcmVnaXN0cnkuaW8iOnsidXNlcm5hbWUiOiJxaXVob20iLCJwYXNzd29yZCI6IkFkbWluMTIzLmNvbSIsImF1dGgiOiJjV2wxYUc5dE9rRmtiV2x1TVRJekxtTnZiUT09In19fQ== |base64 -d
{"auths":{"docker-registry.io":{"username":"qiuhom","password":"Admin123.com","auth":"cWl1aG9tOkFkbWluMTIzLmNvbQ=="}}}[root@master01 ~]#
[root@master01 ~]# echo cWl1aG9tOkFkbWluMTIzLmNvbQ== |base64 -d
qiuhom:Admin123.com[root@master01 ~]#
[root@master01 ~]#
提示：可以看到所有把对应字符串交给base64解密后，拿到的就是我们在创建docker-registry类型的secret资源对象传递的选项；
定义pod资源引用docker-registry类型的secret资源对象
[root@master01 ~]# cat test-pod-demo.yaml
apiVersion: v1
kind: Pod
metadata:
name: test-nginx
namespace: default
labels:
app: nginx
spec:
imagePullSecrets:
- name: docker-registry.io
containers:
- name: nginx
image: docker-registry.io/test/nginx:latest
[root@master01 ~]#
提示：在定义pod时，如果要从对应私有镜像仓库中拉去镜像，需要用到认证信息，可以使用imagePullSecrets字段来应用对应的secret资源对象来传递仓库的认证信息；在应用配置清单之前，需要将所有节点的/etc/hosts文件和/etc/docker/daemon.json文件更新下；如果是私钥镜像仓库默认docker会认为不安全，需要我们手动指定出来；如果对应域名在互联网上无法正常解析，还需要借助对应的hosts文件将其解析到对应仓库服务器的地址上；如下
[root@master01 ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.0.99 time.test.org time-node
192.168.0.41 master01 master01.k8s.org
192.168.0.42 master02 master02.k8s.org
192.168.0.43 master03 master03.k8s.org
192.168.0.44 node01 node01.k8s.org
192.168.0.45 node02 node02.k8s.org
192.168.0.46 node03 node03.k8s.org
192.168.0.47 node04 node04.k8s.org
199.232.28.133 raw.githubusercontent.com
192.168.0.99 docker-registry.io registry
[root@master01 ~]# cat /etc/docker/daemon.json
{
"registry-mirrors": ["https://cyr1uljt.mirror.aliyuncs.com"],
"insecure-registries": ["docker-registry.io"]
}
[root@master01 ~]# scp /etc/docker/daemon.json node01:/etc/docker/
daemon.json 100% 112 39.4KB/s 00:00
[root@master01 ~]# scp /etc/docker/daemon.json node02:/etc/docker/
daemon.json 100% 112 67.3KB/s 00:00
[root@master01 ~]# scp /etc/docker/daemon.json node03:/etc/docker/
daemon.json 100% 112 8.9KB/s 00:00
[root@master01 ~]# scp /etc/docker/daemon.json node04:/etc/docker/
daemon.json 100% 112 69.8KB/s 00:00
[root@master01 ~]# scp /etc/hosts node01:/etc/
hosts 100% 541 477.4KB/s 00:00
[root@master01 ~]# scp /etc/hosts node02:/etc/
hosts 100% 541 225.7KB/s 00:00
[root@master01 ~]# scp /etc/hosts node03:/etc/
hosts 100% 541 217.3KB/s 00:00
[root@master01 ~]# scp /etc/hosts node04:/etc/
hosts 100% 541 149.4KB/s 00:00
[root@master01 ~]# ssh node01 'systemctl restart docker'
[root@master01 ~]# ssh node02 'systemctl restart docker'
[root@master01 ~]# ssh node03 'systemctl restart docker'
[root@master01 ~]# ssh node04 'systemctl restart docker'
提示：有关docker私有镜像仓库harbor的搭建过程可以参考本人博客：https://www.cnblogs.com/qiuhom-1874/p/13061984.html；
应用配置清单，看看对应的pod是否能够启动成功？
[root@master01 ~]# kubectl apply -f test-pod-demo.yaml
pod/test-nginx created
[root@master01 ~]# kubectl get pods -w
NAME READY STATUS RESTARTS AGE
test-nginx 1/1 Running 0 6s
^C[root@master01 ~]# kubectl describe pod test-nginx
Name: test-nginx
Namespace: default
Priority: 0
Node: node02.k8s.org/192.168.0.45
Start Time: Sun, 27 Dec 2020 01:04:18 +0800
Labels: app=nginx
Annotations: <none>
Status: Running
IP: 10.244.2.107
IPs:
IP: 10.244.2.107
Containers:
nginx:
Container ID: docker://9062506afc2fc002102754ee8b2205732ddb740f7f86b870131cb582fc3b9f52
Image: docker-registry.io/test/nginx:latest
Image ID: docker-pullable://docker-registry.io/test/nginx@sha256:0efad4d09a419dc6d574c3c3baacb804a530acd61d5eba72cb1f14e1f5ac0c8f
Port: <none>
Host Port: <none>
State: Running
Started: Sun, 27 Dec 2020 01:04:24 +0800
Ready: True
Restart Count: 0
Environment: <none>
Mounts:
/var/run/secrets/kubernetes.io/serviceaccount from default-token-xvd4c (ro)
Conditions:
Type Status
Initialized True
Ready True
ContainersReady True
PodScheduled True
Volumes:
default-token-xvd4c:
Type: Secret (a volume populated by a Secret)
SecretName: default-token-xvd4c
Optional: false
QoS Class: BestEffort
Node-Selectors: <none>
Tolerations: node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal Scheduled 27s default-scheduler Successfully assigned default/test-nginx to node02.k8s.org
Normal Pulling 26s kubelet Pulling image "docker-registry.io/test/nginx:latest"
Normal Pulled 21s kubelet Successfully pulled image "docker-registry.io/test/nginx:latest" in 4.835022509s
Normal Created 21s kubelet Created container nginx
Normal Started 21s kubelet Started container nginx
[root@master01 ~]#
提示：可以看到对应pod能够正常到指定的私钥仓库中把镜像托下来，并启动成功；
使用create命令创建generic类型的secret资源对象语法格式
Usage: kubectl create secret generic NAME [--type=string] [--from-file=[key=]source] [--from-literal=key1=value1] [--dry-run=server|client|none] [options]
示例：使用create命令创建generic类型的secret资源对象
[root@master01 ~]# kubectl create secret generic mysql-auth --from-literal=username=root --from-literal=passwd=admin
secret/mysql-auth created
[root@master01 ~]# kubectl get secret
NAME TYPE DATA AGE
default-token-xvd4c kubernetes.io/service-account-token 3 18d
docker-registry.io kubernetes.io/dockerconfigjson 1 37m
mysql-auth Opaque 2 13s
www-myapp-com-ingress-secret kubernetes.io/tls 2 4d23h
[root@master01 ~]# kubectl describe secret mysql-auth
Name: mysql-auth
Namespace: default
Labels: <none>
Annotations: <none>
Type: Opaque
Data
====
passwd: 5 bytes
username: 4 bytes
[root@master01 ~]# kubectl get secret mysql-auth -o yaml
apiVersion: v1
data:
passwd: YWRtaW4=
username: cm9vdA==
kind: Secret
metadata:
creationTimestamp: "2020-12-26T17:18:08Z"
managedFields:
- apiVersion: v1
fieldsType: FieldsV1
fieldsV1:
f:data:
.: {}
f:passwd: {}
f:username: {}
f:type: {}
manager: kubectl-create
operation: Update
time: "2020-12-26T17:18:08Z"
name: mysql-auth
namespace: default
resourceVersion: "396175"
uid: a22e27a8-b9f7-405a-b503-ac546da0b4cd
type: Opaque
[root@master01 ~]#
提示：generic类型的secret资源的创建和configmap很类似，它可以接受从命令行中用户手动传递对应的配置信息，也支持从配置文件中获取对应的配置信息；
创建pod资源，引用generic类型的secret类型的资源
[root@master01 ~]# cat mysql-demo.yaml
apiVersion: v1
kind: Pod
metadata:
name: mysql-demo
namespace: default
labels:
app: mysql
spec:
containers:
- name: mysql-demo
image: mysql:5.6
env:
- name: MYSQL_ROOT_PASSWORD
valueFrom:
secretKeyRef:
name: mysql-auth
key: passwd
[root@master01 ~]#
提示：上述清单定义了运行一个pod，其内部跑一个mysql:5.6的容器；对应使用环境变量的方式向mysql-demo容器传递了一个MYSQL_ROOT_PASSWORD的环境变量，对应环境变量的值为generic类型的secret资源对象中的passwd这个键的值；
应用配置清单
[root@master01 ~]# kubectl apply -f mysql-demo.yaml
pod/mysql-demo created
[root@master01 ~]# kubectl get pods -w
NAME READY STATUS RESTARTS AGE
mysql-demo 0/1 ContainerCreating 0 7s
test-nginx 1/1 Running 0 29m
mysql-demo 1/1 Running 0 32s
^C[root@master01 ~]# kubectl describe pod mysql-demo
Name: mysql-demo
Namespace: default
Priority: 0
Node: node03.k8s.org/192.168.0.46
Start Time: Sun, 27 Dec 2020 01:34:10 +0800
Labels: app=mysql
Annotations: <none>
Status: Running
IP: 10.244.3.106
IPs:
IP: 10.244.3.106
Containers:
mysql-demo:
Container ID: docker://97d88917cbc8e304af120e83a859814248cd915da7d2056643b3f29f61c2cb7b
Image: mysql:5.6
Image ID: docker-pullable://mysql@sha256:51d59639d9a864ec302008c81d6909c532eff8b946993ef6448c086ba7917e82
Port: <none>
Host Port: <none>
State: Running
Started: Sun, 27 Dec 2020 01:34:42 +0800
Ready: True
Restart Count: 0
Environment:
MYSQL_ROOT_PASSWORD: <set to the key 'passwd' in secret 'mysql-auth'> Optional: false
Mounts:
/var/run/secrets/kubernetes.io/serviceaccount from default-token-xvd4c (ro)
Conditions:
Type Status
Initialized True
Ready True
ContainersReady True
PodScheduled True
Volumes:
default-token-xvd4c:
Type: Secret (a volume populated by a Secret)
SecretName: default-token-xvd4c
Optional: false
QoS Class: BestEffort
Node-Selectors: <none>
Tolerations: node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal Scheduled 50s default-scheduler Successfully assigned default/mysql-demo to node03.k8s.org
Normal Pulling 49s kubelet Pulling image "mysql:5.6"
Normal Pulled 18s kubelet Successfully pulled image "mysql:5.6" in 30.561208525s
Normal Created 18s kubelet Created container mysql-demo
Normal Started 18s kubelet Started container mysql-demo
[root@master01 ~]#
提示：可以看到对应容器已经正常处于running状态，并在其详细信息中看到对应环境变量MYSQL_ROOT_PASSWORD引用secret中的passwd键；
测试：进入mysql-demo的交互式接口，看看使用创建secret时使用的passwd键传递的密码是否可以正常登录到mysql系统？
[root@master01 ~]# kubectl exec -it mysql-demo -- /bin/sh # mysql ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO) # mysql -padmin Warning: Using a password on the command line interface can be insecure. Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 2 Server version: 5.6.50 MySQL Community Server (GPL) Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved. Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. mysql> show databases; +--------------------+ | Database | +--------------------+ | information_schema | | mysql | | performance_schema | +--------------------+ 3 rows in set (0.00 sec) mysql> exit Bye #
提示：可以看到直接在容器交互式接口直接不使用密码是不能正常登录到mysql数据库；使用正确的密码后能够正常进入mysql；其实我们在交互式接口上查看环境变量也能查看到对应的环境变量的信息；如下
使用create命令创建tls类型的secret资源对象语法格式
Usage: kubectl create secret tls NAME --cert=path/to/cert/file --key=path/to/key/file [--dry-run=server|client|none] [options]
示例：使用create命令创建tls类型的secret资源对象
[root@master01 manifests]# kubectl create secret tls test-tls --cert=./tls.crt --key=./tls.key
secret/test-tls created
[root@master01 manifests]# kubectl get secret
NAME TYPE DATA AGE
default-token-xvd4c kubernetes.io/service-account-token 3 18d
docker-registry.io kubernetes.io/dockerconfigjson 1 65m
mysql-auth Opaque 2 28m
test-tls kubernetes.io/tls 2 10s
www-myapp-com-ingress-secret kubernetes.io/tls 2 4d23h
[root@master01 manifests]# kubectl describe secret test-tls
Name: test-tls
Namespace: default
Labels: <none>
Annotations: <none>
Type: kubernetes.io/tls
Data
====
tls.crt: 1285 bytes
tls.key: 1679 bytes
[root@master01 manifests]# kubectl get secret test-tls -o yaml
apiVersion: v1
data:
tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURoekNDQW0rZ0F3SUJBZ0lKQU4wS2RzTWpIMlNYTUEwR0NTcUdTSWIzRFFFQkN3VUFNRm94Q3pBSkJnTlYKQkFZVEFrTk9NUkF3RGdZRFZRUUlEQWRUYVVOb2RXRnVNUkl3RUFZRFZRUUhEQWxIZFdGdVoxbDFZVzR4RFRBTApCZ05WQkFvTUJGUmxjM1F4RmpBVUJnTlZCQU1NRFhkM2R5NXRlV0Z3Y0M1amIyMHdIaGNOTWpBeE1qSXhNVGMxCk5ETTNXaGNOTXpBeE1qRTVNVGMxTkRNM1dqQmFNUXN3Q1FZRFZRUUdFd0pEVGpFUU1BNEdBMVVFQ0F3SFUybEQKYUhWaGJqRVNNQkFHQTFVRUJ3d0pSM1ZoYm1kWmRXRnVNUTB3Q3dZRFZRUUtEQVJVWlhOME1SWXdGQVlEVlFRRApEQTEzZDNjdWJYbGhjSEF1WTI5dE1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBCnV0ek51djNFd0JRRjAvaHY4T2M3eGZzVUZIRG80cm5nYlV5Ym1UTVd6WkVONER3QTlCeVhvUk8rMUFOR0h0cXMKTTk4MUpJM3N5R21uMTV1Q1N5YTRlMjNIOEZrRVcveFh4VzNVMXZoRmxpRlB3NFgxM0ZRTno5TGJqUDdmbHBOTwpRRzZKVm1nYUNyZFp1TlFnbzFJSG1ocmFFWHV6VStTVkYzVXh1MHd3OUNRZmsxcG82N0NiN0FNRlRMa25QbUhJCndpbHpEK1dYeUtyV3NjRDBQZ2gzTTV1QnBENTJuNURsOHpWZDJiSFlSZGdIUm90dTJTTnBwcmtlVjlzSGxlamUKazVlMDRHZHNhV2pkaGJwMDcrWnBYMmhLVkhBMWJYUnplWG03TjE4ZTQ2elNPaEdydW0xYUtEZUNGd1BPbFZhUAovdEhrbmxleVM0NGNqTFk5Q21CSS93SURBUUFCbzFBd1RqQWRCZ05WSFE0RUZnUVVzU1N0OVJSZ083OFRCclBPCjR3UndVMGJlWlBJd0h3WURWUjBqQkJnd0ZvQVVzU1N0OVJSZ083OFRCclBPNHdSd1UwYmVaUEl3REFZRFZSMFQKQkFVd0F3RUIvekFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBWEJQNUx1ZzVlNGJUbVl3Q2w0ckIyK2k4VWx5dQpZbmZrdmRKQjgvWlFKWXNEdGgwQ0xGWEdHeWdId1ZoWWRYT01jSnB3MkNVbUNsakVwUk9Cb09kNGpvd0pBTHBJClhxUHMvQmJ2aDNCd3B6OFd3S3c1cUd6NmRDTGNmU2ZMV0Q3dkRBVVd2c3UvV1VGQjVpVVlKcmcrRlpwNnBQVTcKeFdpMUtic3piM3BmNkorWFJ0MlpZeDVYMlpHdTQyb2FmcDd3Z1hzS0l0UG9nNmdjQ0d6Z1JXQUFzcHhPOFFRYwpKY1dOZXYwSFAzdVViWG9SbUV2S1NXY3dTcnlhZTVuUGlaRjVkaCtHRys2TktpdnJBR0RkMTVzZzlGZHkzVDl6CkRkWVVmTkhGYlU5TUh6djE1NEtxNFVVZ1ZSbTk2Y2krdFhuYUdtMzJNcVFkZVUvcVVReEtnZ2VMMmc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBdXR6TnV2M0V3QlFGMC9odjhPYzd4ZnNVRkhEbzRybmdiVXlibVRNV3paRU40RHdBCjlCeVhvUk8rMUFOR0h0cXNNOTgxSkkzc3lHbW4xNXVDU3lhNGUyM0g4RmtFVy94WHhXM1UxdmhGbGlGUHc0WDEKM0ZRTno5TGJqUDdmbHBOT1FHNkpWbWdhQ3JkWnVOUWdvMUlIbWhyYUVYdXpVK1NWRjNVeHUwd3c5Q1FmazFwbwo2N0NiN0FNRlRMa25QbUhJd2lsekQrV1h5S3JXc2NEMFBnaDNNNXVCcEQ1Mm41RGw4elZkMmJIWVJkZ0hSb3R1CjJTTnBwcmtlVjlzSGxlamVrNWUwNEdkc2FXamRoYnAwNytacFgyaEtWSEExYlhSemVYbTdOMThlNDZ6U09oR3IKdW0xYUtEZUNGd1BPbFZhUC90SGtubGV5UzQ0Y2pMWTlDbUJJL3dJREFRQUJBb0lCQVFDSmxsRUpFUmRRa3Eyago0UGFUZTc4Z1RIb0JmdzJLKzNBTEtuQWJRbW5VM0t4SjRnU1Z1WVBQLzVqdnhLVlp6SXNrK29ISHM1U1lFR3VjCkxvMm1SaEZxR0hBeVFXa2JUZGRXc0VNYU1kNFM1OTR5U2kyNG1FOC9LYk9zd25IaERmOTlJNmFONzhMVkJ5SFMKSEtjWGVpdk14VjZ4cHRKb3dCTWpIWkNMcDFNWVAwbW94ZGNxOFljQlhxYjJIL1plWUUyM0Z2U1pZclRIWHpUQQpIRjhUSUY3QTA4cVpiTHRJVXVHUUkyZ3JobS95TzRmN005NHJpWDI5Z29zUkZadVpRTUY2enRTUWxRRCs4QU8xCnduNGJ2MWdnNHZXaFcycElIcnE1MG5xZkdIR0tRSHBSeU5SbWV4aEliUzJNbzB5UmkzRFNhN2ZSdGhQU0VuWFMKTGdXTFkyaXhBb0dCQU8yd280MjZhVmlDWmUrY3RmNk9YaklQSC9zMGJyNUpjSk92WEgzZHRxeldHdVVlSlRyUwpiWVg4V0oyWXA5c3VPSTk4dUFSRkY4RWNvc25CdzNjSER4NEZ4Skp4blMrUm1ZcGlnNmtNUFVqbmh1MENxcE9HCktPYTV6MVgvUnR0SVRhMlJHeHkxdjdHMHlQTHA3NVhhQTUrYjMvM1RKMDY0ZzQzMThadjZNMEEzQW9HQkFNbEIKMG9YY1BRcGpWdVZWRVFvMmhjUVZOSWw4Qno2SjErQ0o3WUVKZGhLekxYdVdteithMVhtQ0xQcW9wKzVaM0VqMwpiMTFSanRKSHdzQUJ4eGV4QjZDUTlyZ3ZNYk53bitqQkxINmFSRTJaRkZsK0k0T243NGNKbE1la2UrUTB2bEhpCmtNNE94dGZDYkZDNWoyYVowOFJ2SDJob0p5MG9ubEpuWjQvM3d3bDVBb0dBU0FSNk9jb2VleXZmV08rQmtTUnYKMC9rVE5walhhUjUxVnJvT2F6Q1BWZVQxZHpCZ0ZXZUd1YzhReG9kbmJKaWZtSkl3YTFMSDlNSUpiTm9oc0dIYQpLYjJUcHM5MzBkN3F4Nnc3dWkrMExlL0F5UFZDMjdvTmtJTUNHRXRsbTdGWG45eFVlNmx4OEpVWFFjcXh4aFN0CmZtSExSMnYvLy9FV0l5QSsyWVRBbkpjQ2dZQVFnTU5Ba3NTMm0xcSt4M0QwUTNCSW1leUs4WTZ1aENNZG1ISFAKU1BWVHB6bXRqcllBU3pRQ0dMaVRmVXozOElwdHVVeDZmSHVYcHFiRGsrRzlnWmk4ZythWFI5ZHRmV2kvYjBlMAp3ZldqMzArWjN3d09lYkRjZzk2ZFdGR0lid0xFT0Mzamw3YWFicWp2SGFneW81Nkgxd3plUk53aGlka2hyTFVEClN5L0ZFUUtCZ1FDU2dSaCtzaFJYdFBzV2VPVi92c1pVVEY0YTRSejBaMmhoNFpVNnpLU1M2bzRPZlZiSHJjNTQKQ3FIZVpHTEc5ampLQm15WEZ2cE5rdk9qZnhvOUVZSklrODAwRlZybzFWbU4xcFVNUmphK25LSWpveFlBU2ZQdApVWjBVcGJyTFk4MVdsYUZPWStPQmFFdzhpVXZwb2E1S2VLSXVZOVVDU3lLOUR4YTRIZXI0dFE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
kind: Secret
metadata:
creationTimestamp: "2020-12-26T17:46:00Z"
managedFields:
- apiVersion: v1
fieldsType: FieldsV1
fieldsV1:
f:data:
.: {}
f:tls.crt: {}
f:tls.key: {}
f:type: {}
manager: kubectl-create
operation: Update
time: "2020-12-26T17:46:00Z"
name: test-tls
namespace: default
resourceVersion: "399079"
uid: 67fb9062-56b4-4900-bab6-45ea35b75a09
type: kubernetes.io/tls
[root@master01 manifests]#
提示：创建tls类型的secret资源对象时，只需要指定其名称和对应的证书和私钥文件即可；这里需要注意一点，不管外部证书和私钥是什么名字，在tls类型的secret资源对象中都叫tls.crt和tls.key；它会自动映射为这两个名字；
示例：定义pod挂载secret存储卷
[root@master01 ~]# cat mount-secretvolume.yaml
apiVersion: v1
kind: Pod
metadata:
name: test-pod
namespace: default
spec:
containers:
- name: nginx
image: nginx:1.14-alpine
volumeMounts:
- name: test-tls-secret
mountPath: /etc/nginx/cert/
volumes:
- name: test-tls-secret
secret:
secretName: test-tls
items:
- key: tls.crt
path: test.crt
mode: 0400
- key: tls.key
path: test.key
mode: 0400
[root@master01 ~]#
应用资源清单
[root@master01 ~]# kubectl apply -f mount-secretvolume.yaml
pod/test-pod created
[root@master01 ~]# kubectl get pods -w
NAME READY STATUS RESTARTS AGE
mysql-demo 1/1 Running 0 23m
test-nginx 1/1 Running 0 53m
test-pod 1/1 Running 0 6s
^C[root@master01 ~]# kubectl describe pod test-pod
Name: test-pod
Namespace: default
Priority: 0
Node: node04.k8s.org/192.168.0.47
Start Time: Sun, 27 Dec 2020 01:57:54 +0800
Labels: <none>
Annotations: <none>
Status: Running
IP: 10.244.4.25
IPs:
IP: 10.244.4.25
Containers:
nginx:
Container ID: docker://4ec25999d3813cebe9c7a78c3ffa6b5d282f730c56c88454b08c08b1e7f7a3a7
Image: nginx:1.14-alpine
Image ID: docker-pullable://nginx@sha256:485b610fefec7ff6c463ced9623314a04ed67e3945b9c08d7e53a47f6d108dc7
Port: <none>
Host Port: <none>
State: Running
Started: Sun, 27 Dec 2020 01:57:55 +0800
Ready: True
Restart Count: 0
Environment: <none>
Mounts:
/etc/nginx/cert/ from test-tls-secret (rw)
/var/run/secrets/kubernetes.io/serviceaccount from default-token-xvd4c (ro)
Conditions:
Type Status
Initialized True
Ready True
ContainersReady True
PodScheduled True
Volumes:
test-tls-secret:
Type: Secret (a volume populated by a Secret)
SecretName: test-tls
Optional: false
default-token-xvd4c:
Type: Secret (a volume populated by a Secret)
SecretName: default-token-xvd4c
Optional: false
QoS Class: BestEffort
Node-Selectors: <none>
Tolerations: node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal Scheduled 20s default-scheduler Successfully assigned default/test-pod to node04.k8s.org
Normal Pulled 19s kubelet Container image "nginx:1.14-alpine" already present on machine
Normal Created 19s kubelet Created container nginx
Normal Started 19s kubelet Started container nginx
[root@master01 ~]#
提示：可以看到对应容器已经将对应secret存储卷以读写方式挂载至/etc/nginx/cert/目录；
验证：进入test-pod交互式接口，看看对应目录下是否有对应的文件呢？
[root@master01 ~]# kubectl exec -it test-pod -- /bin/sh / # cd /etc/nginx/ /etc/nginx # ls cert fastcgi_params.default modules uwsgi_params conf.d koi-utf nginx.conf uwsgi_params.default fastcgi.conf koi-win nginx.conf.default win-utf fastcgi.conf.default mime.types scgi_params fastcgi_params mime.types.default scgi_params.default /etc/nginx # ls cert test.crt test.key /etc/nginx # cat cert/test.crt -----BEGIN CERTIFICATE----- MIIDhzCCAm+gAwIBAgIJAN0KdsMjH2SXMA0GCSqGSIb3DQEBCwUAMFoxCzAJBgNV BAYTAkNOMRAwDgYDVQQIDAdTaUNodWFuMRIwEAYDVQQHDAlHdWFuZ1l1YW4xDTAL BgNVBAoMBFRlc3QxFjAUBgNVBAMMDXd3dy5teWFwcC5jb20wHhcNMjAxMjIxMTc1 NDM3WhcNMzAxMjE5MTc1NDM3WjBaMQswCQYDVQQGEwJDTjEQMA4GA1UECAwHU2lD aHVhbjESMBAGA1UEBwwJR3VhbmdZdWFuMQ0wCwYDVQQKDARUZXN0MRYwFAYDVQQD DA13d3cubXlhcHAuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA utzNuv3EwBQF0/hv8Oc7xfsUFHDo4rngbUybmTMWzZEN4DwA9ByXoRO+1ANGHtqs M981JI3syGmn15uCSya4e23H8FkEW/xXxW3U1vhFliFPw4X13FQNz9LbjP7flpNO QG6JVmgaCrdZuNQgo1IHmhraEXuzU+SVF3Uxu0ww9CQfk1po67Cb7AMFTLknPmHI wilzD+WXyKrWscD0Pgh3M5uBpD52n5Dl8zVd2bHYRdgHRotu2SNpprkeV9sHleje k5e04GdsaWjdhbp07+ZpX2hKVHA1bXRzeXm7N18e46zSOhGrum1aKDeCFwPOlVaP /tHknleyS44cjLY9CmBI/wIDAQABo1AwTjAdBgNVHQ4EFgQUsSSt9RRgO78TBrPO 4wRwU0beZPIwHwYDVR0jBBgwFoAUsSSt9RRgO78TBrPO4wRwU0beZPIwDAYDVR0T BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAXBP5Lug5e4bTmYwCl4rB2+i8Ulyu YnfkvdJB8/ZQJYsDth0CLFXGGygHwVhYdXOMcJpw2CUmCljEpROBoOd4jowJALpI XqPs/Bbvh3Bwpz8WwKw5qGz6dCLcfSfLWD7vDAUWvsu/WUFB5iUYJrg+FZp6pPU7 xWi1Kbszb3pf6J+XRt2ZYx5X2ZGu42oafp7wgXsKItPog6gcCGzgRWAAspxO8QQc JcWNev0HP3uUbXoRmEvKSWcwSryae5nPiZF5dh+GG+6NKivrAGDd15sg9Fdy3T9z DdYUfNHFbU9MHzv154Kq4UUgVRm96ci+tXnaGm32MqQdeU/qUQxKggeL2g== -----END CERTIFICATE----- /etc/nginx # cat cert/test.key -----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCAQEAutzNuv3EwBQF0/hv8Oc7xfsUFHDo4rngbUybmTMWzZEN4DwA 9ByXoRO+1ANGHtqsM981JI3syGmn15uCSya4e23H8FkEW/xXxW3U1vhFliFPw4X1 3FQNz9LbjP7flpNOQG6JVmgaCrdZuNQgo1IHmhraEXuzU+SVF3Uxu0ww9CQfk1po 67Cb7AMFTLknPmHIwilzD+WXyKrWscD0Pgh3M5uBpD52n5Dl8zVd2bHYRdgHRotu 2SNpprkeV9sHlejek5e04GdsaWjdhbp07+ZpX2hKVHA1bXRzeXm7N18e46zSOhGr um1aKDeCFwPOlVaP/tHknleyS44cjLY9CmBI/wIDAQABAoIBAQCJllEJERdQkq2j 4PaTe78gTHoBfw2K+3ALKnAbQmnU3KxJ4gSVuYPP/5jvxKVZzIsk+oHHs5SYEGuc Lo2mRhFqGHAyQWkbTddWsEMaMd4S594ySi24mE8/KbOswnHhDf99I6aN78LVByHS HKcXeivMxV6xptJowBMjHZCLp1MYP0moxdcq8YcBXqb2H/ZeYE23FvSZYrTHXzTA HF8TIF7A08qZbLtIUuGQI2grhm/yO4f7M94riX29gosRFZuZQMF6ztSQlQD+8AO1 wn4bv1gg4vWhW2pIHrq50nqfGHGKQHpRyNRmexhIbS2Mo0yRi3DSa7fRthPSEnXS LgWLY2ixAoGBAO2wo426aViCZe+ctf6OXjIPH/s0br5JcJOvXH3dtqzWGuUeJTrS bYX8WJ2Yp9suOI98uARFF8EcosnBw3cHDx4FxJJxnS+RmYpig6kMPUjnhu0CqpOG KOa5z1X/RttITa2RGxy1v7G0yPLp75XaA5+b3/3TJ064g4318Zv6M0A3AoGBAMlB 0oXcPQpjVuVVEQo2hcQVNIl8Bz6J1+CJ7YEJdhKzLXuWmz+a1XmCLPqop+5Z3Ej3 b11RjtJHwsABxxexB6CQ9rgvMbNwn+jBLH6aRE2ZFFl+I4On74cJlMeke+Q0vlHi kM4OxtfCbFC5j2aZ08RvH2hoJy0onlJnZ4/3wwl5AoGASAR6OcoeeyvfWO+BkSRv 0/kTNpjXaR51VroOazCPVeT1dzBgFWeGuc8QxodnbJifmJIwa1LH9MIJbNohsGHa Kb2Tps930d7qx6w7ui+0Le/AyPVC27oNkIMCGEtlm7FXn9xUe6lx8JUXQcqxxhSt fmHLR2v///EWIyA+2YTAnJcCgYAQgMNAksS2m1q+x3D0Q3BImeyK8Y6uhCMdmHHP SPVTpzmtjrYASzQCGLiTfUz38IptuUx6fHuXpqbDk+G9gZi8g+aXR9dtfWi/b0e0 wfWj30+Z3wwOebDcg96dWFGIbwLEOC3jl7aabqjvHagyo56H1wzeRNwhidkhrLUD Sy/FEQKBgQCSgRh+shRXtPsWeOV/vsZUTF4a4Rz0Z2hh4ZU6zKSS6o4OfVbHrc54 CqHeZGLG9jjKBmyXFvpNkvOjfxo9EYJIk800FVro1VmN1pUMRja+nKIjoxYASfPt UZ0UpbrLY81WlaFOY+OBaEw8iUvpoa5KeKIuY9UCSyK9Dxa4Her4tQ== -----END RSA PRIVATE KEY----- /etc/nginx #
提示：可以看到在test-pod容器对应的/etc/nginx/目录下自动创建了一个cert目录，并在其目录下看到有两个证书文件，一个名为test.crt，一个名为test.key；这两个名字都是我们在pod资源清单中指定的名称；
示例：使用资源清单创建secret资源
[root@master01 ~]# cat test-secret.yaml apiVersion: v1 kind: Secret metadata: name: test-secret-demo namespace: default data: name: cWl1aG9tCg== passwd: YWRtaW4xMjMuY29tCg== type: Opaque [root@master01 ~]#
提示：使用资源清单方式创建secret时，data字段是定义对应的kv配置信息，需要事先将其对应的值转换为base64编码；type是用来指定对应secret的类型，这个字段有四个值，分别是Opaque 、kubernetes.io/dockerconfigjson、kubernetes.io/tls、kubernetes.io/service-account-token；
应用资源清单
[root@master01 ~]# kubectl apply -f test-secret.yaml
secret/test-secret-demo created
[root@master01 ~]# kubectl get secret
NAME TYPE DATA AGE
default-token-xvd4c kubernetes.io/service-account-token 3 18d
docker-registry.io kubernetes.io/dockerconfigjson 1 107m
mysql-auth Opaque 2 70m
test-secret-demo Opaque 2 19s
test-tls kubernetes.io/tls 2 42m
www-myapp-com-ingress-secret kubernetes.io/tls 2 5d
[root@master01 ~]# kubectl describe secret test-secret-demo
Name: test-secret-demo
Namespace: default
Labels: <none>
Annotations: <none>
Type: Opaque
Data
====
name: 7 bytes
passwd: 13 bytes
[root@master01 ~]#kubectl get secret test-secret-demo -o yaml
apiVersion: v1
data:
name: cWl1aG9tCg==
passwd: YWRtaW4xMjMuY29tCg==
kind: Secret
metadata:
annotations:
kubectl.kubernetes.io/last-applied-configuration: |
{"apiVersion":"v1","data":{"name":"cWl1aG9tCg==","passwd":"YWRtaW4xMjMuY29tCg=="},"kind":"Secret","metadata":{"annotations":{},"name":"test-secret-demo","namespace":"default"},"type":"Opaque"}
creationTimestamp: "2020-12-26T18:28:19Z"
managedFields:
- apiVersion: v1
fieldsType: FieldsV1
fieldsV1:
f:data:
.: {}
f:name: {}
f:passwd: {}
f:metadata:
f:annotations:
.: {}
f:kubectl.kubernetes.io/last-applied-configuration: {}
f:type: {}
manager: kubectl-client-side-apply
operation: Update
time: "2020-12-26T18:28:19Z"
name: test-secret-demo
namespace: default
resourceVersion: "403480"
uid: 95aecff5-7f78-4f16-908f-61deb56f8c53
type: Opaque
[root@master01 ~]#
示例：使用stringData字段来指定数据
[root@master01 ~]# cat test1-secret.yaml apiVersion: v1 kind: Secret metadata: name: test-secret-demo1 namespace: default stringData: name: qiuhom passwd: admin123.com type: Opaque [root@master01 ~]#
提示：使用stringData字段来指定kv配置信息，可以不用将对应数据编码为base64格式；它会在创建secret时，自动将其转化为base64编码格式，存放在data字段中；
应用配置清单
[root@master01 ~]# kubectl apply -f test1-secret.yaml
secret/test-secret-demo1 created
[root@master01 ~]# kubectl get secret
NAME TYPE DATA AGE
default-token-xvd4c kubernetes.io/service-account-token 3 18d
docker-registry.io kubernetes.io/dockerconfigjson 1 117m
mysql-auth Opaque 2 79m
test-secret-demo Opaque 2 9m40s
test-secret-demo1 Opaque 2 11s
test-tls kubernetes.io/tls 2 51m
www-myapp-com-ingress-secret kubernetes.io/tls 2 5d
[root@master01 ~]# kubectl get secret test-secret-demo1 -o yaml
apiVersion: v1
data:
name: cWl1aG9t
passwd: YWRtaW4xMjMuY29t
kind: Secret
metadata:
annotations:
kubectl.kubernetes.io/last-applied-configuration: |
{"apiVersion":"v1","kind":"Secret","metadata":{"annotations":{},"name":"test-secret-demo1","namespace":"default"},"stringData":{"name":"qiuhom","passwd":"admin123.com"},"type":"Opaque"}
creationTimestamp: "2020-12-26T18:37:48Z"
managedFields:
- apiVersion: v1
fieldsType: FieldsV1
fieldsV1:
f:data:
.: {}
f:name: {}
f:passwd: {}
f:metadata:
f:annotations:
.: {}
f:kubectl.kubernetes.io/last-applied-configuration: {}
f:type: {}
manager: kubectl-client-side-apply
operation: Update
time: "2020-12-26T18:37:48Z"
name: test-secret-demo1
namespace: default
resourceVersion: "404463"
uid: 718d1306-43af-40cb-9a56-6177205be5c4
type: Opaque
[root@master01 ~]# kubectl describe secret test-secret-demo1
Name: test-secret-demo1
Namespace: default
Labels: <none>
Annotations: <none>
Type: Opaque
Data
====
name: 6 bytes
passwd: 12 bytes
[root@master01 ~]#
提示：stringData字段不会被apiserver输出，它将stringData字段信息以base64编码格式存储在data字段中给予显示；但是将对应secret输出为yaml格式时，在对应的注解信息中能够看到对应stringData的信息；
作者：Linux-1874
本文版权归作者和博客园共有，欢迎转载，但未经作者同意必须保留此段声明，且在文章页面明显位置给出原文连接，否则保留追究法律责任的权利.
