159 lines
3.9 KiB
Markdown
159 lines
3.9 KiB
Markdown
# Secret
|
||
|
||
Secret 解决了密码、token、密钥等敏感数据的配置问题，而不需要把这些敏感数据暴露到镜像或者 Pod Spec 中。Secret 可以以 Volume 或者环境变量的方式使用。
|
||
|
||
Secret 有三种类型：
|
||
|
||
- **Service Account** ：用来访问 Kubernetes API，由 Kubernetes 自动创建，并且会自动挂载到 Pod 的 `/run/secrets/kubernetes.io/serviceaccount` 目录中；
|
||
- **Opaque** ：base64 编码格式的 Secret，用来存储密码、密钥等；
|
||
- **kubernetes.io/dockerconfigjson** ：用来存储私有 docker registry 的认证信息。
|
||
|
||
## Opaque Secret
|
||
|
||
Opaque 类型的数据是一个 map 类型，要求 value 是 base64 编码格式：
|
||
|
||
```sh
|
||
$ echo -n "admin" | base64
|
||
YWRtaW4=
|
||
$ echo -n "1f2d1e2e67df" | base64
|
||
MWYyZDFlMmU2N2Rm
|
||
```
|
||
|
||
secrets.yml
|
||
|
||
```yaml
|
||
apiVersion: v1
|
||
kind: Secret
|
||
metadata:
|
||
name: mysecret
|
||
type: Opaque
|
||
data:
|
||
password: MWYyZDFlMmU2N2Rm
|
||
username: YWRtaW4=
|
||
```
|
||
|
||
接着，就可以创建 secret 了：`kubectl create -f secrets.yml`。
|
||
|
||
创建好 secret 之后，有两种方式来使用它：
|
||
|
||
- 以 Volume 方式
|
||
- 以环境变量方式
|
||
|
||
### 将 Secret 挂载到 Volume 中
|
||
|
||
```yaml
|
||
apiVersion: v1
|
||
kind: Pod
|
||
metadata:
|
||
labels:
|
||
name: db
|
||
name: db
|
||
spec:
|
||
volumes:
|
||
- name: secrets
|
||
secret:
|
||
secretName: mysecret
|
||
containers:
|
||
- image: gcr.io/my_project_id/pg:v1
|
||
name: db
|
||
volumeMounts:
|
||
- name: secrets
|
||
mountPath: "/etc/secrets"
|
||
readOnly: true
|
||
ports:
|
||
- name: cp
|
||
containerPort: 5432
|
||
hostPort: 5432
|
||
```
|
||
|
||
### 将 Secret 导出到环境变量中
|
||
|
||
```yaml
|
||
apiVersion: extensions/v1beta1
|
||
kind: Deployment
|
||
metadata:
|
||
name: wordpress-deployment
|
||
spec:
|
||
replicas: 2
|
||
strategy:
|
||
type: RollingUpdate
|
||
template:
|
||
metadata:
|
||
labels:
|
||
app: wordpress
|
||
visualize: "true"
|
||
spec:
|
||
containers:
|
||
- name: "wordpress"
|
||
image: "wordpress"
|
||
ports:
|
||
- containerPort: 80
|
||
env:
|
||
- name: WORDPRESS_DB_USER
|
||
valueFrom:
|
||
secretKeyRef:
|
||
name: mysecret
|
||
key: username
|
||
- name: WORDPRESS_DB_PASSWORD
|
||
valueFrom:
|
||
secretKeyRef:
|
||
name: mysecret
|
||
key: password
|
||
```
|
||
|
||
## kubernetes.io/dockerconfigjson
|
||
|
||
可以直接用 `kubectl` 命令来创建用于 docker registry 认证的 secret：
|
||
|
||
```sh
|
||
$ kubectl create secret docker-registry myregistrykey --docker-server=DOCKER_REGISTRY_SERVER --docker-username=DOCKER_USER --docker-password=DOCKER_PASSWORD --docker-email=DOCKER_EMAIL
|
||
secret "myregistrykey" created.
|
||
```
|
||
|
||
也可以直接读取 `~/.docker/config.json` 的内容来创建：
|
||
|
||
```sh
|
||
$ cat ~/.docker/config.json | base64
|
||
$ cat > myregistrykey.yaml <<EOF
|
||
apiVersion: v1
|
||
kind: Secret
|
||
metadata:
|
||
name: myregistrykey
|
||
data:
|
||
.dockerconfigjson: UmVhbGx5IHJlYWxseSByZWVlZWVlZWVlZWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGx5eXl5eXl5eXl5eXl5eXl5eXl5eSBsbGxsbGxsbGxsbGxsbG9vb29vb29vb29vb29vb29vb29vb29vb29vb25ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubmdnZ2dnZ2dnZ2dnZ2dnZ2dnZ2cgYXV0aCBrZXlzCg==
|
||
type: kubernetes.io/dockerconfigjson
|
||
EOF
|
||
$ kubectl create -f myregistrykey.yaml
|
||
```
|
||
|
||
在创建 Pod 的时候，通过 `imagePullSecrets` 来引用刚创建的 `myregistrykey`:
|
||
|
||
```yaml
|
||
apiVersion: v1
|
||
kind: Pod
|
||
metadata:
|
||
name: foo
|
||
spec:
|
||
containers:
|
||
- name: foo
|
||
image: janedoe/awesomeapp:v1
|
||
imagePullSecrets:
|
||
- name: myregistrykey
|
||
```
|
||
|
||
### Service Account
|
||
|
||
Service Account 用来访问 Kubernetes API，由 Kubernetes 自动创建，并且会自动挂载到 Pod 的 `/run/secrets/kubernetes.io/serviceaccount` 目录中。
|
||
|
||
```sh
|
||
$ kubectl run nginx --image nginx
|
||
deployment "nginx" created
|
||
$ kubectl get pods
|
||
NAME READY STATUS RESTARTS AGE
|
||
nginx-3137573019-md1u2 1/1 Running 0 13s
|
||
$ kubectl exec nginx-3137573019-md1u2 ls /run/secrets/kubernetes.io/serviceaccount
|
||
ca.crt
|
||
namespace
|
||
token
|
||
```
|