k8s快速入门教程8secretandconfigmap

上一篇: k8s快速入门教程-----7 数据管理

8.1 secret

Secret会以密文的方式存储数据&＃xff0c;避免了直接在配置文件中保存敏感信息。Secret 会以Volume的形式被mount 到Pod,容器可通过文件的方式使用Secret 中的敏感数据;此外&＃xff0c;容器也可以环境变量的方式使用这些数据。Secret可通过命令行或YAML创建。比如希望Secret 中包含如下信息:用户名admin, 密码123456。以下2种效果是一样的。

8.1.1 创建secret

8.1.1.1 通过–from-env-file

创建密钥文件

cat <> env.txt
root_password&＃61;21vianet
database&＃61;wangjinxiong
databaseuser&＃61;wangjinxiong
datapassword&＃61;123456
EOF


直接执行以下命令&＃xff0c;生成的secret数据value值会自动加密。

kubectl create secret generic mysecret0913 --from-env-file&＃61;env.txt


查看k8S相关secret信息&＃xff1a;

# kubectl get secret mysecret0913 -oyaml
apiVersion: v1
data:database: d2FuZ2ppbnhpb25ndatabaseuser: d2FuZ2ppbnhpb25ndatapassword: MTIzNDU2root_password: MjF2aWFuZXQ&＃61;
kind: Secret
metadata:creationTimestamp: "2022-09-13T08:38:05Z"name: mysecret0913namespace: defaultresourceVersion: "129446914"selfLink: /api/v1/namespaces/default/secrets/mysecret0913uid: 5fc183df-740b-48f1-a77e-a3efadf7c32b
type: Opaque


绑定pod&＃xff1a;

# cat mysql0913.yaml
kind: Pod
apiVersion: v1
metadata:name: mysql0913labels:app: mysql0913
spec:containers:- name: mysql0913image: mysqlports:- name: tcp-3306containerPort: 3306protocol: TCPenv:- name: MYSQL_ROOT_PASSWORDvalueFrom:secretKeyRef:name: mysecret0913key: root_password- name: MYSQL_DATABASEvalueFrom:secretKeyRef:name: mysecret0913key: database- name: MYSQL_USERvalueFrom:secretKeyRef:name: mysecret0913key: databaseuser- name: MYSQL_PASSWORDvalueFrom:secretKeyRef:name: mysecret0913key: datapasswordimagePullPolicy: IfNotPresentrestartPolicy: Always


8.1.1.2 通过yaml创建

value如果需要加密&＃xff0c;需要手动用base64操作&＃xff1a;

# echo -n 21vianet | base64
MjF2aWFuZXQ&＃61;
#echo -n wangjinxiong | base64
d2FuZ2ppbnhpb25n
# echo -n 123456 | base64
MTIzNDU2


直接创建secret后用kubectl apply -f secret0913.yaml

vi secret0913.yaml
apiVersion: v1
kind: Secret
metadata:name: mysecret0913namespace: default
data:database: d2FuZ2ppbnhpb25ndatabaseuser: d2FuZ2ppbnhpb25ndatapassword: MTIzNDU2root_password: MjF2aWFuZXQ&＃61;kubectl apply -f secret0913.yaml


绑定pod:

# cat mysql0913.yaml
kind: Pod
apiVersion: v1
metadata:name: mysql0913labels:app: mysql0913
spec:containers:- name: mysql0913image: mysqlports:- name: tcp-3306containerPort: 3306protocol: TCPenv:- name: MYSQL_ROOT_PASSWORDvalueFrom:secretKeyRef:name: mysecret0913key: root_password- name: MYSQL_DATABASEvalueFrom:secretKeyRef:name: mysecret0913key: database- name: MYSQL_USERvalueFrom:secretKeyRef:name: mysecret0913key: databaseuser- name: MYSQL_PASSWORDvalueFrom:secretKeyRef:name: mysecret0913key: datapasswordimagePullPolicy: IfNotPresentrestartPolicy: Always


8.1.2 在pod里面使用secret

8.1.2.1 环境变量方式

创建一个pod绑定secret。

kind: Pod
apiVersion: v1
metadata:name: mysql0913labels:app: mysql0913
spec:containers:- name: mysql0913image: mysqlports:- name: tcp-3306containerPort: 3306protocol: TCPenv:- name: MYSQL_ROOT_PASSWORDvalueFrom:secretKeyRef:name: mysecret0913key: root_password- name: MYSQL_DATABASEvalueFrom:secretKeyRef:name: mysecret0913key: database- name: MYSQL_USERvalueFrom:secretKeyRef:name: mysecret0913key: databaseuser- name: MYSQL_PASSWORDvalueFrom:secretKeyRef:name: mysecret0913key: datapasswordimagePullPolicy: IfNotPresentrestartPolicy: Always


8.1.1.1 与8.1.1.2 2种方式均可以正常进入数据库&＃xff1a;

# kubectl exec -it mysql0913 /bin/bash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
root&＃64;mysql0913:/# mysql -uroot -p21vianet
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 8
Server version: 8.0.27 MySQL Community Server - GPLCopyright (c) 2000, 2021, Oracle and/or its affiliates.Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.Type &＃39;help;&＃39; or &＃39;\h&＃39; for help. Type &＃39;\c&＃39; to clear the current input statement.mysql> show databases;
&＃43;--------------------&＃43;
| Database |
&＃43;--------------------&＃43;
| information_schema |
| mysql |
| performance_schema |
| sys |
| wangjinxiong |
&＃43;--------------------&＃43;
5 rows in set (0.03 sec)mysql> quit
Bye
root&＃64;mysql0913:/# mysql -uwangjinxiong -p123456
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 9
Server version: 8.0.27 MySQL Community Server - GPLCopyright (c) 2000, 2021, Oracle and/or its affiliates.Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.Type &＃39;help;&＃39; or &＃39;\h&＃39; for help. Type &＃39;\c&＃39; to clear the current input statement.mysql> show databases;
&＃43;--------------------&＃43;
| Database |
&＃43;--------------------&＃43;
| information_schema |
| wangjinxiong |
&＃43;--------------------&＃43;
2 rows in set (0.01 sec)mysql>


8.1.2.2 volume方式

创建一个pod以volume绑定secret

kind: Pod
apiVersion: v1
metadata:name: busybox0914labels:app: busybox0914
spec:volumes:- name: mysecret0913secret:secretName: mysecret0913containers:- name: busybox0914image: busyboximagePullPolicy: IfNotPresentargs:- /bin/sh- -c- sleep 10;touch /tmp/healthy;sleep 30000volumeMounts:- name: mysecret0913mountPath: "/etc/foo"readOnly: truerestartPolicy: Always


登录pod:

# kubectl exec -it busybox0914 sh
/ # cat /etc/foo/database
wangjinxiong
/ # cat /etc/foo/databaseuser
wangjinxiong
/ # cat /etc/foo/datapassword
123456
/ # cat /etc/foo/root_password
21vianet
/ #

8.2 configmap

Secret可以为Pod 提供密码、Token、私钥等敏感数据;对于一些非敏感数据&＃xff0c;比如应用的配置信息&＃xff0c;则可以用ConfigMap。ConfigMap的创建和使用方式与Secret非常类似&＃xff0c;主要的不同是数据以明文的形式存放。ConfigMap 一般用于下面2种方式&＃xff0c;一种是环境变量传递&＃xff1b;一种是配置文件读写。

8.2.1 创建configmap

创建configmap文件

cat <> env.txt
root_password&＃61;21vianet
database&＃61;wangjinxiong
databaseuser&＃61;wangjinxiong
datapassword&＃61;123456
EOF


直接执行以下命令&＃xff0c;生成configmap

kubectl create configmap myconfigmap0914 --from-env-file&＃61;env.txt


查看configmap配置&＃xff0c;发觉以明文存放&＃xff1a;

# kubectl get configmap myconfigmap0914 -oyaml
apiVersion: v1
data:root_password: 21vianetdatabase: wangjinxiongdatabaseuser: wangjinxiongdatapassword: 123456
kind: ConfigMap
metadata:creationTimestamp: "2022-09-14T02:20:59Z"name: myconfigmap0914namespace: defaultresourceVersion: "129868649"selfLink: /api/v1/namespaces/default/configmaps/myconfigmap0914uid: 30ad8371-6267-4e06-8fab-bc7d86c840af


8.2.2 通过yaml创建

直接创建configmap后用kubectl apply -f myconfigmap0914.yaml

kind: ConfigMap
apiVersion: v1
metadata:name: myconfigmap1008
data:root_password: 21vianetdatabase: wangjinxiongdatabaseuser: wangjinxiongdatapassword: 123456


8.2.3 在pod里面使用configmap

8.2.3.1 环境变量方式

kind: Pod
apiVersion: v1
metadata:name: mysql0914labels:app: mysql0914
spec:volumes:- name: host-timehostPath:path: /etc/localtimetype: &＃39;&＃39;- name: myconfigmap0914configMap:name: myconfigmap0914containers:- name: mysql0914image: mysql:5.7ports:- name: tcp-3306containerPort: 3306protocol: TCPenv:- name: MYSQL_ROOT_PASSWORDvalueFrom:configMapKeyRef:name: myconfigmap0914key: root_password- name: MYSQL_DATABASEvalueFrom:configMapKeyRef:name: myconfigmap0914key: database- name: MYSQL_USERvalueFrom:configMapKeyRef:name: myconfigmap0914key: databaseuser- name: MYSQL_PASSWORDvalueFrom:configMapKeyRef:name: myconfigmap0914key: datapasswordvolumeMounts:- name: host-timereadOnly: truemountPath: /etc/localtimeimagePullPolicy: IfNotPresentrestartPolicy: Always


8.2.3.2 volume方式

volume方式一般用于服务的配置文件挂载。
创建文件&＃xff1a;

cat my.cnf
[mysqld]
pid-file &＃61; /var/run/mysqld/mysqld.pid
socket &＃61; /var/run/mysqld/mysqld.sock
datadir &＃61; /var/lib/mysql
secure-file-priv&＃61; NULL
# Disabling symbolic-links is recommended to prevent assorted security risks
symbolic-links&＃61;0# Custom config should go here
!includedir /etc/mysql/conf.d/default_authentication_plugin&＃61; mysql_native_password


创建configmap:

kubectl create configmap mysql-config0914 --from-file&＃61;my.cnf


创建deployment绑定configmap:

kind: Deployment
apiVersion: apps/v1
metadata:name: mysql0914labels:app: mysql0914
spec:replicas: 1selector:matchLabels:app: mysql0914template:metadata:labels:app: mysql0914spec:volumes:- name: host-timehostPath:path: /etc/localtimetype: &＃39;&＃39;- name: mysql-config0914configMap:name: mysql-config0914items:- key: my.cnfpath: my.cnfcontainers:- name: container0914image: &＃39;mysql:8.0&＃39;ports:- name: tcp-3306containerPort: 3306protocol: TCPenv:- name: MYSQL_ROOT_PASSWORDvalue: gtland2021volumeMounts:- name: host-timereadOnly: truemountPath: /etc/localtime- name: mysql-config0914subPath: my.cnfmountPath: /etc/mysql/my.cnfimagePullPolicy: IfNotPresent