一.系统环境

服务器版本 docker软件版本 Kubernetes(k8s)集群版本 CPU架构
CentOS Linux release 7.4.1708 (Core) Docker version 20.10.12 v1.21.9 x86_64

Kubernetes集群架构:k8scloude1作为master节点,k8scloude2,k8scloude3作为worker节点

服务器 操作系统版本 CPU架构 进程 功能描述
k8scloude1/192.168.110.130 CentOS Linux release 7.4.1708 (Core) x86_64 docker,kube-apiserver,etcd,kube-scheduler,kube-controller-manager,kubelet,kube-proxy,coredns,calico k8s master节点
k8scloude2/192.168.110.129 CentOS Linux release 7.4.1708 (Core) x86_64 docker,kubelet,kube-proxy,calico k8s worker节点
k8scloude3/192.168.110.128 CentOS Linux release 7.4.1708 (Core) x86_64 docker,kubelet,kube-proxy,calico k8s worker节点

二.前言

使用secret的前提是已经有一套可以正常运行的Kubernetes集群,关于Kubernetes(k8s)集群的安装部署,可以查看博客《Centos7 安装部署Kubernetes(k8s)集群》https://www.cnblogs.com/renshengdezheli/p/16686769.html。

三.Secret概览

Secret 是一种包含少量敏感信息例如密码、令牌或密钥的对象。 这样的信息可能会被放在 Pod 规约中或者镜像中。 使用 Secret 意味着你不需要在应用程序代码中包含机密数据

由于创建 Secret 可以独立于使用它们的 Pod, 因此在创建、查看和编辑 Pod 的工作流程中暴露 Secret(及其数据)的风险较小。 Kubernetes 和在集群中运行的应用程序也可以对 Secret 采取额外的预防措施, 例如避免将机密数据写入非易失性存储。

Secret 类似于 ConfigMap 但专门用于保存机密数据。

注意:默认情况下,Kubernetes Secret 未加密地存储在 API 服务器的底层数据存储(etcd)中。 任何拥有 API 访问权限的人都可以检索或修改 Secret,任何有权访问 etcd 的人也可以。 此外,任何有权限在命名空间中创建 Pod 的人都可以使用该访问权限读取该命名空间中的任何 Secret; 这包括间接访问,例如创建 Deployment 的能力。为了安全地使用 Secret,请至少执行以下步骤:

  • 为 Secret 启用静态加密。

  • 以最小特权访问 Secret 并启用或配置 RBAC 规则。

  • 限制 Secret 对特定容器的访问。

  • 考虑使用外部 Secret 存储驱动。

四.Secret 的类型

创建 Secret 时,你可以使用 Secret 资源的 type 字段,或者与其等价的 kubectl 命令行参数(如果有的话)为其设置类型。 Secret 类型有助于对 Secret 数据进行编程处理。

Kubernetes 提供若干种内置的类型,用于一些常见的使用场景。 针对这些类型,Kubernetes 所执行的合法性检查操作以及对其所实施的限制各不相同。

通过为 Secret 对象的 type 字段设置一个非空的字符串值,你也可以定义并使用自己 Secret 类型(如果 type 值为空字符串,则被视为 Opaque 类型)。

当 Secret 配置文件中未作显式设定时,默认的 Secret 类型是 Opaque。 当你使用 kubectl 来创建一个 Secret 时,你会使用 generic 子命令来标明要创建的是一个 Opaque 类型 的Secret。 例如,下面的命令会创建一个空的 Opaque 类型 Secret 对象:

kubectl create secret generic empty-secret
kubectl get secret empty-secret
内置类型 用法
Opaque 用户定义的任意数据
kubernetes.io/service-account-token 服务账号令牌
kubernetes.io/dockercfg ~/.dockercfg 文件的序列化形式
kubernetes.io/dockerconfigjson ~/.docker/config.json 文件的序列化形式
kubernetes.io/basic-auth 用于基本身份认证的凭据
kubernetes.io/ssh-auth 用于 SSH 身份认证的凭据
kubernetes.io/tls 用于 TLS 客户端或者服务器端的数据
bootstrap.kubernetes.io/token 启动引导令牌数据

五.各种类型的secret使用实例

5.1 创建kubernetes.io/service-account-token类型的secret

查看secret,存在一个默认的secret。

[root@k8scloude1 secret-manage]# kubectl get secrets
NAME TYPE DATA AGE
default-token-wkjv8 kubernetes.io/service-account-token 3 26m

kubernetes.io/service-account-token类型的secret:每创建一个service-account账号,都会自动创建一个secret,这个secret用于保存token。

#查看sa
[root@k8scloude1 secret-manage]# kubectl get sa
NAME SECRETS AGE
default 1 170m #创建service-account
[root@k8scloude1 secret-manage]# kubectl create sa satest
serviceaccount/satest created #自动创建一个secret
[root@k8scloude1 secret-manage]# kubectl get secrets
NAME TYPE DATA AGE
default-token-wkjv8 kubernetes.io/service-account-token 3 171m
satest-token-xv8x5 kubernetes.io/service-account-token 3 5s

删除service-account

[root@k8scloude1 secret-manage]# kubectl delete sa satest
serviceaccount "satest" deleted [root@k8scloude1 secret-manage]# kubectl get secrets
NAME TYPE DATA AGE
default-token-wkjv8 kubernetes.io/service-account-token 3 171m

5.2 创建Docker镜像仓库类型的secret

查看imagePullSecrets的说明信息,imagePullSecrets 字段是一个列表,包含对同一命名空间中 Secret 的引用。 你可以使用 imagePullSecrets 将包含 Docker(或其他)镜像仓库密码的 Secret 传递给 kubelet。kubelet 使用此信息来替 Pod 拉取私有镜像。

[root@k8scloude1 secret-manage]# kubectl explain pods.spec.imagePullSecrets
KIND: Pod
VERSION: v1 RESOURCE: imagePullSecrets <[]Object> DESCRIPTION:
ImagePullSecrets is an optional list of references to secrets in the same
namespace to use for pulling any of the images used by this PodSpec. If
specified, these secrets will be passed to individual puller
implementations for them to use. For example, in the case of docker, only
DockerConfig type secrets are honored. More info:
https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod LocalObjectReference contains enough information to let you locate the
referenced object inside the same namespace. FIELDS:
name <string>
Name of the referent. More info:
https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

查看Docker镜像仓库类型的secret帮助

[root@k8scloude1 secret-manage]# kubectl create secret docker-registry --help | grep docker
'$ docker login DOCKER_REGISTRY_SERVER --username=DOCKER_USER --password=DOCKER_PASSWORD --email=DOCKER_EMAIL'.
That produces a ~/.dockercfg file that is used by subsequent 'docker push' and 'docker pull' commands to authenticate to the registry. The email address is optional.
by creating a dockercfg secret and attaching it to your service account.
# If you don't already have a .dockercfg file, you can create a dockercfg secret directly by using:
kubectl create secret docker-registry my-secret --docker-server=DOCKER_REGISTRY_SERVER --docker-username=DOCKER_USER --docker-password=DOCKER_PASSWORD --docker-email=DOCKER_EMAIL
# Create a new secret named my-secret from ~/.docker/config.json
kubectl create secret docker-registry my-secret --from-file=.dockerconfigjson=path/to/.docker/config.json
--docker-email='': Email for Docker registry
--docker-password='': Password for Docker registry authentication
--docker-server='https://index.docker.io/v1/': Server location for Docker registry
--docker-username='': Username 为 Docker registry authentication
kubectl create secret docker-registry NAME --docker-username=user --docker-password=password --docker-email=email [--docker-server=string] [--from-file=[key=]source] [--dry-run=server|client|none] [options]

创建一个镜像仓库类型的secret,该secret包含了镜像仓库的账号,密码,服务器地址

[root@k8scloude1 secret-manage]# kubectl create secret docker-registry dockerregistrysecret --docker-username=LZ --docker-password='qwer' --docker-server=http://192.168.110.133
secret/dockerregistrysecret created [root@k8scloude1 secret-manage]# kubectl get secrets
NAME TYPE DATA AGE
default-token-wkjv8 kubernetes.io/service-account-token 3 3h3m
dockerregistrysecret kubernetes.io/dockerconfigjson 1 14s

kubernetes.io/dockerconfigjson类型的secrets用于镜像仓库不允许匿名用户pull镜像的情况,imagePullSecrets: dockerregistrysecret 指定镜像仓库的secret,dockerregistrysecret这个secrets里记录了镜像仓库的账号密码,这样就可以成功pull镜像下来了。

[root@k8scloude1 secret-manage]# vim test.yaml 

[root@k8scloude1 secret-manage]# cat test.yaml
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
run: mysql
name: mysql
spec:
terminationGracePeriodSeconds: 0
#imagePullSecrets: dockerregistrysecret 指定镜像仓库的secret
imagePullSecrets: dockerregistrysecret
containers:
- image: 192.168.110.133/secret/mysql:latest
imagePullPolicy: IfNotPresent
name: mysql
resources: {}
env:
- name: MYSQL_ROOT_PASSWORD
value: rootsec
dnsPolicy: ClusterFirst
restartPolicy: Always
status: {}

删除dockerregistrysecret

[root@k8scloude1 secret-manage]# kubectl delete secrets dockerregistrysecret
secret "dockerregistrysecret" deleted [root@k8scloude1 secret-manage]# kubectl get secrets
NAME TYPE DATA AGE
default-token-wkjv8 kubernetes.io/service-account-token 3 3h11m

5.3 创建Opaque类型的secret(键值对)

Opaque类型的secret创建语法为

kubectl create secret generic name --from-literal=键=值 --from-literal=键1=值1

创建secret的名字为genericsecret,两个键值对:tom=asd lisi=qwe,可以认为tom的密码为:asd,以此类推

[root@k8scloude1 secret-manage]# kubectl create secret generic genericsecret --from-literal=tom=asd --from-literal=lisi=qwe
secret/genericsecret created

查看secret

[root@k8scloude1 secret-manage]# kubectl get secrets
NAME TYPE DATA AGE
default-token-wkjv8 kubernetes.io/service-account-token 3 3h20m
genericsecret Opaque 2 20s

查看secret的描述信息,在Data那里可以看到lisi和tom的密码是没有显示的

[root@k8scloude1 secret-manage]# kubectl describe secrets genericsecret
Name: genericsecret
Namespace: secret-manage
Labels: <none>
Annotations: <none> Type: Opaque Data
====
lisi: 3 bytes
tom: 3 bytes

以yaml文件的形式显示secrets,可以看到lisi和tom的密码已经被加密显示,是base64加密的。

lisi: cXdl tom: YXNk lisi和tom的密码是被base64加密过的。

[root@k8scloude1 secret-manage]# kubectl get secrets genericsecret -o yaml
apiVersion: v1
data:
lisi: cXdl
tom: YXNk
kind: Secret
metadata:
creationTimestamp: "2022-01-21T07:13:57Z"
name: genericsecret
namespace: secret-manage
resourceVersion: "875438"
selfLink: /api/v1/namespaces/secret-manage/secrets/genericsecret
uid: 6326fa13-ec9f-42dd-8eed-b35261389dde
type: Opaque

可以对密码进行解密:

[root@k8scloude1 secret-manage]# echo cXdl | base64 -d
qwe [root@k8scloude1 secret-manage]# echo YXNk | base64 -d
asd

以JSON的格式显示

[root@k8scloude1 secret-manage]# kubectl get secrets genericsecret -o json
{
"apiVersion": "v1",
"data": {
"lisi": "cXdl",
"tom": "YXNk"
},
"kind": "Secret",
"metadata": {
"creationTimestamp": "2022-01-21T07:13:57Z",
"name": "genericsecret",
"namespace": "secret-manage",
"resourceVersion": "875438",
"selfLink": "/api/v1/namespaces/secret-manage/secrets/genericsecret",
"uid": "6326fa13-ec9f-42dd-8eed-b35261389dde"
},
"type": "Opaque"
}

查询lisi,tom的密码

[root@k8scloude1 secret-manage]# kubectl get secrets genericsecret -o jsonpath={.data.lisi}
cXdl [root@k8scloude1 secret-manage]# kubectl get secrets genericsecret -o jsonpath={.data.tom}
YXNk

查询secret的类型

[root@k8scloude1 secret-manage]# kubectl get secrets genericsecret -o jsonpath={.type}
Opaque

5.4 创建Opaque类型的secret(对文件加密)

secret可以直接使用文件进行加密,键为:文件名 值为:文件内容,使用文件进行加密的语法如下:

kubectl create secret generic name --from-file=/dir/file --from-file=/dir1/file1

这个也是键值对,键:/etc/hosts文件 值:文件内容

[root@k8scloude1 secret-manage]# kubectl create secret generic filesecret --from-file=/etc/hosts
secret/filesecret created [root@k8scloude1 secret-manage]# kubectl get secrets
NAME TYPE DATA AGE
default-token-wkjv8 kubernetes.io/service-account-token 3 3h34m
filesecret Opaque 1 6s
genericsecret Opaque 2 14m

查看secret的内容,host的内容同样被加密

[root@k8scloude1 secret-manage]# kubectl get secrets filesecret -o yaml
apiVersion: v1
data:
hosts: MTI3LjAuMC4xICAgbG9jYWxob3N0IGxvY2FsaG9zdC5sb2NhbGRvbWFpbiBsb2NhbGhvc3Q0IGxvY2FsaG9zdDQubG9jYWxkb21haW40Cjo6MSAgICAgICAgIGxvY2FsaG9zdCBsb2NhbGhvc3QubG9jYWxkb21haW4gbG9jYWxob3N0NiBsb2NhbGhvc3Q2LmxvY2FsZG9tYWluNgoxOTIuMTY4LjExMC4xMzAgazhzY2xvdWRlMQoxOTIuMTY4LjExMC4xMjkgazhzY2xvdWRlMgoxOTIuMTY4LjExMC4xMjggazhzY2xvdWRlMwo=
kind: Secret
metadata:
creationTimestamp: "2022-01-21T07:28:10Z"
name: filesecret
namespace: secret-manage
resourceVersion: "877063"
selfLink: /api/v1/namespaces/secret-manage/secrets/filesecret
uid: 30880892-3fbe-4baf-8d9b-953c7cbe5534
type: Opaque [root@k8scloude1 secret-manage]# kubectl get secrets filesecret -o jsonpath={.data.hosts}
MTI3LjAuMC4xICAgbG9jYWxob3N0IGxvY2FsaG9zdC5sb2NhbGRvbWFpbiBsb2NhbGhvc3Q0IGxvY2FsaG9zdDQubG9jYWxkb21haW40Cjo6MSAgICAgICAgIGxvY2FsaG9zdCBsb2NhbGhvc3QubG9jYWxkb21haW4gbG9jYWxob3N0NiBsb2NhbGhvc3Q2LmxvY2FsZG9tYWluNgoxOTIuMTY4LjExMC4xMzAgazhzY2xvdWRlMQoxOTIuMTY4LjExMC4xMjkgazhzY2xvdWRlMgoxOTIuMTY4LjExMC4xMjggazhzY2xvdWRlMwo=

对secret进行解密

[root@k8scloude1 secret-manage]# kubectl get secrets filesecret -o jsonpath={.data.hosts} | base64 -d
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.110.130 k8scloude1
192.168.110.129 k8scloude2
192.168.110.128 k8scloude3

直接使用两个文件创建secret

[root@k8scloude1 secret-manage]# kubectl create secret generic filesecret2 --from-file=/etc/hosts --from-file=/etc/shadow
secret/filesecret2 created [root@k8scloude1 secret-manage]# kubectl get secrets filesecret2 -o yaml
apiVersion: v1
data:
hosts: MTI3LjAuMC4xICAgbG9jYWxob3N0IGxvY2FsaG9zdC5sb2NhbGRvbWFpbiBsb2NhbGhvc3Q0IGxvY2FsaG9zdDQubG9jYWxkb21haW40Cjo6MSAgICAgICAgIGxvY2FsaG9zdCBsb2NhbGhvc3QubG9jYWxkb21haW4gbG9jYWxob3N0NiBsb2NhbGhvc3Q2LmxvY2FsZG9tYWluNgoxOTIuMTY4LjExMC4xMzAgazhzY2xvdWRlMQoxOTIuMTY4LjExMC4xMjkgazhzY2xvdWRlMgoxOTIuMTY4LjExMC4xMjggazhzY2xvdWRlMwo=
shadow: cm9vdDokNiRaZEx6M20wRTk1clQ2RlJyJGNuWVJwMDU2bkZxVWJublovS3g4QzdzVkY0ZnZoWjNyM1VBRk5LWFYvVkhMQ1AwTGlwNGYzcDgydXMwLlYxeVcyb25RRzM5SzQ4LnAweUhTSmRkZnQuOjowOjk5OTk5Ojc6OjoKYmluOio6MTcxMTA6MDo5OTk5OTo3Ojo6CmRhZW1vbjoqOjE3MTEwOjA6OTk5OTk6Nzo6OgphZG06KjoxNzExMDowOjk5OTk5Ojc6OjoKbHA6KjoxNzExMDowOjk5OTk5Ojc6OjoKc3luYzoqOjE3MTEwOjA6OTk5OTk6Nzo6OgpzaHV0ZG93bjoqOjE3MTEwOjA6OTk5OTk6Nzo6OgpoYWx0Oio6MTcxMTA6MDo5OTk5OTo3Ojo6Cm1haWw6KjoxNzExMDowOjk5OTk5Ojc6OjoKb3BlcmF0b3I6KjoxNzExMDowOjk5OTk5Ojc6OjoKZ2FtZXM6KjoxNzExMDowOjk5OTk5Ojc6OjoKZnRwOio6MTcxMTA6MDo5OTk5OTo3Ojo6Cm5vYm9keToqOjE3MTEwOjA6OTk5OTk6Nzo6OgpzeXN0ZW1kLW5ldHdvcms6ISE6MTc4MjI6Ojo6OjoKZGJ1czohIToxNzgyMjo6Ojo6Ogpwb2xraXRkOiEhOjE3ODIyOjo6Ojo6CnBvc3RmaXg6ISE6MTc4MjI6Ojo6OjoKc3NoZDohIToxNzgyMjo6Ojo6OgpjaHJvbnk6ISE6MTc4MjI6Ojo6OjoKdG9tOiQ2JDEzdFdxdkFXUTBuR1hIMUUkVUx4aC5NcmZzUGh5QXhBMm84RUVqVTlrSnpSUlJPVEcxb1BkZXJvNlUyYmljZjRYYkFNVThyanZSQ2lTSlhnWEVrWjltTjhqYjFlZVJja1dmdm1XWjA6OjA6OTk5OTk6Nzo6Ogo=
kind: Secret
metadata:
creationTimestamp: "2022-01-21T07:34:10Z"
name: filesecret2
namespace: secret-manage
resourceVersion: "877748"
selfLink: /api/v1/namespaces/secret-manage/secrets/filesecret2
uid: e18212f1-eac1-457a-9b5f-aad39485f4dd
type: Opaque

解密

[root@k8scloude1 secret-manage]# kubectl get secrets filesecret2 -o jsonpath={.data.shadow} | base64 -d
root:$6$ZdLz3m0E95rT6FRr$cnYRp056nFqUbnnZ/Kx8C7sVF4fvhZ3r3UAFNKXV/VHLCP0Lip4f3p82us0.V1yW2onQG39K48.p0yHSJddft.::0:99999:7:::
bin:*:17110:0:99999:7:::
daemon:*:17110:0:99999:7:::
adm:*:17110:0:99999:7:::
lp:*:17110:0:99999:7:::
sync:*:17110:0:99999:7:::
shutdown:*:17110:0:99999:7:::
halt:*:17110:0:99999:7:::
mail:*:17110:0:99999:7:::
operator:*:17110:0:99999:7:::
games:*:17110:0:99999:7:::
ftp:*:17110:0:99999:7:::
nobody:*:17110:0:99999:7:::
systemd-network:!!:17822::::::
dbus:!!:17822::::::
polkitd:!!:17822::::::
postfix:!!:17822::::::
sshd:!!:17822::::::
chrony:!!:17822::::::
tom:$6$13tWqvAWQ0nGXH1E$ULxh.MrfsPhyAxA2o8EEjU9kJzRRROTG1oPdero6U2bicf4XbAMU8rjvRCiSJXgXEkZ9mN8jb1eeRckWfvmWZ0::0:99999:7:::

六.以环境变量的方式使用 Secret

6.1 明文方式保存MySQL密码

创建目录存放yaml文件

[root@k8scloude1 ~]# mkdir secret-manage

创建命名空间

[root@k8scloude1 ~]# kubectl create ns secret-manage

把命名空间切换到secret-manage

[root@k8scloude1 secret-manage]# kubens secret-manage
Context "kubernetes-admin@kubernetes" modified.
Active namespace is "secret-manage".

现在还没有pod

[root@k8scloude1 ~]# cd secret-manage/

[root@k8scloude1 secret-manage]# pwd
/root/secret-manage [root@k8scloude1 secret-manage]# kubectl get pod -o wide
No resources found in secret-manage namespace.

配置一个mysql pod,设置mysql 的root密码为rootsec

[root@k8scloude1 secret-manage]# cat mysql.yaml
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
run: mysql
name: mysql
spec:
terminationGracePeriodSeconds: 0
containers:
- image: hub.c.163.com/library/mysql:latest
imagePullPolicy: IfNotPresent
name: mysql
resources: {}
#设置环境变量
env:
#MySQL数据库的root密码为rootsec
- name: MYSQL_ROOT_PASSWORD
value: rootsec
dnsPolicy: ClusterFirst
restartPolicy: Always
status: {}

创建pod

[root@k8scloude1 secret-manage]# kubectl apply -f mysql.yaml
pod/mysql created [root@k8scloude1 secret-manage]# kubectl get pods -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
mysql 1/1 Running 0 6s 10.244.112.133 k8scloude2 <none> <none>

安装mysql客户端,mariadb命令和mysql命令基本相同

[root@k8scloude1 secret-manage]# yum -y install mariadb

连接mysql容器,成功连接mysql

[root@k8scloude1 secret-manage]# mysql -uroot -prootsec -h 10.244.112.133
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MySQL connection id is 3
Server version: 5.7.18 MySQL Community Server (GPL) Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. MySQL [(none)]> exit
Bye

查看pod的描述信息,发现mysql root密码是以明文的形式存在。

MYSQL_ROOT_PASSWORD: rootsec 直接就看到root密码了,不安全。所以我们可以采用secret的方式让账号密码不以明文的形式显示。

[root@k8scloude1 secret-manage]# kubectl describe pod mysql | grep -A10 Environment
Environment:
MYSQL_ROOT_PASSWORD: rootsec
Mounts:
/var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-gbdtf (ro)
Conditions:
Type Status
Initialized True
Ready True
ContainersReady True
PodScheduled True
Volumes:

删除pod

[root@k8scloude1 secret-manage]# kubectl delete pod mysql --force
warning: Immediate deletion does not wait for confirmation that the running resource has been terminated. The resource may continue to run on the cluster indefinitely.
pod "mysql" force deleted [root@k8scloude1 secret-manage]# kubectl get pod -o wide
No resources found in secret-manage namespace.

6.2 使用secret密文方式保存MySQL密码

现在把secret运用到pod里,配置MySQL pod的yaml文件

[root@k8scloude1 secret-manage]# vim mysqlsecret.yaml 

#以环境变量的方式引用secret
[root@k8scloude1 secret-manage]# cat mysqlsecret.yaml
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
run: mysql
name: mysql
spec:
terminationGracePeriodSeconds: 0
containers:
- image: hub.c.163.com/library/mysql:latest
imagePullPolicy: IfNotPresent
name: mysql
resources: {}
env:
- name: MYSQL_ROOT_PASSWORD
valueFrom:
secretKeyRef:
#指定secret的名字和key
name: genericsecret
key: lisi
dnsPolicy: ClusterFirst
restartPolicy: Always
status: {}

创建pod

[root@k8scloude1 secret-manage]# kubectl apply -f mysqlsecret.yaml
pod/mysql created [root@k8scloude1 secret-manage]# kubectl get pod -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
mysql 1/1 Running 0 26s 10.244.112.132 k8scloude2 <none> <none>

成功登录mysql

[root@k8scloude1 secret-manage]# mysql -uroot -pqwe -h 10.244.112.132
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MySQL connection id is 4
Server version: 5.7.18 MySQL Community Server (GPL) Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. MySQL [(none)]> exit
Bye

查看pod的描述信息:MYSQL_ROOT_PASSWORD: <set to the key 'lisi' in secret 'genericsecret'> Optional: false,mysql的密码没有显示,这时候,MYSQL_ROOT_PASSWORD密码就不会以明文的方式显示了

[root@k8scloude1 secret-manage]# kubectl describe pod mysql | grep -A10 Environment
Environment:
MYSQL_ROOT_PASSWORD: <set to the key 'lisi' in secret 'genericsecret'> Optional: false
Mounts:
/var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-wl5jt (ro)
Conditions:
Type Status
Initialized True
Ready True
ContainersReady True
PodScheduled True
Volumes:

删除pod

[root@k8scloude1 secret-manage]# kubectl delete pod mysql --force
warning: Immediate deletion does not wait for confirmation that the running resource has been terminated. The resource may continue to run on the cluster indefinitely.
pod "mysql" force deleted

七.以卷的方式使用secret

7.1 以卷的方式使用secret

配置mysql pod的yaml文件,让secret以卷的方式应用,把filesecret值的内容挂载到/secret目录

[root@k8scloude1 secret-manage]# vim volumesecret.yaml 

[root@k8scloude1 secret-manage]# cat volumesecret.yaml
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
run: mysql
name: mysql
spec:
terminationGracePeriodSeconds: 0
#定义secret类型的卷
volumes:
- name: sec1
secret:
secretName: filesecret
containers:
- image: hub.c.163.com/library/mysql:latest
imagePullPolicy: IfNotPresent
name: mysql
resources: {}
#把sec1卷挂载到/secret目录
volumeMounts:
- name: sec1
mountPath: /secret
env:
- name: MYSQL_ROOT_PASSWORD
valueFrom:
secretKeyRef:
name: genericsecret
key: lisi
dnsPolicy: ClusterFirst
restartPolicy: Always
status: {}

创建pod

[root@k8scloude1 secret-manage]# kubectl apply -f volumesecret.yaml
pod/mysql created [root@k8scloude1 secret-manage]# kubectl get pod -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
mysql 1/1 Running 0 57s 10.244.112.134 k8scloude2 <none> <none>

进入mysql容器,hosts文件已经被挂载到/secret/目录下

[root@k8scloude1 secret-manage]# kubectl exec -it mysql -- bash
root@mysql:/# ls /secret/
hosts
root@mysql:/# cat /secret/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.110.130 k8scloude1
192.168.110.129 k8scloude2
192.168.110.128 k8scloude3
root@mysql:/#
root@mysql:/# exit
exit

删除pod

[root@k8scloude1 secret-manage]# kubectl delete pod mysql --force
warning: Immediate deletion does not wait for confirmation that the running resource has been terminated. The resource may continue to run on the cluster indefinitely.
pod "mysql" force deleted

filesecret2这个secret包含了两个文件,所以就挂载了两个文件到/secret目录下

[root@k8scloude1 secret-manage]# vim volumesecret.yaml 

[root@k8scloude1 secret-manage]# cat volumesecret.yaml
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
run: mysql
name: mysql
spec:
terminationGracePeriodSeconds: 0
#定义secret类型的卷
volumes:
- name: sec1
secret:
secretName: filesecret2
containers:
- image: hub.c.163.com/library/mysql:latest
imagePullPolicy: IfNotPresent
name: mysql
resources: {}
#把sec1卷挂载到/secret目录
volumeMounts:
- name: sec1
mountPath: /secret
env:
- name: MYSQL_ROOT_PASSWORD
valueFrom:
secretKeyRef:
name: genericsecret
key: lisi
dnsPolicy: ClusterFirst
restartPolicy: Always
status: {}

创建pod

[root@k8scloude1 secret-manage]# kubectl apply -f volumesecret.yaml
pod/mysql created [root@k8scloude1 secret-manage]# kubectl get pod -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
mysql 1/1 Running 0 12s 10.244.112.135 k8scloude2 <none> <none>

/secret/下有两个文件

[root@k8scloude1 secret-manage]# kubectl exec -it mysql -- bash
root@mysql:/# ls /secret/
hosts shadow
root@mysql:/# exit
exit

删除pod

[root@k8scloude1 secret-manage]# kubectl delete pod mysql --force
warning: Immediate deletion does not wait for confirmation that the running resource has been terminated. The resource may continue to run on the cluster indefinitely.
pod "mysql" force deleted

filesecret2这个secret包含两个文件,subPath: shadow表示只挂载shadow文件

[root@k8scloude1 secret-manage]# vim volumesecret.yaml 

[root@k8scloude1 secret-manage]# cat volumesecret.yaml
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
run: mysql
name: mysql
spec:
terminationGracePeriodSeconds: 0
volumes:
- name: sec1
secret:
secretName: filesecret2
containers:
- image: hub.c.163.com/library/mysql:latest
imagePullPolicy: IfNotPresent
name: mysql
resources: {}
volumeMounts:
- name: sec1
mountPath: /secret/sha.txt
#subPath: shadow表示只挂载shadow文件
subPath: shadow
env:
- name: MYSQL_ROOT_PASSWORD
valueFrom:
secretKeyRef:
name: genericsecret
key: lisi
dnsPolicy: ClusterFirst
restartPolicy: Always
status: {}

创建pod

[root@k8scloude1 secret-manage]# kubectl apply -f volumesecret.yaml
pod/mysql created [root@k8scloude1 secret-manage]# kubectl get pod -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
mysql 1/1 Running 0 16s 10.244.112.136 k8scloude2 <none> <none>

只有一个文件被挂载

[root@k8scloude1 secret-manage]# kubectl exec -it mysql -- bash
root@mysql:/# ls /secret/
sha.txt
root@mysql:/# cat /secret/sha.txt
root:$6$ZdLz3m0E95rT6FRr$cnYRp056nFqUbnnZ/Kx8C7sVF4fvhZ3r3UAFNKXV/VHLCP0Lip4f3p82us0.V1yW2onQG39K48.p0yHSJddft.::0:99999:7:::
bin:*:17110:0:99999:7:::
daemon:*:17110:0:99999:7:::
adm:*:17110:0:99999:7:::
lp:*:17110:0:99999:7:::
sync:*:17110:0:99999:7:::
shutdown:*:17110:0:99999:7:::
halt:*:17110:0:99999:7:::
mail:*:17110:0:99999:7:::
operator:*:17110:0:99999:7:::
games:*:17110:0:99999:7:::
ftp:*:17110:0:99999:7:::
nobody:*:17110:0:99999:7:::
systemd-network:!!:17822::::::
dbus:!!:17822::::::
polkitd:!!:17822::::::
postfix:!!:17822::::::
sshd:!!:17822::::::
chrony:!!:17822::::::
tom:$6$13tWqvAWQ0nGXH1E$ULxh.MrfsPhyAxA2o8EEjU9kJzRRROTG1oPdero6U2bicf4XbAMU8rjvRCiSJXgXEkZ9mN8jb1eeRckWfvmWZ0::0:99999:7:::
root@mysql:/#
root@mysql:/# exit
exit

删除pod

[root@k8scloude1 secret-manage]# kubectl delete pod mysql --force
warning: Immediate deletion does not wait for confirmation that the running resource has been terminated. The resource may continue to run on the cluster indefinitely.
pod "mysql" force deleted

7.2 使用secret传递Nginx配置文件

以卷的方式引用secret,这种方式可以用来传递配置文件,不过更推荐使用ConfigMap传递配置文件

创建一个名为nginxconfsecret的secret,该secret里包含一个Nginx的配置文件。

[root@k8scloude1 secret-manage]# kubectl create secret generic nginxconfsecret --from-file=nginx.conf
secret/nginxconfsecret created [root@k8scloude1 secret-manage]# kubectl get secrets
NAME TYPE DATA AGE
default-token-wkjv8 kubernetes.io/service-account-token 3 4h47m
filesecret Opaque 1 73m
filesecret2 Opaque 2 67m
genericsecret Opaque 2 87m
nginxconfsecret Opaque 1 17s

以yaml文件的形式查看secret

[root@k8scloude1 secret-manage]# kubectl get secrets nginxconfsecret -o yaml
apiVersion: v1
data:
nginx.conf: CnVzZXIgIG5naW54Owp3b3JrZXJfcHJvY2Vzc2VzICBhdXRvOwoKZXJyb3JfbG9nICAvdmFyL2xvZy9uZ2lueC9lcnJvci5sb2cgbm90aWNlOwpwaWQgICAgICAgIC92YXIvcnVuL25naW54LnBpZDsKCgpldmVudHMgewogICAgd29ya2VyX2Nvbm5lY3Rpb25zICAxMDI0Owp9CgoKaHR0cCB7CiAgICBpbmNsdWRlICAgICAgIC9ldGMvbmdpbngvbWltZS50eXBlczsKICAgIGRlZmF1bHRfdHlwZSAgYXBwbGljYXRpb24vb2N0ZXQtc3RyZWFtOwoKICAgIGxvZ19mb3JtYXQgIG1haW4gICckcmVtb3RlX2FkZHIgLSAkcmVtb3RlX3VzZXIgWyR0aW1lX2xvY2FsXSAiJHJlcXVlc3QiICcKICAgICAgICAgICAgICAgICAgICAgICckc3RhdHVzICRib2R5X2J5dGVzX3NlbnQgIiRodHRwX3JlZmVyZXIiICcKICAgICAgICAgICAgICAgICAgICAgICciJGh0dHBfdXNlcl9hZ2VudCIgIiRodHRwX3hfZm9yd2FyZGVkX2ZvciInOwoKICAgIGFjY2Vzc19sb2cgIC92YXIvbG9nL25naW54L2FjY2Vzcy5sb2cgIG1haW47CgogICAgc2VuZGZpbGUgICAgICAgIG9uOwogICAgI3RjcF9ub3B1c2ggICAgIG9uOwoKICAgIGtlZXBhbGl2ZV90aW1lb3V0ICA2NTsKCiAgICAjZ3ppcCAgb247CgogICAgaW5jbHVkZSAvZXRjL25naW54L2NvbmYuZC8qLmNvbmY7Cn0KCg==
kind: Secret
metadata:
creationTimestamp: "2022-01-21T08:40:57Z"
name: nginxconfsecret
namespace: secret-manage
resourceVersion: "885421"
selfLink: /api/v1/namespaces/secret-manage/secrets/nginxconfsecret
uid: 97da759f-ef07-4edb-94a2-f04b043d7336
type: Opaque

配置Nginx pod的配置文件,把secret:nginxconfsecret包含的nginx.conf挂载到/etc/nginx/nginx.conf下

[root@k8scloude1 secret-manage]# vim volumenginxconfsecret.yaml 

[root@k8scloude1 secret-manage]# cat volumenginxconfsecret.yaml
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
run: nginx
name: nginx
spec:
terminationGracePeriodSeconds: 0
#定义secret类型的卷
volumes:
- name: sec1
secret:
secretName: nginxconfsecret
containers:
- image: nginx
imagePullPolicy: IfNotPresent
name: nginx
resources: {}
#把nginxconfsecret这个secret挂载到/etc/nginx/nginx.conf
volumeMounts:
- name: sec1
mountPath: /etc/nginx/nginx.conf
subPath: nginx.conf
dnsPolicy: ClusterFirst
restartPolicy: Always
status: {}

创建pod

[root@k8scloude1 secret-manage]# kubectl apply -f volumenginxconfsecret.yaml
pod/nginx created [root@k8scloude1 secret-manage]# kubectl get pod -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
nginx 1/1 Running 0 15s 10.244.112.138 k8scloude2 <none> <none>

进入Nginx容器,查看Nginx的配置文件

[root@k8scloude1 secret-manage]# kubectl exec -it nginx -- bash
root@nginx:/# ls /etc/nginx/
conf.d fastcgi_params mime.types modules nginx.conf scgi_params uwsgi_params
root@nginx:/# ls /etc/nginx/nginx.conf
/etc/nginx/nginx.conf root@nginx:/# cat /etc/nginx/nginx.conf | head -3 user nginx;
worker_processes auto;
root@nginx:/# exit
exit

这种方式可以改变secret的内容从而达到改变容器里配置文件内容的目的,但是编辑secret(edit secret)的时候内容加密了,不好修改,这种方式不常用,推荐使用ConfigMap传递配置文件。

删除pod

[root@k8scloude1 secret-manage]# kubectl delete pod nginx --force
warning: Immediate deletion does not wait for confirmation that the running resource has been terminated. The resource may continue to run on the cluster indefinitely.
pod "nginx" force deleted

Kubernetes(k8s)密码管理:Secret的更多相关文章

  1. Kubernetes K8S之存储Secret详解

    K8S之存储Secret概述与类型说明,并详解常用Secret示例 主机配置规划 服务器名称(hostname) 系统版本 配置 内网IP 外网IP(模拟) k8s-master CentOS7.7 ...

  2. Kubernetes K8S之存储Volume详解

    K8S之存储Volume概述与说明,并详解常用Volume示例 主机配置规划 服务器名称(hostname) 系统版本 配置 内网IP 外网IP(模拟) k8s-master CentOS7.7 2C ...

  3. Kubernetes K8S之存储ConfigMap详解

    K8S之存储ConfigMap概述与说明,并详解常用ConfigMap示例 主机配置规划 服务器名称(hostname) 系统版本 配置 内网IP 外网IP(模拟) k8s-master CentOS ...

  4. Kubernetes(k8s)集群部署(k8s企业级Docker容器集群管理)系列之集群部署环境规划(一)

    0.前言 整体架构目录:ASP.NET Core分布式项目实战-目录 k8s架构目录:Kubernetes(k8s)集群部署(k8s企业级Docker容器集群管理)系列目录 一.环境规划 软件 版本 ...

  5. Spring Cloud Config整合Spring Cloud Kubernetes,在k8s上管理配置

    1 前言 欢迎访问南瓜慢说 www.pkslow.com获取更多精彩文章! Kubernetes有专门的ConfigMap和Secret来管理配置,但它也有一些局限性,所以还是希望通过Spring C ...

  6. Kubernetes(k8s)集群部署(k8s企业级Docker容器集群管理)系列目录

    0.目录 整体架构目录:ASP.NET Core分布式项目实战-目录 k8s架构目录:Kubernetes(k8s)集群部署(k8s企业级Docker容器集群管理)系列目录 一.感谢 在此感谢.net ...

  7. Kubernetes(k8s)集群部署(k8s企业级Docker容器集群管理)系列之自签TLS证书及Etcd集群部署(二)

    0.前言 整体架构目录:ASP.NET Core分布式项目实战-目录 k8s架构目录:Kubernetes(k8s)集群部署(k8s企业级Docker容器集群管理)系列目录 一.服务器设置 1.把每一 ...

  8. Kubernetes(k8s)集群部署(k8s企业级Docker容器集群管理)系列之flanneld网络介绍及部署(三)

    0.前言 整体架构目录:ASP.NET Core分布式项目实战-目录 k8s架构目录:Kubernetes(k8s)集群部署(k8s企业级Docker容器集群管理)系列目录 一.flanneld介绍 ...

  9. Kubernetes(k8s)集群部署(k8s企业级Docker容器集群管理)系列之部署master/node节点组件(四)

    0.前言 整体架构目录:ASP.NET Core分布式项目实战-目录 k8s架构目录:Kubernetes(k8s)集群部署(k8s企业级Docker容器集群管理)系列目录 1.部署master组件 ...

  10. 使用kubectl管理Kubernetes(k8s)集群:常用命令,查看负载,命名空间namespace管理

    目录 一.系统环境 二.前言 三.kubectl 3.1 kubectl语法 3.2 kubectl格式化输出 四.kubectl常用命令 五.查看kubernetes集群node节点和pod负载 5 ...

随机推荐

  1. Windows下自动云备份思源笔记到Gitee

    前言 思源笔记是一款本地笔记为主的软件,其目前提供了148元/year的付费同步功能,但对于21世纪中国难民而言还是太贵啦. 条件允许的同学还是使用官方的同步,支持下作者. 所以,就在思考有没有白嫖的 ...

  2. day05-JavaScript02

    JavaScript02 8.JavaScript函数 JavaScript函数介绍 函数是由事件驱动的,或者当它被调用时,执行的可重复使用的代码 例子 <!DOCTYPE html> & ...

  3. 元数据性能大比拼:HDFS vs S3 vs JuiceFS

    元数据是存储系统的核心大脑,元数据性能对整个大数据平台的性能和扩展能力至关重要.尤其在处理海量文件的时候.在平台任务创建.运行和结束提交阶段,会存在大量的元数据 create,open,rename ...

  4. .Net SemaphoreSlim

    看Elsa-core源代码中看到的,Elsa-core中所有保存数据的方法似乎使用同一个Save方法.如下图: 那么为什么要使用这玩意,我还是头一次见这玩意???? 好吧,我承认我自己菜.我自个儿也该 ...

  5. perl遍历哈希的所有健和值

    my %h=("001",{name,"李白",age,"18",height,"185",weight,"6 ...

  6. kubeedge架构与核心设计---https://bbs.huaweicloud.com/webinar/100009

    今天是kubeedge的第一节课,今天主要带大家回顾一下云原生和边缘计算的发展历程 然后我们会重点介绍一下kubeedge这个项目,他的设计背景和核心理念与我们整体的架构 首先是我们来简单回归一下云原 ...

  7. vulnhub靶场之EVILBOX: ONE

    准备: 攻击机:虚拟机kali.本机win10. 靶机:EVILBOX: ONE,下载地址:https://download.vulnhub.com/evilbox/EvilBox---One.ova ...

  8. QMetaObject::connectSlotsByName: No matching signal for xxx

    问题描述 这个问题是没有与 xxx 这个槽函数匹配的信号,但是我做了 QMetaObject::connectSlotsByName(this);, 自动连接.并且确保了函数名和信号名是没有错误的,还 ...

  9. 1、创建Django项目并配置settings文件

    一.先安装Django第三方库 二.创建项目 新建好项目的目录是这样的 迁移数据库,注意:没有安装pymysql的需要通过pip install pymysql安装. 三.创建模块 四.设置setti ...

  10. SpringCloud Alibaba(六) - Seata 分布式事务锁

    1.Seata 简介 1.1 Seata是什么 Seata 是一款开源的分布式事务解决方案,致力于提供高性能和简单易用的分布式事务服务.Seata 将为用户提供了 AT.TCC.SAGA 和 XA 事 ...