K8S学习笔记05 配置管理Secret,ConfigMap

Secret

Secret的主要作用就是加密数据，然后存在etcd里面，让Pod容器以挂载Volume方式进行访问

场景：用户名 和 密码进行加密

一般场景的是对某个字符串进行base64编码 进行加密

echo -n 'admin' | base64
echo -n 'admin123' | base64

变量形式挂载到Pod

1.创建secret加密数据 secret.yaml

apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Opaque
data:
  username: YWRtaW4=
  password: YWRtaW4xMjM=

创建secret

kubectl create -f secret.yaml

查看secret

kubectl get secret

NAME                  TYPE                                  DATA   AGE
mysecret              Opaque                                2      18s

2.以变量形式挂载到pod容器中

创建yaml文件 secret-val.yaml

apiVersion: v1
kind: Pod
metadata:
  name: mypod
spec:
  containers:
  - name: nginx
    image: nginx
    env:
      - name: SECRET_USERNAME
        valueFrom:
          secretKeyRef:
            name: mysecret
            key: username
      - name: SECRET_PASSWORD
        valueFrom:
          secretKeyRef:
            name: mysecret
            key: password

执行

kubectl apply -f secret-val.yaml

查看容器中有没有变量

kubectl get pods

kubectl exec -it mypod

echo $SECRET_USERNAME #admin
echo $SECRET_PASSWORD #admin123

删除Pod

kubectl delete -f secret-val.yaml

3.以数据卷形式挂载

apiVersion: v1
kind: Pod
metadata:
  name: mypod
spec:
  containers:
  - name: nginx
    image: nginx
    volumeMounts:
    - name: foo
      mountPath: "/etc/foo"
      readOnly: true
  volumes:
  - name: foo
    secret:
      secretName: mysecret

执行

kubectl apply -f secret-vol.yaml 

查看

kubectl exec -it mypod bash

cat /etc/foo/username #admin
cat /etc/foo/password #admin123

删除全部pod

kubectl delete pod --all

ConfigMap 配置文件

ConfigMap作用是存储不加密的数据到etcd中，让Pod以变量或数据卷Volume挂载到容器中

创建配置文件

vim redis.properties

redis.port=127.0.0.1
redis.port=6379
redis.password=123456

创建ConfigMap

kubectl create configmap redis-config --from-file=redis.properties

查看详细信息

kubectl describe cm redis-config

Name:         redis-config
Namespace:    default
Labels:       <none>
Annotations:  <none>

Data
====
redis.properties:
----
redis.port=127.0.0.1
redis.port=6379
redis.password=123456

Events:  <none>

以数据卷形式挂载

编辑yaml

创建查看

# 创建
kubectl apply -f cm.yaml
# 查看
kubectl get pods
# 查看执行日志
kubectl logs mypod

删除configmap

kubectl get cm

kubectl delete -f cm.yaml

以变量的形式挂载Pod

配置文件myconfig.yaml声明变量

apiVersion: v1
kind: ConfigMap
metadata:
  name: myconfig
  namespace: default
data:
  special.level: info
  special.type: hello

创建和查看

# 创建pod
kubectl apply -f myconfig.yaml
# 获取
kubectl get cm

NAME       DATA   AGE
myconfig   2      3s

使用配置 config-val.yaml

apiVersion: v1
kind: Pod
metadata:
  name: mypod
spec:
  containers:
    - name: busybox
      image: busybox
      command: [ "/bin/sh", "-c", "echo $(LEVEL) $(TYPE)" ]
      env:
        - name: LEVEL
          valueFrom:
            configMapKeyRef:
              name: myconfig
              key: special.level
        - name: TYPE
          valueFrom:
            configMapKeyRef:
              name: myconfig
              key: special.type
  restartPolicy: Never              

查看日志

kubectl logs mypod

#输出 info hello