Secret加密数据挂载到其他pod

小咪咪 2022-10-17 04:20 156阅读 0赞

通过secret可以将加密数据保存到etcd中，其他pod通过变量或者容器数据卷的方式将加密数据挂载到该pod容器中。

创建secret,把加密数据保存到etcd

资源编排文件 字段配置的加密后的结果，以用 echo -n '要加密内容'|base64获取

[root@k8smaster ~]# cat secret.yaml
    apiVersion: v1
    kind: Secret
    metadata:
      name: mysecret
    type: Opaque
    data:
      username: YWRtaW4=
      password: MWYyZDFlMmU2N2Rm

# 创建secret
    [root@k8smaster ~]# kubectl create -f secret.yaml
    secret/mysecret created

# 以变量形式挂载到其他pod #

资源编排文件 secret-var.yaml

apiVersion: v1
    kind: Pod
    metadata:
      name: mypod
    spec:
      containers:
      - name: nginx
        image: nginx
        env:
          - name: SECRET_USERNAME
            valueFrom:
              secretKeyRef:
                name: mysecret
                key: username
          - name: SECRET_PASSWORD
            valueFrom:
              secretKeyRef:
                name: mysecret
                key: password

创建pod

[root@k8smaster ~]# kubectl apply -f secret-var.yaml
    pod/mypod created
    [root@k8smaster ~]# kubectl get pods
    NAME                     READY   STATUS              RESTARTS   AGE
    ds-test-2fw6j            1/1     Running             0          178m
    hello-1622080200-bhklf   0/1     Completed           0          2m34s
    hello-1622080260-h4b4v   0/1     Completed           0          94s
    hello-1622080320-xbgzr   0/1     Completed           0          34s
    mypod                    0/1     ContainerCreating   0          6s
    nginx-statefulset-0      1/1     Running             0          4h43m
    nginx-statefulset-1      1/1     Running             0          4h43m
    nginx-statefulset-2      1/1     Running             0          4h43m
    pi-dl7c9                 0/1     Completed           0          3h4m

# 进入pod 查看变量值
    [root@k8smaster ~]# kubectl exec -it mypod bash
    kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl kubectl exec [POD] -- [COMMAND] instead.
    root@mypod:/# echo $SECRET_USERNAME
    admin

# 以容器数据卷形式挂载到其他pod #

资源编排文件 secret-vol.yaml

apiVersion: v1
    kind: Pod
    metadata:
      name: mypod
    spec:
      containers:
      - name: nginx
        image: nginx
        volumeMounts:
        - name: foo
          mountPath: "/etc/foo"
          readOnly: true
      volumes:
      - name: foo
        secret:
          secretName: mysecret

# 运行容器
    kubectl apply -f secret-vol.yaml
    
    # 查看容器
    [root@k8smaster ~]# kubectl get pods
    NAME                     READY   STATUS              RESTARTS   AGE
    ds-test-2fw6j            1/1     Running             0          3h7m
    hello-1622080680-49kcm   0/1     Completed           0          3m18s
    hello-1622080740-68pvd   0/1     Completed           0          2m18s
    hello-1622080800-r6gbc   0/1     Completed           0          78s
    hello-1622080860-wf7qc   0/1     Completed           0          18s
    mypod                    1/1     Running             0          8m51s
    mypod1                   0/1     ContainerCreating   0          12s
    nginx-statefulset-0      1/1     Running             0          4h52m
    nginx-statefulset-1      1/1     Running             0          4h52m
    nginx-statefulset-2      1/1     Running             0          4h52m
    pi-dl7c9                 0/1     Completed           0          3h12m

进入容器 查看挂载的数据

[root@k8smaster ~]# kubectl exec -it mypod1 bash
    kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl kubectl exec [POD] -- [COMMAND] instead.
    root@mypod1:/# cd /etc/foo
    root@mypod1:/etc/foo# ls
    password  username
    root@mypod1:/etc/foo# cd username
    bash: cd: username: Not a directory
    root@mypod1:/etc/foo# cat username
    adminroot@mypod1:/etc/foo#