kubectl管理Pod-5: 配置管理（Secret,ConfigMap)

迈不过友情╰ 2024-04-19 06:00 27阅读 0赞

<table> 
 <thead> 
  <tr> 
   <th align="left">资源类型</th> 
   <th align="left">使用方法</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td align="left">Secret （变量注入）</td> 
   <td align="left">变量名-&gt; valueFrom -&gt; secretKeyRef -&gt;secret资源对象(name,key)</td> 
  </tr> 
  <tr> 
   <td align="left">Secret （数据卷挂载）</td> 
   <td align="left">volume名称-&gt;Secret -&gt; name</td> 
  </tr> 
  <tr> 
   <td align="left">ConfigMap （变量注入）</td> 
   <td align="left">变量名-&gt; valueFrom -&gt; configMapKeyRef -&gt; configmap资源对象(name,key)</td> 
  </tr> 
  <tr> 
   <td align="left">ConfigMap （数据卷挂载）</td> 
   <td align="left">volume名称-&gt;ConfigMap -&gt; name</td> 
  </tr> 
 </tbody> 
</table>

# 1, Secret #

官方的说明：[https://kubernetes.io/zh/docs/concepts/configuration/secret/][https_kubernetes.io_zh_docs_concepts_configuration_secret]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2V5ZW9mZWFnbGU_size_16_color_FFFFFF_t_70]

*  使用base64加解密

## a, 创建secret资源 ##

#1,创建secret
    [root@master conf]# cat secret.yaml 
    apiVersion: v1
    kind: Secret
    metadata:
      name: mysecret
    type: Opaque
    data:
      username: cm9vdAo=
      password: MTIzNDU2Cg==
    
    root@master conf]# kubectl apply -f secret.yaml 
    secret/mysecret created
    [root@master conf]# kubectl get secret
    NAME                  TYPE                                  DATA   AGE
    default-token-nghk6   kubernetes.io/service-account-token   3      73m
    mysecret              Opaque                                2      4s
    
    #2, pod中读取secret内容
    [root@master conf]# kubectl get secret mysecret -o yaml
    apiVersion: v1
    data:
      password: MTIzNDU2Cg==
      username: cm9vdAo=
    ...

## b, pod读取secret数据 ##

### 使用方式1： 变量注入 ###

( valueFrom -> secretKeyRef ->secret资源对象)

#1, 创建pod对象    
    [root@master secret]# cat pod-insert-secret.yml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: mypod
    spec:
      containers:
      - name: nginx
        image: nginx
        env:
          - name: SECRET_USERNAME
            valueFrom:
              secretKeyRef:
                name: mysecret
                key: username
          - name: SECRET_PASSWORD
            valueFrom:
              secretKeyRef:
                name: mysecret
                key: password
    
    #pod读取secret里面的值 (username, password)
    [root@master secret]# kubectl apply -f  pod-insert-secret.yml 
    [root@master secret]# kubectl get pod
    NAME                       READY   STATUS    RESTARTS   AGE
    mypod                      1/1     Running   0          122m
    
    [root@master secret]# kubectl exec -it mypod sh
    # echo $SECRET_USERNAME
    root
    # echo $SECRET_PASSWORD
    123456

### 使用方式2： 数据卷挂载 ###

(volume名称–>secret --> secret资源对象名)

#1, 创建pod对象    
    [root@master secret]# cat pod-mount-secret.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: mypod2
    spec:
      containers:
      - name: nginx
        image: nginx
        volumeMounts:
        - name: foo
          mountPath: "/etc/foo"
          readOnly: true
      volumes:
      - name: foo
        secret:
          secretName: mysecret
        
    [root@master secret]# kubectl apply -f pod-mount-secret.yaml 
    [root@master secret]# kubectl get pod
    NAME                       READY   STATUS    RESTARTS   AGE
    mypod                      1/1     Running   0          143m
    mypod2                     1/1     Running   0          11s
    
    #2, 在pod中读取secret资源里面的数据
    [root@master secret]# kubectl exec -it mypod2 bash
    root@mypod2:/# ls /etc/foo
    password  username
    root@mypod2:/# cat /etc/foo/password 
    123456
    root@mypod2:/# cat /etc/foo/username 
    root

# ConfigMap #

## 使用方式1： 变量注入 ##

#1, 定义configmap
    [root@master secret]# cat configmap.yaml 
    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: configmap1
      namespace: default
    data:
      username: "root"
      password: "123456"
    ---
    apiVersion: v1
    kind: Pod
    metadata:
      name: configmap-pod
    spec:
      containers:
        - name: busybox
          image: busybox
          env:
            - name: USER_NAME
              valueFrom:
                configMapKeyRef:
                  name: configmap1
                  key: username
            - name: PASS_WORD
              valueFrom:
                configMapKeyRef:
                  name: configmap1
                  key: password
          command: [ "/bin/sh", "-c", "echo $USER_NAME $PASS_WORD; sleep 60" ]
      restartPolicy: Never
    
    #2, pod读取configmap中的数据
    root@master secret]# kubectl apply -f configmap.yaml 
    configmap/configmap1 created
    pod/configmap-pod created
    
    [root@master secret]# kubectl get pod
    NAME            READY   STATUS    RESTARTS   AGE
    configmap-pod   1/1     Running   0          8s
    [root@master secret]# kubectl logs configmap-pod
    root 123456

## 使用方式2：数据卷挂载 ##

*  创建configmap: 数据源是( 指定的目录或文件 ）

#1, 准备配置文件
    [root@master aa]# tree
    ├── conf
    │   ├── my.cnf
    │   └── redis.conf
    └── configmap-volume.yaml
    1 directory, 3 files
    
    [root@master aa]# cat conf/my.cnf 
    [mysqld]  
    bind-address = 0.0.0.0
    port = 3306  
    socket = /var/lib/mysql/mysql.sock  
    character-set-server=utf8  
    
    [root@master aa]# cat conf/redis.conf 
    redis.host=127.0.0.1
    redis.port=6379
    redis.password=123456
    
    #2,创建configmap: 数据源是目录或文件
    [root@master aa]# kubectl create configmap redis-mysql.configmap --from-file=conf
    configmap/redis-mysql.configmap created
    [root@master aa]# kubectl describe configmap redis-mysql.configmap
    Name:         redis-mysql.configmap
    Namespace:    default
    Labels:       <none>
    Annotations:  <none>
    
    Data
    ====
    redis.conf:
    ----
    redis.host=127.0.0.1
    redis.port=6379
    redis.password=123456
    
    my.cnf:
    ----
    [mysqld]  
    bind-address = 0.0.0.0
    port = 3306  
    socket = /var/lib/mysql/mysql.sock  
    character-set-server=utf8  
    
    #3,从pod中读取configmap具体配置
    [root@master aa]# kubectl exec -it configmap-file-pod sh
    / # ls /etc/myconf/
    my.cnf      redis.conf
    
    / # cat /etc/myconf/my.cnf 
    [mysqld]  
    bind-address = 0.0.0.0
    port = 3306  
    socket = /var/lib/mysql/mysql.sock  
    character-set-server=utf8  
    
    / # cat /etc/myconf/redis.conf 
    redis.host=127.0.0.1
    redis.port=6379
    redis.password=123456

*  创建configmap: 数据源是( yaml中写好的kv对 ）

#1,创建configmap, 在Pod中挂载使用
    [root@master secret]# cat configmap-volume.yaml 
    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: redis-config
    data:
      redis.properties: |
        redis.host=127.0.0.1
        redis.port=6379
        redis.password=123456
    ---
    apiVersion: v1
    kind: Pod
    metadata:
      name: mypod2
    spec:
      containers:
        - name: busybox
          image: busybox
          volumeMounts:
          - name: config-volume
            mountPath: /etc/redis-conf
          command: [ "/bin/sh","-c","cat /etc/redis-conf/redis.properties; sleep 60" ]
      volumes:
        - name: config-volume
          configMap:
            name: redis-config
      restartPolicy: Never
    
    #2, 在pod中验证挂载的配置
    [root@master secret]# kubectl apply -f configmap-volume.yaml 
    configmap/redis-config configured
    pod/mypod2 created
    [root@master secret]# kubectl get pod
    NAME     READY   STATUS    RESTARTS   AGE
    mypod2   1/1     Running   0          4s
    
    [root@master secret]# kubectl exec -it mypod2 sh
    / # cat /etc/redis-conf/redis.properties 
    redis.host=127.0.0.1
    redis.port=6379
    redis.password=123456

[https_kubernetes.io_zh_docs_concepts_configuration_secret]: https://kubernetes.io/zh/docs/concepts/configuration/secret/
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2V5ZW9mZWFnbGU_size_16_color_FFFFFF_t_70]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/18/654a25f42c634e969aabf0563918af03.png