应用配置管理Secret&ConfigMap

1.Secret

常见的应用配置方式

镜像
配置中心
配置文件
共享存储
放到git 仓库

配置文件分类：

敏感信息
非敏感信息如账号密码服务器地址

Secret再k8s中的使用方式

加密数据并存放Etcd中，让Pod的容器以挂载Volume方式访问。

应用场景：凭据

Pod使用secret两种方式：

变量注入
挂载

例：现在一对用户名密码 pod在运行的时候需要加载注入到pod 中

假如现在用户名：admin 密码：password

echo -n "admin" |base64
YWRtaW4=

echo -n "password" |base64
cGFzc3dvcmQ=

passwdAndusername-secret.yaml

apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Opaque
data: 
  username: YWRtaW4=
  password: cGFzc3dvcmQ=

pod怎样注入secret中的变量

secret-var-use.yaml

apiVersion: v1
kind: Pod
metadata:
  name: mypod
spec:
  containers:
  - name: nginx
    image: nginx
    env:
      - name: SECRET_USERNAME
        valueFrom:
          secretKeyRef:
            name: mysecret
            key: username
      - name: SECRET_PASSWORD
        valueFrom:
          secretKeyRef:
            name: mysecret
            key: password

将secret挂载到pod文件中

secret-volume.yaml

apiVersion: v1
kind: Pod
metadata:
  name: mypod2
spec:
  containers:
  - name: nginx
    image: nginx
    volumeMounts:
    - name: foo
      mountPath: "/etc/foo"
      readOnly: true
  volumes:
  - name: foo
    secret:
      secretName: mysecret

三种类型secret

[root@k8s-master1 ~/learn]#  kubectl create secret -h
Create a secret using specified subcommand.

Available Commands:
  docker-registry Create a secret for use with a Docker registry
  generic         Create a secret from a local file, directory or literal value
  tls             Create a TLS secret

docker-registry 是配置docker私有仓库的认证信息，当yaml中指定了相应的secret 就可以获取到对应的变量值

kubectl create secret docker-registry myregistry --docker-server=registry.cn-hangzhou.aliyuncs.com --docker-username=benjami
n7788 --docker-password=a7260488

imagePullSecrets:
- name: myregistry

generic 通过传值或者指定本地文件的方式创建secret

传值：

kubectl create secret generic mysecret --from-literal=username=admin --from-literal=password=123456

传文件：

echo -n admin > ./username
echo -n 123456 > ./password
kubectl create secret generic mysecret --from-file=./username --from-file=./password

tls 创建证书型secret一般用于 ingress 配置https 场景中

kubectl create secret tls secret-tls --cert=/root/learn/ssl/example.ctnrs.com.pem --key=/root/learn/ssl/example.ctnrs.com-ke
y.pem

tls:
  - hosts:
    - example.ctnrs.com
    secretName: secret-tls

Secret官网：https://kubernetes.io/docs/concepts/configuration/secret/

2.ConfigMap

与Secret类似，区别在于ConfigMap保存的是不需要加密配置信息。

应用场景：应用配置

引用变量方式

configmap-string.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: myconfig
  namespace: default
data:
  special.level: info
  special.type: hello

config-var.yaml

apiVersion: v1
kind: Pod
metadata:
  name: mypod3
spec:
  containers:
    - name: busybox
      image: busybox
      command: ["/bin/sh","-c","echo $(LEVEL) $(TYPE)"]
      env:
        - name: LEVEL
          valueFrom:
            configMapKeyRef:
              name: myconfig
              key: special.level
        - name: TYPE
          valueFrom:
            configMapKeyRef:
              name: myconfig
              key: special.type
  restartPolicy: Never

挂载数据卷方式

cat config-volume.yaml

---

apiVersion: v1
kind: ConfigMap
metadata:
  name: redis-config
data:
  redis.properties: |
    redis.host=127.0.0.1
    redis.port=6379
    redis.password=123456
---

apiVersion: v1
kind: Pod
metadata:
  name: mypod4
spec:
  containers:
    - name: busybox
      image: busybox
      command: ["/bin/sh","-c","cat /etc/config/redis.properties"]
      volumeMounts:
      - name: config-volume
        mountPath: /etc/config
  volumes:
      - name: config-volume
        configMap:
          name: redis-config
  restartPolicy: Never