kubernetes存储（二）——K8S的Secret配置管理(创建、挂载、路径映射、设置环境变量、存储私有仓库认证信息)

技术2022-07-11 95

文章目录

1.Secret配置管理介绍2.创建Secret2.1 从文件中创建Secret2.2 编写一个 secret 对象 3.将Secret挂载到Volume中4.向指定路径映射 secret 密钥5.将Secret设置为环境变量6.存储docker registry的认证信息

1.Secret配置管理介绍

Secret 对象类型用来保存敏感信息，例如密码、OAuth 令牌和 ssh key。敏感信息放在 secret 中比放在 Pod 的定义或者容器镜像中来说更加安全和灵活。

Pod 可以用两种方式使用 secret： • 作为 volume 中的文件被挂载到 pod 中的一个或者多个容器里。 • 当 kubelet 为 pod 拉取镜像时使用。

Secret的类型： • Service Account：Kubernetes 自动创建包含访问 API 凭据的 secret，并自动修改 pod 以使用此类型的 secret。

• Opaque：使用base64编码存储信息，可以通过base64 --decode解码获得原始数据，因此安全性弱。

• kubernetes.io/dockerconfigjson：用于存储docker registry的认证信息。

kubectl describe pod -n ingress-nginx serviceaccout 创建时 Kubernetes 会默认创建对应的 secret。对应的 secret 会自动挂载到Pod 的 /run/secrets/kubernetes.io/serviceaccount 目录中在每一个namespace的sa都有一个默认的default用来使得pod连接apiserver 每个namespace下有一个名为default的默认的ServiceAccount对象 ServiceAccount里有一个名为Tokens的可以作为Volume一样被Mount到Pod里的Secret，当Pod启动时这个Secret会被自动Mount到Pod的指定目录下，用来协助完成Pod中的进程访问API Server时的身份鉴权过程。

[kubeadm@server1 cm]$ kubectl get sa NAME SECRETS AGE default 1 9d [kubeadm@server1 cm]$ kubectl get sa -n ingress-nginx NAME SECRETS AGE default 1 11h ingress-nginx 1 11h ingress-nginx-admission 1 11h [kubeadm@server1 ~]$ kubectl describe sa default Name: default Namespace: default Labels: <none> Annotations: <none> Image pull secrets: <none> Mountable secrets: default-token-5qqxc Tokens: default-token-5qqxc Events: <none>

2.创建Secret

2.1 从文件中创建Secret

echo -n 'admin' > ./username.txt echo -n 'redhat' > ./password.txt kubectl create secret generic db-user-pass --from-file=./username.txt --fromfile=./password.txt kubectl get secrets ##Opaque Secret 其value为base64编码后的值。如果密码具有特殊字符，则需要使用 \ 字符对其进行转义，执行以下命令： kubectl create secret generic dev-db-secret --from-literal=username=devuser --from-literal=password=S\!B\\*d\$zDsb 默认情况下 kubectl get和kubectl describe 为了安全是不会显示密码的内容,可以通过以下方式查看：

2.2 编写一个 secret 对象

[kubeadm@server1 cm]$ vim cm2.yml [kubeadm@server1 cm]$ cat cm2.yml apiVersion: v1 kind: Secret metadata: name: mysecret type: Opaque data: username: YWRtaW4= password: cmVkaGF0 [kubeadm@server1 cm]$ kubectl apply -f cm2.yml secret/mysecret created [kubeadm@server1 cm]$ kubectl get secrets NAME TYPE DATA AGE basic-auth Opaque 1 13h default-token-5qqxc kubernetes.io/service-account-token 3 9d mysecret Opaque 2 7s tls-secret kubernetes.io/tls 2 27h

3.将Secret挂载到Volume中

[kubeadm@server1 cm]$ vim cm2.yml [kubeadm@server1 cm]$ cat cm2.yml apiVersion: v1 kind: Secret metadata: name: mysecret type: Opaque data: username: YWRtaW4= password: cmVkaGF0 --- apiVersion: v1 kind: Pod metadata: name: mysecret spec: containers: - name: nginx image: nginx volumeMounts: - name: secrets mountPath: "/secret" readOnly: true volumes: - name: secrets secret: secretName: mysecret [kubeadm@server1 cm]$ kubectl apply -f cm2.yml secret/mysecret unchanged pod/mysecret created [kubeadm@server1 cm]$ kubectl exec mysecret -- ls /secret password username [kubeadm@server1 cm]$ kubectl exec mysecret -- cat /secret/password redhat [kubeadm@server1 cm]$ kubectl exec mysecret -- cat /secret/username admin

4.向指定路径映射 secret 密钥

[kubeadm@server1 cm]$ cat cm2.yml apiVersion: v1 kind: Secret metadata: name: mysecret type: Opaque data: username: YWRtaW4= password: cmVkaGF0 --- apiVersion: v1 kind: Pod metadata: name: mysecret spec: containers: - name: nginx image: nginx volumeMounts: - name: secrets mountPath: "/secret" readOnly: true volumes: - name: secrets secret: secretName: mysecret items: - key: username path: my-group/my-username [kubeadm@server1 cm]$ kubectl delete pod mysecret pod "mysecret" deleted [kubeadm@server1 cm]$ vim cm2.yml [kubeadm@server1 cm]$ kubectl apply -f cm2.yml secret/mysecret unchanged pod/mysecret created [kubeadm@server1 cm]$ kubectl exec mysecret -- ls /secret/my-group my-username [kubeadm@server1 cm]$ kubectl exec mysecret -- cat /secret/my-group/my-username

5.将Secret设置为环境变量

[kubeadm@server1 cm]$ cat cm2.yml apiVersion: v1 kind: Secret metadata: name: mysecret type: Opaque data: username: YWRtaW4= password: cmVkaGF0 --- apiVersion: v1 kind: Pod metadata: name: secret-env spec: containers: - name: nginx image: nginx env: - name: SECRET_USERNAME valueFrom: secretKeyRef: name: mysecret key: username - name: SECRET_PASSWORD valueFrom: secretKeyRef: name: mysecret key: password [kubeadm@server1 cm]$ kubectl delete pod mysecret pod "mysecret" deleted [kubeadm@server1 cm]$ vim cm2.yml [kubeadm@server1 cm]$ kubectl apply -f cm2.yml secret/mysecret unchanged pod/secret-env created [kubeadm@server1 cm]$ kubectl get pod NAME READY STATUS RESTARTS AGE my-nginx-56794ff6cb-5qxlq 1/1 Running 0 6h31m secret-env 1/1 Running 0 80s [kubeadm@server1 cm]$ kubectl exec secret-env -- env PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=secret-env SECRET_PASSWORD=redhat SECRET_USERNAME=admin

环境变量读取Secret很方便，但无法支撑Secret动态更新。

6.存储docker registry的认证信息

kubernetes.io/dockerconfigjson用于存储docker registry的认证信息.

[kubeadm@server1 cm]$ kubectl create secret docker-registry myregistrykey --docker-server=reg.red.org --docker-username=admin --docker-password=redhat --docker-email=root@server1.com secret/myregistrykey created [kubeadm@server1 cm]$ kubectl get secrets NAME TYPE DATA AGE basic-auth Opaque 1 3d23h default-token-5qqxc kubernetes.io/service-account-token 3 12d myregistrykey kubernetes.io/dockerconfigjson 1 23s mysecret Opaque 2 3d9h tls-secret kubernetes.io/tls 2 4d13h [kubeadm@server1 cm]$ vim pod.yml [kubeadm@server1 cm]$ cat pod.yml apiVersion: v1 kind: Pod metadata: name: mypod spec: containers: - name: game2048 image: reg.red.org/private/game2048 imagePullSecrets: - name: myregistrykey [kubeadm@server1 cm]$ kubectl apply -f pod.yml pod/mypod created [kubeadm@server1 cm]$ kubectl get pod NAME READY STATUS RESTARTS AGE my-nginx-56794ff6cb-5qxlq 1/1 Running 0 7h5m mypod 1/1 Running 0 23s secret-env 1/1 Running 0 35m [kubeadm@server1 cm]$ kubectl describe pod mypod Name: mypod Namespace: default Priority: 0 Node: server2/172.25.1.2 Start Time: Wed, 01 Jul 2020 17:10:50 +0800 Labels: <none> Annotations: Status: Running IP: 10.244.1.75 IPs: IP: 10.244.1.75 Events: Type Reason Age From Message ---- ------ ---- ---- ------- Normal Scheduled <unknown> default-scheduler Successfully assigned default/mypod to server2 Normal Pulling 36s kubelet, server2 Pulling image "reg.red.org/private/game2048" Normal Pulled 34s kubelet, server2 Successfully pulled image "reg.red.org/private/game2048" Normal Created 34s kubelet, server2 Created container game2048 Normal Started 34s kubelet, server2 Started container game2048

Processed: 0.019, SQL: 9