k8s学习笔记-ConfigMap和Secret

原创

羊草 2022-06-28 22:49:56 博主文章分类：docker&amp;k8s ©著作权

文章标签 mysql nginx 2d 文章分类 kubernetes 云计算

©著作权归作者所有：来自51CTO博客作者羊草的原创作品，请联系作者获取转载授权，否则将追究法律责任

ConfigMap：方便将配置文件与镜像（image）分离，以保障容器化应用程序的可移植性。

mysql：username：张三 username：李四

Secret：对象允许存储和管理敏感信息，比如密码，OAuth令牌和ssh秘钥。将此数据放入在secret里面。然后通过pod读取这样会更加安全灵活。

配置configMap

apiVersion: v1
kind: ConfigMap
metadata:
    name:test-config
data:
    username: zhangsan
    password: yuanke
    username: lisi

[root@master demo]# vi configMap.yaml
    apiVersion: v1
    kind: ConfigMap
    metadata:
        name: test-config
    data:
        username: zhangsan
        password: yuanke
        username: lisi

[root@master demo]# kubectl create -f configMap.yaml
configmap/test-config created
[root@master demo]# vi configMap.yaml
[root@master demo]# kubectl get configMaps
NAME          DATA   AGE
test-config   2      45s
[root@master demo]# kubectl describe configmaps test-config
Name:         test-config
Namespace:    default
Labels:       <none>
Annotations:  <none>

Data
====
password:
----
yuanke
username:
----
lisi
Events:  <none>

使用configMap

vi test-configMap-env-pod

apiVersion: v1
kind: Pod
metadata:
  name: test-configmap-env-pod
spec:
  containers:
     - name: test-container
       image: radial/busyboxplus
       imagePullPolicy: IfNotPresent
       command: ["/bin/sh","-c","sleep 1000000"]
       envFrom:
       - configMapRef:
            name: test-config

[root@master demo]# kubectl create -f test-configMap-env-pod
pod/test-configmap-env-pod created
[root@master demo]# kubectl get pod
NAME                                  READY   STATUS      RESTARTS   AGE
test-configmap-env-pod                1/1     Running     0          42s
[root@master demo]# kubectl exec -it test-configmap-env-pod -- env
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=test-configmap-env-pod
TERM=xterm
username=lisi
password=yuanke

环境变量的另一种方式

apiVersion: v1
kind: Pod
metadata:
  name: test-configmap-env-pod
spec:
  containers:
     - name: test-container
       image: radial/busyboxplus
       imagePullPolicy: IfNotPresent
       command: ["/bin/sh","-c","echo ${MYSQLUSER} ${MYSQLPASSWD};sleep 1000000"]
       env:
       - name: MYSQLUSER
         valueFrom:
            configMapKeyRef:
               name: test-config
               key: username
       - name: MYSQLPASSWD
         valueFrom:
            configMapKeyRef:
               name: test-config
               key: password

[root@master demo]# kubectl delete -f test-configMap-env-pod
pod "test-configmap-env-pod" deleted
[root@master demo]# kubectl create -f test-configMap-env-pod
pod/test-configmap-env-pod created
[root@master demo]# kubectl get pod
NAME                                  READY   STATUS      RESTARTS   AGE
pc-job-xtn4s                          0/1     Completed   0          13d
test-configmap-env-pod                1/1     Running     0          5s
[root@master demo]# kubectl exec -it test-configmap-env-pod -- env
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=test-configmap-env-pod
TERM=xterm
MYSQLUSER=lisi
MYSQLPASSWD=yuanke

手动创建SECRET

可以先以 json 或 yaml 格式在文件中创建一个 secret 对象，然后创建该对象。

每一项必须是 base64 编码：

$ echo -n "admin" | base64
YWRtaW4=
$ echo -n "1f2d1e2e67df" | base64
MWYyZDFlMmU2N2Rm

解密

echo 'YWRtaW4=' | base64 --decode
返回admin

vi secret-env.yaml

apiVersion: v1
kind: Secret
metadata:
  name: mysecret-env
type: Opaque
data:
  username: YWRtaW4=
  password: MWYyZDFlMmU2N2Rm

kubectl get secrets

[root@master demo]# kubectl create -f secret-env.yaml
secret/mysecret-env created
[root@master demo]# kubectl get secrets
NAME                  TYPE                                  DATA   AGE
default-token-mp2h9   kubernetes.io/service-account-token   3      21d
mysecret-env          Opaque                                2      10s
tls-secret            kubernetes.io/tls                     2      23h

vi secret-pod-env1.yaml

apiVersion: v1
kind: Pod
metadata:
  name: envfrom-secret
spec:
  containers:
     - name: test-nginx
       image: nginx
       envFrom:
       - secretRef:
            name: mysecret-env

kubectl create -f secret-pod-env1.yaml

kubectl exec -it envfrom-secret -- env

k8s学习笔记-ConfigMap和Secret_mysql

另一种引入方式

apiVersion: v1
kind: Pod
metadata:
  name: test-configmap-env-pod
spec:
  containers:
     - name: test-container
       image: radial/busyboxplus
       imagePullPolicy: IfNotPresent
       command: ["/bin/sh","-c","echo ${MYSQLUSER} ${MYSQLPASSWD};sleep 1000000"]
       env:
       - name: MYSQLUSER
         valueFrom:
            secretKeyRef:
               name: mysecret-env
               key: username
       - name: MYSQLPASSWD
         valueFrom:
            secretKeyRef:
               name: mysecret-env
               key: password

[root@master demo]# kubectl create -f test-secret-env-pod
pod/test-configmap-env-pod created
[root@master demo]# kubectl get pod
NAME                                  READY   STATUS      RESTARTS   AGE
deployment-example-868795bc5b-g2x7n   1/1     Running     0          5h29m
test-configmap-env-pod                1/1     Running     0          4s
[root@master demo]# kubectl exec -it test-configmap-env-pod -- env
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=test-configmap-env-pod
TERM=xterm
MYSQLPASSWD=1f2d1e2e67df
MYSQLUSER=admin