k8s配置与密钥管理

1、configmap

1.1 configmap创建方式

命令行创建方式

# kubectl create configmap cm1 --from-literal=host=127.0.0.1 --from-literal=port=3306
configmap/cm1 created
# kubectl describe cm cm1
Name:         cm1
Namespace:    default
Labels:       <none>
Annotations:  <none>

Data
====
host:
----
127.0.0.1
port:
----
3306
Events:  <none>
# kubectl get cm
NAME               DATA   AGE
cm1                2      43s
kube-root-ca.crt   1      24h

通过多个文件创建

# echo -n 127.0.0.1 > host
# echo -n 3306 > port
# kubectl create configmap cm2 --from-file=./host --from-file=./port

命令行通过文件提供多个键值对创建

# cat env.txt 
host=127.0.0.1
port=3306
# kubectl create configmap cm3 --from-env-file=env.txt

通过yaml资源清单文件创建

# cat cm4.yml 
apiVersion: v1
kind: ConfigMap
metadata:
  name: cm4
data:
  host: 127.0.0.1
  port: "3306"

# kubectl apply -f cm4.yml

1.2 configmap的使用方式

通过环境变量的方式传递给pod，这种方式不会热更新

# vim pod-cm1.yaml
apiVersion: v1
kind: Pod
metadata:
  name: pod-cm1
spec:
  containers:
  - name: busybox
    image: busybox
    args: [ "/bin/sh", "-c", "sleep 10000" ]
    envFrom:
    - configMapRef:
        name: cm1


# kubectl apply -f pod-cm1.yaml 

# kubectl get pods
NAME      READY   STATUS    RESTARTS   AGE
pod-cm1   1/1     Running   0          14s

# kubectl exec -it pod-cm1 -- env
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=pod-cm1
TERM=xterm
host=127.0.0.1
port=3306
KUBERNETES_PORT_443_TCP_PORT=443
KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1
KUBERNETES_SERVICE_HOST=10.96.0.1
KUBERNETES_SERVICE_PORT=443
KUBERNETES_SERVICE_PORT_HTTPS=443
KUBERNETES_PORT=tcp://10.96.0.1:443
KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443
KUBERNETES_PORT_443_TCP_PROTO=tcp
HOME=/root

通过volume方式挂载到pod内，这种方式会热更新，大约需要半分钟左右。

# vim pod-cm2.yml
apiVersion: v1
kind: Pod
metadata:
  name: pod-cm2
spec:
  containers:
  - name: busybox
    image: busybox
    args: [ "/bin/sh", "-c", "sleep 100000" ]
    volumeMounts:
    - name: vol-cm
      mountPath: "/etc/mysql"
      readOnly: true
  volumes:
  - name: vol-cm
    configMap:
      name: cm2

# kubectl apply -f pod-cm2.yml 

# kubectl exec pod-cm2 -- ls /etc/mysql
host
port
# kubectl exec pod-cm2 -- cat /etc/mysql/host
127.0.0.1

2、secret

2.1 创建方式

# echo -n 123 | base64 
MTIz
# vim secret-mysql.yaml
apiVersion: v1
kind: Secret
metadata:
  name: secret-mysql
data:
  password: MTIz

# kubectl apply -f secret-mysql.yaml 
# kubectl get secret
NAME                  TYPE                                  DATA   AGE
default-token-bkdlq   kubernetes.io/service-account-token   3      25h
secret-mysql          Opaque                                1      27s
# kubectl describe secret secret-mysql
Name:         secret-mysql
Namespace:    default
Labels:       <none>
Annotations:  <none>

Type:  Opaque

Data
====
password:  3 bytes

2.2 secert使用方法

通过环境方式传递Pod

# vim pod-mysql-secret.yml
apiVersion: v1
kind: Pod
metadata:
  name: pod-mysql-secret1
spec:
  containers:
  - name: mysql
    image: mysql:5.7
    env:
    - name: MYSQL_ROOT_PASSWORD
      valueFrom:
        secretKeyRef:
          name: secret-mysql
          key: password

# kubectl apply -f pod-mysql-secret.yml 

# kubectl exec pod-mysql-secret1 -- env
MYSQL_ROOT_PASSWORD=123

通过volume挂载传递

# cat pod-mysql-secret2.yml
apiVersion: v1
kind: Pod
metadata:
  name: pod-mysql-secret2
spec:
  containers:
  - name: busybox
    image: busybox
    args:
    - /bin/sh
    - -c
    - sleep 100000
    volumeMounts:
    - name: vol-secret
      mountPath: "/opt/passwd"
      readOnly: true
  volumes:
  - name: vol-secret
    secret:
      secretName: secret-mysql

# kubectl apply -f pod-mysql-secret1.yml
# kubectl exec pod-mysql-secret2 -- cat /opt/passwd/password
123