博客原文
Secret介紹
k8s secrets用于存儲(chǔ)和管理一些敏感數(shù)據(jù)，比如密碼，token，密鑰等敏感信息。它把 Pod 想要訪問(wèn)的加密數(shù)據(jù)存放到 Etcd 中。然后用戶就可以通過(guò)在 Pod 的容器里掛載 Volume 的方式或者環(huán)境變量的方式訪問(wèn)到這些 Secret 里保存的信息了。
Secret 類似于 ConfigMap 但專門用于保存機(jī)密數(shù)據(jù)。
Secret 類型
| 內(nèi)置類型 | 用法 |
|---|---|
| Opaque | 用戶定義的任意數(shù)據(jù) |
| kubernetes.io/service-account-tokensymotion | 服務(wù)賬號(hào)令牌 |
| kubernetes.io/dockercfg | ~/.dockercfg 文件的序列化形式 |
| kubernetes.io/dockerconfigjson | ~/.docker/config.json 文件的序列化形式 |
| kubernetes.io/basic-auth | 用于基本身份認(rèn)證的憑據(jù) |
| kubernetes.io/ssh-auth | 用于 SSH 身份認(rèn)證的憑據(jù) |
| kubernetes.io/tls | 用于 TLS 客戶端或者服務(wù)器端的數(shù)據(jù) |
| bootstrap.kubernetes.io/token | 啟動(dòng)引導(dǎo)令牌數(shù)據(jù) |
kubectl 創(chuàng)建類型
$ kubectl create secret dotfile -h
Create a secret with specified type.
A docker-registry type secret is for accessing a container registry.
A generic type secret indicate an Opaque secret type.
A tls type secret holds TLS certificate and its associated key.
Available Commands:
docker-registry Create a secret for use with a Docker registry
generic Create a secret from a local file, directory, or literal value
tls Create a TLS secret
-
docker-registry: 連接私有鏡像倉(cāng)庫(kù)的憑證 -
generic: 常見 secret, 該類型 secret 與 configmap 使用相同 -
tls: 提供 tls 證書, 在 service mesh 中自動(dòng)掛載
Secret 使用
使用場(chǎng)景:
- 設(shè)置容器的環(huán)境變量。
- 向 Pod 提供 SSH 密鑰或密碼等憑據(jù)。
- 允許 kubelet 從私有鏡像倉(cāng)庫(kù)中拉取鏡像。
Opaque 類型 Secret 的使用
創(chuàng)建
1. kubectl create
$ kubectl create secret generic dotfile --from-literal=username=admin --from-literal=password=123456
$ kubectl get secret dotfile -oyaml
apiVersion: v1
data:
password: MTIzNDU2
username: YWRtaW4=
kind: Secret
metadata:
creationTimestamp: "2024-01-09T07:45:19Z"
name: dotfile
namespace: default
resourceVersion: "621858"
uid: ce3a3332-5b97-4af0-8312-ced355786e64
type: Opaque
$ echo -n "YWRtaW4=" | base64 -d
admin
2. yaml
以 yaml 方式創(chuàng)建需要你提前進(jìn)行 base64
$ echo -n "admin" | base64
YWRtaW4=
$ echo -n "123456" | base64
MTIzNDU2
apiVersion: v1
kind: Secret
metadata:
name: dotfile
namespace: default
type: Opaque
data:
password: MTIzNDU2
username: YWRtaW4=
immutable: true
你可以通過(guò)將 Secret 的
immutable字段設(shè)置為true創(chuàng)建不可更改的 Secret。
創(chuàng)建
$ kubectl create -f dotfile-secret.yaml
掛載
1. 作為環(huán)境變量
創(chuàng)建 pod
apiVersion: v1
kind: Pod
metadata:
name: pod1
spec:
containers:
- image: busybox
name: busybox
command: ["/bin/sh","-c","echo $username && env"]
env:
- name: username
valueFrom:
secretKeyRef:
key: username
name: dotfile # secret 名稱
獲取容器日志
# 創(chuàng)建
$ kubectl create -f pod1.yaml
$ kubectl logs pod1
admin
KUBERNETES_SERVICE_PORT=443
KUBERNETES_PORT=tcp://10.96.0.1:443
HOSTNAME=pod1
SHLVL=1
username=admin
HOME=/root
KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
KUBERNETES_PORT_443_TCP_PORT=443
KUBERNETES_PORT_443_TCP_PROTO=tcp
KUBERNETES_SERVICE_PORT_HTTPS=443
KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443
KUBERNETES_SERVICE_HOST=10.96.0.1
PWD=/
2. 作為文件掛載及設(shè)置 POSIX 權(quán)限
對(duì)于 volume 掛載, 推薦 configmap 總結(jié) k8s 中 volume 掛載的種種情況, 及最佳實(shí)踐
創(chuàng)建 pod
apiVersion: v1
kind: Pod
metadata:
name: pod2
spec:
volumes:
- name: sec
secret:
secretName: dotfile
defaultMode: 0400 # 設(shè)置文件權(quán)限
containers:
- image: busybox
name: busybox
command: ["sleep", "24h"]
volumeMounts:
- mountPath: /etc/config
name: sec
注意: secret 掛載到容器后自動(dòng) base64 解碼
$ kubectl exec pod2 -- ls -l /etc/config/
total 0
lrwxrwxrwx 1 root root 15 Jan 9 08:00 password -> ..data/password
lrwxrwxrwx 1 root root 15 Jan 9 08:00 username -> ..data/username
$ kubectl exec pod2 -- cat /etc/config/username
admin
Secret 綁定 serviceAccount
k8s 中 pod 會(huì)掛載 serviceAccount
- 掛載路徑: /var/run/secrets/kubernetes.io/serviceaccount
- 掛載內(nèi)容該 serviceAccount 的:
ca.crt,namespace,token
secret:
apiVersion: v1
kind: Secret
metadata:
name: sa-secret
annotations:
kubernetes.io/service-account.name: "tdd"
type: kubernetes.io/service-account-token
data:
password: MTIzNDU2
username: YWRtaW4=
我們?yōu)?secret 添加了 kubernetes.io/service-account.name字段, 為其指定的 serviceAccount, 創(chuàng)建了 Secret 之后，等待 Kubernetes 在 data 字段中填充 token 主鍵。
查看 secret
$ kubectl get secrets sa-secret -oyaml
apiVersion: v1
data:
ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURCVENDQWUyZ0F3SUJBZ0lJWVB2VXI2cG02NFF3RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TXpFeU16QXdPVE16TVRkYUZ3MHpNekV5TWpjd09UTTRNVGRhTUJVeApFekFSQmdOVkJBTVRDbXQxWW1WeWJtVjBaWE13Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLCkFvSUJBUUM0M1JFazZPZ0VFMGVWN1JHbmc1YnRONEdHaE5uUFNjbUZuYy9LKzhlSEZESVlPRkRKblZlZ0tOUmQKblVOSEFUL2h3T3RaWFZUTHhieWRGTVNqd0xSeDVPNTg5bUlVM3M2SlVZZjFvajFCUjFsWlkreXA5eVRGdXFYYQphbzc3WTVPbkVpT3BOQXUxek1WWUFRK0V2bzJtbmY2b0p6WDd3SFc2TkxZd0V0TVA2cklhclNaaU11MTllRnBWCnpmNU5RMGFGUU4vbkJyQUpHQm15eHF1cGhNRFpYOXlyK1c3emY4Q296NkxuTHRCMCtIaEtHYm9kUGVyaWk0bjgKczJlc2tLdmZ6NmdJK0dhR3ROYWtNU3gwbVZXV0MycTBDbndrOVJEOTNhd1JWRHd2VnZRczljR1B0R0I3WVdIcApDOXBLeTdaOEgybjdDZndza2FqZTMzWnhuUzJaQWdNQkFBR2pXVEJYTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUIwR0ExVWREZ1FXQkJRU1oxaVlWKzlQNTRiNHB3UU9QVkI0TklXYndEQVYKQmdOVkhSRUVEakFNZ2dwcmRXSmxjbTVsZEdWek1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQkdNRzMvN3dSZwp0ZkxDMkNHTGtRcUdaQmNtTlBzR0lwbmRqSnpTSzVjMXJMSVUrNjNHN3ZnWEJENHVuZ3B5RDFRVE5VSWp1ZVRXCkMxM1lZb1ZjK09zZkIvWFlVRkFvZ1JiWWtvZjV2TTBUeFVzdXN1VVUvT0Q2NDc0cE5xajlzQStrejRiMUliMzAKOVFmUG5mM2ZieVZyVmh0dlYxQmxsNVMwMmVDa2xaazM1SjAzczFLdytOWHovSjQzTDF6UlJjNytCa3M1UVpvbAp2ZnhJYW1BaXdqWGFUMDBhVVB3WjZ4S215KzcvUkZuRjB4aExlanhKRTBrOUU0YWR3NGhWSkNWMUp2aWdzcEpDCmNQL3BJMC9hSlVKeHVKNWZVeENuRVRVOXRpNi9aTGloeDg4Uk1vdmRFS0R4RDZJYlpKSWkxYVJwajhVeGdnL0UKcm1ONU5YTnN3Sk9XCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
namespace: ZGVmYXVsdA==
password: MTIzNDU2
token: ZXlKaGJHY2lPaUpTVXpJMU5pSXNJbXRwWkNJNkluZHBiR05VZVVwd1pUbEpRbEJpV0ZReGFFeHFaamh5WlROWE4wOHdXRXBtU1Y4eGJtODRWblp0UlVFaWZRLmV5SnBjM01pT2lKcmRXSmxjbTVsZEdWekwzTmxjblpwWTJWaFkyTnZkVzUwSWl3aWEzVmlaWEp1WlhSbGN5NXBieTl6WlhKMmFXTmxZV05qYjNWdWRDOXVZVzFsYzNCaFkyVWlPaUprWldaaGRXeDBJaXdpYTNWaVpYSnVaWFJsY3k1cGJ5OXpaWEoyYVdObFlXTmpiM1Z1ZEM5elpXTnlaWFF1Ym1GdFpTSTZJbk5oTFhObFkzSmxkQ0lzSW10MVltVnlibVYwWlhNdWFXOHZjMlZ5ZG1salpXRmpZMjkxYm5RdmMyVnlkbWxqWlMxaFkyTnZkVzUwTG01aGJXVWlPaUowWkdRaUxDSnJkV0psY201bGRHVnpMbWx2TDNObGNuWnBZMlZoWTJOdmRXNTBMM05sY25acFkyVXRZV05qYjNWdWRDNTFhV1FpT2lKbVpEWTRZelkwTVMwMU1qSXpMVFJsTUdRdFlqRXlaQzFpWkdKbE5ETXlOMlpsT0dZaUxDSnpkV0lpT2lKemVYTjBaVzA2YzJWeWRtbGpaV0ZqWTI5MWJuUTZaR1ZtWVhWc2REcDBaR1FpZlEuY09UZXoyM2w3VFl2TjFFN1FYcW4xVkN4dUxhbEJCN0JOMTVyU05IWFZndk5waEY4ZTd3ZkY4R3VheXFaSmZtdXB3ZE5HVzV2SFVRbE8yQVQtX3pGZkEta0hSbEN6OVZzZUVnTV82S0lrZ3FiZlNKNGw2WDRQOWFwaEdvYUhBaEdJUGdibTVGU1UwTWR6NlhzNW9fSnVvVjZfWkxxN3BZRVlGU0Y3REF1U0VyZHljSjdBZFFidWl6cHhuOE5lb3JhZ3Y5OWNDWjFlQjVJS0lGQW05SjBld1dlZEJBOUJhM0haN2RXQWozNE9uLW9mTWVKOWtQcmhvZWlUb2dtSkk5SE9NYWd4Ynh4YmF5cVpYdW9TQWJBSkNqVkRoUVZxdUJZRnJ5T09lWFowSnlXaWkyeVdVQWVvdVNDSEtRWUFXd2pmU2dwaGtKdzFQUkE4M3pFQWFmc3hn
username: YWRtaW4=
kind: Secret
metadata:
annotations:
kubernetes.io/service-account.name: tdd
kubernetes.io/service-account.uid: fd68c641-5223-4e0d-b12d-bdbe4327fe8f
creationTimestamp: "2024-01-09T08:49:30Z"
name: sa-secret
namespace: default
resourceVersion: "630499"
uid: c41bc253-c2c4-4d2f-a5d9-0a4fe8b0d8da
type: kubernetes.io/service-account-token
可以看到 kubernetes 控制器自動(dòng)為其填充了 namespace, token, ca
TLS Secret
創(chuàng)建方式
yaml 方式創(chuàng)建
apiVersion: v1
kind: Secret
metadata:
name: secret-tls
type: kubernetes.io/tls
data:
# 值為 base64 編碼，這樣會(huì)掩蓋它們，但不會(huì)提供任何有用的機(jī)密性級(jí)別
tls.crt: |
LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNVakNDQWJzQ0FnMytNQTBHQ1NxR1NJYjNE
UUVCQlFVQU1JR2JNUXN3Q1FZRFZRUUdFd0pLVURFT01Bd0cKQTFVRUNCTUZWRzlyZVc4eEVEQU9C
......
# 在這個(gè)例子中，密鑰數(shù)據(jù)不是真正的 PEM 編碼的私鑰
tls.key: |
RXhhbXBsZSBkYXRhIGZvciB0aGUgVExTIGNydCBmaWVsZA==
kubectl 創(chuàng)建
$ kubectl create secret tls my-tls-secret \
--cert=path/to/cert/file \
--key=path/to/key/file
Docker 鏡像倉(cāng)庫(kù) Secret
yaml 方式創(chuàng)建
apiVersion: v1
kind: Secret
metadata:
name: secret-dockercfg
type: kubernetes.io/dockercfg
data:
.dockercfg: |
eyJhdXRocyI6eyJodHRwczovL2V4YW1wbGUvdjEvIjp7ImF1dGgiOiJvcGVuc2VzYW1lIn19fQo=
kubectl 方式創(chuàng)建
$ kubectl create secret docker-registry secret-tiger-docker \
--docker-email=tiger@acme.example \
--docker-username=tiger \
--docker-password=pass1234 \
--docker-server=my-registry.example:5000
$ kubectl get secret secret-tiger-docker -o jsonpath='{.data.*}' | base64 -d
輸出等價(jià)于以下 JSON 文檔（這也是一個(gè)有效的 Docker 配置文件）：
{
"auths": {
"my-registry.example:5000": {
"username": "tiger",
"password": "pass1234",
"email": "tiger@acme.example",
"auth": "dGlnZXI6cGFzczEyMzQ="
}
}
}
ssh 類型 secret
通過(guò)文件創(chuàng)建
$ kubectl create secret generic ssh-key-secret --from-file=ssh-privatekey=/path/to/.ssh/id_rsa --from-file=ssh-publickey=/path/to/.ssh/id_rsa.pub
pod 掛載 ssh secret
apiVersion: v1
kind: Pod
metadata:
name: secret-test-pod
labels:
name: secret-test
spec:
volumes:
- name: secret-volume
secret:
secretName: ssh-key-secret
containers:
- name: ssh-test-container
image: mySshImage
volumeMounts:
- name: secret-volume
readOnly: true
mountPath: "/etc/secret-volume"
容器命令執(zhí)行時(shí)，秘鑰的數(shù)據(jù)可以在下面的位置訪問(wèn)到：文章來(lái)源：http://www.zghlxwxcb.cn/news/detail-813023.html
/etc/secret-volume/ssh-publickey
/etc/secret-volume/ssh-privatekey
容器就可以隨便使用 Secret 數(shù)據(jù)來(lái)建立 SSH 連接。文章來(lái)源地址http://www.zghlxwxcb.cn/news/detail-813023.html
參考
- https://kubernetes.io/zh-cn/docs/concepts/configuration/secret/#service-account-token-secrets
- https://kubernetes.io/zh-cn/docs/tasks/inject-data-application/distribute-credentials-secure/#provide-prod-test-creds
- https://kubernetes.io/zh-cn/docs/tasks/configure-pod-container/pull-image-private-registry/
到了這里，關(guān)于K8S Secret 一文詳解, 全面覆蓋 Secret 使用場(chǎng)景 | 全家桶的文章就介紹完了。如果您還想了解更多內(nèi)容，請(qǐng)?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！
