应用启动过程中可能需要一些敏感信息，比如访问数据库的用户名、密码。将这些信息直接保存在容器镜像中显然不妥，Kubernetes提供的解决方案是Secret。Secret会以密文的方式存储数据，避免了直接在配置文件中保存敏感信息。

Secret会以Volume的形式被mount到Pod，容器可通过文件的方式使用Secret中的敏感数据；此外，容器也可以环境变量的方式使用这些数据。Secret可通过命令行或YAML创建。

创建Secret

（1）通过--from-literal：

[root@master pods]# kubectl create secret generic mysecret --from-literal=username=admin --from-literal=password=123456 
secret/mysecret created

（2）通过--from-file：

[root@master pods]# echo -n admin > ./username 
[root@master pods]# echo -n 123456 > ./password 
[root@master pods]# kubectl create secret generic mysecret --from-file=./username --from-file=./password
error: failed to create secret secrets "mysecret" already exists

（3）通过--from-env-file：

[root@master pods]# cat << EOF > env.txt
> username=admin
> password=123456
> EOF
[root@master pods]# kubectl create secret generic mysecret --from-env-file=env.txt
error: failed to create secret secrets "mysecret" already exists

（4）通过YAML配置文件：

apiVersion: v1
kind: Secret
metadata:
  name: mysecret
data:
  username: YWRtaW4=
  password: MTIzNDU2

或

apiVersion: v1
kind: Secret
metadata:
  name: mysecret
  namespace: dev
type: Opaque
stringData:
  username: admin
  password: 123456

使用data，文件中的敏感数据必须是通过base64编码后的结果；使用strinData，可以写明文

[root@master ~]# echo -n admin | base64
YWRtaW4=
[root@master ~]# echo -n 123456 | base64
MTIzNDU2

查看Secret

如果要查看value，通过kubectl edit secret mysecret，将其base64解码即可

[root@master ~]# kubectl edit secret mysecret

# Please edit the object below. Lines beginning with a '#' will be ignored,
# and an empty file will abort the edit. If an error occurs while saving this file will be
# reopened with the relevant failures.
#
apiVersion: v1
data:
  password: MTIzNDU2
  username: YWRtaW4=
kind: Secret
metadata:
  creationTimestamp: "2022-08-01T06:15:53Z"
  name: mysecret
  namespace: default
  resourceVersion: "549320"
  uid: 30646142-6f2b-40f6-88fe-03fcf5305f18
type: Opaque

[root@master ~]# echo MTIzNDU2 | base64 --decode
123456[root@master ~]#

在Pod中使用Secret

Pod可以通过Volume或者环境变量的方式使用Secret。

Volume方式

apiVersion: v1
kind: Pod
metadata:
  name: mypod
spec:
  containers:
  - name: mypod
    image: busybox
    args:
      - /bin/sh
      - -c
      - sleep 10; touch /tmp/healthy; sleep 30000
    volumeMounts:
    - name: foo
      mountPath: "/etc/foo"
      readOnly: true
  volumes:
  - name: foo
    secret:
      secretName: mysecret

[root@master ~]# kubectl apply -f mypod.yml 
pod/mypod created
[root@master ~]# kubectl exec -it mypod sh
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
/ # cd /etc/foo/
/etc/foo # ls
password  username
/etc/foo # cat username
admin/etc/foo # cat password
123456/etc/foo #

可以看到，Kubernetes会在指定的路径/etc/foo下为每条敏感数据创建一个文件，文件名就是数据条目的Key，这里是/etc/foo/username和/etc/foo/password，Value则以明文存放在文件中。

以Volume方式使用的Secret支持动态更新：Secret更新后，容器中的数据也会更新。

将secret配置文件中密码改为123（base64编码后）

apiVersion: v1
kind: Secret
metadata:
  name: mysecret
data:
  username: YWRtaW4=
  password: MTIz

[root@master ~]# kubectl apply -f secret.yml 
Warning: resource secrets/mysecret is missing the kubectl.kubernetes.io/last-applied-configuration annotation which is required by kubectl apply. kubectl apply should only be used on resources created declaratively by either kubectl create --save-config or kubectl apply. The missing annotation will be patched automatically.
secret/mysecret configured
[root@master ~]# kubectl exec -it mypod sh
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
/ # cd /etc/foo/
/etc/foo # ls
password  username
/etc/foo # cat password 
123/etc/foo #

可以看到，密码已同步更新

环境变量方式

apiVersion: v1
kind: Pod
metadata:
  name: mypod
spec:
  containers:
  - name: mypod
    image: busybox
    args:
      - /bin/sh
      - -c
      - sleep 10; touch /tmp/healthy; sleep 30000
    env:
      - name: SECRET_USERNAME
        valueFrom:
          secretKeyRef:
            name: mysecret
            key: username
      - name: SECRET_PASSWORD
        valueFrom:
          secretKeyRef:
            name: mysecret
            key: password

[root@master ~]# kubectl exec mypod -it sh
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
/ # echo $SECRET_USERNAME
admin
/ # echo $SECRET_PASSWORD
123
/ #

通过环境变量SECRET_USERNAME和SECRET_PASSWORD成功读取到Secret的数据。

需要注意的是，环境变量读取Secret很方便，但无法支撑Secret动态更新。

ConfigMap

Secret可以为Pod提供密码、Token、私钥等敏感数据；对于一些非敏感数据，比如应用的配置信息，则可以用ConfigMap。

ConfigMap的创建和使用方式与Secret非常类似，主要的不同是数据以明文的形式存放。

apiVersion: v1
kind: ConfigMap
metadata:
  name: myconfigmap
data:
  logging.conf: |
    class: logging.handlers.RotatingFileHandler
    formatter: precise
    level: INFO
    filename: %hostname-%timestamp.log

注意，别漏写了Key logging.conf后面的|符号

创建并查看ConfigMap

[root@master ~]# kubectl apply -f configMap.yml 
configmap/myconfigmap created
[root@master ~]# kubectl get configmap myconfigmap
NAME          DATA   AGE
myconfigmap   1      32s
[root@master ~]# kubectl describe configmap myconfigmap
Name:         myconfigmap
Namespace:    default
Labels:       <none>
Annotations:  <none>

Data
====
logging.conf:
----
class: logging.handlers.RotatingFileHandler
formatter: precise
level: INFO
filename: %hostname-%timestamp.log


BinaryData
====

Events:  <none>

在Pod中使用ConfigMap示例

apiVersion: v1
kind: ConfigMap
metadata:
  name: configmap
  namespace: dev
data:
  info:
    username:admin
    password:123456

apiVersion: v1
kind: Pod
metadata:
  name: pod-configmap
  namespace: dev
spec:
  containers:
    - name: nginx
      image: nginx:1.17.1
      volumeMounts:
        - mountPath: /configmap/config
          name: config
  volumes:
    - name: config
      configMap:
        name: configmap

12-Secret & Configmap