一: 精细化挂载items映射Secret

简介：

• 精细化挂载实际上就是挂载我们想要的secret键

定义Pod

[root@k8s-master secret]# vim use_item_secret.yaml

---
apiVersion: v1
kind: Pod
metadata:
  name: mypod
spec:
  containers:
  - name: testredis
    image: redis
    volumeMounts:                    #保留容器的挂载规则
    - name: foo
      mountPath: "/etc/foo"
      readOnly: true
  volumes:
  - name: foo
    secret:  # 数据卷来源是secret
      secretName: mysecret           #新增三行信息即可
      items:                         #不要把整个 Secret 都挂载，而是挑选需要的 key。
       - key: username               #将需要的哪个key重新定义到那个目录下
         path: my-group/my-username  #相对路径，相对于/etc/foo的路径

运行pod

[root@k8s-master secret]# kubectl apply -f  use_item_secret.yaml 
pod/mypod created
[root@k8s-master secret]# kubectl get pods 
NAME    READY   STATUS    RESTARTS   AGE
mypod   1/1     Running   0          13s
[root@k8s-master secret]# 

查看secret里面的值

[root@k8s-master secret]# kubectl exec -it mypod /bin/bash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
root@mypod:/data# cd /etc/foo/my-group
root@mypod:/etc/foo/my-group# ls
my-username
root@mypod:/etc/foo/my-group# cat my-username 
adminroot@mypod:/etc/foo/my-group# 

二: Secret自动更新

简介：

• 如果修改一个Secret的内容， 那么挂载了该Secret的容器中也将会取到更新后的值， 但是这个时间间隔是由kubelet的同步时间决定的

准备新的密钥:

[root@k8s-master secret]# echo pzx200668 |  base64
cHp4MjAwNjY4Cg==
[root@k8s-master secret]# 

修改secret.yaml

---
apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Opaque
data:
  username: YWRtaW4=   #修改为cHp4MjAwNjY4Cg==的base64加密后的
  password: cHp4QDEyMw==
  
  

更新secret

[root@k8s-master secret]# kubectl delete -f secret.yaml 
secret "mysecret" deleted
[root@k8s-master secret]# kubectl apply -f secret.yaml 
secret/mysecret created
[root@k8s-master secret]# 

进入容器查看是否变化

[root@k8s-master secret]# kubectl get pods 
NAME    READY   STATUS    RESTARTS   AGE
mypod   1/1     Running   0          24m
[root@k8s-master secret]# kubectl exec -it mypod /bin/bash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
root@mypod:/data# cd /etc/foo
root@mypod:/etc/foo# ls 
my-group
root@mypod:/etc/foo# cd my-group
root@mypod:/etc/foo/my-group# ls 
my-username
root@mypod:/etc/foo/my-group# cat my-username 
pzx200668
root@mypod:/etc/foo/my-group# 

# pzx200668 这个就说明我们的secret更新成功

三: Secret使用env

简介：

• Secret 映射为环境变量，无需修改一行代码，应用就能直接读取， 比挂载文件后再写代码读文件更省事

缺点：

• 以环境变量的形式使用Secret（secret更新，pod中不会自动更新,因为env是属于container下的资源，而不是pod下的资源，做不到实时更新）

定义并创建pod

# 1.0 定义pod

[root@k8s-master secret]# vim secret_use_env.yaml
[root@k8s-master secret]# 


---
apiVersion: v1
kind: Pod
metadata:
  name: mypod
spec:
  containers:
  - name: testredis
    image: redis               #删除挂载卷的方式，使用环境变量的方式
    env:                       #定义环境变量
     - name: SECRET_USERNAME   #创建新的环境变量名称
       valueFrom:
        secretKeyRef:          #调用的key是什么
         name: mysecret        #变量的值来自于mysecret
         key: username         #username里面的值



# 2.0 创建pod
[root@k8s-master secret]# kubectl apply -f pod_use_env.yaml 
pod/mypod created
[root@k8s-master secret]# 

进入pod中查看

[root@k8s-master secret]# kubectl get pods 
NAME    READY   STATUS    RESTARTS   AGE
mypod   1/1     Running   0          6s
[root@k8s-master secret]# kubectl exec -it mypod /bin/bash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
root@mypod:/data# echo $SECRET_USERNAME
pzx200668
root@mypod:/data# 

四: 生产实战

1.创建数据库用户的密码secret

[root@k8s-master secret]# mkdir test_secret_mysql
[root@k8s-master secret]# cd test_secret_mysql/
[root@k8s-master test_secret_mysql]# echo -n 'pzx@123456' |
>  base64
cHp4QDEyMzQ1Ng==
[root@k8s-master test_secret_mysql]# 

2.0 定义和创建secret

# 定义secret
apiVersion: v1
kind: Secret
metadata:
  name: mysql-secret
type: Opaque
data:
  password: cHp4QDEyMzQ1Ng==

# 创建secret

[root@k8s-master test_secret_mysql]# kubectl apply -f secret.yml 
secret/mysql-secret created
[root@k8s-master test_secret_mysql]# 

#kubectl describe secret mysql-secret

# kubectl get secret mysql-secret -o yaml

3.0 定义和创建pod

# 定义pod

---
apiVersion: v1
kind: Pod
metadata:
  name: my-mysql
spec:
  containers:
  - name: mysql
    image: mysql:5.7
    ports:
      - containerPort: 3306
    env:                               #声明两个环境变量
      - name: MYSQL_ROOT_PASSWORD      #从Secret读取root密码（核心配置）
        valueFrom:
          secretKeyRef:
            name: mysql-secret
            key: password
      - name: MYSQL_ROOT_HOST          #允许 root从任意IP远程连接（核心配置）
        value: "%"



# 创建pod

[root@k8s-master test_secret_mysql]# kubectl apply -f mysql.yaml 
pod/my-mysql created
[root@k8s-master test_secret_mysql]# kubectl get pods 
NAME       READY   STATUS              RESTARTS   AGE
my-mysql   0/1     ContainerCreating   0          8s
[root@k8s-master test_secret_mysql]# kubectl get pods 
NAME       READY   STATUS              RESTARTS   AGE
my-mysql   0/1     ContainerCreating   0          10s
[root@k8s-master test_secret_mysql]# docker pull mysql:5.7
5.7: Pulling from library/mysql
20e4dcae4c69: Pull complete 
1c56c3d4ce74: Pull complete 
e9f03a1c24ce: Pull complete 
68c3898c2015: Pull complete 
6b95a940e7b6: Pull complete 
90986bb8de6e: Pull complete 
ae71319cb779: Pull complete 
ffc89e9dfd88: Pull complete 
43d05e938198: Pull complete 
064b2d298fba: Pull complete 
df9a4d85569b: Pull complete 
Digest: sha256:4bc6bc963e6d8443453676cae56536f4b8156d78bae03c0145cbe47c2aad73bb
Status: Downloaded newer image for mysql:5.7
docker.io/library/mysql:5.7
[root@k8s-master test_secret_mysql]# kubectl get pods 
NAME       READY   STATUS    RESTARTS   AGE
my-mysql   1/1     Running   0        

[root@k8s-master test_secret_mysql]# kubectl get pods  -o wide 
NAME       READY   STATUS    RESTARTS   AGE   IP             NODE        NOMINATED NODE   READINESS GATES
my-mysql   1/1     Running   0          13m   10.244.36.67   k8s-node1   <none>           <none>
[root@k8s-master test_secret_mysql]# 

4.0 测试secret

# 下载数据库客户端

[root@k8s-master test_secret_mysql]# yum -y install mariadb

# 连接
[root@master 7test_secret_mysql]#mysql -uroot -p'pzx@123456' -h 10.244.36.67 -P3306