K8S之配置管理
文章目录一、Secret方式一:方式二:第一种:使用secret中的变量导入到pod中第二种:以volume的形式挂载到pod的某个目录下二、ConfigMap创建方式一:kubectl第二种变量参数形式一、Secret加密数据并存放在Etcd中,让Pod的容器以挂载Volume方式访问应用场景:凭据https://kubernetes.io/docs/concepts/configuration
·
文章目录
一、Secret
加密数据并存放在Etcd中,让Pod的容器以挂载Volume方式访问
应用场景:凭据
https://kubernetes.io/docs/concepts/configuration/secret/
方式一:
[root@localhost demo]# echo -n 'admin' > ./username.txt
[root@localhost demo]# echo -n '1f2d1e2e67df' > ./password.txt
[root@localhost demo]# kubectl create secret generic db-user-pass --from-file=./username.txt --from-file=./password.txt
secret/db-user-pass created
[root@localhost demo]# kubectl get secret
NAME TYPE DATA AGE
db-user-pass Opaque 2 61s
[root@localhost demo]# kubectl describe secret db-user-pass
Name: db-user-pass
Namespace: default
Labels: <none>
Annotations: <none>
Type: Opaque
Data
====
password.txt: 12 bytes
username.txt: 5 bytes
方式二:
[root@localhost demo]# echo -n 'admin' | base64
YWRtaW4=
[root@localhost demo]# echo -n '1f2d1e2e67df' | base64
MWYyZDFlMmU2N2Rm
[root@localhost demo]# vim secret.yaml
apiVersion: v1
kind: Secret
metadata:
name: mysecret
type: Opaque
data:
username: YWRtaW4=
password: MWYyZDFlMmU2N2Rm
[root@localhost demo]# kubectl create -f secret.yaml
secret/mysecret created
[root@localhost demo]# kubectl get secret
NAME TYPE DATA AGE
mysecret Opaque 2 50s
第一种:使用secret中的变量导入到pod中
复制configmap.yaml和secret-simple.yaml
[root@localhost demo]# kubectl get secret mysecret -o yaml
apiVersion: v1
data:
password: MWYyZDFlMmU2N2Rm
username: YWRtaW4=
kind: Secret
metadata:
creationTimestamp: 2020-02-19T03:54:50Z
name: mysecret
namespace: default
resourceVersion: "973651"
selfLink: /api/v1/namespaces/default/secrets/mysecret
uid: 93d69e01-52cb-11ea-895a-000c297a15fb
type: Opaque
//key: username赋值给SECRET_USERNAME
//key: password 赋值给SECRET_PASSWORD
[root@localhost demo]# vim secret-var.yaml
apiVersion: v1
kind: Pod
metadata:
name: mypod
spec:
containers:
- name: nginx
image: nginx
env:
- name: SECRET_USERNAME
valueFrom:
secretKeyRef:
name: mysecret
key: username
- name: SECRET_PASSWORD
valueFrom:
secretKeyRef:
name: mysecret
key: password
[root@localhost demo]# kubectl apply -f secret-var.yaml
pod/mypod created
[root@localhost demo]# kubectl get pods
NAME READY STATUS RESTARTS AGE
mypod 1/1 Running 0 38s
[root@localhost demo]# kubectl exec -it mypod bash
root@mypod:/# echo $SECRET_USERNAME
admin
root@mypod:/# echo $SECRET_PASSWORD
1f2d1e2e67df
第二种:以volume的形式挂载到pod的某个目录下
[root@localhost demo]# vim secret-vol.yaml
apiVersion: v1
kind: Pod
metadata:
name: mypod
spec:
containers:
- name: nginx
image: nginx
volumeMounts:
- name: foo
mountPath: "/etc/foo"
readOnly: true
volumes:
- name: foo
secret:
secretName: db-user-pass
[root@localhost demo]# kubectl delete -f secret-var.yaml
pod "mypod" deleted
[root@localhost demo]# kubectl create -f secret-vol.yaml
pod/mypod created
[root@localhost demo]# kubectl get pods
NAME READY STATUS RESTARTS AGE
mypod 1/1 Running 0 94s
//容器看见里面的文件被挂载
[root@localhost demo]# kubectl exec -it mypod bash
root@mypod:/# ls /etc/foo
password username
root@mypod:/# cd /etc/foo
root@mypod:/etc/foo# cat password
1f2d1e2e67df
root@mypod:/etc/foo# cat username
admin
二、ConfigMap
与Secret类似,区别在于ConfigMap保存的是不需要加密配置的信息
应用场景:应用配置
创建方式一:kubectl
[root@localhost demo]# vim redis.properties
redis.host=127.0.0.1
redis.port=6379
redis.password=123456
//创建configmap资源
[root@localhost demo]# kubectl create configmap redis-config --from-file=redis.properties
configmap/redis-config created
//查看资源
[root@localhost demo]# kubectl get configmap
NAME DATA AGE
redis-config 1 32s
//也可以用缩写查看
[root@localhost demo]# kubectl get cm
NAME DATA AGE
redis-config 1 78s
[root@localhost demo]# kubectl describe cm redis-config
Name: redis-config
Namespace: default
Labels: <none>
Annotations: <none>
Data
====
redis.properties:
----
redis.host=127.0.0.1
redis.port=6379
redis.password=123456
Events: <none>
//创建mypod资源查看文件导入
[root@localhost demo]# vim cm.yaml
apiVersion: v1
kind: Pod
metadata:
name: mypod
spec:
containers:
- name: busybox
image: busybox
command: [ "/bin/sh","-c","cat /etc/config/redis.properties" ]
volumeMounts:
- name: config-volume
mountPath: /etc/config
volumes:
- name: config-volume
configMap:
name: redis-config
restartPolicy: Never
//删除掉之前创建重名的mypod
[root@localhost demo]# kubectl delete pod mypod
pod "mypod" deleted
[root@localhost demo]# kubectl apply -f cm.yaml
pod/mypod created
[root@localhost demo]# kubectl get pods
NAME READY STATUS RESTARTS AGE
mypod 0/1 Completed 0 7m59s
//查看里面的配置信息
[root@localhost demo]# kubectl logs mypod
redis.host=127.0.0.1
redis.port=6379
redis.password=123456
第二种变量参数形式
//创建configmap资源
[root@localhost demo]# vim myconfig.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: myconfig
namespace: default
data:
special.level: info
special.type: hello
[root@localhost demo]# kubectl apply -f myconfig.yaml
configmap/myconfig created
//创建mypod使用configmap资源输出变量参数
[root@localhost demo]# vim config-var.yaml
apiVersion: v1
kind: Pod
metadata:
name: mypod
spec:
containers:
- name: busybox
image: busybox
command: [ "/bin/sh", "-c", "echo $(LEVEL) $(TYPE)" ]
env:
- name: LEVEL
valueFrom:
configMapKeyRef:
name: myconfig
key: special.level
- name: TYPE
valueFrom:
configMapKeyRef:
name: myconfig
key: special.type
restartPolicy: Never
//清除已有的mypod资源
[root@localhost demo]# kubectl delete pod mypod
pod "mypod" deleted
//创建mypod资源
[root@localhost demo]# kubectl apply -f config-var.yaml
pod/mypod created
//查看变量的输出
[root@localhost demo]# kubectl logs mypod
info hello
更多推荐
已为社区贡献11条内容
所有评论(0)