环境变量(env)是容器级别的参数，为容器设置环境变量方法有
- 变量值从Pod属性获取
- 变量值从自定义变量获取
- 变量值从ConfigMap获取
- 变量值从Secret获取

@Pod属性和自定义变量
test-env.yaml内容如下

apiVersion: v1
kind: Pod
metadata:
  name: test-env
spec:
  containers:
  - name: test-env
    image: busybox
    command: [ "sh", "-c", "sleep 3600"]
    env:
    - name: POD_NAME
      valueFrom:
        fieldRef:
          fieldPath: metadata.name
    - name: POD_NAMESPACE
      valueFrom:
        fieldRef:
          fieldPath: metadata.namespace
    - name: POD_IP
      valueFrom:
        fieldRef:
          fieldPath: status.podIP
    - name: date
      value: "2021-08-29"
    - name: hello
      value: "Greeting"

说明：
lines 11-22 变量值从Pod属性获取
lines 23-26 变量值从自定义变量获取

创建Pod后,进入容器, 获取变量值

[root@k8s-master ~]# kubectl get pod -o wide
NAME                                      READY   STATUS    RESTARTS   AGE     IP               NODE        NOMINATED NODE   READINESS GATES
dns                                       1/1     Running   3          3h42m   10.244.36.94     k8s-node1   <none>           <none>
nfs-client-provisioner-5fd446cd9d-c62kl   1/1     Running   0          8h      10.244.169.149   k8s-node2   <none>           <none>
test-env                                  1/1     Running   0          3m12s   10.244.36.99     k8s-node1   <none>           <none>
[root@k8s-master ~]#
[root@k8s-master ~]# kubectl exec -it test-env -- sh
/ # echo $POD_NAME
test-env
/ # echo $POD_NAMESPACE
default
/ # echo $POD_IP
10.244.36.99
/ # echo $date
2021-08-29
/ # echo $hello
Greeting
/ # exit
[root@k8s-master ~]#

@ ConfigMap

yaml可参考官方文档 -> ConfigMap | Kubernetes

test-configmap.yaml内容如下

apiVersion: v1
kind: ConfigMap
metadata:
  name: game-demo
data:
  # 类属性键；每一个键都映射到一个简单的值
  player_initial_lives: "3"
  ui_properties_file_name: "user-interface.properties"

  # 类文件键
  game.properties: |
    enemy.types=aliens,monsters
    player.maximum-lives=5    
  user-interface.properties: |
    color.good=purple
    color.bad=yellow
    allow.textmode=true 
---
apiVersion: v1
kind: Pod
metadata:
  name: test-configmap
spec:
  containers:
    - name: demo
      image: alpine
      command: ["sleep", "3600"]
      env:
        # 定义环境变量
        - name: PLAYER_INITIAL_LIVES # 请注意这里和 ConfigMap 中的键名是不一样的
          valueFrom:
            configMapKeyRef:
              name: game-demo           # 这个值来自 ConfigMap
              key: player_initial_lives # 需要取值的键
        - name: UI_PROPERTIES_FILE_NAME
          valueFrom:
            configMapKeyRef:
              name: game-demo
              key: ui_properties_file_name
      volumeMounts:
      - name: config
        mountPath: "/config"
        readOnly: true
  volumes:
    # 你可以在 Pod 级别设置卷，然后将其挂载到 Pod 内的容器中
    - name: config
      configMap:
        # 提供你想要挂载的 ConfigMap 的名字
        name: game-demo
        # 来自 ConfigMap 的一组键，将被创建为文件
        items:
        - key: "game.properties"
          path: "game.properties"
        - key: "user-interface.properties"
          path: "user-interface.properties"

说明：
1.ConfigMap的data部分
lines 6-8 一个键对应一个值
lines 10-17 配置的片段格式

2.Pod使用ConfigMap中的值
lines 28-39 环境变量
lines 40-55 在只读卷里面添加一个文件，让应用来读取

[root@k8s-master ~]# kubectl apply -f test-configmap.yaml
configmap/game-demo created
pod/test-configmap created
[root@k8s-master ~]# kubectl get configmap
NAME               DATA   AGE
game-demo          4      18s
kube-root-ca.crt   1      35d
[root@k8s-master ~]#

说明：configmap，game-demo列DATA的4代表  其包含4个键，对应34,39行和52,54行

然后进入Pod获取这些变量的值， 1）环境变量

[root@k8s-master ~]# kubectl get pod
NAME                                      READY   STATUS    RESTARTS   AGE
test-configmap                        1/1     Running   0          74s
dns                                       1/1     Running   5          15h
nfs-client-provisioner-5fd446cd9d-c62kl   1/1     Running   2          20h
test-env                                  1/1     Running   2          11h
[root@k8s-master ~]#
[root@k8s-master ~]# kubectl exec -it test-configmap -- sh
/ # env | grep enemy.types
/ #
/ # env
KUBERNETES_SERVICE_PORT=443
KUBERNETES_PORT=tcp://10.96.0.1:443
UI_PROPERTIES_FILE_NAME=user-interface.properties
HOSTNAME=test-configmap
SHLVL=1
HOME=/root
TERM=xterm
KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
KUBERNETES_PORT_443_TCP_PORT=443
KUBERNETES_PORT_443_TCP_PROTO=tcp
KUBERNETES_SERVICE_PORT_HTTPS=443
KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443
PLAYER_INITIAL_LIVES=3
KUBERNETES_SERVICE_HOST=10.96.0.1
PWD=/
/ # echo $PLAYER_INITIAL_LIVES
3
/ #
/ #
/ # env | grep UI_PROPERTIES_FILE_NAME
UI_PROPERTIES_FILE_NAME=user-interface.properties
/ # env | grep allow.textmode
/ #

2）挂载卷里的配置文件

/ # cd config/
/config # ls
game.properties            user-interface.properties
/config # cat game.properties
enemy.types=aliens,monsters
player.maximum-lives=5
/config # cat user-interface.properties
color.good=purple
color.bad=yellow
allow.textmode=true
/config #

@ Secret

Secret 是一种包含少量敏感信息例如密码、令牌或密钥的对象。 

要使用 Secret，Pod 需要引用 Secret，有三种方式：
由kubelet在为Pod拉取镜像时使用
作为挂载到一个或多个容器上的卷中的文件
作为容器的环境变量

Secret的类型

官方文档 -> Secret | Kubernetes

base64加解密
加密 echo -n 'string' | base64
解密 echo -n 'string' | base64 -d

注意: echo选项"-n" 表示不输出换行,对比如下

[root@k8s-master ~]# echo -n 'admin' | base64
YWRtaW4=
[root@k8s-master ~]# echo 'admin' | base64
YWRtaW4K
[root@k8s-master ~]# echo 'YWRtaW4=' | base64 -d
admin[root@k8s-master ~]#
[root@k8s-master ~]# echo 'YWRtaW4K' | base64 -d
admin
[root@k8s-master ~]# echo -n 'YWRtaW4K' | base64 -d
admin
[root@k8s-master ~]# echo -n 'YWRtaW4=' | base64 -d
admin[root@k8s-master ~]#

test-secret.yaml内容如下,

apiVersion: v1
data:
  username: YWRtaW4=
  password: MWYyZDFlMmU2N2Rm
kind: Secret
metadata:
  name: mysecret
type: Opaque
---
apiVersion: v1
kind: Pod
metadata:
  name: test-secret
spec:
  containers:
  - name: test-secret
    image: nginx
    env:
    - name: USER
      valueFrom:
        secretKeyRef:
          name: mysecret
          key: username
    - name: PASS
      valueFrom:
        secretKeyRef:
          name: mysecret
          key: password
    volumeMounts:
    - name: config
      mountPath: "/config"
      readOnly: true
  volumes:
  - name: config
    secret:
      secretName: mysecret
      items:
      - key: username
        path: usernamefile

创建Secret和Pod

[root@k8s-master ~]# kubectl apply -f test-secret.yaml
secret/mysecret created
pod/test-secret created
[root@k8s-master ~]# kubectl get secret
NAME                                 TYPE                                  DATA   AGE
mysecret                             Opaque                                2      13s
nfs-client-provisioner-token-hfwpd   kubernetes.io/service-account-token   3      35h
[root@k8s-master ~]#

进入Pod获取环境变量

[root@k8s-master ~]# kubectl get pod
NAME                                      READY   STATUS    RESTARTS   AGE
test-configmap                            1/1     Running   2          14h
dns                                       1/1     Running   8          30h
nfs-client-provisioner-5fd446cd9d-c62kl   1/1     Running   4          35h
test-env                                  1/1     Running   5          26h
test-secret                               1/1     Running   0          22s
[root@k8s-master ~]#
[root@k8s-master ~]# kubectl exec -it test-secret -- sh
# echo $USER
admin
# echo $PASS
1f2d1e2e67df
#
# cd config
# ls
usernamefile
# cat usernamefile
admin# exit
[root@k8s-master ~]#