k8s之configmap和secret

1.configmap

  configmap和secret是兩種特殊的存儲卷,它們不是給pod提供存儲空間用的,而是給管理員或者用戶提供了從外部向pod內部注入信息的方式.

configmap:把配置文件放在配置中心上,然后多個pod讀取配置中心的配置文件,不過,configmap中的配置信息都是明文的,所以不安全;

secret:功能和configmap一樣,只不過配置中心存儲的配置文件不是明文的.configmap和secret也是專屬於某個名稱空間的.

# 用命令行創建configmap
kubectl create configmap nginx-config --from-literal=nginx_port=80 --from-literal=server_name=myapp.lixiang.com
kubectl describe cm nginx-config
# 用清單方式創建configmap
mkdir configmap && cd configmap
cat www.conf
server {
      server_name myapp.lixiang.com;
      listen 80;
      root /data/web/html;
}

kubectl create configmap nginx-www --from-file=www.conf
# 用ENV方式把configmap的配置信息注入到pod中
cat pod-configmap.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: pod-cm-1
  namespace: default
  labels:
    app: myapp
    tier: frontend
spec:
  containers: 
  - name: myapp
    image: ikubernetes/myapp:v1 
    ports:
    - name: http
      containerPort: 80
    env:
    - name: NGINX_SERVER_PORT
      valueFrom: # kubectl explain pods.spec.containers.env.valueFrom
        configMapKeyRef: # 表示要引用一個configmap來獲取數據
          name: nginx-config # configmap的名字
          key: nginx_port # 通過kubectl describe cm nginx-config的鍵
    - name: NGINX_SERVER_NAME
      valueFrom:
        configMapKeyRef:
          name: nginx-config
          key: server_name

kubectl apply -f pod-configmap.yaml
kubectl exec -it pod-cm-1 -- /bin/sh
# printenv
NGINX_SERVER_PORT=80
NGINX_SERVER_NAME=myapp.lixiang.com
# 通過edit方式修改configmap的配置文件,在Pod里面不會立即生效,需要重啟pod才能生效
kubectl edit cm nginx-config
# 用存儲卷的方法把configmap注入到pod中
cat pod-configmap2.ymal 
apiVersion: v1
kind: Pod
metadata:
  name: pod-cm-2
  namespace: default
  labels:
    app: myapp
spec:
  containers: 
  - name: myapp
    image: ikubernetes/myapp:v1 
    ports:
    - name: http
      containerPort: 80
    volumeMounts:
    - name: nginxconf
      mountPath: /etc/nginx/conf.d/
      readOnly: true
  volumes:
  - name: nginxconf
    configMap:
      name: nginx-config

kubectl apply -f pod-configmap2.ymal 
# 進入pod,可以看到configmap中的鍵值對,在/etc/nginx/conf.d/下以文件形式存在
# 把www.conf文件注入到pod中
cat pod-configmap3.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: pod-cm-3
  namespace: default
  labels:
    app: myapp
spec:
  containers: 
  - name: myapp
    image: ikubernetes/myapp:v1
    ports:
    - name: http
      containerPort: 80
    volumeMounts:
    - name: nginxconf
      mountPath: /etc/nginx/conf.d/
      readOnly: true
  volumes:
  - name: nginxconf
    configMap:
      name: nginx-www
kubectl apply -f pod-configmap3.yaml 
kubectl exec -it pod-cm-3 -- /bin/sh
/ # cd /etc/nginx/conf.d/
/etc/nginx/conf.d # ls
www.conf
/etc/nginx/conf.d # cat www.conf 
server {
      server_name myapp.lixiang.com;
      listen 80;
      root /data/web/html;
}
# 修改端口,pod中的配置文件同樣會發生變化
kubectl edit cm nginx-www

2.secret

  secret功能和configmap一樣,只不過secret配置中心存儲的配置文件不是明文的,一般將連接數據庫的密碼、私鑰等寫在secret中.

kubectl create secret --help

generic:保存密碼;

tls:保存私鑰、證書;

docker-registry:保存docker認證信息,比如從私有docker倉庫拉鏡像時,就用這個類型,k8s拖鏡像的進程是kublet.

# 如果從私有倉庫拉鏡像,就用imagePullSecrets存登錄驗證的信息
kubectl explain pods.spec.imagePullSecrets
kubectl create secret docker-registry LXregsecret --docker-server=registry.cn-hangzhou.aliyuncs.com \
--docker-username=xx --docker-password=xxxxxx --docker-email=xx
LXregsecret:指定secret的名字,可自行定義;--docker-email:郵件地址(選填)
該密鑰只能在對應namespace使用,也就是這里的default,如果需要在其他namespace中用到,需要在創建時指定名稱空間
containers:
- name: channel
  image: registry-internal.cn-hangzhou.aliyuncs.com/yin32167/channel:dev-1.0
ports:
- containerPort: 8114
imagePullSecrets:
- name: LXregsecret
# 
# 好像也可以這么創建,bash64 -wo 代表以64位轉碼展示並且不換行
cat .docker/config.json |base64 -w0
cat docker-secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: registrypullsecret
data:
  .dockerconfigjson: 加密串
type: kubernetes.io/dockerconfigjson

# password的內容會以base64的形式加密
kubectl create secret generic mysql-root-password --from-literal=password=123456
kubectl describe secret mysql-root-password
kubectl get secret mysql-root-password -o yaml
# 用base64進行解碼
echo MTIzNDU2 |base64 -d

# 把secret通過env的方式注入到pod里面
cat pod-secret-1.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: pod-secret-1
  namespace: default
  labels:
    app: myapp
spec:
  containers: 
  - name: myapp
    image: ikubernetes/myapp:v1 
    ports:
    - name: http
      containerPort: 80
    env:
    - name: MYSQL_ROOT_PASSWORD
      valueFrom:
        secretKeyRef:
          name: mysql-root-password
          key: password
kubectl apply -f pod-secret-1.yaml
kubectl exec -it pod-secret-1 -- /bin/sh
# printenv
MYSQL_ROOT_PASSWORD=123456
secret還可以用mount的方式注入pod中

 

參考博客:http://blog.itpub.net/28916011/viewspace-2214804/

在kubernetes集群中部署nginx+mysql+php應用:https://blog.csdn.net/bbwangj/article/details/82954187

kubernetes小課堂:https://k.i4t.com/