Kubernetes(k8s)密码管理：Secret

2023-02-02 17:44:41

一.系统环境

服务器版本	docker软件版本	Kubernetes(k8s)集群版本	CPU架构
CentOS Linux release 7.4.1708 (Core)	Docker version 20.10.12	v1.21.9	x86_64

Kubernetes集群架构：k8scloude1作为master节点，k8scloude2，k8scloude3作为worker节点

服务器	操作系统版本	CPU架构	进程	功能描述
k8scloude1/192.168.110.130	CentOS Linux release 7.4.1708 (Core)	x86_64	docker，kube-apiserver，etcd，kube-scheduler，kube-controller-manager，kubelet，kube-proxy，coredns，calico	k8s master节点
k8scloude2/192.168.110.129	CentOS Linux release 7.4.1708 (Core)	x86_64	docker，kubelet，kube-proxy，calico	k8s worker节点
k8scloude3/192.168.110.128	CentOS Linux release 7.4.1708 (Core)	x86_64	docker，kubelet，kube-proxy，calico	k8s worker节点

二.前言

使用secret的前提是已经有一套可以正常运行的Kubernetes集群，关于Kubernetes(k8s)集群的安装部署，可以查看博客《Centos7 安装部署Kubernetes(k8s)集群》https://www.cnblogs.com/renshengdezheli/p/16686769.html。

三.Secret概览

Secret 是一种包含少量敏感信息例如密码、令牌或密钥的对象。这样的信息可能会被放在 Pod 规约中或者镜像中。 使用 Secret 意味着你不需要在应用程序代码中包含机密数据。

由于创建 Secret 可以独立于使用它们的 Pod，因此在创建、查看和编辑 Pod 的工作流程中暴露 Secret（及其数据）的风险较小。 Kubernetes 和在集群中运行的应用程序也可以对 Secret 采取额外的预防措施，例如避免将机密数据写入非易失性存储。

Secret 类似于 ConfigMap 但专门用于保存机密数据。关于ConfigMap请查看博客《Kubernetes(k8s)配置文件管理：ConfigMap》。

注意：默认情况下，Kubernetes Secret 未加密地存储在 API 服务器的底层数据存储（etcd）中。任何拥有 API 访问权限的人都可以检索或修改 Secret，任何有权访问 etcd 的人也可以。此外，任何有权限在命名空间中创建 Pod 的人都可以使用该访问权限读取该命名空间中的任何 Secret；这包括间接访问，例如创建 Deployment 的能力。为了安全地使用 Secret，请至少执行以下步骤：

为 Secret 启用静态加密。
以小特权访问 Secret 并启用或配置 RBAC 规则。
限制 Secret 对特定容器的访问。
考虑使用外部 Secret 存储驱动。

四.Secret 的类型

创建 Secret 时，你可以使用 Secret 资源的 type 字段，或者与其等价的 kubectl 命令行参数（如果有的话）为其设置类型。 Secret 类型有助于对 Secret 数据进行编程处理。

Kubernetes 提供若干种内置的类型，用于一些常见的使用场景。针对这些类型，Kubernetes 所执行的合法性检查操作以及对其所实施的限制各不相同。

通过为 Secret 对象的 type 字段设置一个非空的字符串值，你也可以定义并使用自己 Secret 类型（如果 type 值为空字符串，则被视为 Opaque 类型）。
当 Secret 配置文件中未作显式设定时，默认的 Secret 类型是 Opaque。当你使用 kubectl 来创建一个 Secret 时，你会使用 generic 子命令来标明要创建的是一个 Opaque 类型的Secret。例如，下面的命令会创建一个空的 Opaque 类型 Secret 对象：

kubectl create secret generic empty-secret
kubectl get secret empty-secret

内置类型	用法
`Opaque`	用户定义的任意数据
`kubernetes.io/service-account-token`	服务账号令牌
`kubernetes.io/dockercfg`	`~/.dockercfg` 文件的序列化形式
`kubernetes.io/dockerconfigjson`	`~/.docker/config.json` 文件的序列化形式
`kubernetes.io/basic-auth`	用于基本身份认证的凭据
`kubernetes.io/ssh-auth`	用于 SSH 身份认证的凭据
`kubernetes.io/tls`	用于 TLS 客户端或者服务器端的数据
`bootstrap.kubernetes.io/token`	启动引导令牌数据

五.各种类型的secret使用实例

5.1 创建kubernetes.io/service-account-token类型的secret

查看secret，存在一个默认的secret。

[root@k8scloude1 secret-manage]# kubectl get secrets
NAME                  TYPE                                  DATA   AGE
default-token-wkjv8   kubernetes.io/service-account-token   3      26m

kubernetes.io/service-account-token类型的secret：每创建一个service-account账号，都会自动创建一个secret，这个secret用于保存token。

#查看sa
[root@k8scloude1 secret-manage]# kubectl get sa
NAME      SECRETS   AGE
default   1         170m

#创建service-account
[root@k8scloude1 secret-manage]# kubectl create sa satest
serviceaccount/satest created

#自动创建一个secret
[root@k8scloude1 secret-manage]# kubectl get secrets 
NAME                  TYPE                                  DATA   AGE
default-token-wkjv8   kubernetes.io/service-account-token   3      171m
satest-token-xv8x5    kubernetes.io/service-account-token   3      5s

删除service-account

[root@k8scloude1 secret-manage]# kubectl delete sa satest 
serviceaccount "satest" deleted

[root@k8scloude1 secret-manage]# kubectl get secrets 
NAME                  TYPE                                  DATA   AGE
default-token-wkjv8   kubernetes.io/service-account-token   3      171m

5.2 创建Docker镜像仓库类型的secret

查看imagePullSecrets的说明信息，imagePullSecrets 字段是一个列表，包含对同一命名空间中 Secret 的引用。你可以使用 imagePullSecrets 将包含 Docker（或其他）镜像仓库密码的 Secret 传递给 kubelet。kubelet 使用此信息来替 Pod 拉取私有镜像。

[root@k8scloude1 secret-manage]# kubectl explain pods.spec.imagePullSecrets
KIND:     Pod
VERSION:  v1

RESOURCE: imagePullSecrets <[]Object>

DESCRIPTION:
     ImagePullSecrets is an optional list of references to secrets in the same
     namespace to use for pulling any of the images used by this PodSpec. If
     specified, these secrets will be passed to individual puller
     implementations for them to use. For example, in the case of docker, only
     DockerConfig type secrets are honored. More info:
     https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod

     LocalObjectReference contains enough information to let you locate the
     referenced object inside the same namespace.

FIELDS:
   name	<string>
     Name of the referent. More info:
     https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

查看Docker镜像仓库类型的secret帮助

[root@k8scloude1 secret-manage]# kubectl create secret docker-registry --help | grep docker
      '$ docker login DOCKER_REGISTRY_SERVER --username=DOCKER_USER --password=DOCKER_PASSWORD --email=DOCKER_EMAIL'.
 That produces a ~/.dockercfg file that is used by subsequent 'docker push' and 'docker pull' commands to authenticate to the registry. The email address is optional.
  by creating a dockercfg secret and attaching it to your service account.
  # If you don't already have a .dockercfg file, you can create a dockercfg secret directly by using:
  kubectl create secret docker-registry my-secret --docker-server=DOCKER_REGISTRY_SERVER --docker-username=DOCKER_USER --docker-password=DOCKER_PASSWORD --docker-email=DOCKER_EMAIL
  # Create a new secret named my-secret from ~/.docker/config.json
  kubectl create secret docker-registry my-secret --from-file=.dockerconfigjson=path/to/.docker/config.json
      --docker-email='': Email for Docker registry
      --docker-password='': Password for Docker registry authentication
      --docker-server='https://index.docker.io/v1/': Server location for Docker registry
      --docker-username='': Username 为 Docker registry authentication
  kubectl create secret docker-registry NAME --docker-username=user --docker-password=password --docker-email=email [--docker-server=string] [--from-file=[key=]source] [--dry-run=server|client|none] [options]

创建一个镜像仓库类型的secret，该secret包含了镜像仓库的账号，密码，服务器地址

[root@k8scloude1 secret-manage]# kubectl create secret docker-registry dockerregistrysecret --docker-username=LZ --docker-password='qwer' --docker-server=http://192.168.110.133
secret/dockerregistrysecret created

[root@k8scloude1 secret-manage]# kubectl get secrets 
NAME                   TYPE                                  DATA   AGE
default-token-wkjv8    kubernetes.io/service-account-token   3      3h3m
dockerregistrysecret   kubernetes.io/dockerconfigjson        1      14s

kubernetes.io/dockerconfigjson类型的secrets用于镜像仓库不允许匿名用户pull镜像的情况，imagePullSecrets: dockerregistrysecret 指定镜像仓库的secret，dockerregistrysecret这个secrets里记录了镜像仓库的账号密码，这样就可以成功pull镜像下来了。

[root@k8scloude1 secret-manage]# vim test.yaml 

[root@k8scloude1 secret-manage]# cat test.yaml 
apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: mysql
  name: mysql
spec:
  terminationGracePeriodSeconds: 
  #imagePullSecrets: dockerregistrysecret  指定镜像仓库的secret
  imagePullSecrets: dockerregistrysecret
  containers:
  - image: 192.168.110.133/secret/mysql:latest
    imagePullPolicy: IfNotPresent
    name: mysql
    resources: {}
    env:
    - name: MYSQL_ROOT_PASSWORD
      value: rootsec
  dnsPolicy: ClusterFirst
  restartPolicy: Always
status: {}

删除dockerregistrysecret

[root@k8scloude1 secret-manage]# kubectl delete secrets dockerregistrysecret 
secret "dockerregistrysecret" deleted

[root@k8scloude1 secret-manage]# kubectl get secrets 
NAME                  TYPE                                  DATA   AGE
default-token-wkjv8   kubernetes.io/service-account-token   3      3h11m

5.3 创建Opaque类型的secret(键值对)

Opaque类型的secret创建语法为

kubectl create secret generic name --from-literal=键=值 --from-literal=键1=值1

创建secret的名字为genericsecret，两个键值对：tom=asd lisi=qwe，可以认为tom的密码为：asd，以此类推

[root@k8scloude1 secret-manage]# kubectl create secret generic genericsecret --from-literal=tom=asd --from-literal=lisi=qwe
secret/genericsecret created

查看secret

[root@k8scloude1 secret-manage]# kubectl get secrets 
NAME                  TYPE                                  DATA   AGE
default-token-wkjv8   kubernetes.io/service-account-token   3      3h20m
genericsecret         Opaque                                2      20s

查看secret的描述信息，在Data那里可以看到lisi和tom的密码是没有显示的

[root@k8scloude1 secret-manage]# kubectl describe secrets genericsecret 
Name:         genericsecret
Namespace:    secret-manage
Labels:       <none>
Annotations:  <none>

Type:  Opaque

Data
====
lisi:  3 bytes
tom:   3 bytes

以yaml文件的形式显示secrets，可以看到lisi和tom的密码已经被加密显示，是base64加密的。

lisi: cXdl tom: YXNk lisi和tom的密码是被base64加密过的。

[root@k8scloude1 secret-manage]# kubectl get secrets genericsecret -o yaml
apiVersion: v1
data:
  lisi: cXdl
  tom: YXNk
kind: Secret
metadata:
  creationTimestamp: "2022-01-21T07:13:57Z"
  name: genericsecret
  namespace: secret-manage
  resourceVersion: "875438"
  selfLink: /api/v1/namespaces/secret-manage/secrets/genericsecret
  uid: 6326fa13-ec9f-42dd-8eed-b35261389dde
type: Opaque

可以对密码进行解密：

[root@k8scloude1 secret-manage]# echo cXdl | base64 -d
qwe

[root@k8scloude1 secret-manage]# echo YXNk | base64 -d
asd

以JSON的格式显示

[root@k8scloude1 secret-manage]# kubectl get secrets genericsecret -o json
{
    "apiVersion": "v1",
    "data": {
        "lisi": "cXdl",
        "tom": "YXNk"
    },
    "kind": "Secret",
    "metadata": {
        "creationTimestamp": "2022-01-21T07:13:57Z",
        "name": "genericsecret",
        "namespace": "secret-manage",
        "resourceVersion": "875438",
        "selfLink": "/api/v1/namespaces/secret-manage/secrets/genericsecret",
        "uid": "6326fa13-ec9f-42dd-8eed-b35261389dde"
    },
    "type": "Opaque"
}

查询lisi，tom的密码

[root@k8scloude1 secret-manage]# kubectl get secrets genericsecret -o jsonpath={.data.lisi}
cXdl

[root@k8scloude1 secret-manage]# kubectl get secrets genericsecret -o jsonpath={.data.tom}
YXNk

查询secret的类型

[root@k8scloude1 secret-manage]# kubectl get secrets genericsecret -o jsonpath={.type}
Opaque

5.4 创建Opaque类型的secret（对文件加密）

secret可以直接使用文件进行加密，键为：文件名值为：文件内容，使用文件进行加密的语法如下：

kubectl create secret generic name --from-file=/dir/file --from-file=/dir1/file1

这个也是键值对，键：/etc/hosts文件值：文件内容

[root@k8scloude1 secret-manage]# kubectl create secret generic filesecret --from-file=/etc/hosts
secret/filesecret created

[root@k8scloude1 secret-manage]# kubectl get secrets 
NAME                  TYPE                                  DATA   AGE
default-token-wkjv8   kubernetes.io/service-account-token   3      3h34m
filesecret            Opaque                                1      6s
genericsecret         Opaque                                2      14m

查看secret的内容，host的内容同样被加密

[root@k8scloude1 secret-manage]# kubectl get secrets filesecret -o yaml
apiVersion: v1
data:
  hosts: MTI3LjAuMC4xICAgbG9jYWxob3N0IGxvY2FsaG9zdC5sb2NhbGRvbWFpbiBsb2NhbGhvc3Q0IGxvY2FsaG9zdDQubG9jYWxkb21haW40Cjo6MSAgICAgICAgIGxvY2FsaG9zdCBsb2NhbGhvc3QubG9jYWxkb21haW4gbG9jYWxob3N0NiBsb2NhbGhvc3Q2LmxvY2FsZG9tYWluNgoxOTIuMTY4LjExMC4xMzAgazhzY2xvdWRlMQoxOTIuMTY4LjExMC4xMjkgazhzY2xvdWRlMgoxOTIuMTY4LjExMC4xMjggazhzY2xvdWRlMwo=
kind: Secret
metadata:
  creationTimestamp: "2022-01-21T07:28:10Z"
  name: filesecret
  namespace: secret-manage
  resourceVersion: "877063"
  selfLink: /api/v1/namespaces/secret-manage/secrets/filesecret
  uid: 30880892-3fbe-4baf-8d9b-953c7cbe5534
type: Opaque


[root@k8scloude1 secret-manage]# kubectl get secrets filesecret -o jsonpath={.data.hosts}
MTI3LjAuMC4xICAgbG9jYWxob3N0IGxvY2FsaG9zdC5sb2NhbGRvbWFpbiBsb2NhbGhvc3Q0IGxvY2FsaG9zdDQubG9jYWxkb21haW40Cjo6MSAgICAgICAgIGxvY2FsaG9zdCBsb2NhbGhvc3QubG9jYWxkb21haW4gbG9jYWxob3N0NiBsb2NhbGhvc3Q2LmxvY2FsZG9tYWluNgoxOTIuMTY4LjExMC4xMzAgazhzY2xvdWRlMQoxOTIuMTY4LjExMC4xMjkgazhzY2xvdWRlMgoxOTIuMTY4LjExMC4xMjggazhzY2xvdWRlMwo=

对secret进行解密

[root@k8scloude1 secret-manage]# kubectl get secrets filesecret -o jsonpath={.data.hosts} | base64 -d
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.110.130 k8scloude1
192.168.110.129 k8scloude2
192.168.110.128 k8scloude3

直接使用两个文件创建secret

[root@k8scloude1 secret-manage]# kubectl create secret generic filesecret2 --from-file=/etc/hosts --from-file=/etc/shadow
secret/filesecret2 created

[root@k8scloude1 secret-manage]# kubectl get secrets filesecret2 -o yaml
apiVersion: v1
data:
  hosts: MTI3LjAuMC4xICAgbG9jYWxob3N0IGxvY2FsaG9zdC5sb2NhbGRvbWFpbiBsb2NhbGhvc3Q0IGxvY2FsaG9zdDQubG9jYWxkb21haW40Cjo6MSAgICAgICAgIGxvY2FsaG9zdCBsb2NhbGhvc3QubG9jYWxkb21haW4gbG9jYWxob3N0NiBsb2NhbGhvc3Q2LmxvY2FsZG9tYWluNgoxOTIuMTY4LjExMC4xMzAgazhzY2xvdWRlMQoxOTIuMTY4LjExMC4xMjkgazhzY2xvdWRlMgoxOTIuMTY4LjExMC4xMjggazhzY2xvdWRlMwo=
  shadow: cm9vdDokNiRaZEx6M20wRTk1clQ2RlJyJGNuWVJwMDU2bkZxVWJublovS3g4QzdzVkY0ZnZoWjNyM1VBRk5LWFYvVkhMQ1AwTGlwNGYzcDgydXMwLlYxeVcyb25RRzM5SzQ4LnAweUhTSmRkZnQuOjowOjk5OTk5Ojc6OjoKYmluOio6MTcxMTA6MDo5OTk5OTo3Ojo6CmRhZW1vbjoqOjE3MTEwOjA6OTk5OTk6Nzo6OgphZG06KjoxNzExMDowOjk5OTk5Ojc6OjoKbHA6KjoxNzExMDowOjk5OTk5Ojc6OjoKc3luYzoqOjE3MTEwOjA6OTk5OTk6Nzo6OgpzaHV0ZG93bjoqOjE3MTEwOjA6OTk5OTk6Nzo6OgpoYWx0Oio6MTcxMTA6MDo5OTk5OTo3Ojo6Cm1haWw6KjoxNzExMDowOjk5OTk5Ojc6OjoKb3BlcmF0b3I6KjoxNzExMDowOjk5OTk5Ojc6OjoKZ2FtZXM6KjoxNzExMDowOjk5OTk5Ojc6OjoKZnRwOio6MTcxMTA6MDo5OTk5OTo3Ojo6Cm5vYm9keToqOjE3MTEwOjA6OTk5OTk6Nzo6OgpzeXN0ZW1kLW5ldHdvcms6ISE6MTc4MjI6Ojo6OjoKZGJ1czohIToxNzgyMjo6Ojo6Ogpwb2xraXRkOiEhOjE3ODIyOjo6Ojo6CnBvc3RmaXg6ISE6MTc4MjI6Ojo6OjoKc3NoZDohIToxNzgyMjo6Ojo6OgpjaHJvbnk6ISE6MTc4MjI6Ojo6OjoKdG9tOiQ2JDEzdFdxdkFXUTBuR1hIMUUkVUx4aC5NcmZzUGh5QXhBMm84RUVqVTlrSnpSUlJPVEcxb1BkZXJvNlUyYmljZjRYYkFNVThyanZSQ2lTSlhnWEVrWjltTjhqYjFlZVJja1dmdm1XWjA6OjA6OTk5OTk6Nzo6Ogo=
kind: Secret
metadata:
  creationTimestamp: "2022-01-21T07:34:10Z"
  name: filesecret2
  namespace: secret-manage
  resourceVersion: "877748"
  selfLink: /api/v1/namespaces/secret-manage/secrets/filesecret2
  uid: e18212f1-eac1-457a-9b5f-aad39485f4dd
type: Opaque

解密

[root@k8scloude1 secret-manage]# kubectl get secrets filesecret2 -o jsonpath={.data.shadow} | base64 -d
root:$6$ZdLz3m0E95rT6FRr$cnYRp056nFqUbnnZ/Kx8C7sVF4fvhZ3r3UAFNKXV/VHLCP0Lip4f3p82us0.V1yW2onQG39K48.p0yHSJddft.::0:99999:7:::
bin:*:17110:0:99999:7:::
daemon:*:17110:0:99999:7:::
adm:*:17110:0:99999:7:::
lp:*:17110:0:99999:7:::
sync:*:17110:0:99999:7:::
shutdown:*:17110:0:99999:7:::
halt:*:17110:0:99999:7:::
mail:*:17110:0:99999:7:::
operator:*:17110:0:99999:7:::
games:*:17110:0:99999:7:::
ftp:*:17110:0:99999:7:::
nobody:*:17110:0:99999:7:::
systemd-network:!!:17822::::::
dbus:!!:17822::::::
polkitd:!!:17822::::::
postfix:!!:17822::::::
sshd:!!:17822::::::
chrony:!!:17822::::::
tom:$6$13tWqvAWQ0nGXH1E$ULxh.MrfsPhyAxA2o8EEjU9kJzRRROTG1oPdero6U2bicf4XbAMU8rjvRCiSJXgXEkZ9mN8jb1eeRckWfvmWZ0::0:99999:7:::

六.以环境变量的方式使用 Secret

6.1 明文方式保存MySQL密码

创建目录存放yaml文件

[root@k8scloude1 ~]# mkdir secret-manage

创建命名空间

[root@k8scloude1 ~]# kubectl create ns secret-manage

把命名空间切换到secret-manage

[root@k8scloude1 secret-manage]# kubens secret-manage
Context "kubernetes-admin@kubernetes" modified.
Active namespace is "secret-manage".

现在还没有pod

[root@k8scloude1 ~]# cd secret-manage/

[root@k8scloude1 secret-manage]# pwd
/root/secret-manage

[root@k8scloude1 secret-manage]# kubectl get pod -o wide
No resources found in secret-manage namespace.

配置一个mysql pod，设置mysql 的root密码为rootsec

[root@k8scloude1 secret-manage]# cat mysql.yaml 
apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: mysql
  name: mysql
spec:
  terminationGracePeriodSeconds: 
  containers:
  - image: hub.c.163.com/library/mysql:latest
    imagePullPolicy: IfNotPresent
    name: mysql
    resources: {}
    #设置环境变量
    env:
    #MySQL数据库的root密码为rootsec
    - name: MYSQL_ROOT_PASSWORD
      value: rootsec
  dnsPolicy: ClusterFirst
  restartPolicy: Always
status: {}

创建pod

[root@k8scloude1 secret-manage]# kubectl apply -f mysql.yaml 
pod/mysql created

[root@k8scloude1 secret-manage]# kubectl get pods -o wide
NAME    READY   STATUS    RESTARTS   AGE   IP               NODE         NOMINATED NODE   READINESS GATES
mysql   1/1     Running             6s    10.244.112.133   k8scloude2   <none>           <none>

安装mysql客户端，mariadb命令和mysql命令基本相同

[root@k8scloude1 secret-manage]# yum -y install mariadb

连接mysql容器，成功连接mysql

[root@k8scloude1 secret-manage]# mysql -uroot -prootsec -h 10.244.112.133
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MySQL connection id is 3
Server version: 5.7.18 MySQL Community Server (GPL)

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MySQL [(none)]> exit
Bye

查看pod的描述信息，发现mysql root密码是以明文的形式存在。

MYSQL_ROOT_PASSWORD: rootsec 直接就看到root密码了，不安全。所以我们可以采用secret的方式让账号密码不以明文的形式显示。

[root@k8scloude1 secret-manage]# kubectl describe pod mysql | grep -A10 Environment
    Environment:
      MYSQL_ROOT_PASSWORD:  rootsec
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-gbdtf (ro)
Conditions:
  Type              Status
  Initialized       True 
  Ready             True 
  ContainersReady   True 
  PodScheduled      True 
Volumes:

删除pod

[root@k8scloude1 secret-manage]# kubectl delete pod mysql --force
warning: Immediate deletion does not wait for confirmation that the running resource has been terminated. The resource may continue to run on the cluster indefinitely.
pod "mysql" force deleted

[root@k8scloude1 secret-manage]# kubectl get pod -o wide
No resources found in secret-manage namespace.

6.2 使用secret密文方式保存MySQL密码

现在把secret运用到pod里，配置MySQL pod的yaml文件

[root@k8scloude1 secret-manage]# vim mysqlsecret.yaml 

#以环境变量的方式引用secret
[root@k8scloude1 secret-manage]# cat mysqlsecret.yaml 
apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: mysql
  name: mysql
spec:
  terminationGracePeriodSeconds: 
  containers:
  - image: hub.c.163.com/library/mysql:latest
    imagePullPolicy: IfNotPresent
    name: mysql
    resources: {}
    env:
    - name: MYSQL_ROOT_PASSWORD
      valueFrom:
        secretKeyRef:
          #指定secret的名字和key
          name: genericsecret
          key: lisi
  dnsPolicy: ClusterFirst
  restartPolicy: Always
status: {}

创建pod

[root@k8scloude1 secret-manage]# kubectl apply -f mysqlsecret.yaml 
pod/mysql created

[root@k8scloude1 secret-manage]# kubectl get pod -o wide
NAME    READY   STATUS    RESTARTS   AGE   IP               NODE         NOMINATED NODE   READINESS GATES
mysql   1/1     Running             26s   10.244.112.132   k8scloude2   <none>           <none>

成功登录mysql

[root@k8scloude1 secret-manage]# mysql -uroot -pqwe -h 10.244.112.132
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MySQL connection id is 4
Server version: 5.7.18 MySQL Community Server (GPL)

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MySQL [(none)]> exit
Bye

查看pod的描述信息：MYSQL_ROOT_PASSWORD: <set to the key 'lisi' in secret 'genericsecret'> Optional: false，mysql的密码没有显示，这时候，MYSQL_ROOT_PASSWORD密码就不会以明文的方式显示了

[root@k8scloude1 secret-manage]# kubectl describe pod mysql | grep -A10 Environment
    Environment:
      MYSQL_ROOT_PASSWORD:  <set to the key 'lisi' in secret 'genericsecret'>  Optional: false
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-wl5jt (ro)
Conditions:
  Type              Status
  Initialized       True 
  Ready             True 
  ContainersReady   True 
  PodScheduled      True 
Volumes:

删除pod

[root@k8scloude1 secret-manage]# kubectl delete pod mysql --force
warning: Immediate deletion does not wait for confirmation that the running resource has been terminated. The resource may continue to run on the cluster indefinitely.
pod "mysql" force deleted

七.以卷的方式使用secret

7.1 以卷的方式使用secret

配置mysql pod的yaml文件，让secret以卷的方式应用，把filesecret值的内容挂载到/secret目录

[root@k8scloude1 secret-manage]# vim volumesecret.yaml 

[root@k8scloude1 secret-manage]# cat volumesecret.yaml 
apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: mysql
  name: mysql
spec:
  terminationGracePeriodSeconds: 
  #定义secret类型的卷
  volumes:
  - name: sec1
    secret:
      secretName: filesecret
  containers:
  - image: hub.c.163.com/library/mysql:latest
    imagePullPolicy: IfNotPresent
    name: mysql
    resources: {}
    #把sec1卷挂载到/secret目录
    volumeMounts:
    - name: sec1
      mountPath: /secret
    env:
    - name: MYSQL_ROOT_PASSWORD
      valueFrom:
        secretKeyRef:
          name: genericsecret
          key: lisi
  dnsPolicy: ClusterFirst
  restartPolicy: Always
status: {}

创建pod

[root@k8scloude1 secret-manage]# kubectl apply -f volumesecret.yaml 
pod/mysql created

[root@k8scloude1 secret-manage]# kubectl get pod -o wide
NAME    READY   STATUS    RESTARTS   AGE   IP               NODE         NOMINATED NODE   READINESS GATES
mysql   1/1     Running             57s   10.244.112.134   k8scloude2   <none>           <none>

进入mysql容器，hosts文件已经被挂载到/secret/目录下

[root@k8scloude1 secret-manage]# kubectl exec -it mysql -- bash
root@mysql:/# ls /secret/
hosts
root@mysql:/# cat /secret/hosts 
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.110.130 k8scloude1
192.168.110.129 k8scloude2
192.168.110.128 k8scloude3
root@mysql:/# 
root@mysql:/# exit
exit

删除pod

[root@k8scloude1 secret-manage]# kubectl delete pod mysql --force
warning: Immediate deletion does not wait for confirmation that the running resource has been terminated. The resource may continue to run on the cluster indefinitely.
pod "mysql" force deleted

filesecret2这个secret包含了两个文件，所以就挂载了两个文件到/secret目录下

[root@k8scloude1 secret-manage]# vim volumesecret.yaml 

[root@k8scloude1 secret-manage]# cat volumesecret.yaml 
apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: mysql
  name: mysql
spec:
  terminationGracePeriodSeconds: 
  #定义secret类型的卷
  volumes:
  - name: sec1
    secret:
      secretName: filesecret2
  containers:
  - image: hub.c.163.com/library/mysql:latest
    imagePullPolicy: IfNotPresent
    name: mysql
    resources: {}
    #把sec1卷挂载到/secret目录
    volumeMounts:
    - name: sec1
      mountPath: /secret
    env:
    - name: MYSQL_ROOT_PASSWORD
      valueFrom:
        secretKeyRef:
          name: genericsecret
          key: lisi
  dnsPolicy: ClusterFirst
  restartPolicy: Always
status: {}

创建pod

[root@k8scloude1 secret-manage]# kubectl apply -f volumesecret.yaml 
pod/mysql created

[root@k8scloude1 secret-manage]# kubectl get pod -o wide
NAME    READY   STATUS    RESTARTS   AGE   IP               NODE         NOMINATED NODE   READINESS GATES
mysql   1/1     Running             12s   10.244.112.135   k8scloude2   <none>           <none>

/secret/下有两个文件

[root@k8scloude1 secret-manage]# kubectl exec -it mysql -- bash
root@mysql:/# ls /secret/
hosts  shadow
root@mysql:/# exit
exit

删除pod

[root@k8scloude1 secret-manage]# kubectl delete pod mysql --force
warning: Immediate deletion does not wait for confirmation that the running resource has been terminated. The resource may continue to run on the cluster indefinitely.
pod "mysql" force deleted

filesecret2这个secret包含两个文件，subPath: shadow表示只挂载shadow文件

[root@k8scloude1 secret-manage]# vim volumesecret.yaml 

[root@k8scloude1 secret-manage]# cat volumesecret.yaml 
apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: mysql
  name: mysql
spec:
  terminationGracePeriodSeconds: 
  volumes:
  - name: sec1
    secret:
      secretName: filesecret2
  containers:
  - image: hub.c.163.com/library/mysql:latest
    imagePullPolicy: IfNotPresent
    name: mysql
    resources: {}
    volumeMounts:
    - name: sec1
      mountPath: /secret/sha.txt
      #subPath: shadow表示只挂载shadow文件
      subPath: shadow
    env:
    - name: MYSQL_ROOT_PASSWORD
      valueFrom:
        secretKeyRef:
          name: genericsecret
          key: lisi
  dnsPolicy: ClusterFirst
  restartPolicy: Always
status: {}

创建pod

[root@k8scloude1 secret-manage]# kubectl apply -f volumesecret.yaml 
pod/mysql created

[root@k8scloude1 secret-manage]# kubectl get pod -o wide
NAME    READY   STATUS    RESTARTS   AGE   IP               NODE         NOMINATED NODE   READINESS GATES
mysql   1/1     Running             16s   10.244.112.136   k8scloude2   <none>           <none>

只有一个文件被挂载

[root@k8scloude1 secret-manage]# kubectl exec -it mysql -- bash
root@mysql:/# ls /secret/
sha.txt
root@mysql:/# cat /secret/sha.txt 
root:$6$ZdLz3m0E95rT6FRr$cnYRp056nFqUbnnZ/Kx8C7sVF4fvhZ3r3UAFNKXV/VHLCP0Lip4f3p82us0.V1yW2onQG39K48.p0yHSJddft.::0:99999:7:::
bin:*:17110:0:99999:7:::
daemon:*:17110:0:99999:7:::
adm:*:17110:0:99999:7:::
lp:*:17110:0:99999:7:::
sync:*:17110:0:99999:7:::
shutdown:*:17110:0:99999:7:::
halt:*:17110:0:99999:7:::
mail:*:17110:0:99999:7:::
operator:*:17110:0:99999:7:::
games:*:17110:0:99999:7:::
ftp:*:17110:0:99999:7:::
nobody:*:17110:0:99999:7:::
systemd-network:!!:17822::::::
dbus:!!:17822::::::
polkitd:!!:17822::::::
postfix:!!:17822::::::
sshd:!!:17822::::::
chrony:!!:17822::::::
tom:$6$13tWqvAWQ0nGXH1E$ULxh.MrfsPhyAxA2o8EEjU9kJzRRROTG1oPdero6U2bicf4XbAMU8rjvRCiSJXgXEkZ9mN8jb1eeRckWfvmWZ0::0:99999:7:::
root@mysql:/# 
root@mysql:/# exit
exit

删除pod

[root@k8scloude1 secret-manage]# kubectl delete pod mysql --force
warning: Immediate deletion does not wait for confirmation that the running resource has been terminated. The resource may continue to run on the cluster indefinitely.
pod "mysql" force deleted

7.2 使用secret传递Nginx配置文件

以卷的方式引用secret，这种方式可以用来传递配置文件，不过更推荐使用ConfigMap传递配置文件。关于configmap的使用请查看博客《Kubernetes(k8s)配置文件管理：ConfigMap》。

创建一个名为nginxconfsecret的secret，该secret里包含一个Nginx的配置文件。

[root@k8scloude1 secret-manage]# kubectl create secret generic nginxconfsecret --from-file=nginx.conf 
secret/nginxconfsecret created

[root@k8scloude1 secret-manage]# kubectl get secrets 
NAME                  TYPE                                  DATA   AGE
default-token-wkjv8   kubernetes.io/service-account-token   3      4h47m
filesecret            Opaque                                1      73m
filesecret2           Opaque                                2      67m
genericsecret         Opaque                                2      87m
nginxconfsecret       Opaque                                1      17s

以yaml文件的形式查看secret

[root@k8scloude1 secret-manage]# kubectl get secrets nginxconfsecret -o yaml
apiVersion: v1
data:
  nginx.conf: CnVzZXIgIG5naW54Owp3b3JrZXJfcHJvY2Vzc2VzICBhdXRvOwoKZXJyb3JfbG9nICAvdmFyL2xvZy9uZ2lueC9lcnJvci5sb2cgbm90aWNlOwpwaWQgICAgICAgIC92YXIvcnVuL25naW54LnBpZDsKCgpldmVudHMgewogICAgd29ya2VyX2Nvbm5lY3Rpb25zICAxMDI0Owp9CgoKaHR0cCB7CiAgICBpbmNsdWRlICAgICAgIC9ldGMvbmdpbngvbWltZS50eXBlczsKICAgIGRlZmF1bHRfdHlwZSAgYXBwbGljYXRpb24vb2N0ZXQtc3RyZWFtOwoKICAgIGxvZ19mb3JtYXQgIG1haW4gICckcmVtb3RlX2FkZHIgLSAkcmVtb3RlX3VzZXIgWyR0aW1lX2xvY2FsXSAiJHJlcXVlc3QiICcKICAgICAgICAgICAgICAgICAgICAgICckc3RhdHVzICRib2R5X2J5dGVzX3NlbnQgIiRodHRwX3JlZmVyZXIiICcKICAgICAgICAgICAgICAgICAgICAgICciJGh0dHBfdXNlcl9hZ2VudCIgIiRodHRwX3hfZm9yd2FyZGVkX2ZvciInOwoKICAgIGFjY2Vzc19sb2cgIC92YXIvbG9nL25naW54L2FjY2Vzcy5sb2cgIG1haW47CgogICAgc2VuZGZpbGUgICAgICAgIG9uOwogICAgI3RjcF9ub3B1c2ggICAgIG9uOwoKICAgIGtlZXBhbGl2ZV90aW1lb3V0ICA2NTsKCiAgICAjZ3ppcCAgb247CgogICAgaW5jbHVkZSAvZXRjL25naW54L2NvbmYuZC8qLmNvbmY7Cn0KCg==
kind: Secret
metadata:
  creationTimestamp: "2022-01-21T08:40:57Z"
  name: nginxconfsecret
  namespace: secret-manage
  resourceVersion: "885421"
  selfLink: /api/v1/namespaces/secret-manage/secrets/nginxconfsecret
  uid: 97da759f-ef07-4edb-94a2-f04b043d7336
type: Opaque

配置Nginx pod的配置文件，把secret：nginxconfsecret包含的nginx.conf挂载到/etc/nginx/nginx.conf下。

[root@k8scloude1 secret-manage]# vim volumenginxconfsecret.yaml 

[root@k8scloude1 secret-manage]# cat volumenginxconfsecret.yaml 
apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: nginx
  name: nginx
spec:
  terminationGracePeriodSeconds: 
  #定义secret类型的卷
  volumes:
  - name: sec1
    secret:
      secretName: nginxconfsecret
  containers:
  - image: nginx
    imagePullPolicy: IfNotPresent
    name: nginx
    resources: {}
    #把nginxconfsecret这个secret挂载到/etc/nginx/nginx.conf
    volumeMounts:
    - name: sec1
      mountPath: /etc/nginx/nginx.conf
      subPath: nginx.conf
  dnsPolicy: ClusterFirst
  restartPolicy: Always
status: {}

创建pod

[root@k8scloude1 secret-manage]# kubectl apply -f volumenginxconfsecret.yaml 
pod/nginx created

[root@k8scloude1 secret-manage]# kubectl get pod -o wide
NAME    READY   STATUS    RESTARTS   AGE   IP               NODE         NOMINATED NODE   READINESS GATES
nginx   1/1     Running             15s   10.244.112.138   k8scloude2   <none>           <none>

进入Nginx容器，查看Nginx的配置文件

[root@k8scloude1 secret-manage]# kubectl exec -it nginx -- bash
root@nginx:/# ls /etc/nginx/
conf.d	fastcgi_params	mime.*  modules  nginx.conf  scgi_params  uwsgi_params
root@nginx:/# ls /etc/nginx/nginx.conf 
/etc/nginx/nginx.conf

root@nginx:/# cat /etc/nginx/nginx.conf | head -3

user  nginx;
worker_processes  auto;
root@nginx:/# exit
exit

这种方式可以改变secret的内容从而达到改变容器里配置文件内容的目的，但是编辑secret（edit secret）的时候内容加密了，不好修改，这种方式不常用，推荐使用ConfigMap传递配置文件，关于configmap的使用请查看博客《Kubernetes(k8s)配置文件管理：ConfigMap》。

删除pod

[root@k8scloude1 secret-manage]# kubectl delete pod nginx --force
warning: Immediate deletion does not wait for confirmation that the running resource has been terminated. The resource may continue to run on the cluster indefinitely.
pod "nginx" force deleted