Kubernetes 存储 Secret _defaultmode 256-优快云博客

1.定义

2.分类

3.Opaque

1.概念

2.创建

1.base 64 编码

echo -n "jmj" | base64

2.base 64 解码

echo -n "am1q" | base64 -d

3.切记secret对象的value值必须经过base64位编码

因为他会对value自动按照base64 解码如果你放入的值没有编码，那他就会出现错乱

3.实验

echo -n "admin" | base64

echo -n "1f2d1e2e67df" | base64

创建 1.secret.yaml

apiVersion: v1
kind: Secret
metadata:
 name: mysecret
type: Opaque
data:
 password: MWYyZDFlMmU2N2Rm
 username: YWRtaW4=

kubectl create -f 1.secret.yaml

他不会告诉你value 只会告诉你字节大小

想要获取value

kubectl get secret mysecret -o yaml

4.使用

1.env方案

创建 8.deployment.yaml 文件

apiVersion: apps/v1
kind: Deployment
metadata:
 labels:
  app: opaque-secret-env
 name: opaque-secret-env-deploy
spec:
 replicas: 5
 selector:
  matchLabels:
   app: op-se-env-pod
 template:
  metadata:
   labels:
    app: op-se-env-pod
  spec:
   containers:
    - image: wangyanglinux/myapp:v1.0
      name: myapp-continaer
      ports:
        - containerPort: 80
      env:
        - name: TEST_USER
          valueFrom:
            secretKeyRef:
               name: mysecret
               key: username
        - name: TEST_PASSWORD
          valueFrom:
            secretKeyRef:
               name: mysecret
               key: password

kubectl apply -f 8.deployment.yaml

kubectl get pod

随便进入一个

kubectl exec -it opaque-secret-env-deploy-7f868565fb-22v2b -- /bin/bash

env

创建的时候 value需要通过base64编码

我们在挂载的时候它会把这个value值进行自动的解码

2.volume 方案

1.案例1 挂载文件

创建 9.pod.yaml

apiVersion: v1
kind: Pod
metadata:
 labels:
  name: secret-volume
 name: secret-volume-pod
spec:
 volumes:
   - name: volumes12
     secret:
     secretName: mysecret
 containers:
   - image: wangyanglinux/myapp:v1.0
     name: myapp-container
     volumeMounts:
       - name: volumes12
         mountPath: "/data"

kubectl create -f 9.pod.yaml

kubectl exec -it secret-volume-pod  -- /bin/bash

进入pod

cd /data

ls -l ..data/password

644 权限

删除pod

kubectl delete pod  secret-volume-pod

2.案例2 挂载文件的权限修改

apiVersion: v1
kind: Pod
metadata:
 labels:
  name: secret-volume
 name: secret-volume-pod
spec:
 volumes:
   - name: volumes12
     secret:
       secretName: mysecret
       defaultMode: 256
 containers:
   - image: wangyanglinux/myapp:v1.0
     name: myapp-container
     volumeMounts:
       - name: volumes12
         mountPath: "/data"

将刚才的权限改为 256 对应的 8进制是400

kubectl create -f 10.pod.yaml

 kubectl exec -it secret-volume-pod  -- /bin/bash

400

3.案例3 指定某个key到某个目录下

apiVersion: v1
kind: Pod
metadata:
 labels:
  name: secret-volume
 name: secret-volume-pod
spec:
 volumes:
   - name: volumes12
     secret:
       secretName: mysecret
       items:
         - key: username
           path: my-group/my-username
 containers:
   - image: wangyanglinux/myapp:v1.0
     name: myapp-container
     volumeMounts:
       - name: volumes12
         mountPath: "/data"