Kebernetes 學習總結(7) configmap 和 secret

爲了把配置文件從image中解耦，增強應用的可移植性、可複用性，k8s提供了configmap和seret。

configmap
configmap就是一系列配置數據的集合。而這些數據將來可以注入到pod中的container中。注入方式有兩種：1)、把configmap做存存儲卷，然後掛載；2)、使用ENV的valueFrom方式去引用configmap中所保存的數據。
configmap中保存着k:v格式的數據。value長度沒有限制。pod啓動時可以到configmap中獲取相關的配置項。
1、創建configmap
語法如下
kubectl create configmap cmName --from-file=/path/file_name
或 --from-file=key1=/path/file_name
方式一：

[root@k8s-master-dev volumes]# kubectl create configmap nginx-config --from-literal=nginx_port=80 --from-literal=server_name=myapp.inspiry.cn
configmap/nginx-config created
[root@k8s-master-dev volumes]# kubectl get cm
NAME           DATA      AGE
nginx-config   2         7s
[root@k8s-master-dev volumes]# kubectl describe cm nginx-config
Name:         nginx-config
Namespace:    default
Labels:       <none>
Annotations:  <none>

Data
====
nginx_port:
----
80
server_name:
----
myapp.inspiry.cn
Events:  <none>
[root@k8s-master-dev volumes]# cd ../

方式二：

[root@k8s-master-dev manifests]# mkdir configmap
[root@k8s-master-dev manifests]# cd configmap/
[root@k8s-master-dev configmap]# vim www.conf
[root@k8s-master-dev configmap]# cat www.conf
server {
    server_name myapp.inspiry.cn;
    listen 80;
    root /usr/share/nginx/html;
}
[root@k8s-master-dev configmap]# kubectl create configmap nginx-www --from-file=./www.conf
configmap/nginx-www created
[root@k8s-master-dev configmap]# kubectl get cm
NAME           DATA      AGE
nginx-config   2         2m
nginx-www      1         6s
[root@k8s-master-dev configmap]# kubectl describe cm nginx-www
Name:         nginx-www
Namespace:    default
Labels:       <none>
Annotations:  <none>

Data
====
www.conf:
----
server {
    server_name myapp.inspiry.cn;
    listen 80;
    root /usr/share/nginx/html;
}

Events:  <none>
[root@k8s-master-dev configmap]# kubectl get cm nginx-www -o json
{
    "apiVersion": "v1",
    "data": {
        "www.conf": "server {\n    server_name myapp.inspiry.cn;\n    listen 80;\n    root /usr/share/nginx/html;\n}\n"
    },
    "kind": "ConfigMap",
    "metadata": {
        "creationTimestamp": "2019-03-07T06:44:36Z",
        "name": "nginx-www",
        "namespace": "default",
        "resourceVersion": "117824",
        "selfLink": "/api/v1/namespaces/default/configmaps/nginx-www",
        "uid": "7965f8b2-40a4-11e9-8de3-000c295011ce"
    }
}
[root@k8s-master-dev configmap]#

2、configmap的使用
例1、

[root@k8s-master-dev configmap]# vim pod-configmap.yaml
[root@k8s-master-dev configmap]# cat pod-configmap.yaml
apiVersion: v1
kind: Pod
metadata:
  name: pod-cm-1
  namespace: default
  labels:
    app: myapp
    tier: frontend
  annotations:
    inspiry.com/author: "cluster admin"
spec:
  containers:
  - name: myapp
    image: ikubernetes/myapp:v1
    ports:
    - name: http
      containerPort: 80
    env:
    - name: NGINX_SERVER_PORT
      valueFrom:
        configMapKeyRef:
          name: nginx-config
          key: nginx_port
          optional: false
    - name: NGINX_SERVER_NAME
      valueFrom:
        configMapKeyRef:
          name: nginx-config
          key: server_name
          optional: false
[root@k8s-master-dev configmap]# kubectl apply -f pod-configmap.yaml
pod/pod-cm-1 created
[root@k8s-master-dev configmap]# kubectl get pods
NAME          READY     STATUS    RESTARTS   AGE
pod-cm-1      1/1       Running   0          22s
[root@k8s-master-dev configmap]# kubectl exec -it pod-cm-1 -- printenv
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=pod-cm-1
TERM=xterm
NGINX_SERVER_PORT=80
NGINX_SERVER_NAME=myapp.inspiry.cn
KUBERNETES_PORT_443_TCP_PROTO=tcp
KUBERNETES_PORT_443_TCP_PORT=443
KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1
KUBERNETES_SERVICE_HOST=10.96.0.1
KUBERNETES_SERVICE_PORT=443
KUBERNETES_SERVICE_PORT_HTTPS=443
KUBERNETES_PORT=tcp://10.96.0.1:443
KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443
MYAPP_SVC_PORT_80_TCP_PROTO=tcp
MYAPP_SVC_PORT=tcp://10.98.57.156:80
MYAPP_SVC_PORT_80_TCP_ADDR=10.98.57.156
MYAPP_SVC_SERVICE_HOST=10.98.57.156
MYAPP_SVC_SERVICE_PORT=80
MYAPP_SVC_PORT_80_TCP=tcp://10.98.57.156:80
MYAPP_SVC_PORT_80_TCP_PORT=80
NGINX_VERSION=1.12.2
HOME=/root
[root@k8s-master-dev configmap]#

它只在pod啓動時有效，如果pod啓動後再次kubectl edit cm nginx-config ，該pod將無法應用新的值。

例2、

[root@k8s-master-dev configmap]# kubectl delete -f pod-configmap.yaml
pod "pod-cm-1" deleted
[root@k8s-master-dev configmap]# vim pod-configmap2.yaml
[root@k8s-master-dev configmap]# cat pod-configmap2.yaml
apiVersion: v1
kind: Pod
metadata:
  name: pod-cm-2
  namespace: default
  labels:
    app: myapp
    tier: frontend
  annotations:
    inspiry.com/author: "cluster admin"
spec:
  containers:
  - name: myapp
    image: ikubernetes/myapp:v1
    ports:
    - name: http
      containerPort: 80
    volumeMounts:
    - name: nginxconf
      mountPath: /etc/nginx/con.d
      readOnly: true
  volumes:
  - name: nginxconf
    configMap:
      name: nginx-config
[root@k8s-master-dev configmap]# vim pod-configmap2.yaml
[root@k8s-master-dev configmap]#
[root@k8s-master-dev configmap]# kubectl apply -f pod-configmap2.yaml
pod/pod-cm-2 created
[root@k8s-master-dev configmap]# kubectl exec -it pod-cm-2 -- ls /etc/nginx/conf.d/
nginx_port   server_name
[root@k8s-master-dev configmap]# kubectl exec -it pod-cm-2 -- cat /etc/nginx/conf.d/nginx_port
80[root@k8s-master-dev configmap]#
[root@k8s-master-dev configmap]# kubectl exec -it pod-cm-2 -- cat /etc/nginx/conf.d/server_name
myapp.inspiry.cn[root@k8s-master-dev configmap]#
[root@k8s-master-dev configmap]#

當 kubectl edit cm nginx-config 將port 改爲8088之後，等待同步時間，然後再看容器內的變化：

/etc/nginx/config.d # cat nginx_port
8088/etc/nginx/config.d #
/etc/nginx/config.d #
[root@k8s-master-dev configmap]# kubectl delete -f pod-configmap2.yaml
pod "pod-cm-2" deleted
[root@k8s-master-dev configmap]#

例3、

[root@k8s-master-dev configmap]# vim pod-configmap3.yaml
[root@k8s-master-dev configmap]# cat pod-configmap3.yaml
apiVersion: v1
kind: Pod
metadata:
  name: pod-cm-3
  namespace: default
  labels:
    app: myapp
    tier: frontend
  annotations:
    inspiry.com/author: "cluster admin"
spec:
  containers:
  - name: myapp
    image: ikubernetes/myapp:v1
    ports:
    - name: http
      containerPort: 80
    volumeMounts:
    - name: nginxconf
      mountPath: /etc/nginx/conf.d
      readOnly: true
  volumes:
  - name: nginxconf
    configMap:
      name: nginx-www
[root@k8s-master-dev configmap]#
[root@k8s-master-dev configmap]# kubectl apply -f pod-configmap3.yaml
pod/pod-cm-3 created
[root@k8s-master-dev configmap]# kubectl get pods
NAME       READY     STATUS    RESTARTS   AGE
pod-cm-3   1/1       Running   0          30s
[root@k8s-master-dev configmap]# kubectl exec -it pod-cm-3 -- ls /etc/nginx/conf.d/
www.conf
[root@k8s-master-dev configmap]# kubectl exec -it pod-cm-3 -- cat /etc/nginx/conf.d/www.conf
server {
    server_name myapp.inspiry.cn;
    listen 80;
    root /usr/share/nginx/html;
}
[root@k8s-master-dev configmap]# kubectl exec -it pod-cm-3 -- /bin/sh
/ # nginx -T
.........
# configuration file /etc/nginx/conf.d/www.conf:
server {
    server_name myapp.inspiry.cn;
    listen 80;
    root /usr/share/nginx/html;
}

如果此時如果kubectl edit cm nginx-www 修改了port，等待同步時間，container內的配置會自動修改爲新port, 但還需要nginx -s reload ，nginx 才能生效新port。
如果需要mount掛載其中一部分配置，而不是全部配置：可以使用configMap.items

Secret
Secret是用來保存小片敏感數據的k8s資源，例如密碼，token，或者祕鑰。這類數據當然也可以存放在Pod或者鏡像中，但是放在Secret中是爲了更方便的控制如何使用數據，並減少暴露的風險。
1、創建secret

[root@k8s-master-dev configmap]# kubectl create secret generic mysql-root-passwd --from-literal=password=P@ssw0rd
secret/mysql-root-passwd created
[root@k8s-master-dev configmap]# kubectl get secret
NAME                  TYPE                                  DATA      AGE
default-token-lc8dv   kubernetes.io/service-account-token   3         1d
mysql-root-passwd     Opaque                                1         9s
[root@k8s-master-dev configmap]# kubectl describe secret mysql-root-passwd
Name:         mysql-root-passwd
Namespace:    default
Labels:       <none>
Annotations:  <none>

Type:  Opaque

Data
====
password:  8 bytes
[root@k8s-master-dev configmap]# kubectl get secret mysql-root-passwd -o yaml
apiVersion: v1
data:
  password: UEBzc3cwcmQ=
kind: Secret
metadata:
  creationTimestamp: 2019-03-07T07:54:00Z
  name: mysql-root-passwd
  namespace: default
  resourceVersion: "123811"
  selfLink: /api/v1/namespaces/default/secrets/mysql-root-passwd
  uid: 2b4babc4-40ae-11e9-8de3-000c295011ce
type: Opaque
[root@k8s-master-dev configmap]# echo UEBzc3cwcmQ= | base64 -d
P@ssw0rd[root@k8s-master-dev configmap]#
[root@k8s-master-dev configmap]#

2、使用secret (將secret映射到pod中)

[root@k8s-master-dev configmap]# vim pod-secret.yaml
[root@k8s-master-dev configmap]# cat pod-secret.yaml
apiVersion: v1
kind: Pod
metadata:
  name: pod-secret-1
  namespace: default
  labels:
    app: myapp
    tier: frontend
  annotations:
    inspiry.com/author: "cluster admin"
spec:
  containers:
  - name: myapp
    image: ikubernetes/myapp:v1
    ports:
    - name: http
      containerPort: 80
    env:
    - name: MYSQL_ROOT_PASSWORD
      valueFrom:
        secretKeyRef:
          name: mysql-root-passwd
          key: password
[root@k8s-master-dev configmap]#
[root@k8s-master-dev configmap]# kubectl apply -f pod-secret.yaml
pod/pod-secret-1 created
[root@k8s-master-dev configmap]# kubectl get pods
NAME           READY     STATUS    RESTARTS   AGE
pod-secret-1   1/1       Running   0          13s
[root@k8s-master-dev configmap]# kubectl exec pod-secret-1 -- printenv
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=pod-secret-1
MYSQL_ROOT_PASSWORD=P@ssw0rd
KUBERNETES_PORT_443_TCP_PORT=443
KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1
KUBERNETES_SERVICE_HOST=10.96.0.1
KUBERNETES_SERVICE_PORT=443
KUBERNETES_SERVICE_PORT_HTTPS=443
KUBERNETES_PORT=tcp://10.96.0.1:443
KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443
KUBERNETES_PORT_443_TCP_PROTO=tcp
MYAPP_SVC_PORT_80_TCP_PROTO=tcp
MYAPP_SVC_PORT=tcp://10.98.57.156:80
MYAPP_SVC_PORT_80_TCP_ADDR=10.98.57.156
MYAPP_SVC_SERVICE_HOST=10.98.57.156
MYAPP_SVC_SERVICE_PORT=80
MYAPP_SVC_PORT_80_TCP=tcp://10.98.57.156:80
MYAPP_SVC_PORT_80_TCP_PORT=80
NGINX_VERSION=1.12.2
HOME=/root
[root@k8s-master-dev configmap]#

Kebernetes 學習總結(7) configmap 和 secret

EXCEL中下拉菜單中添加新選項或者刪除選項

號稱能打敗MLP的KAN到底行不行？數學核心原理全面解析

同事使用 insert into select 遷移數據，開開心心上線，上線後被公司開除！

Git使用經驗總結5-修改提交信息

Python 爬蟲：Spring Boot 反爬蟲的成功案例

京東科技數字化營銷能力的演進與最佳實踐| 京東雲技術團隊

Git使用經驗總結4-撤回上一次本地提交

Java中止線程的方式

壓榨數據庫的真實處理速度

國內SaaS遇冷？未來企業服務賽道是否還有機會？

Kubernetes 學習總結(12) scheduler

Kebernetes 學習總結(11) K8s 網絡模型-canal策略控制(3)

Kebernetes 學習總結(11) K8s 網絡模型分析(1)

Kebernetes 學習總結(11) K8s 網絡模型分析(2)

Kebernetes 學習總結(11) K8s 資源監控

https://yachay.unat.edu.pe/blog/index.php?comment_area=format_blog&comment_component=blog&comment_co

linux以太網驅動總結