k8s之configmap、secret

配置信息注入 configmap、secret

簡介

  ConfigMap API資源提供了將配置數據注入容器的方式，同時保證該機制對容器來說是透明的。ConfigMap可以被用來保存單個屬性，也可以用來保存整個配置文件或者JSON二進制大對象。
  ConfigMap API資源存儲鍵/值對配置數據，這些數據可以在pods裏使用。ConfigMap跟Secrets類似，但是ConfigMap可以更方便的處理不包含敏感信息的字符串。

創建 configmap

通過命令行創建

kubectl create cm nginx-config --from-literal=nginx_port=80 --from-literal=server_name=myapp.test.org  
kubectl create configmap nginx-www --from-file=./www.conf

# cat www.conf
server {
        server_name myapp.test.org;
        listen 80;
        root /data/web/html;
}

查看 configmap

# kubectl get cm
NAME           DATA   AGE
nginx-config   2      29m
nginx-www      1      37m

實例一

# cat pod-configmap.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: pod-cm-1
  namespace: default
  labels:
    app: myapp
    tier: frontend
spec:
  containers:
  - name: myapp
    image: ikubernetes/myapp:v1
    ports:
    - name: http
      containerPort: 80
    env:
    - name: NGINX_SERVER_PORT
      valueFrom:
        configMapKeyRef:
          name: nginx-config
          key: nginx_port
    - name: NGINX_SERVER_NAME
      valueFrom:
        configMapKeyRef:
          name:  nginx-config
          key: server_name

實例二

掛載方式，通過 kubectl edit cm nginx-config 進行編輯後，pod 裏面的變量也會進行更新

# cat pod-configmap2.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: pod-cm-2
  namespace: default
  labels:
    app: myapp
    tier: frontend
spec:
  containers:
  - name: myapp
    image: ikubernetes/myapp:v1
    ports:
    - name: http
      containerPort: 80
    volumeMounts:
    - name: nginxconf
      mountPath: /etc/nginx/config.d/
      readOnly: true
  volumes:
  - name: nginxconf
    configMap:
      name: nginx-config

實例三

通過 kubectl edit cm nginx-www 進行編輯後，pod 裏面的配置文件也會進行更新,但是監聽端口不會更新，需要重載

# cat pod-configmap3.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: pod-cm-3
  namespace: default
  labels:
    app: myapp
    tier: frontend
spec:
  containers:
  - name: myapp
    image: ikubernetes/myapp:v1
    ports:
    - name: http
      containerPort: 80
    volumeMounts:
    - name: nginxconf
      mountPath: /etc/nginx/conf.d/
      readOnly: true
  volumes:
  - name: nginxconf
    configMap:
      name: nginx-www

創建 secret

# 支持三種方式：docker-registry、generic、tls
# kubectl create secret generic mysql-root-password --from-literal=password=123456
# kubectl get secrets  mysql-root-password 
NAME                  TYPE     DATA   AGE
mysql-root-password   Opaque   1      15s
# kubectl get  secrets  mysql-root-password -o yaml 
apiVersion: v1
data:
  password: MTIzNDU2
kind: Secret
metadata:
  creationTimestamp: "2018-12-18T03:29:02Z"
  name: mysql-root-password
  namespace: default
  resourceVersion: "1518882"
  selfLink: /api/v1/namespaces/default/secrets/mysql-root-password
  uid: 10721e2e-0275-11e9-928f-005056bae900
type: Opaque
# echo MTIzNDU2 | base64 -d  # 這種並不是真正的加密
123456

實例

# cat pod-secret-1.yaml
apiVersion: v1
kind: Pod
metadata:
  name: pod-secret-1
  namespace: default
  labels:
    app: myapp
    tier: frontend
spec:
  containers:
  - name: myapp
    image: ikubernetes/myapp:v1
    ports:
    - name: http
      containerPort: 80
    env:
    - name: MYSQL_ROOT_PASSWORD
      valueFrom:
        secretKeyRef:
          name: mysql-root-password
          key: password

# kubectl exec -it pod-secret-1 -- printenv | grep MYSQL_ROOT_PASSWORD
MYSQL_ROOT_PASSWORD=123456

當 ConfigMap 以數據卷的形式掛載進Pod的時，這時更 新ConfigMap（或刪掉重建ConfigMap），Pod內掛載的配置信息會熱更新。這時可以增加一些監測配置文件變更的腳本，然後reload對應服務。

Ref

• Configure a Pod to Use a ConfigMap
• Configmap