whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Unified use of YAML for Secret example (#5418)

Browse Source 
* Unified use of YAML for Secret example

* Fix dotfiles in secret volume yaml
This commit is contained in:
Kyle Bai
2017-09-13 03:21:34 +08:00
committed by Zach Corleissen
parent 48714d5c9d
commit 97f089ed88
1 changed files with 187 additions and 295 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/concepts/configuration/secret.md
+187 -295
View File
@@ -182,32 +182,23 @@ To consume a Secret in a volume in a Pod:
This is an example of a pod that mounts a secret in a volume: This is an example of a pod that mounts a secret in a volume:
```json ```yaml
{ apiVersion: v1
"apiVersion": "v1", kind: Pod
"kind": "Pod", metadata:
"metadata": { name: mypod
"name": "mypod", spec:
"namespace": "myns" containers:
}, - name: mypod
"spec": { image: redis
"containers": [{ volumeMounts:
"name": "mypod", - name: foo
"image": "redis", mountPath: "/etc/foo"
"volumeMounts": [{ readOnly: true
"name": "foo", volumes:
"mountPath": "/etc/foo", - name: foo
"readOnly": true secret:
}] secretName: mysecret
}],
"volumes": [{
"name": "foo",
"secret": {
"secretName": "mysecret"
}
}]
}
}
``` ```
Each secret you want to use needs to be referred to in `spec.volumes`. Each secret you want to use needs to be referred to in `spec.volumes`.
@@ -222,36 +213,26 @@ You can package many files into one secret, or use many secrets, whichever is co
We can also control the paths within the volume where Secret keys are projected. We can also control the paths within the volume where Secret keys are projected.
You can use `spec.volumes[].secret.items` field to change target path of each key: You can use `spec.volumes[].secret.items` field to change target path of each key:
```json ```yaml
{ apiVersion: v1
"apiVersion": "v1", kind: Pod
"kind": "Pod", metadata:
"metadata": { name: mypod
"name": "mypod", spec:
"namespace": "myns" containers:
}, - name: mypod
"spec": { image: redis
"containers": [{ volumeMounts:
"name": "mypod", - name: foo
"image": "redis", mountPath: "/etc/foo"
"volumeMounts": [{ readOnly: true
"name": "foo", volumes:
"mountPath": "/etc/foo", - name: foo
"readOnly": true secret:
}] secretName: mysecret
}], items:
"volumes": [{ - key: username
"name": "foo", path: my-group/my-username
"secret": {
"secretName": "mysecret",
"items": [{
"key": "username",
"path": "my-group/my-username"
}]
}
}]
}
}
``` ```
What will happen: What will happen:
@@ -271,32 +252,23 @@ mode for the whole secret volume and override per key if needed.
For example, you can specify a default mode like this: For example, you can specify a default mode like this:
```json ```yaml
{ apiVersion: v1
"apiVersion": "v1", kind: Pod
"kind": "Pod", metadata:
"metadata": { name: mypod
"name": "mypod", spec:
"namespace": "myns" containers:
}, - name: mypod
"spec": { image: redis
"containers": [{ volumeMounts:
"name": "mypod", - name: foo
"image": "redis", mountPath: "/etc/foo"
"volumeMounts": [{ volumes:
"name": "foo", - name: foo
"mountPath": "/etc/foo" secret:
}] secretName: mysecret
}], defaultMode: 256
"volumes": [{
"name": "foo",
"secret": {
"secretName": "mysecret",
"defaultMode": 256
}
}]
}
}
``` ```
Then, the secret will be mounted on `/etc/foo` and all the files created by the Then, the secret will be mounted on `/etc/foo` and all the files created by the
@@ -309,36 +281,26 @@ notation to specify permissions in a more natural way.
You can also use mapping, as in the previous example, and specify different You can also use mapping, as in the previous example, and specify different
permission for different files like this: permission for different files like this:
```json ```yaml
{ apiVersion: v1
"apiVersion": "v1", kind: Pod
"kind": "Pod", metadata:
"metadata": { name: mypod
"name": "mypod", spec:
"namespace": "myns" containers:
}, - name: mypod
"spec": { image: redis
"containers": [{ volumeMounts:
"name": "mypod", - name: foo
"image": "redis", mountPath: "/etc/foo"
"volumeMounts": [{ volumes:
"name": "foo", - name: foo
"mountPath": "/etc/foo" secret:
}] secretName: mysecret
}], items:
"volumes": [{ - key: username
"name": "foo", path: my-group/my-username
"secret": { mode: 511
"secretName": "mysecret",
"items": [{
"key": "username",
"path": "my-group/my-username",
"mode": 511
}]
}
}]
}
}
``` ```
In this case, the file resulting in `/etc/foo/my-group/my-username` will have In this case, the file resulting in `/etc/foo/my-group/my-username` will have
@@ -393,19 +355,19 @@ metadata:
name: secret-env-pod name: secret-env-pod
spec: spec:
containers: containers:
- name: mycontainer - name: mycontainer
image: redis image: redis
env: env:
- name: SECRET_USERNAME - name: SECRET_USERNAME
valueFrom: valueFrom:
secretKeyRef: secretKeyRef:
name: mysecret name: mysecret
key: username key: username
- name: SECRET_PASSWORD - name: SECRET_PASSWORD
valueFrom: valueFrom:
secretKeyRef: secretKeyRef:
name: mysecret name: mysecret
key: password key: password
restartPolicy: Never restartPolicy: Never
``` ```
@@ -515,40 +477,25 @@ $ kubectl create secret generic ssh-key-secret --from-file=ssh-privatekey=/path/
Now we can create a pod which references the secret with the ssh key and Now we can create a pod which references the secret with the ssh key and
consumes it in a volume: consumes it in a volume:
```json ```yaml
{ kind: Pod
"kind": "Pod", apiVersion: v1
"apiVersion": "v1", metadata:
"metadata": { name: secret-test-pod
"name": "secret-test-pod", labels:
"labels": { name: secret-test
"name": "secret-test" spec:
} volumes:
}, - name: secret-volume
"spec": { secret:
"volumes": [ secretName: ssh-key-secret
{ containers:
"name": "secret-volume", - name: ssh-test-container
"secret": { image: mySshImage
"secretName": "ssh-key-secret" volumeMounts:
} - name: secret-volume
} readOnly: true
], mountPath: "/etc/secret-volume"
"containers": [
{
"name": "ssh-test-container",
"image": "mySshImage",
"volumeMounts": [
{
"name": "secret-volume",
"readOnly": true,
"mountPath": "/etc/secret-volume"
}
]
}
]
}
}
``` ```
When the container's command runs, the pieces of the key will be available in: When the container's command runs, the pieces of the key will be available in:
@@ -577,78 +524,46 @@ secret "test-db-secret" created
Now make the pods: Now make the pods:
```json ```yaml
{ apiVersion: v1
"apiVersion": "v1", kind: List
"kind": "List", items:
"items": - kind: Pod
[{ apiVersion: v1
"kind": "Pod", metadata:
"apiVersion": "v1", name: prod-db-client-pod
"metadata": { labels:
"name": "prod-db-client-pod", name: prod-db-client
"labels": { spec:
"name": "prod-db-client" volumes:
} - name: secret-volume
}, secret:
"spec": { secretName: prod-db-secret
"volumes": [ containers:
{ - name: db-client-container
"name": "secret-volume", image: myClientImage
"secret": { volumeMounts:
"secretName": "prod-db-secret" - name: secret-volume
} readOnly: true
} mountPath: "/etc/secret-volume"
], - kind: Pod
"containers": [ apiVersion: v1
{ metadata:
"name": "db-client-container", name: test-db-client-pod
"image": "myClientImage", labels:
"volumeMounts": [ name: test-db-client
{ spec:
"name": "secret-volume", volumes:
"readOnly": true, - name: secret-volume
"mountPath": "/etc/secret-volume" secret:
} secretName: test-db-secret
] containers:
} - name: db-client-container
] image: myClientImage
} volumeMounts:
}, - name: secret-volume
{ readOnly: true
"kind": "Pod", mountPath: "/etc/secret-volume"
"apiVersion": "v1",
"metadata": {
"name": "test-db-client-pod",
"labels": {
"name": "test-db-client"
}
},
"spec": {
"volumes": [
{
"name": "secret-volume",
"secret": {
"secretName": "test-db-secret"
}
}
],
"containers": [
{
"name": "db-client-container",
"image": "myClientImage",
"volumeMounts": [
{
"name": "secret-volume",
"readOnly": true,
"mountPath": "/etc/secret-volume"
}
]
}
]
}
}]
}
``` ```
Both containers will have the following files present on their filesystems with the values for each container's environment: Both containers will have the following files present on their filesystems with the values for each container's environment:
@@ -665,26 +580,18 @@ You could further simplify the base pod specification by using two Service Accou
one called, say, `prod-user` with the `prod-db-secret`, and one called, say, one called, say, `prod-user` with the `prod-db-secret`, and one called, say,
`test-user` with the `test-db-secret`. Then, the pod spec can be shortened to, for example: `test-user` with the `test-db-secret`. Then, the pod spec can be shortened to, for example:
```json ```yaml
{ kind: Pod
"kind": "Pod", apiVersion: v1
"apiVersion": "v1", metadata:
"metadata": { name: prod-db-client-pod
"name": "prod-db-client-pod", labels:
"labels": { name: prod-db-client
"name": "prod-db-client" spec:
} serviceAccount: prod-db-client
}, containers:
"spec": { - name: db-client-container
"serviceAccount": "prod-db-client", image: myClientImage
"containers": [
{
"name": "db-client-container",
"image": "myClientImage"
}
]
}
}
``` ```
### Use-case: Dotfiles in secret volume ### Use-case: Dotfiles in secret volume
@@ -692,49 +599,34 @@ one called, say, `prod-user` with the `prod-db-secret`, and one called, say,
In order to make piece of data 'hidden' (i.e., in a file whose name begins with a dot character), simply In order to make piece of data 'hidden' (i.e., in a file whose name begins with a dot character), simply
make that key begin with a dot. For example, when the following secret is mounted into a volume: make that key begin with a dot. For example, when the following secret is mounted into a volume:
```json ```yaml
{ kind: Secret
"kind": "Secret", apiVersion: v1
"apiVersion": "v1", metadata:
"metadata": { name: dotfile-secret
"name": "dotfile-secret" data:
}, .secret-file: dmFsdWUtMg0KDQo=
"data": { ---
".secret-file": "dmFsdWUtMg0KDQo=" kind: Pod
} apiVersion: v1
} metadata:
name: secret-dotfiles-pod
{ spec:
"kind": "Pod", volumes:
"apiVersion": "v1", - name: secret-volume
"metadata": { secret:
"name": "secret-dotfiles-pod" secretName: dotfile-secret
}, containers:
"spec": { - name: dotfile-test-container
"volumes": [ image: gcr.io/google_containers/busybox
{ command:
"name": "secret-volume", - ls
"secret": { - "-l"
"secretName": "dotfile-secret" - "/etc/secret-volume"
} volumeMounts:
} - name: secret-volume
], readOnly: true
"containers": [ mountPath: "/etc/secret-volume"
{
"name": "dotfile-test-container",
"image": "gcr.io/google_containers/busybox",
"command": [ "ls", "-l", "/etc/secret-volume" ],
"volumeMounts": [
{
"name": "secret-volume",
"readOnly": true,
"mountPath": "/etc/secret-volume"
}
]
}
]
}
}
``` ```
@@ -798,7 +690,7 @@ reference a secret then `watch` the resource, re-requesting the secret when the
reference changes. Additionally, a ["bulk watch" API]( reference changes. Additionally, a ["bulk watch" API](
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/bulk_watch.md) https://github.com/kubernetes/community/blob/master/contributors/design-proposals/bulk_watch.md)
to let clients `watch` individual resources has also been proposed, and will likely to let clients `watch` individual resources has also been proposed, and will likely
be available in future releases of Kubernetes. be available in future releases of Kubernetes.
## Security Properties ## Security Properties