[zh] Resync distribute credentials task
This commit is contained in:
Qiming Teng
@@ -1,201 +1,367 @@
|
|||||||
---
|
---
|
||||||
title: 使用 Secret 安全地分发凭证
|
title: 使用 Secret 安全地分发凭证
|
||||||
content_type: task
|
content_type: task
|
||||||
|
weight: 50
|
||||||
|
min-kubernetes-server-version: v1.6
|
||||||
---
|
---
|
||||||
|
|
||||||
<!-- overview -->
|
<!-- overview -->
|
||||||
|
<!--
|
||||||
|
This page shows how to securely inject sensitive data, such as passwords and
|
||||||
|
encryption keys, into Pods.
|
||||||
|
-->
|
||||||
本文展示如何安全地将敏感数据（如密码和加密密钥）注入到 Pods 中。
|
本文展示如何安全地将敏感数据（如密码和加密密钥）注入到 Pods 中。
|
||||||
|
|
||||||
|
|
||||||
## {{% heading "prerequisites" %}}
|
## {{% heading "prerequisites" %}}
|
||||||
|
|
||||||
|
{{< include "task-tutorial-prereqs.md" >}}
|
||||||
{{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}
|
|
||||||
|
|
||||||
|
|
||||||
|
<!--
|
||||||
|
### Convert your secret data to a base-64 representation
|
||||||
|
|
||||||
<!-- steps -->
|
Suppose you want to have two pieces of secret data: a username `my-app` and a password
|
||||||
|
`39528$vdg7Jb`. First, use a base64 encoding tool to convert your username and password to a base64 representation. Here's an example using the commonly available base64 program:
|
||||||
|
-->
|
||||||
|
### 将 secret 数据转换为 base-64 形式
|
||||||
|
|
||||||
## 将 secret 数据转换为 base-64 形式
|
假设用户想要有两条 Secret 数据：用户名 `my-app` 和密码 `39528$vdg7Jb`。
|
||||||
|
首先使用 [Base64 编码](https://www.base64encode.org/) 将用户名和密码转化为 base-64 形式。
|
||||||
|
下面是一个使用常用的 base64 程序的示例：
|
||||||
|
|
||||||
假设用户想要有两条 secret 数据：用户名 `my-app` 和密码
|
```shell
|
||||||
`39528$vdg7Jb`。 首先使用 [Base64 编码](https://www.base64encode.org/) 将用户名和密码转化为 base-64 形式。 这里是一个 Linux 示例：
|
echo -n 'my-app' | base64
|
||||||
|
echo -n '39528$vdg7Jb' | base64
|
||||||
```shell
|
```
|
||||||
echo -n 'my-app' | base64
|
|
||||||
echo -n '39528$vdg7Jb' | base64
|
|
||||||
```
|
|
||||||
|
|
||||||
|
<!--
|
||||||
|
The output shows that the base-64 representation of your username is `bXktYXBw`,
|
||||||
|
and the base-64 representation of your password is `Mzk1MjgkdmRnN0pi`.
|
||||||
|
-->
|
||||||
结果显示 base-64 形式的用户名为 `bXktYXBw`，
|
结果显示 base-64 形式的用户名为 `bXktYXBw`，
|
||||||
base-64 形式的密码为 `Mzk1MjgkdmRnN0pi`。
|
base-64 形式的密码为 `Mzk1MjgkdmRnN0pi`。
|
||||||
|
|
||||||
|
<!--
|
||||||
|
Use a local tool trusted by your OS to decrease the security risks of external tools.
|
||||||
|
-->
|
||||||
|
{{< caution >}}
|
||||||
|
使用你的操作系统所能信任的本地工具以降低使用外部工具的风险。
|
||||||
|
{{< /caution >}}
|
||||||
|
|
||||||
|
<!-- steps -->
|
||||||
|
|
||||||
|
<!--
|
||||||
|
## Create a Secret
|
||||||
|
|
||||||
|
Here is a configuration file you can use to create a Secret that holds your
|
||||||
|
username and password:
|
||||||
|
-->
|
||||||
## 创建 Secret
|
## 创建 Secret
|
||||||
|
|
||||||
这里是一个配置文件，可以用来创建存有用户名和密码的 Secret:
|
这里是一个配置文件，可以用来创建存有用户名和密码的 Secret:
|
||||||
|
|
||||||
{{< codenew file="pods/inject/secret.yaml" >}}
|
{{< codenew file="pods/inject/secret.yaml" >}}
|
||||||
|
|
||||||
1. 创建 Secret
|
1. <!--Create the Secret -->
|
||||||
|
创建 Secret：
|
||||||
|
|
||||||
```shell
|
```shell
|
||||||
kubectl create -f https://k8s.io/examples/pods/inject/secret.yaml
|
kubectl apply -f https://k8s.io/examples/pods/inject/secret.yaml
|
||||||
```
|
```
|
||||||
|
|
||||||
{{< note >}}
|
1. <!-- View information about the Secret -->
|
||||||
如果想要跳过 Base64 编码的步骤，可以使用 `kubectl create secret` 命令来创建 Secret：
|
查看 Secret 相关信息：
|
||||||
{{< /note >}}
|
|
||||||
|
|
||||||
```shell
|
```shell
|
||||||
kubectl create secret generic test-secret --from-literal=username='my-app' --from-literal=password='39528$vdg7Jb'
|
kubectl get secret test-secret
|
||||||
```
|
```
|
||||||
|
|
||||||
1. 查看 Secret 相关信息：
|
|
||||||
|
|
||||||
kubectl get secret test-secret
|
|
||||||
|
|
||||||
|
<!-- Output: -->
|
||||||
输出：
|
输出：
|
||||||
|
|
||||||
```shell
|
```shell
|
||||||
NAME TYPE DATA AGE
|
NAME TYPE DATA AGE
|
||||||
test-secret Opaque 2 1m
|
test-secret Opaque 2 1m
|
||||||
```
|
```
|
||||||
|
|
||||||
1. 查看 Secret 相关的更多详细信息：
|
1. <!-- View more detailed information about the Secret -->
|
||||||
|
查看 Secret 相关的更多详细信息：
|
||||||
|
|
||||||
kubectl describe secret test-secret
|
```shell
|
||||||
|
kubectl describe secret test-secret
|
||||||
|
```
|
||||||
|
|
||||||
输出：
|
<!-- Output: -->
|
||||||
|
输出：
|
||||||
|
|
||||||
```shell
|
```shell
|
||||||
Name: test-secret
|
Name: test-secret
|
||||||
Namespace: default
|
Namespace: default
|
||||||
Labels: <none>
|
Labels: <none>
|
||||||
Annotations: <none>
|
Annotations: <none>
|
||||||
|
|
||||||
Type: Opaque
|
Type: Opaque
|
||||||
|
|
||||||
Data
|
Data
|
||||||
====
|
====
|
||||||
password: 13 bytes
|
password: 13 bytes
|
||||||
username: 7 bytes
|
username: 7 bytes
|
||||||
```
|
```
|
||||||
|
|
||||||
## 创建可以通过卷访问 secret 数据的 Pod
|
<!--
|
||||||
|
### Create a Secret directly with kubectl
|
||||||
|
|
||||||
|
If you want to skip the Base64 encoding step, you can create the
|
||||||
|
same Secret using the `kubectl create secret` command. For example:
|
||||||
|
-->
|
||||||
|
### 直接用 kubectl 创建 Secret
|
||||||
|
|
||||||
|
如果你希望略过 Base64 编码的步骤，你也可以使用 `kubectl create secret`
|
||||||
|
命令直接创建 Secret。例如：
|
||||||
|
|
||||||
|
```shell
|
||||||
|
kubectl create secret generic test-secret --from-literal='username=my-app' --from-literal='password=39528$vdg7Jb'
|
||||||
|
```
|
||||||
|
|
||||||
|
<!--
|
||||||
|
This is more convenient. The detailed approach shown earlier runs
|
||||||
|
through each step explicitly to demonstrate what is happening.
|
||||||
|
-->
|
||||||
|
这是一种更为方便的方法。
|
||||||
|
前面展示的详细分解步骤有助于了解究竟发生了什么事情。
|
||||||
|
|
||||||
|
<!--
|
||||||
|
## Create a Pod that has access to the secret data through a Volume
|
||||||
|
|
||||||
|
Here is a configuration file you can use to create a Pod:
|
||||||
|
-->
|
||||||
|
## 创建一个可以通过卷访问 secret 数据的 Pod
|
||||||
|
|
||||||
这里是一个可以用来创建 pod 的配置文件：
|
这里是一个可以用来创建 pod 的配置文件：
|
||||||
|
|
||||||
{{< codenew file="pods/inject/secret-pod.yaml" >}}
|
{{< codenew file="pods/inject/secret-pod.yaml" >}}
|
||||||
|
|
||||||
1. 创建 Pod：
|
1. <!-- Create the Pod:-->
|
||||||
|
创建 Pod：
|
||||||
|
|
||||||
```shell
|
```shell
|
||||||
kubectl create -f secret-pod.yaml
|
kubectl create -f secret-pod.yaml
|
||||||
```
|
```
|
||||||
|
|
||||||
1. 确认 Pod 正在运行：
|
1. <!-- Verify that your Pod is running: -->
|
||||||
|
确认 Pod 正在运行：
|
||||||
|
|
||||||
```shell
|
```shell
|
||||||
kubectl get pod secret-test-pod
|
kubectl get pod secret-test-pod
|
||||||
```
|
```
|
||||||
|
|
||||||
输出：
|
|
||||||
|
|
||||||
```shell
|
输出：
|
||||||
NAME READY STATUS RESTARTS AGE
|
|
||||||
secret-test-pod 1/1 Running 0 42m
|
|
||||||
```
|
|
||||||
|
|
||||||
1. 在 Pod 中运行的容器中获取一个 shell：
|
|
||||||
|
|
||||||
```shell
|
```shell
|
||||||
kubectl exec -it secret-test-pod -- /bin/bash
|
NAME READY STATUS RESTARTS AGE
|
||||||
```
|
secret-test-pod 1/1 Running 0 42m
|
||||||
|
```
|
||||||
|
|
||||||
1. secret 数据通过挂载在 `/etc/secret-volume` 目录下的卷暴露在容器中。
|
1. <!-- Get a shell into the Container that is running in your Pod:-->
|
||||||
在 shell 中，进入 secret 数据被暴露的目录：
|
获取一个 shell 进入 Pod 中运行的容器：
|
||||||
|
|
||||||
```shell
|
```shell
|
||||||
root@secret-test-pod:/# cd /etc/secret-volume
|
kubectl exec -it secret-test-pod -- /bin/bash
|
||||||
```
|
```
|
||||||
1. 在 shell 中，列出 `/etc/secret-volume` 目录的文件：
|
|
||||||
|
|
||||||
```shell
|
1. <!-- The secret data is exposed to the Container through a Volume mounted under
|
||||||
root@secret-test-pod:/etc/secret-volume# ls
|
`/etc/secret-volume`.
|
||||||
```
|
|
||||||
|
|
||||||
输出显示了两个文件，每个对应一条 secret 数据：
|
In your shell, list the files in the `/etc/secret-volume` directory:
|
||||||
|
-->
|
||||||
|
Secret 数据通过挂载在 `/etc/secret-volume` 目录下的卷暴露在容器中。
|
||||||
|
|
||||||
```shell
|
在 shell 中，列举 `/etc/secret-volume` 目录下的文件：
|
||||||
password username
|
|
||||||
```
|
|
||||||
|
|
||||||
1. 在 shell 中，显示 `username` 和 `password` 文件的内容：
|
```shell
|
||||||
|
ls /etc/secret-volume
|
||||||
|
```
|
||||||
|
|
||||||
```shell
|
<!--
|
||||||
root@secret-test-pod:/etc/secret-volume# cat username; echo; cat password; echo
|
The output shows two files, one for each piece of secret data:
|
||||||
```
|
-->
|
||||||
|
输出包含两个文件，每个对应一个 Secret 数据条目：
|
||||||
|
|
||||||
输出为用户名和密码：
|
```
|
||||||
|
password username
|
||||||
|
```
|
||||||
|
|
||||||
```shell
|
1. <!--
|
||||||
my-app
|
In your shell, display the contents of the `username` and `password` files:
|
||||||
39528$vdg7Jb
|
-->
|
||||||
```
|
在 Shell 中，显示 `username` 和 `password` 文件的内容：
|
||||||
|
|
||||||
## 创建通过环境变量访问 secret 数据的 Pod
|
```shell
|
||||||
|
# 在容器中 Shell 运行下面命令
|
||||||
|
echo "$(cat /etc/secret-volume/username)"
|
||||||
|
echo "$(cat /etc/secret-volume/password)"
|
||||||
|
```
|
||||||
|
|
||||||
这里是一个可以用来创建 pod 的配置文件：
|
<!--
|
||||||
|
The output is your username and password:
|
||||||
|
-->
|
||||||
|
输出为用户名和密码：
|
||||||
|
|
||||||
{{< codenew file="pods/inject/secret-envars-pod.yaml" >}}
|
```shell
|
||||||
|
my-app
|
||||||
|
39528$vdg7Jb
|
||||||
|
```
|
||||||
|
|
||||||
1. 创建 Pod：
|
<!--
|
||||||
|
## Define container environment variables using Secret data
|
||||||
|
|
||||||
```shell
|
### Define a container environment variable with data from a single Secret
|
||||||
kubectl create -f https://k8s.io/examples/pods/inject/secret-envars-pod.yaml
|
|
||||||
```
|
|
||||||
|
|
||||||
1. 确认 Pod 正在运行：
|
-->
|
||||||
|
## 使用 Secret 数据定义容器变量
|
||||||
|
|
||||||
```shell
|
### 使用来自 Secret 中的数据定义容器变量
|
||||||
kubectl get pod secret-envars-test-pod
|
|
||||||
```
|
|
||||||
|
|
||||||
输出：
|
<!--
|
||||||
|
* Define an environment variable as a key-value pair in a Secret:
|
||||||
|
-->
|
||||||
|
* 定义环境变量为 Secret 中的键值偶对：
|
||||||
|
|
||||||
```shell
|
```shell
|
||||||
NAME READY STATUS RESTARTS AGE
|
kubectl create secret generic backend-user --from-literal=backend-username='backend-admin'
|
||||||
secret-envars-test-pod 1/1 Running 0 4m
|
```
|
||||||
```
|
|
||||||
|
|
||||||
1. 在 Pod 中运行的容器中获取一个 shell：
|
<!--
|
||||||
|
* Assign the `backend-username` value defined in the Secret to the `SECRET_USERNAME` environment variable in the Pod specification.
|
||||||
|
-->
|
||||||
|
* 在 Pod 规约中，将 Secret 中定义的值 `backend-username` 赋给 `SECRET_USERNAME` 环境变量
|
||||||
|
|
||||||
```shell
|
{{< codenew file="pods/inject/pod-single-secret-env-variable.yaml" >}}
|
||||||
kubectl exec -it secret-envars-test-pod -- /bin/bash
|
|
||||||
```
|
|
||||||
|
|
||||||
1. 在 shell 中，显示环境变量：
|
<!--
|
||||||
|
* Create the Pod:
|
||||||
|
-->
|
||||||
|
* 创建 Pod：
|
||||||
|
|
||||||
```shell
|
```shell
|
||||||
root@secret-envars-test-pod:/# printenv
|
kubectl create -f https://k8s.io/examples/pods/inject/pod-single-secret-env-variable.yaml
|
||||||
```
|
```
|
||||||
|
|
||||||
输出包括用户名和密码：
|
<!--
|
||||||
|
* In your shell, display the content of `SECRET_USERNAME` container environment variable
|
||||||
|
-->
|
||||||
|
* 在 Shell 中，显示容器环境变量 `SECRET_USERNAME` 的内容：
|
||||||
|
|
||||||
```shell
|
```shell
|
||||||
...
|
kubectl exec -i -t env-single-secret -- /bin/sh -c 'echo $SECRET_USERNAME'
|
||||||
SECRET_USERNAME=my-app
|
```
|
||||||
...
|
|
||||||
SECRET_PASSWORD=39528$vdg7Jb
|
|
||||||
```
|
|
||||||
|
|
||||||
|
输出为：
|
||||||
|
|
||||||
|
```
|
||||||
|
backend-admin
|
||||||
|
```
|
||||||
|
<!--
|
||||||
|
### Define container environment variables with data from multiple Secrets
|
||||||
|
-->
|
||||||
|
### 使用来自多个 Secret 的数据定义环境变量
|
||||||
|
|
||||||
## {{% heading "whatsnext" %}}
|
<!--
|
||||||
|
* As with the previous example, create the Secrets first.
|
||||||
|
-->
|
||||||
|
* 和前面的例子一样，先创建 Secret：
|
||||||
|
|
||||||
|
```shell
|
||||||
|
kubectl create secret generic backend-user --from-literal=backend-username='backend-admin'
|
||||||
|
kubectl create secret generic db-user --from-literal=db-username='db-admin'
|
||||||
|
```
|
||||||
|
|
||||||
* 了解更多关于 [Secrets](/docs/concepts/configuration/secret/)。
|
<!--
|
||||||
* 了解 [Volumes](/docs/concepts/storage/volumes/)。
|
* Define the environment variables in the Pod specification.
|
||||||
|
-->
|
||||||
|
* 在 Pod 规约中定义环境变量：
|
||||||
|
|
||||||
|
{{< codenew file="pods/inject/pod-multiple-secret-env-variable.yaml" >}}
|
||||||
|
|
||||||
|
<!--
|
||||||
|
* Create the Pod:
|
||||||
|
-->
|
||||||
|
* 创建 Pod：
|
||||||
|
|
||||||
|
```shell
|
||||||
|
kubectl create -f https://k8s.io/examples/pods/inject/pod-multiple-secret-env-variable.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
<!--
|
||||||
|
* In your shell, display the container environment variables
|
||||||
|
-->
|
||||||
|
* 在你的 Shell 中，显示容器环境变量的内容：
|
||||||
|
|
||||||
|
```shell
|
||||||
|
kubectl exec -i -t envvars-multiple-secrets -- /bin/sh -c 'env | grep _USERNAME'
|
||||||
|
```
|
||||||
|
|
||||||
|
输出：
|
||||||
|
```
|
||||||
|
DB_USERNAME=db-admin
|
||||||
|
BACKEND_USERNAME=backend-admin
|
||||||
|
```
|
||||||
|
|
||||||
|
<!--
|
||||||
|
## Configure all key-value pairs in a Secret as container environment variables
|
||||||
|
-->
|
||||||
|
## 将 Secret 中的所有键值偶对定义为环境变量
|
||||||
|
|
||||||
|
<!--
|
||||||
|
This functionality is available in Kubernetes v1.6 and later.
|
||||||
|
-->
|
||||||
|
{{< note >}}
|
||||||
|
此功能在 Kubernetes 1.6 版本之后可用。
|
||||||
|
{{< /note >}}
|
||||||
|
|
||||||
|
<!--
|
||||||
|
* Create a Secret containing multiple key-value pairs
|
||||||
|
-->
|
||||||
|
* 创建包含多个键值偶对的 Secret：
|
||||||
|
|
||||||
|
```shell
|
||||||
|
kubectl create secret generic test-secret --from-literal=username='my-app' --from-literal=password='39528$vdg7Jb'
|
||||||
|
```
|
||||||
|
|
||||||
|
<!--
|
||||||
|
* Use envFrom to define all of the Secret’s data as container environment variables. The key from the Secret becomes the environment variable name in the Pod.
|
||||||
|
-->
|
||||||
|
* 使用 `envFrom` 来将 Secret 中的所有数据定义为环境变量。
|
||||||
|
Secret 中的键名成为容器中的环境变量名：
|
||||||
|
|
||||||
|
{{< codenew file="pods/inject/pod-secret-envFrom.yaml" >}}
|
||||||
|
|
||||||
|
<!--
|
||||||
|
* Create the Pod:
|
||||||
|
-->
|
||||||
|
* 创建 Pod：
|
||||||
|
|
||||||
|
```shell
|
||||||
|
kubectl create -f https://k8s.io/examples/pods/inject/pod-secret-envFrom.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
<!--
|
||||||
|
* In your shell, display `username` and `password` container environment variables
|
||||||
|
-->
|
||||||
|
* 在 Shell 中，显示环境变量 `username` 和 `password` 的内容：
|
||||||
|
|
||||||
|
```shell
|
||||||
|
kubectl exec -i -t envfrom-secret -- /bin/sh -c 'echo "username: $username\npassword: $password\n"'
|
||||||
|
```
|
||||||
|
|
||||||
|
输出为：
|
||||||
|
|
||||||
|
```
|
||||||
|
username: my-app
|
||||||
|
password: 39528$vdg7Jb
|
||||||
|
```
|
||||||
|
|
||||||
|
<!-- ### References -->
|
||||||
### 参考
|
### 参考
|
||||||
|
|
||||||
* [Secret](/docs/api-reference/{{< param "version" >}}/#secret-v1-core)
|
* [Secret](/docs/api-reference/{{< param "version" >}}/#secret-v1-core)
|
||||||
@@ -203,3 +369,13 @@ base-64 形式的密码为 `Mzk1MjgkdmRnN0pi`。
|
|||||||
* [Pod](/docs/api-reference/{{< param "version" >}}/#pod-v1-core)
|
* [Pod](/docs/api-reference/{{< param "version" >}}/#pod-v1-core)
|
||||||
|
|
||||||
|
|
||||||
|
## {{% heading "whatsnext" %}}
|
||||||
|
|
||||||
|
<!--
|
||||||
|
* Learn more about [Secrets](/docs/concepts/configuration/secret/).
|
||||||
|
* Learn about [Volumes](/docs/concepts/storage/volumes/).
|
||||||
|
-->
|
||||||
|
* 进一步了解 [Secret](/zh/docs/concepts/configuration/secret/)。
|
||||||
|
* 了解 [Volumes](/zh/docs/concepts/storage/volumes/)。
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user