如何使用secret傳參數給kubernetes的pod

kubernetes的最小單位是pod，預設情況下，一個pod內只有一個container。

Run-time的時候，pod的參數有幾種方式取得

• Container image的預設值
• Run-time透過 --env 參數傳入
• Run-time使用 configMAP 傳入
• Run-time使用 secret 傳入

只有secret可以將參數，透過base64 encode/decode方式，增加傳遞參數的安全性。

先將要傳遞給pod的帳號及密碼，使用base64 encode編碼

    [root@master ~]# echo -n "root" | base64
    cm9vdA==
    [root@master ~]# echo -n "pass1234" | base64 
    cGFzczEyMzQ= 

將base64 encode編碼之後的內容，寫到YAML檔案

    [root@master ~]# vi my-secret.yaml
    [root@master ~]# cat my-secret.yaml
    apiVersion: v1
    kind: Secret
    metadata:
        name: demo-secret-from-yaml
    type: Opaque
    data:
        username: cm9vdA==
        password: cGFzczEyMzQ=

建立secret

    [root@master ~]# kubectl apply -f my-secret.yaml
    secret/demo-secret-from-yaml created
    [root@master ~]# kubectl get secrets demo-secret-from-yaml
    NAME                    TYPE     DATA   AGE
    demo-secret-from-yaml   Opaque   2      83s
    [root@master ~]# kubectl describe secrets demo-secret-from-yaml
    Name:         demo-secret-from-yaml
    Namespace:    default
    Labels:       <none>
    Annotations:  <none>
    
    Type:  Opaque
    
    Data
    ====
    password:  8 bytes
    username:  4 bytes

pod透過environment，接收secret傳遞的參數

    [root@master ~]# vi my-pod.yaml
    [root@master ~]# cat my-pod.yaml
    apiVersion: v1
    kind: Pod
    metadata:
        name: my-pod
        labels:
        app: webserver
    spec:
        containers:
            - name: nginx
            image: nginx
            ports:
            - containerPort: 3000
            env:
            - name: SECRET_USERNAME
                valueFrom:
                  secretKeyRef:
                    name: demo-secret-from-yaml
                    key: username
            - name: SECRET_PASSWORD
                valueFrom:
                  secretKeyRef:
                    name: demo-secret-from-yaml
                    key: password

建立pod，並檢查是否收到environment？

    [root@master ~]# kubectl apply -f my-pod.yaml
    pod/my-pod created
    [root@master ~]# kubectl get pods
    NAME     READY   STATUS    RESTARTS   AGE
    my-pod   1/1     Running   0          47s
    [root@master ~]# kubectl exec -it my-pod -- /bin/bash
    root@my-pod:/app#
    root@my-pod:/app# env | grepSECRET
    SECRET_USERNAME=root 
    SECRET_PASSWORD=pass1234
    root@my-pod:/app# exit
    exit