容器编排系统K8s之ConfigMap、Secret资源

　　前文我们了解了k8s上的pv/pvc/sc资源的使用和相关说明，回顾请参考：https://www.cnblogs.com/qiuhom-1874/p/14188621.html；今天我们主要来聊一下k8s上配置应用相关话题；

　　在说configmap和secret资源之前，我们先来回顾下在docker环境下怎么给容器提供配置信息；在docker容器里我们要给容器里的应用提供配置的方式有两种，一种是通过环境变量的方式，把对应容器里跑的程序的某些属性通过一个环境变量传递给容器运行时的环境中去，这样容器启动时，读取对应的环境变量，对应容器里的应用程序就会根据我们传递的环境变量来启动对应的程序，从而实现配置容器里应用程序的目的；这种能够通过环境变量向容器里的应用传递配置的前提是对应应用程序支持；第二种方式就是通过存储卷的方式，把外部的配置文件直接通过存储卷的方式挂载到容器里的应用程序对应位置，对应程序在启动时，通过读取挂载的配置文件，从而实现配置容器里的应用程序的目的；这两种方式都有一个特点，只能在初始化容器时做，一旦一个容器初始化完成以后，修改对应的配置，必须要重新初始化容器，对应配置才能生效；对于k8s上的pod来说，也是类似的逻辑；第一通过环境变量的方式，第二通过存储卷的方式；不同于docker容器，在k8s上一切皆对象，我们需要把对应的配置信息通过对应资源初始化为一个对象，然后通过pod调用对应的对象，从而实现向pod里的容器提供配置，这种能够把配置信息初始化为一个对象并被pod所调用的资源有两个，分别是configmap和secret；configmap和secret资源都是用来向pod提供配置信息的资源，两者用法都很相似，唯一不同的是configmap主要用于提供非敏感配置的资源，secret主要用来提供敏感配置的资源；简单讲就是configmap不加密，secret要对敏感配置做加密处理（严格上不叫加密，它是把对应敏感数据做base64编码处理）；

　　configmap资源对象的创建和使用

　　configmap是k8s上的一个标准资源，我们可以通过命令的方式来创建，也可以通过定义资源清单的方式来创建；

　　configmap通过create命令来创建的语法格式

Usage:
  kubectl create configmap NAME [--from-file=[key=]source] [--from-literal=key1=value1]
[--dry-run=server|client|none] [options]

　　提示：configmap对象的创建主要指定对应configmap对象的名称，以及把对应配置信息传递给对应对象；configmap对象支持从命令行直接获取用户给定的kv配置信息，也支持通过读取一个配置文件的内容来获取对应配置；--from-file选项表示，对应配置信息从文件获取，默认我们直接指定一个配置文件的文件名称，它会把文件的基名（不包含路径名称）当作对应配置信息的key，把文件内容当作对应key的值；--from-literal选项表示，对应配置信息从用户在命令给定的key和value获取；

　　示例：通过命令的方式创建configmap资源对象，并在命令行向其传递kv配置；

[root@master01 ~]# kubectl create cm configmap-demo --from-literal=key1=value1 --from-literal=key2=value2
configmap/configmap-demo created
[root@master01 ~]# kubectl get cm
NAME               DATA   AGE
configmap-demo     2      8s
kube-root-ca.crt   1      4d2h
[root@master01 ~]# kubectl describe cm configmap-demo
Name:         configmap-demo
Namespace:    default
Labels:       <none>
Annotations:  <none>

Data
====
key1:
----
value1
key2:
----
value2
Events:  <none>
[root@master01 ~]#

　　提示：configmap可以简写为cm；--from-literal选项可以多次使用，每次指定一个配置项；从上面的显示看，对应configmap-demo这个对象保存了两个配置，分别是key1=value1、key2=value2；

　　定义pod应用configmap对象

[root@master01 ~]# cat nginx-demo.yaml
apiVersion: v1
kind: Pod
metadata:
  name: nginx-demo
  namespace: default
  labels:
    app: nginx
    rel: stable
spec:
  containers:
  - name: nginx-demo
    image: nginx:1.14-alpine
    env:
    - name: FIRST_KEY
      valueFrom:
        configMapKeyRef:
          name: configmap-demo
          key: key1
    - name: SECOND_KEY
      valueFrom:
        configMapKeyRef:
          name: configmap-demo
          key: key2
[root@master01 ~]#

　　提示：以上配置清单主要在nginx-demo容器里通过configmap向对应容器的运行环境传递两个环境变量；FIRST_KEY这个环境变量的值对应configmap对象里保存的key1这个键的值；SECOND_KEY这个环境变量的值对应configmap对象里的key2这个键的值；

　　应用资源清单

[root@master01 ~]# kubectl apply -f nginx-demo.yaml
pod/nginx-demo created
[root@master01 ~]# kubectl get pods
NAME         READY   STATUS              RESTARTS   AGE
nginx-demo   0/1     ContainerCreating   0          8s
[root@master01 ~]# kubectl get pods -w
NAME         READY   STATUS              RESTARTS   AGE
nginx-demo   0/1     ContainerCreating   0          17s
nginx-demo   1/1     Running             0          17s
^C[root@master01 ~]# kubectl describe pod nginx-demo
Name:         nginx-demo
Namespace:    default
Priority:     0
Node:         node03.k8s.org/172.16.11.6
Start Time:   Sat, 26 Dec 2020 22:28:10 +0800
Labels:       app=nginx
              rel=stable
Annotations:  <none>
Status:       Running
IP:           10.244.3.8
IPs:
  IP:  10.244.3.8
Containers:
  nginx-demo:
    Container ID:   docker://63cf5421b597f9dcd1169193c248091c62183ba18ec565122e242a53045d3112
    Image:          nginx:1.14-alpine
    Image ID:       docker-pullable://nginx@sha256:485b610fefec7ff6c463ced9623314a04ed67e3945b9c08d7e53a47f6d108dc7
    Port:           <none>
    Host Port:      <none>
    State:          Running
      Started:      Sat, 26 Dec 2020 22:28:26 +0800
    Ready:          True
    Restart Count:  0
    Environment:
      FIRST_KEY:   <set to the key 'key1' of config map 'configmap-demo'>  Optional: false
      SECOND_KEY:  <set to the key 'key2' of config map 'configmap-demo'>  Optional: false
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-8qs4l (ro)
Conditions:
  Type              Status
  Initialized       True
  Ready             True
  ContainersReady   True
  PodScheduled      True
Volumes:
  default-token-8qs4l:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-8qs4l
    Optional:    false
QoS Class:       BestEffort
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                 node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
  Type    Reason     Age   From               Message
  ----    ------     ----  ----               -------
  Normal  Scheduled  35s   default-scheduler  Successfully assigned default/nginx-demo to node03.k8s.org
  Normal  Pulling    32s   kubelet            Pulling image "nginx:1.14-alpine"
  Normal  Pulled     20s   kubelet            Successfully pulled image "nginx:1.14-alpine" in 12.059556374s
  Normal  Created    20s   kubelet            Created container nginx-demo
  Normal  Started    19s   kubelet            Started container nginx-demo
[root@master01 ~]#

　　提示：从上面pod的详细信息可以看到在对应Environment字段下多了两个环境变量，分别是FIRST_KEY和SECOND_KEY；

　　验证：进入对应pod，看看环境变量是否有FIRST_KEY和SECOND_KEY，对应值是否是configmap对象中的值

　　提示：可以看到在对应pod的环境变量中有我们传递的两个环境变量，对应的值也是我们在configmap对象中定义的值；

　　示例：通过命令的方式创建configmap资源对象，并通过配置文件向其传递配置信息；

　　准备配置文件

[root@master01 ~]# cat www-k8s-org.conf
server {
        server_name www.k8s.org;
        listen 80;
        location / {
            root "/www/html";
        }
}
[root@master01 ~]# cat bbs-k8s-org.conf
server {
        server_name bbs.k8s.org;
        listen 80;
        location / {
            root "/bbs/html";
        }
}
[root@master01 ~]#

　　创建configmap对象，并把上面两个配置文件信息传递给configmap对象

[root@master01 ~]# kubectl create cm nginx-conf --from-file=./www-k8s-org.conf --from-file=bbs-conf=./bbs-k8s-org.conf
configmap/nginx-conf created
[root@master01 ~]# kubectl get cm
NAME               DATA   AGE
configmap-demo     2      47m
kube-root-ca.crt   1      4d2h
nginx-conf         2      11s
[root@master01 ~]# kubectl describe cm nginx-conf
Name:         nginx-conf
Namespace:    default
Labels:       <none>
Annotations:  <none>

Data
====
bbs-conf:
----
server {
  server_name bbs.k8s.org;
        listen 80;
        location / {
          root "/bbs/html";
      }
}

www-k8s-org.conf:
----
server {
  server_name www.k8s.org;
        listen 80;
        location / {
          root "/www/html";
      }
}

Events:  <none>
[root@master01 ~]#

　　提示：可以看到cm对象创建成功，并且成功把对应的配置文件内容当作对应key传递给cm对象了；在创建cm对象时，要使用--from-file选项来指定从文件加载配置信息，如果只指定了文件名，则以文件基名作为对应key，其文件内容作为对应key的值；

　　定义pod挂载configmap对象中的配置文件信息

[root@master01 ~]# cat nginx-demo2.yaml
apiVersion: v1
kind: Pod
metadata:
  name: nginx-demo2
  namespace: default
  labels:
    app: nginx
    rel: stable
spec:
  containers:
  - name: nginx-demo
    image: nginx:1.14-alpine
    volumeMounts:
    - name: website-conf
      mountPath: /etc/nginx/conf.d/
  volumes:
  - name: website-conf
    configMap:
      name: nginx-conf
      items:
      - key: www-k8s-org.conf
        path: www-k8s-org.conf
        mode: 0644
      - key: bbs-conf
        path: bbs-k8s-org.conf
        mode: 0644
[root@master01 ~]#

　　提示：以上配置信息表示把configmap对象中的两个配置信息，都以文件的方式挂载到/etc/nginx/conf.d/目录下；configmap类型存储卷它会把configmap中的对象以文件的形式挂载到对应pod；其中spec.volumes.configMap.items.key字段用于指定configmap对象中的key；path用于指定把对应的key映射的文件名称；mode是用于指定对应文件的权限信息；

　　应用配置清单

[root@master01 ~]# kubectl apply -f nginx-demo2.yaml
pod/nginx-demo2 created
[root@master01 ~]# kubectl get pods -w
NAME          READY   STATUS    RESTARTS   AGE
nginx-demo    1/1     Running   0          47m
nginx-demo2   1/1     Running   0          8s
^C[root@master01 ~]# kubectl describe pod nginx-demo2
Name:         nginx-demo2
Namespace:    default
Priority:     0
Node:         node02.k8s.org/172.16.11.5
Start Time:   Sat, 26 Dec 2020 23:15:29 +0800
Labels:       app=nginx
              rel=stable
Annotations:  <none>
Status:       Running
IP:           10.244.2.8
IPs:
  IP:  10.244.2.8
Containers:
  nginx-demo:
    Container ID:   docker://38781957cabf78616c7d826664009c215d3ef7105955e722e5e0104eca636ab0
    Image:          nginx:1.14-alpine
    Image ID:       docker-pullable://nginx@sha256:485b610fefec7ff6c463ced9623314a04ed67e3945b9c08d7e53a47f6d108dc7
    Port:           <none>
    Host Port:      <none>
    State:          Running
      Started:      Sat, 26 Dec 2020 23:15:34 +0800
    Ready:          True
    Restart Count:  0
    Environment:    <none>
    Mounts:
      /etc/nginx/conf.d/ from website-conf (rw)
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-8qs4l (ro)
Conditions:
  Type              Status
  Initialized       True
  Ready             True
  ContainersReady   True
  PodScheduled      True
Volumes:
  website-conf:
    Type:      ConfigMap (a volume populated by a ConfigMap)
    Name:      nginx-conf
    Optional:  false
  default-token-8qs4l:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-8qs4l
    Optional:    false
QoS Class:       BestEffort
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                 node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
  Type    Reason     Age   From               Message
  ----    ------     ----  ----               -------
  Normal  Scheduled  21s   default-scheduler  Successfully assigned default/nginx-demo2 to node02.k8s.org
  Normal  Pulled     18s   kubelet            Container image "nginx:1.14-alpine" already present on machine
  Normal  Created    18s   kubelet            Created container nginx-demo
  Normal  Started    17s   kubelet            Started container nginx-demo
[root@master01 ~]#

　　进入nginx-demo2容器，看看对应/etc/nginx/conf.d/目录下是否有两个我们指定的配置文件？对应文件内容是否是cm对象中对应key的内容？

[root@master01 ~]# kubectl exec -it nginx-demo2 -- /bin/sh
/ # cd /etc/nginx/conf.d/
/etc/nginx/conf.d # ls
bbs-k8s-org.conf  www-k8s-org.conf
/etc/nginx/conf.d # cat www-k8s-org.conf
server {
        server_name www.k8s.org;
        listen 80;
        location / {
            root "/www/html";
        }
}
/etc/nginx/conf.d # cat bbs-k8s-org.conf
server {
        server_name bbs.k8s.org;
        listen 80;
        location / {
            root "/bbs/html";
        }
}
/etc/nginx/conf.d #

　　提示：可以看到在对应pod容器里，在/etc/nginx/conf.d/目录下有两个配置文件，这两个配置文件就是我们定义pod时挂载configmap存储卷定义的文件名称；对应文件内容也是cm对象中保存的文件内容；

　　测试：修改对应cm资源的配置信息，看看对应引用了该cm资源对象的pod是否会更新配置信息？

　　提示：在线修改cm对象配置信息，可以使用edit命令来修改指定cm对象即可；修改完成后保存退出对应配置就会立即更新到cm对象；以上主要修改了bbs-conf键中的listen 80修改为8080；

　　验证：查看对应cm对象，看看配置信息是否更新？

　　提示：可以看到对应cm对象中的配置信息已经被更新；

　　验证：看看对应引用该cm对象中的配置信息的pod是否更新了配置？是否重载了对应配置？

　　提示：对应pod配置文件信息已经更新，但是并没有应用新配置；像这种情况我们还得自己手动进入到对应的容器里重载配置；

　　示例：使用配置清单创建cm对象

[root@master01 ~]# cat configmap-demo.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: test-cm-demo
  namespace: default
data:
  website-conf: |
    server {
        server_name bbs.k8s.org;
        listen 80;
        location / {
            root "/bbs/html";
        }
    }
[root@master01 ~]#

　　提示：cm对象在没有spec字段，却而代之的是data字段，该字段主要用来定义对应kv配置信息；key可以是任意合法名称，对应的值可以是一个文件内容；如果对应内容需要多行来书写，需要在对应的key后面加上 “|”；

　　应用配置清单

[root@master01 ~]# kubectl apply -f configmap-demo.yaml
configmap/test-cm-demo created
[root@master01 ~]# kubectl get cm
NAME               DATA   AGE
configmap-demo     2      82m
kube-root-ca.crt   1      4d3h
nginx-conf         2      35m
test-cm-demo       1      5s
[root@master01 ~]# kubectl describe cm test-cm-demo
Name:         test-cm-demo
Namespace:    default
Labels:       <none>
Annotations:  <none>

Data
====
website-conf:
----
server {
    server_name bbs.k8s.org;
    listen 80;
    location / {
        root "/bbs/html";
    }
}

Events:  <none>
[root@master01 ~]#

　　提示：可以看到对应的cm对象已经成功被创建，并且里面保存了我们在定义cm时的配置信息；

　　Secret资源的创建和使用

　　secret资源和configmap资源的用法都很类似，可以在命令行中通过create命令来创建，也可以通过定义资源清单来创建，其使用方式和configmap也很类似；

　　secret资源通过create命令来创建的语法格式

[root@master01 ~]# kubectl create secret
Create a secret using specified subcommand.

Available Commands:
  docker-registry Create a secret for use with a Docker registry
  generic         Create a secret from a local file, directory or literal value
  tls             Create a TLS secret

Usage:
  kubectl create secret [flags] [options]

Use "kubectl <command> --help" for more information about a given command.
Use "kubectl options" for a list of global command-line options (applies to all commands).
[root@master01 ~]#

　　提示：secret资源有三种类型，分别是docker-registry、generis、tls；其中docker-registry类型主要用来创建保存私有镜像仓库中需要用到的认证信息，比如用户名称，用户密码，仓库地址，用户邮件信息等等；generis类型是比较通用的一种类型，它可以从一个文件中加载信息，也可以从命令行中获取对应的kv配置信息；tls类型主要用来保存证书相关的证书，私钥；在前边我们使用ingress资源时，在应用对应的证书和私钥时，就是通过tls类型的secret资源对象来想起ingress资源对象传递证书和私钥文件信息；

　　创建docker-registry类型的secret资源的语法格式

Usage:
  kubectl create secret docker-registry NAME --docker-username=user --docker-password=password --docker-email=email
[--docker-server=string] [--from-literal=key1=value1] [--dry-run=server|client|none] [options]

　　示例：使用create命令来创建一个docker-registry类型的secret资源对象

[root@master01 ~]# kubectl create secret docker-registry docker-registry.io --docker-username=qiuhom --docker-password=Admin123.com --docker-server=docker-registry.io
secret/docker-registry.io created
[root@master01 ~]# kubectl get secret
NAME                           TYPE                                  DATA   AGE
default-token-xvd4c            kubernetes.io/service-account-token   3      18d
docker-registry.io             kubernetes.io/dockerconfigjson        1      15s
www-myapp-com-ingress-secret   kubernetes.io/tls                     2      4d22h
[root@master01 ~]# kubectl describe secret docker-registry.io
Name:         docker-registry.io
Namespace:    default
Labels:       <none>
Annotations:  <none>

Type:  kubernetes.io/dockerconfigjson

Data
====
.dockerconfigjson:  118 bytes
[root@master01 ~]# kubectl get secret docker-registry.io -o yaml
apiVersion: v1
data:
  .dockerconfigjson: eyJhdXRocyI6eyJkb2NrZXItcmVnaXN0cnkuaW8iOnsidXNlcm5hbWUiOiJxaXVob20iLCJwYXNzd29yZCI6IkFkbWluMTIzLmNvbSIsImF1dGgiOiJjV2wxYUc5dE9rRmtiV2x1TVRJekxtTnZiUT09In19fQ==
kind: Secret
metadata:
  creationTimestamp: "2020-12-26T16:40:56Z"
  managedFields:
  - apiVersion: v1
    fieldsType: FieldsV1
    fieldsV1:
      f:data:
        .: {}
        f:.dockerconfigjson: {}
      f:type: {}
    manager: kubectl-create
    operation: Update
    time: "2020-12-26T16:40:56Z"
  name: docker-registry.io
  namespace: default
  resourceVersion: "392306"
  uid: ac9e425f-95e7-4c34-b161-c621ad2b0a8a
type: kubernetes.io/dockerconfigjson
[root@master01 ~]#

　　提示：从上面对应secret资源对象中输出为yaml格式的配置中可以看到，对应data字段输出的是一个base64编码后的字符串；其实里面的内容就是我们创建secret资源对象时指定的内容；如下

[root@master01 ~]#  echo  eyJhdXRocyI6eyJkb2NrZXItcmVnaXN0cnkuaW8iOnsidXNlcm5hbWUiOiJxaXVob20iLCJwYXNzd29yZCI6IkFkbWluMTIzLmNvbSIsImF1dGgiOiJjV2wxYUc5dE9rRmtiV2x1TVRJekxtTnZiUT09In19fQ== |base64 -d
{"auths":{"docker-registry.io":{"username":"qiuhom","password":"Admin123.com","auth":"cWl1aG9tOkFkbWluMTIzLmNvbQ=="}}}[root@master01 ~]#
[root@master01 ~]# echo cWl1aG9tOkFkbWluMTIzLmNvbQ== |base64 -d
qiuhom:Admin123.com[root@master01 ~]#
[root@master01 ~]#

　　提示：可以看到所有把对应字符串交给base64解密后，拿到的就是我们在创建docker-registry类型的secret资源对象传递的选项；

　　定义pod资源引用docker-registry类型的secret资源对象

[root@master01 ~]# cat test-pod-demo.yaml
apiVersion: v1
kind: Pod
metadata:
  name: test-nginx
  namespace: default
  labels:
    app: nginx
spec:
  imagePullSecrets:
  - name: docker-registry.io
  containers:
  - name: nginx
    image: docker-registry.io/test/nginx:latest
[root@master01 ~]#

　　提示：在定义pod时，如果要从对应私有镜像仓库中拉去镜像，需要用到认证信息，可以使用imagePullSecrets字段来应用对应的secret资源对象来传递仓库的认证信息；在应用配置清单之前，需要将所有节点的/etc/hosts文件和/etc/docker/daemon.json文件更新下；如果是私钥镜像仓库默认docker会认为不安全，需要我们手动指定出来；如果对应域名在互联网上无法正常解析，还需要借助对应的hosts文件将其定解析到对应仓库服务器的地址上；如下

[root@master01 ~]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.0.99 time.test.org time-node
192.168.0.41  master01 master01.k8s.org
192.168.0.42  master02 master02.k8s.org
192.168.0.43  master03 master03.k8s.org
192.168.0.44  node01 node01.k8s.org
192.168.0.45  node02 node02.k8s.org
192.168.0.46  node03 node03.k8s.org
192.168.0.47  node04 node04.k8s.org
199.232.28.133 raw.githubusercontent.com
192.168.0.99 docker-registry.io registry
[root@master01 ~]# cat /etc/docker/daemon.json
{
"registry-mirrors": ["https://cyr1uljt.mirror.aliyuncs.com"],
"insecure-registries": ["docker-registry.io"]
}
[root@master01 ~]# scp /etc/docker/daemon.json node01:/etc/docker/
daemon.json                                                                                                100%  112    39.4KB/s   00:00
[root@master01 ~]# scp /etc/docker/daemon.json node02:/etc/docker/
daemon.json                                                                                                100%  112    67.3KB/s   00:00
[root@master01 ~]# scp /etc/docker/daemon.json node03:/etc/docker/
daemon.json                                                                                                100%  112     8.9KB/s   00:00
[root@master01 ~]# scp /etc/docker/daemon.json node04:/etc/docker/
daemon.json                                                                                                100%  112    69.8KB/s   00:00
[root@master01 ~]# scp /etc/hosts node01:/etc/
hosts                                                                                                      100%  541   477.4KB/s   00:00
[root@master01 ~]# scp /etc/hosts node02:/etc/
hosts                                                                                                      100%  541   225.7KB/s   00:00
[root@master01 ~]# scp /etc/hosts node03:/etc/
hosts                                                                                                      100%  541   217.3KB/s   00:00
[root@master01 ~]# scp /etc/hosts node04:/etc/
hosts                                                                                                      100%  541   149.4KB/s   00:00
[root@master01 ~]# ssh node01 'systemctl restart docker'
[root@master01 ~]# ssh node02 'systemctl restart docker'
[root@master01 ~]# ssh node03 'systemctl restart docker'
[root@master01 ~]# ssh node04 'systemctl restart docker'

　　应用配置清单，看看对应的pod是否能够启动成功？

[root@master01 ~]# kubectl apply -f test-pod-demo.yaml
pod/test-nginx created
[root@master01 ~]# kubectl get pods -w
NAME         READY   STATUS    RESTARTS   AGE
test-nginx   1/1     Running   0          6s
^C[root@master01 ~]# kubectl describe pod test-nginx
Name:         test-nginx
Namespace:    default
Priority:     0
Node:         node02.k8s.org/192.168.0.45
Start Time:   Sun, 27 Dec 2020 01:04:18 +0800
Labels:       app=nginx
Annotations:  <none>
Status:       Running
IP:           10.244.2.107
IPs:
  IP:  10.244.2.107
Containers:
  nginx:
    Container ID:   docker://9062506afc2fc002102754ee8b2205732ddb740f7f86b870131cb582fc3b9f52
    Image:          docker-registry.io/test/nginx:latest
    Image ID:       docker-pullable://docker-registry.io/test/nginx@sha256:0efad4d09a419dc6d574c3c3baacb804a530acd61d5eba72cb1f14e1f5ac0c8f
    Port:           <none>
    Host Port:      <none>
    State:          Running
      Started:      Sun, 27 Dec 2020 01:04:24 +0800
    Ready:          True
    Restart Count:  0
    Environment:    <none>
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-xvd4c (ro)
Conditions:
  Type              Status
  Initialized       True
  Ready             True
  ContainersReady   True
  PodScheduled      True
Volumes:
  default-token-xvd4c:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-xvd4c
    Optional:    false
QoS Class:       BestEffort
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                 node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
  Type    Reason     Age   From               Message
  ----    ------     ----  ----               -------
  Normal  Scheduled  27s   default-scheduler  Successfully assigned default/test-nginx to node02.k8s.org
  Normal  Pulling    26s   kubelet            Pulling image "docker-registry.io/test/nginx:latest"
  Normal  Pulled     21s   kubelet            Successfully pulled image "docker-registry.io/test/nginx:latest" in 4.835022509s
  Normal  Created    21s   kubelet            Created container nginx
  Normal  Started    21s   kubelet            Started container nginx
[root@master01 ~]#

　　提示：可以看到对应pod能够正常到指定的私钥仓库中把镜像托下来，并启动成功；

　　使用create命令创建generic类型的secret资源对象语法格式

Usage:
  kubectl create secret generic NAME [--type=string] [--from-file=[key=]source] [--from-literal=key1=value1]
[--dry-run=server|client|none] [options]

　　示例：使用create命令创建generic类型的secret资源对象

[root@master01 ~]# kubectl create secret generic mysql-auth --from-literal=username=root --from-literal=passwd=admin
secret/mysql-auth created
[root@master01 ~]# kubectl get secret
NAME                           TYPE                                  DATA   AGE
default-token-xvd4c            kubernetes.io/service-account-token   3      18d
docker-registry.io             kubernetes.io/dockerconfigjson        1      37m
mysql-auth                     Opaque                                2      13s
www-myapp-com-ingress-secret   kubernetes.io/tls                     2      4d23h
[root@master01 ~]# kubectl describe secret mysql-auth
Name:         mysql-auth
Namespace:    default
Labels:       <none>
Annotations:  <none>

Type:  Opaque

Data
====
passwd:    5 bytes
username:  4 bytes
[root@master01 ~]# kubectl get secret mysql-auth -o yaml
apiVersion: v1
data:
  passwd: YWRtaW4=
  username: cm9vdA==
kind: Secret
metadata:
  creationTimestamp: "2020-12-26T17:18:08Z"
  managedFields:
  - apiVersion: v1
    fieldsType: FieldsV1
    fieldsV1:
      f:data:
        .: {}
        f:passwd: {}
        f:username: {}
      f:type: {}
    manager: kubectl-create
    operation: Update
    time: "2020-12-26T17:18:08Z"
  name: mysql-auth
  namespace: default
  resourceVersion: "396175"
  uid: a22e27a8-b9f7-405a-b503-ac546da0b4cd
type: Opaque
[root@master01 ~]#

　　提示：generic类型的secret资源的创建和configmap很类似，它可以接受从命令行中用户手动传递对应的配置信息，也支持从配置文件中获取对应的配置信息；

　　创建pod资源，引用generic类型的secret类型的资源

[root@master01 ~]# cat mysql-demo.yaml
apiVersion: v1
kind: Pod
metadata:
  name: mysql-demo
  namespace: default
  labels:
    app: mysql
spec:
  containers:
  - name: mysql-demo
    image: mysql:5.6
    env:
    - name: MYSQL_ROOT_PASSWORD
      valueFrom:
        secretKeyRef:
          name: mysql-auth
          key: passwd
[root@master01 ~]#

　　提示：上述清单定义了运行一个pod，其内部跑一个mysql:5.6的容器；对应使用环境变量的方式向mysql-demo容器传递了一个MYSQL_ROOT_PASSWORD的环境变量，对应环境变量的值为generic类型的secret资源对象中的passwd这个键的值；

　　应用配置清单

[root@master01 ~]# kubectl apply -f mysql-demo.yaml
pod/mysql-demo created
[root@master01 ~]# kubectl get pods -w
NAME         READY   STATUS              RESTARTS   AGE
mysql-demo   0/1     ContainerCreating   0          7s
test-nginx   1/1     Running             0          29m
mysql-demo   1/1     Running             0          32s
^C[root@master01 ~]# kubectl describe pod mysql-demo
Name:         mysql-demo
Namespace:    default
Priority:     0
Node:         node03.k8s.org/192.168.0.46
Start Time:   Sun, 27 Dec 2020 01:34:10 +0800
Labels:       app=mysql
Annotations:  <none>
Status:       Running
IP:           10.244.3.106
IPs:
  IP:  10.244.3.106
Containers:
  mysql-demo:
    Container ID:   docker://97d88917cbc8e304af120e83a859814248cd915da7d2056643b3f29f61c2cb7b
    Image:          mysql:5.6
    Image ID:       docker-pullable://mysql@sha256:51d59639d9a864ec302008c81d6909c532eff8b946993ef6448c086ba7917e82
    Port:           <none>
    Host Port:      <none>
    State:          Running
      Started:      Sun, 27 Dec 2020 01:34:42 +0800
    Ready:          True
    Restart Count:  0
    Environment:
      MYSQL_ROOT_PASSWORD:  <set to the key 'passwd' in secret 'mysql-auth'>  Optional: false
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-xvd4c (ro)
Conditions:
  Type              Status
  Initialized       True
  Ready             True
  ContainersReady   True
  PodScheduled      True
Volumes:
  default-token-xvd4c:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-xvd4c
    Optional:    false
QoS Class:       BestEffort
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                 node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
  Type    Reason     Age   From               Message
  ----    ------     ----  ----               -------
  Normal  Scheduled  50s   default-scheduler  Successfully assigned default/mysql-demo to node03.k8s.org
  Normal  Pulling    49s   kubelet            Pulling image "mysql:5.6"
  Normal  Pulled     18s   kubelet            Successfully pulled image "mysql:5.6" in 30.561208525s
  Normal  Created    18s   kubelet            Created container mysql-demo
  Normal  Started    18s   kubelet            Started container mysql-demo
[root@master01 ~]#

　　提示：可以看到对应容器已经正常处于running状态，并在其详细信息中看到对应环境变量MYSQL_ROOT_PASSWORD引用secret中的passwd键；

　　测试：进入mysql-demo的交互式接口，看看使用创建secret时使用的passwd键传递的密码是否可以正常登录到mysql系统？

[root@master01 ~]# kubectl exec -it mysql-demo -- /bin/sh
# mysql
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)
# mysql -padmin
Warning: Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 2
Server version: 5.6.50 MySQL Community Server (GPL)

Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| performance_schema |
+--------------------+
3 rows in set (0.00 sec)

mysql> exit
Bye
#

　　提示：可以看到直接在容器交互式接口直接不使用密码是不能正常登录到mysql数据库；使用正确的密码后能够正常进入mysql；其实我们在交互式接口上查看环境变量也能查看到对应的环境变量的信息；如下

　　使用create命令创建tls类型的secret资源对象语法格式

Usage:
  kubectl create secret tls NAME --cert=path/to/cert/file --key=path/to/key/file
[--dry-run=server|client|none] [options]

　　示例：使用create命令创建tls类型的secret资源对象

[root@master01 manifests]# kubectl create secret tls test-tls --cert=./tls.crt --key=./tls.key
secret/test-tls created
[root@master01 manifests]# kubectl get secret
NAME                           TYPE                                  DATA   AGE
default-token-xvd4c            kubernetes.io/service-account-token   3      18d
docker-registry.io             kubernetes.io/dockerconfigjson        1      65m
mysql-auth                     Opaque                                2      28m
test-tls                       kubernetes.io/tls                     2      10s
www-myapp-com-ingress-secret   kubernetes.io/tls                     2      4d23h
[root@master01 manifests]# kubectl describe secret test-tls
Name:         test-tls
Namespace:    default
Labels:       <none>
Annotations:  <none>

Type:  kubernetes.io/tls

Data
====
tls.crt:  1285 bytes
tls.key:  1679 bytes
[root@master01 manifests]# kubectl get secret test-tls -o yaml
apiVersion: v1
data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURoekNDQW0rZ0F3SUJBZ0lKQU4wS2RzTWpIMlNYTUEwR0NTcUdTSWIzRFFFQkN3VUFNRm94Q3pBSkJnTlYKQkFZVEFrTk9NUkF3RGdZRFZRUUlEQWRUYVVOb2RXRnVNUkl3RUFZRFZRUUhEQWxIZFdGdVoxbDFZVzR4RFRBTApCZ05WQkFvTUJGUmxjM1F4RmpBVUJnTlZCQU1NRFhkM2R5NXRlV0Z3Y0M1amIyMHdIaGNOTWpBeE1qSXhNVGMxCk5ETTNXaGNOTXpBeE1qRTVNVGMxTkRNM1dqQmFNUXN3Q1FZRFZRUUdFd0pEVGpFUU1BNEdBMVVFQ0F3SFUybEQKYUhWaGJqRVNNQkFHQTFVRUJ3d0pSM1ZoYm1kWmRXRnVNUTB3Q3dZRFZRUUtEQVJVWlhOME1SWXdGQVlEVlFRRApEQTEzZDNjdWJYbGhjSEF1WTI5dE1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBCnV0ek51djNFd0JRRjAvaHY4T2M3eGZzVUZIRG80cm5nYlV5Ym1UTVd6WkVONER3QTlCeVhvUk8rMUFOR0h0cXMKTTk4MUpJM3N5R21uMTV1Q1N5YTRlMjNIOEZrRVcveFh4VzNVMXZoRmxpRlB3NFgxM0ZRTno5TGJqUDdmbHBOTwpRRzZKVm1nYUNyZFp1TlFnbzFJSG1ocmFFWHV6VStTVkYzVXh1MHd3OUNRZmsxcG82N0NiN0FNRlRMa25QbUhJCndpbHpEK1dYeUtyV3NjRDBQZ2gzTTV1QnBENTJuNURsOHpWZDJiSFlSZGdIUm90dTJTTnBwcmtlVjlzSGxlamUKazVlMDRHZHNhV2pkaGJwMDcrWnBYMmhLVkhBMWJYUnplWG03TjE4ZTQ2elNPaEdydW0xYUtEZUNGd1BPbFZhUAovdEhrbmxleVM0NGNqTFk5Q21CSS93SURBUUFCbzFBd1RqQWRCZ05WSFE0RUZnUVVzU1N0OVJSZ083OFRCclBPCjR3UndVMGJlWlBJd0h3WURWUjBqQkJnd0ZvQVVzU1N0OVJSZ083OFRCclBPNHdSd1UwYmVaUEl3REFZRFZSMFQKQkFVd0F3RUIvekFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBWEJQNUx1ZzVlNGJUbVl3Q2w0ckIyK2k4VWx5dQpZbmZrdmRKQjgvWlFKWXNEdGgwQ0xGWEdHeWdId1ZoWWRYT01jSnB3MkNVbUNsakVwUk9Cb09kNGpvd0pBTHBJClhxUHMvQmJ2aDNCd3B6OFd3S3c1cUd6NmRDTGNmU2ZMV0Q3dkRBVVd2c3UvV1VGQjVpVVlKcmcrRlpwNnBQVTcKeFdpMUtic3piM3BmNkorWFJ0MlpZeDVYMlpHdTQyb2FmcDd3Z1hzS0l0UG9nNmdjQ0d6Z1JXQUFzcHhPOFFRYwpKY1dOZXYwSFAzdVViWG9SbUV2S1NXY3dTcnlhZTVuUGlaRjVkaCtHRys2TktpdnJBR0RkMTVzZzlGZHkzVDl6CkRkWVVmTkhGYlU5TUh6djE1NEtxNFVVZ1ZSbTk2Y2krdFhuYUdtMzJNcVFkZVUvcVVReEtnZ2VMMmc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBdXR6TnV2M0V3QlFGMC9odjhPYzd4ZnNVRkhEbzRybmdiVXlibVRNV3paRU40RHdBCjlCeVhvUk8rMUFOR0h0cXNNOTgxSkkzc3lHbW4xNXVDU3lhNGUyM0g4RmtFVy94WHhXM1UxdmhGbGlGUHc0WDEKM0ZRTno5TGJqUDdmbHBOT1FHNkpWbWdhQ3JkWnVOUWdvMUlIbWhyYUVYdXpVK1NWRjNVeHUwd3c5Q1FmazFwbwo2N0NiN0FNRlRMa25QbUhJd2lsekQrV1h5S3JXc2NEMFBnaDNNNXVCcEQ1Mm41RGw4elZkMmJIWVJkZ0hSb3R1CjJTTnBwcmtlVjlzSGxlamVrNWUwNEdkc2FXamRoYnAwNytacFgyaEtWSEExYlhSemVYbTdOMThlNDZ6U09oR3IKdW0xYUtEZUNGd1BPbFZhUC90SGtubGV5UzQ0Y2pMWTlDbUJJL3dJREFRQUJBb0lCQVFDSmxsRUpFUmRRa3Eyago0UGFUZTc4Z1RIb0JmdzJLKzNBTEtuQWJRbW5VM0t4SjRnU1Z1WVBQLzVqdnhLVlp6SXNrK29ISHM1U1lFR3VjCkxvMm1SaEZxR0hBeVFXa2JUZGRXc0VNYU1kNFM1OTR5U2kyNG1FOC9LYk9zd25IaERmOTlJNmFONzhMVkJ5SFMKSEtjWGVpdk14VjZ4cHRKb3dCTWpIWkNMcDFNWVAwbW94ZGNxOFljQlhxYjJIL1plWUUyM0Z2U1pZclRIWHpUQQpIRjhUSUY3QTA4cVpiTHRJVXVHUUkyZ3JobS95TzRmN005NHJpWDI5Z29zUkZadVpRTUY2enRTUWxRRCs4QU8xCnduNGJ2MWdnNHZXaFcycElIcnE1MG5xZkdIR0tRSHBSeU5SbWV4aEliUzJNbzB5UmkzRFNhN2ZSdGhQU0VuWFMKTGdXTFkyaXhBb0dCQU8yd280MjZhVmlDWmUrY3RmNk9YaklQSC9zMGJyNUpjSk92WEgzZHRxeldHdVVlSlRyUwpiWVg4V0oyWXA5c3VPSTk4dUFSRkY4RWNvc25CdzNjSER4NEZ4Skp4blMrUm1ZcGlnNmtNUFVqbmh1MENxcE9HCktPYTV6MVgvUnR0SVRhMlJHeHkxdjdHMHlQTHA3NVhhQTUrYjMvM1RKMDY0ZzQzMThadjZNMEEzQW9HQkFNbEIKMG9YY1BRcGpWdVZWRVFvMmhjUVZOSWw4Qno2SjErQ0o3WUVKZGhLekxYdVdteithMVhtQ0xQcW9wKzVaM0VqMwpiMTFSanRKSHdzQUJ4eGV4QjZDUTlyZ3ZNYk53bitqQkxINmFSRTJaRkZsK0k0T243NGNKbE1la2UrUTB2bEhpCmtNNE94dGZDYkZDNWoyYVowOFJ2SDJob0p5MG9ubEpuWjQvM3d3bDVBb0dBU0FSNk9jb2VleXZmV08rQmtTUnYKMC9rVE5walhhUjUxVnJvT2F6Q1BWZVQxZHpCZ0ZXZUd1YzhReG9kbmJKaWZtSkl3YTFMSDlNSUpiTm9oc0dIYQpLYjJUcHM5MzBkN3F4Nnc3dWkrMExlL0F5UFZDMjdvTmtJTUNHRXRsbTdGWG45eFVlNmx4OEpVWFFjcXh4aFN0CmZtSExSMnYvLy9FV0l5QSsyWVRBbkpjQ2dZQVFnTU5Ba3NTMm0xcSt4M0QwUTNCSW1leUs4WTZ1aENNZG1ISFAKU1BWVHB6bXRqcllBU3pRQ0dMaVRmVXozOElwdHVVeDZmSHVYcHFiRGsrRzlnWmk4ZythWFI5ZHRmV2kvYjBlMAp3ZldqMzArWjN3d09lYkRjZzk2ZFdGR0lid0xFT0Mzamw3YWFicWp2SGFneW81Nkgxd3plUk53aGlka2hyTFVEClN5L0ZFUUtCZ1FDU2dSaCtzaFJYdFBzV2VPVi92c1pVVEY0YTRSejBaMmhoNFpVNnpLU1M2bzRPZlZiSHJjNTQKQ3FIZVpHTEc5ampLQm15WEZ2cE5rdk9qZnhvOUVZSklrODAwRlZybzFWbU4xcFVNUmphK25LSWpveFlBU2ZQdApVWjBVcGJyTFk4MVdsYUZPWStPQmFFdzhpVXZwb2E1S2VLSXVZOVVDU3lLOUR4YTRIZXI0dFE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
kind: Secret
metadata:
  creationTimestamp: "2020-12-26T17:46:00Z"
  managedFields:
  - apiVersion: v1
    fieldsType: FieldsV1
    fieldsV1:
      f:data:
        .: {}
        f:tls.crt: {}
        f:tls.key: {}
      f:type: {}
    manager: kubectl-create
    operation: Update
    time: "2020-12-26T17:46:00Z"
  name: test-tls
  namespace: default
  resourceVersion: "399079"
  uid: 67fb9062-56b4-4900-bab6-45ea35b75a09
type: kubernetes.io/tls
[root@master01 manifests]#

　　提示：创建tls类型的secret资源对象时，只需要指定其名称和对应的证书和私钥文件即可；这里需要注意一点，不管外部证书和私钥是什么名字，在tls类型的secret资源对象中都叫tls.crt和tls.key；它会自动映射为这两个名字；

　　示例：定义pod挂载secret存储卷

[root@master01 ~]# cat mount-secretvolume.yaml
apiVersion: v1
kind: Pod
metadata:
  name: test-pod
  namespace: default
spec:
  containers:
  - name: nginx
    image: nginx:1.14-alpine
    volumeMounts:
    - name: test-tls-secret
      mountPath: /etc/nginx/cert/
  volumes:
  - name: test-tls-secret
    secret:
      secretName: test-tls
      items:
      - key: tls.crt
        path: test.crt
        mode: 0400
      - key: tls.key
        path: test.key
        mode: 0400
[root@master01 ~]#

　　应用资源清单

[root@master01 ~]# kubectl apply -f mount-secretvolume.yaml
pod/test-pod created
[root@master01 ~]# kubectl get pods -w
NAME         READY   STATUS    RESTARTS   AGE
mysql-demo   1/1     Running   0          23m
test-nginx   1/1     Running   0          53m
test-pod     1/1     Running   0          6s
^C[root@master01 ~]# kubectl describe pod test-pod
Name:         test-pod
Namespace:    default
Priority:     0
Node:         node04.k8s.org/192.168.0.47
Start Time:   Sun, 27 Dec 2020 01:57:54 +0800
Labels:       <none>
Annotations:  <none>
Status:       Running
IP:           10.244.4.25
IPs:
  IP:  10.244.4.25
Containers:
  nginx:
    Container ID:   docker://4ec25999d3813cebe9c7a78c3ffa6b5d282f730c56c88454b08c08b1e7f7a3a7
    Image:          nginx:1.14-alpine
    Image ID:       docker-pullable://nginx@sha256:485b610fefec7ff6c463ced9623314a04ed67e3945b9c08d7e53a47f6d108dc7
    Port:           <none>
    Host Port:      <none>
    State:          Running
      Started:      Sun, 27 Dec 2020 01:57:55 +0800
    Ready:          True
    Restart Count:  0
    Environment:    <none>
    Mounts:
      /etc/nginx/cert/ from test-tls-secret (rw)
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-xvd4c (ro)
Conditions:
  Type              Status
  Initialized       True
  Ready             True
  ContainersReady   True
  PodScheduled      True
Volumes:
  test-tls-secret:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  test-tls
    Optional:    false
  default-token-xvd4c:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-xvd4c
    Optional:    false
QoS Class:       BestEffort
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                 node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
  Type    Reason     Age   From               Message
  ----    ------     ----  ----               -------
  Normal  Scheduled  20s   default-scheduler  Successfully assigned default/test-pod to node04.k8s.org
  Normal  Pulled     19s   kubelet            Container image "nginx:1.14-alpine" already present on machine
  Normal  Created    19s   kubelet            Created container nginx
  Normal  Started    19s   kubelet            Started container nginx
[root@master01 ~]#

　　提示：可以看到对应容器已经将对应secret存储卷以读写方式挂载至/etc/nginx/cert/目录；

　　验证：进入test-pod交互式接口，看看对应目录下是否有对应的文件呢？

[root@master01 ~]# kubectl exec -it test-pod -- /bin/sh
/ # cd /etc/nginx/
/etc/nginx # ls
cert                    fastcgi_params.default  modules                 uwsgi_params
conf.d                  koi-utf                 nginx.conf              uwsgi_params.default
fastcgi.conf            koi-win                 nginx.conf.default      win-utf
fastcgi.conf.default    mime.types              scgi_params
fastcgi_params          mime.types.default      scgi_params.default
/etc/nginx # ls cert
test.crt  test.key
/etc/nginx # cat cert/test.crt
-----BEGIN CERTIFICATE-----
MIIDhzCCAm+gAwIBAgIJAN0KdsMjH2SXMA0GCSqGSIb3DQEBCwUAMFoxCzAJBgNV
BAYTAkNOMRAwDgYDVQQIDAdTaUNodWFuMRIwEAYDVQQHDAlHdWFuZ1l1YW4xDTAL
BgNVBAoMBFRlc3QxFjAUBgNVBAMMDXd3dy5teWFwcC5jb20wHhcNMjAxMjIxMTc1
NDM3WhcNMzAxMjE5MTc1NDM3WjBaMQswCQYDVQQGEwJDTjEQMA4GA1UECAwHU2lD
aHVhbjESMBAGA1UEBwwJR3VhbmdZdWFuMQ0wCwYDVQQKDARUZXN0MRYwFAYDVQQD
DA13d3cubXlhcHAuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
utzNuv3EwBQF0/hv8Oc7xfsUFHDo4rngbUybmTMWzZEN4DwA9ByXoRO+1ANGHtqs
M981JI3syGmn15uCSya4e23H8FkEW/xXxW3U1vhFliFPw4X13FQNz9LbjP7flpNO
QG6JVmgaCrdZuNQgo1IHmhraEXuzU+SVF3Uxu0ww9CQfk1po67Cb7AMFTLknPmHI
wilzD+WXyKrWscD0Pgh3M5uBpD52n5Dl8zVd2bHYRdgHRotu2SNpprkeV9sHleje
k5e04GdsaWjdhbp07+ZpX2hKVHA1bXRzeXm7N18e46zSOhGrum1aKDeCFwPOlVaP
/tHknleyS44cjLY9CmBI/wIDAQABo1AwTjAdBgNVHQ4EFgQUsSSt9RRgO78TBrPO
4wRwU0beZPIwHwYDVR0jBBgwFoAUsSSt9RRgO78TBrPO4wRwU0beZPIwDAYDVR0T
BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAXBP5Lug5e4bTmYwCl4rB2+i8Ulyu
YnfkvdJB8/ZQJYsDth0CLFXGGygHwVhYdXOMcJpw2CUmCljEpROBoOd4jowJALpI
XqPs/Bbvh3Bwpz8WwKw5qGz6dCLcfSfLWD7vDAUWvsu/WUFB5iUYJrg+FZp6pPU7
xWi1Kbszb3pf6J+XRt2ZYx5X2ZGu42oafp7wgXsKItPog6gcCGzgRWAAspxO8QQc
JcWNev0HP3uUbXoRmEvKSWcwSryae5nPiZF5dh+GG+6NKivrAGDd15sg9Fdy3T9z
DdYUfNHFbU9MHzv154Kq4UUgVRm96ci+tXnaGm32MqQdeU/qUQxKggeL2g==
-----END CERTIFICATE-----
/etc/nginx # cat cert/test.key
-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAutzNuv3EwBQF0/hv8Oc7xfsUFHDo4rngbUybmTMWzZEN4DwA
9ByXoRO+1ANGHtqsM981JI3syGmn15uCSya4e23H8FkEW/xXxW3U1vhFliFPw4X1
3FQNz9LbjP7flpNOQG6JVmgaCrdZuNQgo1IHmhraEXuzU+SVF3Uxu0ww9CQfk1po
67Cb7AMFTLknPmHIwilzD+WXyKrWscD0Pgh3M5uBpD52n5Dl8zVd2bHYRdgHRotu
2SNpprkeV9sHlejek5e04GdsaWjdhbp07+ZpX2hKVHA1bXRzeXm7N18e46zSOhGr
um1aKDeCFwPOlVaP/tHknleyS44cjLY9CmBI/wIDAQABAoIBAQCJllEJERdQkq2j
4PaTe78gTHoBfw2K+3ALKnAbQmnU3KxJ4gSVuYPP/5jvxKVZzIsk+oHHs5SYEGuc
Lo2mRhFqGHAyQWkbTddWsEMaMd4S594ySi24mE8/KbOswnHhDf99I6aN78LVByHS
HKcXeivMxV6xptJowBMjHZCLp1MYP0moxdcq8YcBXqb2H/ZeYE23FvSZYrTHXzTA
HF8TIF7A08qZbLtIUuGQI2grhm/yO4f7M94riX29gosRFZuZQMF6ztSQlQD+8AO1
wn4bv1gg4vWhW2pIHrq50nqfGHGKQHpRyNRmexhIbS2Mo0yRi3DSa7fRthPSEnXS
LgWLY2ixAoGBAO2wo426aViCZe+ctf6OXjIPH/s0br5JcJOvXH3dtqzWGuUeJTrS
bYX8WJ2Yp9suOI98uARFF8EcosnBw3cHDx4FxJJxnS+RmYpig6kMPUjnhu0CqpOG
KOa5z1X/RttITa2RGxy1v7G0yPLp75XaA5+b3/3TJ064g4318Zv6M0A3AoGBAMlB
0oXcPQpjVuVVEQo2hcQVNIl8Bz6J1+CJ7YEJdhKzLXuWmz+a1XmCLPqop+5Z3Ej3
b11RjtJHwsABxxexB6CQ9rgvMbNwn+jBLH6aRE2ZFFl+I4On74cJlMeke+Q0vlHi
kM4OxtfCbFC5j2aZ08RvH2hoJy0onlJnZ4/3wwl5AoGASAR6OcoeeyvfWO+BkSRv
0/kTNpjXaR51VroOazCPVeT1dzBgFWeGuc8QxodnbJifmJIwa1LH9MIJbNohsGHa
Kb2Tps930d7qx6w7ui+0Le/AyPVC27oNkIMCGEtlm7FXn9xUe6lx8JUXQcqxxhSt
fmHLR2v///EWIyA+2YTAnJcCgYAQgMNAksS2m1q+x3D0Q3BImeyK8Y6uhCMdmHHP
SPVTpzmtjrYASzQCGLiTfUz38IptuUx6fHuXpqbDk+G9gZi8g+aXR9dtfWi/b0e0
wfWj30+Z3wwOebDcg96dWFGIbwLEOC3jl7aabqjvHagyo56H1wzeRNwhidkhrLUD
Sy/FEQKBgQCSgRh+shRXtPsWeOV/vsZUTF4a4Rz0Z2hh4ZU6zKSS6o4OfVbHrc54
CqHeZGLG9jjKBmyXFvpNkvOjfxo9EYJIk800FVro1VmN1pUMRja+nKIjoxYASfPt
UZ0UpbrLY81WlaFOY+OBaEw8iUvpoa5KeKIuY9UCSyK9Dxa4Her4tQ==
-----END RSA PRIVATE KEY-----
/etc/nginx #

　　提示：可以看到在test-pod容器对应的/etc/nginx/目录下自动创建了一个cert目录，并在其目录下看到有两个证书文件，一个名为test.crt，一个名为test.key；这两个名字都是我们在pod资源清单中指定的名称；

　　示例：使用资源清单创建secret资源

[root@master01 ~]# cat test-secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: test-secret-demo
  namespace: default
data:
  name: cWl1aG9tCg==
  passwd: YWRtaW4xMjMuY29tCg==
type: Opaque
[root@master01 ~]#

　　提示：使用资源清单方式创建secret时，data字段是定义对应的kv配置信息，需要事先将其对应的值转换为base64编码；type是用来指定对应secret的类型，这个字段有四个值，分别是Opaque 、kubernetes.io/dockerconfigjson、kubernetes.io/tls、kubernetes.io/service-account-token；

　　应用资源清单

[root@master01 ~]# kubectl apply -f test-secret.yaml
secret/test-secret-demo created
[root@master01 ~]# kubectl get secret
NAME                           TYPE                                  DATA   AGE
default-token-xvd4c            kubernetes.io/service-account-token   3      18d
docker-registry.io             kubernetes.io/dockerconfigjson        1      107m
mysql-auth                     Opaque                                2      70m
test-secret-demo               Opaque                                2      19s
test-tls                       kubernetes.io/tls                     2      42m
www-myapp-com-ingress-secret   kubernetes.io/tls                     2      5d
[root@master01 ~]# kubectl describe secret test-secret-demo
Name:         test-secret-demo
Namespace:    default
Labels:       <none>
Annotations:  <none>

Type:  Opaque

Data
====
name:    7 bytes
passwd:  13 bytes
[root@master01 ~]#kubectl get secret test-secret-demo -o yaml
apiVersion: v1
data:
  name: cWl1aG9tCg==
  passwd: YWRtaW4xMjMuY29tCg==
kind: Secret
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","data":{"name":"cWl1aG9tCg==","passwd":"YWRtaW4xMjMuY29tCg=="},"kind":"Secret","metadata":{"annotations":{},"name":"test-secret-demo","namespace":"default"},"type":"Opaque"}
  creationTimestamp: "2020-12-26T18:28:19Z"
  managedFields:
  - apiVersion: v1
    fieldsType: FieldsV1
    fieldsV1:
      f:data:
        .: {}
        f:name: {}
        f:passwd: {}
      f:metadata:
        f:annotations:
          .: {}
          f:kubectl.kubernetes.io/last-applied-configuration: {}
      f:type: {}
    manager: kubectl-client-side-apply
    operation: Update
    time: "2020-12-26T18:28:19Z"
  name: test-secret-demo
  namespace: default
  resourceVersion: "403480"
  uid: 95aecff5-7f78-4f16-908f-61deb56f8c53
type: Opaque
[root@master01 ~]# 

　　示例：使用stringData字段来指定数据

[root@master01 ~]# cat test1-secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: test-secret-demo1
  namespace: default
stringData:
  name: qiuhom
  passwd: admin123.com
type: Opaque
[root@master01 ~]#

　　提示：使用stringData字段来指定kv配置信息，可以不用将对应数据编码为base64格式；它会在创建secret时，自动将其转化为base64编码格式，存放在data字段中；

　　应用配置清单

[root@master01 ~]# kubectl apply -f test1-secret.yaml
secret/test-secret-demo1 created
[root@master01 ~]# kubectl get secret
NAME                           TYPE                                  DATA   AGE
default-token-xvd4c            kubernetes.io/service-account-token   3      18d
docker-registry.io             kubernetes.io/dockerconfigjson        1      117m
mysql-auth                     Opaque                                2      79m
test-secret-demo               Opaque                                2      9m40s
test-secret-demo1              Opaque                                2      11s
test-tls                       kubernetes.io/tls                     2      51m
www-myapp-com-ingress-secret   kubernetes.io/tls                     2      5d
[root@master01 ~]# kubectl get secret test-secret-demo1 -o yaml
apiVersion: v1
data:
  name: cWl1aG9t
  passwd: YWRtaW4xMjMuY29t
kind: Secret
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","kind":"Secret","metadata":{"annotations":{},"name":"test-secret-demo1","namespace":"default"},"stringData":{"name":"qiuhom","passwd":"admin123.com"},"type":"Opaque"}
  creationTimestamp: "2020-12-26T18:37:48Z"
  managedFields:
  - apiVersion: v1
    fieldsType: FieldsV1
    fieldsV1:
      f:data:
        .: {}
        f:name: {}
        f:passwd: {}
      f:metadata:
        f:annotations:
          .: {}
          f:kubectl.kubernetes.io/last-applied-configuration: {}
      f:type: {}
    manager: kubectl-client-side-apply
    operation: Update
    time: "2020-12-26T18:37:48Z"
  name: test-secret-demo1
  namespace: default
  resourceVersion: "404463"
  uid: 718d1306-43af-40cb-9a56-6177205be5c4
type: Opaque
[root@master01 ~]# kubectl describe secret test-secret-demo1
Name:         test-secret-demo1
Namespace:    default
Labels:       <none>
Annotations:  <none>

Type:  Opaque

Data
====
name:    6 bytes
passwd:  12 bytes
[root@master01 ~]#

　　提示：stringData字段不会被apiserver输出，它将stringData字段信息以base64编码格式存储在data字段中给予显示；但是将对应secret输出为yaml格式时，在对应的注解信息中能够看到对应stringData的信息；