1 篇博文 含有标签「Secret」

# Volume 生命周期与 Pod 的关系
# 1. Pod 被调度到某个 Node
# 2. Kubelet 调用 Volume 插件挂载存储到宿主机
# 3. Kubelet 将宿主机上的挂载点绑定到容器内
# 4. Pod 运行期间，容器读写 Volume 中的数据
# 5. Pod 被删除时，Kubelet 执行卸载操作
# 6. 临时 Volume 数据被清除，持久化 Volume 数据被保留

apiVersion: v1
kind: Pod
metadata:
  name: volume-demo
  labels:
    app: volume-demo
spec:
  containers:
    # 容器 1：写入数据到共享 Volume
    - name: writer
      image: busybox:1.36
      command: ["/bin/sh", "-c"]
      args:
        - |
          while true; do
            date >> /data/log.txt
            echo "Writer: data written" >> /data/log.txt
            sleep 5
          done
      volumeMounts:
        - name: shared-data
          mountPath: /data

    # 容器 2：从共享 Volume 读取数据
    - name: reader
      image: busybox:1.36
      command: ["/bin/sh", "-c"]
      args: ["tail -f /data/log.txt"]
      volumeMounts:
        - name: shared-data
          mountPath: /data

    # 容器 3：使用 hostPath 访问宿主机时间
    - name: time-checker
      image: busybox:1.36
      command: ["/bin/sh", "-c"]
      args: ["while true; do cat /host-time/hostname; sleep 10; done"]
      volumeMounts:
        - name: host-time
          mountPath: /host-time

  volumes:
    # emptyDir：Pod 内容器间共享的临时存储
    - name: shared-data
      emptyDir:
        sizeLimit: 256Mi  # 可选：限制存储大小

    # hostPath：挂载宿主机目录（仅用于开发/调试）
    - name: host-time
      hostPath:
        path: /etc
        type: Directory  # Directory/DirectoryOrCreate/File/FileOrCreate/Socket/CharDevice/BlockDevice

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: example-vol-default
provisioner: vendor-name.example/magicstorage
parameters:
  resturl: "http://192.168.10.100:8080"
allowVolumeExpansion: true  # 允许扩容

apiVersion: storage.k8s.io/v1alpha1
kind: VolumeAttributesClass
metadata:
  name: fast-ssd
driverName: csi.example.com
parameters:
  iops: "5000"
  throughput: "500"
  encryption: "true"

# ============================================
# 1. 静态供给：先创建 PV，再创建 PVC
# ============================================

# PersistentVolume：集群级存储资源
apiVersion: v1
kind: PersistentVolume
metadata:
  name: mysql-pv
spec:
  capacity:
    storage: 20Gi
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: manual
  nfs:
    server: 10.0.0.100
    path: /data/mysql
  # 可选：挂载选项
  mountOptions:
    - hard
    - nfsvers=4.1

---
# PersistentVolumeClaim：用户存储请求
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mysql-pvc
  namespace: database
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 20Gi
  storageClassName: manual  # 必须与 PV 的 storageClassName 一致

---
# 使用 PVC 的 Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mysql
  namespace: database
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mysql
  template:
    metadata:
      labels:
        app: mysql
    spec:
      containers:
        - name: mysql
          image: mysql:8.0
          env:
            - name: MYSQL_ROOT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: mysql-secret
                  key: root-password
          ports:
            - containerPort: 3306
          volumeMounts:
            - name: mysql-data
              mountPath: /var/lib/mysql
      volumes:
        - name: mysql-data
          persistentVolumeClaim:
            claimName: mysql-pvc

# ============================================
# StorageClass：定义存储类别
# ============================================

# 高性能 SSD 存储类（AWS EBS gp3）
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: fast-ssd
provisioner: kubernetes.io/aws-ebs
parameters:
  type: gp3
  iopsPerGB: "50"
  throughput: "250"
  fsType: ext4
reclaimPolicy: Delete
volumeBindingMode: WaitForFirstConsumer
allowVolumeExpansion: true

---
# 标准 HDD 存储类（AWS EBS st1）
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: standard-hdd
provisioner: kubernetes.io/aws-ebs
parameters:
  type: st1
  fsType: ext4
reclaimPolicy: Retain
volumeBindingMode: WaitForFirstConsumer
allowVolumeExpansion: false

---
# 使用动态供给的 PVC（无需预先创建 PV）
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: app-data-pvc
  namespace: production
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: fast-ssd  # 指定 StorageClass，触发动态供给
  resources:
    requests:
      storage: 50Gi

---
# 本地路径 Provisioner（适合开发/测试环境）
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: local-path
provisioner: rancher.io/local-path
parameters:
  archiveOnDelete: "true"
reclaimPolicy: Delete
volumeBindingMode: WaitForFirstConsumer

# ============================================
# ConfigMap：配置外部化
# ============================================

# 创建 ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
  namespace: production
data:
  # 简单键值对
  LOG_LEVEL: "info"
  MAX_CONNECTIONS: "100"
  CACHE_TTL: "300"

  # 完整配置文件
  application.yml: |
    server:
      port: 8080
      shutdown: graceful
    spring:
      datasource:
        url: jdbc:postgresql://db:5432/mydb
        hikari:
          maximum-pool-size: 20
    logging:
      level:
        root: INFO
        com.example: DEBUG

  # Redis 配置
  redis.conf: |
    bind 0.0.0.0
    port 6379
    maxmemory 256mb
    maxmemory-policy allkeys-lru
    appendonly yes

---
# Pod 中使用 ConfigMap（三种方式）
apiVersion: v1
kind: Pod
metadata:
  name: configmap-demo
  namespace: production
spec:
  containers:
    - name: app
      image: my-app:latest
      ports:
        - containerPort: 8080

      # 方式 1：作为环境变量
      env:
        - name: APP_LOG_LEVEL
          valueFrom:
            configMapKeyRef:
              name: app-config
              key: LOG_LEVEL
        - name: APP_MAX_CONNECTIONS
          valueFrom:
            configMapKeyRef:
              name: app-config
              key: MAX_CONNECTIONS

      # 方式 1 补充：一次性导入所有键为环境变量
      envFrom:
        - configMapRef:
            name: app-config
            # 可选：前缀
            prefix: APP_

      # 方式 2：作为 Volume 挂载（支持热更新）
      volumeMounts:
        - name: config-vol
          mountPath: /etc/app/config
          readOnly: true
        - name: redis-config
          mountPath: /etc/redis/redis.conf
          subPath: redis.conf  # 注意：subPath 不支持热更新

      # 方式 3：作为命令行参数
      args: ["--log-level", "$(APP_LOG_LEVEL)"]

  volumes:
    - name: config-vol
      configMap:
        name: app-config
        # 可选：指定要挂载的键
        items:
          - key: application.yml
            path: application.yml
          - key: redis.conf
            path: redis.conf
        # 可选：设置文件权限
        defaultMode: 0644
    - name: redis-config
      configMap:
        name: app-config

# /etc/kubernetes/pki/secrets-encryption-config.yaml
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources:
      - secrets
    providers:
      - aescbc:
          keys:
            - name: key1
              secret: <base64-encoded-32-byte-key> # 本地对称加密密钥
      - identity: {}  # 兜底：未加密的 Secret 仍可读取

# 仅允许特定 ServiceAccount 读取某个指定的 Secret
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: specific-secret-reader
  namespace: production
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    resourceNames: ["db-credentials", "api-keys"] # 切忌使用 * 或者留空
    verbs: ["get"]

# ============================================
# Secret：敏感信息管理
# ============================================

# 1. Opaque Secret：通用密钥
apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
  namespace: production
type: Opaque
data:
  # 值必须为 Base64 编码
  # echo -n 'my-password' | base64
  username: bXktdXNlcm5hbWU=       # my-username
  password: bXktcGFzc3dvcmQ=       # my-password
  connection-string: amRiYzpwb3N0Z3Jlc3FsOi8vZGItaG9zdDo1NDMyL215ZGI=  # jdbc:postgresql://db-host:5432/mydb
---
# 2. Docker Registry Secret：镜像仓库认证
apiVersion: v1
kind: Secret
metadata:
  name: docker-registry-secret
  namespace: production
type: kubernetes.io/dockerconfigjson
data:
  # 通过命令创建：kubectl create secret docker-registry ...
  .dockerconfigjson: eyJhdXRocyI6eyJodHRwczovL2luZGV4LmRvY2tlci5pby92MS8iOnsidXNlcm5hbWUiOiJ1c2VyIiwicGFzc3dvcmQiOiJwYXNzIiwiYXV0aCI6ImRYTmxjanB3WVhOeiJ9fX0=
---
# 3. TLS Secret：HTTPS 证书
apiVersion: v1
kind: Secret
metadata:
  name: tls-secret
  namespace: production
type: kubernetes.io/tls
data:
  tls.crt: <base64-encoded-cert>
  tls.key: <base64-encoded-key>
---
# 4. 在 Pod 中使用 Secret
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-server
  namespace: production
spec:
  replicas: 3
  selector:
    matchLabels:
      app: api-server
  template:
    metadata:
      labels:
        app: api-server
    spec:
      # 拉取私有镜像
      imagePullSecrets:
        - name: docker-registry-secret

      containers:
        - name: api
          image: my-registry.com/api-server:v2.1.0
          ports:
            - containerPort: 8080

          # 方式 1：作为环境变量
          env:
            - name: DB_USERNAME
              valueFrom:
                secretKeyRef:
                  name: db-credentials
                  key: username
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: db-credentials
                  key: password

          # 方式 2：作为 Volume 挂载
          volumeMounts:
            - name: db-secret-vol
              mountPath: /etc/secrets/db
              readOnly: true
            - name: tls-vol
              mountPath: /etc/tls
              readOnly: true

      volumes:
        - name: db-secret-vol
          secret:
            secretName: db-credentials
            defaultMode: 0400  # 仅所有者可读
        - name: tls-vol
          secret:
            secretName: tls-secret
            defaultMode: 0400