一,前言

上一篇,介绍了两种 Secret 对象的创建;

本篇,介绍了 Secret 镜像的使用;

二,使用 secret 镜像

1,Volume 挂载

将Secret 镜像通过存储卷的方式进行挂载

更新配置

查看之前的 deployment-user-v1.yaml

[root@k8s-master deployment]# vi deployment-user-v1.yaml

apiVersion: apps/v1 API版本号
kind: Deployment    资源类型部署
metadata:
  name: user-v1     资源名称
spec:
  minReadySeconds: 1
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: user-v1  告诉deployment根据规则匹配相应的Pod进行控制和管理,matchLabels字段匹配Pod的label值
  replicas: 3       声明Pod副本的数量
  template:
    metadata:
      labels:
        app: user-v1Pod名称
    spec:           描述Pod内的容器信息
      containers:
      - name: nginx 容器的名称
        image: nginx:user-v3镜像
        ports:
        - containerPort: 80容器内映射的端口                                                  

修改以下几处配置:

1,将副本改为 1 份

2,template 模板下的 spec 描述信息,添加 volumes 数据卷声明:使用 secret-opaque(下图中)

[root@k8s-master deployment]# kubectl get secret
NAME                  TYPE                                  DATA   AGE
default-token-q4qxd   kubernetes.io/service-account-token   3      8d
registry-auth         kubernetes.io/dockerconfigjson        1      25m
registry-auth-file    kubernetes.io/dockerconfigjson        1      19m
secret-opaque         Opaque                                2      40m
secret-opaque-flie    Opaque                                2      32m

更新deployment-user-v1.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: user-v1
spec:
  minReadySeconds: 1
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: user-v1
+ replicas: 1声明Pod副本的数量
  template:
    metadata:
      labels:
        app: user-v1
    spec:
+     volumes:
+     - name: secret-opaque声明数据卷
+       secret:
+         secretName: secret-opaque引用的secret名称
      containers:
      - name: nginx
        image: nginx:user-v3
+       volumeMounts:数据卷的挂载信息
+       - name: secret-opaque	#挂载名称 
+         mountPath: /secret-opaque挂载路径
+         readOnly: true只读
        ports:
        - containerPort: 80

应用配置

[root@k8s-master deployment]# kubectl apply -f deployment-user-v1.yaml
deployment.apps/user-v1 configured

查看pod 列表

[root@k8s-master deployment]# kubectl get pods
NAME                       READY   STATUS    RESTARTS   AGE
http-probe                 1/1     Running   78         4h18m
user-v1-64c948c799-66m9w   1/1     Running   0          58s

进入pod

kubectl exec -it user-v1-64c948c799-66m9w -- bash

// 实际执行
[root@k8s-master deployment]# kubectl exec -it user-v1-64c948c799-66m9w -- bash
root@user-v1-64c948c799-66m9w:/# cd secret-opaque/
root@user-v1-64c948c799-66m9w:/secret-opaque# ls
password  username
root@user-v1-64c948c799-66m9w:/secret-opaque# cat username 
admin
root@user-v1-64c948c799-66m9w:/secret-opaque# cat password 
123456

这就是第一种,将Secret作为数据卷,将硬盘上的文件挂载到文件系统中去

2,环境变量注入

  • 第二种是将 Secret 注入进容器的环境变量

修改deployment-user-v1.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: user-v1
spec:
  minReadySeconds: 1
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: user-v1
  replicas: 1
  template:
    metadata:
      labels:
        app: user-v1
    spec:
      volumes:
      - name: secret-opaque
        secret:
          secretName: secret-opaque
      containers:
      - name: nginx
+       env:环境变量
+       - name: USERNAME
+         valueFrom:取值位置
+           secretKeyRef:引用secret对象中的某个key
+             name: secret-opaque-flie指定secret对象
+             key: username指定secret对象中的key为username
+       - name: PASSWORD
+         valueFrom:
+           secretKeyRef:
+             name: secret-opaque-flie
+             key: password
        image: nginx:user-v3
        volumeMounts:
        - name: secret-opaque
          mountPath: /secret-opaque
          readOnly: true
        ports:
        - containerPort: 80

应用配置

[root@k8s-master deployment]# kubectl apply -f deployment-user-v1.yaml 
deployment.apps/user-v1 configured

[root@k8s-master deployment]# kubectl get pods
NAME                       READY   STATUS             RESTARTS   AGE
http-probe                 0/1     CrashLoopBackOff   83         4h35m
user-v1-84bdcc465b-vxvl2   1/1     Running            0          31s

打印当前所有变量

// 进入容器
kubectl exec -it user-v1-84bdcc465b-vxvl2 -- env
kubectl exec -it user-v1-84bdcc465b-vxvl2 -- env | grep USERNAME

// 实际执行
[root@k8s-master deployment]# kubectl exec -it user-v1-84bdcc465b-vxvl2 -- env
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=user-v1-84bdcc465b-vxvl2
TERM=xterm
USERNAME=root
PASSWORD=root
KUBERNETES_PORT_443_TCP_PORT=443
SERVICE_USER_V1_PORT=tcp://10.104.13.40:80
SERVICE_USER_V1_PORT_80_TCP=tcp://10.104.13.40:80
SERVICE_USER_V1_PORT_80_TCP_ADDR=10.104.13.40
SERVICE_USER_V1_PORT_80_TCP_PROTO=tcp
KUBERNETES_SERVICE_PORT=443
KUBERNETES_PORT=tcp://10.96.0.1:443
KUBERNETES_PORT_443_TCP_PROTO=tcp
KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1
SERVICE_USER_V1_SERVICE_HOST=10.104.13.40
KUBERNETES_SERVICE_PORT_HTTPS=443
SERVICE_USER_V1_PORT_80_TCP_PORT=80
KUBERNETES_SERVICE_HOST=10.96.0.1
KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443
SERVICE_USER_V1_SERVICE_PORT=80
NGINX_VERSION=1.19.6
NJS_VERSION=0.5.0
PKG_RELEASE=1~buster
HOME=/root

[root@k8s-master deployment]# kubectl exec -it user-v1-84bdcc465b-vxvl2 -- env | grep USERNAME
USERNAME=root

备注:

配置生效后,可以获取到环境变量;

比如:nodejs 可以通过 process.env.USERNAME 拿到环境变量 USERNAME 的值;

3,Docker 私有库认证

  • 第三种是 Docker 私有库类型,这种方法只能用来配置 私有镜像库认证。

创建一个新的配置文件(拷贝deployment-user-v1.yaml -> deployment-v4.yaml)

[root@k8s-master deployment]# cp deployment-user-v1.yaml deployment-v4.yaml

修改前deployment-v4.yaml

[root@k8s-master deployment]# vi deployment-v4.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: user-v1
spec:
  minReadySeconds: 1
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: user-v1
  replicas: 1
  template:
    metadata:
      labels:
        app: user-v1
    spec:
      volumes:
      - name: secret-opaque
        secret:
          secretName: secret-opaque
      containers:
      - name: nginx
        env:环境变量
        - name: USERNAME
          valueFrom:取值位置
            secretKeyRef:引用secret对象中的某个key
              name: secret-opaque-flie指定secret对象
              key: username指定secret对象中的key为username
        - name: PASSWORD
          valueFrom:
            secretKeyRef:
              name: secret-opaque-flie
              key: password
        image: nginx:user-v3
        volumeMounts:
        - name: secret-opaque
          mountPath: /secret-opaque
          readOnly: true
        ports:
        - containerPort: 80

修改后deployment-v4.yaml (使用私有镜像仓库)

[root@k8s-master deployment]# vi deployment-v4.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: v4    修改
spec:
  selector:
    matchLabels:
      app: v4 修改
  replicas: 1
  template:
    metadata:
      labels:
        app: v4修改
    spec: 
      containers:
      - name: vue-project
        image: 39.105.212.14:8082/vue-project:2021123011191640834385  修改
        ports:
        - containerPort: 80

查看本地镜像列表

[root@iZ2ze7rkgit9zoa18pxu73Z ~]# docker image ls
REPOSITORY                       TAG                      IMAGE ID       CREATED       SIZE
39.105.212.14:8082/vue-project   2021123011191640834385   cf09bb54e87e   4 hours ago   110MB
39.105.212.14:8082/vue-project   2021123011461640835990   cf09bb54e87e   4 hours ago   110MB
cicdproject                      latest                   2e9269d7c724   10 days ago   110MB
node                             latest                   058747996654   3 weeks ago   992MB
nginx                            1.15                     53f3fd8007f7   2 years ago   109MB

选用镜像:39.105.212.14:8082/vue-project:2021123011191640834385

// 镜像名称规则
image: [仅有镜像库地址]/[镜像名称]:[镜像标签]

生效配置

// 生效配置
[root@k8s-master deployment]# kubectl apply -f deployment-v4.yaml 
deployment.apps/v4 created

// 查看 pod,v4 报错 ErrImagePull
[root@k8s-master deployment]# kubectl get pods
NAME                       READY   STATUS             RESTARTS   AGE
http-probe                 0/1     CrashLoopBackOff   87         4h48m
user-v1-84bdcc465b-vxvl2   1/1     Running            0          13m
v4-6dcd997cdf-fw8pr        0/1     ErrImagePull       0          7s

// 查看 pod 详情:镜像拉取失败,没有权限
// 成功分配任务;拉取镜像;镜像拉取失败:没有权限;
[root@k8s-master deployment]# kubectl describe pods v4-6dcd997cdf-fw8pr
Events:
  Type     Reason     Age                From               Message
  ----     ------     ----               ----               -------
  Normal   Scheduled  38s                default-scheduler  Successfully assigned default/v4-6dcd997cdf-fw8pr to k8s-node
  Normal   Pulling    22s (x2 over 38s)  kubelet            Pulling image "39.105.212.14:8082/vue-project:2021123011191640834385"
  Warning  Failed     22s (x2 over 38s)  kubelet            Failed to pull image "39.105.212.14:8082/vue-project:2021123011191640834385": rpc error: code = Unknown desc = Error response from daemon: Get "https://39.105.212.14:8082/v2/": http: server gave HTTP response to HTTPS client
  Warning  Failed     22s (x2 over 38s)  kubelet            Error: ErrImagePull
  Normal   BackOff    7s (x2 over 37s)   kubelet            Back-off pulling image "39.105.212.14:8082/vue-project:2021123011191640834385"
  Warning  Failed     7s (x2 over 37s)   kubelet            Error: ImagePullBackOff

三,结尾

本篇,介绍了两种 Secret 对象的使用;

下一篇,第十七篇 - ECS 服务停机和环境修复;