K8s Secret

K8s Secret?

• 시크릿은 비밀번호, OAuth 토큰, SSH 키 같은 민감한 정보들을 저장하는 용도로 사용
• 구성정보를 base64로 인코딩해서 한곳에서 관리
  • 인코딩된 정보가 pod로 전달되면 해당 정보는 디코딩 된 형태로 보임
• secret의 최대 크기는 1MB
• Secret는 etcd에 암호화 하지 않은 텍스트 형태로 저장됨

kubectl create secret <Available Commands> name
                        docker-registry
                        generic
                        tls
                        
 ex)
 kubectl create secret tls my-secret --cert=path/to/certi/file --key=path/to/key/file
 
 kubectl creaate secret docker-registry reg-secret --docker-username=xxx \
   --docker-password=pass --docker-email=xxx@gmail.com
   
kubectl creaate secret genetic generic-secret \
--from-literal=INTERVAL=2 --from-file=/config/

 

 

K8s Secret 생성 테스트

apiVersion: v1
kind: Pod
metadata:
  name: genid-env-secret
spec:
  containers:
  - image: ubuntu
    command: ["bash"]
    args:
    - "-c"
    - sleep 100000
    env:
    - name: INTERVAL
      valueFrom:
        secretKeyRef:
          name: test-secret
          key: INTERVAL
    name: generator
    volumeMounts:
    - name: html
      mountPath: /webdata
  - image: nginx:1.14
    name: web-server
    volumeMounts:
    - name: html
      mountPath: /usr/share/nginx/html
      readOnly: true
    ports:
    - containerPort: 80
  volumes:
  - name: html
    emptyDir: {}

• # kubectl create secret generic test-secret --from-literal=INTERVAL=2 --from-file=./genid-web-config/

 

 

K8s Secret 볼륨마운트 테스트

apiVersion: v1
kind: Pod
metadata:
  name: genid-env-secret
spec:
  containers:
  - image: ubuntu
    command: ["bash"]
    args:
    - "-c"
    - sleep 100000
    env:
    - name: INTERVAL
      valueFrom:
        secretKeyRef:
          name: test-secret
          key: INTERVAL
    name: generator
    volumeMounts:
    - name: html
      mountPath: /webdata
    - name: config
      mountPath: /etc/nginx/conf.d
  - image: nginx:1.14
    name: web-server
    volumeMounts:
    - name: html
      mountPath: /usr/share/nginx/html
      readOnly: true
    ports:
    - containerPort: 80
  volumes:
  - name: html
    emptyDir: {}
  - name: config
    secret:
      secretName: test-secret
      items:
      - key: nginx-config.conf
        path: nginx-config