kubernetes中怎么驗證secret和configmap

這篇文章主要講解了“kubernetes中怎么驗證secret和configmap”，文中的講解內容簡單清晰，易于學習與理解，下面請大家跟著小編的思路慢慢深入，一起來研究和學習“kubernetes中怎么驗證secret和configmap”吧！

在k8s上用deployment和service部署nginx，用secret存儲ssl證書，用configmap存儲nginx配置文件，簡單搭建起https服務。

1，新建一個有兩個pod的deployment my-nginx

編輯deployment文件

vi dep-nginx.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-nginx
spec:
  selector:
    matchLabels:
      run: my-nginx
  replicas: 2
  template:
    metadata:
      labels:
        run: my-nginx
    spec:
      containers:
      - name: my-nginx
        image: nginx
        ports:
        - containerPort: 80

部署pod：

kubectl apply -f dep-nginx.yaml

kubectl get pods -l run=my-nginx -o wide

# 檢查 Pod 的 IP 地址

kubectl get pods -l run=my-nginx -o yaml | grep podIP

2，為my-nginx新建service

vi nginx-svc.yaml

apiVersion: v1
kind: Service
metadata:
  name: my-nginx
  labels:
    run: my-nginx
spec:
  ports:
  - port: 80
    targetPort: 80
    protocol: TCP
  selector:
    run: my-nginx

kubectl apply -f nginx-svc.yaml

kubectl get svc my-nginx

kubectl get ep my-nginx

3，驗證pod的自愈

刪除deployment中的pod

kubectl delete pods -l run=my-nginx

可看到刪除的pod會被重建，查看重建后的變化

kubectl exec my-nginx-3800858182-e9ihh -- printenv | grep SERVICE

service的dns

kubectl get services kube-dns --namespace=kube-system

kubectl run curl --image=radial/busyboxplus:curl -i --tty

替代nslookup工具的busybox

https://github.com/cncf/curriculum

nslookup my-nginx

4，為新建的nginx添加ssl證書，通過新建secret來使用

1）自簽證書

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /d/tmp/nginx.key -out /d/tmp/nginx.crt -subj "/CN=my-nginx/O=my-nginx"

編碼

echo -n "string"| base64

cat dockerconfig.json |base64 -w 0

解碼

echo "string" | base64 --decode

cat nginx.key |base64 -w 0

cat nginx.crt |base64 -w 0

2）編輯secret文件

vi nginxsecrets.yaml

apiVersion: "v1"
kind: "Secret"
metadata:
  name: "nginxsecret"
  namespace: "default"
data:
  nginx.crt: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURIekNDQWdlZ0F3SUJBZ0lKQUp5M3lQK0pzMlpJT"
  nginx.key: "LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQ"

3）部署secret

kubectl apply -f nginxsecrets.yaml

4）查看新建的secret

kubectl get secrets

5）編輯對應的deployment和service配置文件

vi nginx-https.yaml

apiVersion: v1
kind: Service
metadata:
  name: nginx-https
  labels:
    run: nginx-https
spec:
  type: NodePort
  ports:
  - port: 80
    targetPort: 80
    protocol: TCP
    name: http
  - port: 443  #新加443端口
    protocol: TCP
    name: https
  selector:
    run: nginx-https
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-https
spec:
  selector:
    matchLabels:
      run: nginx-https
  replicas: 1
  template:
    metadata:
      labels:
        run: nginx-https
    spec:
      volumes:
      - name: secret-volume
        secret:
          secretName: nginxsecret  #和新建secret的名字一致
      containers:
      - name: nginxhttps
        image: nginx
        ports:
        - containerPort: 443
        - containerPort: 80
        volumeMounts:
        - mountPath: /etc/nginx/ssl   #設置配置文件掛載點
          name: secret-volume

部署deployment和service

kubectl -f nginx-https.yaml

6）登錄pod并配置ssl，secret只是添加了SSL證書，還得修改配置文件

kubectl exec -it nginx-https-6575cc58f5-7p28z -- /bin/bash

sed -i 'N;2a\ listen 443 ssl;' /etc/nginx/conf.d/default.conf

sed -i 'N;4a\ ssl_certificate /etc/nginx/ssl/nginx.crt;' /etc/nginx/conf.d/default.conf

sed -i 'N;6a\ ssl_certificate_key /etc/nginx/ssl/nginx.key;' /etc/nginx/conf.d/default.conf

nginx -s reload

7）驗證

獲取POD的IP

kubectl get pods -o yaml | grep -i podip

curl -k https://10.244.3.5

-k 即因為證書不受信，允許curl使用未驗證證書的ssl連接并且傳輸數據

瀏覽器的權威證書頒發機構查詢： 瀏覽器設置--隱私與安全--證書管理

linux下路徑： /etc/ssl/certs

獲得service IP

kubectl get svc | grep nginx-https | awk '{print $3}'

訪問測試:

curl -k https://10.1.71.99

獲取service的endpoints

kubectl get ep nginx-https

5，剛剛進入容器修改配置不nice，其實無需手動，用configmap將nginx配置傳入容器，像secret一樣使用

vi https-nginx-configmap.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: https-nginx
spec:
  selector:
    matchLabels:
      run: https-nginx
  replicas: 2 
  template:
    metadata:
      labels:
        run: https-nginx
    spec:
      volumes:
      - name: secret-volume
        secret:
          secretName: nginxsecret
      - name: config-volume
        configMap:
          name: nginx-config
      containers:
      - name: https-nginx
        image: nginx
        ports:
        - containerPort: 80
        - containerPort: 443
        volumeMounts:
        - mountPath: /etc/nginx/ssl
          name: secret-volume
        - mountPath: /etc/nginx/conf.d
          name: config-volume
---
apiVersion: v1
kind: Service
metadata:
  name: https-nginx
  labels:
    run: https-nginx
spec:
  type: NodePort
  ports:
  - port: 80
    targetPort: 80
    protocol: TCP
    name: http
  - port: 443
    targetPort: 443
    protocol: TCP
    name: https
  selector:
    run: https-nginx
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-config
data:
  nginx.conf: |
    server {
        listen       80;
        listen  [::]:80;
        listen       443 ssl;
        server_name  localhost;
        ssl_certificate    /etc/nginx/ssl/nginx.crt;
        ssl_certificate_key    /etc/nginx/ssl/nginx.key;
        location / {
            root   /usr/share/nginx/html;
            index  index.html index.htm;
          }
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/share/nginx/html;
          }
    }

kubectl apply -f https-nginx-configmap.yaml

kubectl get deployments

kubectl get svc

kubectl get cm

感謝各位的閱讀，以上就是“kubernetes中怎么驗證secret和configmap”的內容了，經過本文的學習后，相信大家對kubernetes中怎么驗證secret和configmap這一問題有了更深刻的體會，具體使用情況還需要大家實踐驗證。這里是億速云，小編將為大家推送更多相關知識點的文章，歡迎關注！