不在k8s中加载秘密

Question

我正在学习使用 k8s，但遇到了问题。我已经能够使用相同的 yml 执行多个部署而没有问题。我的问题是，当我挂载秘密卷时，它会向我加载包含变量的目录，但它不会将它们检测为环境变量

我的秘密

apiVersion: v1
kind: Secret
metadata:
  namespace: insertmendoza
  name: authentications-sercret
type: Opaque
data:
  DB_USERNAME: aW5zZXJ0bWVuZG96YQ==
  DB_PASSWORD: aktOUDlaZHRFTE1tNks1

  TOKEN_EXPIRES_IN: ODQ2MDA=
  SECRET_KEY: aXRzaXNzZWd1cmU=

apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: insertmendoza
  name: sarys-authentications
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sarys-authentications
  template:
    metadata:
      labels:
        app: sarys-authentications
    spec:
      containers:
        - name: sarys-authentications
          image: 192.168.88.246:32000/custom:image
          imagePullPolicy: Always
          resources:
            limits:
              memory: "500Mi"
              cpu: "50m"
          ports:
            - containerPort: 8000

          envFrom:
            - configMapRef:
                name: authentications-config

          volumeMounts:
            - name: config-volumen
              mountPath: /etc/config/
              readOnly: true

            - name: secret-volumen
              mountPath: /etc/secret/
              readOnly: true

      volumes:
        - name: config-volumen
          configMap:
            name: authentications-config

        - name: secret-volumen
          secret:
            secretName: authentications-sercret

> microservice@1.0.0 start
> node dist/index.js
{
  ENGINE: 'postgres',
  NAME: 'insertmendoza',
  USER: undefined, <-- not load 
  PASSWORD: undefined,<-- not load 
  HOST: 'db-service',
  PORT: '5432'
}

如果我手动添加它们，如果它识别它们

 env:
            - name: DB_USERNAME
              valueFrom:
                secretKeyRef:
                  name: authentications-sercret
                  key: DB_USERNAME

            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: authentications-sercret
                  key: DB_PASSWORD

> microservice@1.0.0 start
> node dist/index.js
{
  ENGINE: 'postgres',
  NAME: 'insertmendoza',
  USER: 'insertmendoza', <-- work 
  PASSWORD: 'jKNP9ZdtELMm6K5', <-- work
  HOST: 'db-service',
  PORT: '5432'
}
listening queue
listening on *:8000

在我挂载秘密的目录中！

/etc/secret # ls
DB_PASSWORD       DB_USERNAME       SECRET_KEY        TOKEN_EXPIRES_IN
/etc/secret # cat DB_PASSWORD 
jKNP9ZdtELMm6K5/etc/secret # 

编辑

我的解决速度是

envFrom:
        - configMapRef:
            name: authentications-config

        - secretRef: <<--
            name: authentications-sercret <<--

我希望它对你有帮助，来自阿根廷的问候插入门多萨

Answer 1

如果我正确理解了这个问题，那么您就没有将机密加载到环境中。看起来您加载不正确，请使用 envFrom 记录的 here 表单。

使用您的示例将是：

apiVersion: v1
kind: Secret
metadata:
  namespace: insertmendoza
  name: authentications-sercret
type: Opaque
data:
  DB_USERNAME: aW5zZXJ0bWVuZG96YQ==
  DB_PASSWORD: aktOUDlaZHRFTE1tNks1

  TOKEN_EXPIRES_IN: ODQ2MDA=
  SECRET_KEY: aXRzaXNzZWd1cmU=

---

apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: insertmendoza
  name: sarys-authentications
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sarys-authentications
  template:
    metadata:
      labels:
        app: sarys-authentications
    spec:
      containers:
        - name: sarys-authentications
          image: 192.168.88.246:32000/custom:image
          imagePullPolicy: Always
          resources:
            limits:
              memory: "500Mi"
              cpu: "50m"
          ports:
            - containerPort: 8000

          envFrom:
            - configMapRef:
                name: authentications-config

            - secretRef:
                name: authentications-sercret

          volumeMounts:
            - name: config-volumen
              mountPath: /etc/config/
              readOnly: true
      volumes:
        - name: config-volumen
          configMap:
            name: authentications-config

注意卷和装载已被删除，只需添加secretRef 部分。这些现在应该作为环境变量导出到您的 pod 中。