如何连接安装在 kubernetes 卷中的秘密文件

Question

我有几个已挂载的秘密，需要作为属性文件读取。似乎 kubernetes 无法将它们作为单个文件安装，所以我试图在 pod 启动后连接这些文件。我尝试在 postStart 处理程序中运行 cat 命令，但它似乎在安装秘密之前执行，因为我收到此错误：

Error: failed to create containerd task: OCI runtime create failed: container_linux.go:380: starting container process caused: exec: "cat /properties/S3Secret /properties/S3Key >> /properties/dbPassword": stat cat /properties/S3Secret /properties/S3Key >> /properties/dbPassword: no such file or directory: unknown

那么这里是yaml。

apiVersion: apps/v1
kind: Deployment
metadata:
  name: K8S_ID
spec:
  selector:
    matchLabels:
      app: K8S_ID
  replicas: 1
  template:
    metadata:
      labels:
        app: K8S_ID
    spec:
      containers:
        - name: K8S_ID
          image: IMAGE_NAME
          ports:
            - containerPort: 8080
          env:
            - name: PROPERTIES_FILE
              value: "/properties/dbPassword"
          volumeMounts:
            - name: secret-properties
              mountPath: "/properties"
          lifecycle:
            postStart:
              exec:
                command: ["cat /properties/S3Secret /properties/S3Key >> /properties/dbPassword"]
      volumes:
        - name: secret-properties
          secret:
            secretName: secret-properties
            items:
              - key: SECRET_ITEM
                path: dbPassword
              - key: S3Key
                path: S3Key
              - key: S3Secret
                path: S3Secret

Answer 1

您的命令需要一个 shell 会话，如下所示：

...
lifecycle:
  postStart:
    exec:
      command: ["/bin/sh","-c","cat /properties/S3Secret /properties/S3Key >> /properties/dbPassword"]
...