Secret资源

  Secret 资源的功能类似于 ConfigMap，但它专用于存放敏感数据，例如密码、数字证书、私钥、令牌 和 SSH key 等。

一、Secret概述

  Secret 对象存储数据的方式及使用方式类似于 ConfigMap 对象，相同的是，都以键值方式存储数据，在 Pod 资源中通过环境变量或存储卷进行数据访问。不同的是，Secret 对象仅会被分发至调用了对象的 Pod 资源所在的工作节点，且只能由节点将其存储于内存中。另外，Secret 对象的数据的存储及打印格式为 Base64 编码的字符串，因此用户创建 Secret 对象时也要提供此编码格式的数据。在容器中以环境变量或存储卷的方式访问时，它们会被自动解码为明文格式。

  需要注意的是，在 Master 节点上，Secret 对象以非加密的格式存储于 etcd 中，因此管理员必须加以精心管控以确保敏感数据的机密性，必须确保 etcd 集群节点间以及与 API Server 的安全通信，etcd 服务的访问授权，还包括用户访问 API Server 时的授权，因为拥有创建 Pod 资源的用户都可以使用 Secret 资源并能够通过 Pod 的容器访问其数据。

  secret 字段定义如下：

[root@mh-k8s-master-247-10 ~]# kubectl explain secret
KIND:     Secret
VERSION:  v1

DESCRIPTION:
     Secret holds secret data of a certain type. The total bytes of the values
     in the Data field must be less than MaxSecretSize bytes.

FIELDS:
   apiVersion	<string>
     APIVersion defines the versioned schema of this representation of an
     object. Servers should convert recognized schemas to the latest internal
     value, and may reject unrecognized values. More info:
     https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources

   data	<map[string]string>
     Data contains the secret data. Each key must consist of alphanumeric
     characters, '-', '_' or '.'. The serialized form of the secret data is a
     base64 encoded string, representing the arbitrary (possibly non-string)
     data value here. Described in https://tools.ietf.org/html/rfc4648#section-4

   immutable	<boolean>
     Immutable, if set to true, ensures that data stored in the Secret cannot be
     updated (only object metadata can be modified). If not set to true, the
     field can be modified at any time. Defaulted to nil. This is an alpha field
     enabled by ImmutableEphemeralVolumes feature gate.

   kind	<string>
     Kind is a string value representing the REST resource this object
     represents. Servers may infer this from the endpoint the client submits
     requests to. Cannot be updated. In CamelCase. More info:
     https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

   metadata	<Object>
     Standard object's metadata. More info:
     https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

   stringData	<map[string]string>
     stringData allows specifying non-binary secret data in string form. It is
     provided as a write-only convenience method. All keys and values are merged
     into the data field on write, overwriting any existing values. It is never
     output when reading from the API.

   type	<string>
     Used to facilitate programmatic handling of secret data.

[root@mh-k8s-master-247-10 ~]# 

标签：存储,Kubernetes,secret,Secret,values,k8s,data,资源
来源： https://www.cnblogs.com/zuoyang/p/16412358.html