|
| 1 | +--- |
| 2 | +title: 使用 Kustomize 管理 Secret |
| 3 | +content_type: task |
| 4 | +weight: 30 |
| 5 | +description: 使用 kustomization.yaml 文件创建 Secret 对象。 |
| 6 | +--- |
| 7 | +<!-- |
| 8 | +title: Managing Secret using Kustomize |
| 9 | +content_type: task |
| 10 | +weight: 30 |
| 11 | +description: Creating Secret objects using kustomization.yaml file. |
| 12 | +--> |
| 13 | + |
| 14 | +<!-- overview --> |
| 15 | + |
| 16 | +<!-- |
| 17 | +Since Kubernetes v1.14, `kubectl` supports |
| 18 | +[managing objects using Kustomize](/docs/tasks/manage-kubernetes-objects/kustomization/). |
| 19 | +Kustomize provides resource Generators to create Secrets and ConfigMaps. The |
| 20 | +Kustomize generators should be specified in a `kustomization.yaml` file inside |
| 21 | +a directory. After generating the Secret, you can create the Secret on the API |
| 22 | +server with `kubectl apply`. |
| 23 | +--> |
| 24 | +从 kubernetes v1.14 开始，`kubectl` 支持[使用 Kustomize 管理对象](/zh/docs/tasks/manage-kubernetes-objects/kustomization/)。 |
| 25 | +Kustomize 提供了资源生成器（Generators）来创建 Secret 和 ConfigMap。 |
| 26 | +Kustomize 生成器应该在某个目录的 `kustomization.yaml` 文件中指定。 |
| 27 | +生成 Secret 后，你可以使用 `kubectl apply` 在 API 服务器上创建该 Secret。 |
| 28 | +## {{% heading "prerequisites" %}} |
| 29 | + |
| 30 | +{{< include "task-tutorial-prereqs.md" >}} |
| 31 | + |
| 32 | +<!-- steps --> |
| 33 | + |
| 34 | +<!-- ## Create the Kustomization file --> |
| 35 | +## 创建 Kustomization 文件 {#create-the-kustomization-file} |
| 36 | + |
| 37 | +<!-- |
| 38 | +You can generate a Secret by defining a `secretGenerator` in a |
| 39 | +`kustomization.yaml` file that references other existing files. |
| 40 | +For example, the following kustomization file references the |
| 41 | +`./username.txt` and the `./password.txt` files: |
| 42 | +--> |
| 43 | +你可以在 `kustomization.yaml` 中定义 `secreteGenerator`，并在定义中引用其他现成的文件，生成 Secret。 |
| 44 | +例如：下面的 kustomization 文件 引用了 `./username.txt` 和 `./password.txt` 文件： |
| 45 | + |
| 46 | +```yaml |
| 47 | +secretGenerator: |
| 48 | +- name: db-user-pass |
| 49 | + files: |
| 50 | + - username.txt |
| 51 | + - password.txt |
| 52 | +``` |
| 53 | +
|
| 54 | +<!-- |
| 55 | +You can also define the `secretGenerator` in the `kustomization.yaml` |
| 56 | +file by providing some literals. |
| 57 | +For example, the following `kustomization.yaml` file contains two literals |
| 58 | +for `username` and `password` respectively: |
| 59 | +--> |
| 60 | +你也可以在 `kustomization.yaml` 文件中指定一些字面量定义 `secretGenerator`。 |
| 61 | +例如：下面的 `kustomization.yaml` 文件中包含了 `username` 和 `password` 两个字面量： |
| 62 | + |
| 63 | +```yaml |
| 64 | +secretGenerator: |
| 65 | +- name: db-user-pass |
| 66 | + literals: |
| 67 | + - username=admin |
| 68 | + - password=1f2d1e2e67df |
| 69 | +``` |
| 70 | + |
| 71 | +<!-- Note that in both cases, you don't need to base64 encode the values. --> |
| 72 | +注意，上面两种情况，你都不需要使用 base64 编码。 |
| 73 | + |
| 74 | +<!-- ## Create the Secret --> |
| 75 | +## 创建 Secret {#create-the-secret} |
| 76 | + |
| 77 | +<!-- Apply the directory containing the `kustomization.yaml` to create the Secret. --> |
| 78 | +使用 `kubectl apply` 命令应用包含 `kustomization.yaml` 文件的目录创建 Secret。 |
| 79 | + |
| 80 | +```shell |
| 81 | +kubectl apply -k . |
| 82 | +``` |
| 83 | + |
| 84 | +<!-- The output is similar to: --> |
| 85 | +输出类似于： |
| 86 | + |
| 87 | +``` |
| 88 | +secret/db-user-pass-96mffmfh4k created |
| 89 | +``` |
| 90 | +
|
| 91 | +<!-- |
| 92 | +Note that when a Secret is generated, the Secret name is created by hashing |
| 93 | +the Secret data and appending the hash value to the name. This ensures that |
| 94 | +a new Secret is generated each time the data is modified. |
| 95 | +--> |
| 96 | +请注意，生成 Secret 时，Secret 的名称最终是由 `name` 字段和数据的哈希值拼接而成。 |
| 97 | +
|
| 98 | +<!-- ## Check the Secret created --> |
| 99 | +## 检查创建的 Secret {#check-the-secret-created} |
| 100 | +
|
| 101 | +<!-- You can check that the secret was created: --> |
| 102 | +你可以检查刚才创建的 Secret： |
| 103 | +
|
| 104 | +```shell |
| 105 | +kubectl get secrets |
| 106 | +``` |
| 107 | + |
| 108 | +<!-- The output is similar to: --> |
| 109 | +输出类似于： |
| 110 | + |
| 111 | +``` |
| 112 | +NAME TYPE DATA AGE |
| 113 | +db-user-pass-96mffmfh4k Opaque 2 51s |
| 114 | +``` |
| 115 | + |
| 116 | +<!-- You can view a description of the secret: --> |
| 117 | +你可以看到 Secret 的描述： |
| 118 | + |
| 119 | +```shell |
| 120 | +kubectl describe secrets/db-user-pass-96mffmfh4k |
| 121 | +``` |
| 122 | + |
| 123 | +<!-- The output is similar to: --> |
| 124 | +输出类似于： |
| 125 | + |
| 126 | +``` |
| 127 | +Name: db-user-pass |
| 128 | +Namespace: default |
| 129 | +Labels: <none> |
| 130 | +Annotations: <none> |
| 131 | +
|
| 132 | +Type: Opaque |
| 133 | +
|
| 134 | +Data |
| 135 | +==== |
| 136 | +password.txt: 12 bytes |
| 137 | +username.txt: 5 bytes |
| 138 | +``` |
| 139 | + |
| 140 | +<!-- |
| 141 | +The commands `kubectl get` and `kubectl describe` avoid showing the contents of a `Secret` by |
| 142 | +default. This is to protect the `Secret` from being exposed accidentally to an onlooker, |
| 143 | +or from being stored in a terminal log. |
| 144 | +To check the actual content of the encoded data, please refer to |
| 145 | +[decoding secret](/docs/tasks/configmap-secret/managing-secret-using-kubectl/#decoding-secret). |
| 146 | +--> |
| 147 | +`kubectl get` 和 `kubectl describe` 命令默认不显示 `Secret` 的内容。 |
| 148 | +这是为了防止 `Secret` 被意外暴露给旁观者或存储在终端日志中。 |
| 149 | +检查编码后的实际内容，请参考[解码 secret](/zh/docs/tasks/configmap-secret/managing-secret-using-kubectl/#decoding-secret)。 |
| 150 | +--> |
| 151 | + |
| 152 | + |
| 153 | +<!-- ## Clean Up --> |
| 154 | +## 清理 {#clean-up} |
| 155 | + |
| 156 | +<!-- To delete the Secret you have just created: --> |
| 157 | +删除你刚才创建的 Secret： |
| 158 | + |
| 159 | +```shell |
| 160 | +kubectl delete secret db-user-pass-96mffmfh4k |
| 161 | +``` |
| 162 | + |
| 163 | +<!-- Optional section; add links to information related to this topic. --> |
| 164 | +## {{% heading "whatsnext" %}} |
| 165 | + |
| 166 | +<!-- |
| 167 | +- Read more about the [Secret concept](/docs/concepts/configuration/secret/) |
| 168 | +- Learn how to [manage Secret with the `kubectl` command](/docs/tasks/configmap-secret/managing-secret-using-kubectl/) |
| 169 | +- Learn how to [manage Secret using config file](/docs/tasks/configmap-secret/managing-secret-using-config-file/) |
| 170 | +--> |
| 171 | +- 进一步阅读 [Secret 概念](/zh/docs/concepts/configuration/secret/) |
| 172 | +- 了解如何[使用 `kubectl` 命令管理 Secret](/zh/docs/tasks/configmap-secret/managing-secret-using-kubectl/) |
| 173 | +- 了解如何[使用配置文件管理 Secret](/zh/docs/tasks/configmap-secret/managing-secret-using-config-file/) |
0 commit comments