Skip to content

Commit e763156

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #37611 from windsonsea/msuk
[zh] sync managing-secret-using-kustomize.md
2 parents a3f3da0 + 75aa9b5 commit e763156

File tree

1 file changed

+120
-102
lines changed

1 file changed

+120
-102
lines changed

‎content/zh-cn/docs/tasks/configmap-secret/managing-secret-using-kustomize.md

Lines changed: 120 additions & 102 deletions
Original file line numberDiff line numberDiff line change
@@ -14,165 +14,183 @@ description: Creating Secret objects using kustomization.yaml file.
1414
<!-- overview -->
1515

1616
<!--
17-
Since Kubernetes v1.14, `kubectl` supports
18-
[managing objects using Kustomize](/docs/tasks/manage-kubernetes-objects/kustomization/).
19-
Kustomize provides resource Generators to create Secrets and ConfigMaps. The
20-
Kustomize generators should be specified in a `kustomization.yaml` file inside
21-
a directory. After generating the Secret, you can create the Secret on the API
22-
server with `kubectl apply`.
17+
`kubectl` supports using the [Kustomize object management tool](/docs/tasks/manage-kubernetes-objects/kustomization/) to manage Secrets
18+
and ConfigMaps. You create a *resource generator* using Kustomize, which
19+
generates a Secret that you can apply to the API server using `kubectl`.
2320
-->
24-
从 kubernetes v1.14 开始，`kubectl` 支持[使用 Kustomize 管理对象](/zh-cn/docs/tasks/manage-kubernetes-objects/kustomization/)。
25-
Kustomize 提供了资源生成器（Generators）来创建 Secret 和 ConfigMap。
26-
Kustomize 生成器应该在某个目录的 `kustomization.yaml` 文件中指定。
27-
生成 Secret 后，你可以使用 `kubectl apply` 在 API 服务器上创建该 Secret。
21+
`kubectl` 支持使用 [Kustomize 对象管理工具](/zh-cn/docs/tasks/manage-kubernetes-objects/kustomization/)来管理
22+
Secret 和 ConfigMap。你可以使用 Kustomize 创建**资源生成器（Resource Generator）**，
23+
该生成器会生成一个 Secret，让你能够通过 `kubectl` 应用到 API 服务器。
24+
2825
## {{% heading "prerequisites" %}}
2926

3027
{{< include "task-tutorial-prereqs.md" >}}
3128

3229
<!-- steps -->
3330

34-
<!-- ## Create the Kustomization file -->
35-
## 创建 Kustomization 文件 {#create-the-kustomization-file}
31+
<!--
32+
## Create a Secret
3633
37-
<!--
3834
You can generate a Secret by defining a `secretGenerator` in a
39-
`kustomization.yaml` file that references other existing files.
40-
For example, the following kustomization file references the
41-
`./username.txt` and the `./password.txt` files:
35+
`kustomization.yaml` file that references other existing files, `.env` files, or
36+
literal values. For example, the following instructions create a Kustomization
37+
file for the username `admin` and the password `1f2d1e2e67df`.
38+
39+
### Create the Kustomization file
4240
-->
43-
你可以在 `kustomization.yaml` 中定义 `secreteGenerator` 字段，并在定义中引用其它本地文件生成 Secret。
44-
例如：下面的 kustomization 文件 引用了 `./username.txt` 和 `./password.txt` 文件：
41+
## 创建 Secret {#create-a-secret}
4542

46-
```yaml
47-
secretGenerator:
48-
- name: db-user-pass
49-
files:
50-
- username.txt
51-
- password.txt
52-
```
43+
你可以在 `kustomization.yaml` 文件中定义 `secreteGenerator` 字段，
44+
并在定义中引用其它本地文件、`.env` 文件或文字值生成 Secret。
45+
例如：下面的指令为用户名 `admin` 和密码 `1f2d1e2e67df` 创建 Kustomization 文件。
5346

54-
<!--
55-
You can also define the `secretGenerator` in the `kustomization.yaml`
56-
file by providing some literals.
57-
For example, the following `kustomization.yaml` file contains two literals
58-
for `username` and `password` respectively:
59-
-->
60-
你也可以在 `kustomization.yaml` 文件中指定一些字面量定义 `secretGenerator` 字段。
61-
例如：下面的 `kustomization.yaml` 文件中包含了 `username` 和 `password` 两个字面量：
47+
### 创建 Kustomization 文件 {#create-the-kustomization-file}
6248

63-
```yaml
49+
{{< tabs name="Secret data" >}}
50+
{{< tab name="文字" codelang="yaml" >}}
6451
secretGenerator:
65-
- name: db-user-pass
52+
- name: database-creds
6653
literals:
6754
- username=admin
6855
- password=1f2d1e2e67df
69-
```
56+
{{< /tab >}}
57+
{{% tab name="文件" %}}
58+
59+
<!--
60+
1. Store the credentials in files with the values encoded in base64:
61+
-->
62+
1. 用 base64 编码的值存储凭据到文件中：
63+
64+
```shell
65+
echo -n 'admin' > ./username.txt
66+
echo -n '1f2d1e2e67df' > ./password.txt
67+
```
68+
69+
<!--
70+
The `-n` flag ensures that there's no newline character at the end of your
71+
files.
72+
-->
73+
74+
`-n` 标志确保文件结尾处没有换行符。
7075

76+
<!--
77+
1. Create the `kustomization.yaml` file:
78+
-->
79+
2. 创建 `kustomization.yaml` 文件：
80+
81+
```yaml
82+
secretGenerator:
83+
- name: database-creds
84+
files:
85+
- username.txt
86+
- password.txt
87+
```
88+
89+
{{% /tab %}}}
90+
{{% tab name=".env 文件" %}}
7191
<!--
72-
You can also define the `secretGenerator` in the `kustomization.yaml`
73-
file by providing `.env` files.
74-
For example, the following `kustomization.yaml` file pulls in data from
75-
`.env.secret` file:
92+
You can also define the secretGenerator in the `kustomization.yaml` file by
93+
providing `.env` files.
94+
For example, the following `kustomization.yaml` file
95+
pulls in data from an `.env.secret` file:
7696
-->
7797
你也可以使用 `.env` 文件在 `kustomization.yaml` 中定义 `secretGenerator`。
78-
例如：下面的 `kustomization.yaml` 文件从 `.env.secret` 文件获取数据。
98+
例如下面的 `kustomization.yaml` 文件从 `.env.secret` 文件获取数据：
7999

80100
```yaml
81101
secretGenerator:
82102
- name: db-user-pass
83103
envs:
84104
- .env.secret
85105
```
106+
{{% /tab %}}
107+
{{< /tabs >}}
86108

87109
<!--
88-
Note that in all cases, you don't need to base64 encode the values.
110+
In all cases, you don't need to base64 encode the values. The name of the YAML
111+
file **must** be `kustomization.yaml` or `kustomization.yml`.
89112
-->
90-
注意，上面两种情况，你都不需要使用 base64 编码。
113+
在所有情况下，你都不需要对取值作 base64 编码。
114+
YAML 文件的名称**必须**是 `kustomization.yaml` 或 `kustomization.yml`。
115+
116+
<!--
117+
### Apply the kustomization file
91118

92-
<!-- ## Create the Secret -->
93-
## 创建 Secret {#create-the-secret}
119+
To create the Secret, apply the directory that contains the kustomization file:
120+
-->
121+
### 应用 kustomization 文件 {#apply-the-kustomization-file}
94122

95-
<!-- Apply the directory containing the `kustomization.yaml` to create the Secret. -->
96-
在包含 `kustomization.yaml` 文件的目录下使用 `kubectl apply` 命令创建 Secret。
123+
若要创建 Secret，应用包含 kustomization 文件的目录。
97124

98125
```shell
99-
kubectl apply -k .
126+
kubectl apply -k <目录路径>
100127
```
101128

102-
<!-- The output is similar to: -->
129+
<!--
130+
The output is similar to:
131+
-->
103132
输出类似于：
104133

105134
```
106-
secret/db-user-pass-96mffmfh4k created
135+
secret/database-creds-5hdh7hhgfk created
107136
```
108137
109-
<!--
110-
Note that when a Secret is generated, the Secret name is created by hashing
138+
<!--
139+
When a Secret is generated, the Secret name is created by hashing
111140
the Secret data and appending the hash value to the name. This ensures that
112-
a new Secret is generated each time the data is modified.
141+
a new Secret is generated each time the data is modified.
142+
143+
To verify that the Secret was created and to decode the Secret data, refer to
144+
[Managing Secrets using
145+
kubectl](/docs/tasks/configmap-secret/managing-secret-using-kubectl/#verify-the-secret).
113146
-->
114-
请注意，生成 Secret 时，Secret 的名称最终是由 `name` 字段和数据的哈希值拼接而成。
147+
生成 Secret 时，Secret 的名称最终是由 `name` 字段和数据的哈希值拼接而成。
115148
这将保证每次修改数据时生成一个新的 Secret。
116149
117-
<!-- ## Check the Secret created -->
118-
## 检查创建的 Secret {#check-the-secret-created}
119-
120-
<!-- You can check that the secret was created: -->
121-
你可以检查刚才创建的 Secret：
122-
123-
```shell
124-
kubectl get secrets
125-
```
126-
127-
<!-- The output is similar to: -->
128-
输出类似于：
150+
要验证 Secret 是否已创建并解码 Secret 数据，
151+
请参阅[使用 kubectl 管理 Secret](/zh-cn/docs/tasks/configmap-secret/managing-secret-using-kubectl/#verify-the-secret)。
129152
130-
```
131-
NAME TYPE DATA AGE
132-
db-user-pass-96mffmfh4k Opaque 2 51s
133-
```
153+
<!--
154+
## Edit a Secret {#edit-secret}
134155
135-
<!-- You can view a description of the secret: -->
136-
你可以看到 Secret 的描述：
156+
1. In your `kustomization.yaml` file, modify the data, such as the `password`.
157+
1. Apply the directory that contains the kustomization file:
158+
-->
159+
## 编辑 Secret {#edit-secret}
137160
138-
```shell
139-
kubectl describe secrets/db-user-pass-96mffmfh4k
140-
```
161+
1. 在 `kustomization.yaml` 文件中，修改诸如 `password` 等数据。
162+
1. 应用包含 kustomization 文件的目录：
141163
142-
<!-- The output is similar to: -->
143-
输出类似于：
164+
```shell
165+
kubectl apply -k <directory-path>
166+
```
144167

145-
```
146-
Name: db-user-pass-96mffmfh4k
147-
Namespace: default
148-
Labels: <none>
149-
Annotations: <none>
168+
<!--
169+
The output is similar to:
170+
-->
150171

151-
Type: Opaque
172+
输出类似于：
152173

153-
Data
154-
====
155-
password.txt: 12 bytes
156-
username.txt: 5 bytes
157-
```
174+
```
175+
secret/db-user-pass-6f24b56cc8 created
176+
```
158177

159-
<!--
160-
The commands `kubectl get` and `kubectl describe` avoid showing the contents of a `Secret` by
161-
default. This is to protect the `Secret` from being exposed accidentally to an onlooker,
162-
or from being stored in a terminal log.
163-
To check the actual content of the encoded data, please refer to
164-
[decoding secret](/docs/tasks/configmap-secret/managing-secret-using-kubectl/#decoding-secret).
178+
<!--
179+
The edited Secret is created as a new `Secret` object, instead of updating the
180+
existing `Secret` object. You might need to update references to the Secret in
181+
your Pods.
165182
-->
166-
`kubectl get` 和 `kubectl describe` 命令默认不显示 `Secret` 的内容。
167-
这是为了防止 `Secret` 被意外暴露给旁观者或存储在终端日志中。
168-
检查编码后的实际内容，请参考[解码 secret](/zh-cn/docs/tasks/configmap-secret/managing-secret-using-kubectl/#decoding-secret)。
183+
编辑过的 Secret 被创建为一个新的 `Secret` 对象，而不是更新现有的 `Secret` 对象。
184+
你可能需要在 Pod 中更新对该 Secret 的引用。
169185

186+
<!--
187+
## Clean up
170188
171-
<!-- ## Clean Up -->
172-
## 清理 {#clean-up}
189+
To delete a Secret, use `kubectl`:
190+
-->
191+
## 清理 {#clean-up}
173192

174-
<!-- To delete the Secret you have created: -->
175-
删除你创建的 Secret：
193+
要删除 Secret，请使用 `kubectl`：
176194

177195
```shell
178196
kubectl delete secret db-user-pass-96mffmfh4k
@@ -184,7 +202,7 @@ kubectl delete secret db-user-pass-96mffmfh4k
184202
<!--
185203
- Read more about the [Secret concept](/docs/concepts/configuration/secret/)
186204
- Learn how to [manage Secrets with the `kubectl` command](/docs/tasks/configmap-secret/managing-secret-using-kubectl/)
187-
- Learn how to [manage Secrets using config file](/docs/tasks/configmap-secret/managing-secret-using-config-file/)
205+
- Learn how to [manage Secrets using config file](/docs/tasks/configmap-secret/managing-secret-using-config-file/)
188206
-->
189207
- 进一步阅读 [Secret 概念](/zh-cn/docs/concepts/configuration/secret/)
190208
- 了解如何[使用 `kubectl` 命令管理 Secret](/zh-cn/docs/tasks/configmap-secret/managing-secret-using-kubectl/)

0 commit comments

Comments
 (0)