You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
As an administrator, you can create a basic authentication secret, which allows you to store the credentials needed for basic authentication. When using this secret type, the `data` parameter of the `Secret` object must contain the following keys encoded in the base64 format:
10
+
11
+
* `username`: the user name for authentication
12
+
* `password`: the password or token for authentication
13
+
14
+
[NOTE]
15
+
====
16
+
You can use the `stringData` parameter to use clear text content.
17
+
====
18
+
19
+
.Procedure
20
+
21
+
. Create a `Secret` object in a YAML file on a control plane node:
22
+
+
23
+
.Example `secret` object
24
+
[source,yaml]
25
+
----
26
+
apiVersion: v1
27
+
kind: Secret
28
+
metadata:
29
+
name: secret-basic-auth
30
+
type: kubernetes.io/basic-auth <1>
31
+
data:
32
+
stringData: <2>
33
+
username: admin
34
+
password: t0p-Secret
35
+
----
36
+
<1> Specifies a basic authentication secret.
37
+
<2> Specifies the basic authentication values to use.
38
+
39
+
. Use the following command to create the `Secret` object:
40
+
+
41
+
[source,terminal]
42
+
----
43
+
$ oc create -f <filename>.yaml
44
+
----
45
+
46
+
. To use the secret in a pod:
47
+
48
+
.. Update the pod's service account to reference the secret, as shown in the "Understanding how to create secrets" section.
49
+
50
+
.. Create the pod, which consumes the secret as an environment variable or as a file (using a `secret` volume), as shown in the "Understanding how to create secrets" section.
As an administrator, you can create a Docker configuration secret, which allows you to store the credentials for accessing a container image registry.
10
+
11
+
* `kubernetes.io/dockercfg`. Use this secret type to store your local Docker configuration file. The `data` parameter of the `secret` object must contain the contents of a `.dockercfg` file encoded in the base64 format.
12
+
13
+
* `kubernetes.io/dockerconfigjson`. Use this secret type to store your local Docker configuration JSON file. The `data` parameter of the `secret` object must contain the contents of a `.docker/config.json` file encoded in the base64 format.
14
+
15
+
.Procedure
16
+
17
+
. Create a `Secret` object in a YAML file on a control plane node.
<1> Specifies that the secret is using a Docker configuration JSONfile.
50
+
<2> The output of a base64-encoded Docker configuration JSON file
51
+
--
52
+
53
+
. Use the following command to create the `Secret` object
54
+
+
55
+
[source,terminal]
56
+
----
57
+
$ oc create -f <filename>.yaml
58
+
----
59
+
60
+
. To use the secret in a pod:
61
+
62
+
.. Update the pod's service account to reference the secret, as shown in the "Understanding how to create secrets" section.
63
+
64
+
.. Create the pod, which consumes the secret as an environment variable or as a file (using a `secret` volume), as shown in the "Understanding how to create secrets" section.
As an administrator, you can create an opaque secret, which allows for unstructured `key:value` pairs that can contain arbitrary values.
9
+
As an administrator, you can create an opaque secret, which allows you to store unstructured `key:value` pairs that can contain arbitrary values.
10
10
11
11
.Procedure
12
12
13
-
. Create a `Secret` object in a YAML file on master.
13
+
. Create a `Secret` object in a YAML file on a control plane node.
14
14
+
15
15
For example:
16
16
+
@@ -31,12 +31,11 @@ data:
31
31
+
32
32
[source,terminal]
33
33
----
34
-
$ oc create -f <filename>
34
+
$ oc create -f <filename>.yaml
35
35
----
36
36
37
37
. To use the secret in a pod:
38
38
39
-
.. Update the service account for the pod where you want to use the secret to allow the reference to the secret.
39
+
.. Update the pod's service account to reference the secret, as shown in the "Understanding how to create secrets" section.
40
40
41
-
.. Create the pod, which consumes the secret as an environment variable or as a file
42
-
(using a `secret` volume).
41
+
.. Create the pod, which consumes the secret as an environment variable or as a file (using a `secret` volume), as shown in the "Understanding how to create secrets" section.
As an administrator, you can create a service account token secret, which allows you to distribute a service account token to applications that must authenticate to the API.
10
+
11
+
[NOTE]
12
+
====
13
+
It is recommended to obtain bound service account tokens using the TokenRequest API instead of using service account token secrets. The tokens obtained from the TokenRequest API are more secure than the tokens stored in secrets, because they have a bounded lifetime and are not readable by other API clients.
14
+
15
+
You should create a service account token secret only if you cannot use the TokenRequest API and if the security exposure of a non-expiring token in a readable API object is acceptable to you.
16
+
17
+
See the Additional references section that follows for information on creating bound service account tokens.
18
+
====
19
+
20
+
.Procedure
21
+
22
+
. Create a `Secret` object in a YAML file on a control plane node:
23
+
+
24
+
.Example `secret` object:
25
+
[source,yaml]
26
+
----
27
+
apiVersion: v1
28
+
kind: Secret
29
+
metadata:
30
+
name: secret-sa-sample
31
+
annotations:
32
+
kubernetes.io/service-account.name: "sa-name" <1>
33
+
type: kubernetes.io/service-account-token <2>
34
+
----
35
+
<1> Specifies an existing service account name. If you are creating both the `ServiceAccount` and the `Secret` objects, create the `ServiceAccount` object first.
36
+
<2> Specifies a service account token secret.
37
+
38
+
. Use the following command to create the `Secret` object:
39
+
+
40
+
[source,terminal]
41
+
----
42
+
$ oc create -f <filename>.yaml
43
+
----
44
+
45
+
. To use the secret in a pod:
46
+
47
+
.. Update the pod's service account to reference the secret, as shown in the "Understanding how to create secrets" section.
48
+
49
+
.. Create the pod, which consumes the secret as an environment variable or as a file (using a `secret` volume), as shown in the "Understanding how to create secrets" section.
As an administrator, you can create an SSH authentication secret, which allows you to store data used for SSH authentication. When using this secret type, the `data` parameter of the `Secret` object must contain the SSH credential to use.
10
+
11
+
.Procedure
12
+
13
+
. Create a `Secret` object in a YAML file on a control plane node:
14
+
+
15
+
.Example `secret` object:
16
+
[source,yaml]
17
+
----
18
+
apiVersion: v1
19
+
kind: Secret
20
+
metadata:
21
+
name: secret-ssh-auth
22
+
type: kubernetes.io/ssh-auth <1>
23
+
data:
24
+
ssh-privatekey: | <2>
25
+
MIIEpQIBAAKCAQEAulqb/Y ...
26
+
----
27
+
<1> Specifies an SSH authentication secret.
28
+
<2> Specifies the SSH key/value pair as the SSH credentials to use.
29
+
30
+
. Use the following command to create the `Secret` object:
31
+
+
32
+
[source,terminal]
33
+
----
34
+
$ oc create -f <filename>.yaml
35
+
----
36
+
37
+
. To use the secret in a pod:
38
+
39
+
.. Update the pod's service account to reference the secret, as shown in the "Understanding how to create secrets" section.
40
+
41
+
.. Create the pod, which consumes the secret as an environment variable or as a file (using a `secret` volume), as shown in the "Understanding how to create secrets" section.
As an administrator, you can create a Transport Layer Security (TLS) secret, which allows you to store a certificate and its associated key that are typically used for TLS. When using this type of secret, the `data` parameter of the `Secret` object must contain the `tls.key` and the `tls.crt` keys to use. The API server does not validate the values for each key.
10
+
11
+
One common use for TLS secrets is to configure encryption in transit for ingress. You can also use a TLS secret with other resources or directly in your workload.
12
+
13
+
[NOTE]
14
+
====
15
+
You can use the `stringData` parameter to use clear text content.
16
+
====
17
+
18
+
.Procedure
19
+
20
+
. Create a `Secret` object in a YAML file on a control plane node:
21
+
+
22
+
.Example `secret` object:
23
+
[source,yaml]
24
+
----
25
+
apiVersion: v1
26
+
kind: Secret
27
+
metadata:
28
+
name: secret-tls
29
+
type: kubernetes.io/tls <1>
30
+
data:
31
+
tls.crt: | <2>
32
+
MIIC2DCCAcCgAwIBAgIBATANBgkqh ...
33
+
tls.key: |
34
+
MIIEpgIBAAKCAQEA7yn3bRHQ5FHMQ ...
35
+
36
+
----
37
+
<1> Specifies a TLS secret.
38
+
<2> Specifies the `tls.key` and the `tls.crt` keys to use.
39
+
40
+
. Use the following command to create the `Secret` object:
41
+
+
42
+
[source,terminal]
43
+
----
44
+
$ oc create -f <filename>.yaml
45
+
----
46
+
47
+
. To use the secret in a pod:
48
+
49
+
.. Update the pod's service account to reference the secret, as shown in the "Understanding how to create secrets" section.
50
+
51
+
.. Create the pod, which consumes the secret as an environment variable or as a file (using a `secret` volume), as shown in the "Understanding how to create secrets" section.
0 commit comments