Skip to content

Commit b378fde

Browse files
mburke5678mburke5678
authored
Merge pull request #46908 from mburke5678/BZ-2093995-bugfix
BZ-2093995: Add content of creating type: kubernetes.io/service-account-token secret
2 parents f6da068 + 68ddd41 commit b378fde

9 files changed

+410
-103
lines changed

‎modules/nodes-pods-secrets-about.adoc

Lines changed: 0 additions & 93 deletions
Original file line numberDiff line numberDiff line change
@@ -81,99 +81,6 @@ but indicate that the creator of the secret intended to conform to the key/value
8181

8282
For examples of different secret types, see the code samples in _Using Secrets_.
8383

84-
[id="nodes-pods-secrets-about-examples_{context}"]
85-
== Example secret configurations
86-
87-
The following are sample secret configuration files.
88-
89-
.YAML `Secret` object that creates four files
90-
91-
[source,yaml]
92-
----
93-
apiVersion: v1
94-
kind: Secret
95-
metadata:
96-
name: test-secret
97-
data:
98-
username: dmFsdWUtMQ0K <1>
99-
password: dmFsdWUtMQ0KDQo= <2>
100-
stringData:
101-
hostname: myapp.mydomain.com <3>
102-
secret.properties: |- <4>
103-
property1=valueA
104-
property2=valueB
105-
----
106-
<1> File contains decoded values.
107-
<2> File contains decoded values.
108-
<3> File contains the provided string.
109-
<4> File contains the provided data.
110-
111-
.YAML of a pod populating files in a volume with secret data
112-
113-
[source,yaml]
114-
----
115-
apiVersion: v1
116-
kind: Pod
117-
metadata:
118-
name: secret-example-pod
119-
spec:
120-
containers:
121-
- name: secret-test-container
122-
image: busybox
123-
command: [ "/bin/sh", "-c", "cat /etc/secret-volume/*" ]
124-
volumeMounts:
125-
# name must match the volume name below
126-
- name: secret-volume
127-
mountPath: /etc/secret-volume
128-
readOnly: true
129-
volumes:
130-
- name: secret-volume
131-
secret:
132-
secretName: test-secret
133-
restartPolicy: Never
134-
----
135-
136-
.YAML of a pod populating environment variables with secret data
137-
138-
[source,yaml]
139-
----
140-
apiVersion: v1
141-
kind: Pod
142-
metadata:
143-
name: secret-example-pod
144-
spec:
145-
containers:
146-
- name: secret-test-container
147-
image: busybox
148-
command: [ "/bin/sh", "-c", "export" ]
149-
env:
150-
- name: TEST_SECRET_USERNAME_ENV_VAR
151-
valueFrom:
152-
secretKeyRef:
153-
name: test-secret
154-
key: username
155-
restartPolicy: Never
156-
----
157-
158-
.YAML of a build config populating environment variables with secret data
159-
160-
[source,yaml]
161-
----
162-
apiVersion: build.openshift.io/v1
163-
kind: BuildConfig
164-
metadata:
165-
name: secret-example-bc
166-
spec:
167-
strategy:
168-
sourceStrategy:
169-
env:
170-
- name: TEST_SECRET_USERNAME_ENV_VAR
171-
valueFrom:
172-
secretKeyRef:
173-
name: test-secret
174-
key: username
175-
----
176-
17784
[id="nodes-pods-secrets-about-keys_{context}"]
17885
== Secret data keys
17986

‎modules/nodes-pods-secrets-creating-basic.adoc

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * nodes/nodes-pods-secrets.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="nodes-pods-secrets-creating-basic_{context}"]
7+
= Creating a basic authentication secret
8+
9+
As an administrator, you can create a basic authentication secret, which allows you to store the credentials needed for basic authentication. When using this secret type, the `data` parameter of the `Secret` object must contain the following keys encoded in the base64 format:
10+
11+
* `username`: the user name for authentication
12+
* `password`: the password or token for authentication
13+
14+
[NOTE]
15+
====
16+
You can use the `stringData` parameter to use clear text content.
17+
====
18+
19+
.Procedure
20+
21+
. Create a `Secret` object in a YAML file on a control plane node:
22+
+
23+
.Example `secret` object
24+
[source,yaml]
25+
----
26+
apiVersion: v1
27+
kind: Secret
28+
metadata:
29+
name: secret-basic-auth
30+
type: kubernetes.io/basic-auth <1>
31+
data:
32+
stringData: <2>
33+
username: admin
34+
password: t0p-Secret
35+
----
36+
<1> Specifies a basic authentication secret.
37+
<2> Specifies the basic authentication values to use.
38+
39+
. Use the following command to create the `Secret` object:
40+
+
41+
[source,terminal]
42+
----
43+
$ oc create -f <filename>.yaml
44+
----
45+
46+
. To use the secret in a pod:
47+
48+
.. Update the pod's service account to reference the secret, as shown in the "Understanding how to create secrets" section.
49+
50+
.. Create the pod, which consumes the secret as an environment variable or as a file (using a `secret` volume), as shown in the "Understanding how to create secrets" section.

‎modules/nodes-pods-secrets-creating-docker.adoc

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * nodes/nodes-pods-secrets.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="nodes-pods-secrets-creating-docker_{context}"]
7+
= Creating a Docker configuration secret
8+
9+
As an administrator, you can create a Docker configuration secret, which allows you to store the credentials for accessing a container image registry.
10+
11+
* `kubernetes.io/dockercfg`. Use this secret type to store your local Docker configuration file. The `data` parameter of the `secret` object must contain the contents of a `.dockercfg` file encoded in the base64 format.
12+
13+
* `kubernetes.io/dockerconfigjson`. Use this secret type to store your local Docker configuration JSON file. The `data` parameter of the `secret` object must contain the contents of a `.docker/config.json` file encoded in the base64 format.
14+
15+
.Procedure
16+
17+
. Create a `Secret` object in a YAML file on a control plane node.
18+
+
19+
--
20+
.Example Docker configuration `secret` object
21+
[source,yaml]
22+
----
23+
apiVersion: v1
24+
kind: Secret
25+
metadata:
26+
name: secret-docker-cfg
27+
namespace: my-project
28+
type: kubernetes.io/dockerconfig <1>
29+
data:
30+
.dockerconfig:bm5ubm5ubm5ubm5ubm5ubm5ubm5ubmdnZ2dnZ2dnZ2dnZ2dnZ2dnZ2cgYXV0aCBrZXlzCg== <2>
31+
----
32+
<1> Specifies that the secret is using a Docker configuration file.
33+
<2> The output of a base64-encoded Docker configuration file
34+
--
35+
+
36+
--
37+
.Example Docker configuration JSON `secret` object
38+
[source,yaml]
39+
----
40+
apiVersion: v1
41+
kind: Secret
42+
metadata:
43+
name: secret-docker-json
44+
namespace: my-project
45+
type: kubernetes.io/dockerconfig <1>
46+
data:
47+
.dockerconfigjson:bm5ubm5ubm5ubm5ubm5ubm5ubm5ubmdnZ2dnZ2dnZ2dnZ2dnZ2dnZ2cgYXV0aCBrZXlzCg== <2>
48+
----
49+
<1> Specifies that the secret is using a Docker configuration JSONfile.
50+
<2> The output of a base64-encoded Docker configuration JSON file
51+
--
52+
53+
. Use the following command to create the `Secret` object
54+
+
55+
[source,terminal]
56+
----
57+
$ oc create -f <filename>.yaml
58+
----
59+
60+
. To use the secret in a pod:
61+
62+
.. Update the pod's service account to reference the secret, as shown in the "Understanding how to create secrets" section.
63+
64+
.. Create the pod, which consumes the secret as an environment variable or as a file (using a `secret` volume), as shown in the "Understanding how to create secrets" section.
65+

‎modules/nodes-pods-secrets-creating-opaque.adoc

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,11 @@
66
[id="nodes-pods-secrets-creating-opaque_{context}"]
77
= Creating an opaque secret
88

9-
As an administrator, you can create an opaque secret, which allows for unstructured `key:value` pairs that can contain arbitrary values.
9+
As an administrator, you can create an opaque secret, which allows you to store unstructured `key:value` pairs that can contain arbitrary values.
1010

1111
.Procedure
1212

13-
. Create a `Secret` object in a YAML file on master.
13+
. Create a `Secret` object in a YAML file on a control plane node.
1414
+
1515
For example:
1616
+
@@ -31,12 +31,11 @@ data:
3131
+
3232
[source,terminal]
3333
----
34-
$ oc create -f <filename>
34+
$ oc create -f <filename>.yaml
3535
----
3636

3737
. To use the secret in a pod:
3838

39-
.. Update the service account for the pod where you want to use the secret to allow the reference to the secret.
39+
.. Update the pod's service account to reference the secret, as shown in the "Understanding how to create secrets" section.
4040

41-
.. Create the pod, which consumes the secret as an environment variable or as a file
42-
(using a `secret` volume).
41+
.. Create the pod, which consumes the secret as an environment variable or as a file (using a `secret` volume), as shown in the "Understanding how to create secrets" section.

‎modules/nodes-pods-secrets-creating-sa.adoc

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * nodes/nodes-pods-secrets.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="nodes-pods-secrets-creating-sa_{context}"]
7+
= Creating a service account token secret
8+
9+
As an administrator, you can create a service account token secret, which allows you to distribute a service account token to applications that must authenticate to the API.
10+
11+
[NOTE]
12+
====
13+
It is recommended to obtain bound service account tokens using the TokenRequest API instead of using service account token secrets. The tokens obtained from the TokenRequest API are more secure than the tokens stored in secrets, because they have a bounded lifetime and are not readable by other API clients.
14+
15+
You should create a service account token secret only if you cannot use the TokenRequest API and if the security exposure of a non-expiring token in a readable API object is acceptable to you.
16+
17+
See the Additional references section that follows for information on creating bound service account tokens.
18+
====
19+
20+
.Procedure
21+
22+
. Create a `Secret` object in a YAML file on a control plane node:
23+
+
24+
.Example `secret` object:
25+
[source,yaml]
26+
----
27+
apiVersion: v1
28+
kind: Secret
29+
metadata:
30+
name: secret-sa-sample
31+
annotations:
32+
kubernetes.io/service-account.name: "sa-name" <1>
33+
type: kubernetes.io/service-account-token <2>
34+
----
35+
<1> Specifies an existing service account name. If you are creating both the `ServiceAccount` and the `Secret` objects, create the `ServiceAccount` object first.
36+
<2> Specifies a service account token secret.
37+
38+
. Use the following command to create the `Secret` object:
39+
+
40+
[source,terminal]
41+
----
42+
$ oc create -f <filename>.yaml
43+
----
44+
45+
. To use the secret in a pod:
46+
47+
.. Update the pod's service account to reference the secret, as shown in the "Understanding how to create secrets" section.
48+
49+
.. Create the pod, which consumes the secret as an environment variable or as a file (using a `secret` volume), as shown in the "Understanding how to create secrets" section.

‎modules/nodes-pods-secrets-creating-ssh.adoc

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * nodes/nodes-pods-secrets.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="nodes-pods-secrets-creating-ssh_{context}"]
7+
= Creating an SSH authentication secret
8+
9+
As an administrator, you can create an SSH authentication secret, which allows you to store data used for SSH authentication. When using this secret type, the `data` parameter of the `Secret` object must contain the SSH credential to use.
10+
11+
.Procedure
12+
13+
. Create a `Secret` object in a YAML file on a control plane node:
14+
+
15+
.Example `secret` object:
16+
[source,yaml]
17+
----
18+
apiVersion: v1
19+
kind: Secret
20+
metadata:
21+
name: secret-ssh-auth
22+
type: kubernetes.io/ssh-auth <1>
23+
data:
24+
ssh-privatekey: | <2>
25+
MIIEpQIBAAKCAQEAulqb/Y ...
26+
----
27+
<1> Specifies an SSH authentication secret.
28+
<2> Specifies the SSH key/value pair as the SSH credentials to use.
29+
30+
. Use the following command to create the `Secret` object:
31+
+
32+
[source,terminal]
33+
----
34+
$ oc create -f <filename>.yaml
35+
----
36+
37+
. To use the secret in a pod:
38+
39+
.. Update the pod's service account to reference the secret, as shown in the "Understanding how to create secrets" section.
40+
41+
.. Create the pod, which consumes the secret as an environment variable or as a file (using a `secret` volume), as shown in the "Understanding how to create secrets" section.

‎modules/nodes-pods-secrets-creating-tls.adoc

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * nodes/nodes-pods-secrets.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="nodes-pods-secrets-creating-tls_{context}"]
7+
= Creating a TLS secret
8+
9+
As an administrator, you can create a Transport Layer Security (TLS) secret, which allows you to store a certificate and its associated key that are typically used for TLS. When using this type of secret, the `data` parameter of the `Secret` object must contain the `tls.key` and the `tls.crt` keys to use. The API server does not validate the values for each key.
10+
11+
One common use for TLS secrets is to configure encryption in transit for ingress. You can also use a TLS secret with other resources or directly in your workload.
12+
13+
[NOTE]
14+
====
15+
You can use the `stringData` parameter to use clear text content.
16+
====
17+
18+
.Procedure
19+
20+
. Create a `Secret` object in a YAML file on a control plane node:
21+
+
22+
.Example `secret` object:
23+
[source,yaml]
24+
----
25+
apiVersion: v1
26+
kind: Secret
27+
metadata:
28+
name: secret-tls
29+
type: kubernetes.io/tls <1>
30+
data:
31+
tls.crt: | <2>
32+
MIIC2DCCAcCgAwIBAgIBATANBgkqh ...
33+
tls.key: |
34+
MIIEpgIBAAKCAQEA7yn3bRHQ5FHMQ ...
35+
36+
----
37+
<1> Specifies a TLS secret.
38+
<2> Specifies the `tls.key` and the `tls.crt` keys to use.
39+
40+
. Use the following command to create the `Secret` object:
41+
+
42+
[source,terminal]
43+
----
44+
$ oc create -f <filename>.yaml
45+
----
46+
47+
. To use the secret in a pod:
48+
49+
.. Update the pod's service account to reference the secret, as shown in the "Understanding how to create secrets" section.
50+
51+
.. Create the pod, which consumes the secret as an environment variable or as a file (using a `secret` volume), as shown in the "Understanding how to create secrets" section.

0 commit comments

Comments
 (0)