[K8S] 环境变量获取

阳光穿透心脏的1/2处 2022-09-09 04:59 439阅读 0赞

环境变量(env)是容器级别的参数，为容器设置环境变量方法有  
\- 变量值从Pod属性获取  
\- 变量值从自定义变量获取  
\- 变量值从ConfigMap获取  
\- 变量值从Secret获取

@Pod属性和自定义变量  
test-env.yaml内容如下

apiVersion: v1
    kind: Pod
    metadata:
      name: test-env
    spec:
      containers:
      - name: test-env
        image: busybox
        command: [ "sh", "-c", "sleep 3600"]
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: POD_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        - name: date
          value: "2021-08-29"
        - name: hello
          value: "Greeting"

说明：  
lines 11-22 变量值从Pod属性获取  
lines 23-26 变量值从自定义变量获取

创建Pod后,进入容器, 获取变量值

[root@k8s-master ~]# kubectl get pod -o wide
    NAME                                      READY   STATUS    RESTARTS   AGE     IP               NODE        NOMINATED NODE   READINESS GATES
    dns                                       1/1     Running   3          3h42m   10.244.36.94     k8s-node1   <none>           <none>
    nfs-client-provisioner-5fd446cd9d-c62kl   1/1     Running   0          8h      10.244.169.149   k8s-node2   <none>           <none>
    test-env                                  1/1     Running   0          3m12s   10.244.36.99     k8s-node1   <none>           <none>
    [root@k8s-master ~]#
    [root@k8s-master ~]# kubectl exec -it test-env -- sh
    / # echo $POD_NAME
    test-env
    / # echo $POD_NAMESPACE
    default
    / # echo $POD_IP
    10.244.36.99
    / # echo $date
    2021-08-29
    / # echo $hello
    Greeting
    / # exit
    [root@k8s-master ~]#

@ ConfigMap

yaml可参考官方文档 -> [ConfigMap | Kubernetes][ConfigMap _ Kubernetes]

test-configmap.yaml内容如下

apiVersion: v1
    kind: ConfigMap
    metadata:
      name: game-demo
    data:
      # 类属性键；每一个键都映射到一个简单的值
      player_initial_lives: "3"
      ui_properties_file_name: "user-interface.properties"
    
      # 类文件键
      game.properties: |
        enemy.types=aliens,monsters
        player.maximum-lives=5    
      user-interface.properties: |
        color.good=purple
        color.bad=yellow
        allow.textmode=true 
    ---
    apiVersion: v1
    kind: Pod
    metadata:
      name: test-configmap
    spec:
      containers:
        - name: demo
          image: alpine
          command: ["sleep", "3600"]
          env:
            # 定义环境变量
            - name: PLAYER_INITIAL_LIVES # 请注意这里和 ConfigMap 中的键名是不一样的
              valueFrom:
                configMapKeyRef:
                  name: game-demo           # 这个值来自 ConfigMap
                  key: player_initial_lives # 需要取值的键
            - name: UI_PROPERTIES_FILE_NAME
              valueFrom:
                configMapKeyRef:
                  name: game-demo
                  key: ui_properties_file_name
          volumeMounts:
          - name: config
            mountPath: "/config"
            readOnly: true
      volumes:
        # 你可以在 Pod 级别设置卷，然后将其挂载到 Pod 内的容器中
        - name: config
          configMap:
            # 提供你想要挂载的 ConfigMap 的名字
            name: game-demo
            # 来自 ConfigMap 的一组键，将被创建为文件
            items:
            - key: "game.properties"
              path: "game.properties"
            - key: "user-interface.properties"
              path: "user-interface.properties"

说明：  
1.ConfigMap的data部分  
lines 6-8 一个键对应一个值  
lines 10-17 配置的片段格式

2.Pod使用ConfigMap中的值  
lines 28-39 环境变量  
lines 40-55 在只读卷里面添加一个文件，让应用来读取

[root@k8s-master ~]# kubectl apply -f test-configmap.yaml
    configmap/game-demo created
    pod/test-configmap created
    [root@k8s-master ~]# kubectl get configmap
    NAME               DATA   AGE
    game-demo          4      18s
    kube-root-ca.crt   1      35d
    [root@k8s-master ~]#

说明：configmap，game-demo列DATA的4代表  其包含4个键，对应34,39行和52,54行

然后进入Pod获取这些变量的值， 1）环境变量

[root@k8s-master ~]# kubectl get pod
    NAME                                      READY   STATUS    RESTARTS   AGE
    test-configmap                        1/1     Running   0          74s
    dns                                       1/1     Running   5          15h
    nfs-client-provisioner-5fd446cd9d-c62kl   1/1     Running   2          20h
    test-env                                  1/1     Running   2          11h
    [root@k8s-master ~]#
    [root@k8s-master ~]# kubectl exec -it test-configmap -- sh
    / # env | grep enemy.types
    / #
    / # env
    KUBERNETES_SERVICE_PORT=443
    KUBERNETES_PORT=tcp://10.96.0.1:443
    UI_PROPERTIES_FILE_NAME=user-interface.properties
    HOSTNAME=test-configmap
    SHLVL=1
    HOME=/root
    TERM=xterm
    KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1
    PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
    KUBERNETES_PORT_443_TCP_PORT=443
    KUBERNETES_PORT_443_TCP_PROTO=tcp
    KUBERNETES_SERVICE_PORT_HTTPS=443
    KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443
    PLAYER_INITIAL_LIVES=3
    KUBERNETES_SERVICE_HOST=10.96.0.1
    PWD=/
    / # echo $PLAYER_INITIAL_LIVES
    3
    / #
    / #
    / # env | grep UI_PROPERTIES_FILE_NAME
    UI_PROPERTIES_FILE_NAME=user-interface.properties
    / # env | grep allow.textmode
    / #

2）挂载卷里的配置文件

/ # cd config/
    /config # ls
    game.properties            user-interface.properties
    /config # cat game.properties
    enemy.types=aliens,monsters
    player.maximum-lives=5
    /config # cat user-interface.properties
    color.good=purple
    color.bad=yellow
    allow.textmode=true
    /config #

@ Secret

Secret 是一种包含少量敏感信息例如密码、令牌或密钥的对象。

要使用 Secret，Pod 需要引用 Secret，有三种方式：  
由kubelet在为Pod拉取镜像时使用  
作为挂载到一个或多个容器上的卷中的文件  
作为容器的环境变量

Secret的类型

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAd3lfaGh4eA_size_20_color_FFFFFF_t_70_g_se_x_16][]

官方文档 -> [Secret | Kubernetes][Secret _ Kubernetes]

base64加解密  
加密 echo -n 'string' | base64  
解密 echo -n 'string' | base64 -d

注意: echo选项"-n" 表示不输出换行,对比如下

[root@k8s-master ~]# echo -n 'admin' | base64
    YWRtaW4=
    [root@k8s-master ~]# echo 'admin' | base64
    YWRtaW4K
    [root@k8s-master ~]# echo 'YWRtaW4=' | base64 -d
    admin[root@k8s-master ~]#
    [root@k8s-master ~]# echo 'YWRtaW4K' | base64 -d
    admin
    [root@k8s-master ~]# echo -n 'YWRtaW4K' | base64 -d
    admin
    [root@k8s-master ~]# echo -n 'YWRtaW4=' | base64 -d
    admin[root@k8s-master ~]#

test-secret.yaml内容如下,

apiVersion: v1
    data:
      username: YWRtaW4=
      password: MWYyZDFlMmU2N2Rm
    kind: Secret
    metadata:
      name: mysecret
    type: Opaque
    ---
    apiVersion: v1
    kind: Pod
    metadata:
      name: test-secret
    spec:
      containers:
      - name: test-secret
        image: nginx
        env:
        - name: USER
          valueFrom:
            secretKeyRef:
              name: mysecret
              key: username
        - name: PASS
          valueFrom:
            secretKeyRef:
              name: mysecret
              key: password
        volumeMounts:
        - name: config
          mountPath: "/config"
          readOnly: true
      volumes:
      - name: config
        secret:
          secretName: mysecret
          items:
          - key: username
            path: usernamefile

创建Secret和Pod

[root@k8s-master ~]# kubectl apply -f test-secret.yaml
    secret/mysecret created
    pod/test-secret created
    [root@k8s-master ~]# kubectl get secret
    NAME                                 TYPE                                  DATA   AGE
    mysecret                             Opaque                                2      13s
    nfs-client-provisioner-token-hfwpd   kubernetes.io/service-account-token   3      35h
    [root@k8s-master ~]#

进入Pod获取环境变量

[root@k8s-master ~]# kubectl get pod
    NAME                                      READY   STATUS    RESTARTS   AGE
    test-configmap                            1/1     Running   2          14h
    dns                                       1/1     Running   8          30h
    nfs-client-provisioner-5fd446cd9d-c62kl   1/1     Running   4          35h
    test-env                                  1/1     Running   5          26h
    test-secret                               1/1     Running   0          22s
    [root@k8s-master ~]#
    [root@k8s-master ~]# kubectl exec -it test-secret -- sh
    # echo $USER
    admin
    # echo $PASS
    1f2d1e2e67df
    #
    # cd config
    # ls
    usernamefile
    # cat usernamefile
    admin# exit
    [root@k8s-master ~]#

[ConfigMap _ Kubernetes]: https://kubernetes.io/zh/docs/concepts/configuration/configmap/
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAd3lfaGh4eA_size_20_color_FFFFFF_t_70_g_se_x_16]: /images/20220829/964b54eb70864f31b8ae1317f250e692.png
[Secret _ Kubernetes]: https://kubernetes.io/zh/docs/concepts/configuration/secret/