我有一个安装了 vault 的 kubernetes 集群(通过 helm chart)。
我想将密码从保管库填充到 pod(例如 nginx)中的文件,并每 5 分钟刷新一次密码。
我使用以下配置对其进行测试(使用适当的保险库策略/后端身份验证):
命名空间.yaml
apiVersion: v1
kind: Namespace
metadata:
name: web
服务账户.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: nginx
namespace: web
secrets:
- name: nginx
nginx-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx
namespace: web
labels:
app: nginx
run: nginx
version: vault-injector
spec:
replicas: 1
selector:
matchLabels:
run: nginx
version: vault-injector
template:
metadata:
labels:
app: nginx
run: nginx
version: vault-injector
annotations:
vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/role: "nginx"
#vault.hashicorp.com/agent-inject-status: "update"
vault.hashicorp.com/agent-inject-secret-nginx.pass: "infrastructure/nginx/"
spec:
serviceAccountName: nginx
containers:
- name: nginx
image: nginx
ports:
- name: http
containerPort: 80
当我将这个配置应用到我的 kubernetes 集群时,部署被创建并且我的 secret 被填充到/vault/secret/nginx.pass(如预期的那样)。
kubectl exec -it pod/nginx-69955d8744-v9jm2 -n web -- cat /vault/secrets/nginx.pass
Password1: MySecretPassword1
Password2: MySecretPassword2
我尝试更新 kv 并在 nginx kv 上添加密码,但我的 pod 没有刷新/vault/secrets/nginx.pass 上的文件。如果我重新启动,我的 secret 就会被填满
是否可以动态刷新kv?最好的方法是什么?我想使用 vault 作为配置管理器,并且能够在不重启 pod 的情况下修改 kv。
最佳答案
您可以通过指定 TTL 值在您的 kv secret 上定义 TTL。例如:
vault kv put infrastructure/nginx ttl=1m Password1=PasswordUpdated1 Password2=PasswordUpdated2
每分钟都会使您的基础设施/nginx 密码过期。 Vault sidecar 将自动检查新值并将文件刷新到您的 pod 中。
root@LAP-INFO-28:/mnt/c/Users/cmonsieux/Desktop/IAC/kubernetes/yaml/simplePod# k logs nginx-69955d8744-mwhmf vault-agent -n web
renewal process
2020-09-06T07:16:42.867Z [INFO] sink.file: token written: path=/home/vault/.vault-token
2020-09-06T07:16:42.867Z [INFO] template.server: template server received new token
2020/09/06 07:16:42.867793 [INFO] (runner) stopping
2020/09/06 07:16:42.867869 [INFO] (runner) creating new runner (dry: false, once: false)
2020/09/06 07:16:42.868051 [INFO] (runner) creating watcher
2020/09/06 07:16:42.868101 [INFO] (runner) starting
2020-09-06T07:16:42.900Z [INFO] auth.handler: renewed auth token
2020/09/06 07:18:26.268835 [INFO] (runner) rendered "(dynamic)" => "/vault/secrets/nginx.pass"
2020/09/06 07:19:18.810479 [INFO] (runner) rendered "(dynamic)" => "/vault/secrets/nginx.pass"
2020/09/06 07:24:41.189868 [INFO] (runner) rendered "(dynamic)" => "/vault/secrets/nginx.pass"
2020/09/06 07:25:36.095547 [INFO] (runner) rendered "(dynamic)" => "/vault/secrets/nginx.pass"
2020/09/06 07:29:11.479051 [INFO] (runner) rendered "(dynamic)" => "/vault/secrets/nginx.pass"
2020/09/06 07:31:00.715215 [INFO] (runner) rendered "(dynamic)" => "/vault/secrets/nginx.pass"
root@LAP-INFO-28:/mnt/c/Users/cmonsieux/Desktop/IAC/kubernetes/yaml/simplePod# k exec -it pod/nginx-69955d8744-mwhmf -n web -- cat /vault/secrets/nginx.pass
Password1: PasswordUpdated1
Password2: PasswordUpdated2
ttl: 1m
关于nginx - Kubernetes - 如何在不重启 pod 的情况下动态刷新 secret ,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/63746183/