配置管理

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:                          # 键值对形式
  LOG_LEVEL: "info"
  DB_HOST: "mysql-svc"
  CACHE_TTL: "300"

---

apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-conf
data:                          # 多行文件内容
  nginx.conf: |
    server {
        listen 80;
        location / {
            proxy_pass http://backend-svc:8080;
        }
    }

# 方式一:注入为环境变量
apiVersion: v1
kind: Pod
metadata:
  name: app
spec:
  containers:
  - name: app
    image: my-app:v1
    env:
    - name: LOG_LEVEL                  # Pod 内的环境变量名
      valueFrom:
        configMapKeyRef:
          name: app-config             # ConfigMap 名称
          key: LOG_LEVEL               # ConfigMap 中的 key

    # 或者一次性注入整个 ConfigMap 的所有键值
    envFrom:
    - configMapRef:
        name: app-config               # LOG_LEVEL,DB_HOST,CACHE_TTL 全部变成环境变量

# 方式二:挂载为文件(适合配置文件场景)
apiVersion: v1
kind: Pod
metadata:
  name: nginx
spec:
  containers:
  - name: nginx
    image: nginx:1.25
    volumeMounts:
    - name: config-volume
      mountPath: /etc/nginx/nginx.conf   # 挂载到容器的哪个路径
      subPath: nginx.conf                # 只挂载 ConfigMap 中的某个 key(避免覆盖整个目录)
  volumes:
  - name: config-volume
    configMap:
      name: nginx-conf                   # 引用的 ConfigMap

apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
type: Opaque                    # 通用类型(还有 tls / dockerconfigjson 等)
data:                           # 注意:值必须是 Base64 编码
  username: YWRtaW4=            # echo -n "admin" | base64
  password: UzNjcjN0IUAj        # echo -n "S3cr3t!@#" | base64

---

# 或者用 stringData 直接写明文(K8s 会自动 Base64)
apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
stringData:                     # 明文写入,apply 后 K8s 自动转为 Base64 存储
  username: admin
  password: "S3cr3t!@#"

spec:
  containers:
  - name: app
    image: my-app:v1
    env:
    - name: DB_USERNAME
      valueFrom:
        secretKeyRef:              # 注意是 secretKeyRef,不是 configMapKeyRef
          name: db-credentials
          key: username
    - name: DB_PASSWORD
      valueFrom:
        secretKeyRef:
          name: db-credentials
          key: password

    # 或挂载为文件
    volumeMounts:
    - name: secret-volume
      mountPath: /etc/secrets
      readOnly: true               # 建议只读
  volumes:
  - name: secret-volume
    secret:
      secretName: db-credentials
      # 挂载后:/etc/secrets/username 和 /etc/secrets/password 各一个文件

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-version-info
data:
  VERSION: "2.1.0"
  BUILD_DATE: "2024-03-15"
immutable: true                # ← 设置后无法再修改 data,只能删除重建

# API Server 的加密配置(/etc/kubernetes/encryption-config.yaml)
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources:
  - secrets                     # 只加密 Secret(ConfigMap 通常不需要)
  providers:
  - aescbc:                     # 加密算法:AES-CBC
      keys:
      - name: key1
        secret: base64编码的32字节密钥
  - identity: {}                # 兜底:未加密的旧数据仍可读

# External Secrets Operator 示例:
# 在 K8s 中声明"从 Vault 的哪个路径取什么 key"
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: db-credentials
spec:
  refreshInterval: 1h               # 每小时同步一次
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: db-credentials            # 生成的 K8s Secret 名称
  data:
  - secretKey: username             # K8s Secret 中的 key
    remoteRef:
      key: secret/data/prod/db      # Vault 中的路径
      property: username            # Vault 中的字段
  - secretKey: password
    remoteRef:
      key: secret/data/prod/db
      property: password

# 效果:Controller 自动创建并维护一个 K8s Secret "db-credentials"
# Pod 照常用 secretKeyRef 读取,完全不知道密钥来自 Vault

apiVersion: apps/v1
kind: Deployment
metadata:
  name: app
spec:
  template:
    metadata:
      annotations:
        # 把 ConfigMap 内容的 hash 写进 annotation
        # ConfigMap 内容变 → hash 变 → template 变 → 触发滚动更新
        checksum/config: "{{ sha256sum .Values.configData }}"  # Helm 模板语法
    spec:
      containers:
      - name: app
        envFrom:
        - configMapRef:
            name: app-config