kubectl 使用目录结构创建密钥

Question

I've created a secret with this command for one pair of public/private keys:

kubectl create secret generic my-keys-secret --from-file=./public.key --from-file=./private.key

And used it in my pod configuration file:

spec:
  volumes:
    - name: my-keys
      secret:
      secretName: my-keys-secret

volumeMounts:
  - name: my-keys
    readOnly: true
    mountPath: "/keys"

So the pod can access keys/public.key and keys/private.key .

But our new requirement is to support multiple pairs of public/private keys in this structure:

.
└── keys
    ├── 1
    │   ├── private.key
    │   └── public.key
    .
    .
    │
    └── n
        ├── private.key
        └── public.key

Is it possible to create the secret with kubectl create secret generic cmd in the above structure? (the pod should be able to access keys/n/public.key and keys/n/private.key )

Answer 1

Yes, definintely. You need what is called a generator . The best one is kustomize . You can use it either as a standalone binary, or integrate it with kubectl.

You will simply create a kustomization.yaml file that will take certain resource directories and templates as input and generate a whole bunch of manifests as output. For multi-level directories, you will have a kustomization.yaml file per directory. These will all be consumed by the program in a sequence to generate a complete set of manifests for you. This you can directly apply to your cluster with:

kubectl apply -k .

This command assumes your current directory has a kustomization.yaml file that you want to use and it will first generate all the manifests and then apply them. If you only want to generate them and not apply them, you can --dry-run your instruction and get -o yaml output and save it to a file, like this:

kubectl apply -k . --dry-run=client -o yaml > my-secrets.yaml

This will put all of your generated secret manifests in my-secrets.yaml which you can check for correctness when templating.

You can read more about templatization options on the kustomize docs here . It's very intuitive and simple to use :)