文档首页 > > API参考> Kubernetes API> Secret> 创建Secret

创建Secret

分享
更新时间:2020/07/21 GMT+08:00

功能介绍

该API用于创建Secret资源类型,Secret解决了密码、token、密钥等敏感数据的配置问题,而不需要把这些敏感数据暴露到镜像或者Pod Spec中。Secret可以以Volume或者环境变量的方式使用。

Secret有主要有四种类型:

  • kubernetes.io/service-account-token :用来访问Kubernetes API,由Kubernetes自动创建,并且会自动挂载到Pod的/run/secrets/kubernetes.io/serviceaccount目录中;
  • opaque :base64编码格式的Secret,用来存储密码、密钥等;在高敏感场景,建议先通过数据加密服务加密敏感数据后,再存入Secret中;
  • cfe/secure-opaque:secret格式,常用于上传敏感信息给平台使用。数据加密后存储并返回密文,可以有效保障用户数据安全;
  • kubernetes.io/dockerconfigjson :用来存储私有docker registry的认证信息。

URI

POST /api/v1/namespaces/{namespace}/secrets

表1 描述该API的参数。

表1 参数描述

参数

是否必选

描述

namespace

Yes

Object name and auth scope, such as for teams and projects.

请求消息

请求参数:

请求参数如表2所示。

表2 参数描述

参数

是否必选

参数类型

描述

kind

Yes

String

Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase.

The value of this parameter is Secret.

apiVersion

Yes

String

APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values.

The value of this parameter is v1.

metadata

Yes

metadata object

-

data

No

Object

Data contains the secret data. Each key must be a valid DNS_SUBDOMAIN or leading dot followed by valid DNS_SUBDOMAIN. The serialized form of the secret data is a base64 encoded string, representing the arbitrary (possibly non-string) data value here.

type

No

String

Used to facilitate programmatic handling of secret data.

The primitive k8s supports the following secret types:

  • kubernetes.io/service-account-token
  • kubernetes.io/.dockercfg
  • kubernetes.io/.dockerconfigjson
  • kubernetes.io/basic-auth
  • kubernetes.io/ssh-auth
  • kubernetes.io/tls
表3 metadata字段数据结构说明

参数

是否必选

参数类型

描述

name

Yes

String

Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition.

The name must be 0 to 253 characters in length.

The string must comply with regular expression [a-z0-9]([-a-z0-9]*[a-z0-9])?.

generateName

No

String

GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.

If this field is specified and the generated name exists, the server will NOT return a 409 - instead, it will either return 201 Created or 500 with Reason ServerTimeout indicating a unique name could not be found in the time allotted, and the client should retry (optionally after the time indicated in the Retry-After header).

Applied only if Name is not specified.

Value length: 0 character < String length ≤ 253 characters.

The string must comply with regular expression [a-z0-9]([-a-z0-9]*[a-z0-9])?.

namespace

No

String

Namespace defines the space within each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty. Must be a DNS_LABEL. Cannot be updated.

Value length: 0 character < String length ≤ 253 characters.

The string must comply with regular expression [a-z0-9]([-a-z0-9]*[a-z0-9])?.

selfLink

No

String

SelfLink is a URL representing this object. Populated by the system. Read-only.

说明:

This parameter is automatically generated. Do not assign values to this parameter. Otherwise, the API fails to be called.

uid

No

String

UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations. Populated by the system. Read-only.

说明:

This parameter is automatically generated. Do not assign values to this parameter. Otherwise, the API fails to be called.

resourceVersion

No

String

An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources. Populated by the system. Read-only. Value must be treated as opaque by clients.

说明:

This parameter is automatically generated. Do not assign values to this parameter. Otherwise, the API fails to be called.

generation

No

Integer

A sequence number representing a specific generation of the desired state. Currently only implemented by replication controllers. Populated by the system. Read-only.

creationTimestamp

No

String

CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists.

说明:

This parameter is automatically generated. Do not assign values to this parameter. Otherwise, the API fails to be called.

deletionTimestamp

No

String

DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource will be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. Once the resource is deleted in the API, the Kubelet will send a hard termination signal to the container. If not set, graceful deletion of the object has not been requested. Populated by the system when a graceful deletion is requested. Read-only.

deletionGracePeriodSeconds

No

Integer

Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.

labels

No

Object

Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services.

Annotations

No

Object

Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects.

ownerReferences

No

ownerReferences object

List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.

finalizers

No

Array of strings

Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed.

表4 ownerReferences字段数据结构说明

参数

是否必选

参数类型

描述

apiVersion

No

String

API version of the referent.

kind

No

String

Kind of the referent.

name

No

String

Name of the referent.

uid

No

String

UID of the referent.

controller

No

Boolean

If true, this reference points to the managing controller.

请求示例:
{
  "apiVersion": "v1",
  "kind": "Secret",
  "metadata": {
    "name": "mysecret"
  },
  "type": "Opaque",
  "data": {
    "password": "******", #需要用Base64编码,方法:echo -n "待编码内容" | base64
    "username": "*****" #需要用Base64编码,方法:echo -n "待编码内容" | base64
  }
}

响应消息

响应参数:

响应参数的详细描述请参见表2

响应示例:

{ 
   "kind": "Secret", 
   "apiVersion": "v1", 
   "metadata": { 
     "name": "mysecret", 
     "namespace": "default", 
     "selfLink": "/api/v1/namespaces/default/secrets/mysecret", 
     "uid": "597c306b-594e-11e6-b444-286ed488fafe", 
     "resourceVersion": "10742", 
     "creationTimestamp": "2016-08-03T07:46:12Z" 
   }, 
   "data": { 
     "password": "******", 
     "username": "*****"      
   }, 
   "type": "Opaque" 
 }

状态码

表5描述API的状态码。

表5 状态码

状态码

描述

201

This operation succeeds, and a secret resource object is returned.

异常状态码请参见状态码

分享:

    相关文档

    相关产品

文档是否有解决您的问题?

提交成功!非常感谢您的反馈,我们会继续努力做到更好!
反馈提交失败,请稍后再试!

*必选

请至少选择或填写一项反馈信息

字符长度不能超过200

提交反馈 取消

如您有其它疑问,您也可以通过华为云社区问答频道来与我们联系探讨

智能客服提问云社区提问