Compare commits
9 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
f2ac5a2d0d | ||
|
|
78d14d0d75 | ||
|
|
d5034af5ca | ||
|
|
40ed9e6a44 | ||
|
|
c1d20546ec | ||
|
|
3cf6b8ec4d | ||
|
|
3aee7a9081 | ||
|
|
abefa2b155 | ||
|
|
281f932814 |
@@ -23,8 +23,16 @@ English | [简体中文](zh/README.md)
|
||||
|
||||
## Release notes
|
||||
|
||||
* 3.2.1 - Patch release of kustomize in its own module. No change in function
|
||||
from v3.2.0.
|
||||
* [kustomize/3.2.2](https://github.com/kubernetes-sigs/kustomize/releases/tag/kustomize%2Fv3.2.2) - kustomize CLI
|
||||
moved to depend on kustomize Go API [3.3.0](v3.3.0.md).
|
||||
|
||||
* [API 3.3.0](v3.3.0.md) - First release of the kustomize Go API
|
||||
in a module excluding the `kustomize` CLI. From here on,
|
||||
the CLI and API will release independently.
|
||||
|
||||
* [kustomize/3.2.1](https://github.com/kubernetes-sigs/kustomize/releases/tag/kustomize%2Fv3.2.1) - Patch release
|
||||
of `kustomize` CLI in its own module,
|
||||
depending on Go API release [3.2.0](v3.2.0.md).
|
||||
|
||||
* [3.2.0](v3.2.0.md) - TODO(jingfang)
|
||||
|
||||
|
||||
114
docs/v3.3.0.md
Normal file
@@ -0,0 +1,114 @@
|
||||
# kustomize 3.3.0
|
||||
|
||||
[versioning policy documentation]: https://github.com/kubernetes-sigs/kustomize/blob/master/docs/versioningPolicy.md
|
||||
[release process documentation]: https://github.com/kubernetes-sigs/kustomize/tree/master/releasing
|
||||
|
||||
## Summary of changes
|
||||
|
||||
### First release of the Go API-only module.
|
||||
|
||||
Many of the PRs since the last kustomize release were
|
||||
around restructuring the _sigs.k8s.io/kustomize_
|
||||
repository into three Go modules instead of just one.
|
||||
|
||||
The reasons for this are detailed in the [versioning
|
||||
policy documentation], and what it means for releasing
|
||||
is explained in the [release process documentation].
|
||||
|
||||
The tl;dr is that the top level module
|
||||
`sigs.k8s.io/kustomize` now defines the kustomize Go
|
||||
API, and the _kustomize_ CLI sits below it in an
|
||||
independent module `sigs.k8s.io/kustomize/kustomize`.
|
||||
|
||||
The modules release independently, though in practice a
|
||||
new release of the kustomize Go API will likely be
|
||||
followed quickly by a new release of the `kustomize`
|
||||
executable.
|
||||
|
||||
This is a necessary step to creating a much smaller
|
||||
kustomize Go API surface that has some hope of
|
||||
conforming to semantic versioning and being of some use
|
||||
to clients.
|
||||
|
||||
The kustomize CLI will see the same kustomize Go API as
|
||||
any other client.
|
||||
|
||||
The new semver-able API will begin with `v4.0.0` (not
|
||||
yet released) and be a clean break with `v3` etc.
|
||||
|
||||
|
||||
### Change log since v3.2.0
|
||||
|
||||
```
|
||||
3c9d828f - Have kustomize CLI depend on kustomize Go API v3.3.0 (Jeffrey Regan)
|
||||
5d800f0b - Merge pull request #1595 from monopole/threeReleases (Jeff Regan)
|
||||
4eb2d5bc - Three builders. (Jeffrey Regan)
|
||||
988af1ff - Update README.md (Jeff Regan)
|
||||
1617183e - Merge pull request #1590 from monopole/releaseProcessUpdate (Kubernetes Prow Robot)
|
||||
ee727464 - update release process doc (jregan)
|
||||
c9e7dc3b - Merge pull request #1589 from monopole/moreTestsAroundKustFileName (Jeff Regan)
|
||||
07e0e46a - improve tests for alternative kustomization file names (Jeffrey Regan)
|
||||
404d2d63 - Merge pull request #1587 from monopole/reducePgmconfig (Jeff Regan)
|
||||
baa0296a - Reduce size of pgmconfig package (Jeffrey Regan)
|
||||
0f665ac1 - Merge pull request #1544 from ptux/add-transformer-href (Jeff Regan)
|
||||
14b0a650 - Merge pull request #1581 from monopole/refactorFs (Jeff Regan)
|
||||
2d58f8b8 - Break the dep between fs and pgmconfig. (Jeffrey Regan)
|
||||
9a43ca53 - Merge pull request #1578 from nlamirault/fix/build-plugins-doc (Jeff Regan)
|
||||
5372fc6f - Merge pull request #1579 from monopole/fsPackageCleanup (Jeff Regan)
|
||||
86bc3440 - Merge pull request #1513 from nimohunter/fix_empty_list_item (Kubernetes Prow Robot)
|
||||
a014f7d4 - Merge pull request #1561 from beautytiger/dev-190925 (Jeff Regan)
|
||||
9a94bcb8 - Improve fs package and doc in prep to officially go public (Jeffrey Regan)
|
||||
07634ef0 - Merge pull request #1575 from monopole/versioning (Jeff Regan)
|
||||
995f88d6 - Update versioning notes. (jregan)
|
||||
334a6467 - Fix: documentation link for plugins (Nicolas Lamirault)
|
||||
08963ba5 - improve test code coverage in transformers (Guangming Wang)
|
||||
326fb689 - Merge pull request #1570 from bzub/1234-go_plugin_doc (Jeff Regan)
|
||||
970ce67c - Update goPluginCaveats.md (Jeff Regan)
|
||||
98d18930 - Update INSTALL.md (Jeff Regan)
|
||||
d89b448c - Fix git tag recovery in cloud build. (Jeff Regan)
|
||||
17bf9d32 - Update releasing README. (Jeff Regan)
|
||||
a99aff1d - Merge pull request #1571 from monopole/updateCloudBuildProcess (Kubernetes Prow Robot)
|
||||
a694ac7b - Update cloud build process for kustomize. (Jeffrey Regan)
|
||||
b5b11ef6 - Fix compile kustomize example. (bzub)
|
||||
fa1af6f5 - Merge pull request #1473 from richardmarshall/execpluginhash (Jeff Regan)
|
||||
9288dec0 - Fix failing BashedConfigMapTest (Jeff Regan)
|
||||
1a45dd0b - Merge pull request #1566 from monopole/releaseNotes3.2.1 (Kubernetes Prow Robot)
|
||||
592c5acf - docs: Exec plugin generator options (Richard Marshall)
|
||||
ac9424fa - tests: Add unit tests for update resource options (Richard Marshall)
|
||||
79fbe7c4 - Support resource generator options in exec plugins (Richard Marshall)
|
||||
f69d526f - v3.2.1 release notes (Jeff Regan)
|
||||
07a95a60 - Merge pull request #1565 from monopole/tweakBinaryDepsBeforeTagging (Jeff Regan)
|
||||
032b3857 - Pin the kustomize binary's dependence on kustomize libs. (jregan)
|
||||
81062959 - Merge pull request #1564 from monopole/moveKustomizeBinaryToOwnModule (Kubernetes Prow Robot)
|
||||
b82a8fd3 - Move the kustomize binary to its own module. (Jeffrey Regan)
|
||||
2d0c22d6 - Merge pull request #1562 from keleustes/tools (Kubernetes Prow Robot)
|
||||
aa342def - Pin tool versions using go modules (Ian Howell)
|
||||
10786ec0 - Merge pull request #1554 from keleustes/readme (Kubernetes Prow Robot)
|
||||
7c705687 - Update README.md to include Kubernetes 1.16 (Jerome Brette)
|
||||
e8933d97 - Merge pull request #1560 from monopole/precommitTuneup (Jeff Regan)
|
||||
9d7b6544 - Make pre-commit more portable and less tricky. (jregan)
|
||||
7a0946a9 - Merge pull request #1558 from monopole/dependOnNewPluginatorModule (Jeff Regan)
|
||||
def4f045 - Depend on new pluginator location. (Jeffrey Regan)
|
||||
2f2408f1 - Merge pull request #1559 from monopole/compressCopyright (Jeff Regan)
|
||||
3b9bcc48 - Compress copyright in the commands package. (Jeffrey Regan)
|
||||
d0429ff4 - Merge pull request #1557 from monopole/pluginatorModule (Jeff Regan)
|
||||
33deefc3 - Copy pluginator to its own module. (Jeffrey Regan)
|
||||
9b3de82b - Merge pull request #1506 from Liujingfang1/release (Jeff Regan)
|
||||
d217074f - Merge pull request #1550 from keleustes/apiversion (Kubernetes Prow Robot)
|
||||
1d90ba7c - Fix typo in apiVersion yaml declaration (Jerome Brette)
|
||||
eeeb4c36 - Merge pull request #1547 from keleustes/extensions (Kubernetes Prow Robot)
|
||||
b1faa989 - Update Ingress apiVersion to networking.k8s.io/v1beta1 (Jerome Brette)
|
||||
d8250c9e - move test case (nimohunter)
|
||||
c9500466 - add transformer href (Wang(わん))
|
||||
0c32691e - Merge pull request #1537 from jaypipes/gomod-install-note (Kubernetes Prow Robot)
|
||||
88b1d627 - Merge pull request #1541 from rtnpro/patch-1 (Jeff Regan)
|
||||
aec82066 - Update INSTALL.md (Jeff Regan)
|
||||
20c2b53a - Merge pull request #1542 from monopole/tweakFilePathsInTest (Jeff Regan)
|
||||
274b5c3b - Tweak file path handling and logging in test. (Jeffrey Regan)
|
||||
b1fdaa23 - Fix typo in transformerconfigs README (Ratnadeep Debnath)
|
||||
b5d5e70b - empty list or map item return error (nimohunter)
|
||||
2e829853 - empty list or map item return error (nimohunter)
|
||||
55941f57 - add note about GO111MODULE for source install (Jay Pipes)
|
||||
9e226001 - empty list or map item return error (nimohunter)
|
||||
77b63f96 - add release note for v3.2.0 (jingfangliu)
|
||||
```
|
||||
@@ -32,13 +32,13 @@ go get sigs.k8s.io/kustomize/v3/cmd/kustomize
|
||||
|
||||
- generator 插件:
|
||||
|
||||
* [last mile helm](../chart.md) - 对 helm chart 进行 last mile 修改。
|
||||
* [last mile helm](chart.md) - 对 helm chart 进行 last mile 修改。
|
||||
|
||||
* [secret generation](../secretGeneratorPlugin.md) - 生成 Secret。
|
||||
* [secret generation](secretGeneratorPlugin.md) - 生成 Secret。
|
||||
|
||||
- transformer 插件:
|
||||
|
||||
* [validation transformer](../validationTransformer/README.md) - 通过 transformer 验证资源。
|
||||
* [validation transformer](../validationTransformer/README.md) - 通过 transformer 验证资源。
|
||||
|
||||
- 定制内建 transformer 配置
|
||||
|
||||
|
||||
215
examples/zh/chart.md
Normal file
@@ -0,0 +1,215 @@
|
||||
# 使用 kustomize 对 helm chart s进行修改
|
||||
|
||||
[last mile]: https://testingclouds.wordpress.com/2018/07/20/844/
|
||||
[stable chart]: https://github.com/helm/charts/tree/master/stable
|
||||
[Helm charts]: https://github.com/helm/charts
|
||||
[_minecraft_]: https://github.com/helm/charts/tree/master/stable/minecraft
|
||||
[插件]: ../../docs/plugins
|
||||
|
||||
kustomize 并不会读取 [Helm charts] ,但可以使用 generator ß来访问 [Helm charts] 。
|
||||
|
||||
使用 [last mile] 模式来结合 kustomize 和 helm ,使用一个 inflated chart 作为基础,然后使用 kustomize 在部署到集群的途中进行修改。
|
||||
|
||||
以下示例中使用的 generator 仅适用于 [stable chart] 仓库中的 chart。该示例虽然使用 [_minecraft_] ,但可以应用于任何 chart。
|
||||
|
||||
假设 `helm` 已在你的 `$PATH` 中,建立一个工作空间:
|
||||
|
||||
<!-- @makeWorkplace @test -->
|
||||
```bash
|
||||
DEMO_HOME=$(mktemp -d)
|
||||
mkdir -p $DEMO_HOME/base
|
||||
mkdir -p $DEMO_HOME/dev
|
||||
mkdir -p $DEMO_HOME/prod
|
||||
```
|
||||
|
||||
## 使用远程 chart
|
||||
|
||||
定义 _development_ variant(环境)。
|
||||
|
||||
这可能涉及许多 kustomizations(参见其他示例),但在本示例中,将 `dev-` 名称前缀添加到所有资源:
|
||||
|
||||
<!-- @writeKustDev @test -->
|
||||
```bash
|
||||
cat <<'EOF' >$DEMO_HOME/dev/kustomization.yaml
|
||||
namePrefix: dev-
|
||||
resources:
|
||||
- ../base
|
||||
EOF
|
||||
```
|
||||
|
||||
同上,使用 `namePrefix: prod-` 定义生产 variant :
|
||||
|
||||
<!-- @writeKustProd @test -->
|
||||
```bash
|
||||
cat <<'EOF' >$DEMO_HOME/prod/kustomization.yaml
|
||||
namePrefix: prod-
|
||||
resources:
|
||||
- ../base
|
||||
EOF
|
||||
```
|
||||
|
||||
这两个 variants 指向同一个 base。
|
||||
|
||||
定义这个 base:
|
||||
|
||||
<!-- @writeKustDev @test -->
|
||||
```bash
|
||||
cat <<'EOF' >$DEMO_HOME/base/kustomization.yaml
|
||||
generators:
|
||||
- chartInflator.yaml
|
||||
EOF
|
||||
```
|
||||
|
||||
base 指向一个名为 `chartInflator.yaml` 的生成配置文件。
|
||||
|
||||
此文件允许指定 [stable chart] 的名称及其他内容,例如 values 文件的路径,默认为 `values.yaml` 。
|
||||
|
||||
创建配置文件 `chartInflator.yaml`,指定 chart 名称为 _minecraft_:
|
||||
|
||||
<!-- @writeGeneratorConfig @test -->
|
||||
```bash
|
||||
cat <<'EOF' >$DEMO_HOME/base/chartInflator.yaml
|
||||
apiVersion: someteam.example.com/v1
|
||||
kind: ChartInflator
|
||||
metadata:
|
||||
name: notImportantHere
|
||||
chartName: minecraft
|
||||
EOF
|
||||
```
|
||||
|
||||
因为这个特定的 YAML 文件列在 kustomization文件的 `generators:` 字段中,所以它被视为生成器插件(由 _apiVersion_ 和 _kind_ 字段标识)与配置插件的其他字段之间的绑定。
|
||||
|
||||
将插件下载到 `DEMO_HOME` 并赋予其执行权限:
|
||||
|
||||
<!-- @installPlugin @test -->
|
||||
```bash
|
||||
plugin=plugin/someteam.example.com/v1/chartinflator/ChartInflator
|
||||
curl -s --create-dirs -o \
|
||||
"$DEMO_HOME/kustomize/$plugin" \
|
||||
"https://raw.githubusercontent.com/\
|
||||
kubernetes-sigs/kustomize/master/$plugin"
|
||||
|
||||
chmod a+x $DEMO_HOME/kustomize/$plugin
|
||||
```
|
||||
|
||||
检查目录布局:
|
||||
|
||||
<!-- @tree -->
|
||||
```bash
|
||||
tree $DEMO_HOME
|
||||
```
|
||||
|
||||
将会得倒类似的目录及文件:
|
||||
|
||||
> ```bash
|
||||
> /tmp/whatever
|
||||
> ├── base
|
||||
> │ ├── chartInflator.yaml
|
||||
> │ └── kustomization.yaml
|
||||
> ├── dev
|
||||
> │ └── kustomization.yaml
|
||||
> ├── kustomize
|
||||
> │ └── plugin
|
||||
> │ └── someteam.example.com
|
||||
> │ └── v1
|
||||
> │ └── chartinflator
|
||||
> │ └── ChartInflator
|
||||
> └── prod
|
||||
> └── kustomization.yaml
|
||||
> ```
|
||||
|
||||
运行 kustomize 定义一个 helper function 来传入正确的环境和常见标志:
|
||||
|
||||
<!-- @defineKustomizeIt @test -->
|
||||
```
|
||||
function kustomizeIt {
|
||||
XDG_CONFIG_HOME=$DEMO_HOME \
|
||||
kustomize build --enable_alpha_plugins \
|
||||
$DEMO_HOME/$1
|
||||
}
|
||||
```
|
||||
|
||||
最终构建 `prod` variant。这里要注意的是,所有资源名称现在都具有 `prod-` 前缀:
|
||||
|
||||
<!-- @doProd @test -->
|
||||
```bash
|
||||
clear
|
||||
kustomizeIt prod
|
||||
```
|
||||
|
||||
比较 `dev` 和 `prod`:
|
||||
|
||||
<!-- @doCompare -->
|
||||
```bash
|
||||
diff <(kustomizeIt dev) <(kustomizeIt prod) | more
|
||||
```
|
||||
|
||||
在 base上 运行 kustomize 查看未修改但已展开的 chart。
|
||||
这里的每次调用都是重新下载并重新展开 chart。
|
||||
|
||||
<!-- @showBase @test -->
|
||||
```bash
|
||||
kustomizeIt base
|
||||
```
|
||||
|
||||
## 使用本地 chart
|
||||
|
||||
上面的示例由于未在配置中指定本地 chart 的主目录,所以kustomize会取得远程chart的副本并存在临时目录中。
|
||||
|
||||
要禁止 fetch,请明确指定 `charHome` ,并确保chart 已经被保存在该目录下
|
||||
|
||||
要进行演示,并且不会干扰您现有的 helm 环境,请执行以下操作:
|
||||
|
||||
<!-- @helmInit @test -->
|
||||
```bash
|
||||
helmHome=$DEMO_HOME/dothelm
|
||||
chartHome=$DEMO_HOME/base/charts
|
||||
|
||||
function doHelm {
|
||||
helm --home $helmHome $@
|
||||
}
|
||||
|
||||
# 在新位置创建 helm 配置文件。
|
||||
# 初始化命令比较复杂
|
||||
doHelm init --client-only >& /dev/null
|
||||
```
|
||||
|
||||
现在下载 chart ; 可以再次使用的 [_minecraft_] (也可以使用其他的 chart ):
|
||||
|
||||
<!-- @fetchChart @test -->
|
||||
```bash
|
||||
doHelm fetch --untar \
|
||||
--untardir $chartHome \
|
||||
stable/minecraft
|
||||
```
|
||||
|
||||
使用 tree 查看更多信息;helm 配置数据和完整的 chart 副本:
|
||||
|
||||
<!-- @tree -->
|
||||
```bash
|
||||
tree $DEMO_HOME
|
||||
```
|
||||
|
||||
将 `chartHome` 字段添加到生成器的配置文件中,以便可以查找本地 chart:
|
||||
|
||||
<!-- @modifyGenConfig @test -->
|
||||
```bash
|
||||
echo "chartHome: $chartHome" >>$DEMO_HOME/base/chartInflator.yaml
|
||||
```
|
||||
|
||||
更改 values 文件,用来展示本地 chart 的更改:
|
||||
|
||||
<!-- @valueChange @test -->
|
||||
```
|
||||
sed -i 's/CHANGEME!/SOMETHINGELSE/' $chartHome/minecraft/values.yaml
|
||||
sed -i 's/LoadBalancer/NodePort/' $chartHome/minecraft/values.yaml
|
||||
```
|
||||
|
||||
最后进行构建:
|
||||
|
||||
<!-- @finalProd @test -->
|
||||
```bash
|
||||
kustomizeIt prod
|
||||
```
|
||||
|
||||
观察结果中 `LoadBalancer` 变为 `NodePort`,并且加密的密码也有所不同。
|
||||
193
examples/zh/secretGeneratorPlugin.md
Normal file
@@ -0,0 +1,193 @@
|
||||
[ConfigMaps]: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.13/#configmap-v1-core
|
||||
[ELF]: https://en.wikipedia.org/wiki/Executable_and_Linkable_Format
|
||||
[Go plugin]: https://golang.org/pkg/plugin
|
||||
[Secrets]: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.13/#secret-v1-core
|
||||
[base64]: https://tools.ietf.org/html/rfc4648#section-4
|
||||
[configuration directory]: https://wiki.archlinux.org/index.php/XDG_Base_Directory#Specification
|
||||
[grpc]: https://grpc.io
|
||||
[tag]: https://github.com/kubernetes-sigs/kustomize/releases
|
||||
[v2.0.3]: https://github.com/kubernetes-sigs/kustomize/releases/tag/v2.0.3
|
||||
[`exec.Command`]: https://golang.org/pkg/os/exec/#Command
|
||||
|
||||
# 生成 Secrets
|
||||
|
||||
## Secret 是什么?
|
||||
|
||||
Kubernetes 的 [ConfigMaps] 和 [Secrets] 都是key:value map,但 [Secrets] 的内容更为敏感,比如:密码或者 ssh 秘钥。
|
||||
|
||||
Kubernetes 开发者以各种方式工作,Secrets 保存的信息相比 ConfigMaps,Deployments 等的配置信息需要更谨慎的隐藏。
|
||||
|
||||
## 创建一个工作空间
|
||||
|
||||
<!-- @establishBase @test -->
|
||||
```bash
|
||||
DEMO_HOME=$(mktemp -d)
|
||||
```
|
||||
|
||||
## 来自本地文件的 Secret
|
||||
|
||||
kustomize 可以通过三种不同的方式生成来自本地文件的 Secret 。
|
||||
|
||||
* 从 _env_ 文件中获取(`NAME = VALUE`,每行一个)
|
||||
* 使用文件内容来生成一个 secret
|
||||
* 从 kustomization.yaml 文件获取 secret
|
||||
|
||||
这里有一个示例结合所有的三种方式:
|
||||
|
||||
创建一个包含一些短密码的 env 文件:
|
||||
|
||||
<!-- @makeEnvFile @test -->
|
||||
```bash
|
||||
cat <<'EOF' >$DEMO_HOME/foo.env
|
||||
ROUTER_PASSWORD=admin
|
||||
DB_PASSWORD=iloveyou
|
||||
EOF
|
||||
```
|
||||
|
||||
创建一个长密码的文本文件:
|
||||
|
||||
<!-- @makeLongSecretFile @test -->
|
||||
```bash
|
||||
cat <<'EOF' >$DEMO_HOME/longsecret.txt
|
||||
Lorem ipsum dolor sit amet,
|
||||
consectetur adipiscing elit,
|
||||
sed do eiusmod tempor incididunt
|
||||
ut labore et dolore magna aliqua.
|
||||
EOF
|
||||
```
|
||||
|
||||
创建一个kustomization.yaml 文件, 其中包含引用上面文件的 secretGenerator, 并且另外定义一些文字 KV 对:
|
||||
|
||||
<!-- @makeKustomization1 @test -->
|
||||
```bash
|
||||
cat <<'EOF' >$DEMO_HOME/kustomization.yaml
|
||||
secretGenerator:
|
||||
- name: mysecrets
|
||||
envs:
|
||||
- foo.env
|
||||
files:
|
||||
- longsecret.txt
|
||||
literals:
|
||||
- FRUIT=apple
|
||||
- VEGETABLE=carrot
|
||||
EOF
|
||||
```
|
||||
|
||||
生成 Secret :
|
||||
|
||||
<!-- @build1 @test -->
|
||||
```bash
|
||||
result=$(kustomize build $DEMO_HOME)
|
||||
echo "$result"
|
||||
# Spot check the result:
|
||||
test 1 == $(echo "$result" | grep -c "FRUIT: YXBwbGU=")
|
||||
```
|
||||
|
||||
将会得到类似的内容:
|
||||
|
||||
> ```yaml
|
||||
> apiVersion: v1
|
||||
> kind: Secret
|
||||
> metadata:
|
||||
> name: mysecrets-hfb5df789h
|
||||
> type: Opaque
|
||||
> data:
|
||||
> FRUIT: YXBwbGU=
|
||||
> VEGETABLE: Y2Fycm90
|
||||
> ROUTER_PASSWORD: YWRtaW4=
|
||||
> DB_PASSWORD: aWxvdmV5b3U=
|
||||
> longsecret.txt: TG9yZW0gaXBzdW0gZG9sb3Igc2l0I... (elided)
|
||||
> ```
|
||||
|
||||
资源名称的前缀为 `mysecrets`(在 kustomization.yaml 中指定),后跟其内容的哈希值。
|
||||
|
||||
使用 base64 解码器确认这些值的原始版本。
|
||||
|
||||
这三种方法共同的问题是创建 Secret 所使用的敏感数据必须保存磁盘上。
|
||||
|
||||
这会增加额外的安全问题:对本地存储的敏感文件的查看、安装和删除权限的控制等。
|
||||
|
||||
## 来自任何地方的 Secret
|
||||
|
||||
一般的替代方案是在[generator](../../docs/plugins)中生成 secrets 。
|
||||
|
||||
然后,这些值可以通过经过身份验证和授权的 RPC 进入密码保险库服务。
|
||||
|
||||
[sgp]: ../../plugin/someteam.example.com/v1/secretsfromdatabase
|
||||
|
||||
这里有一个[secret 生成器][sgp],它模拟从数据库中拉取 map 中的值。
|
||||
|
||||
下载
|
||||
|
||||
<!-- @copyPlugin @test -->
|
||||
```bash
|
||||
repo=https://raw.githubusercontent.com/kubernetes-sigs/kustomize
|
||||
pPath=plugin/someteam.example.com/v1/secretsfromdatabase
|
||||
dir=$DEMO_HOME/kustomize/$pPath
|
||||
|
||||
mkdir -p $dir
|
||||
|
||||
curl -s -o $dir/SecretsFromDatabase.go \
|
||||
${repo}/master/$pPath/SecretsFromDatabase.go
|
||||
```
|
||||
|
||||
运行 kustomize build 生成结果
|
||||
|
||||
<!-- @compilePlugin @xtest -->
|
||||
```bash
|
||||
go build -buildmode plugin \
|
||||
-o $dir/SecretsFromDatabase.so \
|
||||
$dir/SecretsFromDatabase.go
|
||||
```
|
||||
|
||||
创建一个配置文件:
|
||||
|
||||
<!-- @makeConfiguration @test -->
|
||||
```bash
|
||||
cat <<'EOF' >$DEMO_HOME/secretFromDb.yaml
|
||||
apiVersion: someteam.example.com/v1
|
||||
kind: SecretsFromDatabase
|
||||
metadata:
|
||||
name: mySecretGenerator
|
||||
name: forbiddenValues
|
||||
namespace: production
|
||||
keys:
|
||||
- ROCKET
|
||||
- VEGETABLE
|
||||
EOF
|
||||
```
|
||||
|
||||
创建一个引用此生成器的新 kustomization.yaml 文件:
|
||||
|
||||
<!-- @makeKustomization2 @test -->
|
||||
```bash
|
||||
cat <<'EOF' >$DEMO_HOME/kustomization.yaml
|
||||
generators:
|
||||
- secretFromDb.yaml
|
||||
EOF
|
||||
```
|
||||
|
||||
最终生成 secret ,设置 `XDG_CONFIG_HOME` 以便可以在 `$DEMO_HOME` 中找到该生成器:
|
||||
|
||||
<!-- @build2 @xtest -->
|
||||
```bash
|
||||
result=$( \
|
||||
XDG_CONFIG_HOME=$DEMO_HOME \
|
||||
kustomize build --enable_alpha_plugins $DEMO_HOME )
|
||||
echo "$result"
|
||||
# Spot check the result:
|
||||
test 1 == $(echo "$result" | grep -c "FRUIT: YXBwbGU=")
|
||||
```
|
||||
|
||||
将会得到类似的内容:
|
||||
|
||||
> ```yaml
|
||||
> apiVersion: v1
|
||||
> kind: Secret
|
||||
> metadata:
|
||||
> name: mysecrets-bdt27dbkd6
|
||||
> type: Opaque
|
||||
> data:
|
||||
> FRUIT: YXBwbGU=
|
||||
> VEGETABLE: Y2Fycm90
|
||||
> ```
|
||||
6
go.mod
@@ -5,15 +5,11 @@ go 1.12
|
||||
require (
|
||||
github.com/evanphx/json-patch v4.5.0+incompatible
|
||||
github.com/go-openapi/spec v0.19.2
|
||||
github.com/gogo/protobuf v1.3.0 // indirect
|
||||
github.com/golangci/golangci-lint v1.19.1
|
||||
github.com/gorilla/mux v1.7.3 // indirect
|
||||
github.com/gorilla/sessions v1.2.0 // indirect
|
||||
github.com/gorilla/websocket v1.4.1 // indirect
|
||||
github.com/monopole/mdrip v0.2.48
|
||||
github.com/monopole/mdrip v1.0.0
|
||||
github.com/pkg/errors v0.8.1
|
||||
github.com/russross/blackfriday v2.0.0+incompatible // indirect
|
||||
github.com/shurcooL/sanitized_anchor_name v1.0.0 // indirect
|
||||
github.com/spf13/pflag v1.0.5
|
||||
gopkg.in/yaml.v2 v2.2.2
|
||||
k8s.io/api v0.0.0-20190313235455-40a48860b5ab
|
||||
|
||||
18
go.sum
@@ -89,9 +89,8 @@ github.com/go-toolsmith/typep v1.0.0/go.mod h1:JSQCQMUPdRlMZFswiq3TGpNp1GMktqkR2
|
||||
github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
|
||||
github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
|
||||
github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
|
||||
github.com/gogo/protobuf v1.2.1 h1:/s5zKNz0uPFCZ5hddgPdo2TK2TVrUNMn0OOX8/aZMTE=
|
||||
github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
|
||||
github.com/gogo/protobuf v1.3.0 h1:G8O7TerXerS4F6sx9OV7/nRfJdnXgHZu/S/7F2SN+UE=
|
||||
github.com/gogo/protobuf v1.3.0/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
|
||||
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
|
||||
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
|
||||
github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
|
||||
@@ -142,15 +141,19 @@ github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm4
|
||||
github.com/googleapis/gnostic v0.0.0-20170426233943-68f4ded48ba9/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
|
||||
github.com/googleapis/gnostic v0.3.0 h1:CcQijm0XKekKjP/YCz28LXVSpgguuB+nCxaSjCe09y0=
|
||||
github.com/googleapis/gnostic v0.3.0/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
|
||||
github.com/gorilla/context v0.0.0-20160226214623-1ea25387ff6f/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
|
||||
github.com/gorilla/mux v1.6.0/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
|
||||
github.com/gorilla/mux v1.7.3 h1:gnP5JzjVOuiZD07fKKToCAOjS0yOpj/qPETTXCCS6hw=
|
||||
github.com/gorilla/mux v1.7.3/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
|
||||
github.com/gorilla/securecookie v0.0.0-20160422134519-667fe4e3466a/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
|
||||
github.com/gorilla/securecookie v1.1.1 h1:miw7JPhV+b/lAHSXz4qd/nN9jRiAFV5FwjeKyCS8BvQ=
|
||||
github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
|
||||
github.com/gorilla/sessions v0.0.0-20160922145804-ca9ada445741/go.mod h1:+WVp8kdw6VhyKExm03PAMRn2ZxnPtm58pV0dBVPdhHE=
|
||||
github.com/gorilla/sessions v1.2.0 h1:S7P+1Hm5V/AT9cjEcUD5uDaQSX0OE577aCXgoaKpYbQ=
|
||||
github.com/gorilla/sessions v1.2.0/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
|
||||
github.com/gorilla/websocket v1.2.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
|
||||
github.com/gorilla/websocket v1.4.0 h1:WDFjx/TMzVgy9VdMMQi2K2Emtwi2QcUQsztZ/zLaH/Q=
|
||||
github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
|
||||
github.com/gorilla/websocket v1.4.1 h1:q7AeDBpnBk8AogcD4DSag/Ukw/KV+YhzLj2bP5HvKCM=
|
||||
github.com/gorilla/websocket v1.4.1/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
|
||||
github.com/gostaticanalysis/analysisutil v0.0.0-20190318220348-4088753ea4d3 h1:JVnpOZS+qxli+rgVl98ILOXVNbW+kb5wcxeGx8ShUIw=
|
||||
github.com/gostaticanalysis/analysisutil v0.0.0-20190318220348-4088753ea4d3/go.mod h1:eEOZF4jCKGi+aprrirO9e7WKB3beBRtWgqGunKl6pKE=
|
||||
github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
|
||||
@@ -168,7 +171,6 @@ github.com/json-iterator/go v1.1.6 h1:MrUvLMLTMxbqFJ9kzlvat/rYZqZnW3u4wkLzWTaFwK
|
||||
github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
|
||||
github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
|
||||
github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
|
||||
github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
|
||||
github.com/kisielk/gotool v1.0.0 h1:AV2c/EiW3KqPNT9ZKl07ehoAGi4C5/01Cfbblndcapg=
|
||||
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
|
||||
github.com/klauspost/compress v1.4.0/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
|
||||
@@ -211,8 +213,8 @@ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJ
|
||||
github.com/modern-go/reflect2 v0.0.0-20180320133207-05fbef0ca5da/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
|
||||
github.com/modern-go/reflect2 v1.0.1 h1:9f412s+6RmYXLWZSEzVVgPGK7C2PphHj5RJrvfx9AWI=
|
||||
github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
|
||||
github.com/monopole/mdrip v0.2.48 h1:LVXlMzEyJOPouL5MYN9z61rMHwatLV1JZZSN+mmI6zI=
|
||||
github.com/monopole/mdrip v0.2.48/go.mod h1:rzORfdNQ63T/tS95GOFHB+I3OrT+Bjlk8krOc/QiL/8=
|
||||
github.com/monopole/mdrip v1.0.0 h1:RFDBa+tab6mW+gX4Ww2SZDc4kS6p01FwnLtgz64Il+I=
|
||||
github.com/monopole/mdrip v1.0.0/go.mod h1:N1/ppRG9CaPeUKAUHZ3dUlfOT81lTpKZLkyhCvTETwM=
|
||||
github.com/mozilla/tls-observatory v0.0.0-20190404164649-a3c1b6cfecfd/go.mod h1:SrKMQvPiws7F7iqYp8/TX+IhxCYhzr6N/1yb8cwHsGk=
|
||||
github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
|
||||
github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
|
||||
@@ -250,6 +252,7 @@ github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40T
|
||||
github.com/quasilyte/go-consistent v0.0.0-20190521200055-c6f3937de18c/go.mod h1:5STLWrekHfjyYwxBRVRXNOSewLJ3PWfDJd1VyTS21fI=
|
||||
github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
|
||||
github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
|
||||
github.com/russross/blackfriday v1.5.2 h1:HyvC0ARfnZBqnXwABFeSZHpKvJHJJfPz81GNueLj0oo=
|
||||
github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
|
||||
github.com/russross/blackfriday v2.0.0+incompatible h1:cBXrhZNUf9C+La9/YpS+UHpUT8YD6Td9ZMSU9APFcsk=
|
||||
github.com/russross/blackfriday v2.0.0+incompatible/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
|
||||
@@ -370,7 +373,6 @@ golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGm
|
||||
golang.org/x/tools v0.0.0-20180525024113-a5b4c53f6e8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20181011042414-1f849cf54d09/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20181117154741-2ddaf7f79a09/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20190110163146-51295c7ec13a/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
|
||||
|
Before Width: | Height: | Size: 53 KiB After Width: | Height: | Size: 53 KiB |
|
Before Width: | Height: | Size: 44 KiB After Width: | Height: | Size: 44 KiB |
|
Before Width: | Height: | Size: 32 KiB After Width: | Height: | Size: 32 KiB |
|
Before Width: | Height: | Size: 5.3 KiB After Width: | Height: | Size: 5.3 KiB |