Red Hat Summit 红帽全球峰会支持控制台（Console）开发人员开始试用联系人

3.10. What is a secret?

The Secret object type provides a mechanism to hold sensitive information such as passwords, OpenShift Container Platform client configuration files, dockercfg files, private source repository credentials, and so on. Secrets decouple sensitive content from the pods. You can mount secrets into containers using a volume plug-in or the system can use secrets to perform actions on behalf of a pod.

YAML Secret Object Definition

apiVersion: v1
kind: Secret
metadata:
  name: test-secret
  namespace: my-namespace
type: Opaque
1 

data:
2 

  username: dmFsdWUtMQ0K
3 

  password: dmFsdWUtMg0KDQo=
stringData:
4 

  hostname: myapp.mydomain.com
5
Copy to Clipboard Toggle word wrap

1
Indicates the structure of the secret’s key names and values.
2
The allowable format for the keys in the data field must meet the guidelines in the DNS_SUBDOMAIN value in the Kubernetes identifiers glossary.
3
The value associated with keys in the data map must be base64 encoded.
4
Entries in the stringData map are converted to base64 and the entry are then moved to the data map automatically. This field is write-only. The value is only be returned by the data field.
5
The value associated with keys in the stringData map is made up of plain text strings.

3.10.1. Properties of secrets
复制链接

Key properties include:

  • Secret data can be referenced independently from its definition.
  • Secret data volumes are backed by temporary file-storage facilities (tmpfs) and never come to rest on a node.
  • Secret data can be shared within a namespace.

3.10.2. Types of Secrets
复制链接

The value in the type field indicates the structure of the secret’s key names and values. The type can be used to enforce the presence of user names and keys in the secret object. If you do not want validation, use the opaque type, which is the default.

Specify one of the following types to trigger minimal server-side validation to ensure the presence of specific key names in the secret data:

  • kubernetes.io/service-account-token. Uses a service account token.
  • kubernetes.io/dockercfg. Uses the .dockercfg file for required Docker credentials.
  • kubernetes.io/dockerconfigjson. Uses the .docker/config.json file for required Docker credentials.
  • kubernetes.io/basic-auth. Use with basic authentication.
  • kubernetes.io/ssh-auth. Use with SSH key authentication.
  • kubernetes.io/tls. Use with TLS certificate authorities.

Specify type= Opaque if you do not want validation, which means the secret does not claim to conform to any convention for key names or values. An opaque secret, allows for unstructured key:value pairs that can contain arbitrary values.

注意

You can specify other arbitrary types, such as example.com/my-secret-type. These types are not enforced server-side, but indicate that the creator of the secret intended to conform to the key/value requirements of that type.

3.10.3. Updates to secrets
复制链接

When you modify the value of a secret, the value used by an already running pod does not dynamically change. To change a secret, you must delete the original pod and create a new pod, in some cases with an identical PodSpec.

Updating a secret follows the same workflow as deploying a new container image. You can use the kubectl rolling-update command.

The resourceVersion value in a secret is not specified when it is referenced. Therefore, if a secret is updated at the same time as pods are starting, the version of the secret that is used for the pod is not defined.

注意

Currently, it is not possible to check the resource version of a secret object that was used when a pod was created. It is planned that pods report this information, so that a controller could restart ones using a old resourceVersion. In the interim, do not update the data of existing secrets, but create new ones with distinct names.

3.10.4. Creating secrets
复制链接

You must create a secret before creating the pods that depend on that secret.

When creating secrets:

  • Create a secret object with secret data.
  • Update the pod service account to allow the reference to the secret.
  • Create a pod, which consumes the secret as an environment variable or as a file using a secret volume.

Procedure

  • Use the create command to create a secret object from a JSON or YAML file: 

    $ oc create -f <filename>
    Copy to Clipboard Toggle word wrap

    For example, you can create a secret from your local .docker/config.json file: 

    $ oc create secret generic dockerhub \
    --from-file=.dockerconfigjson=<path/to/.docker/config.json> \
    --type=kubernetes.io/dockerconfigjson
    Copy to Clipboard Toggle word wrap

    This command generates a JSON specification of the secret named dockerhub and creates the object. 

    apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Opaque
    1 
    
data:
  username: dXNlci1uYW1l
  password: cGFzc3dvcmQ=
    Copy to Clipboard Toggle word wrap
    1
    Specifies an opaque secret. 
    apiVersion: v1
kind: Secret
metadata:
  name: aregistrykey
  namespace: myapps
type: kubernetes.io/dockerconfigjson
    1 
    
data:
  .dockerconfigjson:bm5ubm5ubm5ubm5ubm5ubm5ubm5ubmdnZ2dnZ2dnZ2dnZ2dnZ2dnZ2cgYXV0aCBrZXlzCg==
    2
    Copy to Clipboard Toggle word wrap
    1
    Specifies that the secret is using a docker configuration JSON file.
    2
    The output of a base64-encoded the docker configuration JSON file

3.10.4.1. Using secrets
复制链接

After creating secrets, you can create a pod to reference your secret, get logs, and delete the pod.

Procedure

  1. Create the pod to reference your secret: 

    $ oc create -f <your_yaml_file>.yaml
    Copy to Clipboard Toggle word wrap

  2. Get the logs: 

    $ oc logs secret-example-pod
    Copy to Clipboard Toggle word wrap

  3. Delete the pod: 

    $ oc delete pod secret-example-pod
    Copy to Clipboard Toggle word wrap

Additional resources

  • Example YAML files with secret data:

    YAML Secret That Will Create Four Files

    apiVersion: v1
kind: Secret
metadata:
  name: test-secret
data:
  username: dmFsdWUtMQ0K
    1 
    
  password: dmFsdWUtMQ0KDQo=
    2 
    
stringData:
  hostname: myapp.mydomain.com
    3 
    
  secret.properties: |-
    4 
    
    property1=valueA
    property2=valueB
    Copy to Clipboard Toggle word wrap

    1
    File contains decoded values.
    2
    File contains decoded values.
    3
    File contains the provided string.
    4
    File contains the provided data.

    YAML of a Pod Populating Files in a Volume with Secret Data

    apiVersion: v1
kind: Pod
metadata:
  name: secret-example-pod
spec:
  containers:
    - name: secret-test-container
      image: busybox
      command: [ "/bin/sh", "-c", "cat /etc/secret-volume/*" ]
      volumeMounts:
          # name must match the volume name below
          - name: secret-volume
            mountPath: /etc/secret-volume
            readOnly: true
  volumes:
    - name: secret-volume
      secret:
        secretName: test-secret
  restartPolicy: Never
    Copy to Clipboard Toggle word wrap

    YAML of a Pod Populating Environment Variables with Secret Data

    apiVersion: v1
kind: Pod
metadata:
  name: secret-example-pod
spec:
  containers:
    - name: secret-test-container
      image: busybox
      command: [ "/bin/sh", "-c", "export" ]
      env:
        - name: TEST_SECRET_USERNAME_ENV_VAR
          valueFrom:
            secretKeyRef:
              name: test-secret
              key: username
  restartPolicy: Never
    Copy to Clipboard Toggle word wrap

    YAML of a Build Config Populating Environment Variables with Secret Data

    apiVersion: v1
kind: BuildConfig
metadata:
  name: secret-example-bc
spec:
  strategy:
    sourceStrategy:
      env:
      - name: TEST_SECRET_USERNAME_ENV_VAR
        valueFrom:
          secretKeyRef:
            name: test-secret
            key: username
    Copy to Clipboard Toggle word wrap

返回顶部
Red Hat logoGithubredditYoutubeTwitter

学习

尝试、购买和销售

社区

关于红帽文档

通过我们的产品和服务，以及可以信赖的内容，帮助红帽用户创新并实现他们的目标。 了解我们当前的更新.

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情，请参阅红帽博客.

關於紅帽

我们提供强化的解决方案，使企业能够更轻松地跨平台和环境（从核心数据中心到网络边缘）工作。

Theme

© 2025 Red Hat