[zh] sync managing-secret-using-kubectl.md

pull/38034/head
Michael 2022-11-24 07:45:23 +08:00
parent 3d813eb490
commit 7e1192fe97
1 changed files with 83 additions and 76 deletions

View File

@ -58,7 +58,7 @@ Run the following command:
```shell ```shell
kubectl create secret generic db-user-pass \ kubectl create secret generic db-user-pass \
--from-literal=username=devuser \ --from-literal=username=admin \
--from-literal=password='S!B\*d$zDsb=' --from-literal=password='S!B\*d$zDsb='
``` ```
@ -84,6 +84,7 @@ characters.
echo -n 'admin' | base64 > ./username.txt echo -n 'admin' | base64 > ./username.txt
echo -n 'S!B\*d$zDsb=' | base64 > ./password.txt echo -n 'S!B\*d$zDsb=' | base64 > ./password.txt
``` ```
<!-- <!--
The `-n` flag ensures that the generated files do not have an extra newline The `-n` flag ensures that the generated files do not have an extra newline
character at the end of the text. This is important because when `kubectl` character at the end of the text. This is important because when `kubectl`
@ -105,6 +106,7 @@ characters.
--from-file=./username.txt \ --from-file=./username.txt \
--from-file=./password.txt --from-file=./password.txt
``` ```
<!-- <!--
The default key name is the file name. You can optionally set the key name The default key name is the file name. You can optionally set the key name
using `--from-file=[key=]source`. For example: using `--from-file=[key=]source`. For example:
@ -140,6 +142,9 @@ Check that the Secret was created:
kubectl get secrets kubectl get secrets
``` ```
<!--
The output is similar to:
-->
输出类似于: 输出类似于:
``` ```
@ -197,38 +202,45 @@ accidentally, or from being stored in a terminal log.
kubectl get secret db-user-pass -o jsonpath='{.data}' kubectl get secret db-user-pass -o jsonpath='{.data}'
``` ```
<!-- The output is similar to: --> <!--
The output is similar to:
-->
输出类似于: 输出类似于:
```json ```json
{"password":"UyFCXCpkJHpEc2I9","username":"YWRtaW4="} {"password":"UyFCXCpkJHpEc2I9","username":"YWRtaW4="}
``` ```
<!-- 2. Decode the `password` data: --> <!--
2. Decode the `password` data:
-->
2. 解码 `password` 数据: 2. 解码 `password` 数据:
```shell ```shell
echo 'UyFCXCpkJHpEc2I9' | base64 --decode echo 'UyFCXCpkJHpEc2I9' | base64 --decode
``` ```
<!-- The output is similar to: --> <!--
The output is similar to:
-->
输出类似于: 输出类似于:
``` ```
S!B\*d$zDsb= S!B\*d$zDsb=
``` ```
{{< caution >}}
<!-- <!--
{{<caution>}}This is an example for documentation purposes. In practice, This is an example for documentation purposes. In practice,
this method could cause the command with the encoded data to be stored in this method could cause the command with the encoded data to be stored in
your shell history. Anyone with access to your computer could find the your shell history. Anyone with access to your computer could find the
command and decode the secret. A better approach is to combine the view and command and decode the secret. A better approach is to combine the view and
decode commands.{{</caution>}} decode commands.
--> -->
{{<caution>}}
这是一个出于文档编制目的的示例。实际上,该方法可能会导致包含编码数据的命令存储在 这是一个出于文档编制目的的示例。实际上,该方法可能会导致包含编码数据的命令存储在
Shell 的历史记录中。任何可以访问你的计算机的人都可以找到该命令并对 Secret 进行解码。 Shell 的历史记录中。任何可以访问你的计算机的人都可以找到该命令并对 Secret 进行解码。
更好的办法是将查看和解码命令一同使用。{{</caution>}} 更好的办法是将查看和解码命令一同使用。
{{< /caution >}}
```shell ```shell
kubectl get secret db-user-pass -o jsonpath='{.data.password}' | base64 --decode kubectl get secret db-user-pass -o jsonpath='{.data.password}' | base64 --decode
@ -256,6 +268,7 @@ This opens your default editor and allows you to update the base64 encoded
Secret values in the `data` field, such as in the following example: Secret values in the `data` field, such as in the following example:
--> -->
这将打开默认编辑器,并允许你更新 `data` 字段中的 base64 编码的 Secret 值,示例如下: 这将打开默认编辑器,并允许你更新 `data` 字段中的 base64 编码的 Secret 值,示例如下:
<!-- <!--
# Please edit the object below. Lines beginning with a '#' will be ignored, # Please edit the object below. Lines beginning with a '#' will be ignored,
# and an empty file will abort the edit. If an error occurs while saving this file, it will be # and an empty file will abort the edit. If an error occurs while saving this file, it will be
@ -264,11 +277,9 @@ Secret values in the `data` field, such as in the following example:
--> -->
```yaml ```yaml
#请编辑下面的对象。以“#”开头的行将被忽略, #请编辑下面的对象。以“#”开头的行将被忽略,
#空文件将中止编辑。如果在保存此文件时发生错误, #空文件将中止编辑。如果在保存此文件时发生错误,
#则将重新打开该文件并显示相关的失败。 #则将重新打开该文件并显示相关的失败。
#
apiVersion: v1 apiVersion: v1
data: data:
password: UyFCXCpkJHpEc2I9 password: UyFCXCpkJHpEc2I9
@ -297,17 +308,13 @@ To delete a Secret, run the following command:
kubectl delete secret db-user-pass kubectl delete secret db-user-pass
``` ```
<!--
discussion
-->
## {{% heading "whatsnext" %}} ## {{% heading "whatsnext" %}}
<!-- <!--
- Read more about the [Secret concept](/docs/concepts/configuration/secret/) - Read more about the [Secret concept](/docs/concepts/configuration/secret/)
- Learn how to [manage Secrets using config files](/docs/tasks/configmap-secret/managing-secret-using-config-file/) - Learn how to [manage Secrets using config file](/docs/tasks/configmap-secret/managing-secret-using-config-file/)
- Learn how to [manage Secrets using kustomize](/docs/tasks/configmap-secret/managing-secret-using-kustomize/) - Learn how to [manage Secrets using kustomize](/docs/tasks/configmap-secret/managing-secret-using-kustomize/)
--> -->
- 进一步阅读 [Secret 概念](/zh-cn/docs/concepts/configuration/secret/) - 进一步阅读 [Secret 概念](/zh-cn/docs/concepts/configuration/secret/)
- 了解如何[使用配置文件管理 Secret](/zh-cn/docs/tasks/configmap-secret/managing-secret-using-config-file/) - 了解如何[使用配置文件管理 Secret](/zh-cn/docs/tasks/configmap-secret/managing-secret-using-config-file/)
- 了解如何[使用 kustomize 管理 Secret](/zh-cn/docs/tasks/configmap-secret/managing-secret-using-kustomize/) - 了解如何[使用 Kustomize 管理 Secret](/zh-cn/docs/tasks/configmap-secret/managing-secret-using-kustomize/)