[zh-cn] resync /configmap-secret/managing-secret-using-config-file.md
Michael
windsonsea
parent
7b6094017d
commit
ff17bdf523
|
|
@ -20,97 +20,112 @@ description: Creating Secret objects using resource configuration file.
|
|||
<!-- steps -->
|
||||
|
||||
<!--
|
||||
##Create the Config file
|
||||
## Create the Secret {#create-the-config-file}
|
||||
-->
|
||||
## 创建配置文件 {#create-the-config-file}
|
||||
## 创建 Secret {#create-the-config-file}
|
||||
|
||||
<!--
|
||||
You can create a Secret in a file first, in JSON or YAML format, and then
|
||||
create that object. The
|
||||
You can define the `Secret` object in a manifest first, in JSON or YAML format,
|
||||
and then create that object. The
|
||||
[Secret](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#secret-v1-core)
|
||||
resource contains two maps: `data` and `stringData`.
|
||||
The `data` field is used to store arbitrary data, encoded using base64. The
|
||||
`stringData` field is provided for convenience, and it allows you to provide
|
||||
Secret data as unencoded strings.
|
||||
the same data as unencoded strings.
|
||||
The keys of `data` and `stringData` must consist of alphanumeric characters,
|
||||
`-`, `_` or `.`.
|
||||
`-`, `_` or `.`.
|
||||
-->
|
||||
你可以先用 JSON 或 YAML 格式在文件中创建 Secret，然后创建该对象。
|
||||
你可以先用 JSON 或 YAML 格式在一个清单文件中定义 `Secret` 对象，然后创建该对象。
|
||||
[Secret](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#secret-v1-core)
|
||||
资源包含2个键值对： `data` 和 `stringData`。
|
||||
资源包含 2 个键值对：`data` 和 `stringData`。
|
||||
`data` 字段用来存储 base64 编码的任意数据。
|
||||
提供 `stringData` 字段是为了方便，它允许 Secret 使用未编码的字符串。
|
||||
`data` 和 `stringData` 的键必须由字母、数字、`-`，`_` 或 `.` 组成。
|
||||
`data` 和 `stringData` 的键必须由字母、数字、`-`、`_` 或 `.` 组成。
|
||||
|
||||
<!--
|
||||
For example, to store two strings in a Secret using the `data` field, convert
|
||||
the strings to base64 as follows:
|
||||
The following example stores two strings in a Secret using the `data` field.
|
||||
-->
|
||||
例如，要使用 Secret 的 `data` 字段存储两个字符串，请将字符串转换为 base64 ，如下所示：
|
||||
|
||||
```shell
|
||||
echo -n 'admin' | base64
|
||||
```
|
||||
|
||||
<!--
|
||||
The output is similar to:
|
||||
-->
|
||||
输出类似于：
|
||||
|
||||
```
|
||||
YWRtaW4=
|
||||
```
|
||||
|
||||
```shell
|
||||
echo -n '1f2d1e2e67df' | base64
|
||||
```
|
||||
|
||||
<!--
|
||||
The output is similar to:
|
||||
-->
|
||||
输出类似于：
|
||||
|
||||
```
|
||||
MWYyZDFlMmU2N2Rm
|
||||
```
|
||||
|
||||
<!--
|
||||
Write a Secret config file that looks like this:
|
||||
-->
|
||||
编写一个 Secret 配置文件，如下所示：
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: mysecret
|
||||
type: Opaque
|
||||
data:
|
||||
username: YWRtaW4=
|
||||
password: MWYyZDFlMmU2N2Rm
|
||||
```
|
||||
以下示例使用 `data` 字段在 Secret 中存储两个字符串：
|
||||
|
||||
<!--
|
||||
Note that the name of a Secret object must be a valid
|
||||
[DNS subdomain name](/docs/concepts/overview/working-with-objects/names#dns-subdomain-names).
|
||||
1. Convert the strings to base64:
|
||||
-->
|
||||
注意，Secret 对象的名称必须是有效的 [DNS 子域名](/zh-cn/docs/concepts/overview/working-with-objects/names#dns-subdomain-names)。
|
||||
1. 将这些字符串转换为 base64：
|
||||
|
||||
{{< note >}}
|
||||
<!--
|
||||
The serialized JSON and YAML values of Secret data are encoded as base64
|
||||
strings. Newlines are not valid within these strings and must be omitted. When
|
||||
using the `base64` utility on Darwin/macOS, users should avoid using the `-b`
|
||||
option to split long lines. Conversely, Linux users *should* add the option
|
||||
`-w 0` to `base64` commands or the pipeline `base64 | tr -d '\n'` if the `-w`
|
||||
option is not available.
|
||||
```shell
|
||||
echo -n 'admin' | base64
|
||||
echo -n '1f2d1e2e67df' | base64
|
||||
```
|
||||
|
||||
{{< note >}}
|
||||
<!--
|
||||
The serialized JSON and YAML values of Secret data are encoded as base64 strings. Newlines are not valid within these strings and must be omitted. When using the `base64` utility on Darwin/macOS, users should avoid using the `-b` option to split long lines. Conversely, Linux users *should* add the option `-w 0` to `base64` commands or the pipeline `base64 | tr -d '\n'` if the `-w` option is not available.
|
||||
-->
|
||||
Secret 数据的 JSON 和 YAML 序列化结果是以 base64 编码的。
|
||||
换行符在这些字符串中无效，必须省略。
|
||||
在 Darwin/macOS 上使用 `base64` 工具时，用户不应该使用 `-b` 选项分割长行。
|
||||
相反地，Linux 用户**应该**在 `base64` 地命令中添加 `-w 0` 选项，
|
||||
或者在 `-w` 选项不可用的情况下，输入 `base64 | tr -d '\n'`。
|
||||
{{< /note >}}
|
||||
|
||||
<!--
|
||||
The output is similar to:
|
||||
-->
|
||||
输出类似于：
|
||||
|
||||
```
|
||||
YWRtaW4=
|
||||
MWYyZDFlMmU2N2Rm
|
||||
```
|
||||
<!--
|
||||
1. Create the manifest:
|
||||
-->
|
||||
Secret 数据的 JSON 和 YAML 序列化结果是以 base64 编码的。
|
||||
换行符在这些字符串中无效，必须省略。
|
||||
在 Darwin/macOS 上使用 `base64` 工具时，用户不应该使用 `-b` 选项分割长行。
|
||||
相反地，Linux 用户**应该**在 `base64` 地命令中添加 `-w 0` 选项，
|
||||
或者在 `-w` 选项不可用的情况下，输入 `base64 | tr -d '\n'`。
|
||||
{{< /note >}}
|
||||
2. 创建清单：
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: mysecret
|
||||
type: Opaque
|
||||
data:
|
||||
username: YWRtaW4=
|
||||
password: MWYyZDFlMmU2N2Rm
|
||||
```
|
||||
<!--
|
||||
Note that the name of a Secret object must be a valid
|
||||
[DNS subdomain name](/docs/concepts/overview/working-with-objects/names#dns-subdomain-names).
|
||||
-->
|
||||
注意，Secret 对象的名称必须是有效的 [DNS 子域名](/zh-cn/docs/concepts/overview/working-with-objects/names#dns-subdomain-names)。
|
||||
|
||||
<!--
|
||||
1. Create the Secret using [`kubectl apply`](/docs/reference/generated/kubectl/kubectl-commands#apply):
|
||||
-->
|
||||
3. 使用 [`kubectl apply`](/docs/reference/generated/kubectl/kubectl-commands#apply) 创建 Secret：
|
||||
|
||||
```shell
|
||||
kubectl apply -f ./secret.yaml
|
||||
```
|
||||
|
||||
<!--
|
||||
The output is similar to:
|
||||
-->
|
||||
输出类似于：
|
||||
|
||||
```
|
||||
secret/mysecret created
|
||||
```
|
||||
<!--
|
||||
To verify that the Secret was created and to decode the Secret data, refer to
|
||||
[Managing Secrets using kubectl](/docs/tasks/configmap-secret/managing-secret-using-kubectl/#verify-the-secret).
|
||||
-->
|
||||
若要验证 Secret 被创建以及想要解码 Secret 数据，
|
||||
请参阅[使用 kubectl 管理 Secret](/zh-cn/docs/tasks/configmap-secret/managing-secret-using-kubectl/#verify-the-secret)
|
||||
|
||||
<!--
|
||||
### Specify unencoded data when creating a Secret
|
||||
-->
|
||||
### 创建 Secret 时提供未编码的数据 {#specify-unencoded-data-when-creating-a-secret}
|
||||
|
||||
<!--
|
||||
For certain scenarios, you may wish to use the `stringData` field instead. This
|
||||
|
|
@ -130,7 +145,7 @@ parts of that configuration file during your deployment process.
|
|||
你希望在部署过程中，填入部分内容到该配置文件。
|
||||
|
||||
<!--
|
||||
or example, if your application uses the following configuration file:
|
||||
For example, if your application uses the following configuration file:
|
||||
-->
|
||||
例如，如果你的应用程序使用以下配置文件:
|
||||
|
||||
|
|
@ -158,42 +173,16 @@ stringData:
|
|||
password: <password>
|
||||
```
|
||||
|
||||
<!--
|
||||
## Create the Secret object
|
||||
<!--
|
||||
When you retrieve the Secret data, the command returns the encoded values,
|
||||
and not the plaintext values you provided in `stringData`.
|
||||
|
||||
For example, if you run the following command:
|
||||
-->
|
||||
## 创建 Secret 对象 {#create-the-secret-object}
|
||||
当你检索 Secret 数据时，此命令将返回编码的值，并不是你在 `stringData` 中提供的纯文本值。
|
||||
|
||||
<!--
|
||||
Now create the Secret using [`kubectl apply`](/docs/reference/generated/kubectl/kubectl-commands#apply):
|
||||
-->
|
||||
现在使用 [`kubectl apply`](/docs/reference/generated/kubectl/kubectl-commands#apply) 创建 Secret：
|
||||
|
||||
```shell
|
||||
kubectl apply -f ./secret.yaml
|
||||
```
|
||||
|
||||
<!--
|
||||
The output is similar to:
|
||||
-->
|
||||
输出类似于：
|
||||
|
||||
```
|
||||
secret/mysecret created
|
||||
```
|
||||
|
||||
<!--
|
||||
## Check the Secret
|
||||
-->
|
||||
## 检查 Secret {#check-the-secret}
|
||||
|
||||
<!--
|
||||
The `stringData` field is a write-only convenience field. It is never output when
|
||||
retrieving Secrets. For example, if you run the following command:
|
||||
-->
|
||||
`stringData` 字段是只写的。获取 Secret 时，此字段永远不会输出。
|
||||
例如，如果你运行以下命令：
|
||||
|
||||
|
||||
```shell
|
||||
kubectl get secret mysecret -o yaml
|
||||
```
|
||||
|
|
@ -214,26 +203,21 @@ metadata:
|
|||
namespace: default
|
||||
resourceVersion: "7225"
|
||||
uid: c280ad2e-e916-11e8-98f2-025000000001
|
||||
type: Opaque
|
||||
type:
|
||||
```
|
||||
|
||||
<!--
|
||||
The commands `kubectl get` and `kubectl describe` avoid showing the contents of a `Secret` by
|
||||
default. This is to protect the `Secret` from being exposed accidentally to an onlooker,
|
||||
or from being stored in a terminal log.
|
||||
To check the actual content of the encoded data, please refer to
|
||||
[decoding secret](/docs/tasks/configmap-secret/managing-secret-using-kubectl/#decoding-secret).
|
||||
-->
|
||||
命令 `kubectl get` 和 `kubectl describe` 默认不显示 `Secret` 的内容。
|
||||
这是为了防止 `Secret` 意外地暴露给旁观者或者保存在终端日志中。
|
||||
检查编码数据的实际内容，请参考[解码 secret](/zh-cn/docs/tasks/configmap-secret/managing-secret-using-kubectl/#decoding-secret)。
|
||||
|
||||
<!--
|
||||
If a field, such as `username`, is specified in both `data` and `stringData`,
|
||||
the value from `stringData` is used. For example, the following Secret definition:
|
||||
### Specifying both `data` and `stringData`
|
||||
|
||||
If you specify a field in both `data` and `stringData`, the value from `stringData` is used.
|
||||
|
||||
For example, if you define the following Secret:
|
||||
-->
|
||||
如果在 `data` 和 `stringData` 中都指定了一个字段，比如 `username`，字段值来自 `stringData`。
|
||||
例如，下面的 Secret 定义:
|
||||
### 同时指定 `data` 和 `stringData` {#specifying-both-data-and-stringdata}
|
||||
|
||||
如果你在 `data` 和 `stringData` 中设置了同一个字段，则使用来自 `stringData` 中的值。
|
||||
|
||||
例如，如果你定义以下 Secret：
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
|
|
@ -248,9 +232,9 @@ stringData:
|
|||
```
|
||||
|
||||
<!--
|
||||
Results in the following Secret:
|
||||
The `Secret` object is created as follows:
|
||||
-->
|
||||
结果有以下 Secret：
|
||||
所创建的 `Secret` 对象如下：
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
|
|
@ -267,9 +251,9 @@ type: Opaque
|
|||
```
|
||||
|
||||
<!--
|
||||
Where `YWRtaW5pc3RyYXRvcg==` decodes to `administrator`.
|
||||
`YWRtaW5pc3RyYXRvcg==` decodes to `administrator`.
|
||||
-->
|
||||
其中 `YWRtaW5pc3RyYXRvcg==` 解码成 `administrator`。
|
||||
`YWRtaW5pc3RyYXRvcg==` 解码成 `administrator`。
|
||||
|
||||
<!--
|
||||
## Clean Up
|
||||
|
|
|
|||
Loading…
Reference in New Issue