从作业创建或编辑 Kubernetes 机密

Question

我正在尝试从 Kubernetes 作业生成 Kubernetes 机密。秘密是TLS证书，用于elasticsearch传输，我试过这个工作：

apiVersion: batch/v1
kind: Job
metadata:
  name: conso-security-tls-gen-certs
spec:
  template:
    spec:
      containers:
      - name: generator
        volumeMounts:
          - name: certs
            mountPath: "/certs"
        image: "docker.elastic.co/elasticsearch/elasticsearch:7.4.2"
        command: ["/bin/sh", "-c"]
        args:
        - "bin/elasticsearch-certutil ca (...) --silent -out /certs/bundle.p12"
      restartPolicy: Never
      volumes:
      - name: certs
        secret:
          secretName: conso-security-tls-certs
  backoffLimit: 4

但是正如 https://github.com/kubernetes/kubernetes/issues/62099 所说，卷 /certs 是只读的。有没有办法像这样create/edit这个秘密？

Answer 1

一旦 container/pod 消失，

Volumes from secrets 也消失。此外，更新从 Secret 创建的卷中的文件不会更新 Secret 本身。

作业的目标似乎是生成一个证书并创建或更新一个 Secret object with that cert? If that is the case I'd suggest looking into using the Kubernetes API or kubectl to manipulate Secrets from within the running container. You'd need to set up and use a Service Account，该 Secret object with that cert? If that is the case I'd suggest looking into using the Kubernetes API or kubectl to manipulate Secrets from within the running container. You'd need to set up and use a Service Account 有权使用给定命名空间中的 Secrets。

从作业创建或编辑 Kubernetes 机密

Create or edit Kubernetes secret from a job

kubernetes

kubernetes-secrets

kubernetes-jobs