在 Deployment 中装载一个 secret

Question

正如标题所说，我正在尝试将机密作为卷安装到部署中。

我发现如果 kind: Pod 我可以用这种方式做，但无法在 kind: Deployment

上复制

apiVersion: apps/v1
kind: Deployment

volumeMounts:
     - name: certs-vol
       mountPath: "/certs"
       readOnly: true
volumes:
      - name: certs-vol
        secret:
        secretName: certs-secret

报错如下ValidationError(Deployment.spec.template.spec.volumes[1]): unknown field "secretName" in io.k8s.api.core.v1.Volume, ValidationError(Deployment.spec.template.spec.volumes[2]

有没有办法在部署时做到这一点？

Answer 1

如评论中David Maze所述：

Does secretName: need to be indented one step further (a child of secret:)?

您的 yaml 文件应如下所示：

apiVersion: apps/v1
kind: Deployment

volumeMounts:
     - name: certs-vol
       mountPath: "/certs"
       readOnly: true
volumes:
      - name: certs-vol
        secret:
          secretName: certs-secret

您可以阅读有关 mounting secret as a file 的更多信息。这可能是最有趣的部分：

It is possible to create Secret and pass it as a file or multiple files to Pods.
I've created a simple example for you to illustrate how it works. Below you can see a sample Secret manifest file and Deployment that uses this Secret:
NOTE: I used subPath with Secrets and it works as expected.

apiVersion: v1  
kind: Secret  
metadata:  
  name: my-secret  
data:  
  secret.file1: |  
    c2VjcmV0RmlsZTEK  
  secret.file2: |  
    c2VjcmV0RmlsZTIK  

---  

apiVersion: apps/v1  
kind: Deployment  
metadata:  
...  
    spec:  
      containers:  
      - image: nginx  
        name: nginx  
        volumeMounts:  
        - name: secrets-files  
          mountPath: "/mnt/secret.file1"  # "secret.file1" file will be created in "/mnt" directory  
          subPath: secret.file1  
        - name: secrets-files  
          mountPath: "/mnt/secret.file2"  # "secret.file2" file will be created in "/mnt" directory  
          subPath: secret.file2  
      volumes:  
        - name: secrets-files  
          secret:  
            secretName: my-secret # name of the Secret

Note: Secret should be created before Deployment.