Skip to content

Commit 511e8b1

Browse files
kolaynekolayne
authored
Merge pull request #11 from kolayne-IU-assignments/lab11
Lab11
2 parents c62920f + 7f85cb9 commit 511e8b1

File tree

9 files changed

+137
-14
lines changed

9 files changed

+137
-14
lines changed

‎k8s/11.md

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
# Secrets
2+
3+
## Kubectl secrets
4+
5+
```
6+
$ kubectl create secret generic demo-secret --from-literal=password=sensitive
7+
secret/demo-secret created
8+
$ kubectl describe secrets/demo-secret
9+
Name: demo-secret
10+
Namespace: default
11+
Labels: <none>
12+
Annotations: <none>
13+
14+
Type: Opaque
15+
16+
Data
17+
====
18+
password: 9 bytes
19+
$ kubectl get secrets/demo-secret -o jsonpath='{.data.password}' | base64 -d; echo
20+
sensitive
21+
$
22+
```
23+
24+
## Helm-secrets-managed secrets
25+
26+
```
27+
$ kubectl get pods
28+
NAME READY STATUS RESTARTS AGE
29+
app-py-797f75bf4f-cb7vz 1/1 Running 0 2m44s
30+
app-py-797f75bf4f-gz2zf 1/1 Running 0 2m44s
31+
app-py-797f75bf4f-lvh57 1/1 Running 0 2m44s
32+
app-py-797f75bf4f-rccl7 1/1 Running 0 2m44s
33+
$ kubectl exec app-py-797f75bf4f-cb7vz -- printenv | grep -i secret
34+
SecretEntry=sensitive
35+
$
36+
```
37+
38+
## Vault-managed secrets
39+
40+
```
41+
$ kubectl exec -it app-py-5db7d795db-qg5xn -- cat /vault/secrets/another_secret.txt
42+
Defaulted container "app-py" out of: app-py, vault-agent, vault-agent-init (init)
43+
data: map[value:sensitive2!]
44+
metadata: map[created_time:2024-04-12T13:15:12.335484444Z custom_metadata:<nil> deletion_time: destroyed:false version:1]
45+
$ kubectl exec -it app-py-5db7d795db-qg5xn -- df
46+
Defaulted container "app-py" out of: app-py, vault-agent, vault-agent-init (init)
47+
Filesystem 1K-blocks Used Available Use% Mounted on
48+
overlay 171367696 130850160 31739760 80% /
49+
tmpfs 65536 0 65536 0% /dev
50+
/dev/nvme0n1p5 171367696 130850160 31739760 80% /dev/termination-log
51+
tmpfs 16211940 4 16211936 0% /vault/secrets
52+
/dev/nvme0n1p5 171367696 130850160 31739760 80% /etc/resolv.conf
53+
/dev/nvme0n1p5 171367696 130850160 31739760 80% /etc/hostname
54+
/dev/nvme0n1p5 171367696 130850160 31739760 80% /etc/hosts
55+
shm 65536 0 65536 0% /dev/shm
56+
tmpfs 16211940 12 16211928 0% /run/secrets/kubernetes.io/serviceaccount
57+
tmpfs 8105968 0 8105968 0% /proc/asound
58+
tmpfs 8105968 0 8105968 0% /proc/acpi
59+
tmpfs 65536 0 65536 0% /proc/kcore
60+
tmpfs 65536 0 65536 0% /proc/keys
61+
tmpfs 65536 0 65536 0% /proc/timer_list
62+
tmpfs 8105968 0 8105968 0% /proc/scsi
63+
tmpfs 8105968 0 8105968 0% /sys/firmware
64+
$
65+
```

‎k8s/app-go/templates/_helpers.tpl

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,3 +60,10 @@ Create the name of the service account to use
6060
{{- default "default" .Values.serviceAccount.name }}
6161
{{- end }}
6262
{{- end }}
63+
64+
{{- define "app-go.environ" -}}
65+
- name: var1
66+
value: val1
67+
- name: var2
68+
value: val2
69+
{{- end }}

‎k8s/app-go/templates/deployment.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,8 @@ spec:
5050
volumeMounts:
5151
{{- toYaml . | nindent 12 }}
5252
{{- end }}
53+
env:
54+
{{ include "app-go.environ" . | nindent 12 }}
5355
{{- with .Values.volumes }}
5456
volumes:
5557
{{- toYaml . | nindent 8 }}

‎k8s/app-go/values.yaml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -51,17 +51,17 @@ ingress:
5151
# hosts:
5252
# - chart-example.local
5353

54-
resources: {}
54+
resources:
5555
# We usually recommend not to specify default resources and to leave this as a conscious
5656
# choice for the user. This also increases chances charts run on environments with little
5757
# resources, such as Minikube. If you do want to specify resources, uncomment the following
5858
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
59-
# limits:
59+
limits:
6060
# cpu: 100m
61-
# memory: 128Mi
62-
# requests:
63-
# cpu: 100m
64-
# memory: 128Mi
61+
memory: 50Mi
62+
requests:
63+
cpu: 2000m
64+
memory: 20Mi
6565

6666
livenessProbe:
6767
httpGet:

‎k8s/app-py/env-secrets.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
password: ENC[AES256_GCM,data:jkIHSRXIJJg6,iv:C1tzrVqcM8p0prM33gbb8qUIH9aC3AmcioOabPiObsM=,tag:ZQROaZu/9SKI014pw6bqkg==,type:str]
2+
sops:
3+
kms: []
4+
gcp_kms: []
5+
azure_kv: []
6+
hc_vault: []
7+
age: []
8+
lastmodified: "2024-04-11T09:21:07Z"
9+
mac: ENC[AES256_GCM,data:FUujMws7tys9W2kqmXegmOLVeOqfpaVR9k8lLXz9xd8FejL30L7n3C6G2lQOdyLxiAoM6QNsd7w391QtDial4EK/s45iIWTTErhltnI+FmtWA+mkKvSz49MXHo0crs9klmi9KrAXkdvNatOzR4U130WKvKg05sNSueU1O2a1Umc=,iv:OXeA+7nnFkP3KegqhUIN8+9zJBEv1J9xo78mjgDkLQo=,tag:aNTwP7Q84Br29x6ZPRWqOw==,type:str]
10+
pgp:
11+
- created_at: "2024-04-11T07:33:06Z"
12+
enc: |-
13+
-----BEGIN PGP MESSAGE-----
14+
15+
hF4D+wRifE+fehgSAQdARWW5wgUqLNWnutSU0gfj5577Mh5GuEhrzO9EHQB5wUYw
16+
ln0wAfD8FifZc8Vsx1J9HUTZ43bD2WJFJPW03CovsPQB/FQ6ruB98eh/qJwi0Uep
17+
1GgBCQIQuDxgGga8HLacn7hlx6Ne6S9ncanhpBt8n0iazmEZ6POWpuABM/4Jtfqw
18+
lEyPVhTG5lHN7gBeH6dUy8p0ToFkr5+cgqKVhkLTC5QDvRDJiFFbVLSFKldVaBlg
19+
2fgJasjY10VeMA==
20+
=SEai
21+
-----END PGP MESSAGE-----
22+
fp: 6B5B7AD70550DCAA8A5E592479753ED3261B7AAB
23+
unencrypted_suffix: _unencrypted
24+
version: 3.8.1

‎k8s/app-py/templates/_helpers.tpl

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,3 +60,10 @@ Create the name of the service account to use
6060
{{- default "default" .Values.serviceAccount.name }}
6161
{{- end }}
6262
{{- end }}
63+
64+
{{- define "app-py.environ" -}}
65+
- name: var1
66+
value: val1
67+
- name: var2
68+
value: val2
69+
{{- end }}

‎k8s/app-py/templates/deployment.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,13 @@ spec:
5050
volumeMounts:
5151
{{- toYaml . | nindent 12 }}
5252
{{- end }}
53+
env:
54+
- name: SecretEntry
55+
valueFrom:
56+
secretKeyRef:
57+
name: env-secret
58+
key: value
59+
{{ include "app-py.environ" . | nindent 12 }}
5360
{{- with .Values.volumes }}
5461
volumes:
5562
{{- toYaml . | nindent 8 }}

‎k8s/app-py/templates/secrets.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: v1
2+
kind: Secret
3+
type: Opaque
4+
metadata:
5+
name: env-secret
6+
data:
7+
value: {{ .Values.password | b64enc | quote }}

‎k8s/app-py/values.yaml

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,13 @@ serviceAccount:
1515
annotations: {}
1616
# The name of the service account to use.
1717
# If not set and create is true, a name is generated using the fullname template
18-
name: ""
18+
name: "web-app"
1919

20-
podAnnotations: {}
20+
podAnnotations:
21+
git: keep
22+
vault.hashicorp.com/agent-inject: 'true'
23+
vault.hashicorp.com/role: 'web-app'
24+
vault.hashicorp.com/agent-inject-secret-another_secret.txt: 'internal/data/another_secret'
2125
podLabels: {}
2226

2327
podSecurityContext: {}
@@ -51,17 +55,17 @@ ingress:
5155
# hosts:
5256
# - chart-example.local
5357

54-
resources: {}
58+
resources:
5559
# We usually recommend not to specify default resources and to leave this as a conscious
5660
# choice for the user. This also increases chances charts run on environments with little
5761
# resources, such as Minikube. If you do want to specify resources, uncomment the following
5862
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
59-
# limits:
63+
limits:
6064
# cpu: 100m
61-
# memory: 128Mi
62-
# requests:
63-
# cpu: 100m
64-
# memory: 128Mi
65+
memory: 60Mi
66+
requests:
67+
cpu: 2000m
68+
memory: 30Mi
6569

6670
livenessProbe:
6771
httpGet:

0 commit comments

Comments
 (0)