前提条件:

  • K8S集群中正确部署了virtual-kubelet(serverless Kubernetes 默认集成)

ECI支持原生的Secret,可以像原生K8S集群一样使用Secret:

# kubectl create secret generic demo --from-literal=raw=test-secret
secret/demo created
# kubectl get secret demo -o yaml
apiVersion: v1
data:
  raw: dGVzdC1zZWNyZXQ=
kind: Secret
metadata:
  creationTimestamp: "2020-01-20T13:14:22Z"
  name: demo
  namespace: default
  resourceVersion: "15357979"
  selfLink: /api/v1/namespaces/default/secrets/demo
  uid: c645990b-3b86-11ea-aa30-3e3af7242710
type: Opaque

将以下内容保存为pod.yaml:

apiVersion: v1
kind: Pod
metadata:
  name: test-secret
spec:
  nodeName: virtual-kubelet
  containers:
  - name: nginx
    image: nginx:latest
    volumeMounts:
    - name: secret-vol
      mountPath: "/cache-test"
      readOnly: true
  volumes:
  - name: secret-vol
    secret:
      secretName: demo
      items:
      - key: raw
        path: secrets/raw

使用kubectl创建ECI实例:

# kubectl create -f pod.yaml
pod/test-secret created
# kubectl exec -it test-secret bash
root@test-secret:/# ls /cache-test/
secrets
root@test-secret:/# cat /cache-test/secrets/raw
test-secret

可见,已经将Secret挂载容器内。