Use secrets-Scalable Open Financial Architecture(SOFAStack)-阿里云帮助中心

You can use secrets for workload environment variables, command-line arguments, and volumes. You can also use secrets to pull images when you create an application service and configure a pod template.

Prerequisites

A secret is created.

Note

When you use a secret in a pod, the pod and the secret must be in the same namespace.

This topic uses the following secret as an example.

  apiVersion: v1
  kind:Secret
  metadata:
    name: mysecret
namespace: yournamespace  # Change to the current namespace name
  type:Opaque
  data:
    username:my-username # username
    password:******# Must be Base64-encoded

Use a secret to configure a pod volume

You can use Secrets as files in a pod.

Log on to the console. In the navigation pane on the left, click Cluster Management > Clusters.
On the cluster list page, click the name of the target cluster to open the Cluster Details page.
In the navigation pane on the left, click Workloads > Pods.

Click Create from YAML, enter the following content in the editor, and then click Submit.

In the following pod example, the username and password keys from the mysecret secret are saved as files in the /etc/foo directory.

 apiVersion: v1
 kind:Pod
 metadata:
   name: mypod
namespace: yournamespace  # Change to the current namespace name
 spec:
   containers:
- name: mypod
     image: redis
     volumeMounts:
- name: foo
       mountPath:"/etc/foo"
       readOnly:true
   volumes:
- name: foo
     secret:
       secretName: mysecret

Use a secret to set pod environment variables

A secret can be set as an environment variable in a pod.

Log on to the console. In the navigation pane on the left, click Cluster Management > Clusters.
On the cluster list page, click the name of the target cluster to open the Cluster Details page.
In the navigation pane on the left, click Workloads > Pods.

Click Create from YAML, enter the following content in the editor, and then click Submit.

In the following pod example, the username and password keys from the mysecret secret are configured as pod environment variables.

 apiVersion: v1
 kind:Pod
 metadata:
   name: secret-env-pod
namespace: yournamespace  # Change to the current namespace name
 spec:
   containers:
- name: mycontainer
     image: redis
     env:
- name: SECRET_USERNAME
         valueFrom:
           secretKeyRef:
             name: mysecret
             key: username
- name: SECRET_PASSWORD
         valueFrom:
           secretKeyRef:
             name: mysecret
             key: password
   restartPolicy:Never