如何在库伯奈特斯将“伏尔塔秘密”挂载为文件？

Question

我在库伯奈特斯用哈希科普·库尔特。我试图将秘密文件挂载到我的应用程序所在的主文件夹中。它应该是这样的：/usr/share/nginx/html/.env，而应用程序文件在/usr/share/nginx/html中。但集装箱没有启动，因为这一点。我怀疑/usr/share/nginx/html被Vault覆盖(注释：vault.hashicorp.com/secret-volume-path)。如何仅挂载文件/usr/share/nginx/html/.env

我的注解：

vault.hashicorp.com/agent-init-first: "true"
vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/agent-inject-secret-.env: configs/data/app/dev
vault.hashicorp.com/agent-inject-template-.env: |
  {{- with secret (print "configs/data/app/dev") -}}{{- range $k, $v := .Data.data -}}
  {{ $k }}={{ $v }}
  {{ end }}{{- end -}}
vault.hashicorp.com/role: app
vault.hashicorp.com/secret-volume-path: /usr/share/nginx/html

Answer 1

我试图复制用例，但是我得到了一个错误。

2022/10/21 06:42:12 [error] 29#29: *9 directory index of "/usr/share/nginx/html/" is forbidden, client: 20.1.48.169, server: localhost, request: "GET / HTTP/1.1", host: "20.1.55.62:80"

所以看起来金库也改变了目录权限，因为它在路径中创建了.env，下面是配置

        vault.hashicorp.com/agent-init-first: "true"
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/agent-inject-secret-.env: kv/develop/us-west-2/app1-secrets
        vault.hashicorp.com/agent-inject-template-.env: |
          "{{ with secret "kv/develop/us-west-2/app1-secrets" }}
          {{ range $k, $v := .Data.data }}
           {{ $k }} = "{{ $v }}"
          {{ end }}
          {{ end }} "
        vault.hashicorp.com/agent-limits-ephemeral: ""
        vault.hashicorp.com/secret-volume-path: /usr/share/nginx/html/
        vault.hashicorp.com/agent-inject-file-.env: .env
        vault.hashicorp.com/auth-path: auth/kubernetes/develop/us-west-2
        vault.hashicorp.com/role: rolename

所做的工作是覆盖所需容器的command，对于这个用例，我使用了nginx

command: ["bash", "-c", "cat /vault/secret/.env > /usr/share/nginx/html/.env && nginx -g 'daemon off;' "]

下面是具有虚拟值my-app的compelete示例

apiVersion: apps/v1
kind: Deployment
metadata:
  name: debug-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
      annotations:
        vault.hashicorp.com/agent-init-first: "true"
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/agent-inject-secret-.env: kv/my-app/develop/us-west-2/develop-my-app
        vault.hashicorp.com/agent-inject-template-.env: |
          "{{ with secret "kv/my-app/develop/us-west-2/develop-my-app" }}
          {{ range $k, $v := .Data.data }}
           {{ $k }} = "{{ $v }}"
          {{ end }}
          {{ end }} "
        vault.hashicorp.com/agent-limits-ephemeral: ""
        vault.hashicorp.com/secret-volume-path: /vault/secret/
        vault.hashicorp.com/agent-inject-file-.env: .env
        vault.hashicorp.com/auth-path: auth/kubernetes/develop/us-west-2
        vault.hashicorp.com/role: my-app-develop-my-app
    spec:
      serviceAccountName: develop-my-app
      containers:
        - name: debug
          image: nginx
          command: ["bash", "-c", "cat /vault/secret/.env > /usr/share/nginx/html/.env && nginx -g 'daemon off;' "]
          ports:
            - name: http
              containerPort: 80
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /
              port: http
          readinessProbe:
            httpGet:
              path: /
              port: http