nginx - Kubernetes - 如何在不重启 pod 的情况下动态刷新 secret

Question

我有一个安装了 vault 的 kubernetes 集群(通过 helm chart)。

我想将密码从保管库填充到 pod(例如 nginx)中的文件，并每 5 分钟刷新一次密码。

我使用以下配置对其进行测试(使用适当的保险库策略/后端身份验证):

命名空间.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: web

服务账户.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: nginx
  namespace: web
secrets:
- name: nginx

nginx-deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
  namespace: web
  labels:
    app: nginx
    run: nginx
    version: vault-injector
spec:
  replicas: 1
  selector:
    matchLabels:
      run: nginx
      version: vault-injector
  template:
    metadata:
      labels:
        app: nginx
        run: nginx
        version: vault-injector
      annotations:
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/role: "nginx"
        #vault.hashicorp.com/agent-inject-status: "update"
        vault.hashicorp.com/agent-inject-secret-nginx.pass: "infrastructure/nginx/"
    spec:
      serviceAccountName: nginx
      containers:
        - name: nginx
          image: nginx
          ports:
            - name: http
              containerPort: 80    

当我将这个配置应用到我的 kubernetes 集群时，部署被创建并且我的 secret 被填充到/vault/secret/nginx.pass(如预期的那样)。

kubectl exec -it pod/nginx-69955d8744-v9jm2 -n web -- cat /vault/secrets/nginx.pass
Password1: MySecretPassword1
Password2: MySecretPassword2

我尝试更新 kv 并在 nginx kv 上添加密码，但我的 pod 没有刷新/vault/secrets/nginx.pass 上的文件。如果我重新启动，我的 secret 就会被填满

是否可以动态刷新kv？最好的方法是什么？我想使用 vault 作为配置管理器，并且能够在不重启 pod 的情况下修改 kv。

Answer 1

您可以通过指定 TTL 值在您的 kv secret 上定义 TTL。例如:

 vault kv put infrastructure/nginx ttl=1m Password1=PasswordUpdated1 Password2=PasswordUpdated2

每分钟都会使您的基础设施/nginx 密码过期。 Vault sidecar 将自动检查新值并将文件刷新到您的 pod 中。

root@LAP-INFO-28:/mnt/c/Users/cmonsieux/Desktop/IAC/kubernetes/yaml/simplePod# k logs nginx-69955d8744-mwhmf vault-agent -n web
    renewal process
    2020-09-06T07:16:42.867Z [INFO]  sink.file: token written: path=/home/vault/.vault-token
    2020-09-06T07:16:42.867Z [INFO]  template.server: template server received new token
    2020/09/06 07:16:42.867793 [INFO] (runner) stopping
    2020/09/06 07:16:42.867869 [INFO] (runner) creating new runner (dry: false, once: false)
    2020/09/06 07:16:42.868051 [INFO] (runner) creating watcher
    2020/09/06 07:16:42.868101 [INFO] (runner) starting
    2020-09-06T07:16:42.900Z [INFO]  auth.handler: renewed auth token
    2020/09/06 07:18:26.268835 [INFO] (runner) rendered "(dynamic)" => "/vault/secrets/nginx.pass"
    2020/09/06 07:19:18.810479 [INFO] (runner) rendered "(dynamic)" => "/vault/secrets/nginx.pass"
    2020/09/06 07:24:41.189868 [INFO] (runner) rendered "(dynamic)" => "/vault/secrets/nginx.pass"
    2020/09/06 07:25:36.095547 [INFO] (runner) rendered "(dynamic)" => "/vault/secrets/nginx.pass"
    2020/09/06 07:29:11.479051 [INFO] (runner) rendered "(dynamic)" => "/vault/secrets/nginx.pass"
    2020/09/06 07:31:00.715215 [INFO] (runner) rendered "(dynamic)" => "/vault/secrets/nginx.pass"
root@LAP-INFO-28:/mnt/c/Users/cmonsieux/Desktop/IAC/kubernetes/yaml/simplePod# k exec -it pod/nginx-69955d8744-mwhmf -n web -- cat /vault/secrets/nginx.pass
Password1: PasswordUpdated1
Password2: PasswordUpdated2
ttl: 1m