Kubernetes配置管理最佳实践

Kubernetes配置管理最佳实践引言在 Kubernetes 中配置管理是应用部署和运维的核心环节。合理的配置管理可以提高应用的可维护性、安全性和灵活性。本文将深入探讨 Kubernetes 中的配置管理方案包括 ConfigMap、Secret、Volume 等核心概念和最佳实践。一、配置管理概述1.1 配置管理层次┌─────────────────────────────────────────────────────────────┐ │ 配置管理层次结构 │ ├─────────────────────────────────────────────────────────────┤ │ │ │ ┌───────────────────┐ │ │ │ 环境变量配置 │ ← 轻量级配置敏感信息应避免 │ │ └────────┬──────────┘ │ │ │ │ │ ┌────────▼───────────┐ │ │ │ ConfigMap │ ← 非敏感配置键值对形式 │ │ └────────┬──────────┘ │ │ │ │ │ ┌────────▼───────────┐ │ │ │ Secret │ ← 敏感配置Base64加密存储 │ │ └────────┬──────────┘ │ │ │ │ │ ┌────────▼───────────┐ │ │ │ Volume │ ← 文件级配置挂载到容器 │ │ └────────┬──────────┘ │ │ │ │ │ ┌────────▼───────────┐ │ │ │ 外部配置中心 │ ← 集中式配置管理 │ │ └───────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────┘1.2 配置管理方案对比方案用途安全性适用场景环境变量简单配置低非敏感配置ConfigMap配置文件中配置文件、命令行参数Secret敏感数据高密码、密钥、证书Volume文件挂载中配置文件、数据文件二、ConfigMap 配置2.1 创建 ConfigMapapiVersion: v1 kind: ConfigMap metadata: name: app-config data: # 简单键值对 database.host: db.example.com database.port: 5432 database.name: mydb # 配置文件内容 app.properties: | server.port8080 server.host0.0.0.0 logging.levelINFO # JSON 配置 config.json: | { debug: false, timeout: 30, retries: 3 }2.2 通过环境变量使用 ConfigMapapiVersion: v1 kind: Pod metadata: name: config-pod spec: containers: - name: app image: my-app:latest env: - name: DB_HOST valueFrom: configMapKeyRef: name: app-config key: database.host - name: DB_PORT valueFrom: configMapKeyRef: name: app-config key: database.port envFrom: - configMapRef: name: app-config2.3 通过 Volume 使用 ConfigMapapiVersion: v1 kind: Pod metadata: name: config-volume-pod spec: containers: - name: app image: my-app:latest volumeMounts: - name: config-volume mountPath: /app/config readOnly: true volumes: - name: config-volume configMap: name: app-config items: - key: app.properties path: app.properties - key: config.json path: config.json2.4 ConfigMap 更新策略apiVersion: apps/v1 kind: Deployment metadata: name: app-deployment spec: replicas: 3 template: spec: containers: - name: app image: my-app:latest volumeMounts: - name: config-volume mountPath: /app/config readOnly: true volumes: - name: config-volume configMap: name: app-config strategy: rollingUpdate: maxSurge: 1 maxUnavailable: 0三、Secret 配置3.1 创建 SecretapiVersion: v1 kind: Secret metadata: name: app-secret type: Opaque data: # Base64 编码的敏感数据 db.password: cGFzc3dvcmQxMjM api.key: YXBpa2V5MTIzNDU tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t... tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQ...3.2 通过环境变量使用 SecretapiVersion: v1 kind: Pod metadata: name: secret-pod spec: containers: - name: app image: my-app:latest env: - name: DB_PASSWORD valueFrom: secretKeyRef: name: app-secret key: db.password - name: API_KEY valueFrom: secretKeyRef: name: app-secret key: api.key3.3 通过 Volume 使用 SecretapiVersion: v1 kind: Pod metadata: name: secret-volume-pod spec: containers: - name: app image: my-app:latest volumeMounts: - name: secret-volume mountPath: /app/secrets readOnly: true volumes: - name: secret-volume secret: secretName: app-secret items: - key: tls.crt path: tls.crt - key: tls.key path: tls.key3.4 TLS SecretapiVersion: v1 kind: Secret metadata: name: tls-secret type: kubernetes.io/tls data: tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t... tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQ...四、Volume 配置4.1 EmptyDir VolumeapiVersion: v1 kind: Pod metadata: name: emptydir-pod spec: containers: - name: app image: my-app:latest volumeMounts: - name: temp-data mountPath: /tmp/data volumes: - name: temp-data emptyDir: sizeLimit: 500Mi4.2 HostPath VolumeapiVersion: v1 kind: Pod metadata: name: hostpath-pod spec: containers: - name: app image: my-app:latest volumeMounts: - name: host-log mountPath: /var/log/myapp volumes: - name: host-log hostPath: path: /var/log/myapp type: DirectoryOrCreate4.3 PersistentVolumeClaim VolumeapiVersion: v1 kind: Pod metadata: name: pvc-pod spec: containers: - name: app image: my-app:latest volumeMounts: - name:># 基础配置 - 通用配置 apiVersion: v1 kind: ConfigMap metadata: name: base-config data: env: production region: us-west-2 # 应用配置 - 应用特定配置 apiVersion: v1 kind: ConfigMap metadata: name: app-config data: app.name: my-app app.version: 1.0.0 # 环境特定配置 - 每个环境独立 apiVersion: v1 kind: ConfigMap metadata: name: env-config data: db.host: prod-db.example.com api.url: https://api.example.com5.2 敏感数据管理# 数据库凭证 apiVersion: v1 kind: Secret metadata: name: db-secret type: Opaque data: username: dXNlcjE password: cGFzc3dvcmQ # API 密钥 apiVersion: v1 kind: Secret metadata: name: api-secret type: Opaque data: key: YXBpa2V5MTIz5.3 配置热更新# 更新 ConfigMap kubectl apply -f configmap.yaml # 查看更新后的配置 kubectl describe configmap app-config # 触发 Pod 滚动更新如果需要 kubectl rollout restart deployment app-deployment5.4 配置验证# 验证 ConfigMap kubectl get configmap app-config -o yaml # 验证 Secret不显示敏感内容 kubectl get secret app-secret -o yaml # 解码 Secret 内容 kubectl get secret app-secret -o jsonpath{.data.db\.password} | base64 -d六、配置管理工具6.1 Helm 配置管理# values.yaml database: host: db.example.com port: 5432 name: mydb secretName: db-secret # templates/deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: {{ .Release.Name }}-app spec: template: spec: containers: - name: app image: my-app:latest env: - name: DB_HOST value: {{ .Values.database.host }} - name: DB_PASSWORD valueFrom: secretKeyRef: name: {{ .Values.database.secretName }} key: password6.2 Kustomize 配置管理# base/deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: app spec: template: spec: containers: - name: app image: my-app:latest env: - name: ENV value: base # overlays/production/deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: app spec: template: spec: containers: - name: app env: - name: ENV value: production - name: DB_HOST value: prod-db.example.com七、配置管理安全实践7.1 最小权限原则apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: config-reader rules: - apiGroups: [] resources: [configmaps, secrets] verbs: [get, list, watch] apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: config-reader-binding roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: config-reader subjects: - kind: ServiceAccount name: app-sa7.2 Secret 加密# 启用 Secret 静态加密 apiVersion: v1 kind: Secret metadata: name: encryption-config type: Opaque data: key: LS0tLS1CRUdJTiBFTkNSWVBURUQgS0VZLS0tLS0t... # 配置 API Server 使用加密 # --encryption-provider-config/etc/kubernetes/encryption-config.yaml7.3 配置审计# 查看所有 ConfigMap kubectl get configmaps --all-namespaces # 查看所有 Secret kubectl get secrets --all-namespaces # 检查 Secret 权限 kubectl auth can-i get secrets --namespacedefault八、总结配置管理是 Kubernetes 运维的核心ConfigMap管理非敏感配置Secret管理敏感数据使用 Base64 编码Volume挂载配置文件到容器分层管理按环境和用途分离配置安全实践最小权限、加密存储、定期审计通过合理配置管理可以提高应用的可维护性和安全性。下一步行动审查现有配置管理方案分离敏感和非敏感配置实施配置分层管理配置访问控制和审计建立配置更新流程