文档 https://docs.docker.com/engine/swarm/secrets/

secret其实就是指敏感信息的保护，如密码、ssh-key、证书等。

创建secret

有两种方式

1. 从标准的收入读取

  1. vagrant@swarm-manager:~$ echo abc123 | docker secret create mysql_pass -
  2. 4nkx3vpdd41tbvl9qs24j7m6w
  3. vagrant@swarm-manager:~$ docker secret ls
  4. ID                          NAME         DRIVER    CREATED         UPDATED
  5. 4nkx3vpdd41tbvl9qs24j7m6w   mysql_pass             8 seconds ago   8 seconds ago
  6. vagrant@swarm-manager:~$ docker secret inspect mysql_pass
  7. [
  8.     {
  9.         "ID": "4nkx3vpdd41tbvl9qs24j7m6w",
  10.         "Version": {
  11.             "Index": 4562
  12.         },
  13.         "CreatedAt": "2021-07-25T22:36:51.544523646Z",
  14.         "UpdatedAt": "2021-07-25T22:36:51.544523646Z",
  15.         "Spec": {
  16.             "Name": "mysql_pass",
  17.             "Labels": {}
  18.         }
  19.     }
  20. ]
  21. vagrant@swarm-manager:~$ docker secret rm mysql_pass
  22. mysql_pass
  23. vagrant@swarm-manager:~$

创建secret中最后的 - 表示从标准输入读取数据。secret创建后存储与swarm的raft数据库中。

2. 从文件读取

  1. vagrant@swarm-manager:~$ ls
  2. mysql_pass.txt
  3. vagrant@swarm-manager:~$ more mysql_pass.txt
  4. abc123
  5. vagrant@swarm-manager:~$ docker secret create mysql_pass mysql_pass.txt
  6. elsodoordd7zzpgsdlwgynq3f
  7. vagrant@swarm-manager:~$ docker secret inspect mysql_pass
  8. [
  9.     {
  10.         "ID": "elsodoordd7zzpgsdlwgynq3f",
  11.         "Version": {
  12.             "Index": 4564
  13.         },
  14.         "CreatedAt": "2021-07-25T22:38:14.143954043Z",
  15.         "UpdatedAt": "2021-07-25T22:38:14.143954043Z",
  16.         "Spec": {
  17.             "Name": "mysql_pass",
  18.             "Labels": {}
  19.         }
  20.     }
  21. ]
  22. vagrant@swarm-manager:~$

secret在service中的存储

  • 创建一个busybox的service

    1. [vagrant@swarm-manager ~]$ echo abc123 > mysql_pass
    2. [vagrant@swarm-manager ~]$
    3. [vagrant@swarm-manager ~]$ ls
    4. flask-redis  mysql_pass
    5. [vagrant@swarm-manager ~]$
    6. [vagrant@swarm-manager ~]$ docker create secret mysql_pass^C
    7. [vagrant@swarm-manager ~]$
    8. [vagrant@swarm-manager ~]$
    9. [vagrant@swarm-manager ~]$ docker secret create mysql_pass ^C
    10. [vagrant@swarm-manager ~]$
    11. [vagrant@swarm-manager ~]$ mv mysql_pass mysql_pass.txt
    12. [vagrant@swarm-manager ~]$
    13. [vagrant@swarm-manager ~]$
    14. [vagrant@swarm-manager ~]$ docker secret create mysql_pass mysql_pass.txt
    15. q857fiit06y042kgaurtnfnth
    16. [vagrant@swarm-manager ~]$
    17. [vagrant@swarm-manager ~]$ docker secret ls
    18. ID                          NAME         DRIVER    CREATED         UPDATED
    19. q857fiit06y042kgaurtnfnth   mysql_pass             5 seconds ago   5 seconds ago
    20. [vagrant@swarm-manager ~]$
    21. [vagrant@swarm-manager ~]$ docker service create --name test --secret mysql_pass busybox ping 8.8.8.8
    22. oo9v1zpsd8bh0r4ky7x9sosf7
    23. overall progress: 1 out of 1 tasks
    24. 1/1: running   [==================================================>]
    25. verify: Service converged
    26. [vagrant@swarm-manager ~]$
    27. [vagrant@swarm-manager ~]$ docker service ps test
    28. ID             NAME      IMAGE            NODE            DESIRED STATE   CURRENT STATE            ERROR     PORTS
    29. eymo24tj6uqf   test.1    busybox:latest   swarm-worker1   Running         Running 40 seconds ago
    30. [vagrant@swarm-manager ~]$
    31. [vagrant@swarm-manager ~]$

  • 在worker1中进入到对应容器，在/run/secrets中的与指定secret名称相同的mysql_pass可查看到secret

    1. [vagrant@swarm-worker1 ~]$ docker container ls
    2. CONTAINER ID   IMAGE               COMMAND                  CREATED          STATUS          PORTS     NAMES
    3. 255bfbfa952e   busybox:latest      "ping 8.8.8.8"           26 seconds ago   Up 25 seconds             test.1.eymo24tj6uqf080fdxw8rwdef
    4. f6adfc5dfe31   nicolaka/netshoot   "nsenter --net=/netn…"   5 hours ago      Up 5 hours                interesting_shtern
    5. [vagrant@swarm-worker1 ~]$
    6. [vagrant@swarm-worker1 ~]$ docker exec -it 255 sh
    7. / #
    8. / # cd /run/secrets/
    9. /run/secrets # ls
    10. mysql_pass
    11. /run/secrets # more mysql_pass
    12. abc123
    13. /run/secrets #

    secret 的使用

    参考 https://hub.docker.com/_/mysql

    1. vagrant@swarm-manager:~$ docker service create --name mysql-demo --secret mysql_pass --env MYSQL_ROOT_PASSWORD_FILE=/run/secrets/mysql_pass mysql:5.7
    2. wb4z2ximgqaefephu9f4109c7
    3. overall progress: 1 out of 1 tasks
    4. 1/1: running   [==================================================>]
    5. verify: Service converged
    6. vagrant@swarm-manager:~$ docker service ls
    7. ID             NAME         MODE         REPLICAS   IMAGE       PORTS
    8. wb4z2ximgqae   mysql-demo   replicated   1/1        mysql:5.7
    9. vagrant@swarm-manager:~$ docker service ps mysql-demo
    10. ID             NAME           IMAGE       NODE            DESIRED STATE   CURRENT STATE            ERROR     PORTS
    11. 909429p4uovy   mysql-demo.1   mysql:5.7   swarm-worker2   Running         Running 32 seconds ago
    12. vagrant@swarm-manager:~$