最小化微服务漏洞 Secret存储敏感数据

示例：将Mysql用户密码保存到Secret中存储 （敏感的数据可以存储在secret当中）

下面就是123456经过base64位编码，-n是去掉换行符

[root@k8s-master ~]# echo -n 123456 | base64
MTIzNDU2

 通过这种方式在yaml文件里面来指定mysql的密码现然是不安全的，mysql可以读取注入的变量MYSQL_ROOT_PASSWORD值作为其密码，以为describe一下就能够看得到。

        env:
        - name: MYSQL_ROOT_PASSWORD
          value: 123456

[root@k8s-master ~]# cat mysql.yaml 
apiVersion: v1
kind: Secret
metadata:
  name: mysql
type: Opaque
data:
  mysql-root-password: "MTIzNDU2"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mysql
spec:
  selector:
    matchLabels:
      app: mysql
  template:
    metadata:
      labels:
        app: mysql
    spec:
      containers:
      - name: db
        image: mysql:5.7.30
        env:
        - name: MYSQL_ROOT_PASSWORD
          valueFrom:
            secretKeyRef:
              name: mysql
              key: mysql-root-password



[root@k8s-master ~]# kubectl get secret
NAME                  TYPE                                  DATA   AGE
default-token-j9294   kubernetes.io/service-account-token   3      239d
mysql                 Opaque                                1      7m24s
[root@k8s-master ~]# kubectl describe secret mysql
Name:         mysql
Namespace:    default
Labels:       <none>
Annotations:  <none>

Type:  Opaque

Data
====
mysql-root-password:  6 bytes





[root@k8s-master ~]# kubectl get pod
NAME                     READY   STATUS    RESTARTS   AGE
mysql-5467bf5d7d-g67dm   1/1     Running   0          6m27s
[root@k8s-master ~]# kubectl exec -it mysql-5467bf5d7d-g67dm bash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
root@mysql-5467bf5d7d-g67dm:/# echo $MYSQL_ROOT_PASSWORD
123456

root@mysql-5467bf5d7d-g67dm:/# mysql -rroot -p123456
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 2
Server version: 5.7.30 MySQL Community Server (GPL)

Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> 

要查看具体的值可以使用如下： 

[root@k8s-master ~]# kubectl get secret mysql -n default -o jsonpath={.data.mysql-root-password} | base64 -d
123456