Docker:
CMD command param1 CMD ["command", "param1"] ex. CMD sleep 5 CMD ["sleep", "5"]
docker run ubuntu sleep 5
FROM Ubuntu
ENTRYPOINT ["sleep"]
docker run ubuntu-sleeper 10
FROM Ubuntu
ENTRYPOINT ["sleep]
CMD["5"]
docker run ubuntu-sleeper
//it takes the default value of 5
and if passed with a new value, it take the passed value.
//modify entrypoint command during runtime
docker run --entrypont sleep2.0 ubuntu-selleper 20
//command goes" sleep2.0 20
Commands and arguments:
//docker run --name ubuntu-sleeper ubuntu-sleeper 10
apiVersion: v1
kind: Pod
metadata:
name: ubuntu-sleeper-pod
spec:
containers:
- name: ubuntu-sleeper
image: ubuntu-sleeper
//ENTRYPOINT
command: ["sleeper2.0"]
//CMD
args: ["10"]
Environment Variable: Can be set using key-value pairs, config maps and secrets
//key-value pair method
apiVersion: v1
kind: Pod
metadata:
name: ubuntu-sleeper-pod
spec:
containers:
- name: ubuntu-sleeper
image: ubuntu-sleeper
//environment
env:
- name: APP-COLOR
value: pink
//config maps
//imperative
// kubectl create configmap <config-name> --from-literal=<key>=<value>
//kubectl create configmap app-config --from-literal=APP_COLOR=blue
//using config-map file
//kubectl create configmap app-config --from-file=<path-of-file>
//adding it to pod definition file
envFrom:
- configMapKeyRef:
name: app-config
//declarative
apiVersion: v1
kind: ConfigMap
metadata:
name: app-config
data:
APP_COLOR: blue
APP_MPDE: prod
//kubectl get configmaps
//adding config definition into pod definition
containers:
- env:
- name: APP_COLOR
valueFrom:
configMapKeyRef:
name: webapp-config-map
key: APP_COLOR
//secrets
env:
- name: APP-COLOR
valueFrom:
secretKeyRef:
Secrets:
These are used to store sensitive information. There are two steps to work with secrets.
- Create the secrets
//imperative
//kubectl create secret generic
//declarative //kubectl create -f
apiVersion: v1
kind: Secret
metadata:
name: app-secret
data:
DB_HOST: mysql
DB_USERNAME: admin
DB:PASSWORD: myapssword
//the secrets can be ecoded using:
//echo -n 'mysql' | base64
//kubectl get secrets //kubectl describe secrets
//decrypting base62 secrets //echo -n 'base62ecoded' | base64 –decode
- Inject the secrets into the pod
//
spec:
containers:
- name: simple-app
image: simple-app
envFrom:
-secretRef:
//app-secret is the name of the secret created
name: app-secret
// secret as a single environment variable
env:
- name: DB_Password
valueFrom:
secretKeyRef:
name: app-secret
key: DB_Password
//secret as a file from a volume
//ls /opt/app-secret-volumes
volume:
- name:
secret:
secretName: app-secret
Note: Secrets are not encrypted only encoded Do not push them to source control Anyone able to create pods/deployment in the same namespace can access the secrets. Configure least-privilege access to secrets using RBAC Use third party secret storage
Encrypting secrets: source: https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/
//set encryption in kube-apiserver config //vim /etc/kubernetes/manifests/kube-apiserver.yaml //if not set create the following yaml file
--encryption-provider-config
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources:
- secrets
- configmaps
- pandas.awesome.bears.example
providers:
- aescbc:
keys:
- name: key1
secret: <BASE 64 ENCODED SECRET>
- identity: {}
ETCDCTL_API=3 etcdctl
–cacert=/etc/kubernetes/pki/etcd/ca.crt
–cert=/etc/kubernetes/pki/etcd/server.crt
–key=/etc/kubernetes/pki/etcd/server.key
get /registry/secrets/default/secret1 | hexdump -C
```