K8S下redis哨兵集群使用secret隐藏configmap内明文密码方案详解

news/2025/2/22 17:14:06/

#作者：朱雷

文章目录

  • 一、背景环境及方案说明
    • 1.1、环境说明
    • 1.2、方案一：使用配置文件设置密码
    • 1.3、方案二：使用args 的命令行传参设置密码
  • 二、redis secret configmap deployment参考
    • 2.1 创建secret-redis.yaml参考
    • 2.2 修改configmap配置参考
      • 2.2.1 哨兵节点修改（每个节点都修改）
      • 2.2.2 主从节点配置修改
      • 2.2.3 使用命令行参数指定密码（本小节与上面两小节互斥）
    • 2.3 修改deployment配置参考
      • 2.3.1 master&slaves节点的deployment的yaml修改
      • 2.3.2 哨兵节点的deployment的yaml修改
      • 2.3.4 镜像环境变量参考
  • 三、测试是否生效
  • 四、 注意事项

一、背景环境及方案说明

Redis 哨兵configmap里包含明文密码，需要处理不在configmap内显示明文密码。

1.1、环境说明

方案基于Redis-5.0.14 哨兵版本（5.x，6.x版本兼容）
方案基于redis-sentinel-exporter-5.0.8版本
方案基于容器环境变量
使用两种方案的其中任意一种均可实现

1.2、方案一：使用配置文件设置密码

参照 2.2.1 和2.2.2 修改configmap
参照 2.3.1 和2.3.2 修改deployment

1.3、方案二：使用args 的命令行传参设置密码

参照 2.2.3.1 和2.2.3.2 修改configmap
参照 2.3.3.1 和2.3.3.2 修改deployment

redis_secret_configmap_deployment_16">二、redis secret configmap deployment参考

redisyaml_17">2.1 创建secret-redis.yaml参考

${}内为redis密码的base64的编码，若认证和同步密码不一致分别定义即可
apiVersion: v1
data:password: ${aGFyYm9yMjM0NSM=}
kind: Secret
metadata:name: redis-auth-secretnamespace: paas-middleware

2.2 修改configmap配置参考

2.2.1 哨兵节点修改（每个节点都修改）

apiVersion: v1
data:redis-docker-entrypoint.sh: |#!/bin/bashif [ ! -f "/redis-conf/redis.conf" ]; thencp /etc/redis/redis.conf /redis-conf/redis.conf**echo -e "sentinel auth-pass mymaster ${REDIS_PASSWORD}" >> /redis-conf/redis.conffi**redis-sentinel /redis-conf/redis.conf $@redis.conf: |port 26379protected-mode nodaemonize nosentinel monitor mymaster 169.169.164.253 6379 2sentinel down-after-milliseconds mymaster 15000sentinel failover-timeout mymaster 60000sentinel deny-scripts-reconfig yessentinel parallel-syncs mymaster 2sentinel auth-pass mymaster somepassword   # 删除这行配置
kind: ConfigMap
metadata:labels:app: redis-base-1type: redisname: redis-base-1-sentinel-1namespace: paas-middleware每个哨兵的configmap 都修改下， 有****不带删除线的为新增行

2.2.2 主从节点配置修改

apiVersion: v1
data:redis-docker-entrypoint.sh: |#!/bin/bashif [ ! -f "/redis-conf/redis.conf" ]; thencp /etc/redis/redis.conf /redis-conf/redis.conf**echo -e "masterauth ${REDIS_MASTER_PASSWORD}" >> /redis-conf/redis.confecho -e "requirepass ${REDIS_PASSWORD}" >> /redis-conf/redis.conf**firedis-server /redis-conf/redis.conf $@redis.conf: |bind 0.0.0.0 ::port 6379daemonize noprotected-mode notimeout 300tcp-keepalive 300replica-read-only yesreplica-serve-stale-data yesmaxclients 20000maxmemory 0maxmemory-policy noevictionmasterauth somepassword  # 删除此行配置requirepass somepassword  # 删除此行配置rename-command FLUSHALL ""dir "/data/"pidfile "/data/redis.pid"logfile "/data/redis.log"
kind: ConfigMap
metadata:labels:app: redis-base-1type: redisname: redis-base-1-masternamespace: paas-middleware所有主从configmap配置文件都修改， 有****不带删除线的为新增行

2.2.3 使用命令行参数指定密码（本小节与上面两小节互斥）

  1. 以下为哨兵节点configmap 修改
apiVersion: v1
data:redis-docker-entrypoint.sh: |#!/bin/bashif [ ! -f "/redis-conf/redis.conf" ]; thencp /etc/redis/redis.conf /redis-conf/redis.conffiredis-sentinel /redis-conf/redis.conf $@redis.conf: |port 26379protected-mode nodaemonize nosentinel monitor mymaster 169.169.164.253 6379 2sentinel down-after-milliseconds mymaster 15000sentinel failover-timeout mymaster 60000sentinel deny-scripts-reconfig yessentinel parallel-syncs mymaster 2sentinel auth-pass mymaster somepassword   # 删除这行配置
kind: ConfigMap
metadata:labels:app: redis-base-1type: redisname: redis-base-1-sentinel-1namespace: paas-middleware每个哨兵的configmap 都修改下， 有****不带删除线的为新增行
  1. 以下为主从节点configmap 修改

下面为主从节点实例configmap修改，有****不带删除线为新增行
apiVersion: v1
data:
redis-docker-entrypoint.sh: |#!/bin/bashif [ ! -f "/redis-conf/redis.conf" ]; thencp /etc/redis/redis.conf /redis-conf/redis.conffiredis-server /redis-conf/redis.conf $@
redis.conf: |bind 0.0.0.0 ::port 6379daemonize noprotected-mode notimeout 300tcp-keepalive 300replica-read-only yesreplica-serve-stale-data yesmaxclients 20000maxmemory 0maxmemory-policy noevictionmasterauth somepassword  # 删除此行配置requirepass somepassword  # 删除此行配置rename-command FLUSHALL ""dir "/data/"pidfile "/data/redis.pid"logfile "/data/redis.log"
kind: ConfigMap
metadata:
labels:app: redis-base-1type: redis
name: redis-base-1-master
namespace: paas-middleware

2.3 修改deployment配置参考

2.3.1 master&slaves节点的deployment的yaml修改

所有主从节点配置文件都修改，  有**xxx**为新增行
apiVersion: apps/v1
kind: Deployment
metadata:annotations:
deployment.kubernetes.io/revision: "1"labels:app: redis-base-1type: redisname: redis-base-1-masternamespace: paas-middleware
spec:progressDeadlineSeconds: 600replicas: 1revisionHistoryLimit: 10selector:matchLabels:app: redis-base-1name: redis-base-1-masterservicename: redis-base-1type: rediswithexporter: "yes"strategy:rollingUpdate:maxSurge: 25%maxUnavailable: 25%type: RollingUpdatetemplate:metadata:annotations:prometheus.io/port: "9121"prometheus.io/scrape: "true"labels:app: redis-base-1name: redis-base-1-masterservicename: redis-base-1type: rediswithexporter: "yes"spec:containers:- args:- --replica-announce-ip- 169.169.164.253- --replica-announce-port- "6379"command:- /etc/redis/redis-docker-entrypoint.shimage: harbor.somedomain/paas_middleware/redis-sentinel-main-5.0.8:latestimagePullPolicy: Alwaysname: redis**env:- name: REDIS_PASSWORDvalueFrom:secretKeyRef:name: redis-auth-secretkey: password- name: REDIS_MASTER_PASSWORDvalueFrom:secretKeyRef:name: redis-auth-secretkey: password**ports:- containerPort: 6379name: clientprotocol: TCPresources: {}terminationMessagePath: /dev/termination-logterminationMessagePolicy: FilevolumeMounts:- mountPath: /etc/redis/name: config- mountPath: /dataname: data- mountPath: /redis-confname: actual-config- args:- --redis.addr- redis://localhost:6379- --redis.password- somepassword  #密码替换成 $(REDIS_PASSWORD) 变量- **$(REDIS_PASSWORD)**- --web.listen-address- 0.0.0.0:9121image: harbor.somedomain/paas_middleware/redis-sentinel-exporter-5.0.8:latestimagePullPolicy: Alwaysname: redis-exporter**env:- name: REDIS_PASSWORDvalueFrom:secretKeyRef:name: redis-auth-secretkey: password**ports:- containerPort: 9121name: redis-exporterprotocol: TCPresources: {}terminationMessagePath: /dev/termination-logterminationMessagePolicy: FilednsPolicy: ClusterFirstnodeSelector:kubernetes.io/hostname: 10.179.75.111restartPolicy: AlwaysschedulerName: default-schedulersecurityContext: {}terminationGracePeriodSeconds: 30volumes:- configMap:defaultMode: 509name: redis-base-1-mastername: config- hostPath:path: /data/redis/redis-base-1-master/datatype: ""name: data- hostPath:path: /data/redis/redis-base-1-master/redis-conftype: ""name: actual-config

2.3.2 哨兵节点的deployment的yaml修改


所有哨兵节点配置文件都修改， 有****为新增行
apiVersion: apps/v1
kind: Deployment
metadata:annotations:deployment.kubernetes.io/revision: "1"labels:app: redis-base-1type: redisname: redis-base-1-sentinel-1namespace: paas-middleware
spec:progressDeadlineSeconds: 600replicas: 1revisionHistoryLimit: 10selector:matchLabels:app: redis-base-1name: redis-base-1-sentinel-1role: sentineltype: rediswithexporter: "no"strategy:rollingUpdate:maxSurge: 25%maxUnavailable: 25%type: RollingUpdatetemplate:metadata:creationTimestamp: nulllabels:app: redis-base-1name: redis-base-1-sentinel-1role: sentineltype: rediswithexporter: "no"spec:containers:- args:- --sentinel- announce-ip- 169.169.196.242- --replica-announce-port- "26379"command:- /etc/redis/redis-docker-entrypoint.shimage: harbor.somedomain/paas_middleware/redis-sentinel-main-5.0.8:latestimagePullPolicy: Alwaysname: redis**env:- name: REDIS_PASSWORDvalueFrom:secretKeyRef:name: redis-auth-secretkey: password- name: REDIS_MASTER_PASSWORDvalueFrom:secretKeyRef:name: redis-auth-secretkey: password**ports:- containerPort: 26379name: clientprotocol: TCPresources: {}terminationMessagePath: /dev/termination-logterminationMessagePolicy: FilevolumeMounts:- mountPath: /etc/redis/name: config- mountPath: /dataname: data- mountPath: /redis-confname: actual-configdnsPolicy: ClusterFirstnodeSelector:kubernetes.io/hostname: 10.179.75.111restartPolicy: AlwaysschedulerName: default-schedulersecurityContext: {}terminationGracePeriodSeconds: 30volumes:- configMap:defaultMode: 509name: redis-base-1-sentinel-1name: config- hostPath:path: /data/redis/redis-base-1-sentinel-1/datatype: ""name: data- hostPath:path: /data/redis/redis-base-1-sentinel-1/redis-conftype: ""name: actual-config
status:availableReplicas: 1conditions:- lastTransitionTime: "2023-11-09T03:25:41Z"lastUpdateTime: "2023-11-09T03:25:43Z"message: ReplicaSet "redis-base-1-sentinel-1-668c76f9bc" has successfully progressed.reason: NewReplicaSetAvailablestatus: "True"type: Progressing- lastTransitionTime: "2024-07-21T16:48:34Z"lastUpdateTime: "2024-07-21T16:48:34Z"message: Deployment has minimum availability.reason: MinimumReplicasAvailablestatus: "True"type: AvailableobservedGeneration: 3readyReplicas: 1replicas: 1updatedReplicas: 1

2.3.3 使用命令行参数指定密码（本小节与上面两小节互斥）

  1. 哨兵节点deployment 修改
    所有哨兵节点配置文件都修改， 有****不带删除线的为新增行
apiVersion: apps/v1
kind: Deployment
metadata:annotations:deployment.kubernetes.io/revision: "1"labels:app: redis-base-1type: redisname: redis-base-1-sentinel-1namespace: paas-middleware
spec:progressDeadlineSeconds: 600replicas: 1revisionHistoryLimit: 10selector:matchLabels:app: redis-base-1name: redis-base-1-sentinel-1role: sentineltype: rediswithexporter: "no"strategy:rollingUpdate:maxSurge: 25%maxUnavailable: 25%type: RollingUpdatetemplate:metadata:creationTimestamp: nulllabels:app: redis-base-1name: redis-base-1-sentinel-1role: sentineltype: rediswithexporter: "no"spec:containers:- args:- --sentinel- announce-ip- 169.169.196.242- --replica-announce-port- "26379"- --sentinel- auth-pass- mymaster- $(REDIS_PASSWORD)command:- /etc/redis/redis-docker-entrypoint.shimage: harbor.somedomain/paas_middleware/redis-sentinel-main-5.0.8:latestimagePullPolicy: Alwaysname: redisenv:- name: REDIS_PASSWORDvalueFrom:secretKeyRef:name: redis-auth-secretkey: password- name: REDIS_MASTER_PASSWORDvalueFrom:secretKeyRef:name: redis-auth-secretkey: passwordports:- containerPort: 26379name: clientprotocol: TCPresources: {}terminationMessagePath: /dev/termination-logterminationMessagePolicy: FilevolumeMounts:- mountPath: /etc/redis/name: config- mountPath: /dataname: data- mountPath: /redis-confname: actual-configdnsPolicy: ClusterFirstnodeSelector:kubernetes.io/hostname: 10.179.75.111restartPolicy: AlwaysschedulerName: default-schedulersecurityContext: {}terminationGracePeriodSeconds: 30volumes:- configMap:defaultMode: 509name: redis-base-1-sentinel-1name: config- hostPath:path: /data/redis/redis-base-1-sentinel-1/datatype: ""name: data- hostPath:path: /data/redis/redis-base-1-sentinel-1/redis-conftype: ""name: actual-config
status:availableReplicas: 1conditions:- lastTransitionTime: "2023-11-09T03:25:41Z"lastUpdateTime: "2023-11-09T03:25:43Z"message: ReplicaSet "redis-base-1-sentinel-1-668c76f9bc" has successfully progressed.reason: NewReplicaSetAvailablestatus: "True"type: Progressing- lastTransitionTime: "2024-07-21T16:48:34Z"lastUpdateTime: "2024-07-21T16:48:34Z"message: Deployment has minimum availability.reason: MinimumReplicasAvailablestatus: "True"type: AvailableobservedGeneration: 3readyReplicas: 1replicas: 1updatedReplicas: 1

2、以下为主从实例deployment 配置修改
所有主从节点配置文件都修改， 有****不带删除线的为新增行

apiVersion: apps/v1
kind: Deployment
metadata:annotations:
deployment.kubernetes.io/revision: "1"labels:app: redis-base-1type: redisname: redis-base-1-masternamespace: paas-middleware
spec:progressDeadlineSeconds: 600replicas: 1revisionHistoryLimit: 10selector:matchLabels:app: redis-base-1name: redis-base-1-masterservicename: redis-base-1type: rediswithexporter: "yes"strategy:rollingUpdate:maxSurge: 25%maxUnavailable: 25%type: RollingUpdatetemplate:metadata:annotations:prometheus.io/port: "9121"prometheus.io/scrape: "true"labels:app: redis-base-1name: redis-base-1-masterservicename: redis-base-1type: rediswithexporter: "yes"spec:containers:- args:- --replica-announce-ip- 169.169.164.253- --replica-announce-port- "6379"- --**requirepass- $(REDIS_PASSWORD)- -- masterauth- $(REDIS_MASTER_PASSWORD)**command:- /etc/redis/redis-docker-entrypoint.shimage: harbor.somedomain/paas_middleware/redis-sentinel-main-5.0.8:latestimagePullPolicy: Alwaysname: redis**env:- name: REDIS_PASSWORDvalueFrom:secretKeyRef:name: redis-auth-secretkey: password- name: REDIS_MASTER_PASSWORDvalueFrom:secretKeyRef:name: redis-auth-secretkey: password**ports:- containerPort: 6379name: clientprotocol: TCPresources: {}terminationMessagePath: /dev/termination-logterminationMessagePolicy: FilevolumeMounts:- mountPath: /etc/redis/name: config- mountPath: /dataname: data- mountPath: /redis-confname: actual-config- args:- --redis.addr- redis://localhost:6379- --redis.password- somepassword  #密码替换成 $(REDIS_PASSWORD) 变量- **$(REDIS_PASSWORD)**- --web.listen-address- 0.0.0.0:9121image: harbor.somedomain/paas_middleware/redis-sentinel-exporter-5.0.8:latestimagePullPolicy: Alwaysname: redis-exporter**env:- name: REDIS_PASSWORDvalueFrom:secretKeyRef:name: redis-auth-secretkey: password**ports:- containerPort: 9121name: redis-exporterprotocol: TCPresources: {}terminationMessagePath: /dev/termination-logterminationMessagePolicy: FilednsPolicy: ClusterFirstnodeSelector:kubernetes.io/hostname: 10.179.75.111restartPolicy: AlwaysschedulerName: default-schedulersecurityContext: {}terminationGracePeriodSeconds: 30volumes:- configMap:defaultMode: 509name: redis-base-1-mastername: config- hostPath:path: /data/redis/redis-base-1-master/datatype: ""name: data- hostPath:path: /data/redis/redis-base-1-master/redis-conftype: ""name: actual-config

2.3.4 镜像环境变量参考

https://hub.docker.com/r/bitnami/redis#configuration
https://github.com/oliver006/redis_exporter#flags

三、测试是否生效

Master节点
在这里插入图片描述
Slave节点
在这里插入图片描述
哨兵节点
在这里插入图片描述
测试redis-sentinel-exporter 指标抓取
在这里插入图片描述

四、 注意事项

  1. 所有节点configmap和deployment yaml 配置文件都按照上面修改别遗漏
  2. 修改完先在测试环境验证没有问题，再连接到连接哨兵集群进行读写测试

http://www.ppmy.cn/news/1574211.html

相关文章

lerobot调试记录

lerobot调试记录

这里写自定义目录标题 libtiff.so undefined symbol libtiff.so undefined symbol anaconda3/envs/lerobot3/lib/python3.10/site-packages/../.././libtiff.so.6: undefined symbol: jpeg12_write_raw_data, version LIBJPEG_8.01.安装库 conda install -c conda-forge jpeg …
阅读更多...
Spring MVC的基本概念

Spring MVC的基本概念

1. Spring MVC 的核心概念 Spring MVC 是基于 MVC 设计模式的框架，其核心组件包括： Controller（控制器）：接收用户请求，处理业务逻辑，并返回视图名称或数据。 Model（模型&#xff0…
阅读更多...
vue中的watch 和 computed 的区别

vue中的watch 和 computed 的区别

1. computed（计算属性） computed 适用于基于已有数据计算出新的数据，具有缓存特性，只有当依赖的值发生变化时才会重新计算。 特点： 有缓存：如果依赖的值没有变化，多次访问 computed 只会返回…
阅读更多...
探秘IP地址与MAC地址：网络世界的身份标识

探秘IP地址与MAC地址：网络世界的身份标识

在互联网的世界里，每台设备就像一个独特的“居民”，而IP地址和MAC地址则是这些“居民”的重要身份标识。它们虽然都与网络通信相关，但却有着明显的区别。接下来，让我们一起深入了解它们的奥秘。 定义与基本概念 IP地址 IP地址&…
阅读更多...
Java-数据结构-(HashMap HashSet)

Java-数据结构-(HashMap HashSet)

一、Tree和Hash的区别 在上一篇文章中，我们讲到了"TreeMap"和"TreeSet"，但当我们刷题的时候却会发现，实际应用Map和Set时，却常常都只会用"HashMap"和"HashSet"，这是为什么呢…
阅读更多...
Linux下文件权限与安全

Linux下文件权限与安全

1.概述 1.1为什么要给文件设置权限？ 为了防止未经授权的用户来访问你的文件，可以在文件和目录上设置权限。还可以设定文件 在创建时所具有的缺省权限：这些只是整个系统安全问题中的一小部分。本文只是简单介绍一下文件的权限与安全。 1.2文…
阅读更多...
【GreatSQL优化器-15】index merge

【GreatSQL优化器-15】index merge

【GreatSQL优化器-15】index merge 一、index merge介绍 GreatSQL的优化器的Index Merge Optimization是查询优化器在处理复杂查询时使用的一种高级技术。当查询的 WHERE 子句中有多个独立的条件，且每个条件都可以使用不同的索引时，优化器会尝试将这些…
阅读更多...
kill -9 结束某个用户所有进程的方式-linux019

kill -9 结束某个用户所有进程的方式-linux019

1. 使用 pkill 命令 pkill 命令可以通过用户名直接终止该用户的所有进程。加上 -9 参数，表示强制结束进程。 pkill -9 -u XXXX 说明：这个命令会使用 SIGKILL 信号（即 kill -9）强制终止 ttlsa 用户的所有进程。 2. 使用 killal…
阅读更多...
最新文章

Copyright @ 2022~2023