文檔 https://docs.docker.com/engine/swarm/secrets/

secret其實就是指敏感信息的保護，如密碼、ssh-key、證書等。

創(chuàng)建secret

有兩種方式

1. 從標準的收入讀取

vagrant@swarm-manager:~$ echo abc123 | docker secret create mysql_pass -
4nkx3vpdd41tbvl9qs24j7m6w
vagrant@swarm-manager:~$ docker secret ls
ID                          NAME         DRIVER    CREATED         UPDATED
4nkx3vpdd41tbvl9qs24j7m6w   mysql_pass             8 seconds ago   8 seconds ago
vagrant@swarm-manager:~$ docker secret inspect mysql_pass
[
    {
        "ID": "4nkx3vpdd41tbvl9qs24j7m6w",
        "Version": {
            "Index": 4562
        },
        "CreatedAt": "2021-07-25T22:36:51.544523646Z",
        "UpdatedAt": "2021-07-25T22:36:51.544523646Z",
        "Spec": {
            "Name": "mysql_pass",
            "Labels": {}
        }
    }
]
vagrant@swarm-manager:~$ docker secret rm mysql_pass
mysql_pass
vagrant@swarm-manager:~$

創(chuàng)建secret中最后的 - 表示從標準輸入讀取數(shù)據(jù)。secret創(chuàng)建后存儲與swarm的raft數(shù)據(jù)庫中。

2. 從文件讀取

vagrant@swarm-manager:~$ ls
mysql_pass.txt
vagrant@swarm-manager:~$ more mysql_pass.txt
abc123
vagrant@swarm-manager:~$ docker secret create mysql_pass mysql_pass.txt
elsodoordd7zzpgsdlwgynq3f
vagrant@swarm-manager:~$ docker secret inspect mysql_pass
[
    {
        "ID": "elsodoordd7zzpgsdlwgynq3f",
        "Version": {
            "Index": 4564
        },
        "CreatedAt": "2021-07-25T22:38:14.143954043Z",
        "UpdatedAt": "2021-07-25T22:38:14.143954043Z",
        "Spec": {
            "Name": "mysql_pass",
            "Labels": {}
        }
    }
]
vagrant@swarm-manager:~$

secret在service中的存儲

• 創(chuàng)建一個busybox的service

[vagrant@swarm-manager ~]$ echo abc123 > mysql_pass
[vagrant@swarm-manager ~]$
[vagrant@swarm-manager ~]$ ls
flask-redis  mysql_pass
[vagrant@swarm-manager ~]$
[vagrant@swarm-manager ~]$ docker create secret mysql_pass^C
[vagrant@swarm-manager ~]$
[vagrant@swarm-manager ~]$
[vagrant@swarm-manager ~]$ docker secret create mysql_pass ^C
[vagrant@swarm-manager ~]$
[vagrant@swarm-manager ~]$ mv mysql_pass mysql_pass.txt
[vagrant@swarm-manager ~]$
[vagrant@swarm-manager ~]$
[vagrant@swarm-manager ~]$ docker secret create mysql_pass mysql_pass.txt
q857fiit06y042kgaurtnfnth
[vagrant@swarm-manager ~]$
[vagrant@swarm-manager ~]$ docker secret ls
ID                          NAME         DRIVER    CREATED         UPDATED
q857fiit06y042kgaurtnfnth   mysql_pass             5 seconds ago   5 seconds ago
[vagrant@swarm-manager ~]$
[vagrant@swarm-manager ~]$ docker service create --name test --secret mysql_pass busybox ping 8.8.8.8
oo9v1zpsd8bh0r4ky7x9sosf7
overall progress: 1 out of 1 tasks
1/1: running   [==================================================>]
verify: Service converged
[vagrant@swarm-manager ~]$
[vagrant@swarm-manager ~]$ docker service ps test
ID             NAME      IMAGE            NODE            DESIRED STATE   CURRENT STATE            ERROR     PORTS
eymo24tj6uqf   test.1    busybox:latest   swarm-worker1   Running         Running 40 seconds ago
[vagrant@swarm-manager ~]$
[vagrant@swarm-manager ~]$

• 在worker1中進入到對應(yīng)容器，在/run/secrets中的與指定secret名稱相同的mysql_pass可查看到secret

[vagrant@swarm-worker1 ~]$ docker container ls
CONTAINER ID   IMAGE               COMMAND                  CREATED          STATUS          PORTS     NAMES
255bfbfa952e   busybox:latest      "ping 8.8.8.8"           26 seconds ago   Up 25 seconds             test.1.eymo24tj6uqf080fdxw8rwdef
f6adfc5dfe31   nicolaka/netshoot   "nsenter --net=/netn…"   5 hours ago      Up 5 hours                interesting_shtern
[vagrant@swarm-worker1 ~]$
[vagrant@swarm-worker1 ~]$ docker exec -it 255 sh
/ #
/ # cd /run/secrets/
/run/secrets # ls
mysql_pass
/run/secrets # more mysql_pass
abc123
/run/secrets #

secret 的使用

參考 https://hub.docker.com/_/mysql

vagrant@swarm-manager:~$ docker service create --name mysql-demo --secret mysql_pass --env MYSQL_ROOT_PASSWORD_FILE=/run/secrets/mysql_pass mysql:5.7
wb4z2ximgqaefephu9f4109c7
overall progress: 1 out of 1 tasks
1/1: running   [==================================================>]
verify: Service converged
vagrant@swarm-manager:~$ docker service ls
ID             NAME         MODE         REPLICAS   IMAGE       PORTS
wb4z2ximgqae   mysql-demo   replicated   1/1        mysql:5.7
vagrant@swarm-manager:~$ docker service ps mysql-demo
ID             NAME           IMAGE       NODE            DESIRED STATE   CURRENT STATE            ERROR     PORTS
909429p4uovy   mysql-demo.1   mysql:5.7   swarm-worker2   Running         Running 32 seconds ago
vagrant@swarm-manager:~$