110、通过案例学习Secret （Swarm17）
在下面的例子中，我们会部署一个 WordPress 应用，WordPress 是流行的开源博客系统。
我们将创建一个 Mysql Service ，将密码保存到secret 中。我们还会创建一个 WordPress service ，他将使用 secret 连接Mysql 。这个例子将展示如何使用secret避免在image中存放敏感信息，或者在命令行中直接传递敏感信息。
创建 secret
root@host03:~# openssl rand -base64 20 | docker secret create mysql_root_password - # 直接生成随机字符串并创建secret
4pjwxd6sr9du56wi1zpicejoy
root@host03:~# docker secret inspect mysql_root_password
[
{
"ID": "4pjwxd6sr9du56wi1zpicejoy",
"Version": {
"Index": 17167
},
"CreatedAt": "2019-05-16T06:52:50.88254189Z",
"UpdatedAt": "2019-05-16T06:52:50.88254189Z",
"Spec": {
"Name": "mysql_root_password",
"Labels": {}
}
}
]
root@host03:~# openssl rand -base64 20 > password.txt # 生成随机字符串保存到文件
root@host03:~# docker secret create mysql_root_password_file ./password.txt # 从文件读取密码生成secret
m6rc31lat7wutlcmfxn88z8dy
root@host03:~# docker secret inspect mysql_root_password_file
[
{
"ID": "m6rc31lat7wutlcmfxn88z8dy",
"Version": {
"Index": 17168
},
"CreatedAt": "2019-05-16T06:54:19.792675996Z",
"UpdatedAt": "2019-05-16T06:54:19.792675996Z",
"Spec": {
"Name": "mysql_root_password_file",
"Labels": {}
}
}
]
root@host03:~# openssl rand -base64 20 | docker secret create mysql_password - # 我们这里为WordPress创建一个非root的secret
v6a7aqck9okemsopzc870e6p4
root@host03:~# docker secret inspect mysql_password
[
{
"ID": "v6a7aqck9okemsopzc870e6p4",
"Version": {
"Index": 17169
},
"CreatedAt": "2019-05-16T06:57:15.399204873Z",
"UpdatedAt": "2019-05-16T06:57:15.399204873Z",
"Spec": {
"Name": "mysql_password",
"Labels": {}
}
}
]
root@host03:~# docker secret ls
ID NAME DRIVER CREATED UPDATED
v6a7aqck9okemsopzc870e6p4 mysql_password About a minute ago About a minute ago
4pjwxd6sr9du56wi1zpicejoy mysql_root_password 5 minutes ago 5 minutes ago
m6rc31lat7wutlcmfxn88z8dy mysql_root_password_file 4 minutes ago 4 minutes ago
创建自定义 overlay 网络
root@host03:~# docker network create --driver overlay mysql_private
ssi9vxai6fppn1xfydaoedjth
root@host03:~# docker network ls
NETWORK ID NAME DRIVER SCOPE
c31c660ab056 bridge bridge local
b5ff39d0ca1f docker_gwbridge bridge local
e9f624212e28 host host local
sngp88bsqode ingress overlay swarm
ssi9vxai6fpp mysql_private overlay swarm
39b5e5857095 none null local
创建mysql service
root@host03:~# docker service create --name mysql --network mysql_private --secret source=mysql_root_password,target=mysql_root_password --secret source=mysql_password,target=mysql_password -e MYSQL_ROOT_PASSWORD_FILE='/run/secrets/mysql_root_password' -e MYSQL_PASSWORD_FILE='/run/secrets/mysql_password' -e MYSQL_USER='wordpress' -e MYSQL_DATABASE='wordpress' mysql:5.7
image mysql:latest could not be accessed on a registry to record
its digest. Each node will access mysql:latest independently,
possibly leading to different nodes running different
versions of the image.
wtcc6kth07v7hmf528bfe1p1y
overall progress: 1 out of 1 tasks
1/1: running [==================================================>]
verify: Service converged
root@host03:~# docker service ps mysql
ID NAME IMAGE NODE DESIRED STATE CURRENT STATE ERROR PORTS
p69wao0p573p mysql.1 mysql:latest host01 Running Running about a minute ago
创建 WordPress service
root@host03:~# docker service create --name wordpress --network mysql_private --publish 80:80 --secret source=mysql_password,target=wp_db_password -e WORDPRESS_DB_HOST='mysql:3306' -e WORDPRESS_DB_NAME='wordpress' -e WORDPRESS_DB_USER='wordpress' -e WORDPRESS_DB_PASSWORD_FILE='/run/secrets/wp_db_password' wordpress
sl396197rt8jh52xwsrg7x2gv
overall progress: 1 out of 1 tasks
1/1: running [==================================================>]
verify: Service converged
root@host03:~# docker service ps wordpress
ID NAME IMAGE NODE DESIRED STATE CURRENT STATE ERROR PORTS
bvlccd2fsho2 wordpress.1 wordpress:latest host02 Running Running 17 seconds ago
访问 WordPress页面 http://10.12.31.211
