什么是 <none> kubectl 描述 pod 命令中的环境

Question

当我做kubectl describe pod时，我可以看到

Environment:                <none>

就在秘密之后。我想知道它是什么。是否可以将机密分配给环境？(例如本地，开发，暂存，生产？

➜  espace-client git:(master) ✗ kubectl describe pod -n espace-client espace-client-client-6b7b994b4c-gx58t 
Name:           espace-client-client-6b7b994b4c-gx58t
Namespace:      espace-client
Priority:       0
Node:           minikube/192.168.0.85
Start Time:     Fri, 27 Sep 2019 11:37:06 +0200
Labels:         app=espace-client-client
pod-template-hash=6b7b994b4c
Annotations:    kubectl.kubernetes.io/restartedAt: 2019-09-27T11:37:06+02:00
Status:         Running
IP:             172.17.0.21
IPs:            <none>
Controlled By:  ReplicaSet/espace-client-client-6b7b994b4c
Containers:
espace-client-client:
Container ID:   docker://b3ee1efe45bb8ed9f27aca60e3bfecc1d7e29bc12600787d8d674ffb62ffc3f4
Image:          espace_client_client:local
Image ID:       docker://sha256:4cf73af7615ebfd30e7a8b0126154fa12b605dd34ead7cb0eefc43cd3ccc869b
Port:           3000/TCP
Host Port:      0/TCP
State:          Running
Started:      Fri, 27 Sep 2019 11:37:09 +0200
Ready:          True
Restart Count:  0
Environment Variables from:
espace-client-client-env  Secret  Optional: false
Environment:                <none>
Mounts:
/var/run/secrets/kubernetes.io/serviceaccount from default-token-lzb8h (ro)
Conditions:
Type              Status
Initialized       True 
Ready             True 
ContainersReady   True 
PodScheduled      True 
Volumes:
default-token-lzb8h:
Type:        Secret (a volume populated by a Secret)
SecretName:  default-token-lzb8h
Optional:    false
QoS Class:       BestEffort
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
node.kubernetes.io/unreachable:NoExecute for 300s
Events:          <none>

Answer 1

环境部分包含定义为 PodSpec 一部分的任何环境变量：

apiVersion: v1
kind: Pod
metadata:
name: envar-demo
labels:
purpose: demonstrate-envars
spec:
containers:
- name: envar-demo-container
image: gcr.io/google-samples/node-hello:1.0
env:
- name: DEMO_GREETING
value: "Hello from the environment"
- name: DEMO_FAREWELL
value: "Such a sweet sorrow"

这是因为很可能没有为 Pod 定义 Env 变量。您还可以将机密分配给环境。它们将显示在"环境"部分中，如下所示：

SECURITY_JWT_PRIVATEKEY: <set to the key 'privateKey' in secret 'tokens'> Optional: false

例如：

apiVersion: v1
kind: Pod
metadata:
name: secrets-demo
labels:
purpose: demonstrate-secrets-in-env
spec:
containers:
- name: secret-demo-container
image: gcr.io/google-samples/node-hello:1.0
env:
- name: SECRET_PASSWORD
valueFrom:
secretKeyRef:
name: mysecret
key: password