Docker & Kubernetes for Developers · 课时

使用外部密钥存储安全管理 Secrets

停止提交明文 Secrets，并使用 External Secrets Operator 将 Kubernetes 与 HashiCorp Vault 等外部保管库集成

使用外部密钥存储安全管理 Secrets 是 CoddyKit 上的免费 Docker & Kubernetes for Developers 课时。这是第 4 节课，共 4 节。你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。这是 Docker & Kubernetes for Developers 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Docker & Kubernetes for Developers 课程共包含 4 节课。

本课时的部分内容尚未翻译，以英文显示。

Kubernetes Secrets Are Only Encoded

By default a Kubernetes Secret is just base64-encoded, not encrypted. Anyone with API access or etcd access can read it unless extra protection is added.

Encryption at Rest

A first step is enabling encryption at rest in the API server so Secret data is encrypted before being written to etcd.

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources: ["secrets"]
    providers:
      - aescbc:
          keys:
            - name: key1
              secret: <base64-key>

The Git Problem

In GitOps, committing Secret YAML to a repo leaks credentials. We need secrets that live outside git but still flow into the cluster.

External Secret Stores

Tools like HashiCorp Vault, AWS Secrets Manager, and GCP Secret Manager store secrets centrally with auditing, rotation, and fine-grained access.

The External Secrets Operator

The External Secrets Operator (ESO) syncs values from an external store into native Kubernetes Secrets, so workloads consume them normally.

Defining a SecretStore

A SecretStore tells ESO how to authenticate to the backend.

apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: vault-backend
spec:
  provider:
    vault:
      server: https://vault.example.com
      path: secret
      auth:
        kubernetes:
          role: my-app

Defining an ExternalSecret

An ExternalSecret maps a key in the store to a generated Kubernetes Secret.

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: db-creds
spec:
  secretStoreRef:
    name: vault-backend
    kind: SecretStore
  target:
    name: db-creds
  data:
    - secretKey: password
      remoteRef:
        key: database/prod
        property: password

Automatic Rotation

ESO refreshes synced secrets on an interval, so rotating a value in Vault propagates into the cluster without redeploys.

spec:
  refreshInterval: 1h

Sealed Secrets Alternative

If you must keep secrets in git, Sealed Secrets encrypts them with a cluster-only key, producing a safe-to-commit SealedSecret that only the controller can decrypt.

Limiting Access With RBAC

Restrict who can read Secrets using RBAC, and prefer mounting secrets as files over environment variables to reduce accidental logging.

Avoiding Leaks

Never echo secrets in logs or CI output, and add secret-scanning to your pipeline to catch accidental commits.

Quick Check

Test what you have learned.

Recap

You learned that Secrets are only base64-encoded, how encryption at rest helps, and how the External Secrets Operator syncs from Vault and similar stores, plus Sealed Secrets, rotation, and RBAC to keep credentials safe.

常见问题解答

「使用外部密钥存储安全管理 Secrets」课时是免费的吗？

是的 — 「使用外部密钥存储安全管理 Secrets」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Docker & Kubernetes for Developers 课程的其余内容，请升级到 CoddyKit PRO。 Docker & Kubernetes for Developers 课程共包含 4 节课。

「使用外部密钥存储安全管理 Secrets」这节课中我会学到什么？

停止提交明文 Secrets，并使用 External Secrets Operator 将 Kubernetes 与 HashiCorp Vault 等外部保管库集成你通过在浏览器中直接运行的动手代码来练习 Docker & Kubernetes for Developers，全天候 AI 导师会在你学习这节课的过程中回答你的问题。

学习 Docker & Kubernetes for Developers 需要有经验吗？

无需任何先前经验。CoddyKit 上的 Docker & Kubernetes for Developers 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。这是第 4 节课，共 4 节。

「使用外部密钥存储安全管理 Secrets」课时需要多长时间？

大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。

我能在这节 Docker & Kubernetes for Developers 课中编写并运行代码吗？

能。每节 Docker & Kubernetes for Developers 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。

此课程中的所有课时

← 返回 Docker & Kubernetes for Developers