Pular para o conteúdo principal

Lab 5.3 - Injeção de Configuração em Pods

Objetivos​

Ao final deste lab, você será capaz de:

  • Injetar ConfigMaps como variáveis de ambiente
  • Montar ConfigMaps como volumes
  • Utilizar Secrets de forma segura
  • Entender as diferenças entre env e volumes

Pré-requisitos​

  • Cluster Kubernetes funcional
  • kubectl configurado
  • Compreensão de ConfigMaps e Secrets

Exercício 1: Variáveis de Ambiente a partir de ConfigMap​

Etapa 1: Criar o ConfigMap​

kubectl create configmap app-config \
  --from-literal=database_url=postgresql://localhost:5432/mydb \
  --from-literal=log_level=info \
  --from-literal=max_connections=100

Etapa 2: Criar um Pod com env​

Crie um arquivo pod-env.yaml:

apiVersion: v1
kind: Pod
metadata:
  name: app-pod-env
spec:
  containers:
  - name: app
    image: busybox:1.35
    command: ["sh", "-c", "env | grep -E 'DATABASE|LOG|MAX' && sleep 3600"]
    env:
    - name: DATABASE_URL
      valueFrom:
        configMapKeyRef:
          name: app-config
          key: database_url
    - name: LOG_LEVEL
      valueFrom:
        configMapKeyRef:
          name: app-config
          key: log_level
    - name: MAX_CONNECTIONS
      valueFrom:
        configMapKeyRef:
          name: app-config
          key: max_connections

Etapa 3: Deploy e Verificação​

kubectl apply -f pod-env.yaml
kubectl logs app-pod-env

Exercício 2: envFrom para Todas as Chaves​

Criar um Pod com envFrom​

Crie pod-envfrom.yaml:

apiVersion: v1
kind: Pod
metadata:
  name: app-pod-envfrom
spec:
  containers:
  - name: app
    image: busybox:1.35
    command: ["sh", "-c", "env | grep -E 'database|log|max' && sleep 3600"]
    envFrom:
    - configMapRef:
        name: app-config

Deploy e Verificação​

kubectl apply -f pod-envfrom.yaml
kubectl logs app-pod-envfrom

Exercício 3: ConfigMap como Volume​

Criar um ConfigMap com Arquivo​

cat > nginx.conf <<EOF
server {
    listen 80;
    server_name example.com;
    root /usr/share/nginx/html;
}
EOF

kubectl create configmap nginx-config --from-file=nginx.conf

Criar um Pod com Volume​

Crie pod-volume.yaml:

apiVersion: v1
kind: Pod
metadata:
  name: nginx-pod
spec:
  containers:
  - name: nginx
    image: nginx:1.20
    volumeMounts:
    - name: config
      mountPath: /etc/nginx/conf.d
      readOnly: true
  volumes:
  - name: config
    configMap:
      name: nginx-config

Deploy e Verificação​

kubectl apply -f pod-volume.yaml
kubectl exec nginx-pod -- cat /etc/nginx/conf.d/nginx.conf

Exercício 4: Secrets como Variáveis de Ambiente​

Criar um Secret​

kubectl create secret generic db-secret \
  --from-literal=username=admin \
  --from-literal=password=secret123

Criar um Pod com Secret​

Crie pod-secret-env.yaml:

apiVersion: v1
kind: Pod
metadata:
  name: app-pod-secret
spec:
  containers:
  - name: app
    image: busybox:1.35
    command: ["sh", "-c", "echo 'DB_USER: $DB_USERNAME' && echo 'DB_PASS: $DB_PASSWORD' && sleep 3600"]
    env:
    - name: DB_USERNAME
      valueFrom:
        secretKeyRef:
          name: db-secret
          key: username
    - name: DB_PASSWORD
      valueFrom:
        secretKeyRef:
          name: db-secret
          key: password

Deploy e Verificação​

kubectl apply -f pod-secret-env.yaml
kubectl logs app-pod-secret

Exercício 5: Secrets como Volume​

Criar um Pod com Secret Volume​

Crie pod-secret-volume.yaml:

apiVersion: v1
kind: Pod
metadata:
  name: app-pod-secret-vol
spec:
  containers:
  - name: app
    image: busybox:1.35
    command: ["sh", "-c", "ls -la /etc/secrets && cat /etc/secrets/username && sleep 3600"]
    volumeMounts:
    - name: secrets
      mountPath: /etc/secrets
      readOnly: true
  volumes:
  - name: secrets
    secret:
      secretName: db-secret
      defaultMode: 0400

Deploy e Verificação​

kubectl apply -f pod-secret-volume.yaml
kubectl logs app-pod-secret-vol

Exercício 6: Configuração Completa​

Criar ConfigMap e Secret​

kubectl create configmap app-config \
  --from-literal=app_name=MyApp \
  --from-literal=environment=production

kubectl create secret generic app-secret \
  --from-literal=api_key=secret-api-key-123

Criar um Deployment Completo​

Crie deployment-complete.yaml:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: app-deployment
spec:
  replicas: 2
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
      - name: app
        image: nginx:1.20
        env:
        - name: APP_NAME
          valueFrom:
            configMapKeyRef:
              name: app-config
              key: app_name
        - name: ENVIRONMENT
          valueFrom:
            configMapKeyRef:
              name: app-config
              key: environment
        - name: API_KEY
          valueFrom:
            secretKeyRef:
              name: app-secret
              key: api_key
        volumeMounts:
        - name: config
          mountPath: /etc/config
          readOnly: true
      volumes:
      - name: config
        configMap:
          name: app-config

Deploy e Verificação​

kubectl apply -f deployment-complete.yaml
kubectl get pods -l app=myapp
kubectl exec <pod-name> -- env | grep -E 'APP|ENV|API'

Limpeza​

kubectl delete pod app-pod-env app-pod-envfrom nginx-pod app-pod-secret app-pod-secret-vol
kubectl delete deployment app-deployment
kubectl delete configmap app-config nginx-config
kubectl delete secret db-secret app-secret

Perguntas para Reflexão​

  1. Qual é a diferença entre env e envFrom?
  2. Quando usar um volume ConfigMap vs variáveis de ambiente?
  3. Por que usar readOnly: true para volumes de secrets?
  4. Como as alterações em um ConfigMap afetam os Pods existentes?

Lab criado em: Dezembro de 2024