在k8s集群中，往往需要方便的拉取服务所需镜像，但镜像仓库账密铁铁是机密，肯定不能明文存储
那么如何将镜像仓库账号密码，以dockerconfigjson形式存储在Secret中，使服务可以使用imagePullSecrets的形式方便的进行引用呢？
创建Secret
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
| kubectl create secret docker-registry <secret-name> \
--docker-server=<registry-url> \
--docker-username=<username> \
--docker-password=<password> \
kubectl create secret docker-registry harbor \
--docker-server="192.168.10.130" \
--docker-username="admin" \
--docker-password="Harbor12345"
kubectl get secrets
NAME TYPE DATA AGE
default-token-xmc6r kubernetes.io/service-account-token 3 75d
harbor kubernetes.io/dockerconfigjson 1 22s
kubectl describe secrets harbor
Name: harbor
Namespace: default
Labels: <none>
Annotations: <none>
Type: kubernetes.io/dockerconfigjson
Data
====
.dockerconfigjson: 108 bytes
|
解密dockerconfigjson
那么现在我们看到了集群中有这么一个Secret，类型是dockerconfigjson
从其中应该如何反推出其仓库地址，账号和密码呢？
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
| kubectl get secrets
NAME TYPE DATA AGE
default-token-xmc6r kubernetes.io/service-account-token 3 75d
harbor kubernetes.io/dockerconfigjson 1 113s
kubectl get secrets harbor -o yaml
apiVersion: v1
data:
.dockerconfigjson: eyJhdXRocyI6eyIxOTIuMTY4LjEwLjEzMCI6eyJ1c2VybmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiJIYXJib3IxMjM0NSIsImF1dGgiOiJZV1J0YVc0NlNHRnlZbTl5TVRJek5EVT0ifX19
kind: Secret
metadata:
creationTimestamp: "2025-04-22T13:52:48Z"
name: harbor
namespace: default
resourceVersion: "8027982"
uid: 1591f404-af7d-4169-b70b-c3a1be3935b9
type: kubernetes.io/dockerconfigjson
json也行，随你喜欢
echo -n "eyJhdXRocyI6eyIxOTIuMTY4LjEwLjEzMCI6eyJ1c2VybmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiJIYXJib3IxMjM0NSIsImF1dGgiOiJZV1J0YVc0NlNHRnlZbTl5TVRJek5EVT0ifX19" \
| base64 -d
{"auths":{"192.168.10.130":{"username":"admin","password":"Harbor12345","auth":"YWRtaW46SGFyYm9yMTIzNDU="}}}
此时已经可以看出来endpoint和username和password的
有时候只有一个auth字段
可以将auth字段再次进行解密
echo -n "YWRtaW46SGFyYm9yMTIzNDU=" | base64 -d
admin:Harbor12345
得到用户名和密码，中间使用冒号隔开
|
