Using Object Storage
OpenShift leverages the Kubernetes
persistent volume framework and allows you to provision persistent storage using networked storage. This allows Administrators to provide storage for data that needs to persist, regardless of the state of the
pod. For example, a database spun up in OpenShift; you can use an NFS backend storage to save the data.
You can also use storage to save information from an application that takes things like file uploads.
But what if I want my application to run in ANY OpenShift cluster, independent of backend storage?
I can use Object Storage to provide my backend storage and I don't need to have a
persistent volume mapped to my application. This also serves another purpose of being able to deploy my applicaiton in ANY OpenShift environmet and still have the data available; regardless of where it's hosted.
Secret object type in Kubernetes lets you hold sensitive information such as passwords, OpenShift client config files, dockercfg files, private source repository credentials, etc. by abstracting sensitive content from the pods that use it. This can be used in a veriety of ways; but it can be mounted into containers using as a volume and then used as a config file the applicaion reads from.
I have created a simple "uploader" application that uses S3 storage. https://github.com/christianh814/php-object-store
If you take a look at the
index.php file, you'll see in the source code that I am using the
file_get_contents function in order populate the variables needed to connect to S3 (you can see these on lines 211 and 212).
if (!defined('awsAccessKey')) define('awsAccessKey', file_get_contents('/etc/secret/aws-access-key'));
if (!defined('awsSecretKey')) define('awsSecretKey', file_get_contents('/etc/secret/aws-secret-key'));
I will create a new secret that will mount a volume and populate the files with the entries I upload.
NOTE: I am going to assume that you have an
ec2-creds file somewhere with the right environment variables set up.
Deploying And Application With Secrets
First; I will create the application how I would create any other application normally
$ oc new-app openshift/php~https://github.com/christianh814/php-object-store.git --name=uploader
Now I will
ec2-creds file that has the keys to access my AWS account.
$ source ~/ec2-creds
Next, I will create some temp files that has this information.
$ echo -n $AWS_ACCESS_KEY_ID > /tmp/aws-access-key
$ echo -n $AWS_SECRET_ACCESS_KEY > /tmp/aws-secret-key
I will use these files to upload them to OpenShift as a
$ oc secrets new s3secret aws-access-key=/tmp/aws-access-key aws-secret-key=/tmp/aws-secret-key
You can view your secret to verify (NOTE: The values shown are the values in base64)
$ oc get secret s3secret -o json
Next, we need to add the
secret to the
serviceAccount so that it can be used
$ oc secrets add serviceaccounts/default secrets/s3secret
This application expects the secrets to be mounted on
/etc/secret so add your secret config to that mountpoint.
$ oc volume dc/uploader --add --type=secret --secret-name=s3secret -m /etc/secret
This volume addition to the
DeploymentConfig will trigger a deployment of the pod.
If you check the pod; you'll see the secret volume mounted
$ oc get pods
NAME READY STATUS RESTARTS AGE
uploader-1-build 0/1 Completed 0 34m
uploader-2-9ndre 1/1 Running 0 4m
$ oc rsh uploader-2-9ndre
bash-4.2$ df -h /etc/secret
Filesystem Size Used Avail Use% Mounted on
tmpfs 920M 8.0K 920M 1% /etc/secret
bash-4.2$ ls -l /etc/secret/
-r--r--r--. 1 root root 20 Apr 18 17:19 aws-access-key
-r--r--r--. 1 root root 40 Apr 18 17:19 aws-secret-key
Now everything I upload will now appear on my S3 bucket storage account. Additionally, Anywhere I deploy this application; the files will appear in the list. This makes it to where I can deploy this application to an OpenShift cluster in different regions in the US and users will get the same experence no matter which pod/region the users lands on.
In this blog you saw how you can use secrets in order to upload sensitive data inside of OpenShift. Also, you saw how you can use that to create an application that uploads files into an Object Storage system.