From 020ef5f5c4ff68176e87b2daf60353c3339ffce2 Mon Sep 17 00:00:00 2001 From: buildmaster Date: Wed, 16 Jan 2019 16:27:30 +0000 Subject: [PATCH] Sync docs from master to gh-pages --- ...rnetes_propertysource_implementations.html | 14 ++++++------- single/spring-cloud-kubernetes.html | 14 ++++++------- spring-cloud-kubernetes.xml | 21 +++++++++++++------ 3 files changed, 27 insertions(+), 22 deletions(-) diff --git a/multi/multi__kubernetes_propertysource_implementations.html b/multi/multi__kubernetes_propertysource_implementations.html index e193e974..4d9d6d6c 100644 --- a/multi/multi__kubernetes_propertysource_implementations.html +++ b/multi/multi__kubernetes_propertysource_implementations.html @@ -111,12 +111,10 @@ This behavior is controlled by the spring.cloud.kubernetes addition to or instead of the mechanism described earlier. Multiple (exact) file paths can be specified in spring.cloud.kubernetes.config.paths by using the , delimiter

Table 4.1. Properties:

NameTypeDefaultDescription

spring.cloud.kubernetes.config.enableApi

Boolean

true

Enable/Disable consuming ConfigMaps via APIs

spring.cloud.kubernetes.config.enabled

Boolean

true

Enable Secrets PropertySource

spring.cloud.kubernetes.config.name

String

${spring.application.name}

Sets the name of ConfigMap to lookup

spring.cloud.kubernetes.config.namespace

String

Client namespace

Sets the Kubernetes namespace where to lookup

spring.cloud.kubernetes.config.paths

List

null

Sets the paths where ConfigMaps are mounted


4.2 Secrets PropertySource

Kubernetes has the notion of [Secrets](https://kubernetes.io/docs/concepts/configuration/secret/) for storing sensitive data such as password, OAuth tokens, etc. This project provides integration with Secrets to make secrets -accessible by Spring Boot applications. This feature can be explicitly enabled/disabled using the spring.cloud.kubernetes.secrets.enabled property.

The SecretsPropertySource when enabled will lookup Kubernetes for Secrets from the following sources: -1. reading recursively from secrets mounts -2. named after the application (as defined by spring.application.name) -3. matching some labels

Please note that by default, consuming Secrets via API (points 2 and 3 above) is not enabled for security reasons - and it is recommend that containers share secrets via mounted volumes. Otherwise proper RBAC security configurations must be provided - to make sure that unauthorized access to Secrets occurs.

If the secrets are found their data is made available to the application.

Example:

Let’s assume that we have a spring boot application named demo that uses properties to read its database +accessible by Spring Boot applications. This feature can be explicitly enabled/disabled using the spring.cloud.kubernetes.secrets.enabled property.

The SecretsPropertySource when enabled will lookup Kubernetes for Secrets from the following sources:

  1. reading recursively from secrets mounts
  2. named after the application (as defined by spring.application.name)
  3. matching some labels

Please note that by default, consuming Secrets via API (points 2 and 3 above) is not enabled for security reasons +and it is recommended that containers share secrets via mounted volumes. +If you enable consuming Secrets via API, then it is recommended access to Secrets is limited by an +[authorization policy such as RBAC](https://kubernetes.io/docs/concepts/configuration/secret/#best-practices).

If the secrets are found their data is made available to the application.

Example:

Let’s assume that we have a spring boot application named demo that uses properties to read its database configuration. We can create a Kubernetes secret using the following command:

oc create secret generic db-secret --from-literal=username=user --from-literal=password=p455w0rd

This would create the following secret (shown using oc get secrets db-secret -o yaml):

apiVersion: v1
 data:
   password: cDQ1NXcwcmQ=
@@ -159,7 +157,7 @@ configuration. We can create a Kubernetes secret using the following command:
`
 -Dspring.cloud.kubernetes.secrets.labels.broker=activemq
 -Dspring.cloud.kubernetes.secrets.labels.db=postgresql
-`

Table 4.2. Properties:

NameTypeDefaultDescription

spring.cloud.kubernetes.secrets.enableApi

Boolean

false

Enable/Disable consuming secrets via APIs (examples 2 and 3)

spring.cloud.kubernetes.secrets.enabled

Boolean

true

Enable Secrets PropertySource

spring.cloud.kubernetes.secrets.name

String

${spring.application.name}

Sets the name of the secret to lookup

spring.cloud.kubernetes.secrets.namespace

String

Client namespace

Sets the Kubernetes namespace where to lookup

spring.cloud.kubernetes.secrets.labels

Map

null

Sets the labels used to lookup secrets

spring.cloud.kubernetes.secrets.paths

List

null

Sets the paths where secrets are mounted (example 1)


Notes: +`

Table 4.2. Properties:

NameTypeDefaultDescription

spring.cloud.kubernetes.secrets.enableApi

Boolean

false

Enable/Disable consuming secrets via APIs (examples 2 and 3)

spring.cloud.kubernetes.secrets.enabled

Boolean

true

Enable Secrets PropertySource

spring.cloud.kubernetes.secrets.name

String

${spring.application.name}

Sets the name of the secret to lookup

spring.cloud.kubernetes.secrets.namespace

String

Client namespace

Sets the Kubernetes namespace where to lookup

spring.cloud.kubernetes.secrets.labels

Map

null

Sets the labels used to lookup secrets

spring.cloud.kubernetes.secrets.paths

List

null

Sets the paths where secrets are mounted (example 1)


Notes: - The property spring.cloud.kubernetes.secrets.labels behaves as defined by Map-based binding. - The property spring.cloud.kubernetes.secrets.paths behaves as defined by @@ -209,6 +207,6 @@ The view role on the service account is required in - polling: re-creates the configuration periodically from config maps and secrets to see if it has changed. The polling period can be configured using the property spring.cloud.kubernetes.reload.period and defaults to 15 seconds. It requires the same role as the monitored property source. -This means, for example, that using polling on file mounted secret sources does not require particular privileges.

Table 4.3. Properties:

NameTypeDefaultDescription

spring.cloud.kubernetes.reload.period

Duration

15s

The period for verifying changes when using the polling strategy

spring.cloud.kubernetes.reload.enabled

Boolean

false

Enables monitoring of property sources and configuration reload

spring.cloud.kubernetes.reload.monitoring-config-maps

Boolean

true

Allow monitoring changes in config maps

spring.cloud.kubernetes.reload.monitoring-secrets

Boolean

false

Allow monitoring changes in secrets

spring.cloud.kubernetes.reload.strategy

Enum

refresh

The strategy to use when firing a reload (refresh, restart_context, shutdown)

spring.cloud.kubernetes.reload.mode

Enum

event

Specifies how to listen for changes in property sources (event, polling)


Notes: +This means, for example, that using polling on file mounted secret sources does not require particular privileges.

Table 4.3. Properties:

NameTypeDefaultDescription

spring.cloud.kubernetes.reload.period

Duration

15s

The period for verifying changes when using the polling strategy

spring.cloud.kubernetes.reload.enabled

Boolean

false

Enables monitoring of property sources and configuration reload

spring.cloud.kubernetes.reload.monitoring-config-maps

Boolean

true

Allow monitoring changes in config maps

spring.cloud.kubernetes.reload.monitoring-secrets

Boolean

false

Allow monitoring changes in secrets

spring.cloud.kubernetes.reload.strategy

Enum

refresh

The strategy to use when firing a reload (refresh, restart_context, shutdown)

spring.cloud.kubernetes.reload.mode

Enum

event

Specifies how to listen for changes in property sources (event, polling)


Notes: - Properties under spring.cloud.kubernetes.reload. should not be used in config maps or secrets: changing such properties at runtime may lead to unexpected results; - Deleting a property or the whole config map does not restore the original state of the beans when using the refresh level.

Prev   Next
3. Kubernetes native service discovery Home 5. Ribbon discovery in Kubernetes
\ No newline at end of file diff --git a/single/spring-cloud-kubernetes.html b/single/spring-cloud-kubernetes.html index 32946bd8..1a9d0c42 100644 --- a/single/spring-cloud-kubernetes.html +++ b/single/spring-cloud-kubernetes.html @@ -130,12 +130,10 @@ This behavior is controlled by the spring.cloud.kubernetes addition to or instead of the mechanism described earlier. Multiple (exact) file paths can be specified in spring.cloud.kubernetes.config.paths by using the , delimiter

Table 4.1. Properties:

NameTypeDefaultDescription

spring.cloud.kubernetes.config.enableApi

Boolean

true

Enable/Disable consuming ConfigMaps via APIs

spring.cloud.kubernetes.config.enabled

Boolean

true

Enable Secrets PropertySource

spring.cloud.kubernetes.config.name

String

${spring.application.name}

Sets the name of ConfigMap to lookup

spring.cloud.kubernetes.config.namespace

String

Client namespace

Sets the Kubernetes namespace where to lookup

spring.cloud.kubernetes.config.paths

List

null

Sets the paths where ConfigMaps are mounted


4.2 Secrets PropertySource

Kubernetes has the notion of [Secrets](https://kubernetes.io/docs/concepts/configuration/secret/) for storing sensitive data such as password, OAuth tokens, etc. This project provides integration with Secrets to make secrets -accessible by Spring Boot applications. This feature can be explicitly enabled/disabled using the spring.cloud.kubernetes.secrets.enabled property.

The SecretsPropertySource when enabled will lookup Kubernetes for Secrets from the following sources: -1. reading recursively from secrets mounts -2. named after the application (as defined by spring.application.name) -3. matching some labels

Please note that by default, consuming Secrets via API (points 2 and 3 above) is not enabled for security reasons - and it is recommend that containers share secrets via mounted volumes. Otherwise proper RBAC security configurations must be provided - to make sure that unauthorized access to Secrets occurs.

If the secrets are found their data is made available to the application.

Example:

Let’s assume that we have a spring boot application named demo that uses properties to read its database +accessible by Spring Boot applications. This feature can be explicitly enabled/disabled using the spring.cloud.kubernetes.secrets.enabled property.

The SecretsPropertySource when enabled will lookup Kubernetes for Secrets from the following sources:

  1. reading recursively from secrets mounts
  2. named after the application (as defined by spring.application.name)
  3. matching some labels

Please note that by default, consuming Secrets via API (points 2 and 3 above) is not enabled for security reasons +and it is recommended that containers share secrets via mounted volumes. +If you enable consuming Secrets via API, then it is recommended access to Secrets is limited by an +[authorization policy such as RBAC](https://kubernetes.io/docs/concepts/configuration/secret/#best-practices).

If the secrets are found their data is made available to the application.

Example:

Let’s assume that we have a spring boot application named demo that uses properties to read its database configuration. We can create a Kubernetes secret using the following command:

oc create secret generic db-secret --from-literal=username=user --from-literal=password=p455w0rd

This would create the following secret (shown using oc get secrets db-secret -o yaml):

apiVersion: v1
 data:
   password: cDQ1NXcwcmQ=
@@ -178,7 +176,7 @@ configuration. We can create a Kubernetes secret using the following command:
`
 -Dspring.cloud.kubernetes.secrets.labels.broker=activemq
 -Dspring.cloud.kubernetes.secrets.labels.db=postgresql
-`

Table 4.2. Properties:

NameTypeDefaultDescription

spring.cloud.kubernetes.secrets.enableApi

Boolean

false

Enable/Disable consuming secrets via APIs (examples 2 and 3)

spring.cloud.kubernetes.secrets.enabled

Boolean

true

Enable Secrets PropertySource

spring.cloud.kubernetes.secrets.name

String

${spring.application.name}

Sets the name of the secret to lookup

spring.cloud.kubernetes.secrets.namespace

String

Client namespace

Sets the Kubernetes namespace where to lookup

spring.cloud.kubernetes.secrets.labels

Map

null

Sets the labels used to lookup secrets

spring.cloud.kubernetes.secrets.paths

List

null

Sets the paths where secrets are mounted (example 1)


Notes: +`

Table 4.2. Properties:

NameTypeDefaultDescription

spring.cloud.kubernetes.secrets.enableApi

Boolean

false

Enable/Disable consuming secrets via APIs (examples 2 and 3)

spring.cloud.kubernetes.secrets.enabled

Boolean

true

Enable Secrets PropertySource

spring.cloud.kubernetes.secrets.name

String

${spring.application.name}

Sets the name of the secret to lookup

spring.cloud.kubernetes.secrets.namespace

String

Client namespace

Sets the Kubernetes namespace where to lookup

spring.cloud.kubernetes.secrets.labels

Map

null

Sets the labels used to lookup secrets

spring.cloud.kubernetes.secrets.paths

List

null

Sets the paths where secrets are mounted (example 1)


Notes: - The property spring.cloud.kubernetes.secrets.labels behaves as defined by Map-based binding. - The property spring.cloud.kubernetes.secrets.paths behaves as defined by @@ -228,7 +226,7 @@ The view role on the service account is required in - polling: re-creates the configuration periodically from config maps and secrets to see if it has changed. The polling period can be configured using the property spring.cloud.kubernetes.reload.period and defaults to 15 seconds. It requires the same role as the monitored property source. -This means, for example, that using polling on file mounted secret sources does not require particular privileges.

Table 4.3. Properties:

NameTypeDefaultDescription

spring.cloud.kubernetes.reload.period

Duration

15s

The period for verifying changes when using the polling strategy

spring.cloud.kubernetes.reload.enabled

Boolean

false

Enables monitoring of property sources and configuration reload

spring.cloud.kubernetes.reload.monitoring-config-maps

Boolean

true

Allow monitoring changes in config maps

spring.cloud.kubernetes.reload.monitoring-secrets

Boolean

false

Allow monitoring changes in secrets

spring.cloud.kubernetes.reload.strategy

Enum

refresh

The strategy to use when firing a reload (refresh, restart_context, shutdown)

spring.cloud.kubernetes.reload.mode

Enum

event

Specifies how to listen for changes in property sources (event, polling)


Notes: +This means, for example, that using polling on file mounted secret sources does not require particular privileges.

Table 4.3. Properties:

NameTypeDefaultDescription

spring.cloud.kubernetes.reload.period

Duration

15s

The period for verifying changes when using the polling strategy

spring.cloud.kubernetes.reload.enabled

Boolean

false

Enables monitoring of property sources and configuration reload

spring.cloud.kubernetes.reload.monitoring-config-maps

Boolean

true

Allow monitoring changes in config maps

spring.cloud.kubernetes.reload.monitoring-secrets

Boolean

false

Allow monitoring changes in secrets

spring.cloud.kubernetes.reload.strategy

Enum

refresh

The strategy to use when firing a reload (refresh, restart_context, shutdown)

spring.cloud.kubernetes.reload.mode

Enum

event

Specifies how to listen for changes in property sources (event, polling)


Notes: - Properties under spring.cloud.kubernetes.reload. should not be used in config maps or secrets: changing such properties at runtime may lead to unexpected results; - Deleting a property or the whole config map does not restore the original state of the beans when using the refresh level.

5. Ribbon discovery in Kubernetes

Spring Cloud client applications calling a microservice should be interested on relying on a client load-balancing feature in order to automatically discover at which endpoint(s) it can reach a given service. This mechanism has been diff --git a/spring-cloud-kubernetes.xml b/spring-cloud-kubernetes.xml index 44c9fa2c..42053c95 100644 --- a/spring-cloud-kubernetes.xml +++ b/spring-cloud-kubernetes.xml @@ -272,13 +272,22 @@ Multiple (exact) file paths can be specified in spring.cloud.kubernetes Kubernetes has the notion of [Secrets](https://kubernetes.io/docs/concepts/configuration/secret/) for storing sensitive data such as password, OAuth tokens, etc. This project provides integration with Secrets to make secrets accessible by Spring Boot applications. This feature can be explicitly enabled/disabled using the spring.cloud.kubernetes.secrets.enabled property. -The SecretsPropertySource when enabled will lookup Kubernetes for Secrets from the following sources: -1. reading recursively from secrets mounts -2. named after the application (as defined by spring.application.name) -3. matching some labels +The SecretsPropertySource when enabled will lookup Kubernetes for Secrets from the following sources: + + +reading recursively from secrets mounts + + +named after the application (as defined by spring.application.name) + + +matching some labels + + Please note that by default, consuming Secrets via API (points 2 and 3 above) is not enabled for security reasons - and it is recommend that containers share secrets via mounted volumes. Otherwise proper RBAC security configurations must be provided - to make sure that unauthorized access to Secrets occurs. +and it is recommended that containers share secrets via mounted volumes. +If you enable consuming Secrets via API, then it is recommended access to Secrets is limited by an +[authorization policy such as RBAC](https://kubernetes.io/docs/concepts/configuration/secret/#best-practices). If the secrets are found their data is made available to the application. Example: Let’s assume that we have a spring boot application named demo that uses properties to read its database