보안 비밀 구성 파일을 gkectl create secrets 명령어에 대한 입력으로 제공합니다. 이 명령어는 보안 비밀 그룹마다 Kubernetes 보안 비밀을 만듭니다(그룹의 각 사용자 인증 정보에 보안 비밀 하나). 이 명령어는 지정된 Kubernetes 네임스페이스의 관리자 클러스터에 보안 비밀을 만듭니다.
시작하려면 보안 비밀 구성 파일의 템플릿을 만듭니다.
gkectl create-config secrets
템플릿
생성된 템플릿을 보려면 클릭합니다.
apiVersion:v1kind:ClusterSecrets# List of secret groups; for admin clusters it allows only one groupsecretGroups:
#(Required for user clusters only) A unique name for secret namespace; it needs to
#have prefix 'gke-onprem-secrets-' (example:gke-onprem-secrets-test)
‐namespace:""# Secrets in this namespacesecrets:# The credentials for vCentervCenter:username:""password:""# The credentials for f5BigIPf5BigIP:username:""password:""# The GCP service account key used to pull GKE imagescomponentAccessServiceAccount:serviceAccountKeyPath:""# The GCP service account key used to register the clusterregisterServiceAccount:serviceAccountKeyPath:""# The GCP service account key used to send logs and metrics from the clusterstackdriverServiceAccount:serviceAccountKeyPath:""# The GCP service account key used to send audit logs from the clustercloudAuditLoggingServiceAccount:serviceAccountKeyPath:""# The credentials for private registryprivateRegistry:username:""password:""
보안 비밀 구성 파일의 필드 입력
secretGroups
객체의 배열. 객체마다 Kubernetes 네임스페이스 이름과 사용자 인증 정보 집합이 있습니다.
관리자 클러스터의 경우 하나의 보안 비밀 그룹만 허용됩니다.
secretGroups[i].namespace
사용자 클러스터 전용.
보안 비밀 집합을 보관할 Kubernetes 네임스페이스의 이름입니다. 이름은 gke-onprem-secrets-로 시작해야 합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-01(UTC)"],[],[],null,["This document describes the fields in a Secrets configuration file. You use a\nSecrets configuration file when you create\n[prepared Secrets](/kubernetes-engine/distributed-cloud/vmware/docs/how-to/prepared-credentials).\n\nA Secrets configuration file holds a set of Secret groups. Each group has\nthe name of a Kubernetes namespace and credentials for one or more of\nthe following:\n\n- vCenter Server\n- F5 BIG-IP\n- A [component access service account](/kubernetes-engine/distributed-cloud/vmware/docs/how-to/service-accounts#component_access_service_account)\n- A [connect-register service account](/kubernetes-engine/distributed-cloud/vmware/docs/how-to/service-accounts#connect_register_service_account)\n- A [logging-monitoring service account](/kubernetes-engine/distributed-cloud/vmware/docs/how-to/service-accounts#logging_monitoring_service_account)\n- An [audit logging service account](/kubernetes-engine/distributed-cloud/vmware/docs/how-to/service-accounts#audit_logging_service_account)\n- A [usage metering service account](/kubernetes-engine/distributed-cloud/vmware/docs/how-to/service-accounts#usage_metering_service_account)\n- Private registry\n\nYou provide a Secrets configuration file as input to the `gkectl create secrets`\ncommand. For each Secret group, the command creates Kubernetes Secrets: one\nSecret for each of the credentials in the group. The command creates the Secrets\nin an admin cluster in the specified Kubernetes namespace.\n\nTo get started, create a template for your Secrets configuration file:\n\n```\ngkectl create-config secrets\n```\n\n**Template**\nClick to see the generated template. \n\n```yaml\napiVersion: v1\nkind: ClusterSecrets\n# List of secret groups; for admin clusters it allows only one group\nsecretGroups:\n# (Required for user clusters only) A unique name for secret namespace; it needs to\n# have prefix 'gke-onprem-secrets-' (example: gke-onprem-secrets-test)\n‐ namespace: \"\"\n # Secrets in this namespace\n secrets:\n # The credentials for vCenter\n vCenter:\n username: \"\"\n password: \"\"\n # The credentials for f5BigIP\n f5BigIP:\n username: \"\"\n password: \"\"\n # The GCP service account key used to pull GKE images\n componentAccessServiceAccount:\n serviceAccountKeyPath: \"\"\n # The GCP service account key used to register the cluster\n registerServiceAccount:\n serviceAccountKeyPath: \"\"\n # The GCP service account key used to send logs and metrics from the cluster\n stackdriverServiceAccount:\n serviceAccountKeyPath: \"\"\n # The GCP service account key used to send audit logs from the cluster\n cloudAuditLoggingServiceAccount:\n serviceAccountKeyPath: \"\"\n # The credentials for private registry\n privateRegistry:\n username: \"\"\n password: \"\" \n```\n\nFilling in the fields in a Secrets configuration file\n\n`secretGroups`\n\nAn array of objects. Each object has the name of a Kubernetes namespace and a\nset of credentials.\n\nFor an admin cluster, only one Secret group is allowed.\n\n`secretGroups[i].namespace`\n\nUser cluster only.\n\nA name of your choice for a Kubernetes namespace that will hold a set of\nSecrets. The name must begin with `gke-onprem-secrets-`.\n\nExample:\n\n```\nsecretGroups:\n- namespace: \"gke-onprem-secrets-bob\"\n secrets:\n ...\n- namespace: \"gke-onprem-secrets-alice\"\n secrets:\n ...\n```\n\n`secretGroups[i].secrets.vCenter`\n\nThe username and password of a vCenter account.\n\nExample:\n\n```\nsecretGroups:\n- namespace: \"gke-onprem-secrets-bob\"\n secrets:\n vCenter:\n username: \"vc-bob\"\n password: \"U$icUKEW#INE\"\n```\n\n`secretGroups[i].secrets.f5BigIP`\n\nThe username and password of an F5 BIG-IP account.\n\nExample:\n\n```\nsecretGroups:\n- namespace: \"gke-onprem-secrets-bob\"\n secrets:\n f5BigIP:\n username: \"f5-bob\"\n password: \"exvQVx^@L%F1\"\n```\n\n`secretGroups[i].secrets.componentAccessServiceAccount.serviceAccountKeyPath`\n\nThe path of a JSON key file for a\n[component access service account](/kubernetes-engine/distributed-cloud/vmware/docs/how-to/service-accounts#component_access_service_account).\n\n```\nsecretGroups:\n- namespace: \"gke-onprem-secrets-bob\"\n secrets:\n componentAccessServiceAccount:\n serviceAccountKeyPath: \"my-folder/component-access-key.json\"\n```\n\n`secretGroups[i].secrets.registerServiceAccount.serviceAccountKeyPath`\n\nThe path of a JSON key file for a\n[connect-register service account](/kubernetes-engine/distributed-cloud/vmware/docs/how-to/service-accounts#connect_register_service_account).\n\n```\nsecretGroups:\n- namespace: \"gke-onprem-secrets-bob\"\n secrets:\n registerServiceAccount:\n serviceAccountKeyPath: \"my-folder/connect-register-key.json\"\n```\n\n`secretGroups[i].secrets.stackdriverServiceAccount.serviceAccountKeyPath`\n\nThe path of a JSON key file for a\n[logging-monitoring service account](/kubernetes-engine/distributed-cloud/vmware/docs/how-to/service-accounts#logging_monitoring_service_account).\n\nExample:\n\n```\nsecretGroups:\n- namespace: \"gke-onprem-secrets-bob\"\n secrets:\n stackdriverServiceAccount:\n serviceAccountKeyPath: \"my-folder/log-mon-key.json\"\n```\n\n`secretGroups[i].secrets.cloudAuditLoggingServiceAccount.serviceAccountKeyPath`\n\nThe path of a JSON key file for an\n[audit logging service account](/kubernetes-engine/distributed-cloud/vmware/docs/how-to/service-accounts#audit_logging_service_account).\n\n```\nsecretGroups:\n- namespace: \"gke-onprem-secrets-bob\"\n secrets:\n cloudAuditLoggingServiceAccount:\n serviceAccountKeyPath: \"my-folder/audit-log-key.json\"\n```\n\n`secretGroups[i].secrets.privateRegistry`\n\nThe username and password of the **private** registry if using the private\nregistry.\n\nExample:\n\n```\nsecretGroups:\n- namespace: \"gke-onprem-secrets-bob\"\n secrets:\n privateRegistry:\n username: \"registry-user-bob\"\n password: \"f[vuV3^@L*4g\"\n```"]]
