Spring Boot运行时如何从Kubernetes读取/注入环境变量？

针对你的场景，完全不需要使用复杂的Kubernetes Java Client API，以下几种方案更简洁高效，且符合Spring Boot的生态设计：

1. 直接将Secret映射为环境变量（最简便） #

Kubernetes支持把Secret的键值对直接映射为容器环境变量，Spring Boot可以像读取普通环境变量一样获取凭证，全程无需调用K8s API。

步骤1：修改Deployment配置挂载Secret为环境变量 #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: your-spring-boot-app
spec:
  template:
    spec:
      containers:
      - name: app-container
        image: your-app-image:latest
        env:
          # Basic Auth凭证映射
          - name: BASIC_AUTH_USERNAME
            valueFrom:
              secretKeyRef:
                name: your-basic-auth-secret # 你的Secret名称
                key: username # Secret中存储用户名的键
          - name: BASIC_AUTH_PASSWORD
            valueFrom:
              secretKeyRef:
                name: your-basic-auth-secret
                key: password # Secret中存储密码的键
          # OAuth2凭证映射
          - name: OAUTH2_CLIENT_ID
            valueFrom:
              secretKeyRef:
                name: your-oauth2-secret
                key: client_id
          - name: OAUTH2_CLIENT_SECRET
            valueFrom:
              secretKeyRef:
                name: your-oauth2-secret
                key: client_secret

步骤2：Spring Boot中读取环境变量 #

用@Value直接注入：

import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;

@Component
public class AuthCredentials {
    @Value("${BASIC_AUTH_USERNAME}")
    private String basicAuthUsername;

    @Value("${BASIC_AUTH_PASSWORD}")
    private String basicAuthPassword;

    @Value("${OAUTH2_CLIENT_ID}")
    private String oauth2ClientId;

    @Value("${OAUTH2_CLIENT_SECRET}")
    private String oauth2ClientSecret;

    // Getters
}

或者用@ConfigurationProperties做规范绑定：

import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.stereotype.Component;

@Component
@ConfigurationProperties(prefix = "basic.auth")
public class BasicAuthProperties {
    private String username;
    private String password;

    // Getters & Setters
}

对应的application.yml可配置默认值映射：

basic:
  auth:
    username: ${BASIC_AUTH_USERNAME}
    password: ${BASIC_AUTH_PASSWORD}

2. 将Secret挂载为文件（适合长内容凭证） #

如果凭证是多行内容（比如OAuth2的JWT私钥），环境变量可能有长度限制，这时可以把Secret挂载为容器内的文件，Spring Boot读取文件内容。

步骤1：修改Deployment配置挂载Secret为文件 #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: your-spring-boot-app
spec:
  template:
    spec:
      volumes:
      - name: basic-auth-secret-volume
        secret:
          secretName: your-basic-auth-secret
      - name: oauth2-secret-volume
        secret:
          secretName: your-oauth2-secret
      containers:
      - name: app-container
        image: your-app-image:latest
        volumeMounts:
        - name: basic-auth-secret-volume
          mountPath: /secrets/basic-auth
          readOnly: true
        - name: oauth2-secret-volume
          mountPath: /secrets/oauth2
          readOnly: true

挂载后，/secrets/basic-auth目录下会生成以Secret键命名的文件（比如username文件内容就是用户名）。

步骤2：Spring Boot中读取文件内容 #

用Spring的Resource接口加载：

import org.springframework.core.io.FileSystemResource;
import org.springframework.stereotype.Component;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;

@Component
public class AuthCredentials {
    private final String basicAuthUsername;
    private final String basicAuthPassword;

    public AuthCredentials() throws IOException {
        this.basicAuthUsername = Files.readString(
            new FileSystemResource("/secrets/basic-auth/username").getFile().toPath(),
            StandardCharsets.UTF_8
        );
        this.basicAuthPassword = Files.readString(
            new FileSystemResource("/secrets/basic-auth/password").getFile().toPath(),
            StandardCharsets.UTF_8
        );
    }

    // Getters
}

3. 使用Spring Cloud Kubernetes（自动同步Secret） #

如果需要Secret更新时自动同步到应用，或者不想手动管理挂载配置，可以用Spring官方的集成组件，它会自动从K8s API拉取Secret并注入Spring环境，比原生Java Client简洁很多。

步骤1：引入Maven依赖 #

<dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-starter-kubernetes-secrets</artifactId>
</dependency>

步骤2：配置RBAC权限 #

给Pod的ServiceAccount配置读取Secret的权限：

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: your-namespace
  name: secret-reader
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "watch", "list"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: your-namespace
  name: app-secret-reader
subjects:
- kind: ServiceAccount
  name: default
  namespace: your-namespace
roleRef:
  kind: Role
  name: secret-reader
  apiGroup: rbac.authorization.k8s.io

步骤3：Spring Boot中读取Secret #

直接用@Value读取，格式为${secret-name.key-name}：

import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;

@Component
public class AuthCredentials {
    @Value("${your-basic-auth-secret.username}")
    private String basicAuthUsername;

    @Value("${your-basic-auth-secret.password}")
    private String basicAuthPassword;

    // Getters
}

方案对比 #

内容的提问来源于stack exchange，提问作者Tigerkralle1