如何在SpringBoot中配置动态值连接MySQL（适配Kubernetes Secrets）

1. 创建Kubernetes Secret #

Kubernetes Secrets会自动用Base64存储敏感数据，你可以用两种方式创建：

方式一：用kubectl直接创建（推荐，自动编码） #

直接传入明文，kubectl会自动完成Base64加密：

kubectl create secret generic db-secrets \
  --from-literal=db-username=root \
  --from-literal=db-password=your-real-password \
  --from-literal=db-host=your-mysql-host-address

方式二：手动编写Secret YAML #

先把每个值转成Base64编码：

echo -n "root" | base64
echo -n "your-real-password" | base64
echo -n "your-mysql-host-address" | base64

然后创建secret.yaml文件：

apiVersion: v1
kind: Secret
metadata:
  name: db-secrets
type: Opaque
data:
  db-username: <替换为用户名的Base64编码>
  db-password: <替换为密码的Base64编码>
  db-host: <替换为主机地址的Base64编码>

执行命令创建Secret：

kubectl apply -f secret.yaml

2. 修改Spring Boot的application.dev.yaml #

把静态配置替换为环境变量占位符，Spring Boot会自动读取容器内的环境变量填充：

datasource:
    url: jdbc:mysql://${DB_HOST}?useSSL=false&allowPublicKeyRetrieval=true
    username: ${DB_USERNAME}
    password: ${DB_PASSWORD}
    driver-class-name: com.mysql.cj.jdbc.Driver

3. 在Kubernetes Deployment中映射Secret到环境变量 #

修改你的Deployment配置，将Secret中的值映射为容器的环境变量：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: your-springboot-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: springboot-app
  template:
    metadata:
      labels:
        app: springboot-app
    spec:
      containers:
      - name: springboot-container
        image: your-app-image:tag
        env:
        - name: DB_HOST
          valueFrom:
            secretKeyRef:
              name: db-secrets
              key: db-host
        - name: DB_USERNAME
          valueFrom:
            secretKeyRef:
              name: db-secrets
              key: db-username
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: db-secrets
              key: db-password
        ports:
        - containerPort: 8080

备选方案：将Secret挂载为文件读取 #

如果不想用环境变量，也可以把Secret挂载成文件，让Spring Boot从文件读取值：

修改Deployment添加挂载 #

spec:
  containers:
  - name: springboot-container
    image: your-app-image:tag
    volumeMounts:
    - name: db-secrets-volume
      mountPath: /secrets/db
      readOnly: true
  volumes:
  - name: db-secrets-volume
    secret:
      secretName: db-secrets

修改application.dev.yaml读取文件内容 #

datasource:
    url: jdbc:mysql://${file:/secrets/db/db-host}?useSSL=false&allowPublicKeyRetrieval=true
    username: ${file:/secrets/db/db-username}
    password: ${file:/secrets/db/db-password}
    driver-class-name: com.mysql.cj.jdbc.Driver

内容的提问来源于stack exchange，提问作者DarkDead