Configmap配置管理
创建ConfigMap
- 使用字面值创建
2. 使用文件创建
3.使用目录创建
- 使用yaml文件创建
如何使用ConfigMap
- cm通过环境变量的方式直接传递给pod
[kubeadm@server2 cm]$ vim cm5.yaml
[kubeadm@server2 cm]$ cat cm5.yaml
apiVersion: v1
kind: Pod
metadata:
name: pod1
spec:
containers:
- name: pod1
image: busybox
command: ["/bin/sh","-c","env"]
env:
- name: key1
valueFrom:
configMapKeyRef:
name: cm4
key: db_host
- name: key2
valueFrom:
configMapKeyRef:
name: cm4
key: db_port
restartPolicy: Never
[kubeadm@server2 cm]$ vim cm6.yaml
[kubeadm@server2 cm]$ cat cm6.yaml
apiVersion: v1
kind: Pod
metadata:
name: pod1
spec:
containers:
- name: pod1
image: busybox
command: ["/bin/sh","-c","env"]
envFrom:
- configMapRef:
name: cm4
restartPolicy: Never
- 通过在pod的命令行下运行的方式
[kubeadm@server2 cm]$ vim cm7.yaml
[kubeadm@server2 cm]$ cat cm7.yaml
apiVersion: v1
kind: Pod
metadata:
name: pod1
spec:
containers:
- name: pod1
image: busybox
command: ["/bin/sh","-c","echo $(db_host) $(db_port)"]
envFrom:
- configMapRef:
name: cm4
restartPolicy: Never
- 作为volume的方式挂载到pod内
[kubeadm@server2 cm]$ vim cm8.yaml
[kubeadm@server2 cm]$ cat cm8.yaml
apiVersion: v1
kind: Pod
metadata:
name: pod1
spec:
containers:
- name: pod1
image: busybox
command: ["/bin/sh","-c","cat /config/db_host"]
volumeMounts:
- name: config-volume
mountPath: /config
volumes:
- name: config-volume
configMap:
name: cm4
restartPolicy: Never
[kubeadm@server2 cm]$ cat cm8.yaml
apiVersion: v1
kind: Pod
metadata:
name: pod2
spec:
containers:
- name: pod2
image: busybox
command: ["/bin/sh","-c","ls /config/"]
volumeMounts:
- name: config-volume
mountPath: /config
volumes:
- name: config-volume
configMap:
name: cm4
restartPolicy: Never
[kubeadm@server2 cm]$ cat cm9.yaml
apiVersion: v1
kind: Pod
metadata:
name: pod2
spec:
containers:
- name: pod2
image: myapp:v1
volumeMounts:
- name: config-volume
mountPath: /config
volumes:
- name: config-volume
configMap:
name: cm4
热更新
[kubeadm@server2 cm]$ cat cm1.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-nginx
spec:
replicas: 1
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- name: nginx
image: nginx
ports:
- containerPort: 80
volumeMounts:
- name: config-volume
mountPath: /config
volumes:
- name: config-volume
configMap:
name: cm4
改变地址 看容器内是否能更新
第一种方法:
此时,需要删掉my-nginx这个pod,这个pod会重新上线,完成热更细腻
第二种方法:
改回到172.25.254.38
重新发布nginx
[kubeadm@server2 cm]$ vim cm1.yaml
[kubeadm@server2 cm]$ cat cm1.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-nginx
spec:
replicas: 1
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- name: nginx
image: nginx
ports:
- containerPort: 80
volumeMounts:
- name: config-volume
mountPath: /etc/nginx/conf.d
volumes:
- name: config-volume
configMap:
name: nginxconf
[kubeadm@server2 cm]$ vim nginx.conf
[kubeadm@server2 cm]$ cat nginx.conf
server {
listen 8000;
server_name _;
location / {
root /usr/share/nginx/html;
index index.html index.htm;
}
}
可以访问到8000端口的nginx服务
将端口改为8080
滚动更新pod,nginx配置也发生变化
Secret 配置管理
- 创建secret
存在一个默认的卷
- 简单加密
带有特殊字符的密码:
base64转换
2. 用yaml文件创建secret
- 将secret挂载到卷中
[kubeadm@server2 secret]$ vim secret1.yaml
[kubeadm@server2 secret]$ cat secret1.yaml
apiVersion: v1
kind: Pod
metadata:
name: mysecret
spec:
containers:
- name: nginx
image: nginx
volumeMounts:
- name: secret
mountPath: "/secret"
readOnly: true
volumes:
- name: secret
secret:
secretName: mysecret
指定路径:
[kubeadm@server2 secret]$ vim secret1.yaml
[kubeadm@server2 secret]$ cat secret1.yaml
apiVersion: v1
kind: Pod
metadata:
name: mysecret
spec:
containers:
- name: nginx
image: nginx
volumeMounts:
- name: secret
mountPath: "/secret"
readOnly: true
volumes:
- name: secret
secret:
secretName: mysecret
items:
- key: username
path: my-group/my-username
- 将secret设置为环境变量
[kubeadm@server2 secret]$ vim secret2.yaml
[kubeadm@server2 secret]$ cat secret2.yaml
apiVersion: v1
kind: Pod
metadata:
name: mysecret
spec:
containers:
- name: nginx
image: nginx
env:
- name: SECRET_USERNAME
valueFrom:
secretKeyRef:
name: mysecret
key: username
- name: SECRET_PASSWORD
valueFrom:
secretKeyRef:
name: mysecret
key: password
动态更新的方法跟configmap一样,都需要重新加载
- 认证
在仓库种创建新项目westos,并上传镜像game2048,设置仓库为私有
[kubeadm@server2 secret]$ vim secret3.yaml
[kubeadm@server2 secret]$ cat secret3.yaml
apiVersion: v1
kind: Pod
metadata:
name: mypod
spec:
containers:
- name: nginx
image: reg.westos.org/westos/game2048
imagePullSecrets:
- name: myregistrykey
清单中用到加密认证
Volumes配置管理
[kubeadm@server2 volumes]$ vim pod.yaml
[kubeadm@server2 volumes]$ cat pod.yaml
apiVersion: v1
kind: Pod
metadata:
name: vol1
spec:
containers:
- image: busyboxplus
name: vm1
command: ["sleep", "300"]
volumeMounts:
- mountPath: /cache
name: cache-volume
- name: vm2
image: nginx
volumeMounts:
- mountPath: /usr/share/nginx/html
name: cache-volume
volumes:
- name: cache-volume
emptyDir:
medium: Memory
sizeLimit: 100Mi
pod内有两个容器
因为共享存储,所以vm1的存储在vm2中可以访问的到
如果写入资源大小大于设定存储,那么会被驱逐
[kubeadm@server2 volumes]$ vim pod.yaml
[kubeadm@server2 volumes]$ cat pod.yaml
apiVersion: v1
kind: Pod
metadata:
name: test-pd
spec:
containers:
- image: nginx
name: test-container
volumeMounts:
- mountPath: /test-pd
name: test-volume
volumes:
- name: test-volume
hostPath:
path: /data
type: DirectoryOrCreate
调度到server3
限制: 如果发生从server3调度到其它节点,那么server3的数据就不能再用
nfs:
[kubeadm@server2 volumes]$ vim pod.yaml
[kubeadm@server2 volumes]$ cat pod.yaml
apiVersion: v1
kind: Pod
metadata:
name: test-pd
spec:
containers:
- image: nginx
name: test-container
volumeMounts:
- mountPath: /usr/share/nginx/html
name: test-volume
volumes:
- name: test-volume
nfs:
server: 172.25.254.1
path: /nfs
在172.25.254.1上安装启动nfs服务(服务端)
在pod端安装nfs-utils(客户端)
pod中缩写数据存储到172.25.254.1:/nfs里面
pv
静态pv
[kubeadm@server2 manifest]$ vim pv1.yaml
[kubeadm@server2 manifest]$ cat pv1.yaml
apiVersion: v1
kind: PersistentVolume
metadata:
name: pv1
spec:
capacity:
storage: 1Gi
volumeMode: Filesystem
accessModes:
- ReadWriteOnce
persistentVolumeReclaimPolicy: Recycle
storageClassName: nfs
nfs:
path: /nfs
server: 172.25.254.1
pvc1关联pv1
[kubeadm@server2 manifest]$ vim pvc1.yaml
[kubeadm@server2 manifest]$ cat pvc1.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: pvc1
spec:
storageClassName: nfs
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
nfs pv回收再利用
再创建:
[kubeadm@server2 manifest]$ vim pv2.yaml
[kubeadm@server2 manifest]$ cat pv2.yaml
apiVersion: v1
kind: PersistentVolume
metadata:
name: pv2
spec:
capacity:
storage: 2Gi
volumeMode: Filesystem
accessModes:
- ReadWriteMany
persistentVolumeReclaimPolicy: Delete
storageClassName: nfs
nfs:
path: /nfs
server: 172.25.254.1
pvc1关联pv2
[kubeadm@server2 manifest]$ vim pvc1.yaml
[kubeadm@server2 manifest]$ cat pvc1.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: pvc1
spec:
storageClassName: nfs
accessModes:
- ReadWriteMany
resources:
requests:
storage: 2Gi
pv2设定删除pvc删除pv
手动回收pv2
再次绑定pv1和pvc1
pod使用pv
[kubeadm@server2 pv]$ vim pod.yaml
[kubeadm@server2 pv]$ cat pod.yaml
apiVersion: v1
kind: Pod
metadata:
name: test-pd
spec:
containers:
- image: nginx
name: nginx
volumeMounts:
- mountPath: /usr/share/nginx/html
name: storage1
volumes:
- name: storage1
persistentVolumeClaim:
claimName: pvc1
挂载在nfs服务端
pv回收再利用
持久卷保留数据
删除pv同时nfs服务端数据删除
动态pv
有一种情况:
当静态pv和pvc设定无法匹配的情况下需要使用动态pv
https://github.com/kubernetes-incubator/external-storage/tree/master/nfs-client
NFS动态分配pv示例:
配置授权:
[kubeadm@server2 nfsclass]$ vim rbac.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: nfs-client-provisioner-runner
rules:
- apiGroups: [""]
resources: ["persistentvolumes"]
verbs: ["get", "list", "watch", "create", "delete"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["events"]
verbs: ["create", "update", "patch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: run-nfs-client-provisioner
subjects:
- kind: ServiceAccount
name: nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
roleRef:
kind: ClusterRole
name: nfs-client-provisioner-runner
apiGroup: rbac.authorization.k8s.io
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: leader-locking-nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
rules:
- apiGroups: [""]
resources: ["endpoints"]
verbs: ["get", "list", "watch", "create", "update", "patch"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: leader-locking-nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
subjects:
- kind: ServiceAccount
name: nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
roleRef:
kind: Role
name: leader-locking-nfs-client-provisioner
apiGroup: rbac.authorization.k8s.io
部署NFS:
提前在私人仓库下载镜像
nfs在server1已经做好
vim deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: nfs-client-provisioner
labels:
app: nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: nfs-client-provisioner
template:
metadata:
labels:
app: nfs-client-provisioner
spec:
serviceAccountName: nfs-client-provisioner
containers:
- name: nfs-client-provisioner
image: nfs-client-provisioner:latest
volumeMounts:
- name: nfs-client-root
mountPath: /persistentvolumes
env:
- name: PROVISIONER_NAME
value: westos.org/nfs
- name: NFS_SERVER
value: 172.25.254.1
- name: NFS_PATH
value: /nfs
volumes:
- name: nfs-client-root
nfs:
server: 172.25.254.1
path: /nfs
声明:
vim class.yaml
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: managed-nfs-storage
provisioner: westos.org/nfs
parameters:
archiveOnDelete: "false"
创建pv:
vim test-claim.yaml
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: test-claim
annotations:
volume.beta.kubernetes.io/storage-class: "managed-nfs-storage"
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 100Mi
nfs处自动创建pv:
当删除pvc时pv也被删除,nfs处pv卷也被删除(动态)
备份:
修改false为true
重新更新pv,再删除会有备份
创建pod
vim pod.yaml
kind: Pod
apiVersion: v1
metadata:
name: test-pod
spec:
containers:
- name: test-pod
image: nginx
volumeMounts:
- name: nfs-pvc
mountPath: "/usr/share/nginx/html"
volumes:
- name: nfs-pvc
persistentVolumeClaim:
claimName: test-claim
当nfs写入发布页面时,就可以访问的到
默认的pvc
打补丁
删除:
先将清单中个数改为0,生效
再删除