kubernetes集群编排——k8s存储（configmap，secrets）

configmap

字面值创建

kubectl create configmap my-config --from-literal=key1=config1 --from-literal=key2=config2

kubectl get cm

kubectl describe cm my-config

通过文件创建

kubectl create configmap my-config-2 --from-file=/etc/resolv.conf

kubectl describe cm my-config-2

通过目录创建

mkdir test

cp /etc/passwd test/

cp /etc/fstab  test/

ls test/

kubectl create configmap my-config-3 --from-file=test

kubectl describe cm my-config-3

通过yaml文件创建

vim cm1.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: cm1-config
data:
  db_host: "172.25.0.250"
  db_port: "3306"

kubectl apply -f cm1.yaml

kubectl describe cm cm1-config

使用configmap设置环境变量

vim pod1.yaml

apiVersion: v1
kind: Pod
metadata:
  name: pod1
spec:
  containers:
    - name: pod1
      image: busybox
      command: ["/bin/sh", "-c", "env"]
      env:
        - name: key1
          valueFrom:
            configMapKeyRef:
              name: cm1-config
              key: db_host
        - name: key2
          valueFrom:
            configMapKeyRef:
              name: cm1-config
              key: db_port
  restartPolicy: Never

kubectl apply -f pod1.yaml

kubectl logs pod1

kubectl delete  pod pod1

vim pod2.yaml

apiVersion: v1
kind: Pod
metadata:
  name: pod2
spec:
  containers:
    - name: pod2
      image: busybox
      command: ["/bin/sh", "-c", "env"]
      envFrom:
        - configMapRef:
            name: cm1-config
  restartPolicy: Never

kubectl apply -f pod2.yaml

kubectl logs pod2

kubectl delete  pod pod2

使用conigmap设置命令行参数

vim pod3.yaml

apiVersion: v1
kind: Pod
metadata:
  name: pod3
spec:
  containers:
    - name: pod3
      image: busybox
      command: ["/bin/sh", "-c", "echo $(db_host) $(db_port)"]
      envFrom:
        - configMapRef:
            name: cm1-config
  restartPolicy: Never

kubectl apply -f pod3.yaml

kubectl logs  pod3

kubectl delete  pod pod3

通过数据卷使用configmap

vim pod4.yaml

apiVersion: v1
kind: Pod
metadata:
  name: pod4
spec:
  containers:
    - name: pod4
      image: busybox
      command: ["/bin/sh", "-c", "cat /config/db_host"]
      volumeMounts:
      - name: config-volume
        mountPath: /config
  volumes:
    - name: config-volume
      configMap:
        name: cm1-config
  restartPolicy: Never

kubectl apply -f pod4.yaml

kubectl logs  pod4

kubectl delete pod pod4

configmap热更新

vim nginx.conf

server {
    listen       8000;
    server_name  _;

    location / {
        root /usr/share/nginx/html;
        index  index.html index.htm;
    }
}

kubectl create configmap nginxconf --from-file=nginx.conf

kubectl describe cm nginxconf

vim my-nginx.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - name: nginx
          image: nginx
          volumeMounts:
          - name: config-volume
            mountPath: /etc/nginx/conf.d
      volumes:
        - name: config-volume
          configMap:
            name: nginxconf

kubectl apply -f my-nginx.yaml

kubectl get pod -o wide

kubectl exec my-nginx-85fb986977-87dff -- cat /etc/nginx/conf.d/nginx.conf

curl 10.244.219.17:8000

编辑cm，修改端口

kubectl edit  cm nginxconf

kubectl exec my-nginx-85fb986977-87dff -- cat /etc/nginx/conf.d/nginx.conf

修改cm后，过上几秒配置信息会同步到容器，但是容器内运行的服务并不会加载生效，需要手动刷新

方式一：(推荐)

kubectl delete  pod my-nginx-85fb986977-87dff

方式二：（手动触发版本更新，会新建一个replicaset）

kubectl patch deployments.apps my-nginx --patch '{"spec": {"template": {"metadata": {"annotations": {"version/config": "20231103"}}}}}'

kubectl get pod -o wide

curl 10.244.106.133

secrets

从文件创建

echo -n 'admin' > ./username.txt

echo -n 'westos' > ./password.txt

kubectl create secret generic db-user-pass --from-file=./username.txt --from-file=./password.txt


kubectl get secrets db-user-pass -o yaml

编写yaml文件

echo -n 'admin' | base64

echo -n 'westos' | base64

vim mysecret.yaml

apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Opaque
data:
  username: YWRtaW4=			#必须编码后的值
  password: d2VzdG9z

kubectl apply -f mysecret.yaml

kubectl get secrets mysecret -o yaml

将Secret挂载到Volume中

vim pod1.yaml

apiVersion: v1
kind: Pod
metadata:
  name: mysecret
spec:
  containers:
  - name: nginx
    image: nginx
    volumeMounts:
    - name: secrets
      mountPath: "/secret"
      readOnly: true
  volumes:
  - name: secrets
    secret:
      secretName: mysecret

kubectl apply  -f pod1.yaml

kubectl get pod

kubectl exec  mysecret -- ls /secret

kubectl delete  -f pod1.yaml

向指定路径映射 secret 密钥

vim pod2.yaml

apiVersion: v1
kind: Pod
metadata:
  name: mysecret
spec:
  containers:
  - name: nginx
    image: nginx
    volumeMounts:
    - name: secrets
      mountPath: "/secret"
      readOnly: true
  volumes:
  - name: secrets
    secret:
      secretName: mysecret
      items:
      - key: username
        path: my-group/my-username

kubectl apply -f pod2.yaml

kubectl exec  mysecret -- cat /secret/my-group/my-username

kubectl delete  -f pod2.yaml

将Secret设置为环境变量

vim pod3.yaml

apiVersion: v1
kind: Pod
metadata:
  name: secret-env
spec:
  containers:
  - name: pod3
    image: busybox
    command: ["/bin/sh", "-c", "env"]
    env:
      - name: SECRET_USERNAME
        valueFrom:
          secretKeyRef:
            name: mysecret
            key: username
      - name: SECRET_PASSWORD
        valueFrom:
          secretKeyRef:
            name: mysecret
            key: password
  restartPolicy: Never

kubectl apply -f pod3.yaml

kubectl logs secret-env

存储docker registry的认证信息

kubectl create secret docker-registry myregistrykey --docker-server=reg.westos.org --docker-username=admin --docker-password=westos --docker-email=hjl@westos.org

新建私有仓库

vim pod4.yaml

apiVersion: v1
kind: Pod
metadata:
  name: mypod
spec:
  containers:
    - name: game2048
      image: reg.westos.org/westos/game2048
  imagePullSecrets:
    - name: myregistrykey

kubectl apply -f pod4.yaml

kubectl  get pod

推荐把registrykey绑定到sa，这样yaml文件中就可以不用指定，更加安全。

kubectl patch serviceaccount default -p '{"imagePullSecrets": [{"name": "myregistrykey"}]}'

kubectl describe sa default