1、创建 NFS 服务器
2、创建 ServiceAccount
Kubernetes 集群大部分是基于 RBAC 的权限控制,所以创建一个一定权限的 ServiceAccount 与后面要创建的 “NFS Provisioner” 绑定,赋予一定的权限。
官方地址:https://github.com/kubernetes-retired/external-storage/tree/master/nfs-client/deploy
vim nfs-rbac.yaml
# 内容
kind: ServiceAccount
apiVersion: v1
metadata:
name: nfs-client-provisioner
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: nfs-client-provisioner-runner
rules:
- apiGroups: [""]
resources: ["persistentvolumes"]
verbs: ["get", "list", "watch", "create", "delete"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["events"]
verbs: ["create", "update", "patch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: run-nfs-client-provisioner
subjects:
- kind: ServiceAccount
name: nfs-client-provisioner
namespace: default
roleRef:
kind: ClusterRole
name: nfs-client-provisioner-runner
apiGroup: rbac.authorization.k8s.io
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: leader-locking-nfs-client-provisioner
rules:
- apiGroups: [""]
resources: ["endpoints"]
verbs: ["get", "list", "watch", "create", "update", "patch"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: leader-locking-nfs-client-provisioner
subjects:
- kind: ServiceAccount
name: nfs-client-provisioner
namespace: default
roleRef:
kind: Role
name: leader-locking-nfs-client-provisioner
apiGroup: rbac.authorization.k8s.io
2、部署 NFS Provisioner
vim nfs-provisioner-deploy.yaml
# 内容
kind: Deployment
apiVersion: apps/v1
metadata:
name: nfs-client-provisioner
namespace: default
labels:
app: nfs-client-provisioner
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: nfs-client-provisioner
template:
metadata:
labels:
app: nfs-client-provisioner
spec:
serviceAccountName: nfs-client-provisioner
containers:
- name: nfs-client-provisioner
image: gmoney23/nfs-client-provisioner
volumeMounts:
- name: nfs-client-root
mountPath: /persistentvolumes
env:
- name: PROVISIONER_NAME
value: nfs-client
- name: NFS_SERVER
value: 192.168.2.105
- name: NFS_PATH
value: /nfsdata
volumes:
- name: nfs-client-root
nfs:
server: 192.168.2.105
path: /nfsdata
3、创建 NFS StorageClass
vim nfs-storage.yaml
# 内容
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: nfs-storage
annotations:
storageclass.kubernetes.io/is-default-class: "true"
provisioner: nfs-client
parameters:
archiveOnDelete: "true"
至此,StorageClass 创建完成
4、接下来创建一个 PVC
vim test-pvc.yaml
# 内容
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: test-pvc
spec:
storageClassName: nfs-storage
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 10Gi
5、创建
kubectl apply -f test-pvc.yaml
6、查看 PV,PVC
# 查看 PVC
[root@master provisioner]# kubectl get pvc
NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS AGE
test-pvc Bound pvc-dbe640e5-60bd-43e5-945e-6cde20e22af4 1Mi RWO nfs-storage 4m5s
# 自动创建一个 PV
[root@master provisioner]# kubectl get pv
NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS REASON AGE
pvc-dbe640e5-60bd-43e5-945e-6cde20e22af4 1Mi RWO Delete Bound default/test-pvc nfs-storage 3m38s
7、在 NFS 服务器上面 也会自动生成 namespace+pvcname+pvname 命名的文件夹
[root@gitlab ~]# ll /nfsdata/
总用量 0
drwxrwxrwx 2 root root 6 3月 31 09:04 default-test-pvc-pvc-dbe640e5-60bd-43e5-945e-6cde20e22af4
8、这时如果删除 PVC,PV也会自动删除
kubectl delete pvc test-pvc
[root@master provisioner]# kubectl get pvc,pv
No resources found in default namespace.