linux--kubernetes(存储 Configmanp和pv)

Configmap配置管理

创建ConfigMap

1. 使用字面值创建

2. 使用文件创建

3.使用目录创建

4. 使用yaml文件创建

如何使用ConfigMap

1. cm通过环境变量的方式直接传递给pod

[kubeadm@server2 cm]$ vim cm5.yaml
[kubeadm@server2 cm]$ cat cm5.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: pod1
spec:
  containers:
    - name: pod1
      image: busybox
      command: ["/bin/sh","-c","env"]
      env:
        - name: key1
          valueFrom:
            configMapKeyRef:
              name: cm4
              key: db_host
        - name: key2
          valueFrom:
            configMapKeyRef:
              name: cm4
              key: db_port
  restartPolicy: Never

[kubeadm@server2 cm]$ vim cm6.yaml 
[kubeadm@server2 cm]$ cat cm6.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: pod1
spec:
  containers:
    - name: pod1
      image: busybox
      command: ["/bin/sh","-c","env"]
      envFrom:
        - configMapRef:
            name: cm4
  restartPolicy: Never

2. 通过在pod的命令行下运行的方式

[kubeadm@server2 cm]$ vim cm7.yaml 
[kubeadm@server2 cm]$ cat cm7.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: pod1
spec:
  containers:
    - name: pod1
      image: busybox
      command: ["/bin/sh","-c","echo $(db_host) $(db_port)"]
      envFrom:
        - configMapRef:
            name: cm4
  restartPolicy: Never

3. 作为volume的方式挂载到pod内

[kubeadm@server2 cm]$ vim cm8.yaml 
[kubeadm@server2 cm]$ cat cm8.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: pod1
spec:
  containers:
    - name: pod1
      image: busybox
      command: ["/bin/sh","-c","cat /config/db_host"]
      volumeMounts:
      - name: config-volume
        mountPath: /config
  volumes:
    - name: config-volume
      configMap:
        name: cm4
  restartPolicy: Never

[kubeadm@server2 cm]$ cat cm8.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: pod2
spec:
  containers:
    - name: pod2
      image: busybox
      command: ["/bin/sh","-c","ls /config/"]
      volumeMounts:
      - name: config-volume
        mountPath: /config
  volumes:
    - name: config-volume
      configMap:
        name: cm4
  restartPolicy: Never

[kubeadm@server2 cm]$ cat cm9.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: pod2
spec:
  containers:
    - name: pod2
      image: myapp:v1
      volumeMounts:
      - name: config-volume
        mountPath: /config
  volumes:
    - name: config-volume
      configMap:
        name: cm4

热更新

[kubeadm@server2 cm]$ cat cm1.yaml 
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - name: nginx
          image: nginx
          ports:
          - containerPort: 80
          volumeMounts:
          - name: config-volume
            mountPath: /config
      volumes:
        - name: config-volume
          configMap:
            name: cm4

改变地址 看容器内是否能更新

第一种方法：

此时，需要删掉my-nginx这个pod，这个pod会重新上线，完成热更细腻

第二种方法：

改回到172.25.254.38

重新发布nginx

[kubeadm@server2 cm]$ vim cm1.yaml 
[kubeadm@server2 cm]$ cat cm1.yaml 
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - name: nginx
          image: nginx
          ports:
          - containerPort: 80
          volumeMounts:
          - name: config-volume
            mountPath: /etc/nginx/conf.d
      volumes:
        - name: config-volume
          configMap:
            name: nginxconf

[kubeadm@server2 cm]$ vim nginx.conf
[kubeadm@server2 cm]$ cat nginx.conf 
server {
    listen 8000;
    server_name _;

    location / {
          root /usr/share/nginx/html;
          index index.html index.htm;
    }
}

可以访问到8000端口的nginx服务

将端口改为8080

滚动更新pod，nginx配置也发生变化

Secret 配置管理

1. 创建secret

存在一个默认的卷

2. 简单加密

带有特殊字符的密码：

base64转换

2. 用yaml文件创建secret

3. 将secret挂载到卷中

[kubeadm@server2 secret]$ vim secret1.yaml
[kubeadm@server2 secret]$ cat secret1.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: mysecret
spec:
  containers:
  - name: nginx
    image: nginx
    volumeMounts:
    - name: secret
      mountPath: "/secret"
      readOnly: true
  volumes:
  - name: secret
    secret:
      secretName: mysecret

指定路径：

[kubeadm@server2 secret]$ vim secret1.yaml 
[kubeadm@server2 secret]$ cat secret1.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: mysecret
spec:
  containers:
  - name: nginx
    image: nginx
    volumeMounts:
    - name: secret
      mountPath: "/secret"
      readOnly: true
  volumes:
  - name: secret
    secret:
      secretName: mysecret
      items:
      - key: username
        path: my-group/my-username

4. 将secret设置为环境变量

[kubeadm@server2 secret]$ vim secret2.yaml 
[kubeadm@server2 secret]$ cat secret2.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: mysecret
spec:
  containers:
  - name: nginx
    image: nginx
    env:
      - name: SECRET_USERNAME
        valueFrom:
          secretKeyRef:
            name: mysecret
            key: username
      - name: SECRET_PASSWORD
        valueFrom:
          secretKeyRef:
            name: mysecret
            key: password

动态更新的方法跟configmap一样，都需要重新加载

5. 认证

在仓库种创建新项目westos,并上传镜像game2048,设置仓库为私有

[kubeadm@server2 secret]$ vim secret3.yaml 
[kubeadm@server2 secret]$ cat secret3.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: mypod
spec:
  containers:
  - name: nginx
    image: reg.westos.org/westos/game2048
  imagePullSecrets:
    - name: myregistrykey

清单中用到加密认证

Volumes配置管理

[kubeadm@server2 volumes]$ vim pod.yaml 
[kubeadm@server2 volumes]$ cat pod.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: vol1
spec:
  containers:
  - image: busyboxplus
    name: vm1
    command: ["sleep", "300"]
    volumeMounts:
    - mountPath: /cache
      name: cache-volume
  - name: vm2
    image: nginx
    volumeMounts:
    - mountPath: /usr/share/nginx/html
      name: cache-volume
  volumes:
  - name: cache-volume
    emptyDir:
      medium: Memory
      sizeLimit: 100Mi

pod内有两个容器

因为共享存储，所以vm1的存储在vm2中可以访问的到

如果写入资源大小大于设定存储，那么会被驱逐

[kubeadm@server2 volumes]$ vim pod.yaml 
[kubeadm@server2 volumes]$ cat pod.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: test-pd
spec:
  containers:
  - image: nginx
    name: test-container
    volumeMounts:
    - mountPath: /test-pd
      name: test-volume
  volumes:
  - name: test-volume
    hostPath:
      path: /data
      type: DirectoryOrCreate

调度到server3

限制： 如果发生从server3调度到其它节点，那么server3的数据就不能再用

nfs:

[kubeadm@server2 volumes]$ vim pod.yaml 
[kubeadm@server2 volumes]$ cat pod.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: test-pd
spec:
  containers:
  - image: nginx
    name: test-container
    volumeMounts:
    - mountPath: /usr/share/nginx/html
      name: test-volume
  volumes:
  - name: test-volume
    nfs:
      server: 172.25.254.1
      path: /nfs

在172.25.254.1上安装启动nfs服务（服务端）
在pod端安装nfs-utils（客户端）

pod中缩写数据存储到172.25.254.1:/nfs里面

pv

静态pv

[kubeadm@server2 manifest]$ vim pv1.yaml
[kubeadm@server2 manifest]$ cat pv1.yaml 
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv1
spec:
  capacity:
    storage: 1Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Recycle
  storageClassName: nfs
  nfs:
    path: /nfs
    server: 172.25.254.1

pvc1关联pv1

[kubeadm@server2 manifest]$ vim pvc1.yaml
[kubeadm@server2 manifest]$ cat pvc1.yaml 
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc1
spec:
  storageClassName: nfs
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi

nfs pv回收再利用

再创建：

[kubeadm@server2 manifest]$ vim pv2.yaml 
[kubeadm@server2 manifest]$ cat pv2.yaml 
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv2
spec:
  capacity:
    storage: 2Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteMany
  persistentVolumeReclaimPolicy: Delete
  storageClassName: nfs
  nfs:
    path: /nfs
    server: 172.25.254.1

pvc1关联pv2

[kubeadm@server2 manifest]$ vim pvc1.yaml 
[kubeadm@server2 manifest]$ cat pvc1.yaml 
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc1
spec:
  storageClassName: nfs
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 2Gi

pv2设定删除pvc删除pv

手动回收pv2

再次绑定pv1和pvc1

pod使用pv

[kubeadm@server2 pv]$ vim pod.yaml 
[kubeadm@server2 pv]$ cat pod.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: test-pd
spec:
  containers:
  - image: nginx
    name: nginx
    volumeMounts:
    - mountPath: /usr/share/nginx/html
      name: storage1
  volumes:
  - name: storage1
    persistentVolumeClaim:
      claimName: pvc1

挂载在nfs服务端

pv回收再利用

持久卷保留数据

删除pv同时nfs服务端数据删除

动态pv

有一种情况：
当静态pv和pvc设定无法匹配的情况下需要使用动态pv

https://github.com/kubernetes-incubator/external-storage/tree/master/nfs-client

NFS动态分配pv示例：

配置授权：

[kubeadm@server2 nfsclass]$ vim rbac.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: nfs-client-provisioner
  # replace with namespace where provisioner is deployed
  namespace: default
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: nfs-client-provisioner-runner
rules:
  - apiGroups: [""]
    resources: ["persistentvolumes"]
    verbs: ["get", "list", "watch", "create", "delete"]
  - apiGroups: [""]
    resources: ["persistentvolumeclaims"]
    verbs: ["get", "list", "watch", "update"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["storageclasses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["create", "update", "patch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: run-nfs-client-provisioner
subjects:
  - kind: ServiceAccount
    name: nfs-client-provisioner
    # replace with namespace where provisioner is deployed
    namespace: default
roleRef:
  kind: ClusterRole
  name: nfs-client-provisioner-runner
  apiGroup: rbac.authorization.k8s.io
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: leader-locking-nfs-client-provisioner
  # replace with namespace where provisioner is deployed
  namespace: default
rules:
  - apiGroups: [""]
    resources: ["endpoints"]
    verbs: ["get", "list", "watch", "create", "update", "patch"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: leader-locking-nfs-client-provisioner
  # replace with namespace where provisioner is deployed
  namespace: default
subjects:
  - kind: ServiceAccount
    name: nfs-client-provisioner
    # replace with namespace where provisioner is deployed
    namespace: default
roleRef:
  kind: Role
  name: leader-locking-nfs-client-provisioner
  apiGroup: rbac.authorization.k8s.io

部署NFS：

提前在私人仓库下载镜像
nfs在server1已经做好

vim deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nfs-client-provisioner
  labels:
    app: nfs-client-provisioner
  # replace with namespace where provisioner is deployed
  namespace: default
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: nfs-client-provisioner
  template:
    metadata:
      labels:
        app: nfs-client-provisioner
    spec:
      serviceAccountName: nfs-client-provisioner
      containers:
        - name: nfs-client-provisioner
          image: nfs-client-provisioner:latest
          volumeMounts:
            - name: nfs-client-root
              mountPath: /persistentvolumes
          env:
            - name: PROVISIONER_NAME
              value: westos.org/nfs
            - name: NFS_SERVER
              value: 172.25.254.1
            - name: NFS_PATH
              value: /nfs
      volumes:
        - name: nfs-client-root
          nfs:
            server: 172.25.254.1
            path: /nfs

声明：

vim class.yaml
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: managed-nfs-storage
provisioner: westos.org/nfs
parameters:
  archiveOnDelete: "false"

创建pv:

vim test-claim.yaml
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: test-claim
  annotations:
    volume.beta.kubernetes.io/storage-class: "managed-nfs-storage"
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 100Mi

nfs处自动创建pv:

当删除pvc时pv也被删除，nfs处pv卷也被删除（动态）

备份：

修改false为true

重新更新pv，再删除会有备份

创建pod

vim pod.yaml
kind: Pod
apiVersion: v1
metadata:
  name: test-pod
spec:
  containers:
  - name: test-pod
    image: nginx
    volumeMounts:
      - name: nfs-pvc
        mountPath: "/usr/share/nginx/html"
  volumes:
    - name: nfs-pvc
      persistentVolumeClaim:
        claimName: test-claim

当nfs写入发布页面时，就可以访问的到

默认的pvc

打补丁

删除：
先将清单中个数改为0，生效
再删除