Kubernetes pv-pvc-nfs-service综合实验

该实验详细介绍了如何在Kubernetes(K8s)集群中利用PV(PersistentVolume)和PVC(PersistentVolumeClaim)结合NFS(NetworkFileSystem)服务进行持久化存储。首先,配置了NFS服务器并测试了K8s节点对其的挂载。接着,在Master节点创建了PV和PVC,并部署了一个Pod来使用这些资源。最后,通过Deployment和Service将Pod对外发布,使得内网数据可被外网访问。

目录

实验:pv-pvc-nfs-service综合实验

实验环境

实验描述

实验拓扑图: 

实验步骤:

1、修改nfs服务器的主机名:

2、搭建nfs服务器:(131条消息) 搭建NFS服务器_搭建nfs存储_Claylpf的博客-优快云博客

3、测试k8s上所有节点服务器是否可以挂载到NFS服务器上去

4、在master机器上创建pv使用nfs服务器上的共享目录

5、在master机器上创建pvc使用pv

6、在master机器上创建pod使用pvc

7、测试去访问它(在node1上去访问)

8、使用deployment方式部署pod

9、创建一个service发布我们的Pod

10、测试访问


实验:pv-pvc-nfs-service综合实验

实验环境

4台centos7虚拟机 (都已经搭建好k8s) 和一台准备搭建nfs服务器的centos7虚拟机

实验描述

使用pv持久卷和pvc持久卷申请结合nfs将内网的数据发布出去,让外网的用户可以访问到内网的数据,更深刻的理解pv、pvc和nfs的使用流程,有更深刻的体会。

实验拓扑图: 

实验步骤:

1、修改nfs服务器的主机名:

[root@nginx-lb1 ~]# hostnamectl set-hostname nfs
[root@nginx-lb1 ~]# su - root
上一次登录:一 7月 17 00:16:08 CST 2023从 192.168.2.43pts/1 上
[root@nfs ~]# 

2、搭建nfs服务器:(131条消息) 搭建NFS服务器_搭建nfs存储_Claylpf的博客-优快云博客

[root@nfs ~]# ps aux|grep nfs
root       3248  0.0  0.0      0     0 ?        S<   00:36   0:00 [nfsd4_callbacks]
root       3254  0.0  0.0      0     0 ?        S    00:36   0:00 [nfsd]
root       3255  0.0  0.0      0     0 ?        S    00:36   0:00 [nfsd]
root       3256  0.0  0.0      0     0 ?        S    00:36   0:00 [nfsd]
root       3257  0.0  0.0      0     0 ?        S    00:36   0:00 [nfsd]
root       3258  0.0  0.0      0     0 ?        S    00:36   0:00 [nfsd]
root       3259  0.0  0.0      0     0 ?        S    00:36   0:00 [nfsd]
root       3260  0.0  0.0      0     0 ?        S    00:36   0:00 [nfsd]
root       3261  0.0  0.0      0     0 ?        S    00:36   0:00 [nfsd]
root       3271  0.0  0.0 112824   988 pts/1    R+   00:36   0:00 grep --color=auto nfs
[root@nfs ~]# vim /etc/exports
[root@nfs ~]# mkdir /web
[root@nfs ~]# cd /web/
[root@nfs web]# ls
[root@nfs web]# exportfs -rv
exporting 192.168.2.0/24:/web

成功搭建NFS服务器

3、测试k8s上所有节点服务器是否可以挂载到NFS服务器上去

[root@master ~]# mkdir /sanchuang
[root@master ~]# mount 192.168.2.77:/web /sanchuang      #挂载命令
[root@master ~]# df|grep web
192.168.2.77:/web       17811456 1769728 16041728   10% /sanchuang
[root@master ~]# 

4、在master机器上创建pv使用nfs服务器上的共享目录

创建pv-nfs.yaml文件

[root@master pv]# vim pv-nfs.yaml
[root@master pv]# cat pv-nfs.yaml 
apiVersion: v1
kind: PersistentVolume
metadata:
  name: sc-nginx-pv
  labels:
    type: sc-nginx-pv
spec:
  capacity:
    storage: 5Gi 
  accessModes:
    - ReadWriteMany
  storageClassName: nfs         #pv对应的名字
  nfs:
    path: "/web"       #nfs共享的目录
    server: 192.168.2.77   #nfs服务器的ip地址
    readOnly: false   #访问模式
[root@master pv]# 

创建Pod

[root@master pv]# kubectl apply -f pv-nfs.yaml 
persistentvolume/sc-nginx-pv created
[root@master pv]# 

查看效果

[root@master pv]# kubectl get pv
NAME             CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS      CLAIM                   STORAGECLASS   REASON   AGE
sc-nginx-pv      5Gi        RWX            Retain           Available                           nfs                     23s
task-pv-volume   10Gi       RWO            Retain           Bound       default/task-pv-claim   manual                  14h
[root@master pv]# 

5、在master机器上创建pvc使用pv

创建pvc使用pv

[root@master pv]# vim pvc-nfs.yaml
[root@master pv]# cat pvc-nfs.yaml 
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: sc-nginx-pvc
spec:
  accessModes:
  - ReadWriteMany      
  resources:
     requests:
       storage: 1Gi
  storageClassName: nfs #使用nfs类型的pv
[root@master pv]# 

创建Pod使用pvc

[root@master pv]# kubectl apply -f pvc-nfs.yaml 
persistentvolumeclaim/sc-nginx-pvc created
[root@master pv]# 

查看效果

[root@master pv]# kubectl get pvc
NAME            STATUS   VOLUME           CAPACITY   ACCESS MODES   STORAGECLASS   AGE
sc-nginx-pvc    Bound    sc-nginx-pv      5Gi        RWX            nfs            57s
task-pv-claim   Bound    task-pv-volume   10Gi       RWO            manual         13h
[root@master pv]# 

6、在master机器上创建pod使用pvc

创建pod使用pvc

[root@master pv]# vim pod-nfs.yaml
[root@master pv]# cat pod-nfs.yaml 
apiVersion: v1
kind: Pod      #这里使用pod方式去部署,下面也会介绍用deployment方式部署
metadata:
  name: sc-pv-pod-nfs
spec:
  volumes:
    - name: sc-pv-storage-nfs
      persistentVolumeClaim:
        claimName: sc-nginx-pvc
  containers:
    - name: sc-pv-container-nfs
      image: nginx
      ports:
        - containerPort: 80
          name: "http-server"
      volumeMounts:
        - mountPath: "/usr/share/nginx/html"
          name: sc-pv-storage-nfs
[root@master pv]# 

应用和验证

[root@master pv]# kubectl apply -f pod-nfs.yaml 
pod/sc-pv-pod-nfs created
[root@master pv]# kubectl get pod -o wide
NAME                       READY   STATUS    RESTARTS   AGE   IP           NODE    NOMINATED NODE   READINESS GATES
my-nginx-575db987b-d74hs   1/1     Running   0          12h   10.244.1.8   node1   <none>           <none>
my-nginx-575db987b-rmnvh   1/1     Running   0          16h   10.244.3.5   node3   <none>           <none>
my-nginx-575db987b-w2xvf   1/1     Running   0          16h   10.244.2.5   node2   <none>           <none>
sc-pv-pod-nfs              1/1     Running   0          13s   10.244.1.9   node1   <none>           <none>
test                       1/1     Running   0          13h   10.244.2.7   node2   <none>           <none>
[root@master pv]# 

7、测试去访问它(在node1上去访问)

[root@node1 sanchuang]# curl 10.244.1.12
Welcome tow sanchuang!
[root@node1 sanchuang]# 

在nfs服务器上修改共享目录的内容,然后再重新在node机器上访问,观察是否变化,若跟nfs服务器上的共享目录一样,则证明成功

8、使用deployment方式部署pod

[root@master pv]# cat pod-nfs-deploy.yaml 
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: claylpf-nginx
spec:
  replicas: 5  #创建5个副本
  selector:
    matchLabels:
      app: claylpf-nginx
  template:
    metadata:
      labels:
        app: claylpf-nginx
    spec:
     volumes:
     - name: sc-pv-storage-nfs-2
       persistentVolumeClaim:
          claimName: sc-nginx-pvc
     containers:
     - name: sc-pv-container-nfs-2
       image: nginx
       ports:
        - containerPort: 80
          name: "http-server"
       volumeMounts:
        - mountPath: "/usr/share/nginx/html"
          name: sc-pv-storage-nfs-2
[root@master pv]# 

应用和查看

[root@master pv]# kubectl apply -f pod-nfs-deploy.yaml 
deployment.apps/nginx-deployment created
[root@master pv]# kubectl get pod -o wide
NAME                                READY   STATUS    RESTARTS   AGE   IP            NODE    NOMINATED NODE   READINESS GATES
my-nginx-575db987b-d74hs            1/1     Running   0          13h   10.244.1.8    node1   <none>           <none>
my-nginx-575db987b-rmnvh            1/1     Running   0          17h   10.244.3.5    node3   <none>           <none>
my-nginx-575db987b-w2xvf            1/1     Running   0          17h   10.244.2.5    node2   <none>           <none>
nginx-deployment-849bdd77bb-5p6ms   1/1     Running   0          21s   10.244.1.14   node1   <none>           <none>
nginx-deployment-849bdd77bb-h5vvr   1/1     Running   0          22s   10.244.3.6    node3   <none>           <none>
nginx-deployment-849bdd77bb-r7cdk   1/1     Running   0          21s   10.244.3.7    node3   <none>           <none>
nginx-deployment-849bdd77bb-whcn2   1/1     Running   0          22s   10.244.1.13   node1   <none>           <none>
nginx-deployment-849bdd77bb-z6r52   1/1     Running   0          22s   10.244.2.8    node2   <none>           <none>
test                                1/1     Running   0          14h   10.244.2.7    node2   <none>           <none>

9、创建一个service发布我们的Pod

[root@master pv]# cat pod-nfs-service.yaml 
apiVersion: v1
kind: Service
metadata:
  name: my-nginx-nfs
  labels:
    run: my-nginx-nfs
spec:
  type: NodePort
  ports:
  - port: 8080
    targetPort: 80
    protocol: TCP
    name: http
  selector:
    app: claylpf-nginx     #注意这里要用app的形式,跟前面的nfs-pod文件对应,有些使用方法是run,不要搞错了
[root@master pv]# 

应用和查看

[root@master pv]# kubectl apply -f pod-nfs-service.yaml 
[root@master pv]# kubectl get service
NAME           TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)          AGE
kubernetes     ClusterIP   10.0.0.1      <none>        443/TCP          18h
my-nginx-nfs   NodePort    10.10.6.200   <none>        8080:31058/TCP   72s
[root@master pv]# 

10、测试访问

随意访问一台主机的ip地址的31058端口,看是否出现画面

kubernetes GitLab + Ingressroot@k8s-m001:~/devops/test-devops/gitlab# ll total 44 drwxr-xr-x 3 root root 4096 Jun 15 18:25 ./ drwxr-xr-x 7 root root 4096 Jun 15 18:21 ../ -rw-r--r-- 1 root root 1337 Jun 15 18:21 gitlab-deployment.yaml -rw-r--r-- 1 root root 520 Jun 15 18:22 gitlab-ingress.yaml -rw-r--r-- 1 root root 723 Jun 15 17:51 gitlab-nfs-pvc-pro.yaml -rw-r--r-- 1 root root 58 Jun 14 21:55 gitlab-ns.yaml -rw-r--r-- 1 root root 293 Jun 15 18:25 gitlab-services.yaml drwxrwxrwx 2 root root 4096 Jun 15 16:31 gitlab.wh02.com_nginx/ -rw-r--r-- 1 root root 9078 Jun 15 16:28 gitlab.wh02.com_nginx.zip root@k8s-m001:~/devops/test-devops/gitlab# cat gitlab-deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: gitlab namespace: gitlab spec: selector: matchLabels: app: gitlab replicas: 1 template: metadata: labels: app: gitlab spec: securityContext: fsGroup: 1000 containers: - name: gitlab image: harbor.wh02.com/cicd/gitlab/gitlab-ce:17.11.0-ce.0 imagePullPolicy: Always ports: - containerPort: 80 - containerPort: 22 env: - name: GITLAB_OMNIBUS_CONFIG value: | external_url 'https://gitlab.wh02.com' gitlab_rails['initial_root_password'] = "Aa123123" gitlab_rails['gitlab_default_locale'] = 'zh_CN' gitlab_rails['gitlab_default_locale_in_system'] = true volumeMounts: - name: gitlab-storage mountPath: /var/opt/gitlab subPath: data - name: gitlab-storage mountPath: /var/log/gitlab subPath: logs - name: gitlab-storage mountPath: /etc/gitlab subPath: config resources: requests: cpu: "2" memory: "5Gi" limits: cpu: "2" memory: "6Gi" volumes: - name: gitlab-storage persistentVolumeClaim: claimName: gitlab-pvc root@k8s-m001:~/devops/test-devops/gitlab# cat gitlab-ingress.yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: gitlab-ingress namespace: gitlab annotations: nginx.ingress.kubernetes.io/ssl-redirect: "true" spec: ingressClassName: nginx tls: - hosts: - gitlab.wh02.com secretName: gitlab-tls rules: - host: gitlab.wh02.com http: paths: - path: / pathType: Prefix backend: service: name: gitlab-service port: number: 80 root@k8s-m001:~/devops/test-devops/gitlab# cat gitlab-nfs-pvc-pro.yaml apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: name: nfs-gitlab-static provisioner: kubernetes.io/no-provisioner volumeBindingMode: WaitForFirstConsumer reclaimPolicy: Retain --- apiVersion: v1 kind: PersistentVolume metadata: name: gitlab-pv spec: capacity: storage: 50Gi accessModes: - ReadWriteMany nfs: server: 192.168.3.101 path: /data/k8sdata/gitlab_data storageClassName: nfs-gitlab-static persistentVolumeReclaimPolicy: Retain --- apiVersion: v1 kind: PersistentVolumeClaim metadata: name: gitlab-pvc namespace: gitlab spec: accessModes: - ReadWriteMany resources: requests: storage: 50Gi storageClassName: nfs-gitlab-static volumeName: gitlab-pv root@k8s-m001:~/devops/test-devops/gitlab# cat gitlab-ns.yaml apiVersion: v1 kind: Namespace metadata: name: gitlab root@k8s-m001:~/devops/test-devops/gitlab# cat gitlab-services.yaml apiVersion: v1 kind: Service metadata: name: gitlab-service namespace: gitlab spec: selector: app: gitlab type: NodePort ports: - name: http port: 80 targetPort: 80 # nodePort: 30030 - name: ssh port: 22 targetPort: 22 # nodePort: 30022 root@k8s-m001:~/devops/test-devops/gitlab# kubectl get secrets -n gitlab No resources found in gitlab namespace. root@k8s-m001:~/devops/test-devops/gitlab# kubectl get secrets -A NAMESPACE NAME TYPE DATA AGE ingress-nginx ingress-nginx-admission Opaque 3 97m jenkins harbor-pull-secret kubernetes.io/dockerconfigjson 1 7h41m kube-system calico-etcd-secrets Opaque 3 40h kubernetes-dashboard dashboard-admin-user kubernetes.io/service-account-token 3 65d kubernetes-dashboard kubernetes-dashboard-certs Opaque 0 65d kubernetes-dashboard kubernetes-dashboard-csrf Opaque 1 65d kubernetes-dashboard kubernetes-dashboard-key-holder Opaque 2 65d kuboard kuboard-admin-token kubernetes.io/service-account-token 3 40h kuboard kuboard-viewer-token kubernetes.io/service-account-token 3 40h root@k8s-m001:~/devops/test-devops/gitlab# kubectl get pv,pvc -n gitlab NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS VOLUMEATTRIBUTESCLASS REASON AGE persistentvolume/gitlab-pv 50Gi RWX Retain Bound gitlab/gitlab-pvc nfs-gitlab-static <unset> 44m persistentvolume/jenkins-pv 10Gi RWX Retain Released jenkins/jenkins-pvc <unset> 26h persistentvolume/pvc-1464be8d-5bc8-4ba1-8d91-c282167ea4cf 50Gi RWX Delete Bound jenkins/jenkins-pvc nfs-dynamic <unset> 7h41m persistentvolume/pvc-49a9790f-7ebf-43a6-8454-b90cf50d2f3d 50Gi RWX Retain Released jenkins/jenkins-pvc nfs-dynamic <unset> 7h54m persistentvolume/pvc-4ddd9d5b-a734-4889-af64-0c96f340ce11 50Gi RWX Retain Released jenkins/jenkins-pvc nfs-dynamic <unset> 8h NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS VOLUMEATTRIBUTESCLASS AGE persistentvolumeclaim/gitlab-pvc Bound gitlab-pv 50Gi RWX nfs-gitlab-static <unset> 44m
06-17
<think>我们正在配置GitLab在Kubernetes中的部署,需要以下资源:1.Deployment:定义GitLab的Pod模板和副本数等。2.Service:暴露GitLab服务以便内部或外部访问。3.Ingress:提供外部访问的路由规则。4.存储相关:由于GitLab需要持久化数据,我们需要StorageClass、PersistentVolume(PV)和PersistentVolumeClaim(PVC)。但注意,如果使用动态供应,我们只需创建StorageClass和PVCPV会由存储系统自动创建;如果使用静态供应,则需要预先创建PV。根据引用内容,我们看到了静态PVPVC的配置示例(引用[2]和引用[3]),以及动态PV的提及(引用[2])。同时,引用[5]提供了一个Deployment的示例,其中使用了PVC和亲和性设置。考虑到GitLab对存储的需求较大(包括仓库数据、数据库等),我们通常使用持久化存储。这里我们选择使用NFS作为后端存储(如引用[2]和引用[3]所示),并采用静态PV的方式,因为动态PV需要配置StorageClass和Provisioner,而静态PV更直接。步骤概述:1.创建PV:为GitLab的数据目录提供持久化存储。2.创建PVC:供Deployment中的Pod挂载。3.创建Deployment:定义GitLab容器,挂载PVC到相应路径。4.创建Service:为GitLab的HTTP和SSH服务(如果需要)暴露端口。5.创建Ingress:配置访问GitLab的域名和路径。注意:GitLab通常需要多个存储卷(例如,仓库数据、上传文件、数据库等),但为了简化,我们这里只创建一个PV/PVC用于数据存储。实际生产可能需要多个PVC。以下为具体资源配置文件:###1.创建PersistentVolume(PV)假设我们使用NFS服务器,IP为192.168.30.150,共享目录为/data/gitlab。创建PV:```yamlapiVersion:v1kind:PersistentVolumemetadata:name:gitlab-pvspec:capacity:storage:20Gi#根据实际需求调整accessModes:-ReadWriteManypersistentVolumeReclaimPolicy:Retain#GitLab数据重要,建议Retain,避免误删storageClassName:nfsnfs:path:/data/gitlabserver:192.168.30.150```###2.创建PersistentVolumeClaim(PVC)在同一个命名空间(例如gitlab)中创建PVC,绑定到上面的PV:```yamlapiVersion:v1kind:PersistentVolumeClaimmetadata:name:gitlab-pvcnamespace:gitlabspec:accessModes:-ReadWriteManyresources:requests:storage:20GistorageClassName:nfs```###3.创建DeploymentGitLab官方提供了Docker镜像,我们可以使用它。注意:GitLab需要配置多个环境变量,这里仅展示基本配置。同时,我们挂载PVC到GitLab的工作目录(通常是/var/opt/gitlab)。```yamlapiVersion:apps/v1kind:Deploymentmetadata:name:gitlabnamespace:gitlabspec:replicas:1#GitLab通常单实例,高可用需要复杂配置selector:matchLabels:app:gitlabtemplate:metadata:labels:app:gitlabspec:containers:-name:gitlabimage:gitlab/gitlab-ce:latestports:-containerPort:80#HTTP-containerPort:443#HTTPS-containerPort:22#SSHvolumeMounts:-name:gitlab-datamountPath:/var/opt/gitlabvolumes:-name:gitlab-datapersistentVolumeClaim:claimName:gitlab-pvc```注意:实际中,GitLab还需要配置数据库(PostgreSQL)和Redis,但为了简化,我们使用单容器镜像(包含所有组件)。生产环境建议拆分成多个微服务部署。###4.创建Service创建一个Service来暴露GitLab的端口:```yamlapiVersion:v1kind:Servicemetadata:name:gitlab-servicenamespace:gitlabspec:selector:app:gitlabports:-name:httpport:80targetPort:80-name:httpsport:443targetPort:443-name:sshport:22targetPort:22```###5.创建Ingress假设我们使用一个域名(例如gitlab.example.com)来访问GitLab。Ingress需要配置规则:```yamlapiVersion:networking.k8s.io/v1kind:Ingressmetadata:name:gitlab-ingressnamespace:gitlabannotations:nginx.ingress.kubernetes.io/rewrite-target:/spec:rules:-host:gitlab.example.comhttp:paths:-path:/pathType:Prefixbackend:service:name:gitlab-serviceport:number:80```注意:如果需要HTTPS,还需要配置TLS证书。###部署步骤1.创建命名空间:`kubectlcreatenamespacegitlab`2.依次应用上述PVPVC、Deployment、Service和Ingress配置文件。###注意事项-存储:确保NFS服务器已正确设置,并且Kubernetes节点可以访问。-资源:GitLab对内存和CPU要求较高,可以在Deployment中设置资源限制。-初始化:GitLab容器首次启动需要较长时间(几分钟)进行初始化配置。-访问:部署完成后,通过Ingress的域名访问GitLab,初始用户名是root,初始密码在容器内的/etc/gitlab/initial_root_password文件中(注意:该文件24小时后会被删除)。以上配置是一个基础版本,实际生产环境可能需要更复杂的配置,例如配置数据库、Redis、SMTP等。§§相关问题§§1.如何为GitLabIngress配置HTTPS证书?2.如何扩展GitLab以实现高可用性?3.在Kubernetes中部署GitLab时如何配置外部数据库和Redis?</think>### 在 Kubernetes 中部署 GitLab 的完整配置方案 以下是 GitLab 在 Kubernetes 中的核心资源配置,包括 Deployment、Ingress、存储和服务。配置基于 NFS 持久化存储(参考引用[2][3])和 Ingress 路由(参考引用[5])。 #### 1. StorageClass 与持久化存储 (PV/PVC) ```yaml # StorageClass (动态供应) apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: name: nfs-gitlab provisioner: k8s-sigs.io/nfs-subdir-external-provisioner parameters: archiveOnDelete: "false" --- # PersistentVolumeClaim (动态绑定) apiVersion: v1 kind: PersistentVolumeClaim metadata: name: gitlab-data-pvc namespace: gitlab spec: storageClassName: nfs-gitlab accessModes: - ReadWriteMany resources: requests: storage: 50Gi # 根据数据量调整 ``` > **说明**: > 动态存储方案简化了 PV 管理(引用[2])。若需静态 PV,参考引用[3]创建 PV 后绑定 PVC,需指定 `nfs.path` 和 `nfs.server`。 #### 2. Deployment 配置 ```yaml apiVersion: apps/v1 kind: Deployment metadata: name: gitlab namespace: gitlab spec: replicas: 1 # 生产环境建议 ≥2 selector: matchLabels: app: gitlab template: metadata: labels: app: gitlab spec: containers: - name: gitlab image: gitlab/gitlab-ce:latest ports: - containerPort: 80 # HTTP - containerPort: 443 # HTTPS - containerPort: 22 # SSH env: - name: GITLAB_OMNIBUS_CONFIG value: | external_url 'http://gitlab.example.com' gitlab_rails['initial_root_password'] = "your_secure_password" volumeMounts: - name: gitlab-storage mountPath: /var/opt/gitlab volumes: - name: gitlab-storage persistentVolumeClaim: claimName: gitlab-data-pvc ``` > **关键参数**: > - `external_url`: GitLab 访问地址(需与 Ingress host 匹配) > - 挂载点 `/var/opt/gitlab` 存储所有核心数据 > - 多副本时需配置共享存储(如 NFS)和 Redis/PostgreSQL 集群 #### 3. Service 配置 ```yaml apiVersion: v1 kind: Service metadata: name: gitlab-service namespace: gitlab spec: selector: app: gitlab ports: - name: http port: 80 targetPort: 80 - name: ssh port: 22 targetPort: 22 type: ClusterIP # Ingress 代理 HTTP,SSH 需 NodePort/LoadBalancer ``` #### 4. Ingress 配置 (HTTP/HTTPS) ```yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: gitlab-ingress namespace: gitlab annotations: nginx.ingress.kubernetes.io/proxy-body-size: "0" # 允许大文件上传 cert-manager.io/cluster-issuer: "letsencrypt-prod" # 自动 TLS spec: tls: - hosts: - gitlab.example.com secretName: gitlab-tls rules: - host: gitlab.example.com http: paths: - path: / pathType: Prefix backend: service: name: gitlab-service port: number: 80 ``` > **HTTPS 说明**: > 需提前安装 [cert-manager](https://cert-manager.io/) 自动签发证书,或手动添加 TLS 证书到 Secret。 --- ### 部署步骤 1. **创建命名空间** ```bash kubectl create namespace gitlab ``` 2. **部署存储** ```bash kubectl apply -f storageclass.yaml -f pvc.yaml ``` 3. **部署 GitLab** ```bash kubectl apply -f deployment.yaml -f service.yaml ``` 4. **配置 Ingress** ```bash kubectl apply -f ingress.yaml ``` 5. **验证访问** - 将域名 `gitlab.example.com` 解析到 Ingress 控制器 IP - 访问 `http://gitlab.example.com` 或 `https://gitlab.example.com` --- ### 常见问题解决 1. **SSH 访问问题** - 方案 1:Service 改为 `NodePort`,通过节点 IP+端口访问 - 方案 2:部署 LoadBalancer 类型的 Service(云环境) 2. **存储性能优化** - 使用高性能存储(如 Ceph 或云盘) - 分离数据目录(如单独 PVC 挂载 `/var/opt/gitlab/git-data`) 3. **初始化配置** 首次启动后,通过 Pod 执行配置更新: ```bash kubectl exec -it gitlab-pod -n gitlab -- gitlab-ctl reconfigure ``` > **安全建议**: > - 定期备份 PVC 数据(引用[3]) > - 启用 HPA 自动扩缩容 > - 配置资源限制(CPU/Memory)
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值