第八部分 pv、pcv、cm、secret引入
pv、pvc
如果pvc需要空间很多，pv空间不足以支持，那么生产的pod就会一致hang住，这就需要根据pvc容量，动态生成pv了。
借助中间层StorageClass：针对尚有存储空间，还未做成PV的空间进行分类。
需要restful接口，做强认证
cm明文存储数据，信息容易泄露
secret基于base64加密，非明文，但是解密规则比较简单。
配置容器化应用的方式：
1、自定义命令行参数；
command
args: []
2、把配置文件直接焙进镜像；
3、环境变量
(1) Cloud Native的应用程序一般可直接通过环境变量加载配置；
(2) 通过entrypoint脚本来预处理变量为配置文件中的配置信息；
4、存储卷
configmap
命令行创建cm
[root@k8s-master ~]# kubectl create configmap -h
[root@k8s-master ~]# kubectl create configmap nginx-config --from-literal=nginx_port=80 --from-literal=server_name=myapp.weiwei.com
[root@k8s-master ~]# kubectl describe cm nginx-config
第二种方式：文件创建cm
[root@k8s-master cm]# cat www.conf
server {
server_name myapp.weiwei.com;
listen 80;
root /data/web/html;
}
[root@k8s-master cm]# kubectl create cm nginx-www --from-file=wwwt=./www.conf
[root@k8s-master cm]# kubectl get cm
NAME DATA AGE
nginx-config 2 5m34s
nginx-www 1 13s
[root@k8s-master cm]# kubectl describe cm nginx-www
[root@k8s-master cm]# kubectl get cm nginx-www -oyaml
apiVersion: v1
data:
wwwt: |
server {
server_name myapp.weiwei.com;
listen 80;
root /data/web/html;
}
kind: ConfigMap
metadata:
creationTimestamp: "2023-07-13T04:07:27Z"
name: nginx-www
namespace: default
resourceVersion: "347983"
selfLink: /api/v1/namespaces/default/configmaps/nginx-www
uid: c790fcae-2132-11ee-afb0-000c29250b06
这些cm数据是可以注入到pod容器中的，有两种方式：通过环境变量传入容器
a、通过环境变量方式将cm传入pod
编写pod，让生成的configmap生成的字段传入pod内置环境变量中。
将传入nginx_port、server_name两个变量到pod中。并以变量NGINX_SERVER_PORT、NGINX_SERVER_NAME到环境变量env中。
[root@k8s-master cm]# cat pod-cm.yaml
apiVersion: v1
kind: Pod
metadata:
labels:
app: pod-mydemo
name: pod-cm-1
annotations:
weiwei/create-by: "configmap sunny"
spec:
containers:
- image: ikubernetes/myapp:v1
name: pod-mydemo
ports:
- name: http
containerPort: 80
env:
- name: NGINX_SERVER_PORT
valueFrom:
configMapKeyRef:
name: nginx-config
key: nginx_port
- name: NGINX_SERVER_NAME
valueFrom:
configMapKeyRef:
name: nginx-config
key: server_name
[root@k8s-master cm]# kubectl create -f pod-cm.yaml
pod/pod-cm-1 created
[root@k8s-master cm]# kubectl get pods pod-cm-1
NAME READY STATUS RESTARTS AGE
pod-cm-1 1/1 Running 0 63s
[root@k8s-master cm]# kubectl exec -it pod-cm-1 -- printenv |egrep -i nginx
NGINX_SERVER_PORT=80
NGINX_SERVER_NAME=myapp.weiwei.com
NGINX_VERSION=1.12.2
如上，kubectl get cm nginx-config -oyaml两个变量跟pod一致。说明变量值成功传到pod内部环境变量中。
变更操作：configmap数据调整修改试试，将端口由80调整到8080
[root@master ~]# kubectl edit cm/nginx-config
configmap/nginx-config edited
[root@k8s-master cm]# kubectl get cm nginx-config -oyaml
apiVersion: v1
data:
nginx_port: "8080"
[root@k8s-master cm]# kubectl exec -it pod-cm-1 -- env |egrep -i nginx 查看容器，发现注入的环境变量并没有改变。
NGINX_SERVER_PORT=80
NGINX_SERVER_NAME=myapp.weiwei.com
NGINX_VERSION=1.12.2
删除pod重建才可以看出变更的端口信息。
b、通过volume方式将cm传入pod
基于上述情况有如下需求：在cm修改之后，会立即同步到api server中，再传入pod内部，需要几秒钟。
这个时候需要，配置volumes卷来管理资源。
[root@k8s-master cm]# cat pod-cm2.yaml
apiVersion: v1
kind: Pod
metadata:
labels:
app: pod-mydemo
name: pod-cm-2
annotations:
weiwei/create-by: "configmap sunny"
spec:
containers:
- image: ikubernetes/myapp:v1
name: pod-mydemo
ports:
- name: http
containerPort: 80
volumeMounts:
- name: nginxconf
mountPath: /etc/nginx/config.d/
readOnly: true
volumes:
- name: nginxconf
configMap:
name: nginx-config
[root@k8s-master cm]# kubectl create -f pod-cm2.yaml
pod/pod-cm-2 created
[root@k8s-master cm]# kubectl exec -it pod-cm-2 -- cat /etc/nginx/config.d/nginx_port
8080
[root@k8s-master cm]# kubectl edit cm nginx-config 调整端口到8088
"/tmp/kubectl-edit-2g4qb.yaml" 16L, 529C written
configmap/nginx-config edited
[root@k8s-master cm]# kubectl exec -it pod-cm-2 -- cat /etc/nginx/config.d/nginx_port
8080[root@k8s-master cm]# kubectl exec -it pod-cm-2 -- cat /etc/nginx/config.d/nginx_port
8080[root@k8s-master cm]# kubectl exec -it pod-cm-2 -- cat /etc/nginx/config.d/nginx_port
...
8088[root@k8s-master cm]# kubectl exec -it pod-cm-2 -- cat /etc/nginx/config.d/nginx_port
8088[root@k8s-master cm]#
因为信息需要通过apiserver同步到etcd中，然后再回到pod，整个过程是随机的几秒钟。
b、通过volume方式之虚拟机主机静cm作为配置文件传入pod
[root@k8s-master cm]# cat >>www_nginx.conf<<EOF
server {
server_name myapp.weiwei.com;
listen 81;
root /data/web/html;
}
EOF
[root@k8s-master cm]# kubectl create cm nginx-vhost --from-file=nginx_vhost.conf=./www_nginx.conf
[root@k8s-master cm]# kubectl get cm nginx-vhost -oyaml
apiVersion: v1
data:
nginx_vhost.conf: |
server {
server_name myapp.weiwei.com;
listen 81;
root /data/web/html;
}
[root@k8s-master cm]# kubectl exec -it pod-cm-3 -- ls /etc/nginx/conf.d/nginx_vhost.conf
/etc/nginx/conf.d/nginx_vhost.conf
[root@k8s-master cm]# kubectl exec -it pod-cm-3 -- nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@k8s-master cm]# kubectl exec -it pod-cm-3 -- cat /etc/nginx/conf.d/nginx_vhost.conf
server {
server_name myapp.weiwei.com;
listen 81;
root /data/web/html;
}
[root@k8s-master cm]# kubectl exec -it pod-cm-3 -- nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@k8s-master cm]# kubectl exec -it pod-cm-3 -- nginx -T |tail -7 (如下cm作为配置文件写入到pod容器中)
# configuration file /etc/nginx/conf.d/nginx_vhost.conf:
server {
server_name myapp.weiwei.com;
listen 81;
root /data/web/html;
}
[root@k8s-master cm]# kubectl exec -it pod-cm-3 -- /bin/sh # 登录容器，创建静态访问文件
/ # mkdir -p /data/web/html/ && echo "<h1>Welcome to comfigMap.</h1>" >/data/web/html/index.html
/ # netstat -lnpt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:81 0.0.0.0:* LISTEN 1/nginx: master pro
/ # ip add |grep 10.244 |awk '{print $2}'|awk -F '/' '{print $1}'
10.244.2.44
/ # exit
[root@k8s-master cm]# curl 10.244.2.44:81 # 访问验证成功，
<h1>Welcome to comfigMap.</h1>
[root@k8s-master cm]# kubectl edit cm nginx-vhost 同样将81端口改为8001端口
[root@k8s-master cm]# kubectl exec -it pod-cm-3 -- cat /etc/nginx/conf.d/nginx_vhost.conf # 查看pod配置已经修改了，只是没有重载nginx
server {
server_name myapp.weiwei.com;
listen 8001;
root /data/web/html;
}
[root@k8s-master cm]# kubectl exec -it pod-cm-3 -- netstat -lnpt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:81 0.0.0.0:* LISTEN 1/nginx: master pro
[root@k8s-master cm]# kubectl exec -it pod-cm-3 -- nginx -s reload # 重载nginx服务，再次访问。
2023/07/13 10:53:40 [notice] 74#74: signal process started
[root@k8s-master cm]# kubectl exec -it pod-cm-3 -- netstat -lnpt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:8001 0.0.0.0:* LISTEN 1/nginx: master pro
[root@k8s-master cm]# curl 10.244.2.44:8001
除了直接挂载配置文件方式外，还会把某些字段设置key传入，也可以指定文件属性。
自此，完成了comfigmap配置操作，验证正常。
secret引入
cm不能保存敏感数据，需要引入secrets
用于存放mysql密码，私钥证书，有三种secret认证方式
[root@k8s-master ~]# kubectl create secret --help
Create a secret using specified subcommand.
Available Commands:
docker-registry 创建一个给 Docker registry 使用的 secret
generic 从本地 file, directory 或者 literal value 创建一个 secret
tls 创建一个 TLS secret
[root@k8s-master cm]# kubectl create secret generic my-root-secret --from-literal=password=MyP@ss12
secret/my-root-secret created
[root@k8s-master cm]# kubectl get secret
NAME TYPE DATA AGE
default-token-64vq2 kubernetes.io/service-account-token 3 4d1h
my-root-secret Opaque 1 14s
tomcat-ingress-secret kubernetes.io/tls 2 26h
[root@k8s-master cm]# kubectl describe secret my-root-secret
Name: my-root-secret
Namespace: default
Labels: <none>
Annotations: <none>
Type: Opaque
Data
====
password: 8 bytes
[root@k8s-master cm]# kubectl get secret my-root-secret -oyaml # 可以看到密文
apiVersion: v1
data:
password: TXlQQHNzMTI=
kind: Secret
metadata:
creationTimestamp: "2023-07-13T11:06:19Z"
name: my-root-secret
namespace: default
resourceVersion: "388301"
selfLink: /api/v1/namespaces/default/secrets/my-root-secret
uid: 4b88060b-216d-11ee-93aa-000c29250b06
type: Opaque
[root@k8s-master cm]# echo TXlQQHNzMTI= |base64 -d # 解密数据，获得原始内容
MyP@ss12[root@k8s-master cm]#
[root@k8s-master cm]# kubectl create -f pod-secret-1.yaml
[root@k8s-master cm]# cat pod-secret-1.yaml secret注入到pod中
apiVersion: v1
kind: Pod
metadata:
labels:
app: pod-mydemo
name: pod-secret-1
annotations:
weiwei/create-by: "secret sunny"
spec:
containers:
- image: ikubernetes/myapp:v1
name: pod-mydemo
ports:
- name: http
containerPort: 80
env:
- name: MYSQL_ROOT_PASSWORD
valueFrom:
secretKeyRef:
name: my-root-secret
key: password
[root@k8s-master cm]# kubectl exec -it pod-secret-1 -- printenv | grep -i mysql # 验证，在pod中以明文形式出现
MYSQL_ROOT_PASSWORD=MyP@ss12
其他两种形式展示的serect，暂不演示。