1. 程式人生 > >kubernetes 中pv、pvc、configmap和secret

kubernetes 中pv、pvc、configmap和secret

configmap和secret
PV和PVC是藉助於StorageClass來分配磁碟的

如何給Pod傳配置資訊:

兩種方式:
1.把configmap關聯到一個pod上,傳遞給pod內部的一個變數,注入的方式給容器傳配置資訊
2.配置卷,將配置檔案對映到外面的路徑

configmap在k8s上扮演了K8s的配置中心的功能
Pod啟動時候講configmap打包為儲存卷,掛載到配置檔案的路徑下
configmap是明文的資訊

secret是密文傳遞的,功能和configmap一樣的

配置容器化應用的方式:
1,自定義命令列引數
    command
    args

2,把配置檔案直接add進映象,不推薦

3,環境變數(類似docker)
    1,Cloud native的應用創徐一般可以直接通過環境變數載入配置
    2,通過entrypoint指令碼來預處理變數為配置檔案中的配置資訊

4.儲存卷

pod資源環境變數的傳遞方式
一個configmap是一群pod的配置集合
儲存的方式key,vallue

 

檢視幫助:
kubectl create configmap --help

開始建立配置檔案:
[[email protected] volumes]# kubectl create configmap nginx-config --from-literal=nginx_port=80 --from-literal=server_name=myapp.node1.com
configmap/nginx-config created

檢視建立配置檔案資訊
kubectl get cm
[
[email protected]
volumes]# kubectl get cm NAME DATA AGE nginx-config 2 1m 檢視配置的具體資訊: [[email protected] volumes]# kubectl get cm NAME DATA AGE nginx-config 2 1m [[email protected] volumes]# kubectl describe cm nginx-config Name: nginx-config Namespace: default Labels: <none> Annotations: <none> Data ==== nginx_port: #key ---- 80 #value server_name: #key ---- myapp.node1.com #value Events: <none> 這個configmap就可以被Pod啟動的時候呼叫了 建立一個nginx配置 vim www.conf kubectl create configmap nginx-www --from-file=www=./www.conf 或者 kubectl create configmap nginx-www --from-file=./www.conf [
[email protected]
configmap]# kubectl get cm NAME DATA AGE nginx-config 2 18h nginx-www 1 8s [[email protected] configmap]# kubectl get cm nginx-www -o yaml apiVersion: v1 data: www.conf: | server { server_name jesse.com listen 80; root /data/web/html/; } kind: ConfigMap metadata: creationTimestamp: 2018-09-12T03:20:39Z name: nginx-www namespace: default resourceVersion: "225540" selfLink: /api/v1/namespaces/default/configmaps/nginx-www uid: d2765aca-b63a-11e8-a432-000c29f33006 [[email protected] configmap]# kubectl describe cm nginx-www Name: nginx-www Namespace: default Labels: <none> Annotations: <none> Data ==== www.conf: ---- server { server_name jesse.com listen 80; root /data/web/html/; } Events: <none>

建立yaml檔案:

 

[[email protected] configmap]# cat pod-configmap.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: pod-cm-1
  namespace: default
  labels:
    app: myapp
    tier: frontend
  annotations:
    node1/create-by: "cluster admin"  #備註
spec:
  containers:
  - name: myapp
    image: ikubernetes/myapp:v1
    ports: 
    - name: http
      containerPort: 80
    env:
    - name: NGINX_SERVER_PORT
      valueFrom:
        configMapKeyRef:
          name: nginx-config
          key: nginx_port
    - name: NGINX_SERVER_NAME
      valueFrom:
        configMapKeyRef:
          name: nginx-config
          key: server_name

[[email protected] configmap]# kubectl apply -f pod-configmap.yaml 
pod/pod-cm-1 created
[[email protected] configmap]# kubectl get pods
NAME       READY     STATUS    RESTARTS   AGE
pod-cm-1   1/1       Running   0          7s
[[email protected] configmap]# kubectl get cm
NAME           DATA      AGE
nginx-config   2         20h
nginx-www      1         2h


進入容器中檢視是否在環境變數中生成成功:
kubectl exec -it pod-cm-1 /bin/sh

/ # printenv
MYAPP_SVC_PORT_80_TCP_ADDR=10.98.57.156
KUBERNETES_PORT=tcp://10.96.0.1:443
KUBERNETES_SERVICE_PORT=443
MYAPP_SVC_PORT_80_TCP_PORT=80
HOSTNAME=pod-cm-1   #生成資料
SHLVL=1
MYAPP_SVC_PORT_80_TCP_PROTO=tcp
HOME=/root
NGINX_SERVER_PORT=80  #生成埠
NGINX_SERVER_NAME=myapp.node1.com    #自己定義的主機名
MYAPP_SVC_PORT_80_TCP=tcp://10.98.57.156:80
TERM=xterm
NGINX_VERSION=1.12.2
KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
KUBERNETES_PORT_443_TCP_PORT=443
KUBERNETES_PORT_443_TCP_PROTO=tcp
MYAPP_SVC_SERVICE_HOST=10.98.57.156
KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443
KUBERNETES_SERVICE_PORT_HTTPS=443
PWD=/
KUBERNETES_SERVICE_HOST=10.96.0.1
MYAPP_SVC_SERVICE_PORT=80
MYAPP_SVC_PORT=tcp://10.98.57.156:80

通過上面已經說明,環境資訊已經注入
如果我更改掉配置,看看是否會生效

[[email protected] configmap]# kubectl edit cm nginx-config
configmap/nginx-config edited

apiVersion: v1
data:
  nginx_port: "8080"   #更改後的埠
  server_name: myapp.node1.com
kind: ConfigMap
metadata:
  creationTimestamp: 2018-09-11T09:19:50Z
  name: nginx-config
  namespace: default
  resourceVersion: "218073"
  selfLink: /api/v1/namespaces/default/configmaps/nginx-config
  uid: d5a14836-b5a3-11e8-a432-000c29f33006


[[email protected] configmap]# kubectl describe cm nginx-config
Name:         nginx-config
Namespace:    default
Labels:       <none>
Annotations:  <none>

Data
====
nginx_port:
----
8080
server_name:
----
myapp.node1.com
Events:  <none>

再次檢視系統變數發現沒有改變
NGINX_SERVER_PORT=80



##############################
也就是說,當我們使用系統變數時,只在系統的啟動時才會有效
##############################

如果我們使用儲存卷的方式是可以隨時改變的

[[email protected] configmap]# cat pod-configmap-2.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: pod-cm-2
  namespace: default
  labels:
    app: myapp
    tier: frontend
  annotations:
    node1/create-by: "cluster admin"  #備註
spec:
  containers:
  - name: myapp
    image: ikubernetes/myapp:v1
    ports: 
    - name: http
      containerPort: 80
    volumeMounts:
    - name: nginxconf
      mountPath: /etc/nginx/config.d/
      readOnly: true   #不允許容器改變我們的內容
  volumes:
  - name: nginxconf
    configMap:
      name: nginx-config

[[email protected] configmap]# kubectl apply -f pod-configmap-2.yaml 
pod/pod-cm-2 created
[[email protected] configmap]# kubectl get pods
NAME       READY     STATUS    RESTARTS   AGE
pod-cm-2   1/1       Running   0          10s


[[email protected] configmap]# kubectl get pods
NAME       READY     STATUS    RESTARTS   AGE
pod-cm-2   1/1       Running   0          1m

kubectl exec -it pod-cm-2 /bin/sh

進入容器檢視狀態:說明是生效的
 # cd /etc/nginx/config.d/
/etc/nginx/config.d # ls
nginx_port   server_name
/etc/nginx/config.d # cat nginx_port 
/etc/nginx/config.d # cat server_name 
myapp.node1.com/etc/nginx/config.d # 


下面我改一下動態的配置
kubectl edit cm nginx-config

apiVersion: v1
data:
  nginx_port: "8088"
  server_name: myapp.node1.com
kind: ConfigMap
metadata:
  creationTimestamp: 2018-09-11T09:19:50Z
  name: nginx-config
  namespace: default
  resourceVersion: "237943"
  selfLink: /api/v1/namespaces/default/configmaps/nginx-config
  uid: d5a14836-b5a3-11e8-a432-000c29f33006

將8080埠更改為8088

我們在容器中檢視
/etc/nginx/config.d # cat nginx_port 
8088/etc/nginx/config.d # 已經改過來了,同步需要幾秒鐘
生效的
過程同步到apiserver->pod中

/etc/nginx/config.d # ls -l
total 0
lrwxrwxrwx    1 root     root            17 Sep 12 13:59 nginx_port -> ..data/nginx_port
lrwxrwxrwx    1 root     root            18 Sep 12 13:59 server_name -> ..data/server_name


####################################
利用configmap和nginx建站
[[email protected] configmap]# cat pod-configmap-3.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: pod-cm-2
  namespace: default
  labels:
    app: myapp
    tier: frontend
  annotations:
    node1/create-by: "cluster admin"  #備註
spec:
  containers:
  - name: myapp
    image: ikubernetes/myapp:v1
    ports: 
    - name: http
      containerPort: 80
    volumeMounts:
    - name: nginxconf
      mountPath: /etc/nginx/conf.d/
      readOnly: true   #不允許容器改變我們的內容
  volumes:
  - name: nginxconf
    configMap:
      name: nginx-www


[[email protected] configmap]# kubectl get pods
NAME       READY     STATUS    RESTARTS   AGE
pod-cm-2   1/1       Running   0          19s

[[email protected] configmap]# kubectl exec -it pod-cm-2 /bin/sh
/ # cd /etc/nginx/conf.d/
/etc/nginx/conf.d # ls
www.conf
/etc/nginx/conf.d # cat www.conf 
server {
    server_name jesse.com
    listen 80;
    root /data/web/html/;
}

檢視nginx的配置
nginx -T
mkdir /data/web/html -p
vi /data/web/html/index.html    Test Nginx

[[email protected] configmap]# kubectl get pods -o wide
NAME       READY     STATUS    RESTARTS   AGE       IP            NODE      NOMINATED NODE
pod-cm-2   1/1       Running   0          7m        10.244.2.62   node2     <none>

在node1上測試,新增jesse.com 10.244.2.62 到解析檔案
[[email protected] ~]# curl jesse.com
<h1>Test! Nginx<h1>


[[email protected] configmap]# kubectl edit cm nginx-www
更改埠8080
apiVersion: v1
data:
  www.conf: |
    server {
        server_name jesse.com
        listen 8080;
        root /data/web/html/;
    }
kind: ConfigMap

在容器內部檢視是否生效:
/etc/nginx/conf.d # cat www.conf 
server {
    server_name jesse.com
    listen 8080;
    root /data/web/html/;
}


在容器內檢視埠:
/etc/nginx/conf.d # netstat -tnl
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      

過載一下nginx配置檔案
nginx -s reload

###################################
儲存卷掛載部分內容
kubectl explain pods.spec.volumes.configMap.items
###################################

secret的使用方式
[[email protected] ~]# kubectl create secret generic mysql-root-password [email protected]
secret/mysql-root-password created
[[email protected] ~]# kubectl get secret
NAME                    TYPE                                  DATA      AGE
default-token-4xzt8     kubernetes.io/service-account-token   3         3d
mysql-root-password     Opaque                                1         13s
tomcat-ingress-secret   kubernetes.io/tls                     2         8h

[[email protected] ~]# kubectl get secret
NAME                    TYPE                                  DATA      AGE
default-token-4xzt8     kubernetes.io/service-account-token   3         3d
mysql-root-password     Opaque                                1         13s
tomcat-ingress-secret   kubernetes.io/tls                     2         8h
[[email protected] ~]# kubectl describe secret mysql-root-password
Name:         mysql-root-password
Namespace:    default
Labels:       <none>
Annotations:  <none>

Type:  Opaque

Data
====
password:  9 bytes

[[email protected] ~]# kubectl get secret mysql-root-password
NAME                  TYPE      DATA      AGE
mysql-root-password   Opaque    1         1m
[[email protected] ~]# kubectl get secret mysql-root-password -o yaml
apiVersion: v1
data:
  password: TXlQQHNzMTIz
kind: Secret
metadata:
  creationTimestamp: 2018-08-17T10:52:26Z
  name: mysql-root-password
  namespace: default
  resourceVersion: "395369"
  selfLink: /api/v1/namespaces/default/secrets/mysql-root-password
  uid: a12239c1-a20b-11e8-9cac-005056a52314
type: Opaque



#解碼

[[email protected] ~]# echo TXlQQHNzMTIz |base64 -d
[email protected]
通過環境量獲取
[[email protected] configmap]# vim pod-secret-1.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: pod-secret-1
  namespace: default
  labels: 
    app: myapp
    tier: frontend
  annotations:
    zpx.com/created-by: "cluster admin"
spec:
  containers:
  - name: myapp
    image: ikubernetes/myapp:v1
    ports:
    - name: http 
      containerPort: 80
    env:
    - name: MYSQL_ROOT_PASSWORD
      valueFrom:
        secretKeyRef:
          name: mysql-root-password
          key: password

[[email protected] configmap]# kubectl apply -f pod-secret-1.yaml 
pod/pod-secret-1 created
[[email protected] configmap]# kubectl get pods
NAME                             READY     STATUS    RESTARTS   AGE
filebeat-ds-7nncx                1/1       Running   0          1d
filebeat-ds-st7f6                1/1       Running   0          1d
myapp-deploy-67f6f6b4dc-tl8z7    1/1       Running   0          1d
myapp-deploy-67f6f6b4dc-vsxnc    1/1       Running   0          1d
myapp-deploy-67f6f6b4dc-x5hw6    1/1       Running   0          1d
pod-cm-2                         1/1       Running   0          55m
pod-cm-3                         1/1       Running   0          45m
pod-demo                         2/2       Running   0          4h
pod-secret-1                     1/1       Running   0          20s
pod-vol-hostpath                 1/1       Running   0          3h
pod-vol-nfs                      1/1       Running   0          3h
pod-vol-pvc                      1/1       Running   0          2h
poststart-pod                    1/1       Running   48         2d
redis-5b5d6fbbbd-t4zl7           1/1       Running   0          1d
tomcat-deploy-588c79d48d-s5hcr   1/1       Running   0          8h
tomcat-deploy-588c79d48d-sd76q   1/1       Running   0          8h
tomcat-deploy-588c79d48d-sxhh6   1/1       Running   0          8h
[[email protected] configmap]# kubectl exec pod-secret-1 -- printenv
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=pod-secret-1
[email protected]
REDIS_PORT_6379_TCP=tcp://10.97.97.97:6379
MYAPP_SERVICE_PORT_HTTP=80
TOMCAT_SERVICE_PORT_AJP=8009
KUBERNETES_PORT=tcp://10.96.0.1:443
KUBERNETES_PORT_443_TCP_PORT=443
TOMCAT_PORT_8080_TCP_PORT=8080
KUBERNETES_SERVICE_HOST=10.96.0.1
KUBERNETES_PORT_443_TCP_PROTO=tcp
REDIS_SERVICE_HOST=10.97.97.97
TOMCAT_PORT_8009_TCP_PROTO=tcp
REDIS_PORT=tcp://10.97.97.97:6379
TOMCAT_PORT_8009_TCP=tcp://10.99.116.34:8009
KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443
MYAPP_SERVICE_HOST=10.107.175.175
MYAPP_PORT_80_TCP_PROTO=tcp
MYAPP_PORT_80_TCP_ADDR=10.107.175.175
TOMCAT_PORT_8080_TCP_PROTO=tcp
MYAPP_PORT_80_TCP_PORT=80
TOMCAT_PORT_8080_TCP_ADDR=10.99.116.34
KUBERNETES_SERVICE_PORT=443
REDIS_PORT_6379_TCP_PROTO=tcp
REDIS_PORT_6379_TCP_PORT=6379
MYAPP_SERVICE_PORT=80
TOMCAT_SERVICE_PORT=8080
TOMCAT_SERVICE_PORT_HTTP=8080
TOMCAT_PORT_8009_TCP_ADDR=10.99.116.34
MYAPP_PORT_80_TCP=tcp://10.107.175.175:80
TOMCAT_SERVICE_HOST=10.99.116.34
KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1
REDIS_SERVICE_PORT=6379
KUBERNETES_SERVICE_PORT_HTTPS=443
REDIS_PORT_6379_TCP_ADDR=10.97.97.97
MYAPP_PORT=tcp://10.107.175.175:80
TOMCAT_PORT=tcp://10.99.116.34:8080
TOMCAT_PORT_8080_TCP=tcp://10.99.116.34:8080
TOMCAT_PORT_8009_TCP_PORT=8009
MYAPP_SVC_PORT_80_TCP_PROTO=tcp
MYAPP_SVC_PORT=tcp://10.98.57.156:80
MYAPP_SVC_PORT_80_TCP_ADDR=10.98.57.156
MYAPP_SVC_SERVICE_HOST=10.98.57.156
MYAPP_SVC_SERVICE_PORT=80
MYAPP_SVC_PORT_80_TCP=tcp://10.98.57.156:80
MYAPP_SVC_PORT_80_TCP_PORT=80
NGINX_VERSION=1.12.2
HOME=/root