[toc]

kubernetes 操作记录三

存储卷

emptyDir

COPY
# vim pod-vol-demo.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: pod-demo
  namespace: default
  labels:
    app: myapp
    tier: frontend
  annotations:
    ssjinyao.com/create-by: "cluster admin"
spec:
  containers:
  - name: myapp
    image: ikubernetes/myapp:v1
    imagePullPolicy: IfNotPresent
    ports:
    - name: http
      containerPort: 80
    volumeMounts:
    - name: html
      mountPath: /data/www/html
    command: ["/bin/sh"]
    args: ["-c" ,  "httpd -h /data/www/html && sleep 300000"]
  - name: busybox
    image: busybox:latest
    imagePullPolicy: IfNotPresent
    volumeMounts:
    - name: html
      mountPath: /data/
    command: ["/bin/sh"]
    args: [ "-c", "while sleep 2 ; do echo $(date) >> /data/index.html; done"]
  volumes:
  - name: html
    emptyDir: {}
# kubectl exec -it pod-demo -c busybox -- /bin/sh
/ # echo $(date) >> /data/index.html
/ # cat /data/index.html
Fri May 17 06:59:59 UTC 2019
# kubectl exec -it pod-demo -c myapp  -- /bin/sh
/ # ls /data/web/html/index.html
/data/web/html/index.html
/ # cat /data/web/html/index.html
Fri May 17 06:59:59 UTC 2019
# curl  10.244.2.183
Fri May 17 07:33:24 UTC 2019
Fri May 17 07:33:26 UTC 2019
Fri May 17 07:33:28 UTC 2019
Fri May 17 07:33:30 UTC 2019
Fri May 17 07:33:32 UTC 2019
Fri May 17 07:33:34 UTC 2019
Fri May 17 07:33:36 UTC 2019
Fri May 17 07:33:38 UTC 2019
Fri May 17 07:33:40 UTC 2019
Fri May 17 07:33:42 UTC 2019
Fri May 17 07:33:44 UTC 2019

hostPath挂载使用

COPY
# vim pod-hostpath-vol.yaml
apiVersion: v1
kind: Pod
metadata:
  name: pod-vol-hostpath
  namespace: default
spec:
  containers:
  - name: myapp
    image: ikubernets/myapp:v1
    volumeMounts:
    - name: html
      mountPath: /usr/share/nginx/html/
  volumes:
  - name: html
    hostPath:
      path: /data/pod/volume1
      type: DirectoryOrCreate
# kubectl apply -f pod-hostpath-vol.yaml

node1,node2,node3 分别创建以下目录

COPY
# mkdir -p /data/pod/volume1/ #注三个节点都要执行
# echo "node1.ssjinyao.com" >> /data/pod/volume1/index.html
# echo "node2.ssjinyao.com" >> /data/pod/volume1/index.html
# echo "node3.ssjinyao.com" >> /data/pod/volume1/index.html
# curl 10.244.1.155
node1.ssjinyao.com

可以看出当前运行在node1节点上

nfs 卷挂载使用

选择一台服务器，安装并开启nfs 服务

COPY
# mkdir -pv /data/volumes
# yum -y install nfs nfs-utils 
# vim /etc/exports
/data/volumes  10.1.87.83/24(rw,no_root_squash)
# systemctl start nfs

注: 其它节点也需要安装 nfs-utils 不然pod驱动不了

在node02上手动测试挂载

COPY
# mount -t nfs node03:/data/volumes/ /mnt

在kubernetes 集群中使用nfs volumes

COPY
apiVersion: v1
kind: Pod
metadata:
  name: pod-vol-nfs
  namespace: default
spec:
  containers:
  - name: myapp
    image: ikubernetes/myapp:v1
    volumeMounts:
    - name: html
      mountPath: /usr/share/nginx/html/
  volumes:
  - name: html
    nfs:
      path: /data/volumes
      server: node03
# kubectl apply -f pod-vol-nfs.yaml

在nfs服务器上写入数据

COPY
# echo "<h1>nfs.ssjinyao.com</h1>" >> /data/volumes/index.html

尝试访问

COPY
# curl  10.244.2.185
<h1>nfs.ssjinyao.com</h1>

pv, pvc 的使用

nfs 服务器上创建多个目录

COPY
# mkdir /data/volumes/v{1,2,3,4,5}
# vim /etc/exports
/data/volumes/v1 10.1.87.83/24(rw,no_root_squash)
/data/volumes/v2 10.1.87.83/24(rw,no_root_squash)
/data/volumes/v3 10.1.87.83/24(rw,no_root_squash)
/data/volumes/v4 10.1.87.83/24(rw,no_root_squash)
/data/volumes/v5 10.1.87.83/24(rw,no_root_squash)
# exportfs -arv
exporting 10.1.87.83/24:/data/volumes/v5
exporting 10.1.87.83/24:/data/volumes/v4
exporting 10.1.87.83/24:/data/volumes/v3
exporting 10.1.87.83/24:/data/volumes/v2
exporting 10.1.87.83/24:/data/volumes/v1
# systemctl restart nfs

COPY
# vim pv-demo.yaml
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv01
  labels:
    name: pv001
spec:
  nfs:
    path: /data/volumes/v1
    server: node03
  accessModes: ["ReadWriteMany","ReadWriteOnce"]
  capacity:
    storage: 5Gi
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv02
  labels:
    name: pv002
spec:
  nfs:
    path: /data/volumes/v2
    server: node03
  accessModes: ["ReadWriteOnce"]
  capacity:
    storage: 10Gi
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv03
  labels:
    name: pv003
spec:
  nfs:
    path: /data/volumes/v3
    server: node03
  accessModes: ["ReadWriteMany","ReadWriteOnce"]
  capacity:
    storage: 20Gi
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv04
  labels:
    name: pv004
spec:
  nfs:
    path: /data/volumes/v4
    server: node03
  accessModes: ["ReadWriteMany","ReadWriteOnce"]
  capacity:
    storage: 10Gi
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv05
  labels:
    name: pv005
spec:
  nfs:
    path: /data/volumes/v5
    server: node03
  accessModes: ["ReadWriteMany","ReadWriteOnce"]
  capacity:
    storage: 10Gi
---
# kubectl get pv
NAME   CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS      CLAIM   STORAGECLASS   REASON   AGE
pv01   5Gi        RWO,RWX        Retain           Available                                   74s
pv02   10Gi       RWO            Retain           Available                                   74s
pv03   20Gi       RWO,RWX        Retain           Available                                   74s
pv04   10Gi       RWO,RWX        Retain           Available                                   74s
pv05   10Gi       RWO,RWX        Retain           Available                                   74s

pvc 绑定 pv

COPY
# cat pod-vol-pvc.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mypvc
  namespace: default
spec:
  accessModes: ["ReadWriteMany"]
  resources:
    requests:
      storage: 11Gi
---
apiVersion: v1
kind: Pod
metadata:
  name: pod-vol-pvc
  namespace: default
spec:
  containers:
  - name: myapp
    image: ikubernetes/myapp:v1
    volumeMounts:
    - name: html
      mountPath: /usr/share/nginx/html/
  volumes:
  - name: html
    persistentVolumeClaim:
      claimName: mypvc
# kubectl apply -f pod-vol-pvc.yaml
# kubectl get pv
NAME   CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS      CLAIM           STORAGECLASS   REASON   AGE
pv01   5Gi        RWO,RWX        Retain           Available                                           40m
pv02   10Gi       RWO            Retain           Available                                           40m
pv03   20Gi       RWO,RWX        Retain           Bound       default/mypvc                           40m
pv04   10Gi       RWO,RWX        Retain           Available                                           40m
pv05   10Gi       RWO,RWX        Retain           Available                                           40m
#  kubectl  get pvc
NAME    STATUS   VOLUME   CAPACITY   ACCESS MODES   STORAGECLASS   AGE
mypvc   Bound    pv03     20Gi       RWO,RWX                       8s

configmap 的使用

COPY
# kubectl create configmap nginx-config --from-literal=nginx_port=80 --from-literal=server_name=myapp.ssjinyao.com
configmap/nginx-config created
# kubectl  get cm
NAME           DATA   AGE
nginx-config   2      25s
# kubectl describe cm nginx-config
Name:         nginx-config
Namespace:    default
Labels:       <none>
Annotations:  <none>
 
Data
====
nginx_port:
----
80
server_name:
----
myapp.ssjinyao.com
Events:  <none>

COPY
# mkdir configmap
# cd configmap/
# vim www.conf
server {
    server_name myapp.ssjinyao.com;
        listen 80;
        root /data/web/html/;
 
}
# kubectl create configmap nginx-www --from-file=./www.conf
# kubectl get cm
NAME           DATA   AGE
nginx-config   2      4m4s
nginx-www      1      3s
# kubectl  get cm nginx-www -o yaml
apiVersion: v1
data:
  www.conf: "server {\n\tserver_name myapp.ssjinyao.com;\n        listen 80;\n        root
    /data/web/html/;\n\n}\n"
kind: ConfigMap
metadata:
  creationTimestamp: "2019-05-20T08:17:37Z"
  name: nginx-www
  namespace: default
  resourceVersion: "3462936"
  selfLink: /api/v1/namespaces/default/configmaps/nginx-www
  uid: ba1625a7-7ad7-11e9-8902-525400c45563

Pod 引用 configmap ，环境变量方式

COPY
# vim pod-configmap.yaml
apiVersion: v1
kind: Pod
metadata:
  name: pod-cm-1
  namespace: default
  labels:
    app: myapp
    tier: frontend
  annotations:
    ssjinyao.com/create-by: "cluster admin"
spec:
  containers:
  - name: myapp
    image: ikubernetes/myapp:v1
    ports:
    - name: http
      containerPort: 80
    env:
    - name: NGINX_SERVER_PORT
      valueFrom:
        configMapKeyRef:
          name: nginx-config
          key: nginx_port
    - name: NGINX_SERVER_NAME
      valueFrom:
        configMapKeyRef:
          name: nginx-config
          key: server_name
# kubectl  apply -f pod-configmap.yaml
pod/pod-cm-1 created
# kubectl  exec pod-cm-1 -it -- /bin/sh
/ # printenv | grep NGINX_SERVER
NGINX_SERVER_PORT=80
NGINX_SERVER_NAME=myapp.ssjinyao.com

当环境变量获取时，容器的变量不是实时更新的

COPY
# kubectl edit cm nginx-config
configmap/nginx-config edited
# 将nginx_port: "80" 改变 nginx_port: "8080"
# 可以看到configmap 是实时生效的
# kubectl describe cm nginx-config
Name:         nginx-config
Namespace:    default
Labels:       <none>
Annotations:  <none>
 
Data
====
nginx_port:
----
8080
server_name:
----
myapp.ssjinyao.com
Events:  <none>
# 而容器中则不会时实更新变量
# kubectl  exec pod-cm-1 -it -- /bin/sh
/ # printenv | grep NGINX_SERVER
NGINX_SERVER_PORT=80
NGINX_SERVER_NAME=myapp.ssjinyao.com

存储卷挂载方式

COPY
# vim pod-configmap2.yaml
apiVersion: v1
kind: Pod
metadata:
  name: pod-cm-2
  namespace: default
  labels:
    app: myapp
    tier: frontend
  annotations:
    ssjinyao.com/create-by: "cluster admin"
spec:
  containers:
  - name: myapp
    image: ikubernetes/myapp:v1
    ports:
    - name: http
      containerPort: 80
    volumeMounts:
    - name: nginxconf
      mountPath: /etc/nginx/config.d/
      readOnly: true
  volumes:
  - name: nginxconf
    configMap:
      name: nginx-config
# kubectl apply -f pod-configmap2.yaml
pod/pod-cm-2 created
# kubectl exec pod-cm-2 -it -- /bin/sh
/ # cd /etc/nginx/conf
conf.d/    config.d/
/ # cd /etc/nginx/config.d/
/etc/nginx/config.d # ls
nginx_port   server_name
/etc/nginx/config.d # cat nginx_port
8080/etc/nginx/config.d #
/etc/nginx/config.d # cat server_name
myapp.ssjinyao.com/etc/nginx/config.d #
# kubectl edit cm nginx-config
configmap/nginx-config edited
# 将nginx_port: "8080" 改为 nginx_port: "8088" 
# 稍等片刻后，接入容器发现nginx_port值实时更新
# kubectl edit cm nginx-config
Edit cancelled, no changes made.
[root@bj-zb-vm-ops-test5 configmap]# kubectl exec pod-cm-2 -it -- /bin/sh
/ # cd /etc/nginx/config.d/
/etc/nginx/config.d # cat nginx_port
8088/etc/nginx/config.d #

案例,配置文件焙进镜像

COPY
# vim pod-configmap3.yaml
# kubectl apply -f pod-configmap3.yaml
apiVersion: v1
kind: Pod
metadata:
  name: pod-cm-3
  namespace: default
  labels:
    app: myapp
    tier: frontend
  annotations:
    ssjinyao.com/create-by: "cluster admin"
spec:
  containers:
  - name: myapp
    image: ikubernetes/myapp:v1
    ports:
    - name: http
      containerPort: 80
    volumeMounts:
    - name: nginxconf
      mountPath: /etc/nginx/conf.d/
      readOnly: true
  volumes:
  - name: nginxconf
    configMap:
      name: nginx-www
# kubectl exec pod-cm-3 -it -- /bin/sh
/ # cd /etc/nginx/conf.d/
/etc/nginx/conf.d # cat www.conf
server {
    server_name myapp.ssjinyao.com;
        listen 80;
        root /data/web/html/;
 
}
# kubectl edit cm nginx-www
configmap/nginx-www edited
# 将 listen 80 改为 listen 8080，稍等片刻后接入容器查看配置
# kubectl exec pod-cm-3 -it -- /bin/sh
/ # cd /etc/nginx/conf.d/
/etc/nginx/conf.d # cat www.conf
server {
    server_name myapp.ssjinyao.com;
        listen 8080;
        root /data/web/html/;
 
}
# echo "<h1> Nginx Server Configured by CM </h1>" > /data/web/html/index.html
# 说明配置文件焙进镜像的方式是可以实时更新的;当然配置文件生效，需要nginx -s reload
# vim /etc/hosts  加入本地解析至Pod ip
10.244.1.158 myapp.ssjinyao.com
# curl  http://myapp.ssjinyao.com:8080
<h1> Nginx Server Configured by CM </h1>

secret 的使用

configmap 都是明文存数据的，私钥和证书要放在secret中，密码要写成dns secret 而非configamp

COPY
# kubectl create secret generic mysql-root-password   --from-literal=passwod=H@ndih3
secret/mysql-root-password created
# kubectl  get secret
NAME                    TYPE                                  DATA   AGE
default-token-2sgn5     kubernetes.io/service-account-token   3      24d
mysql-root-password     Opaque                                1      45s
tomcat-ingress-secret   kubernetes.io/tls                     2      4d
# kubectl describe secret mysql-root-password
Name:         mysql-root-password
Namespace:    default
Labels:       <none>
Annotations:  <none>
 
Type:  Opaque
 
Data
====
passwod:  7 bytes
# 对比configmap  的Data数据，secret 值是不显示的
# kubectl describe configmap nginx-www
Name:         nginx-www
Namespace:    default
Labels:       <none>
Annotations:  <none>
 
Data
====
www.conf:
----
server {
  server_name myapp.ssjinyao.com;
        listen 8080;
        root /data/web/html/;
 
}
 
Events:  <none>
# 而 configmap  Data的值是显示的
# 我们也可以这样看
 
# kubectl  get secret mysql-root-password -o yaml
apiVersion: v1
data:
  passwod: SEBuZGloMw==
kind: Secret
metadata:
  creationTimestamp: "2019-05-20T09:20:53Z"
  name: mysql-root-password
  namespace: default
  resourceVersion: "3469600"
  selfLink: /api/v1/namespaces/default/secrets/mysql-root-password
  uid: 90cd9aaa-7ae0-11e9-8902-525400c45563
type: Opaque」

可以看出数据还是有的，因此安全没有那好，也没有加密码的意义
可以直接用 base64 -d 进行解密

COPY
# echo SEBuZGloMw== | base64 -d
H@ndih3

COPY
# vim  pod-secret-1.yaml
apiVersion: v1
kind: Pod
metadata:
  name: pod-secret-1
  namespace: default
  labels:
    app: myapp
    tier: frontend
  annotations:
    ssjinyao.com/create-by: "cluster admin"
spec:
  containers:
  - name: myapp
    image: ikubernetes/myapp:v1
    ports:
    - name: http
      containerPort: 80
    env:
    - name: MYSQL_ROOT_PASSWORD
      valueFrom:
        secretKeyRef:
          name: mysql-root-password
          key: passwod

COPY
# kubectl exec  pod-secret-1 -- printenv | grep MYSQL
MYSQL_ROOT_PASSWORD=H@ndih3

statefulset 的使用

nfs服务器还是在node3 上，配置信息如下

COPY
# cat /etc/exports
/data/volumes/v1 10.1.87.83/24(rw,no_root_squash)
/data/volumes/v2 10.1.87.83/24(rw,no_root_squash)
/data/volumes/v3 10.1.87.83/24(rw,no_root_squash)
/data/volumes/v4 10.1.87.83/24(rw,no_root_squash)
/data/volumes/v5 10.1.87.83/24(rw,no_root_squash)

注：确保三台node服务器都安装了 nfs-utils

pv改动及创建

COPY
# cat volumes/pv-demo.yaml
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv01
  labels:
    name: pv001
spec:
  nfs:
    path: /data/volumes/v1
    server: node03
  accessModes: ["ReadWriteMany","ReadWriteOnce"]
  capacity:
    storage: 5Gi
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv02
  labels:
    name: pv002
spec:
  nfs:
    path: /data/volumes/v2
    server: node03
  accessModes: ["ReadWriteOnce"]
  capacity:
    storage: 5Gi
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv03
  labels:
    name: pv003
spec:
  nfs:
    path: /data/volumes/v3
    server: node03
  accessModes: ["ReadWriteMany","ReadWriteOnce"]
  capacity:
    storage: 5Gi
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv04
  labels:
    name: pv004
spec:
  nfs:
    path: /data/volumes/v4
    server: node03
  accessModes: ["ReadWriteMany","ReadWriteOnce"]
  capacity:
    storage: 10Gi
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv05
  labels:
    name: pv005
spec:
  nfs:
    path: /data/volumes/v5
    server: node03
  accessModes: ["ReadWriteMany","ReadWriteOnce"]
  capacity:
    storage: 10Gi
---
# kubectl apply -f volumes/pv-demo.yaml

COPY
# vim stateful-demo.yaml
apiVersion: v1
kind: Service
metadata:
  name: myapp
  labels:
    app: myapp
spec:
  ports:
  - port: 80
    name: web
  clusterIP: None
  selector:
    app: myapp-pod
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: myapp
spec:
  serviceName: myapp
  replicas: 3
  selector:
    matchLabels:
      app: myapp-pod
  template:
    metadata:
      labels:
        app: myapp-pod
    spec:
      containers:
      - name: myapp
        image: ikubernetes/myapp:v1
        ports:
        - containerPort: 80
          name: web
        volumeMounts:
        - name: myappdata
          mountPath: /usr/share/nginx/html
  volumeClaimTemplates:
  - metadata:
      name: myappdata
    spec:
      accessModes: ["ReadWriteOnce"]
      resources:
        requests:
          storage: 5Gi
# kubectl get pods
NAME                             READY   STATUS    RESTARTS   AGE
client                           1/1     Running   0          23d
myapp-0                          1/1     Running   0          7m10s
myapp-1                          1/1     Running   0          7m5s
myapp-2                          1/1     Running   0          7m1s
# kubectl get sts
NAME    READY   AGE
myapp   3/3     7m32s
# kubectl get pv
NAME   CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS      CLAIM                       STORAGECLASS   REASON   AGE
pv01   5Gi        RWO,RWX        Retain           Bound       default/myappdata-myapp-1                           8m12s
pv02   5Gi        RWO            Retain           Bound       default/myappdata-myapp-0                           8m12s
pv03   5Gi        RWO,RWX        Retain           Bound       default/myappdata-myapp-2                           8m12s
pv04   10Gi       RWO,RWX        Retain           Available                                                       8m12s
pv05   10Gi       RWO,RWX        Retain           Available                                                       8m12s
# kubectl exec -it myapp-0 -- /bin/sh
/ # nslookup myapp-0.myapp.default.svc.cluster.local
nslookup: can't resolve '(null)': Name does not resolve
 
Name:      myapp-0.myapp.default.svc.cluster.local
Address 1: 10.244.1.162 myapp-0.myapp.default.svc.cluster.local
/ # nslookup myapp-1.myapp.default.svc.cluster.local
nslookup: can't resolve '(null)': Name does not resolve
 
Name:      myapp-1.myapp.default.svc.cluster.local
Address 1: 10.244.2.192 myapp-1.myapp.default.svc.cluster.local
/ # nslookup myapp-2.myapp.default.svc.cluster.local
nslookup: can't resolve '(null)': Name does not resolve
 
Name:      myapp-2.myapp.default.svc.cluster.local
Address 1: 10.244.3.172 myapp-2.myapp.default.svc.cluster.local

pod 数量扩展

COPY
# kubectl scale sts myapp --replicas=5
statefulset.apps/myapp scaled
# kubectl patch sts myapp -p '{"spec":{"replicas":2}}'
statefulset.apps/myapp patched
# kubectl patch sts myapp -p '{"spec":{"updateStrategy":{"rollingUpdate":{"partition":4}}}}'
statefulset.apps/myapp patched
# kubectl set image sts/myapp myapp=ikubernetes/myapp:v2
statefulset.apps/myapp image updated
# kubectl get sts -o wide
NAME    READY   AGE   CONTAINERS   IMAGES
myapp   2/2     53m   myapp        ikubernetes/myapp:v2