KUBERNETES05_NFS坏境搭建PVPVC挂载目录ConfigMap挂载文件Secret挂载敏感信息

Posted 2021-12-29 所得皆惊喜

文章目录

• ①. 基本概念与NFS环境搭建
• ②. Deployment使用NFS进行挂载
• ③. PV、PVC挂载目录
• ④. ConfigMap挂载文件
• ⑤. Secret挂载敏感信息

①. 基本概念与NFS环境搭建

• ①. 在docker里面可以将容器里面的文件挂载在外面,可以很好的修改文件。在k8s中,如果我们使用目录挂载,当node1节点中的pod挂了,会发生故障转移到别的node2上面,这时node2中并没有node1中的文件。这时引入了NFS网络文件系统,当master节点的文件改变了,会同步到node节点,node节点文件发生了改变,也会同步到master
  

• ②. 安装NFS

# (1). 所有节点
yum install -y nfs-utils

#(2). 主节点
#nfs主节点
echo "/nfs/data/ *(insecure,rw,sync,no_root_squash)" > /etc/exports

mkdir -p /nfs/data
systemctl enable rpcbind --now
systemctl enable nfs-server --now
#配置生效
exportfs -r

# (3). 从节点
showmount -e 192.168.68.144
#执行以下命令挂载 nfs 服务器上的共享目录到本机路径 /root/nfsmount
mkdir -p /nfs/data
mount -t nfs 192.168.68.144:/nfs/data /nfs/data

# (4). 在主节点 写入一个测试文件
echo "hello nfs server" > /nfs/data/test.txt
# 去node节点查看/nfs/data/下是不是有一个test.txt

②. Deployment使用NFS进行挂载

• ①. 创建文件夹 cd /nfs/data/html,在master节点执行 kubectl apply -f deploy.yaml(yaml文件内容如下)

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: nginx-pv-demo
  name: nginx-pv-demo
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx-pv-demo
  template:
    metadata:
      labels:
        app: nginx-pv-demo
    spec:
      containers:
      - image: nginx
        name: nginx
        volumeMounts:
        - name: html
          mountPath: /usr/share/nginx/html
      volumes:
        - name: html
          nfs:
            server: 192.168.68.144
            path: /nfs/data/nginx-pv

[root@k8smaster nginx-pv]# echo "hello NFS " >index.html
[root@k8smaster nginx-pv]# kubectl get pods -owide
NAME                            READY   STATUS    RESTARTS   AGE     IP               NODE       NOMINATED NODE   READINESS GATES
hello-server-6cbb679d85-pxwld   1/1     Running   1          3h56m   11.168.249.22    k8snode1   <none>           <none>
hello-server-6cbb679d85-rslbx   1/1     Running   1          3h56m   11.168.185.223   k8snode2   <none>           <none>
my-dep-01-54d8bdbf78-4xmbj      1/1     Running   1          4h54m   11.168.185.220   k8snode2   <none>           <none>
my-dep-01-54d8bdbf78-h2w7x      1/1     Running   1          4h54m   11.168.185.222   k8snode2   <none>           <none>
my-dep-01-54d8bdbf78-xfrm2      1/1     Running   1          4h54m   11.168.249.25    k8snode1   <none>           <none>
mynginx                         1/1     Running   1          136m    11.168.185.221   k8snode2   <none>           <none>
nginx-demo-7d56b74b84-mdcks     1/1     Running   1          3h56m   11.168.185.224   k8snode2   <none>           <none>
nginx-demo-7d56b74b84-rpzvn     1/1     Running   1          3h56m   11.168.249.26    k8snode1   <none>           <none>
nginx-pv-demo-bc8c96c6b-6jwtx   1/1     Running   0          97s     11.168.185.227   k8snode2   <none>           <none>
nginx-pv-demo-bc8c96c6b-jb6d8   1/1     Running   0          97s     11.168.249.28    k8snode1   <none>           <none>
[root@k8smaster nginx-pv]# curl 11.168.185.227
hello NFS 
[root@k8smaster nginx-pv]# 

• ②. 缺点

1. 需要自己手动创建/nfs/data/html文件夹
2. 如果pod不要了,这个时候删除了node节点中的pod,这个时候的html中文件不会随着pod的删除而删除

③. PV、PVC挂载目录

• ①. PV:持久卷(Persistent Volume),将应用需要持久化的数据保存到指定位置

• ②. PVC:持久卷申明(Persistent Volume Claim),申明需要使用的持久卷规格(用多大的空间)

• ③. 静态供应:提前将空间大小规定好,比如说下次pod要挂文件了,写一个申请的空间大小(比如11M),我们在静态供应池中寻找一个20MB的空间给这个需要的pod

• ④. 动态供应:静态供应只能在已有的pv里面进行挑选,动态供应,我们也需要提交一个申请如10m,这个时候在pv里面会自动创建一个10m进行一个绑定(下图右边的pod)
  

• ⑤. 演示静态供应

# (1). nfs主节点、静态供应
mkdir -p /nfs/data/01
mkdir -p /nfs/data/02
mkdir -p /nfs/data/03

(2). 创建PV
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv01-10m
spec:
  capacity:
    storage: 10M
  accessModes:
    - ReadWriteMany
  storageClassName: nfs
  nfs:
    path: /nfs/data/01
    server: 192.168.68.144
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv02-1gi
spec:
  capacity:
    storage: 1Gi
  accessModes:
    - ReadWriteMany
  storageClassName: nfs
  nfs:
    path: /nfs/data/02
    server: 192.168.68.144
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv03-3gi
spec:
  capacity:
    storage: 3Gi
  accessModes:
    - ReadWriteMany
  storageClassName: nfs
  nfs:
    path: /nfs/data/03
    server: 192.168.68.144

# (3). PVC创建与绑定
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: nginx-pvc
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 200Mi
  storageClassName: nfs

# (4). 创建Pod绑定PVC
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: nginx-deploy-pvc
  name: nginx-deploy-pvc
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx-deploy-pvc
  template:
    metadata:
      labels:
        app: nginx-deploy-pvc
    spec:
      containers:
      - image: nginx
        name: nginx
        volumeMounts:
        - name: html
          mountPath: /usr/share/nginx/html
      volumes:
        - name: html
          persistentVolumeClaim:
            claimName: nginx-pvc

④. ConfigMap挂载文件

• ①. 把之前的配置文件创建为配置集

# 创建配置,redis保存到k8s的etcd；
kubectl create cm redis-conf --from-file=redis.conf

# 下面这个是在上一步kubectl create cm redis-conf --from-file=redis.conf的具体文件信息
apiVersion: v1
data:    #data是所有真正的数据,key:默认是文件名   value:配置文件的内容
  redis.conf: |
    appendonly yes
kind: ConfigMap
metadata:
  name: redis-conf
  namespace: default

• ②. 创建Pod

apiVersion: v1
kind: Pod
metadata:
  name: redis
spec:
  containers:
  - name: redis
    image: redis
    command:
      - redis-server
      - "/redis-master/redis.conf"  #指的是redis容器内部的位置
    ports:
    - containerPort: 6379
    volumeMounts:
    - mountPath: /data
      name: data
    - mountPath: /redis-master
      name: config
  volumes:
    - name: data
      emptyDir: 
    - name: config
      configMap:
        name: redis-conf
        items:
        - key: redis.conf
          path: redis.conf

• ③. ConfigMap配置集,抽取应用的配置
  修改了CM。Pod里面的配置文件会跟着变
  

⑤. Secret挂载敏感信息

• ①. Secret 对象类型用来保存敏感信息,例如密码、OAuth令牌和SSH密钥。将这些信息放在secret中比放在Pod的定义或者容器镜像中来说更加安全和灵活

• ②. 在master节点中输入如下的命令

kubectl create secret docker-registry tang-docker \\
--docker-username=tang\\
--docker-password=123456\\
--docker-email=[e-mail]

##命令格式
kubectl create secret docker-registry regcred \\
  --docker-server=<你的镜像仓库服务器> \\
  --docker-username=<你的用户名> \\
  --docker-password=<你的密码> \\
  --docker-email=<你的邮箱地址>

apiVersion: v1
kind: Pod
metadata:
  name: private-nginx
spec:
  containers:
  - name: private-nginx
    image: tang/guignginx:v1.0
  imagePullSecrets:
  - name: tang-docker