kubernetes 中pv、pvc、configmap和secret
阿新 • • 發佈:2018-11-09
configmap和secret
PV和PVC是藉助於StorageClass來分配磁碟的
如何給Pod傳配置資訊:
兩種方式:
1.把configmap關聯到一個pod上,傳遞給pod內部的一個變數,注入的方式給容器傳配置資訊
2.配置卷,將配置檔案對映到外面的路徑
configmap在k8s上扮演了K8s的配置中心的功能
Pod啟動時候講configmap打包為儲存卷,掛載到配置檔案的路徑下
configmap是明文的資訊
secret是密文傳遞的,功能和configmap一樣的
配置容器化應用的方式:
1,自定義命令列引數
command
args
2,把配置檔案直接add進映象,不推薦
3,環境變數(類似docker)
1,Cloud native的應用創徐一般可以直接通過環境變數載入配置
2,通過entrypoint指令碼來預處理變數為配置檔案中的配置資訊
4.儲存卷
pod資源環境變數的傳遞方式
一個configmap是一群pod的配置集合
儲存的方式key,vallue
檢視幫助:
kubectl create configmap --help
開始建立配置檔案:
[[email protected] volumes]# kubectl create configmap nginx-config --from-literal=nginx_port=80 --from-literal=server_name=myapp.node1.com
configmap/nginx-config created
檢視建立配置檔案資訊
kubectl get cm
[ [email protected] volumes]# kubectl get cm
NAME DATA AGE
nginx-config 2 1m
檢視配置的具體資訊:
[[email protected] volumes]# kubectl get cm
NAME DATA AGE
nginx-config 2 1m
[[email protected] volumes]# kubectl describe cm nginx-config
Name: nginx-config
Namespace: default
Labels: <none>
Annotations: <none>
Data
====
nginx_port: #key
----
80 #value
server_name: #key
----
myapp.node1.com #value
Events: <none>
這個configmap就可以被Pod啟動的時候呼叫了
建立一個nginx配置
vim www.conf
kubectl create configmap nginx-www --from-file=www=./www.conf
或者
kubectl create configmap nginx-www --from-file=./www.conf
[ [email protected] configmap]# kubectl get cm
NAME DATA AGE
nginx-config 2 18h
nginx-www 1 8s
[[email protected] configmap]# kubectl get cm nginx-www -o yaml
apiVersion: v1
data:
www.conf: |
server {
server_name jesse.com
listen 80;
root /data/web/html/;
}
kind: ConfigMap
metadata:
creationTimestamp: 2018-09-12T03:20:39Z
name: nginx-www
namespace: default
resourceVersion: "225540"
selfLink: /api/v1/namespaces/default/configmaps/nginx-www
uid: d2765aca-b63a-11e8-a432-000c29f33006
[[email protected] configmap]# kubectl describe cm nginx-www
Name: nginx-www
Namespace: default
Labels: <none>
Annotations: <none>
Data
====
www.conf:
----
server {
server_name jesse.com
listen 80;
root /data/web/html/;
}
Events: <none>
建立yaml檔案:
[[email protected] configmap]# cat pod-configmap.yaml
apiVersion: v1
kind: Pod
metadata:
name: pod-cm-1
namespace: default
labels:
app: myapp
tier: frontend
annotations:
node1/create-by: "cluster admin" #備註
spec:
containers:
- name: myapp
image: ikubernetes/myapp:v1
ports:
- name: http
containerPort: 80
env:
- name: NGINX_SERVER_PORT
valueFrom:
configMapKeyRef:
name: nginx-config
key: nginx_port
- name: NGINX_SERVER_NAME
valueFrom:
configMapKeyRef:
name: nginx-config
key: server_name
[[email protected] configmap]# kubectl apply -f pod-configmap.yaml
pod/pod-cm-1 created
[[email protected] configmap]# kubectl get pods
NAME READY STATUS RESTARTS AGE
pod-cm-1 1/1 Running 0 7s
[[email protected] configmap]# kubectl get cm
NAME DATA AGE
nginx-config 2 20h
nginx-www 1 2h
進入容器中檢視是否在環境變數中生成成功:
kubectl exec -it pod-cm-1 /bin/sh
/ # printenv
MYAPP_SVC_PORT_80_TCP_ADDR=10.98.57.156
KUBERNETES_PORT=tcp://10.96.0.1:443
KUBERNETES_SERVICE_PORT=443
MYAPP_SVC_PORT_80_TCP_PORT=80
HOSTNAME=pod-cm-1 #生成資料
SHLVL=1
MYAPP_SVC_PORT_80_TCP_PROTO=tcp
HOME=/root
NGINX_SERVER_PORT=80 #生成埠
NGINX_SERVER_NAME=myapp.node1.com #自己定義的主機名
MYAPP_SVC_PORT_80_TCP=tcp://10.98.57.156:80
TERM=xterm
NGINX_VERSION=1.12.2
KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
KUBERNETES_PORT_443_TCP_PORT=443
KUBERNETES_PORT_443_TCP_PROTO=tcp
MYAPP_SVC_SERVICE_HOST=10.98.57.156
KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443
KUBERNETES_SERVICE_PORT_HTTPS=443
PWD=/
KUBERNETES_SERVICE_HOST=10.96.0.1
MYAPP_SVC_SERVICE_PORT=80
MYAPP_SVC_PORT=tcp://10.98.57.156:80
通過上面已經說明,環境資訊已經注入
如果我更改掉配置,看看是否會生效
[[email protected] configmap]# kubectl edit cm nginx-config
configmap/nginx-config edited
apiVersion: v1
data:
nginx_port: "8080" #更改後的埠
server_name: myapp.node1.com
kind: ConfigMap
metadata:
creationTimestamp: 2018-09-11T09:19:50Z
name: nginx-config
namespace: default
resourceVersion: "218073"
selfLink: /api/v1/namespaces/default/configmaps/nginx-config
uid: d5a14836-b5a3-11e8-a432-000c29f33006
[[email protected] configmap]# kubectl describe cm nginx-config
Name: nginx-config
Namespace: default
Labels: <none>
Annotations: <none>
Data
====
nginx_port:
----
8080
server_name:
----
myapp.node1.com
Events: <none>
再次檢視系統變數發現沒有改變
NGINX_SERVER_PORT=80
##############################
也就是說,當我們使用系統變數時,只在系統的啟動時才會有效
##############################
如果我們使用儲存卷的方式是可以隨時改變的
[[email protected] configmap]# cat pod-configmap-2.yaml
apiVersion: v1
kind: Pod
metadata:
name: pod-cm-2
namespace: default
labels:
app: myapp
tier: frontend
annotations:
node1/create-by: "cluster admin" #備註
spec:
containers:
- name: myapp
image: ikubernetes/myapp:v1
ports:
- name: http
containerPort: 80
volumeMounts:
- name: nginxconf
mountPath: /etc/nginx/config.d/
readOnly: true #不允許容器改變我們的內容
volumes:
- name: nginxconf
configMap:
name: nginx-config
[[email protected] configmap]# kubectl apply -f pod-configmap-2.yaml
pod/pod-cm-2 created
[[email protected] configmap]# kubectl get pods
NAME READY STATUS RESTARTS AGE
pod-cm-2 1/1 Running 0 10s
[[email protected] configmap]# kubectl get pods
NAME READY STATUS RESTARTS AGE
pod-cm-2 1/1 Running 0 1m
kubectl exec -it pod-cm-2 /bin/sh
進入容器檢視狀態:說明是生效的
# cd /etc/nginx/config.d/
/etc/nginx/config.d # ls
nginx_port server_name
/etc/nginx/config.d # cat nginx_port
/etc/nginx/config.d # cat server_name
myapp.node1.com/etc/nginx/config.d #
下面我改一下動態的配置
kubectl edit cm nginx-config
apiVersion: v1
data:
nginx_port: "8088"
server_name: myapp.node1.com
kind: ConfigMap
metadata:
creationTimestamp: 2018-09-11T09:19:50Z
name: nginx-config
namespace: default
resourceVersion: "237943"
selfLink: /api/v1/namespaces/default/configmaps/nginx-config
uid: d5a14836-b5a3-11e8-a432-000c29f33006
將8080埠更改為8088
我們在容器中檢視
/etc/nginx/config.d # cat nginx_port
8088/etc/nginx/config.d # 已經改過來了,同步需要幾秒鐘
生效的
過程同步到apiserver->pod中
/etc/nginx/config.d # ls -l
total 0
lrwxrwxrwx 1 root root 17 Sep 12 13:59 nginx_port -> ..data/nginx_port
lrwxrwxrwx 1 root root 18 Sep 12 13:59 server_name -> ..data/server_name
####################################
利用configmap和nginx建站
[[email protected] configmap]# cat pod-configmap-3.yaml
apiVersion: v1
kind: Pod
metadata:
name: pod-cm-2
namespace: default
labels:
app: myapp
tier: frontend
annotations:
node1/create-by: "cluster admin" #備註
spec:
containers:
- name: myapp
image: ikubernetes/myapp:v1
ports:
- name: http
containerPort: 80
volumeMounts:
- name: nginxconf
mountPath: /etc/nginx/conf.d/
readOnly: true #不允許容器改變我們的內容
volumes:
- name: nginxconf
configMap:
name: nginx-www
[[email protected] configmap]# kubectl get pods
NAME READY STATUS RESTARTS AGE
pod-cm-2 1/1 Running 0 19s
[[email protected] configmap]# kubectl exec -it pod-cm-2 /bin/sh
/ # cd /etc/nginx/conf.d/
/etc/nginx/conf.d # ls
www.conf
/etc/nginx/conf.d # cat www.conf
server {
server_name jesse.com
listen 80;
root /data/web/html/;
}
檢視nginx的配置
nginx -T
mkdir /data/web/html -p
vi /data/web/html/index.html Test Nginx
[[email protected] configmap]# kubectl get pods -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE
pod-cm-2 1/1 Running 0 7m 10.244.2.62 node2 <none>
在node1上測試,新增jesse.com 10.244.2.62 到解析檔案
[[email protected] ~]# curl jesse.com
<h1>Test! Nginx<h1>
[[email protected] configmap]# kubectl edit cm nginx-www
更改埠8080
apiVersion: v1
data:
www.conf: |
server {
server_name jesse.com
listen 8080;
root /data/web/html/;
}
kind: ConfigMap
在容器內部檢視是否生效:
/etc/nginx/conf.d # cat www.conf
server {
server_name jesse.com
listen 8080;
root /data/web/html/;
}
在容器內檢視埠:
/etc/nginx/conf.d # netstat -tnl
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN
過載一下nginx配置檔案
nginx -s reload
###################################
儲存卷掛載部分內容
kubectl explain pods.spec.volumes.configMap.items
###################################
secret的使用方式
[[email protected] ~]# kubectl create secret generic mysql-root-password [email protected]
secret/mysql-root-password created
[[email protected] ~]# kubectl get secret
NAME TYPE DATA AGE
default-token-4xzt8 kubernetes.io/service-account-token 3 3d
mysql-root-password Opaque 1 13s
tomcat-ingress-secret kubernetes.io/tls 2 8h
[[email protected] ~]# kubectl get secret
NAME TYPE DATA AGE
default-token-4xzt8 kubernetes.io/service-account-token 3 3d
mysql-root-password Opaque 1 13s
tomcat-ingress-secret kubernetes.io/tls 2 8h
[[email protected] ~]# kubectl describe secret mysql-root-password
Name: mysql-root-password
Namespace: default
Labels: <none>
Annotations: <none>
Type: Opaque
Data
====
password: 9 bytes
[[email protected] ~]# kubectl get secret mysql-root-password
NAME TYPE DATA AGE
mysql-root-password Opaque 1 1m
[[email protected] ~]# kubectl get secret mysql-root-password -o yaml
apiVersion: v1
data:
password: TXlQQHNzMTIz
kind: Secret
metadata:
creationTimestamp: 2018-08-17T10:52:26Z
name: mysql-root-password
namespace: default
resourceVersion: "395369"
selfLink: /api/v1/namespaces/default/secrets/mysql-root-password
uid: a12239c1-a20b-11e8-9cac-005056a52314
type: Opaque
#解碼
[[email protected] ~]# echo TXlQQHNzMTIz |base64 -d
[email protected]
通過環境量獲取
[[email protected] configmap]# vim pod-secret-1.yaml
apiVersion: v1
kind: Pod
metadata:
name: pod-secret-1
namespace: default
labels:
app: myapp
tier: frontend
annotations:
zpx.com/created-by: "cluster admin"
spec:
containers:
- name: myapp
image: ikubernetes/myapp:v1
ports:
- name: http
containerPort: 80
env:
- name: MYSQL_ROOT_PASSWORD
valueFrom:
secretKeyRef:
name: mysql-root-password
key: password
[[email protected] configmap]# kubectl apply -f pod-secret-1.yaml
pod/pod-secret-1 created
[[email protected] configmap]# kubectl get pods
NAME READY STATUS RESTARTS AGE
filebeat-ds-7nncx 1/1 Running 0 1d
filebeat-ds-st7f6 1/1 Running 0 1d
myapp-deploy-67f6f6b4dc-tl8z7 1/1 Running 0 1d
myapp-deploy-67f6f6b4dc-vsxnc 1/1 Running 0 1d
myapp-deploy-67f6f6b4dc-x5hw6 1/1 Running 0 1d
pod-cm-2 1/1 Running 0 55m
pod-cm-3 1/1 Running 0 45m
pod-demo 2/2 Running 0 4h
pod-secret-1 1/1 Running 0 20s
pod-vol-hostpath 1/1 Running 0 3h
pod-vol-nfs 1/1 Running 0 3h
pod-vol-pvc 1/1 Running 0 2h
poststart-pod 1/1 Running 48 2d
redis-5b5d6fbbbd-t4zl7 1/1 Running 0 1d
tomcat-deploy-588c79d48d-s5hcr 1/1 Running 0 8h
tomcat-deploy-588c79d48d-sd76q 1/1 Running 0 8h
tomcat-deploy-588c79d48d-sxhh6 1/1 Running 0 8h
[[email protected] configmap]# kubectl exec pod-secret-1 -- printenv
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=pod-secret-1
[email protected]
REDIS_PORT_6379_TCP=tcp://10.97.97.97:6379
MYAPP_SERVICE_PORT_HTTP=80
TOMCAT_SERVICE_PORT_AJP=8009
KUBERNETES_PORT=tcp://10.96.0.1:443
KUBERNETES_PORT_443_TCP_PORT=443
TOMCAT_PORT_8080_TCP_PORT=8080
KUBERNETES_SERVICE_HOST=10.96.0.1
KUBERNETES_PORT_443_TCP_PROTO=tcp
REDIS_SERVICE_HOST=10.97.97.97
TOMCAT_PORT_8009_TCP_PROTO=tcp
REDIS_PORT=tcp://10.97.97.97:6379
TOMCAT_PORT_8009_TCP=tcp://10.99.116.34:8009
KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443
MYAPP_SERVICE_HOST=10.107.175.175
MYAPP_PORT_80_TCP_PROTO=tcp
MYAPP_PORT_80_TCP_ADDR=10.107.175.175
TOMCAT_PORT_8080_TCP_PROTO=tcp
MYAPP_PORT_80_TCP_PORT=80
TOMCAT_PORT_8080_TCP_ADDR=10.99.116.34
KUBERNETES_SERVICE_PORT=443
REDIS_PORT_6379_TCP_PROTO=tcp
REDIS_PORT_6379_TCP_PORT=6379
MYAPP_SERVICE_PORT=80
TOMCAT_SERVICE_PORT=8080
TOMCAT_SERVICE_PORT_HTTP=8080
TOMCAT_PORT_8009_TCP_ADDR=10.99.116.34
MYAPP_PORT_80_TCP=tcp://10.107.175.175:80
TOMCAT_SERVICE_HOST=10.99.116.34
KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1
REDIS_SERVICE_PORT=6379
KUBERNETES_SERVICE_PORT_HTTPS=443
REDIS_PORT_6379_TCP_ADDR=10.97.97.97
MYAPP_PORT=tcp://10.107.175.175:80
TOMCAT_PORT=tcp://10.99.116.34:8080
TOMCAT_PORT_8080_TCP=tcp://10.99.116.34:8080
TOMCAT_PORT_8009_TCP_PORT=8009
MYAPP_SVC_PORT_80_TCP_PROTO=tcp
MYAPP_SVC_PORT=tcp://10.98.57.156:80
MYAPP_SVC_PORT_80_TCP_ADDR=10.98.57.156
MYAPP_SVC_SERVICE_HOST=10.98.57.156
MYAPP_SVC_SERVICE_PORT=80
MYAPP_SVC_PORT_80_TCP=tcp://10.98.57.156:80
MYAPP_SVC_PORT_80_TCP_PORT=80
NGINX_VERSION=1.12.2
HOME=/root