^-^
【go云原生】Kubernetes Volume
最近更新：2025-01-06   |   字数总计：2.2k   |   阅读估时：10分钟   |   阅读量：次
  1. Kubernetes Volume
    1. ConfigMap与Secret
      1. ConfigMap
        1. 创建方式
        2. 使用方式
      2. Secret
        1. 创建方式
        2. 使用方式
    2. Volume
      1. hostPath
      2. emptyDir
      3. configMap
      4. secret
      5. PV与PVC

Kubernetes Volume

ConfigMap与Secret

ConfigMap

  • ConfigMap是k8s集群用来保存非机密性数据得键值对对象。使用时，pod可以将其作为环境变量、命令行参数或者存储卷中的配置文件。

创建方式

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
# 1. 以键值对的方式创建
kubectl create cm myhelloenv --from-literal=env1=k8scmvalue1 --from-literal=env2=k8scmvalue2
kubectl get cm myhelloenv -o yaml

# 2. 以变量文件方式创建
# myhello-startup-params
p1=k8scmp1
p2=k8scmp2
kubectl create cm myhellostarup --from-env-file myhello-startup-params
kubectl get cm myhellostarup -o yaml

# 3. 文件方式定义
# app-info.conf
AppInfo:
    Name: hello
    Host: 127.0.0.1
    Port: 80
    Desc: 这里是配置文件
# author-info.conf
AuthorInfo:
    Name: hello2
    Gender: 男
    Age: 11
    Desc: 这里是一位男士
kubectl create cm myhelloconfigs --from-file=appinfo.yml=app-info.conf --from-file=authorinfo.yml=author-info.conf # 这里，两个配置项的key是appinfo.yml和authorinfo.yml
kubectl get cm myhelloconfigs -o yaml

# 4. 通过资源配置文件来创建
# myhello-all-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
    name: myhello-all-config
data:
    env1: "k8scmvalue1"
    env2: "k8scmvalue2"
    p1: "k8scmp1"
    p2: "k8scmp2"
    appinfo.yml: | # 这里key是appinfo.yml，value是有层级结构的
        AppInfo:
            Name: hello
            Host: 127.0.0.1
            Port: 80
            Desc: 这里是配置文件
    authorinfo.yml: | 
        AuthorInfo:
            Name: hello2
            Gender: 男
            Age: 11
            Desc: 这里是一位男士

kubectl create -f myhello-all-config.yaml
kubectl get -f myhello-all-config.yaml -o yaml

使用方式

  1. 用作容器的环境变量
  2. 用于容器内命令行参数
  3. Pod中作为文件使用
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
# 1. 定义deployment，使用ConfigMap
# myapp-cm-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
    name: myapp-cm-deployment
    labels:
        name: myapp-cm
spec:
    replicas: 5
    selector:
        matchLabels:
            name: myapp-cm
    template:
        metadata:
            labels:
                name: myapp-cm
        spec:
            containers:
            - name: myhello
              image: xlhmzch/hello:1.0.3
              imagePullPolicy: IfNotPresent
              ports:
              - containerPort: 80
              command: ["./app"]
              args: ["--param1=$(param1)", "--param2=$(param2)"] # 命令行参数使用ConfigMap，这里也一样ConfigMap修改之后，pod不会修改的，需要重启生效
              env: # 环境变量使用configMap
              - name: env1
                valueFrom:
                    configMapKeyRdf: # 通过ConfigMap来获取环境变量的值，这里需要注意哈，如果ConfigMap更改，pod是不会自动更新的，我们需要重启pod
                        name: myhello-all-config
                        key: env1
              - name: env2
                valueFrom:
                    configMapKeyRdf: # 通过ConfigMap来获取环境变量的值
                        name: myhello-all-config
                        key: env2
              - name: param1
                valueFrom:
                    configMapKeyRdf: # 通过ConfigMap来获取环境变量的值
                        name: myhello-all-config
                        key: p1
              - name: param2
                valueFrom:
                    configMapKeyRdf: # 通过ConfigMap来获取环境变量的值
                        name: myhello-all-config
                        key: p2
              volumeMounts: # 使用Volume
              - name: myhello-conf # 指定应用的数据卷名称
                mountPath: "/app/configs" # 挂载的目录
                readOnly: true
           volumes: # Pod作为文件使用，以这种机制进行使用，configmap进行修改，是会同步修改pod的
           - name: myhello-conf 
                configMap: # 数据卷类型为configMap的投射
                    name: myhello-all-config
                    items: 
                    - key: "appinfo.yml" # 将key值投射为一个文件
                        path: "appinfo.yml" # 文件的名称定义为这样
                    - key: "authorinfo.yml"
                        path: "authorinfo.yml"

kubectl apply -f myapp-cm-deployment.yaml
# 2. 定义svc来访问pod
# myapp-cm-svc.yaml
apiVersion: v1
kind: Service
metadata:
    name: myapp-cm-svc
spec:
    type: ClusterIP
    selector:
        name: myapp-cm
    ports:
        - protocol: TCP
            name: http
            port: 80
            targetPort: 80
kubectl apply -f myapp-cm-svc.yaml
curl http://10.108.110.126/print/env
curl http://10.108.110.126/print/startup
curl http://10.108.110.126/print/config/appinfo
curl http://10.108.110.126/print/config/authorinfo

Secret

  • 一种包含少量敏感信息例如密码、令牌或密钥的对象。这样的信息可能会被放到pod的定义中或者镜像中，使用secret意味着不需要再应用程序中包含敏感信息。
  • 三种类型的secret
    1. generic
    2. tls
    3. docker-registry

创建方式

  • generic
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    # 1. 键值对
    kubectl create secret generic kvdemo-secret --from-literal=username=admin --from-literal=pwd=oinoihph14561

    # 2. 变量文件
    # user-pwd-env
    username=admin
    pwd=oinoihph14561
    kubectl create secret generic envfiledemo-secret --from-env-file user-pwd-env

    # 3. 多文件
    echo -n 'admin' > username.txt
    echo -n 'oinoihph14561' > password.txt
    kubectl create secret generic filedemo --form-file=username.txt --from-file=password.txt

    # 4. 资源配置文件
    echo -n 'admin' | base64
    echo -n 'oinoihph14561' | base64
    # my-opaque-secret.yaml
    apiVersion: v1
    kind: Secret
    metadata:
        name: my-opaque-secret
    type: Opaque # opaque是用户自定义类型
    data:
        username: noinwg=
        password: noqinergoho281
    kubectl create -f my-opaque-secret.yaml
    kubectl get -f my-opaque-secret.yaml -o yaml
  • tls
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    # 自签证书
    openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /tmp/3wicu.key -out /tmp/3wicu.crt -subj "/CN=www.icu.com/0=www.icu.com"

    # 1. 命令行创建
    kubectl create secret tls tlsdemo-secret --cert=/tmp/3wicu.crt --key=/tmp/3wicu.key

    # 2. 配置文件创建
    cat /tmp/3wicu.crt | base64
    cat /tmp/3wicu.key | base64
    # my-tls-secret.yaml
    apiVersion: "v1"
    kind: "Secret"
    metadata:
        name: "my-tls-secret"
        namespace: "default"
    type: kubernetes.io/tls
    data:
        tls.crt: "aldskmiognapignoierngopqniergopnier"
        tls.key: "qoiegnoqgnorpiqnp3irugnpqirognpqirug"

    kubectl apply -f my-tls-secret.yaml
  • docker-registry
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    # 1. 命令行
    kubectl create secret docker-registry dockerregistrydemo --docker-server=https://index.mydocker.io/v1/ --docker-username=my --docker-password=pwd123 --docker-email=my@qq.com # server可以不指定，那么就是官方公共的地址

    # 2. 配置文件方式
    # dockerconfigjson
    {
        "auths" : {
            "docker.lin.com:5000": {
                "username" : "lin",
                "password": "pass1234",
                "email": "lin@qq.com",
                "auth": "qwegwerg="
            }
        }
    }
    cat dockerconfigjson | base64
    # dockerconfigjson-secret.yaml
    apiVersion: "v1"
    kind: "Secret"
    metadata:
        name: dockerconfigjson-secret
    type: kubernetes.io/dockerconfigjson
    data:
        .dockerconfigjson: "1998198qioiqn3grpoun2unr24g42th"

    kubectl create -f dockerconfigjson-secret.yaml

使用方式

  1. 用作容器的环境变量
  2. Pod作为文件使用
  3. kubelet为pod拉取镜像时使用
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    60
    61
    62
    63
    64
    65
    66
    67
    68
    69
    70
    71
    72
    73
    74
    75
    76
    77
    78
    79
    80
    81
    82
    83
    84
    85
    86
    87
    88
    89
    90
    91
    92
    93
    94
    95
    96
    97
    98
    echo -n "env1secretvalue1" | base64
    echo -n "env1secretvalue2" | base64

    cat $HOME/.docker/config.json | base64
    cat /tmp/3wicu.crt | base64
    cat /tmp/3wicu.key | base64

    # my-all-secret.yaml
    apiVersion: v1
    kind: Secret
    metadata:
        name: my-all-secret
    type: Opaque
    data:
        environment1: qoneotiq49819efr
        environment2: qoneotiq451qergg
        .dockerconfigjson: "qweongoqpwbrquibgrqei"
        tls.crt: "qwognqpernigpoqerngp"
        tls.key: "qwognqpernigpoqerngp"

    kubectl apply -f my-all-secret.yaml

    # myapp-secret-deployment.yaml
    apiVersion: apps/v1
    kind: Deployment
    metadata:
        name: myapp-secret-deployment
        labels:
            name: myapp-secret
    spec:
        replicas: 5
        selector:
            matchLabels:
                name: myapp-secret
        template:
            metadata:
                labels:
                    name: myapp-secret
            spec:
                imagePullSecrets: # 设置docker拉取的secret
                - name: my-all-secret
                containers:
                - name: myhello
                  image: xlhmzch/hello:1.0.3
                  imagePullPolicy: Always
                  ports:
                  - containerPort: 80
                  command: ["./app"]
                  args: ["--param1=$(env1)", "--param2=$(env1)"] 
                  env: 
                  - name: env1
                    valueFrom:
                        secretKeyRef: 
                            name: my-all-secret
                            key: environment1
                            optional: false # false意味着这个值必须存在
                  - name: env2
                    valueFrom:
                        secretKeyRef: 
                            name: my-all-secret
                            key: environment2
                            optional: false
                  volumeMounts: # 使用Volume
                  - name: myhello-secret # 指定应用的数据卷名称
                    mountPath: "/app/cert" # 挂载的目录
                    readOnly: true
               volumes: 
               - name: myhello-secret 
                    secret: # 数据卷类型为secret的投射
                        secretName: my-all-secret
                        optional: false
                        items: 
                        - key: "tls.key" # 将key值投射为一个文件
                            path: "tls.key" # 文件的名称定义为这样
                        - key: "tls.crt"
                            path: "tls.crt"

    # myapp-secret-svc.yaml
    apiVersion: v1
    kind: Service
    metadata:
        name: myapp-secret-svc
    spec:
        type: ClusterIP
        selector:
            name: myapp-secret
        ports:
            - protocol: TCP
                name: http
                port: 80
                targetPort: 80

    kubectl apply -f myapp-secret-deployment.yaml
    kubectl apply -f myapp-secret-svc.yaml
    curl http://10.104.206.255/print/env
    curl http://10.104.206.255/print/startup
    kubectl exec myapp-secret-deployment-noqngiqbr -- ls cert
    kubectl exec myapp-secret-deployment-noqngiqbr -- cat cert/tls.crt

Volume

  • 核心是一个目录
  • 解决：
    1. 解决容器崩溃或重启时文件丢失的问题
    2. 解决多个容器共享文件的问题

hostPath

  • cadvisor-ds.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    60
    61
    62
    63
    64
    65
    66
    apiVersion: apps/v1
    kind: DaemonSet
    metadata:
        name: cadvisor
        namespace: default
        labels:
            app: cadvisor
    spec:
        selector:
            matchLabels:
                app: cadvisor
        template:
            metadata:
                labels:
                    app: cadvisor
            spec:
                tolerations:
                - key: node-role.kubernetes.io/control-plane
                  operator: Exists
                  effect: NoSchedule
                containers:
                - name: cadvisor
                  image: google/cadvisor:v0.32.0
                  ports:
                  - containerPort: 8080
                  resources:
                    limits:
                        memory: 200Mi
                    requests:
                        cpu: 100m
                        memory: 200Mi
                  volumeMounts:
                  - name: rootfs
                    mountPath: /rootfs
                  - name: run
                    mountPath: /var/run
                  - name: sys
                    mountPath: /sys
                  - name: varlibdocker
                    mountPath: /var/lib/docker/
                  - name: devdisk
                    mountPath: /dev/disk
                    readOnly: true
                  - name: localtime
                    mountPath: /etc/localtime
                    readOnly: true
                  terminationGroupPeriodseconds: 30
                  volumes:
                  - name: rootfs
                    hostPath: # 使用hostpath类型去创建volume，通常就是使用监控应用上使用，不会去写的volumes，因为hostpath再不同的系统中取到的内容可能是不一致的
                        path: /
                  - name: run
                    hostPath:
                        path: /var/run
                  - name: sys
                    hostPath:
                        path: /sys/
                  - name: varlibdocker
                    hostPath:
                        path: /var/lib/docker/
                  - name: devdisk
                    hostPath:
                        path: /dev/disk
                  - name: localtime
                    hostPath:
                        path: /etc/localtime
  • cadvisor-svc.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    apiVersion: v1
    kind: Service
    metadata:
        name: cadvisor-svc
        labels:
            name: cadvisor-svc
    spec:
        type: NodePort
        ports:
        - port: 80
            protocol: TCP
            targetPort: 8080
            name: http
            nodePort: 30002
        selector:
            app: cadvisor
    1
    2
    3
    kubectl apply -f cadvisor-ds.yaml
    kubectl apply -f cadvisor-svc.yaml
    curl http://192.168.239.142:30002

emptyDir

  • nginx-init-demo.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    apiVersion: v1
    kind: Pod
    metadata:
        name: nginx-init-demo
    spec:
        containers:
        - name: nginx
            image:nginx
            ports:
            - containerPort: 80
            volumeMounts:
            - name: workdir
                mountPath: /usr/share/nginx/html
        initContainers: # 在init容器中对空目录进行写入
        - name: install 
            image: busybox
            command:
            - wget
            - "-o"
            - "/work-dir/index.html"
            - https://www.baidu.com/ # 把百度首页down下来
            volumeMounts:
            - name: workdir
                mountPath: "/work-dir"
        dnsPolicy: Default
        volumes:
        - name: workdir
            emptyDir: {} # 这样定义

configMap

  • 在configMap作为文件使用的章节已经出现过了

secret

  • 在secret作为文件使用的章节已经出现过了

PV与PVC

  • 上述都是临时卷，当pod销毁时，volume也就销毁了。而PV和PVC是持久卷。
  • NFS文件系统安装
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    # 为每个节点都安装nfs工具
    apt-get install nfs-common

    # 在其中一个机器上启动nfs 置配器
    git clone https://github.com/kubernetes-sigs/nfs-ganesha-server-and-external-provisioner
    cd nfs-ganesha-server-and-external-provisioner-master
    vim ./deploy/kubernetes/deployment.yaml
    > image: quay.io/kubernetes_incubator/nfs-provisioner # 改一下镜像为能够拉取的镜像
    > hostPath:
    >   path: /mysrv # 改一下文件路径位置，nfs 置配器启动在哪个节点，哪个节点的这个文件目录就是持久化的路径
    > args:
    > - "-provisioner=lin.com/nfs" # 修改置配器参数

    kubectl apply -f ./deploy/kubernetes/deployment.yaml
    kubectl apply -f ./deploy/kubernetes/rbac.yaml
  • 创建存储类
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    vim mynfs.yaml

    kind: StorageClass
    apiVersion: storage.k8s.io/v1
    metadata:
        name: mynfs
    provisioner: lin.com/nfs # 必须与我们之前部署的置配器参数一致，因为PV也就是持久化卷，我们有非常非常多的方式去创建，所以我们必须指定对应持久化卷置配器。这里我们的置配器类型就是nfs的置配器。
    mountOptions:
        - vers=4.1

    kubectl apply -f mynfs.yaml
  • 创建PVC
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    vim mypvc001.yaml

    kind: PersistentVolumeClaim
    apiVersion: v1
    metadata:
        name: mypvc001
    spec:
        storageClassName: mynfs
        accessModes:
            - ReadWriteMany
        resources:
            requests:
                storage: 1Mi

    kubectl apply -f mypvc001.yaml
  • 使用PVC
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    vim write-pod.yaml

    kind: Pod
    apiversion: v1 
    metadata:
        name: write-pod 
    spec:
        containers:
        - name: write-pod 
            image: busybox 
            command:
                -"/bin/sh" 
            args:
                -"-c"
                -"echo 成功访问pv >/mnt/SUCCESS && exit 0 | exit 1" 
            volumeMounts:
            - name: nfs-pvc 
                mountPath: "/mnt" 
        restartPolicy: "Never" 
        volumes: # 使用我们的PVC
            - name: nfs-pvc
                persistentVolumeclaim: 
                    claimName: mypvc001 

    kubectl apply -f write-pod.yaml
    cat /mysrv/pvc-noiphonoigqerigjoper/SUCCESS # 已经被持久化了
2025-01-05 该篇文章被 Cleofwine 归为分类: Go云原生

上一篇：【go云原生】Ceph文件系统与K8s 下一篇：个人摄影学习：生活篇
© 2023-2026 Cleofwine / Email / GitHub / 浙ICP备2024136127号
🌙赠我弯弯一枚月，也赠予我晚星⭐ 本站由Hexo驱动｜使用Hexo-theme-A4主题