Day03-Pod环境变量,容器重启策略,emptyDir,hostPath,nfs存储卷,资源限制及configMap,secret实战案例
0、昨日内容回顾:
- Pod资源清单
apiVersion: v1
kind: Pod
metadata:
name: ...
spec:
hostNetwork: true
nodeName: k8s233.oldboyedu.com
containers:
- name:
image:
stdin:
command:
args:
imagePullPolicy:
- name:
image:
...
- Pod的基础管理
创建:
kubectl create
kubectl apply
删除:
kubectl delete
查看:
kubectl get
修改:
kubectl apply
- 故障排查相关指令:
kubectl describe
kubectl exec
kubectl logs
kubectl cp
1、面试题预告
Q1: Pod的容器重启策略有哪些?请简要说明?
Q2: 如何向Pod的指定容器传递环境变量?有哪些方式,请简要说明?
Q3: 同一个Pod如何实现数据持久化?如何实现数据共享?跨节点的Pod如何实现数据共享呢?
Q4: 多个Pod如何实现使用同一个配置文件?
Q5: 如何下载habor的私有项目镜像?
Q6: Pod如何实现健康检查?
1.1 Q1:Pod的容器的三种重启策略:(注意, K8S所谓的容器指的是重新创建容器。)
[root@k8s231.oldboyedu.com pods]# cat 07-nginx-restartPolicy.yaml
apiVersion: v1
kind: Pod
metadata:
name: linux85-web-restartpolicy-always
spec:
nodeName: k8s233.oldboyedu.com
# 当容器退出时,始终重启容器。
restartPolicy: Always
containers:
- name: nginx
image: harbor.oldboyedu.com/web/linux85-web:v0.1
imagePullPolicy: Always
command:
- "sleep"
- "10"
---
apiVersion: v1
kind: Pod
metadata:
name: linux85-web-restartpolicy-onfailure
spec:
nodeName: k8s233.oldboyedu.com
# 当容器正常退出时不会重启容器,异常退出时,会重启容器。
restartPolicy: OnFailure
containers:
- name: nginx
image: harbor.oldboyedu.com/web/linux85-web:v0.1
imagePullPolicy: Always
command:
- "sleep"
- "10"
---
apiVersion: v1
kind: Pod
metadata:
name: linux85-web-restartpolicy-never
spec:
nodeName: k8s233.oldboyedu.com
# 当容器退出时,始终不重启。
restartPolicy: Never
containers:
- name: nginx
image: harbor.oldboyedu.com/web/linux85-web:v0.1
imagePullPolicy: Always
command:
- "sleep"
- "10"
1.2 Q2:向容器传递环境变量的两种方式
[root@k8s231.oldboyedu.com pods]# cat 08-games-env.yaml
apiVersion: v1
kind: Pod
metadata:
name: linux85-game-env
spec:
nodeName: k8s232.oldboyedu.com
containers:
- name: game
image: harbor.oldboyedu.com/oldboyedu-games/jasonyin2020/oldboyedu-games:v0.7
# 向容器传递环境变量
env:
# 指定的变量名称
- name: SCHOOL
# 指定变量的值
value: oldboyedu
- name: CLASS
value: linux85
- name: OLDBOYEDU_POD_NAME
# 不使用自定义的变量值,而是引用别处的值
valueFrom:
# 值引用自某个字段
fieldRef:
# 指定字段的路径
fieldPath: "metadata.name"
- name: OLDBOYEDU_NODENAME
valueFrom:
fieldRef:
fieldPath: "spec.nodeName"
- name: OLDBOYEDU_HOSTIP
valueFrom:
fieldRef:
fieldPath: "status.hostIP"
- name: OLDBOYEDU_PODIP
valueFrom:
fieldRef:
fieldPath: "status.podIP"
[root@k8s231 pods]# kubectl explain po.spec.containers.env
KIND: Pod
VERSION: v1
RESOURCE: env <[]Object>
........
[root@k8s231.oldboyedu.com pods]# kubectl apply -f 08-games-env.yaml
pod/linux85-game-env created
[root@k8s231.oldboyedu.com pods]# kubectl get pods -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
linux85-game-env 1/1 Running 0 5s 10.100.1.15 k8s232.oldboyedu.com <none> <none>
[root@k8s231.oldboyedu.com pods]# kubectl exec linux85-game-env -- env
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=linux85-game-env
SCHOOL=oldboyedu
CLASS=linux85
OLDBOYEDU_POD_NAME=linux85-game-env
OLDBOYEDU_NODENAME=k8s232.oldboyedu.com
OLDBOYEDU_HOSTIP=10.0.0.232
OLDBOYEDU_PODIP=10.100.1.15
KUBERNETES_PORT=tcp://10.200.0.1:443
KUBERNETES_PORT_443_TCP=tcp://10.200.0.1:443
KUBERNETES_PORT_443_TCP_PROTO=tcp
KUBERNETES_PORT_443_TCP_PORT=443
KUBERNETES_PORT_443_TCP_ADDR=10.200.0.1
KUBERNETES_SERVICE_HOST=10.200.0.1
KUBERNETES_SERVICE_PORT=443
KUBERNETES_SERVICE_PORT_HTTPS=443
HOME=/root
[root@k8s231.oldboyedu.com pods]#
1.3 Q3: 同一个Pod如何实现数据持久化?如何实现数据共享?跨节点的Pod如何实现数据共享呢?
1.3.1 数据持久化之emptyDir实战案例
[root@k8s231.oldboyedu.com pods]# cat 09-games-volumes-emptyDir.yaml
apiVersion: v1
kind: Pod
metadata:
name: linux85-volume-emptydir-001
spec:
# 定义存储卷
volumes:
# 指定存储卷的名称
- name: data01
# 指定存储卷类型为emptyDir类型
# 当Pod被删除时,数据会被随时删除,其有以下两个作用:
# - 对容器的数据进行持久化,当删除容器时数据不会丢失;
# - 可以实现同一个Pod内不同容器之间数据共享;
emptyDir: {}
containers:
- name: web
image: harbor.oldboyedu.com/web/nginx:1.20.1-alpine
# 指定挂载点
volumeMounts:
# 指定存储卷的名称
- name: data01
# 指定容器的挂载目录
mountPath: /usr/share/nginx/html
- name: linux
image: harbor.oldboyedu.com/linux/alpine:latest
stdin: true
volumeMounts:
- name: data01
mountPath: /oldboyedu-data
[root@k8s231 pods]# kubectl exec -it linux85-volume-emptydir-001 -- sh
/ # cd /usr/share/nginx/html/
/usr/share/nginx/html # ls
50x.html index.html
/usr/share/nginx/html # echo "<h1>v0.1</h1>" > index.html
/usr/share/nginx/html #
[root@k8s231 pods]# !curl
curl 10.100.2.13
<h1>v0.1</h1>
[root@k8s231 ~]# kubectl exec -it linux85-volume-emptydir-001 -c web -- sh
/ # cd /usr/share/nginx/html/
/usr/share/nginx/html # ls
/usr/share/nginx/html # echo "<h1>test</h1>" > index.html
/usr/share/nginx/html #
[root@k8s231 ~]# curl 10.100.1.6
<h1>test</h1>
[root@k8s231 ~]# kubectl exec -it linux85-volume-emptydir-001 -c linux -- sh
/ # ls
bin home mnt proc sbin tmp
dev lib oldboyedu-data root srv usr
etc media opt run sys var
/ # cd oldboyedu-data/
/oldboyedu-data # ll
sh: ll: not found
/oldboyedu-data # ls
index.html
/oldboyedu-data # cat index.html
<h1>test</h1>
/oldboyedu-data # echo 111111111> index.html
sh: 3: Bad file descriptor
/oldboyedu-data # echo 111111111 > index.html
/oldboyedu-data # cat index.html
111111111
/oldboyedu-data #
[root@k8s231 ~]# curl 10.100.1.6
111111111
1.3.2 数据持久化之hostPath实战案例
[root@k8s231.oldboyedu.com pods]# cat 10-games-volumes-hostPath.yaml
apiVersion: v1
kind: Pod
metadata:
name: linux85-volume-hostpath-001
spec:
nodeName: k8s232.oldboyedu.com
volumes:
- name: data01
emptyDir: {}
- name: data02
# 指定类型为宿主机存储卷,该存储卷只要用于容器访问宿主机路径的需求。
hostPath:
# 指定存储卷的路径
path: /oldboyedu-data
containers:
- name: web
image: harbor.oldboyedu.com/web/nginx:1.20.1-alpine
volumeMounts:
- name: data02
mountPath: /usr/share/nginx/html
---
apiVersion: v1
kind: Pod
metadata:
name: linux85-volume-hostpath-002
spec:
nodeName: k8s232.oldboyedu.com
volumes:
- name: linux85-data
hostPath:
path: /oldboyedu-data
containers:
- name: linux
image: harbor.oldboyedu.com/linux/alpine:latest
stdin: true
volumeMounts:
- name: linux85-data
mountPath: /oldboyedu-data-linux85
[root@k8s231.oldboyedu.com pods]#
1.3.3 跨节点的Pod实现数据共享
1.3.3.1 部署nfs server
(1)所有节点安装nfs相关软件包
yum -y install nfs-utils
(2)k8s231节点设置共享目录
mkdir -pv /oldboyedu/data/kubernetes
cat > /etc/exports <<'EOF'
/oldboyedu/data/kubernetes *(rw,no_root_squash)
EOF
(3)配置nfs服务开机自启动
systemctl enable --now nfs
(4)服务端检查NFS挂载信息
exportfs
(5)客户端节点手动挂载测试
mount -t nfs k8s231.oldboyedu.com:/oldboyedu/data/kubernetes /mnt/
umount /mnt
1.3.3.2 数据持久化之nfs实战案例
[root@k8s231.oldboyedu.com pods]# cat 11-nginx-alpine-volumes-nfs.yaml
apiVersion: v1
kind: Pod
metadata:
name: linux85-volume-nfs-web
spec:
nodeName: k8s232.oldboyedu.com
volumes:
- name: data
# 指定存储卷类型是nfs
nfs:
# 指定nfs服务器的地址
server: 10.0.0.231
# 指定nfs对外暴露的挂载路径
path: /oldboyedu/data/kubernetes/volume-nfs
containers:
- name: web
image: harbor.oldboyedu.com/web/nginx:1.20.1-alpine
volumeMounts:
- name: data
mountPath: /usr/share/nginx/html
---
apiVersion: v1
kind: Pod
metadata:
name: linux85-volume-nfs-linux
spec:
nodeName: k8s233.oldboyedu.com
volumes:
- name: data
nfs:
server: 10.0.0.231
path: /oldboyedu/data/kubernetes/volume-nfs
containers:
- name: linux
image: harbor.oldboyedu.com/linux/alpine:latest
stdin: true
volumeMounts:
- name: data
mountPath: /oldboyedu-data-linux85
[root@k8s231 pods]# kubectl apply -f 11-nginx-alpine-volumes-nfs.yaml
pod/linux85-volume-nfs-web created
pod/linux85-volume-nfs-linux created
[root@k8s231 pods]# kubectl get pods -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
linux85-volume-nfs-linux 1/1 Running 0 21s 10.100.2.15 k8s233.oldboyedu.com <none> <none>
linux85-volume-nfs-web 1/1 Running 0 21s 10.100.1.9 k8s232.oldboyedu.com <none> <none>
[root@k8s231 pods]# curl 10.100.1.9
<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.20.1</center>
</body>
</html>
[root@k8s231 pods]# echo "<h1>www.oldboyedu.com</h1>" > /oldboyedu/data/kubernetes/volume-nfs/index.html
[root@k8s231 pods]# curl 10.100.1.9
<h1>www.oldboyedu.com</h1>
[root@k8s231 pods]#
2、容器的资源限制实战案例
[root@k8s231 pods]# kubectl explain po.spec.containers.resources
KIND: Pod
VERSION: v1
RESOURCE: resources <Object>
DESCRIPTION:
Compute Resources required by this container. Cannot be updated. More info:
https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
ResourceRequirements describes the compute resource requirements.
FIELDS:
limits <map[string]string>
Limits describes the maximum amount of compute resources allowed. More
info:
https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
requests <map[string]string>
Requests describes the minimum amount of compute resources required. If
Requests is omitted for a container, it defaults to Limits if that is
explicitly specified, otherwise to an implementation-defined value. More
info:
https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
[root@k8s231.oldboyedu.com pods]# cat 12-stress.yaml
apiVersion: v1
kind: Pod
metadata:
name: linux85-stress-003
spec:
nodeName: k8s233.oldboyedu.com
containers:
- name: stress
image: jasonyin2020/oldboyedu-linux-tools:v0.1
args:
- "tail"
- "-f"
- "/etc/hosts"
# 对容器进行资源限制
resources:
# 期望目标节点有的资源大小,若不满足,则无法调度,Pod处于Pedding状态。
# 若满足调度需求,调度到节点后也不会立刻使用requests字段的定义的资源。
requests:
# 要求目标节点有10G的可用内存.
# memory: 10G
memory: 256M
# 指定CPU的核心数,固定单位: 1core=1000m
cpu: 500m
# 配置资源的使用上限
limits:
memory: 500M
cpu: 1.5
[root@k8s231.oldboyedu.com pods]#
[root@k8s231 pods]# kubectl apply -f 12-stress.yaml
# 对容器进行压测
[root@k8s231 pods]# kubectl exec -it linux85-stress-001 -- sh
(1).CPU压力测试 ----> 产生4个cpu进程1分钟后停止运行(注意观察CPU的使用率,尽管我指定了4颗CPU,但应该不会超过200%)
/usr/local/stress # stress -c 4 --verbose --timeout 1m
(2).Memory压力测试 ---> 产生5个work工作经常,并且每个工作经常占用200000000 Bytes(即200MB),且不释放内存,但不会超过1G的使用空间。
/usr/local/stress # stress -m 5 --vm-bytes 200000000 --vm-keep --verbose
# 查看容器压测结果
[root@k8s233 ~]# docker stats d94975678c05
CONTAINER ID NAME CPU % MEM USAGE / LIMIT MEM % NET I/O BLOCK I/O PIDS
d94975678c05 k8s_stress_linux85-stress-001_default_81fbd533-9440-4c34-8f66-7d1357985182_0 0.00% 56KiB / 3.839GiB 0.00% 0B / 0B 156kB / 0B 1
3、configMap概述
configmap数据会存储在etcd数据库,其应用场景主要在于应用程序配置。
configMap支持的数据类型:
(1)键值对;
(2)多行数据;
Pod使用configmap资源有两种常见的方式:
(1)变量注入;
(2)数据卷挂载
推荐阅读:
https://kubernetes.io/docs/concepts/storage/volumes/#configmap
https://kubernetes.io/docs/concepts/configuration/configmap/
3.1 定义configMap(简称"cm")资源
[root@k8s231.oldboyedu.com configMap]# cat 01-config-demo.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: linux85-config
# 定义cm资源的数据
data:
# 定义单行数据
school: oldboyedu
class: linux85
# 定义多行数据
my.cfg: |
datadir: "/var/lib/mysql"
basedir: "/usr/share/mysql"
socket: "/tmp/mysql.sock"
student.info: |
pengbing: "大长腿,熬夜,六味地黄丸"
wumingkun: "彭斌,Linux"
qinhongbin: "欧美,日韩,国产"
liwenxuan: "拍小电影,小皮鞭"
wanglei: "演小电影,大皮鞭"
[root@k8s231.oldboyedu.com configMap]# kubectl apply -f 01-config-demo.yaml
configmap/linux85-config created
3.2 pod基于env环境变量引入cm资源
[root@k8s231.oldboyedu.com configMap]# cat 02-cm-env.yaml
apiVersion: v1
kind: Pod
metadata:
name: linux85-game-cm-env
spec:
nodeName: k8s232.oldboyedu.com
containers:
- name: game
image: harbor.oldboyedu.com/oldboyedu-games/jasonyin2020/oldboyedu-games:v0.7
env:
- name: OLDBOYEDU_LINUX85_SCHOOL
valueFrom:
# 指定引用的configMap资源
configMapKeyRef:
# 指定configMap的名称
name: linux85-config
# 指定configMap的KEY
key: school
- name: OLDBOYEDU_LINUX85_CLASS
valueFrom:
configMapKeyRef:
name: linux85-config
key: class
- name: OLDBOYEDU_LINUX85_mycfg
valueFrom:
configMapKeyRef:
name: linux85-config
key: my.cfg
- name: OLDBOYEDU_LINUX85_studentinfo
valueFrom:
configMapKeyRef:
name: linux85-config
key: student.info
[root@k8s231.oldboyedu.com configMap]#
[root@k8s231.oldboyedu.com configMap]# kubectl apply -f 02-cm-env.yaml
[root@k8s231.oldboyedu.com configMap]#
[root@k8s231.oldboyedu.com configMap]# kubectl exec linux85-game-cm-env -- env
3.3 pod基于存储卷的方式引入cm资源
[root@k8s231.oldboyedu.com configMap]# cat 03-cm-volumes.yaml
apiVersion: v1
kind: Pod
metadata:
name: linux85-volume-cm-008
spec:
nodeName: k8s232.oldboyedu.com
volumes:
- name: data
# 指定存储卷的类型为configMap
configMap:
# 指定configMap的名称
name: linux85-config
# 引用configMap的key
items:
# 指定key的名称
- key: student.info
# 可以暂时理解为指定文件的名称
path: oldboyedu-linux85-student.info
containers:
- name: web
image: harbor.oldboyedu.com/web/nginx:1.20.1-alpine
command: ["tail","-f","/etc/hosts"]
volumeMounts:
- name: data
mountPath: /etc/nginx/nginx.conf
# 当subPath的值和configMap.items.path相同时,mountPath的挂载点是一个文件而非目录!
subPath: oldboyedu-linux85-student.info
[root@k8s231.oldboyedu.com configMap]#
[root@k8s231.oldboyedu.com configMap]# kubectl apply -f 03-cm-volumes.yaml
课堂练习:
请将"harbor.oldboyedu.com/oldboyedu-games/jasonyin2020/oldboyedu-games:v0.1"的nginx的配置文件使用cm资源创建并挂载!
3.4 课堂练习及prots的端口映射案例
[root@k8s231.oldboyedu.com configMap]# cat 04-cm-ketanglianxi.yaml
apiVersion: v1
kind: Pod
metadata:
name: linux85-games-ketanglianxi-002
spec:
# hostNetwork: true
nodeName: k8s232.oldboyedu.com
volumes:
- name: data
configMap:
name: oldboyedu-linux85-games
items:
- key: nginx.conf
path: nginx.conf
containers:
- name: game
image: harbor.oldboyedu.com/oldboyedu-games/jasonyin2020/oldboyedu-games:v0.1
volumeMounts:
- name: data
mountPath: /usr/local/nginx/conf/nginx.conf
subPath: nginx.conf
# 指定容器的端口映射相关字段
ports:
# 指定容器的端口号
- containerPort: 80
# 绑定主机的IP地址
hostIP: "0.0.0.0"
# 指定绑定的端口号
hostPort: 88
# 给该端口起一个别名,要求唯一
name: game
# 指定容器的协议
protocol: TCP
---
apiVersion: v1
kind: ConfigMap
metadata:
name: oldboyedu-linux85-games
data:
nginx.conf: |
worker_processes 1;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
server {
listen 80;
root /usr/local/nginx/html/bird/;
server_name game01.oldboyedu.com;
}
server {
listen 80;
root /usr/local/nginx/html/pinshu/;
server_name game03.oldboyedu.com;
}
server {
listen 80;
root /usr/local/nginx/html/tanke/;
server_name game05.oldboyedu.com;
}
server {
listen 80;
root /usr/local/nginx/html/pingtai/;
server_name game02.oldboyedu.com;
}
server {
listen 80;
root /usr/local/nginx/html/chengbao/;
server_name game04.oldboyedu.com;
}
}
[root@k8s231 configMap]# kubectl get pods -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
linux85-game-cm-env 1/1 Running 1 (14m ago) 3d 10.100.1.14 k8s232.oldboyedu.com <none> <none>
linux85-games-ketanglianxi-002 1/1 Running 0 11s 10.100.1.15 k8s232.oldboyedu.com <none> <none>
linux85-volume-cm-008 1/1 Running 1 (14m ago) 2d23h 10.100.1.13 k8s232.oldboyedu.com <none> <none>
[root@k8s232 ~]# iptables-save |grep 88
-A CNI-DN-d3271470de13d7612fb59 -s 10.100.1.0/24 -p tcp -m tcp --dport 88 -j CNI-HOSTPORT-SETMARK
-A CNI-DN-d3271470de13d7612fb59 -s 127.0.0.1/32 -p tcp -m tcp --dport 88 -j CNI-HOSTPORT-SETMARK
-A CNI-DN-d3271470de13d7612fb59 -p tcp -m tcp --dport 88 -j DNAT --to-destination 10.100.1.15:80
-A CNI-HOSTPORT-DNAT -p tcp -m comment --comment "dnat name: \"cbr0\" id: \"13446eea55742ce95f7e3228c024946a01a5d3d54ccd4bc0a9fd91a2a824f01c\"" -m multiport --dports 88 -j CNI-DN-d3271470de13d7612fb59
4. secret资源的增删改查实战
[root@k8s231 ~]# echo elastic | base64
ZWxhc3RpYwo=
[root@k8s231 ~]# echo oldboyedu | base64
b2xkYm95ZWR1Cg==
[root@k8s231 ~]# echo oldboyedu | base64 |base64 -d
oldboyedu
[root@k8s231.oldboyedu.com secret]# kubectl get secrets es-https
NAME TYPE DATA AGE
es-https Opaque 2 44s
[root@k8s231.oldboyedu.com secret]# kubectl apply -f 01-secret-demo.yaml
secret/es-https configured
[root@k8s231.oldboyedu.com secret]# kubectl get secrets es-https
NAME TYPE DATA AGE
es-https Opaque 3 49s
[root@k8s231.oldboyedu.com secret]# cat 01-secret-demo.yaml
apiVersion: v1
kind: Secret
metadata:
name: es-https
data:
username: ZWxhc3RpYwo=
password: b2xkYm95ZWR1Cg==
hostip: MTAuMC4wLjI1MAo=
[root@k8s231 secret]# kubectl get secrets es-https -o yaml
apiVersion: v1
data:
password: b2xkYm95ZWR1Cg==
username: ZWxhc3RpYwo=
kind: Secret
metadata:
annotations:
kubectl.kubernetes.io/last-applied-configuration: |
{"apiVersion":"v1","data":{"password":"b2xkYm95ZWR1Cg==","username":"ZWxhc3RpYwo="},"kind":"Secret","metadata":{"annotations":{},"name":"es-https","namespace":"default"}}
creationTimestamp: "2024-06-17T07:25:27Z"
name: es-https
namespace: default
resourceVersion: "127717"
uid: 0c1619a6-2511-46d2-9f17-a709483ea16f
type: Opaque
[root@k8s231.oldboyedu.com secret]# kubectl delete -f 01-secret-demo.yaml
secret "es-https" deleted
[root@k8s231.oldboyedu.com secret]#
与ConfigMap类似,区别在于secret存储敏感数据,所有的数据都需要经过base64进行编码。
使用secret主要存储的是凭据信息。
参考链接:
https://kubernetes.io/zh/docs/concepts/configuration/secret/#secret-types
4.1 Pod基于env引用secret资源案例
[root@k8s231.oldboyedu.com secret]# cat 02-secret-env.yaml
apiVersion: v1
kind: Pod
metadata:
name: linux85-game-secret-001
spec:
nodeName: k8s232.oldboyedu.com
containers:
- name: game
image: harbor.oldboyedu.com/oldboyedu-games/jasonyin2020/oldboyedu-games:v0.7
env:
- name: OLDBOYEDU_LINUX85_USERNAME
valueFrom:
# 指定引用的secret资源
secretKeyRef:
# 指定secret的名称
name: es-https
# 指定secret的KEY
key: username
- name: OLDBOYEDU_LINUX85_PASSWORD
valueFrom:
secretKeyRef:
name: es-https
key: password
- name: OLDBOYEDU_LINUX85_HOSTIP
valueFrom:
secretKeyRef:
name: es-https
key: hostip
[root@k8s231.oldboyedu.com secret]# kubectl apply -f 02-secret-env.yaml
pod/linux85-game-secret-001 created
[root@k8s231.oldboyedu.com secret]# kubectl get pods
NAME READY STATUS RESTARTS AGE
linux85-game-secret-001 1/1 Running 0 2s
[root@k8s231.oldboyedu.com secret]# kubectl exec linux85-game-secret-001 -- env
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=linux85-game-secret-001
OLDBOYEDU_LINUX85_HOSTIP=10.0.0.250
OLDBOYEDU_LINUX85_USERNAME=elastic
OLDBOYEDU_LINUX85_PASSWORD=oldboyedu
KUBERNETES_SERVICE_PORT=443
KUBERNETES_SERVICE_PORT_HTTPS=443
KUBERNETES_PORT=tcp://10.200.0.1:443
KUBERNETES_PORT_443_TCP=tcp://10.200.0.1:443
KUBERNETES_PORT_443_TCP_PROTO=tcp
KUBERNETES_PORT_443_TCP_PORT=443
KUBERNETES_PORT_443_TCP_ADDR=10.200.0.1
KUBERNETES_SERVICE_HOST=10.200.0.1
HOME=/root
4.2 Pod基于存储卷引用secret资源案例
[root@k8s231.oldboyedu.com secret]# cat 03-secret-volumes.yaml
apiVersion: v1
kind: Pod
metadata:
name: linux85-volume-secret-003
spec:
nodeName: k8s232.oldboyedu.com
volumes:
- name: data
# 指定存储卷的类型为secret
secret:
# 指定secret的名称
secretName: es-https
items:
- key: username
path: username.info
- key: password
path: password.info
- key: hostip
path: hostip.info
containers:
- name: web
image: harbor.oldboyedu.com/web/nginx:1.20.1-alpine
command: ["tail","-f","/etc/hosts"]
volumeMounts:
- name: data
# mountPath: /oldboyedu-data
mountPath: /etc/nginx/nginx.conf
subPath: username.info
- name: data
mountPath: /etc/nginx/password.conf
subPath: password.info
- name: data
mountPath: /etc/nginx/hostip.conf
subPath: hostip.info
[root@k8s231.oldboyedu.com secret]#
[root@k8s231.oldboyedu.com secret]# kubectl apply -f 03-secret-volumes.yaml
pod/linux85-volume-secret-003 configured
[root@k8s231 secret]# kubectl exec -it linux85-volume-secret-003 -- sh
/ # ls
bin home proc sys
dev lib root tmp
docker-entrypoint.d media run usr
docker-entrypoint.sh mnt sbin var
etc opt srv
/ # cd /etc/nginx/
/etc/nginx # ll
sh: ll: not found
/etc/nginx # ls
conf.d fastcgi_params mime.types nginx.conf scgi_params
fastcgi.conf hostip.conf modules password.conf uwsgi_params
/etc/nginx # cat nginx.conf
elastic
/etc/nginx # cat password.conf
oldboyedu
/etc/nginx # cat hostip.conf
10.0.0.250
/etc/nginx #
harbor用户信息:
username: linux85
password: Linux85@2023
基于命令行的方式创建harbor认证信息:
kubectl create secret docker-registry linux85 --docker-username=linux85 --docker-password=Linux85@2023 --docker-email=linux85@oldboyedu.com --docker-server=harbor.oldboyedu.com
[root@k8s231 ~]# kubectl get secrets
NAME TYPE DATA AGE
default-token-2m5sn kubernetes.io/service-account-token 3 5d6h
es-https Opaque 3 47m
linux85 kubernetes.io/dockerconfigjson 1 16s
获取habor认证信息的资源清单
kubectl get secrets linux85 -o yaml
[root@k8s231 ~]# kubectl get secrets linux85 -o yaml
apiVersion: v1
data:
.dockerconfigjson: eyJhdXRocyI6eyJoYXJib3Iub2xkYm95ZWR1LmNvbSI6eyJ1c2VybmFtZSI6ImxpbnV4ODUiLCJwYXNzd29yZCI6IkxpbnV4ODVAMjAyMyIsImVtYWlsIjoibGludXg4NUBvbGRib3llZHUuY29tIiwiYXV0aCI6ImJHbHVkWGc0TlRwTWFXNTFlRGcxUURJd01qTT0ifX19
kind: Secret
metadata:
creationTimestamp: "2024-06-17T08:18:32Z"
name: linux85
namespace: default
resourceVersion: "132322"
uid: e685a3df-2439-4ffc-85af-5def618d46bd
type: kubernetes.io/dockerconfigjson
[root@k8s231 secret]# kubectl get secrets linux85 -o yaml >> 04-imagePullSecret.yaml
4.3 编写资源清单拉取私有项目镜像案例:(温馨提示,不要直接复制,小心你的环境跟我不一样哟~)
[root@k8s231.oldboyedu.com secret]# cat 04-imagePullSecret.yaml
apiVersion: v1
kind: Pod
metadata:
name: linux85-imagepullsecret-002
spec:
nodeName: k8s232.oldboyedu.com
# 指定拉取镜像的secret验证信息
imagePullSecrets:
- name: linux85
containers:
- name: linux
image: harbor.oldboyedu.com/linux85/jasonyin2020/oldboyedu-linux-tools:v0.1
stdin: true
---
apiVersion: v1
data:
.dockerconfigjson: eyJhdXRocyI6eyJoYXJib3Iub2xkYm95ZWR1LmNvbSI6eyJ1c2VybmFtZSI6ImxpbnV4ODUiLCJwYXNzd29yZCI6IkxpbnV4ODVAMjAyMyIsImVtYWlsIjoibGludXg4NUBvbGRib3llZHUuY29tIiwiYXV0aCI6ImJHbHVkWGc0TlRwTWFXNTFlRGcxUURJd01qTT0ifX19
kind: Secret
metadata:
name: linux85
type: kubernetes.io/dockerconfigjson
周末作业:
(1)完成课堂的所有练习并完善思维导图;
(2)将"harbor.oldboyedu.com/oldboyedu-games/jasonyin2020/oldboyedu-games:v0.1"镜像拆分成5个游戏镜像,要求如下:
- 创建habor私有仓库:
仓库名称: homework
用户名: linux85-homework
密码: Linux85@2023 - 镜像名称:
harbor.oldboyedu.com/homework/oldboyedu-games:bird
harbor.oldboyedu.com/homework/oldboyedu-games:pinshu
harbor.oldboyedu.com/homework/oldboyedu-games:tanke
harbor.oldboyedu.com/homework/oldboyedu-games:pingtai
harbor.oldboyedu.com/homework/oldboyedu-games:chengbao - 将镜像批量推送到harbor仓库,如果可以的话请使用docker-compose实现批量编译并批量推送。
- 将上述5个镜像使用同一个文件实现5个Pod的部署,要求对每个容器的内存资源限制为200M,CPU为0.5核心。
作业提示: 本案例会使用到Pod,secret,configMap等资源。
扩展作业:
(1)各组用以下方式部署K8S集群;
kind:
一组。
minikube:
二组。
KubeSphere:
三组。
rancher:
四组。
kuboard:
五组。
kubeasz:
六组。
(2)将上面的基础作业使用各组自己搭建的K8S环境在实现一次。
(3)使用kubeadm部署K8S 1.27版本。在将上面的基础作业使用各组自己搭建的K8S环境在实现一次。