1. Configmap配置管理
- Configmap用于保存配置数据，以键值对形式存储。
configMap 资源提供了向 Pod 注入配置数据的方法。
旨在让镜像和配置文件解耦，以便实现镜像的可移植性和可复用性。
典型的使用场景：
1.填充环境变量的值
2.设置容器内的命令行参数
3.填充卷的配置文件 ##使用较多
- 创建ConfigMap的方式有4种：
1.使用字面值创建
2.使用文件创建
3.使用目录创建
4.编写configmap的yaml文件创建
- 1.使用字面值创建
$ kubectl create configmap my-config --from-literal=key1=config1 --from-literal=key2=config2
- 2.使用文件创建
$ kubectl create configmap my-config-2 --from-file=/etc/resolv.conf
key的名称是文件名称，value的值是这个文件的内容
- 3.使用目录创建
$ kubectl create configmap my-config-3 --from-file=test
目录中的文件名为key，文件内容是value
- 4.编写configmap的yaml文件
$ vim cm1.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: cm1-config
data:
db_host: "172.25.0.250"
db_port: "3306"
$ kubectl create -f cm1.yaml
1.1 清理实验环境
##删除namespace
[root@server2 ~]# kubectl get ns ##查看所有namespace，并删除
[root@server2 ~]# kubectl delete pod --all -n demo --force ##先删除里面pod在删除ns会快一点
[root@server2 ~]# kubectl delete ns demo
[root@server2 ~]# kubectl delete pod --all -n test --force
[root@server2 ~]# kubectl delete ns test
##删除pod
[root@server2 ~]# kubectl get pod
[root@server2 ~]# kubectl delete pod nginx --force
[root@server2 ~]# kubectl delete deployments.apps deployment
[root@server2 ~]# kubectl delete pod demo --force
##删除服务
[root@server2 ~]# kubectl get svc
[root@server2 ~]# kubectl delete svc nginx-svc
##删除ingress服务
[root@server2 ~]# kubectl delete ingress ingress-demo
## 删除网络策略
[root@server2 ~]# kubectl delete networkpolicies. --all
[root@server2 ~]# kubectl get networkpolicies.
No resources found in default namespace.
1.2 使用字面值创建
[root@server2 ~]# kubectl get cm
NAME DATA AGE
kube-root-ca.crt 1 37d
[root@server2 ~]# kubectl create configmap my-config --from-literal=key1=config1 --from-literal=key2=config2
configmap/my-config created
[root@server2 ~]# kubectl describe cm my-config
1.3 使用文件创建
[root@server2 ~]# kubectl create configmap my-config-2 --from-file=/etc/resolv.conf
configmap/my-config-2 created
[root@server2 ~]# cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 114.114.114.114
[root@server2 ~]# kubectl describe cm my-config-2
1.4 使用目录创建
[root@server2 ~]# mkdir congfigmap
[root@server2 ~]# cd congfigmap/
[root@server2 congfigmap]# mkdir test
[root@server2 congfigmap]# cp /etc/resolv.conf test/
[root@server2 congfigmap]# cp /etc/fstab test/
[root@server2 congfigmap]# ls test/
fstab resolv.conf
[root@server2 congfigmap]# kubectl create configmap my-config-3 --from-file=test
configmap/my-config-3 created
[root@server2 congfigmap]# kubectl describe cm my-config-3
1.5 编写configmap的yaml文件
[root@server2 congfigmap]# vim cm1.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: cm1-config
data:
db_host: "192.168.0.250"
db_port: "3306"
[root@server2 congfigmap]# kubectl apply -f cm1.yaml ##应用
[root@server2 congfigmap]# kubectl describe cm cm1-config ##描述详细信息
2.如何使用configmap
- 如何使用configmap：
1.通过环境变量的方式直接传递给pod
2.通过在pod的命令行下运行的方式
3.作为volume的方式挂载到pod内 ##此方式最常用
2.1 使用configmap设置环境变量
[root@server2 congfigmap]# vim pod1.yaml
apiVersion: v1
kind: Pod
metadata:
name: pod1
spec:
containers:
- name: pod1
image: busyboxplus
command: ["/bin/sh", "-c", "env"]
env:
- name: key1
valueFrom:
configMapKeyRef:
name: cm1-config
key: db_host
- name: key2
valueFrom:
configMapKeyRef:
name: cm1-config
key: db_port
restartPolicy: Never
[root@server2 congfigmap]# kubectl apply -f pod1.yaml
pod/pod1 created
[root@server2 congfigmap]# kubectl get pod
NAME READY STATUS RESTARTS AGE
pod1 0/1 Completed 0 5s
[root@server2 congfigmap]# kubectl logs pod1 ##查看日志是否有cm1-config信息
key1=192.168.0.250
key2=3306
2.2 使用conigmap设置命令行参数
[root@server2 congfigmap]# vim pod2.yaml
apiVersion: v1
kind: Pod
metadata:
name: pod2
spec:
containers:
- name: pod2
image: busyboxplus
command: ["/bin/sh", "-c", "echo $(db_host) $(db_port)"]
envFrom:
- configMapRef:
name: cm1-config
restartPolicy: Never
[root@server2 congfigmap]# kubectl apply -f pod2.yaml
pod/pod2 created
[root@server2 congfigmap]# kubectl get pod
NAME READY STATUS RESTARTS AGE
pod1 0/1 Completed 0 7m51s
pod2 0/1 Completed 0 19s
[root@server2 congfigmap]# kubectl logs pod2
192.168.0.250 3306
2.3 通过数据卷使用configmap
[root@server2 congfigmap]# vim pod3.yaml
apiVersion: v1
kind: Pod
metadata:
name: pod3
spec:
containers:
- name: pod3
image: busyboxplus
command: ["/bin/sh", "-c", "cat /config/db_host"]
volumeMounts:
- name: config-volume
mountPath: /config
volumes:
- name: config-volume
configMap:
name: cm1-config
restartPolicy: Never
[root@server2 congfigmap]# kubectl apply -f pod3.yaml
pod/pod3 created
[root@server2 congfigmap]# kubectl get pod
NAME READY STATUS RESTARTS AGE
pod1 0/1 Completed 0 13m
pod2 0/1 Completed 0 5m55s
pod3 0/1 Completed 0 4s
[root@server2 congfigmap]# kubectl logs pod3
192.168.0.250[root@server2 congfigmap]#
2.4 configmap热更新(使用数据卷)
[root@server2 congfigmap]# kubectl delete pod pod3
pod "pod3" deleted
## 1. 配置并查看数据卷内容
[root@server2 congfigmap]# vim pod3.yaml
apiVersion: v1
kind: Pod
metadata:
name: pod3
spec:
containers:
- name: pod3
image: busyboxplus
stdin: true
tty: true
volumeMounts:
- name: config-volume
mountPath: /config
volumes:
- name: config-volume
configMap:
name: cm1-config
[root@server2 congfigmap]# kubectl apply -f pod3.yaml
[root@server2 congfigmap]# kubectl get pod
[root@server2 congfigmap]# kubectl attach pod3 -it ##进入pod3并查看数据卷内容
[ root@pod3:/ ]$ cd /config/
[ root@pod3:/config ]$ ls
db_host db_port
[ root@pod3:/config ]$ cat *
192.168.0.2503306[ root@pod3:/config ]$
## 2. 准备热更新
[root@server2 congfigmap]# kubectl describe cm cm1-config ##编辑文件内容
[root@server2 congfigmap]# kubectl attach pod3 -it #查看pod3是否运行
Defaulting container name to pod3.
Use 'kubectl describe pod/pod3 -n default' to see all of the containers in this pod.
If you don't see a command prompt, try pressing enter.
[ root@pod3:/config ]$ cd /config/
[ root@pod3:/config ]$ cat *
192.168.0.2408080[ root@pod3:/config ]$ ##内容更新成功
2.5 pod滚动更新
configmap热更新后，并不会触发相关Pod的滚动更新，需要手动触发。
[root@server2 congfigmap]# kubectl delete -f pod1.yaml
[root@server2 congfigmap]# kubectl delete -f pod2.yaml
[root@server2 congfigmap]# kubectl delete -f pod3.yaml
[root@server2 congfigmap]# kubectl get pod
No resources found in default namespace.
[root@server2 congfigmap]# vim demo.yml
apiVersion: apps/v1
kind: Deployment
metadata:
name: demo
spec:
replicas: 1
selector:
matchLabels:
app: myapp
template:
metadata:
labels:
app: myapp
spec:
containers:
- name: myapp
image: myapp:v1
volumeMounts:
- name: config-volume
mountPath: /etc/nginx/conf.d
volumes:
- name: config-volume
configMap:
name: nginx-config
[root@server2 congfigmap]# vim default.conf
server {
listen 8080; ##此处自己书写的测试文件端口是8080
server_name _;
location / {
root /usr/share/nginx/html;
index index.html index.htm;
}
}
[root@server2 congfigmap]# kubectl create configmap nginx-config --from-file=default.conf ##创建cm
configmap/nginx-config created
[root@server2 congfigmap]# kubectl get cm
[root@server2 congfigmap]# kubectl describe cm nginx-config
[root@server2 congfigmap]# kubectl apply -f demo.yml ##创建pod
deployment.apps/demo created
[root@server2 congfigmap]# kubectl get pod
NAME READY STATUS RESTARTS AGE
demo 1/1 Running 0 28m
demo-75679c99b4-zs92h 1/1 Running 0 6s
[root@server2 congfigmap]# kubectl describe pod demo-75679c99b4-zs92h
[root@server2 congfigmap]# kubectl get pod -o wide ##查看pod详细信息
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
demo 1/1 Running 0 30m 10.244.22.11 server4 <none> <none>
demo-75679c99b4-zs92h 1/1 Running 0 83s 10.244.141.198 server3 <none> <none>
[root@server2 congfigmap]# curl 10.244.141.198:8080 ##使用8080端口访问成功
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>
[root@server2 congfigmap]# kubectl exec -it demo-75679c99b4-zs92h -- sh ##进入终端查看nginx的默认conf文件
/ # cd /etc/nginx/conf.d/
/etc/nginx/conf.d # ls
default.conf
/etc/nginx/conf.d # cat default.conf
2.5.1 使用命令更新(打补丁)
[root@server2 congfigmap]# kubectl edit cm nginx-config ##编辑文件，修改端口号为80
[root@server2 congfigmap]# kubectl describe cm nginx-config ##查看cm信息，发现热更新成功
[root@server2 congfigmap]# curl 10.244.141.198:8080 ##发现更新成功后还是只能使用8080进行访问，这是因为pod没有更新
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>
[root@server2 congfigmap]# curl 10.244.141.198
curl: (7) Failed connect to 10.244.141.198:80; Connection refused
[root@server2 congfigmap]# kubectl exec -it demo-75679c99b4-zs92h -- sh ##查看配置文件是否是热更新
/ # cat /etc/nginx/conf.d/default.conf
server {
listen 80;
server_name _;
location / {
root /usr/share/nginx/html;
index index.html index.htm;
}
}
/ # netstat -antlp ##查看端口发现还是8080
[root@server2 congfigmap]# kubectl patch deployments.apps demo --patch '{"spec": {"template": {"metadata": {"annotations": {"version/config": "2021022401"}}}}}' ##打补丁
deployment.apps/demo patched
[root@server2 congfigmap]# kubectl get pod
NAME READY STATUS RESTARTS AGE
demo 1/1 Running 0 41m
demo-75679c99b4-zs92h 0/1 Terminating 0 13m
demo-7f476857fb-bdh65 1/1 Running 0 6s
[root@server2 congfigmap]# kubectl get pod -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
demo 1/1 Running 0 42m 10.244.22.11 server4 <none> <none>
demo-75679c99b4-zs92h 0/1 Terminating 0 13m <none> server3 <none> <none>
demo-7f476857fb-bdh65 1/1 Running 0 20s 10.244.22.12 server4 <none> <none>
[root@server2 congfigmap]# curl 10.244.22.12 ##使用80端口访问成功
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>
[root@server2 congfigmap]# kubectl exec -it demo-7f476857fb-bdh65 -- sh
/ # netstat -antlp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 1/nginx: master pro
2.5.2 直接删除pod更新
[root@server2 congfigmap]# kubectl edit cm nginx-config ##把端口改成8080
configmap/nginx-config edited
[root@server2 congfigmap]# kubectl get pod
NAME READY STATUS RESTARTS AGE
demo 1/1 Running 0 50m
demo-7f476857fb-bdh65 1/1 Running 0 9m12s
[root@server2 congfigmap]# kubectl delete pod demo-7f476857fb-bdh65
pod "demo-7f476857fb-bdh65" deleted
[root@server2 congfigmap]# kubectl get pod -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
demo 1/1 Running 0 53m 10.244.22.11 server4 <none> <none>
demo-7f476857fb-wwhdm 1/1 Running 0 23s 10.244.141.199 server3 <none> <none>
[root@server2 congfigmap]# curl 10.244.141.199
curl: (7) Failed connect to 10.244.141.199:80; Connection refused
[root@server2 congfigmap]# curl 10.244.141.199:8080
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>
3.Secret配置管理
- Secret 对象类型用来保存敏感信息，例如密码、OAuth 令牌和 ssh key。
- 敏感信息放在 secret 中比放在 Pod 的定义或者容器镜像中来说更加安全和灵活。
- Pod 可以用两种方式使用 secret：
作为 volume 中的文件被挂载到 pod 中的一个或者多个容器里。
当 kubelet 为 pod 拉取镜像时使用。
- Secret的类型：
Service Account：Kubernetes 自动创建包含访问 API 凭据的 secret，并自动修改 pod 以使用此类型的 secret。
Opaque：使用base64编码存储信息，可以通过base64 --decode解码获得原始数据，因此安全性弱。
kubernetes.io/dockerconfigjson：用于存储docker registry的认证信息。
3.1 默认secret
- 每个namespace下有一个名为default的默认的ServiceAccount对象
- ServiceAccount里有一个名为Tokens的可以作为Volume一样被Mount到Pod里的Secret，当Pod启动时这个Secret会被自动Mount到Pod的指定目录下，用来协助完成Pod中的进程访问API Server时的身份鉴权过程。
3.2 简单操作
[root@server2 secret]# vim mysecret.yaml
apiVersion: v1
kind: Secret
metadata:
name: mysecret
type: Opaque
data:
username: YWRtaW4=
password: d2VzdG9z
[root@server2 secret]# echo YWRtaW4= | base64 -d
admin[root@server2 secret]# echo d2VzdG9z | base64 -d
westos[root@server2 secret]# kubectl apply -f mysecret.yaml
secret/mysecret created
[root@server2 secret]# kubectl get secrets
NAME TYPE DATA AGE
basic-auth Opaque 1 8d
default-token-s98h6 kubernetes.io/service-account-token 3 37d
mysecret Opaque 2 6s
tls-secret kubernetes.io/tls 2 7d21h
[root@server2 secret]# kubectl describe secrets mysecret
Name: mysecret
Namespace: default
Labels: <none>
Annotations: <none>
Type: Opaque
Data
====
password: 6 bytes
username: 5 bytes
[root@server2 secret]# kubectl get secrets mysecret -o yaml
apiVersion: v1
data:
password: d2VzdG9z
username: YWRtaW4=
3.3 将Secret挂载到Volume，向指定路径映射secret密钥
将Secret挂载到Volume
[root@server2 secret]# kubectl get pod
NAME READY STATUS RESTARTS AGE
demo 1/1 Running 0 98m
demo-7f476857fb-wwhdm 1/1 Running 0 45m
[root@server2 secret]# kubectl delete deployments.apps demo
[root@server2 secret]# kubectl delete pod demo
[root@server2 secret]# vim pod1.yaml
[root@server2 secret]# kubectl apply -f pod1.yaml
pod/mysecret created
[root@server2 secret]# kubectl exec mysecret -- ls /secret
password
username
[root@server2 secret]# kubectl exec mysecret -- cat /secret/username
admin[root@server2 secret]# kubectl exec mysecret -- cat /secret/password
westos[root@server2 secret]# kubectl get pod
[root@server2 secret]# kubectl delete -f pod1.yaml
向指定路径映射secret密钥
[root@server2 secret]# vim pod1.yaml
apiVersion: v1
kind: Pod
metadata:
name: mysecret
spec:
containers:
- name: demo
image: myapp:v1
volumeMounts:
- name: secrets
mountPath: "/secret"
readOnly: true
volumes:
- name: secrets
secret:
secretName: mysecret
items:
- key: username
path: my-group/my-username
[root@server2 secret]# kubectl apply -f pod1.yaml
pod/mysecret created
[root@server2 secret]# kubectl get pod
NAME READY STATUS RESTARTS AGE
mysecret 1/1 Running 0 5s
[root@server2 secret]# kubectl exec mysecret -- ls /secret
my-group
[root@server2 secret]# kubectl exec mysecret -- cat /secret/my-group/my-username
admin[root@server2 secret]#
3.4 将Secret设置为环境变量
[root@server2 secret]# kubectl delete pod mysecret --force
[root@server2 secret]# vim pod2.yaml
apiVersion: v1
kind: Pod
metadata:
name: secret-env
spec:
containers:
- name: nginx
image: myapp:v1
env:
- name: SECRET_USERNAME
valueFrom:
secretKeyRef:
name: mysecret
key: username
- name: SECRET_PASSWORD
valueFrom:
secretKeyRef:
name: mysecret
key: password
[root@server2 secret]# kubectl apply -f pod2.yaml
pod/secret-env created
[root@server2 secret]# kubectl get pod
NAME READY STATUS RESTARTS AGE
secret-env 1/1 Running 0 9s
[root@server2 secret]# kubectl exec secret-env -- env
3.5 拉取未公开仓库镜像
[root@server2 secret]# kubectl delete pod secret-env --force
[root@server2 secret]# vim pod3.yaml
apiVersion: v1
kind: Pod
metadata:
name: mypod
spec:
containers:
- name: game2048
image: reg.westos.org/westos/game2048
imagePullSecrets: ##没有这一部分是拉取不成功的
- name: myregistrykey
[root@server2 secret]# kubectl create secret docker-registry myregistrykey --docker-server=reg.westos.org --docker-username=admin --docker-password=westos --docker-email=自己仓库邮箱
[root@server2 secret]# kubectl get secrets
[root@server2 secret]# kubectl describe secrets myregistrykey
[root@server2 secret]# kubectl get secrets myregistrykey -o yaml
[root@server2 secret]# echo eyJhdXRocyI6eyJyZWcud2VzdG9zLm9yZyI6eyJ1c2VybmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiJ3ZXN0b3MiLCJlbWFpbCI6IjYyNjQzODY2MUBxcS5jb20iLCJhdXRoIjoiWVdSdGFXNDZkMlZ6ZEc5eiJ9fX0 | base64 -d
[root@server2 secret]# kubectl apply -f pod3.yaml
pod/mypod created
[root@server2 secret]# kubectl get pod
NAME READY STATUS RESTARTS AGE
mypod 1/1 Running 0 26s
[root@server2 secret]# kubectl describe pod mypod
