k8s之Configmap與Secret

ConfigMap：k8s標准資源，將配置文件做成k8s資源，使其它資源可加載其中配置
Secret：實現加密功能的安全配置文件。由多個key:val中組成

創建configmap資源，可直接使用kubectl創建並且傳值

kubectl create configmap filebeat-cfg -n config --from-literal=redis_host="redis.default.svc.cluster.local" --from-literal=log_level="Info"

--from-literal=log_level="Info" 此字段表示為創建一個key為log_level並且為這個可以賦值為info
而后創建pod，並引用configmap資源中的key

apiVersion: v1
kind: Pod
metadata: 
  name: pod-cfg-demo
  namespace : config
spec:
  containers:
    name: filebeat
    image: ikubernetes/filebeat:5.6.5-alp ine
    env:#引用環境變量值
    - name: REDIS_ HOST #名稱，REDIS_HOST為容器內部的變量名稱
      valueFrom:#引用其他資源傳遞變量，
        configMapKeyRef :#表示引用configmap資源
          name: filebeat-cfg #configmap名稱，為剛才創建的configmap資源
          key: redis_host#key名稱
    - name: LOG_LEUEL #同上也為容器內的變量名稱
        valueFrom:
          configMapKeyRef :
            name: filebeat-cfg 
            key: log_level

連接至容器內部查看環境變量傳遞成功了，但是我們修改configmap中key 的值不會生效，除非重建pod

基於存儲卷引用configmap
創建2個配置文件為存儲卷提供配置

定義好configmap
kubectl create configmap nginx-cfg --from-file=./server1.conf --from-file=server-2./server2.conf -n config
--from-file=./server1.conf #利用文件來傳遞參數，沒有給key名稱默認為文件名稱為key，文件內容為value
--from-file=server-2./server2.conf -n config#也可以手動添加key名。並指定文件內容為value，且目錄為相對路徑不能為絕對路徑

apiVersion: v1
kind: Pod
metadata:
  name: myapp-pod
  namespace: config
spec:
  containers: 
  - name: myapp
    image: ikubernetes/ myapp:v1
    volumeMounts : #定義容器使用存儲卷掛載
    - name: config#使用存儲卷的名稱
      mountPath: /etc/nginx/conf.d/
volumes:#定義存儲卷
- name: config#存儲卷名稱
  configMap:#存儲卷類型：這里為configmap而不是nfs其他的文件系統，可以指定configmap資源為存儲卷
    name: nginx-cfg#configmap名稱，這里為我們剛才創建的cm名稱
    items :#使用cm中的key
    - key: server1.conf #key名稱
      path: server-first.conf #表示映射為文件時文件名是什么
    - key: server-2
      path: server-second.conf

kubectl edit cm nginx-cfg -n config#在線修改時會自動同步至容器內部

secret資源。經過base64編碼后的配置中心，用於傳遞敏感信息的值
secret類型：
tls類型：專用ssl。tls格式的證書和私鑰打包進secret中。不管原來文件叫什么，通通進行統一，證書一定會映射為叫tls.crt。私鑰為tls.key
generic：非證書認證時使用的普通的敏感信息類型
docker-registry：用於連接dockerhub中時使用的賬戶認證信息類型

kubectl create secret generic mysql-root-password -n config --from-literal=password=centos #創建通用型secret資源

創建pod使用secret中的key傳遞給容器

apiVersion: v1
kind: Pod
metadata:
  name: mysql
  namespace: config
spec:
  containers:
  - name: mysql
    image: mysql:5.6
    env: #容器內部定義的變量
    - name: MYSQL_ROOT_PASSWORD#此名稱為容器內部定義的變量名，不是隨便給的。需要傳遞參數才能啟動mysql容器
      valueFrom:  #定義值
        secretKeyRef: #值類型為secret
          key: password #key名稱
          name: mysql-root-password #secret的名稱

交互式連接mysql可直接使用傳遞的參數登陸mysql

kubectl create secret tls mysql-cert --cert=./myapp.crt --key=./myapp.key -n config#創證書類型secret配置，是其他pod能將此secret當作證書認證

apiVersion: v1
kind: Pod
metadata:
  name: myapp-pod-tls
  namespace: config
spec:
  containers:
  - name: myapp
    image: ikubernetes/myapp:v1
    volumeMounts:
    - name: config
      mountPath: /etc/nginx/conf.d/
    - name: tls
      mountPath: /etc/nginx/certs/#容器內部的掛載路徑
  volumes:#定義存儲卷類型
  - name: config 存儲卷名稱
    configMap:  #存儲卷類型configmap
     name: nginx-cfg
     items:
     - key: server1.conf
       path: server-first.conf
     - key: server-2
       path: server-second.conf
  - name: tls
    secret: #此存儲卷類型為secret
      secretName: mysql-cert #secret的名稱，剛才我創建為mysql-cert
      items: #定義key
      - key: tls.crt #注意原key和crt為什么名稱。在secret中定義都為tls.key,tls,crt
        path: myapp.crt #在容器中名稱相對路徑為mountPath: /etc/nginx/conf.d/
      - key: tls.key
        path: myapp.key
        mode: 0600 #定義權限

StatefulSet：管理有狀態應用，但對於擴縮容需要自己寫代碼操作，statefulset只負責提供給pod一個單一的標識，存儲設備。
operator：使用不同應用程序，對不同的應用程序有程序的所有運維管理操作，不同的應用程序有不同的operator，operator運行為k8s集群中的pod，用於控制有狀態的集群應用

定義statefulset：

先創建好幾個pv，使用靜態創建
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-nfs-v0
  labels:
    storage: nfs
spec:
  accessModes: ["ReadWriteOnce ","ReadwriteMany","ReadOnlyMany"]
  capacity:
    storage: 1Gi
  volumeMode: Filesystem
  persistentvolumeReclaimPolicy: Retain
  nfs:
    server: 192 .168.1.199
    path: /vols/v0
---

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-nfs-v1
  labels:
    storage: nfs
spec:
  accessModes: ["ReadWriteOnce ","ReadwriteMany","ReadOnlyMany"]
  capacity:
    storage: 5Gi
  volumeMode: Filesystem
  persistentvolumeReclaimPolicy: Retain
  nfs:
    server: 192 .168.1.199
    path: /vols/v1
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-nfs-v2
  labels:
    storage: nfs
spec:
  accessModes: ["ReadWriteOnce ","ReadwriteMany","ReadOnlyMany"]
  capacity:
    storage: 5Gi
  volumeMode: Filesystem
  persistentvolumeReclaimPolicy: Retain
  nfs:
    server: 192 .168.1.199
    path: /vols/v2
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-nfs-v3
  labels:
    storage: nfs
spec:
  accessModes: ["ReadWriteOnce ","ReadwriteMany","ReadOnlyMany"]
  capacity:
    storage: 5Gi
  volumeMode: Filesystem
  persistentvolumeReclaimPolicy: Retain
  nfs:
    server: 192 .168.1.199
    path: /vols/v3
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-nfs-v4
  labels:
    storage: nfs
spec:
  accessModes: ["ReadWriteOnce ","ReadwriteMany","ReadOnlyMany"]
  capacity:
    storage: 5Gi
  volumeMode: Filesystem
  persistentvolumeReclaimPolicy: Retain
  nfs:
    server: 192 .168.1.199
    path: /vols/v4
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-nfs-v5
  labels:
    storage: nfs
spec:
  accessModes: ["ReadWriteOnce ","ReadwriteMany","ReadOnlyMany"]
  capacity:
    storage: 5Gi
  volumeMode: Filesystem
  persistentvolumeReclaimPolicy: Retain
  nfs:
    server: 192 .168.1.199
    path: /vols/v5
#而后創建statefulset資源，綁定使用pv

定義好statefulset

apiVersion: v1
kind: Service #定義好前端service
metadata:
  name: myapp-sts-svc
  namespace: sts
  labels:
    app: myapp
spec:
  ports:
  - port: 80
    name: web
  clusterIP: None
  selector:
    app: myapp-pod
    containers: sts
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: statefulset-demo
  namespace: sts
spec:
  selector:
    matchLabels:
      app: myapp-pod
      containers: sts
  serviceName: "myapp-sts-svc"
  replicas: 2 #pod副本數量
  template:#pod模板
    metadata:
      labels:
        app: myapp-pod
        containers: sts
    spec:
      terminationGracePeriodSeconds: 10#刪除pod時長
      containers:
      - name: myapp
        image: ikubernetes/myapp:v1
        ports:
        - containerPort: 80
          name: web
        volumeMounts:
        - name: myapp-pvc
          mountPath: /usr/share/nginx/html
  volumeClaimTemplates:#定義好pvc資源模板
  - metadata:
      name: myapp-pvc #pvc名稱
      namespace: sts #所屬名稱空間
    spec:
      accessModes: [ "ReadWriteOnce" ] #訪問模型為單路讀寫
      resources: #請求占用多少資源
        requests:
          storage: 2Gi