K8s--07 configMap資源

目錄

• 一、configMap資源
• 二、安全認證和RBACAPI
• 三、dashboard創建

一、configMap資源

configMap資源
 
1.為什么要用configMap？
將配置文件和POD解耦

2.congiMap里的配置文件是如何存儲的？
鍵值對
key:value
文件名:配置文件的內容

3.configMap支持的配置類型
  直接定義的鍵值對 
  基於文件創建的鍵值對

4.configMap創建方式
  命令行
  資源配置清單 

5.configMap的配置文件如何傳遞到POD里
  變量傳遞
  數據卷掛載

6.命令行創建configMap
kubectl create configmap --help

kubectl create configmap nginx-config --from-literal=nginx_port=80 --from-literal=server_name=nginx.cookzhang.com

kubectl get cm
kubectl describe cm nginx-config 


7.POD環境變量形式引用configMap
kubectl explain pod.spec.containers.env.valueFrom.configMapKeyRef

cat >nginx-cm.yaml <<EOF
apiVersion: v1
kind: Pod
metadata: 
  name: nginx-cm
spec:
  containers:
  - name: nginx-pod
    image: nginx:1.14.0
    ports:
    - name: http 
      containerPort: 80
    env:
    - name: NGINX_PORT
      valueFrom:
        configMapKeyRef:
          name: nginx-config
          key: nginx_port
    - name: SERVER_NAME
      valueFrom:
        configMapKeyRef:
          name: nginx-config
          key: server_name 
EOF
kubectl create -f nginx-cm.yaml

8.查看pod是否引入了變量
[root@node1 ~/confimap]# kubectl exec -it nginx-cm /bin/bash
root@nginx-cm:~# echo ${NGINX_PORT}
80
root@nginx-cm:~# echo ${SERVER_NAME}
nginx.cookzhang.com
root@nginx-cm:~# printenv |egrep "NGINX_PORT|SERVER_NAME"
NGINX_PORT=80
SERVER_NAME=nginx.cookzhang.com

注意：
變量傳遞的形式，修改confMap的配置，POD內並不會生效
因為變量只有在創建POD的時候才會引用生效，POD一旦創建好，環境變量就不變了


8.文件形式創建configMap
創建配置文件：
cat >www.conf <<EOF
server {
        listen       80;
        server_name  www.cookzy.com;
        location / {
            root   /usr/share/nginx/html/www;
            index  index.html index.htm;
        }
    }
EOF

創建configMap資源：
kubectl create configmap nginx-www --from-file=www.conf=./www.conf 

查看cm資源
kubectl get cm
kubectl describe cm nginx-www

編寫pod並以存儲卷掛載模式引用configMap的配置
cat >nginx-cm-volume.yaml <<EOF
apiVersion: v1
kind: Pod
metadata: 
  name: nginx-cm
spec:
  containers:
  - name: nginx-pod
    image: nginx:1.14.0
    ports:
    - name: http 
      containerPort: 80

    volumeMounts:
    - name: nginx-www
      mountPath: /etc/nginx/conf.d/

  volumes:
  - name: nginx-www
    configMap:
     name: nginx-www
     items: 
     - key: www.conf
       path: www.conf
EOF

測試：
1.進到容器內查看文件
kubectl exec -it nginx-cm /bin/bash
cat /etc/nginx/conf.d/www.conf 
2.動態修改configMap
kubectl edit cm nginx-www

3.再次進入容器內觀察配置會不會自動更新
cat /etc/nginx/conf.d/www.conf 
nginx -T


9.配置文件內容直接以數據格式直接存儲在configMap里
創建config配置清單：
cat >nginx-configMap.yaml <<EOF
apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-config
  namespace: default
data:
  www.conf: |
    server {
            listen       80;
            server_name  www.cookzy.com;
            location / {
                root   /usr/share/nginx/html/www;
                index  index.html index.htm;
            }
        }
  blog.conf: |
    server {
            listen       80;
            server_name  blog.cookzy.com;
            location / {
                root   /usr/share/nginx/html/blog;
                index  index.html index.htm;
            }
        }


應用並查看清單:
kubectl create -f nginx-configMap.yaml
kubectl get cm
kubectl describe cm nginx-config 

創建POD資源清單並引用configMap
cat >nginx-cm-volume-all.yaml <<EOF
apiVersion: v1
kind: Pod
metadata: 
  name: nginx-cm
spec:
  containers:
  - name: nginx-pod
    image: nginx:1.14.0
    ports:
    - name: http 
      containerPort: 80
    volumeMounts:
    - name: nginx-config
      mountPath: /etc/nginx/conf.d/

  volumes:
  - name: nginx-config
    configMap:
     name: nginx-config
     items: 
     - key: www.conf
       path: www.conf
     - key: blog.conf
       path: blog.conf
EOF

應用並查看:
kubectl create -f nginx-cm-volume-all.yaml
kubectl get pod
kubectl describe pod nginx-cm 

進入容器內並查看：
kubectl exec -it nginx-cm /bin/bash
ls /etc/nginx/conf.d/
cat /etc/nginx/conf.d/www.conf

測試動態修改configMap會不會生效
kubectl edit cm nginx-config 

kubectl exec -it nginx-cm /bin/bash
ls /etc/nginx/conf.d/
cat /etc/nginx/conf.d/www.conf

二、安全認證和RBACAPI

Server是訪問控制的唯一入口

在k8s平台上的操作對象都要經歷三種安全相關的操作
1.認證操作
  http協議 token 認證令牌 
  ssl認證  kubectl需要證書雙向認證
2.授權檢查
  RBAC  基於角色的訪問控制 
3.准入控制
  進一步補充授權機制，一般在創建，刪除，代理操作時作補充

k8s的api賬戶分為2類
  1.實實在在的用戶 人類用戶 userAccount
  2.POD客戶端 serviceAccount 默認每個POD都有認真信息

RBAC就要角色的訪問控制
  你這個賬號可以擁有什么權限
  
以traefik舉例：
1.創建了賬號 ServiceAccount:traefik-ingress-controller
2.創建角色   ClusterRole:   traefik-ingress-controller
  Role  POD相關的權限
  ClusterRole namespace級別操作 
3.將賬戶和權限角色進行綁定     traefik-ingress-controller
  RoleBinding
  ClusterRoleBinding
4.創建POD時引用ServiceAccount
  serviceAccountName: traefik-ingress-controller


注意！！！
kubeadm安裝的k8s集群，證書默認只有1年

三、dashboard創建

k8s 

1.官方項目地址
https://github.com/kubernetes/dashboard

2.下載配置文件
wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-rc5/aio/deploy/recommended.yaml

3.修改配置文件
 39 spec:
 40   type: NodePort
 41   ports:
 42     - port: 443
 43       targetPort: 8443
 44       nodePort: 30000

4.應用資源配置
kubectl create -f recommended.yaml

5.創建管理員賬戶並應用
https://github.com/kubernetes/dashboard/blob/master/docs/user/access-control/creating-sample-user.md

cat > dashboard-admin.yaml<<EOF
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kubernetes-dashboard
EOF
kubectl create -f dashboard-admin.yaml

6.查看資源並獲取token
kubectl get pod -n kubernetes-dashboard -o wide
kubectl get svc -n kubernetes-dashboard
kubectl get secret  -n kubernetes-dashboard
kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep admin-user | awk '{print $1}')

7.瀏覽器訪問
https://10.0.0.11:30000
google瀏覽器打不開就換火狐瀏覽器
黑科技 


x.報錯總結
{"level":"error","msg":"Error scraping node metrics: the server could not find the requested resource (get nodes.metrics.k8s.io)","time":"2020-03-03T09:57:00Z"}

Skipping metric because of error: Metric label not set

原因：
沒有安裝metrics監控組建