[root@master231 istio]# istioctl install –set profile=demo -y
​
3.7 查看拉取的镜像是否成功
root@master231:~# kubectl -n istio-system get pods
​
3.8 添加istioctl客户端自动补全功能
[root@master231 istio]# ll istio-1.17.8/tools/istioctl.bash
-rw-r–r– 1 root root 11294 Oct 11 2023 istio-1.17.8/tools/istioctl.bash
[root@master231 istio]#
[root@master231 istio]# source istio-1.17.8/tools/istioctl.bash
[root@master231 istio]#
[root@master231 istio]# istioctl
admin (Manage control plane (istiod) configuration)
analyze (Analyze Istio configuration and print validation messages)
authz ((authz is experimental. Use `istioctl experimental authz`))
bug-report (Cluster information and log capture support tool.)
…
​
3.9 查看istio的版本号
[root@master231 istio]# istioctl version
client version: 1.17.8
control plane version: 1.17.8
data plane version: 1.17.8 (2 proxies)
[root@master231 istio]#
​
4 istio实现A|B测试
4.1 编写资源清单
[root@master231 /server/kubernetes/istio/case-demo]# cat 01-deploy-apps.yaml
apiVersion: v1
kind: Namespace
metadata:
name: yangsenlin
​
—
​
apiVersion: apps/v1
# 注意，创建pod建议使用deploy资源，不要使用rc资源，否则istioctl可能无法手动注入。
kind: Deployment
metadata:
name: apps-v1
namespace: yangsenlin
spec:
replicas: 1
selector:
matchLabels:
app: xiuxian01
version: v1
auther: yangsenlin
template:
metadata:
labels:
app: xiuxian01
version: v1
auther: yangsenlin
spec:
volumes:
– name: data
emptyDir: {}
initContainers:
– name: init
image: registry.cn-hangzhou.aliyuncs.com/yangsenlin-k8s/apps:v2
volumeMounts:
– name: data
mountPath: /data
command:
– /bin/sh
– -c
– echo c1 > /data/index.html
containers:
– name: c1
ports:
– containerPort: 80
image: registry.cn-hangzhou.aliyuncs.com/yangsenlin-k8s/apps:v1
volumeMounts:
– name: data
mountPath: /usr/share/nginx/html
​
—
​
apiVersion: apps/v1
kind: Deployment
metadata:
name: apps-v2
namespace: yangsenlin
spec:
replicas: 1
selector:
matchLabels:
app: xiuxian02
version: v2
auther: yangsenlin
template:
metadata:
labels:
app: xiuxian02
version: v2
auther: yangsenlin
spec:
volumes:
– name: data
emptyDir: {}
initContainers:
– name: init
image: registry.cn-hangzhou.aliyuncs.com/yangsenlin-k8s/apps:v1
volumeMounts:
– name: data
mountPath: /data
command:
– /bin/sh
– -c
– echo c2 > /data/index.html
containers:
– name: c2
ports:
– containerPort: 80
image: registry.cn-hangzhou.aliyuncs.com/yangsenlin-k8s/apps:v1
volumeMounts:
– name: data
mountPath: /usr/share/nginx/html
[root@master231 case-demo]# cat 02-svc-apps.yaml
apiVersion: v1
kind: Service
metadata:
name: apps-svc-v1
namespace: yangsenlin
spec:
selector:
version: v1
ports:
– protocol: TCP
port: 80
targetPort: 80
name: http
​
—
​
apiVersion: v1
kind: Service
metadata:
name: apps-svc-v2
namespace: yangsenlin
spec:
selector:
version: v2
ports:
– protocol: TCP
port: 80
targetPort: 80
name: http
​
—
​
apiVersion: v1
kind: Service
metadata:
name: apps-svc-all
namespace: yangsenlin
spec:
selector:
auther: yangsenlin
ports:
– protocol: TCP
port: 80
targetPort: 80
name: http
[root@master231 case-demo]# cat 03-deploy-client.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: apps-client
namespace: yangsenlin
spec:
replicas: 1
selector:
matchLabels:
app: client-test
template:
metadata:
labels:
app: client-test
spec:
containers:
– name: c1
image: registry.cn-hangzhou.aliyuncs.com/yangsenlin-k8s/apps:v1
command:
– tail
– -f
– /etc/hosts
[root@master231 case-demo]# cat 04-vs-apps-svc-all.yaml
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
name: apps-svc-all-vs
namespace: yangsenlin
spec:
hosts:
– apps-svc-all
http:
# 定义匹配规则
– match:
# 基于header信息匹配将其进行路由，header信息自定义即可。
– headers:
# 匹配用户名包含”forestysl”的用户，这个KEY是咱们自定义的。
yangsenlin-username:
# “eaxct”关键词是包含，也可以使用”prefix”进行前缀匹配。
exact: forestysl
route:
– destination:
host: apps-svc-v1
– route:
– destination:
host: apps-svc-v2
​
4.2 手动注入
istioctl kube-inject -f 03-deploy-client.yaml | kubectl -n yangsenlin apply -f –
istioctl kube-inject -f 01-deploy-apps.yaml | kubectl -n yangsenlin apply -f –
kubectl get all -n yangsenlin
​
4.3 开始测试
[root@master231 /server/kubernetes/istio/case-demo]# kubectl get pods -n yangsenlin
NAME READY STATUS RESTARTS AGE
apps-client-5f579696d5-5n8zh 2/2 Running 0 3m39s
apps-v1-867845f5f9-wrkgv 2/2 Running 0 3m39s
apps-v2-7dfbc7c579-8nvsg 2/2 Running 0 3m39s
[root@master231 /server/kubernetes/istio/case-demo]#
[root@master241 yangsenlin]# kubectl -n yangsenlin exec -it apps-client-5cc67d864-g2r2v — sh
/ #
/ # while true; do curl -H “yangsenlin-username:forestysl” http://apps-svc-all;sleep 0.1;done # 添加用户认证的header信息
c1
c1
c1
c1
c1
c1
c1
…
​
​
​
/ # while true; do curl http://apps-svc-all;sleep 0.1;done # 不添加用户认证
c2
c2
c2
c2
c2
c2
c2
…
​
​
​
​
​
31 存储卷
常见的存储卷有
emptyDir
hostPath
nfs
configMap
secrets
downloadAPI
projected
pv
pvc
sc
local sc
​
1 emptyDir
1.1 emptyDir概述
emptyDir表示“空目录”（临时目录）存储卷，可以对容器的指定路径做数据持久化。
​
1.2 特点
随着pod生命周期的结束而结束

应用场景
1 实现同一个pod内不同容器的数据共享；
2 对数据做临时存储

1.3 对容器的指定目录做数据持久化
root@master231:/manifests# mkdir volumes
root@master231:/manifests# cd volumes/
root@master231:/manifests/volumes#
​
root@master231:/manifests/volumes# cat 01-deploy-emptyDir.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-xiuxian-emptydir
spec:
replicas: 3
selector:
matchLabels:
apps: xiuxian
template:
metadata:
labels:
apps: xiuxian
spec:
# 定义存储卷
volumes:
# 定义存储类型是一个”空目录”(emptyDir)
– emptyDir: {}
# 为存储卷起名字
name: data
containers:
– name: c1
image: crpi-kxgdi0lp5jdep1gc.cn-chengdu.personal.cr.aliyuncs.com/yangsenlin/apps:v1
# 定义存储卷挂载
volumeMounts:
# 需要要挂载的存储卷
– name: data
# 挂载到容器的指定路径，如果路径有文件，则会将文件的内容全部清空
mountPath: /usr/share/nginx/html

1.4 查看emptyDir数据的存储路径
/var/lib/kubelet/pods//volumes/kubernetes.io~empty-dir//
​
1.5 master节点写入测试数据，worker节点上查看
root@worker233:~# ll /var/lib/kubelet/pods/5a653aea-3acb-4525-8707-78dfc1024cd0/volumes/kubernetes.io~empty-dir/data/
total 8
drwxrwxrwx 2 root root 4096 Apr 10 20:59 ./
drwxr-xr-x 3 root root 4096 Apr 10 20:59 ../
​
​
root@master231:/manifests/volumes# kubectl exec -it deploy-xiuxian-emptydir-745ffd54fc-d99ng — sh
/ # echo 111111111111111111 > /usr/share/nginx/html/index.html
/ # exit
root@master231:/manifests/volumes#
​
root@worker233:~# docker ps -a | grep deploy-xiuxian-emptydir-745ffd54fc-d99ng
fa31078b4b9f f28fd43be4ad “/docker-entrypoint.…” 46 seconds ago Up 45 seconds k8s_c1_deploy-xiuxian-emptydir-745ffd54fc-d99ng_default_5a653aea-3acb-4525-8707-78dfc1024cd0_0
bbd6aaefef3c registry.aliyuncs.com/google_containers/pause:3.6 “/pause” 47 seconds ago Up 47 seconds k8s_POD_deploy-xiuxian-emptydir-745ffd54fc-d99ng_default_5a653aea-3acb-4525-8707-78dfc1024cd0_0
​
root@worker233:~# ll /var/lib/kubelet/pods/5a653aea-3acb-4525-8707-78dfc1024cd0/volumes/kubernetes.io~empty-dir/data/
total 12
drwxrwxrwx 2 root root 4096 Apr 10 21:05 ./
drwxr-xr-x 3 root root 4096 Apr 10 20:59 ../
-rw-r–r– 1 root root 19 Apr 10 21:05 index.html
​
root@worker233:~# docker ps -a | grep deploy-xiuxian-emptydir-745ffd54fc-2644m
1d4664f3c397 f28fd43be4ad “/docker-entrypoint.…” 9 minutes ago Up 9 minutes k8s_c1_deploy-xiuxian-emptydir-745ffd54fc-2644m_default_071e2d24-955e-4218-bb03-1635eeee8388_0
cb5aa2df92e8 registry.aliyuncs.com/google_containers/pause:3.6 “/pause” 9 minutes ago Up 9 minutes k8s_POD_deploy-xiuxian-emptydir-745ffd54fc-2644m_default_071e2d24-955e-4218-bb03-1635eeee8388_0
​
root@worker233:~# ll /var/lib/kubelet/pods/071e2d24-955e-4218-bb03-1635eeee8388/volumes/kubernetes.io~empty-dir/data/
total 8
drwxrwxrwx 2 root root 4096 Apr 10 20:59 ./
drwxr-xr-x 3 root root 4096 Apr 10 20:59 ../
​
root@worker232:~# docker ps -a | grep deploy-xiuxian-emptydir-745ffd54fc-22xpb
1416ba87b6c1 f28fd43be4ad “/docker-entrypoint.…” 11 minutes ago Up 11 minutes k8s_c1_deploy-xiuxian-emptydir-745ffd54fc-22xpb_default_f0d37fdb-4364-4f43-9668-cfe1309dc359_0
b3e3d65ffeb9 registry.aliyuncs.com/google_containers/pause:3.6 “/pause” 11 minutes ago Up 11 minutes k8s_POD_deploy-xiuxian-emptydir-745ffd54fc-22xpb_default_f0d37fdb-4364-4f43-9668-cfe1309dc359_0
root@worker232:~# ll /var/lib/kubelet/pods/f0d37fdb-4364-4f43-9668-cfe1309dc359/volumes/kubernetes.io~empty-dir/data/
total 8
drwxrwxrwx 2 root root 4096 Apr 10 20:59 ./
drwxr-xr-x 3 root root 4096 Apr 10 20:59 ../
root@worker232:~#
​
1.6 持久化总结
只有在pod中写入数据的容器才会改变，没有写入数据的pod容器中无变化
​
1.7 实现同一个pod内不同容器的数据共享
root@master231:/manifests/volumes# cat 02-deploy-emptyDir.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-xiuxian-emptydir-multiple
spec:
replicas: 3
selector:
matchLabels:
apps: xiuxian
template:
metadata:
labels:
apps: xiuxian
spec:
volumes:
– emptyDir: {}
name: data
containers:
– name: c1
image: crpi-kxgdi0lp5jdep1gc.cn-chengdu.personal.cr.aliyuncs.com/yangsenlin/apps:v1
ports:
– containerPort: 80
volumeMounts:
– name: data
mountPath: /usr/share/nginx/html
– name: c2
image: crpi-kxgdi0lp5jdep1gc.cn-chengdu.personal.cr.aliyuncs.com/yangsenlin/apps:v1
command:
– /bin/sh
– -c
– echo www.yangsenlin.top >> /ysl/index.html; tail -f /etc/hosts
volumeMounts:
– name: data
mountPath: /ysl

root@master231:/manifests/volumes# kubectl get pods -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
deploy-xiuxian-emptydir-multiple-67cb889f5d-9q894 2/2 Running 0 19s 10.100.2.97 worker233
deploy-xiuxian-emptydir-multiple-67cb889f5d-rwc2p 2/2 Running 0 19s 10.100.2.98 worker233
deploy-xiuxian-emptydir-multiple-67cb889f5d-xvqxh 2/2 Running 0 19s 10.100.1.36 worker232
root@master231:/manifests/volumes#
​
1.8 测试
root@master231:/manifests/volumes# kubectl exec -it deploy-xiuxian-emptydir-multiple-67cb889f5d-xvqxh -c c1 — sh
/ # ls -l /usr/share/nginx/html/
total 4
-rw-r–r– 1 root root 19 Apr 10 13:17 index.html
/ # cat /usr/share/nginx/html/index.html
www.yangsenlin.top
/ #
​
root@master231:/manifests/volumes# kubectl exec -it deploy-xiuxian-emptydir-multiple-67cb889f5d-xvqxh -c c2 — sh
/ # ls -l /ysl/index.html
-rw-r–r– 1 root root 19 Apr 10 13:17 /ysl/index.html
/ # cat /ysl/index.html
www.yangsenlin.top
/ #
​
2 hostPath
2.1 概述
hostPath用于pod内容器访问worker节点宿主机任意路径
​
2.2 应用场景
1 将某个worker节点的宿主机数据共享给pod的容器指定路径
2 同步时区
​
2.3 部署应用
root@master231:/manifests/volumes# cat 03-deploy-hostPath.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-xiuxian-hostpath
spec:
replicas: 3
selector:
matchLabels:
apps: xiuxian
template:
metadata:
labels:
apps: xiuxian
spec:
volumes:
– emptyDir: {}
name: data01
# 声明存储卷的名称是hostPath
– hostPath:
# 将worker节点宿主机路径暴露给容器，如果目录不存在会自动创建。
path: /ysl
name: data02
– name: data03
hostPath:
path: /etc/localtime
containers:
– name: c1
image: crpi-kxgdi0lp5jdep1gc.cn-chengdu.personal.cr.aliyuncs.com/yangsenlin/apps:v1
ports:
– containerPort: 80
volumeMounts:
– name: data01
mountPath: /usr/share/nginx/html
– name: data02
mountPath: /ysl-container
– name: data03
mountPath: /etc/localtime
root@master231:/manifests/volumes# kubectl apply -f 03-deploy-hostPath.yaml
​
2.4 worker233节点准备测试数据
root@worker233:~# echo ceshi > /ysl/index.html
​
2.5 进入属于worker233节点的pod查看和worker232节点的pod作对比
root@master231:/manifests/volumes# kubectl get pods -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
deploy-xiuxian-hostpath-74db47bd86-kdqld 1/1 Running 0 11m 10.100.2.101 worker233
deploy-xiuxian-hostpath-74db47bd86-nh7hb 1/1 Running 0 11m 10.100.1.38 worker232
deploy-xiuxian-hostpath-74db47bd86-njvnm 1/1 Running 0 11m 10.100.2.102 worker233
root@master231:/manifests/volumes# kubectl exec -it deploy-xiuxian-hostpath-74db47bd86-kdqld — sh
/ # ls -l /ysl-container/index.html
-rw-r–r– 1 root root 6 Apr 10 21:47 /ysl-container/index.html
/ # cat /ysl-container/index.html
ceshi
/ # exit
root@master231:/manifests/volumes# kubectl exec -it deploy-xiuxian-hostpath-74db47bd86-nh7hb — sh
/ # ls -l /ysl-container/
total 0
/ #
​
2.6 总结
hostPath不能跨节点的pod数据共享，nfs就可以解决
​
​
3 nfs
3.1 概述
nfs表示网络文件系统，存在客户端和服务端，需要单独部署服务端
k8s在使用nfs时，集群应该安装nfs的相关模块（每个节点均需安装）
​
nfs的应用场景
1 实现跨节点不同pod的数据共享
2 实现跨节点存储数据

3.2 部署nfs服务器
所有节点安装nfs程序
apt -y install nfs-kernel-server
​
3.3 服务端配置nfs
root@master231:/manifests/volumes# mkdir -pv /software/data/nfs-server
root@master231:/manifests/volumes# tail -1 /etc/exports
/software/data/nfs-server *(rw,no_root_squash)
root@master231:/manifests/volumes#
root@master231:/manifests/volumes# systemctl restart nfs-server.service
root@master231:/manifests/volumes# exportfs
/software/data/nfs-server

3.4 应用部署
root@master231:/manifests/volumes# cat 04-deploy-nfs.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-xiuxian-nfs
spec:
replicas: 3
selector:
matchLabels:
apps: xiuxian
template:
metadata:
labels:
apps: xiuxian
spec:
volumes:
– emptyDir: {}
name: data01
– name: data02
hostPath:
path: /etc/localtime
– name: data03
# 表示存储卷的类型是nfs
nfs:
# 指定nfs的服务器
server: 10.0.0.231
# 指定nfs共享的数据路径
path: /software/data/nfs-server
containers:
– name: c1
image: crpi-kxgdi0lp5jdep1gc.cn-chengdu.personal.cr.aliyuncs.com/yangsenlin/apps:v1
ports:
– containerPort: 80
volumeMounts:
– name: data01
mountPath: /usr/share/nginx/html
– name: data02
mountPath: /etc/localtime
– name: data03
mountPath: /nfsdata

root@master231:/manifests/volumes# kubectl apply -f 04-deploy-nfs.yaml
deployment.apps/deploy-xiuxian-nfs created
​
root@master231:/manifests/volumes# kubectl get pods -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
deploy-xiuxian-nfs-66c674bccb-7dh2w 1/1 Running 0 29s 10.100.2.104 worker233
deploy-xiuxian-nfs-66c674bccb-7sjst 1/1 Running 0 29s 10.100.1.39 worker232
deploy-xiuxian-nfs-66c674bccb-g6d72 1/1 Running 0 29s 10.100.2.103 worker233
​
root@master231:/manifests/volumes# kubectl exec -it deploy-xiuxian-nfs-66c674bccb-7dh2w — sh/ # echo www.yangsenlin.top > /nfsdata/index.html
/ # exit
root@master231:/manifests/volumes# kubectl exec -it deploy-xiuxian-nfs-66c674bccb-7sjst — sh/ # cat /nfsdata/index.html
www.yangsenlin.top
/ # exit
root@master231:/manifests/volumes# kubectl exec -it deploy-xiuxian-nfs-66c674bccb-g6d72 — sh
/ # cat /nfsdata/index.html
www.yangsenlin.top
/ # exit
root@master231:/manifests/volumes# cat /software/data/nfs-server/index.html
www.yangsenlin.top
root@master231:/manifests/volumes#
​
​
4 存储卷综合案例测试
root@master231:/manifests/volumes# cat 05-deploy-multiple.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-xiuxian-multiple
spec:
replicas: 3
selector:
matchLabels:
apps: xiuxian
template:
metadata:
labels:
apps: xiuxian
spec:
initContainers:
– name: init01
image: crpi-kxgdi0lp5jdep1gc.cn-chengdu.personal.cr.aliyuncs.com/yangsenlin/apps:v1
command:
– cp
args:
– /haha/index.html
– /xixi/
volumeMounts:
– name: data01
mountPath: /xixi
– name: data03
mountPath: /haha
volumes:
– emptyDir: {}
name: data01
– name: data02
hostPath:
path: /etc/localtime
– name: data03
nfs:
server: 10.0.0.231
path: /software/data/nfs-server
containers:
– name: c1
image: crpi-kxgdi0lp5jdep1gc.cn-chengdu.personal.cr.aliyuncs.com/yangsenlin/apps:v1
ports:
– containerPort: 80
volumeMounts:
– name: data01
mountPath: /usr/share/nginx/html
– name: data02
mountPath: /etc/localtime
– name: data03
mountPath: /nfsdata
root@master231:/manifests/volumes#
​
​
4 configMap
​
4.1 什么是configMap
configMap的本质就是将配置信息基于键值对的方式进行映射的一种手段，数据存储在etcd
configMap将你的环境配置信息和容器镜像解耦，便于应用配置的修改
​
4.2 声明式API创建cm资源
root@master231:/manifests/volumes# kubectl explain configMap.data
root@master231:~/manifests/configmaps# cat 01-cm.demo
apiVersion: v1
kind: ConfigMap
metadata:
name: game-demo
# 定义配置信息
data:
# 类属性键；每一个键都映射到一个简单的值
player_initial_lives: “3”
ui_properties_file_name: “user-interface.properties”
# 自定义键值对
xingming: zhangsan
city: Sichuan
​
# 类文件键
game.properties: |
enemy.types=aliens,monsters
player.maximum-lives=5
user-interface.properties: |
color.good=purple
color.bad=yellow
allow.textmode=true
# 定义MySQL的配置信息
my.cnf: |
datadir=/data/mysql80
basedir=/softwares/mysql80
port=3306
socket=/tmp/mysql80.sock
root@master231:~/manifests/configmaps#
​
root@master231:/manifests/volumes# kubectl apply -f 01-cm.demo
configmap/game-demo created
root@master231:/manifests/volumes# kubectl get cm
NAME DATA AGE
game-demo 7 8s
kube-root-ca.crt 1 7d14h
root@master231:/manifests/volumes# kubectl get -f 01-cm.demo
NAME DATA AGE
game-demo 7 24s
root@master231:/manifests/volumes# kubectl get cm game-demo
NAME DATA AGE
game-demo 7 38s
​
4.3 响应式创建cm
root@master231:~/manifests/configmaps# kubectl create configmap test-xy –from-file=myhosts=/etc/hosts –from-literal=username=admin –from-literal=password=admin123 –from-literal=myos=/etc/os-release
​
root@master231:~/manifests/configmaps# kubectl get cm
NAME DATA AGE
game-demo 7 24h
kube-root-ca.crt 1 8d
test-xy 4 44s
root@master231:~/manifests/configmaps# kubectl get cm test-xy
NAME DATA AGE
test-xy 4 54s
root@master231:~/manifests/configmaps# kubectl describe cm test-xy
​
root@master231:~/manifests/configmaps# kubectl get cm test-xy -o yaml
​
4.4 基于环境变量引用cm资源
root@master231:~/manifests/volumes# cat 07-deploy-cm-env.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-cm-env
spec:
replicas: 3
selector:
matchLabels:
apps: xiuxian
template:
metadata:
labels:
apps: xiuxian
spec:
containers:
– name: c1
image: crpi-kxgdi0lp5jdep1gc.cn-chengdu.personal.cr.aliyuncs.com/yangsenlin/apps:v1
env:
– name: test-xingming
# 值从哪里引用
valueFrom:
# 表示值从一个cm类型引用
configMapKeyRef:
# 指定引用cm资源的名称
name: game-demo
# 引用cm的某个key
key: xingming
– name: test-mysql
valueFrom:
configMapKeyRef:
name: game-demo
key: my.cnf

root@master231:~/manifests/volumes# kubectl apply -f 07-deploy-cm-env.yaml
root@master231:~/manifests/volumes# kubectl exec -it deploy-cm-env-6987ccb879-ddlbk — env|grep test
test-xingming=zhangsan
test-mysql=datadir=/data/mysql80
​
4.5 pod基于存储卷引用cm资源
root@master231:~/manifests/volumes# cat 08-deploy-cm-volume.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-cm-volume
spec:
replicas: 3
selector:
matchLabels:
apps: xiuxian
template:
metadata:
labels:
apps: xiuxian
spec:
volumes:
– name: data
# 表示存储卷的类型是cm
configMap:
# 指定cm的名称
name: game-demo
# 引用cm的具体key，若不定义，则会将cm的所有key全部引用，将每个key作为文件名称。
# 如果定义，可以引用具体的字段名称，且指定文件名称。
items:
# 引用cm资源具体的KEY
– key: game.properties
# 指定将来挂载时的文件名称
path: test-game.properties
– key: my.cnf
path: ysl-my.cnf
containers:
– name: c1
image: crpi-kxgdi0lp5jdep1gc.cn-chengdu.personal.cr.aliyuncs.com/yangsenlin/apps:v1
volumeMounts:
– name: data
mountPath: /ysl
​
root@master231:~/manifests/volumes# kubectl apply -f 08-deploy-cm-volume.yaml
​
root@master231:~/manifests/volumes# kubectl exec -it deploy-cm-volume-b645c76cc-h9pfm — ls -l /ysl
total 0
lrwxrwxrwx 1 root root 27 Apr 13 03:01 test-game.properties -> ..data/test-game.properties
lrwxrwxrwx 1 root root 17 Apr 13 03:01 ysl-my.cnf -> ..data/ysl-my.cnf
​
4.6 cm资源映射nginx配置文件subPath
​
root@master231:~/manifests/volumes# cat 09-deploy-cm-nginx-subPath.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: nginx-subfile
data:
nginx.conf: |
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log notice;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main ‘$remote_addr – $remote_user [$time_local] “$request” ‘
‘$status $body_bytes_sent “$http_referer” ‘
‘”$http_user_agent” “$http_x_forwarded_for”‘;
access_log /var/log/nginx/access.log main;
sendfile on;
keepalive_timeout 65;
include /etc/nginx/conf.d/*.conf;
}
​
​
default.conf: |
server {
listen 81;
listen [::]:81;
server_name localhost;

location / {
root /usr/share/nginx/html;
index index.html index.htm;
}

error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/share/nginx/html;
}

}
​
​
—
​
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-cm-nginx-subpath
spec:
replicas: 3
selector:
matchLabels:
apps: xiuxian
template:
metadata:
labels:
apps: xiuxian
spec:
volumes:
– name: data01
configMap:
name: nginx-subfile
items:
– key: default.conf
path: default.conf
– name: data02
configMap:
name: nginx-subfile
items:
– key: nginx.conf
path: nginx.conf
– name: data03
hostPath:
path: /etc/localtime
containers:
– name: c1
image: crpi-kxgdi0lp5jdep1gc.cn-chengdu.personal.cr.aliyuncs.com/yangsenlin/apps:v1
#command: [“tail”,”-f”,”/etc/hosts”]
volumeMounts:
– name: data01
mountPath: /etc/nginx/conf.d/
– name: data02
mountPath: /etc/nginx/nginx.conf
# 当subPath的值和存储卷的path相同时，mountPath挂载点将是一个文件，而非目录。
subPath: nginx.conf
– name: data03
mountPath: /etc/localtime
root@master231:~/manifests/volumes# kubectl apply -f 09-deploy-cm-nginx-subPath.yaml
configmap/nginx-subfile created
deployment.apps/deploy-cm-nginx-subpath created
root@master231:~/manifests/volumes#
​
​
root@master231:~/manifests/volumes# kubectl exec -it deploy-cm-nginx-subpath-6f7cc6446b-66jvf — ls -l /etc/nginx;date -R
total 32
drwxrwxrwx 3 root root 4096 Apr 13 11:09 conf.d
-rw-r–r– 1 root root 1077 May 25 2021 fastcgi.conf
-rw-r–r– 1 root root 1007 May 25 2021 fastcgi_params
-rw-r–r– 1 root root 5231 May 25 2021 mime.types
lrwxrwxrwx 1 root root 22 Nov 13 2021 modules -> /usr/lib/nginx/modules
-rw-r–r– 1 root root 597 Apr 13 11:09 nginx.conf
-rw-r–r– 1 root root 636 May 25 2021 scgi_params
-rw-r–r– 1 root root 664 May 25 2021 uwsgi_params
Sun, 13 Apr 2023 11:10:49 +0800
​
5 secrets
5.1 概述
和cm作用类似，但secrets是k8s用于存储敏感数据(密码、令牌或密钥的对象)的资源
会将数据以base64进行编码，将敏感数据单独存储这样让数据泄露的风险会减小。
官网链接:
https://kubernetes.io/zh-cn/docs/concepts/configuration/secret/
https://kubernetes.io/zh-cn/docs/concepts/configuration/secret/#secret-types
​
5.2 声明式创建创建secret的两种方式
5.2.1 基于stringData
root@master231:~/manifests/secrets# kubectl apply -f 01-secrets-demo.yaml
secret/test-mysql-conn created
root@master231:~/manifests/secrets# kubectl get -f 01-secrets-demo.yaml
NAME TYPE DATA AGE
test-mysql-conn Opaque 3 11s
root@master231:~/manifests/secrets# kubectl describe -f 01-secrets-demo.yaml
Name: test-mysql-conn
Namespace: default
Labels:
Annotations:
​
Type: Opaque
​
Data
====
my.cnf: 92 bytes
password: 3 bytes
username: 5 bytes
root@master231:~/manifests/secrets# cat 01-secrets-demo.yaml
apiVersion: v1
kind: Secret
metadata:
name: test-mysql-conn
# 创建secret时会自动将value的值自动编码
stringData:
username: admin
password: ysl
my.cnf: |
datadir=/ysl/data/mysql80
basedir=/ysl/softwares/mysql80
port=3306
socket=/tmp/mysql80.sock
root@master231:~/manifests/secrets# kubectl get secrets test-mysql-conn -o yaml
apiVersion: v1
data:
my.cnf: ZGF0YWRpcj0veXNsL2RhdGEvbXlzcWw4MApiYXNlZGlyPS95c2wvc29mdHdhcmVzL215c3FsODAKcG9ydD0zMzA2CnNvY2tldD0vdG1wL215c3FsODAuc29jawo=
password: eXNs
username: YWRtaW4=
kind: Secret
metadata:
annotations:
kubectl.kubernetes.io/last-applied-configuration: |
{“apiVersion”:”v1″,”kind”:”Secret”,”metadata”:{“annotations”:{},”name”:”test-mysql-conn”,”namespace”:”default”},”stringData”:{“my.cnf”:”datadir=/ysl/data/mysql80\nbasedir=/ysl/softwares/mysql80\nport=3306\nsocket=/tmp/mysql80.sock\n”,”password”:”ysl”,”username”:”admin”}}
creationTimestamp: “2025-04-13T03:18:26Z”
name: test-mysql-conn
namespace: default
resourceVersion: “476167”
uid: b1d5bdc1-31a9-4d41-adb5-6a660fccd588
type: Opaque
​
5.2.2 将编码的文件解码
base64解码
echo -n base64编码 | base64 -d
​
base64编码
echo 需要编码的文件 | base64
​
5.2.3 基于data（反推yaml）
root@master231:~/manifests/secrets# kubectl get secrets test-mysql-conn -o yaml > 02-secrets-Data-demo.yaml
root@master231:~/manifests/secrets# kubectl apply -f 02-secrets-Data-demo.yaml
​
5.3 响应式创建secret
root@master231:~/manifests/secrets# kubectl create secret generic test-secrets –from-file=myhost=/etc/hosts –from-file=myos=/etc/os-release –from-literal=xingming=ysl –from-literal=class=ysl
secret/test-secrets created
​
root@master231:~/manifests/secrets# kubectl get secrets test-secrets
NAME TYPE DATA AGE
test-secrets Opaque 4 28s
root@master231:~/manifests/secrets# kubectl describe secrets test-secrets
​
5.4 pod基于环境变量应用secret
root@master231:~/manifests/volumes# kubectl get pods
NAME READY STATUS RESTARTS AGE
deploy-secret-env-5dfb865b94-468t7 1/1 Running 0 3s
deploy-secret-env-5dfb865b94-mmztq 1/1 Running 0 3s
deploy-secret-env-5dfb865b94-vnpr2 1/1 Running 0 3s
root@master231:~/manifests/volumes# kubectl exec -it deploy-secret-env-5dfb865b94-468t7 — env | grep test
test-username=admin
test-password=ysl
test-class=datadir=/ysl/data/mysql80
root@master231:~/manifests/volumes# cat 10-deploy-secrets-env.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-secret-env
spec:
replicas: 3
selector:
matchLabels:
apps: xiuxian
template:
metadata:
labels:
apps: xiuxian
spec:
containers:
– name: c1
image: crpi-kxgdi0lp5jdep1gc.cn-chengdu.personal.cr.aliyuncs.com/yangsenlin/apps:v1
env:
– name: test-username
valueFrom:
# 表示值从一个secret类型引用
secretKeyRef:
# 指定引用secret资源的名称
name: test-mysql-conn
# 引用secret的某个key
key: username
– name: test-password
valueFrom:
secretKeyRef:
name: test-mysql-conn
key: password
– name: test-class
valueFrom:
secretKeyRef:
name: test-mysql-conn
key: my.cnf
root@master231:~/manifests/volumes#
​
5.5 基于存储卷应用secret
root@master231:~/manifests/volumes# cat 11-deploy-secrets-volume.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-secret-volume
spec:
replicas: 3
selector:
matchLabels:
apps: xiuxian
template:
metadata:
labels:
apps: xiuxian
spec:
volumes:
– name: data
# 表示存储卷的类型是secret
secret:
# 指定secret的名称
secretName: test-mysql-conn
items:
– key: username
path: username.txt
– key: password
path: pwd.txt
containers:
– name: c1
image: crpi-kxgdi0lp5jdep1gc.cn-chengdu.personal.cr.aliyuncs.com/yangsenlin/apps:v1
volumeMounts:
– name: data
mountPath: /ysl
root@master231:~/manifests/volumes# kubectl apply -f 11-deploy-secrets-volume.yaml
deployment.apps/deploy-secret-volume created
root@master231:~/manifests/volumes# kubectl get pods
NAME READY STATUS RESTARTS AGE
deploy-secret-volume-6d5f7df59-55fmg 1/1 Running 0 9s
deploy-secret-volume-6d5f7df59-7q4df 1/1 Running 0 9s
deploy-secret-volume-6d5f7df59-lkmcz 1/1 Running 0 9s
root@master231:~/manifests/volumes# kubectl exec -it deploy-secret-volume-6d5f7df59-55fmg —
cat /ysl/username.txt;cat /ysl/pwd.txt
​
root@master231:~/manifests/volumes# kubectl exec -it deploy-secret-volume-6d5f7df59-55fmg — sh
/ # ls /ysl
pwd.txt username.txt
/ # cat /ysl/pwd.txt
/ # cat /ysl/pwd.txt -n
1 ysl
/ # exit
​
6 拉取harbor私有镜像
6.1 推送镜像到harbor
root@worker233:~# docker tag crpi-kxgdi0lp5jdep1gc.cn-chengdu.personal.cr.aliyuncs.com/yangsenlin/apps:nginx-1.24 harbor.ysl.com/ysl-xiuxian/apps:nginx-1.24
root@worker233:~# docker push harbor.ysl.com/ysl-xiuxian/apps:nginx-1.24
​
6.2 将harbor仓库设置为私有
在配置管理里面将“公开”勾选叉掉并保存
6.3 创建harbor的普通用户并授权项目
略
​
6.4 响应式创建secrets
root@master231:~/manifests/volumes# kubectl create secret docker-registry ysl-xiuxian –docker-username=ceshi –docker-password=XZnh@95599 –docker-email=ceshi@qq.com –docker-server=harbor.ysl.com
secret/ysl-xiuxian created
root@master231:~/manifests/volumes#
​
root@master231:~/manifests/volumes# kubectl get secret/ysl-xiuxian
NAME TYPE DATA AGE
ysl-xiuxian kubernetes.io/dockerconfigjson 1 48s
root@master231:~/manifests/volumes# kubectl describe secret/ysl-xiuxian
​
root@master231:~/manifests/volumes# kubectl get secret/ysl-xiuxian -o yaml
​
6.5 拉取镜像时指定secret
root@master231:~/manifests/volumes# cat 12-deploy-secrets-harbor.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-secret-harbor
spec:
replicas: 3
selector:
matchLabels:
apps: xiuxian
template:
metadata:
labels:
apps: xiuxian
spec:
# 指定拉取私有仓库的镜像仓库的secret认证信息
imagePullSecrets:
– name: ysl-xiuxian
containers:
– name: c1
image: harbor.ysl.com/ysl-xiuxian/apps:v2
​
​
root@master231:~/manifests/volumes# kubectl get pods
NAME READY STATUS RESTARTS AGE
deploy-secret-harbor-57b7f55bb9-gdl7g 1/1 Running 0 5s
deploy-secret-harbor-57b7f55bb9-hkrhz 1/1 Running 0 5s
deploy-secret-harbor-57b7f55bb9-k4z7w 1/1 Running 0 5s
​
​
6.6 容器拉取镜像策略
Always
1 如果本地没有镜像，则会去远程仓库拉取镜像
2 如果本地有镜像，则会对比本地的镜像摘要信息和远程仓库的摘要信息对比，相同则不拉取，不同则拉取

Never
1 不管本地有没有镜像，都不会拉取
​
IfNotPresent
1 本地没有镜像，则会去远程仓库拉取镜像
2 如果本地没有镜像，则尝试启动容器
​
温馨提示:
Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.

如果镜像标签的tag为”:latest”时，默认的镜像策略为”Always”，否则默认镜像拉取策略为”IfNotPresent”。

7 servieaccounts
7.1 概述
serviceaccounts简称sa，表示服务账号，其作用就是用于身份验证。
创建一个sa是会自动关联一个secrets资源
为pod内的服务提供服务账号，可以基于该账号进行认证操作
​
7.2 响应式创建sa
root@master231:~/manifests/volumes# kubectl create serviceaccount ysl
serviceaccount/ysl created
​
root@master231:~/manifests/volumes# kubectl get sa
NAME SECRETS AGE
default 1 8d
ysl 1 50s
root@master231:~/manifests/volumes# kubectl get sa ysl -o yaml
…
secrets:
– name: ysl-token-wl69r
​
root@master231:~/manifests/volumes# kubectl get secrets ysl-token-wl69r
NAME TYPE DATA AGE
ysl-token-wl69r kubernetes.io/service-account-token 3 2m2s
root@master231:~/manifests/volumes#
​
7.3 声明式创建服务账号
root@master231:~/manifests/serviceaccounts# kubectl delete -f 01-sa.yaml
serviceaccount “ysl” deleted
root@master231:~/manifests/serviceaccounts# kubectl apply -f 01-sa.yaml
serviceaccount/ysl created
root@master231:~/manifests/serviceaccounts# kubectl get -f 01-sa.yaml
NAME SECRETS AGE
ysl 2 7s
root@master231:~/manifests/serviceaccounts#
​
7.4 基于sa引用secret实现镜像拉取
root@master231:~/manifests/volumes# cat 13-deploy-imagePullPolicy-serviceAccountName.yaml
apiVersion: v1
kind: Secret
metadata:
name: harbor-ysl
type: kubernetes.io/dockerconfigjson
stringData:
# 解码:
# echo bGludXg5NTpMaW51eDk1QDIwMjU= | base64 -d
# 编码:
# echo -n ysl:ysl@2025 | base64
.dockerconfigjson: ‘{“auths”:{“harbor.ysl.com”:{“username”:”ceshi”,”password”:”XZnh@95599″,”email”:”ceshi@qq.com”,”auth”:”Y2VzaGkK”}}}’
​
—
​
apiVersion: v1
kind: ServiceAccount
metadata:
name: ysl
imagePullSecrets:
– name: harbor-ysl
​
—
​
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-secret-harbor
spec:
replicas: 3
selector:
matchLabels:
apps: xiuxian
template:
metadata:
labels:
apps: xiuxian
spec:
#imagePullSecrets:
#- name: harbor-ysl
# 也可以不适用”imagePullSecrets”，而是基于sa进行认证
serviceAccountName: ysl
containers:
– name: c1
image: harbor.ysl.com/test-xiuxian/test:v2
# imagePullPolicy: Never
# imagePullPolicy: IfNotPresent
imagePullPolicy: Always
root@master231:~/manifests/volumes# kubectl apply -f 13-deploy-imagePullPolicy-serviceAccountName.yaml
[root@master231 volumes]# kubectl get pods -o wide
​
​
8 valueFrom之fieldRef及resourceFieldRef
fieldRef有效值:
– metadata.name
– metadata.namespace,
– `metadata.labels[‘‘]`
– `metadata.annotations[‘‘]`
– spec.nodeName
– spec.serviceAccountName
– status.hostIP
– status.podIP
– status.podIPs

resourceFieldRef有效值:
– limits.cpu
– limits.memory
– limits.ephemeral-storage
– requests.cpu
– requests.memory
– requests.ephemeral-storage
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-valuefrom
spec:
replicas: 3
selector:
matchLabels:
apps: xiuxian
template:
metadata:
labels:
apps: xiuxian
spec:
containers:
– name: c1
image: harbor.ysl.com/ysl-xiuxian/apps:v2
resources:
requests:
cpu: 0.2
memory: 200Mi
limits:
cpu: 0.5
memory: 500Mi
imagePullPolicy: Always
env:
– name: test-PODNAME
valueFrom:
fieldRef:
fieldPath: metadata.name
– name: test-IP
valueFrom:
fieldRef:
fieldPath: status.podIP
– name: test-REQUESTS
valueFrom:
resourceFieldRef:
resource: requests.cpu
– name: test-LIMITS
valueFrom:
resourceFieldRef:
resource: limits.memory
[root@master231 volumes]# kubectl apply -f 14-deploy-valueFrom.yaml
deployment.apps/deploy-valuefrom created
[root@master231 volumes]#
[root@master231 volumes]# kubectl get pods -o wide
[root@master231 volumes]# kubectl exec deploy-valuefrom-7f48549b-5v4rn — env
…
test-LIMITS=524288000
test-PODNAME=deploy-valuefrom-7f48549b-5v4rn
test-IP=10.100.2.182
# 很明显，对于requests字段并没有抓到0.2，而是”向上取整”。
test-REQUESTS=1
…
​
​
9 downloadAPI
9.1 概述
与ConfigMap和Secret不同，DownwardAPI自身并非一种独立的API资源类型。
​
DownwardAPI只是一种将Pod的metadata、spec或status中的字段值注入到其内部Container里的方式。
​
DownwardAPI提供了两种方式用于将POD的信息注入到容器内部
– 环境变量：
用于单个变量，可以将POD信息和容器信息直接注入容器内部.
– Volume挂载：
将 POD 信息生成为文件，直接挂载到容器内部中去

9.2 应用部署测试
root@master231:~/manifests/volumes# kubectl apply -f 15-deploy-download-API.yaml
deployment.apps/downloadapi-demo created
root@master231:~/manifests/volumes# kubectl get pods
NAME READY STATUS RESTARTS AGE
downloadapi-demo-684844f646-pdx9l 2/2 Running 0 4s
root@master231:~/manifests/volumes# cat 15-deploy-download-API.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: downloadapi-demo
spec:
replicas: 1
selector:
matchLabels:
apps: v1
template:
metadata:
labels:
apps: v1
spec:
volumes:
– name: data01
downwardAPI:
items:
– path: pod-name
# 仅支持: annotations, labels, name and namespace。
fieldRef:
fieldPath: “metadata.name”
– name: data02
downwardAPI:
items:
– path: pod-ns
fieldRef:
fieldPath: “metadata.namespace”
– name: data03
downwardAPI:
items:
– path: containers-limists-memory
# 仅支持: limits.cpu, limits.memory, requests.cpu and requests.memory
resourceFieldRef:
containerName: c1
resource: “limits.memory”
containers:
– name: c1
image: registry.cn-hangzhou.aliyuncs.com/yangsenlin-k8s/apps:v1
resources:
requests:
cpu: 0.2
memory: 300Mi
limits:
cpu: 0.5
memory: 500Mi
volumeMounts:
– name: data01
mountPath: /xixi
– name: data02
mountPath: /haha
– name: data03
mountPath: /hehe
– name: c2
image: registry.cn-hangzhou.aliyuncs.com/yangsenlin-k8s/apps:v2
command:
– tail
args:
– -f
– /etc/hosts
resources:
limits:
cpu: 1.5
memory: 1.5Gi
root@master231:~/manifests/volumes#
​
root@master231:~/manifests/volumes# kubectl exec -it downloadapi-demo-684844f646-pdx9l -c c1 — sh
/ # ls /xixi/
pod-name
/ # ls /h
haha/ hehe/ home/
/ # ls /hehe/
containers-limists-memory
/ # ls /haha
pod-ns
/ #
​
10 projected
10.1 概述
Projected Volume是一种特殊的卷类型，它能够将已存在的多个卷投射进同一个挂载点目录中。
​
Projected Volume仅支持对如下四种类型的卷（数据源）进行投射操作，这类的卷一般都是用于为容器提供预先定义好的数据:
– Secret：
投射Secret 对象。
– ConfigMap：
投射ConfigMap对象。
– DownwardAPI：
投射Pod元数据。
– ServiceAccountToken：
投射ServiceAccount Token。

10.2 部署应用测试
root@master231:~/manifests/volumes# cat 16-deploy-projested-volumes.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: ysl-cm
data:
blog: “https://www.cnblogs.com/yangsenlin”
k8s: “https://space.bilibili.com/600805398/channel/series”
​
—
​
apiVersion: v1
kind: Secret
metadata:
name: ysl-secrets
stringData:
username: admin
password: yangsenlin
​
—
apiVersion: apps/v1
kind: Deployment
metadata:
name: projected-demo
spec:
replicas: 1
selector:
matchLabels:
apps: v1
template:
metadata:
labels:
apps: v1
spec:
volumes:
– name: data01
projected:
sources:
– downwardAPI:
items:
– path: containers-limists-memory
resourceFieldRef:
containerName: c1
resource: “limits.memory”
– configMap:
name: ysl-cm
– secret:
name: ysl-secrets
– serviceAccountToken:
path: ysl-token
containers:
– name: c1
image: harbor.ysl.com/ysl-xiuxian/apps:v1
resources:
limits:
cpu: 0.5
memory: 500Mi
volumeMounts:
– name: data01
mountPath: /ysl-xixi
root@master231:~/manifests/volumes# kubectl apply -f 16-deploy-projested-volumes.yaml
configmap/ysl-cm unchanged
secret/ysl-secrets configured
deployment.apps/projected-demo created
root@master231:~/manifests/volumes# kubectl get pods
NAME READY STATUS RESTARTS AGE
projected-demo-d5544c7d7-kpbxb 1/1 Running 0 3s
root@master231:~/manifests/volumes# kubectl exec -it projected-demo-d5544c7d7-kpbxb — sh
/ # ls /ysl-xixi
blog k8s username
containers-limists-memory password ysl-token
/ #
​
11 pv sc pvc
11.1 概述
– pv
pv用于和后端存储对接的资源，关联后端存储。
​
– sc
sc可以动态创建pv的资源，关联后端存储。

– pvc
可以向pv或者sc进行资源请求，获取特定的存储。

pod只需要在存储卷声明使用哪个pvc即可。

11.2 手动创建pv和pvc及pod引用
1 手动创建pv
root@master231:~/manifests/volumes# mkdir -pv /ysl/data/nfs-server/pv/linux/pv00{1,2,3}
​
root@master231:~/manifests/persistentvolumes# cat manual-pv.yaml
apiVersion: v1
kind: PersistentVolume
metadata:
name: test-linux-pv01
labels:
xingming: zhangsan
spec:
# 声明PV的访问模式，常用的有”ReadWriteOnce”,”ReadOnlyMany”和”ReadWriteMany”:
# ReadWriteOnce:(简称:”RWO”)
# 只允许单个worker节点读写存储卷，但是该节点的多个Pod是可以同时访问该存储卷的。
# ReadOnlyMany:(简称:”ROX”)
# 允许多个worker节点进行只读存储卷。
# ReadWriteMany:(简称:”RWX”)
# 允许多个worker节点进行读写存储卷。
# ReadWriteOncePod:(简称:”RWOP”)
# 该卷可以通过单个Pod以读写方式装入。
# 如果您想确保整个集群中只有一个pod可以读取或写入PVC，请使用ReadWriteOncePod访问模式。
# 这仅适用于CSI卷和Kubernetes版本1.22+。
accessModes:
– ReadWriteMany
# 声明存储卷的类型为nfs
nfs:
path: /ysl/data/nfs-server/pv/linux/pv001
server: 10.0.0.231
# 指定存储卷的回收策略，常用的有”Retain”和”Delete”
# Retain:
# “保留回收”策略允许手动回收资源。
# 删除PersistentVolumeClaim时，PersistentVolume仍然存在，并且该卷被视为”已释放”。
# 在管理员手动回收资源之前，使用该策略其他Pod将无法直接使用。
# Delete:
# 对于支持删除回收策略的卷插件，k8s将删除pv及其对应的数据卷数据。
# Recycle:
# 对于”回收利用”策略官方已弃用。相反，推荐的方法是使用动态资源调配。
# 如果基础卷插件支持，回收回收策略将对卷执行基本清理（rm -rf /thevolume/*），并使其再次可用于新的声明。
persistentVolumeReclaimPolicy: Retain
# 声明存储的容量
capacity:
storage: 2Gi
​
—
​
apiVersion: v1
kind: PersistentVolume
metadata:
name: test-linux-pv02
labels:
xingming: zhangsan
spec:
accessModes:
– ReadWriteMany
nfs:
path: /ysl/data/nfs-server/pv/linux/pv002
server: 10.0.0.231
persistentVolumeReclaimPolicy: Retain
capacity:
storage: 5Gi
​
—
​
apiVersion: v1
kind: PersistentVolume
metadata:
name: test-linux-pv03
labels:
xingming: zhangsan
spec:
accessModes:
– ReadWriteMany
nfs:
path: /ysl/data/nfs-server/pv/linux/pv003
server: 10.0.0.231
persistentVolumeReclaimPolicy: Retain
capacity:
storage: 10Gi
root@master231:~/manifests/persistentvolumes# kubectl apply -f manual-pv.yaml
persistentvolume/test-linux-pv01 created
persistentvolume/test-linux-pv02 created
persistentvolume/test-linux-pv03 created
root@master231:~/manifests/persistentvolumes# kubectl get pv
NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS REASON AGE
test-linux-pv01 2Gi RWX Retain Available 4s
test-linux-pv02 5Gi RWX Retain Available 4s
test-linux-pv03 10Gi RWX Retain Available 4s
root@master231:~/manifests/persistentvolumes#
​
​
相关资源说明:
NAME :
pv的名称
CAPACITY :
pv的容量
ACCESS MODES:
pv的访问模式
RECLAIM POLICY:
pv的回收策略。
STATUS :
pv的状态。
CLAIM:
pv被哪个pvc使用。
STORAGECLASS
sc的名称。
REASON
pv出错时的原因。
AGE
创建的时间。

2 手动创建pvc
root@master231:~/manifests/persistentvolumes# kubectl get pvc,pv
NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS AGE
persistentvolumeclaim/test-linux-pvc Bound test-linux-pv02 5Gi RWX 7s
​
NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS REASON AGE
persistentvolume/test-linux-pv01 2Gi RWX Retain Available 2m34s
persistentvolume/test-linux-pv02 5Gi RWX Retain Bound default/test-linux-pvc 2m34s
persistentvolume/test-linux-pv03 10Gi RWX Retain Available 2m34s
root@master231:~/manifests/persistentvolumes#
root@master231:/manifests/volumes# cat 17-deploy-pvc.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-pvc-demo
spec:
replicas: 1
selector:
matchLabels:
apps: v1
template:
metadata:
labels:
apps: v1
spec:
volumes:
– name: data
# 声明存储卷的类型是pvc
persistentVolumeClaim:
# 声明pvc的名称
claimName: test-linux-pvc
– name: dt
hostPath:
path: /etc/localtime
initContainers:
– name: init01
image: crpi-kxgdi0lp5jdep1gc.cn-chengdu.personal.cr.aliyuncs.com/yangsenlin/apps:v1
volumeMounts:
– name: data
mountPath: /ysl
– name: dt
mountPath: /etc/localtime
command:
– /bin/sh
– -c
– date -R >> /ysl/index.html ; echo www.ysl.com >> /ysl/index.html
containers:
– name: c1
image: crpi-kxgdi0lp5jdep1gc.cn-chengdu.personal.cr.aliyuncs.com/yangsenlin/apps:v1
volumeMounts:
– name: data
mountPath: /usr/share/nginx/html
– name: dt
mountPath: /etc/localtime
root@master231:/manifests/volumes# kubectl apply -f 17-deploy-pvc.yaml
deployment.apps/deploy-pvc-demo created
root@master231:/manifests/volumes#
​
​
​
​
​
​
4.验证Pod后端的存储数据
4.1 找到pvc的名称
[root@master231 volumes]# kubectl describe pod deploy-pvc-demo-688b57bdd-dlkzd
Name: deploy-pvc-demo-688b57bdd-dlkzd
Namespace: default
…
Volumes:
data:
Type: PersistentVolumeClaim (a reference to a PersistentVolumeClaim in the same namespace)
ClaimName: test-linux-pvc
…

4.2 基于pvc找到与之关联的pv
[root@master231 volumes]# kubectl get pvc test-linux-pvc
NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS AGE
test-linux-pvc Bound test-linux-pv02 5Gi RWX 12m
[root@master231 volumes]#
[root@master231 volumes]# kubectl get pv test-linux-pv02
NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS REASON AGE
test-linux-pv02 5Gi RWX Retain Bound default/test-linux-pvc 15m
[root@master231 volumes]#
​
​
4.3 查看pv的详细信息
[root@master231 volumes]# kubectl describe pv test-linux-pv02
Name: test-linux-pv02
Labels: school=ysl
…
Source:
Type: NFS (an NFS mount that lasts the lifetime of a pod)
Server: 10.0.0.231
Path: /ysl/data/nfs-server/pv/linux/pv002
ReadOnly: false
…
​
​
4.4 验证数据的内容
[root@master231 volumes]# ll /ysl/data/nfs-server/pv/linux/pv002
total 12
drwxr-xr-x 2 root root 4096 Feb 14 16:46 ./
drwxr-xr-x 5 root root 4096 Feb 14 16:36 ../
-rw-r–r– 1 root root 68 Feb 14 16:49 index.html
[root@master231 volumes]#
[root@master231 volumes]# cat /ysl/data/nfs-server/pv/linux/pv002/index.html
Fri, 14 Feb 2025 16:49:42 +0800
www.ysl.com
[root@master231 volumes]#
​
​
12 基于nfs4.9.0版本实现动态存储类应用部署
推荐阅读:
https://github.com/kubernetes-csi/csi-driver-nfs/blob/master/docs/install-csi-driver-v4.9.0.md

https://kubernetes.io/docs/concepts/storage/storage-classes/#nfs
12.1 克隆代码
[root@master231 nfs]# git clone https://github.com/kubernetes-csi/csi-driver-nfs.git
​
​
12.2 安装动态存储类
root@master231:~/csi-driver-nfs-4.9.0# ./deploy/install-driver.sh v4.9.0 local
use local deploy
Installing NFS CSI driver, version: v4.9.0 …
serviceaccount/csi-nfs-controller-sa created
serviceaccount/csi-nfs-node-sa created
clusterrole.rbac.authorization.k8s.io/nfs-external-provisioner-role created
clusterrolebinding.rbac.authorization.k8s.io/nfs-csi-provisioner-binding created
csidriver.storage.k8s.io/nfs.csi.k8s.io created
deployment.apps/csi-nfs-controller created
daemonset.apps/csi-nfs-node created
NFS CSI driver installed successfully.
​
12.3 验证安装
root@master231:~/images# kubectl -n kube-system get pods -o wide | grep csi
csi-nfs-controller-5c5c695fb-qxxp2 4/4 Running 0 4m31s 10.0.0.232 worker232
csi-nfs-node-6k297 3/3 Running 0 37m 10.0.0.231 master231
csi-nfs-node-sxjwx 3/3 Running 0 37m 10.0.0.232 worker232
csi-nfs-node-tjm4p 3/3 Running 0 4m13s 10.0.0.233 worker233
root@master231:~/images#
​
4.创建存储类
root@master231:~/csi-driver-nfs-4.9.0# mkdir -p /ysl/data/nfs-server/sc
​
root@master231:~/csi-driver-nfs-4.9.0# cat deploy/v4.9.0/storageclass.yaml
—
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: nfs-csi
provisioner: nfs.csi.k8s.io
parameters:
server: 10.0.0.231
share: /ysl/data/nfs-server/sc
# csi.storage.k8s.io/provisioner-secret is only needed for providing mountOptions in DeleteVolume
# csi.storage.k8s.io/provisioner-secret-name: “mount-options”
# csi.storage.k8s.io/provisioner-secret-namespace: “default”
reclaimPolicy: Delete
volumeBindingMode: Immediate
mountOptions:
– nfsvers=4.1

root@master231:~/csi-driver-nfs-4.9.0# kubectl apply -f deploy/v4.9.0/storageclass.yaml
storageclass.storage.k8s.io/nfs-csi created
root@master231:~/csi-driver-nfs-4.9.0# kubectl get sc
NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE
nfs-csi nfs.csi.k8s.io Delete Immediate false 7s
root@master231:~/csi-driver-nfs-4.9.0#
​
​
5.删除pv和pvc保证环境”干净”
root@master231:/manifests/persistentvolumes# kubectl delete -f .
persistentvolume “ysl-linux-pv01” deleted
persistentvolume “ysl-linux-pv02” deleted
persistentvolume “ysl-linux-pv03” deleted
persistentvolumeclaim “ysl-linux-pvc” deleted
root@master231:/manifests/persistentvolumes# kubectl get pv,pvc,pods
No resources found
​
6.创建pvc测试
[root@master231 persistentvolumeclaims]# kubectl get sc
NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE
nfs-csi nfs.csi.k8s.io Delete Immediate false 9m15s
[root@master231 persistentvolumeclaims]#
[root@master231 persistentvolumeclaims]# cat pvc-sc.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: test-linux-pvc
spec:
storageClassName: nfs-csi
accessModes:
– ReadWriteMany
resources:
limits:
storage: 4Gi
requests:
storage: 3Gi
[root@master231 persistentvolumeclaims]#
[root@master231 persistentvolumeclaims]# kubectl apply -f pvc-sc.yaml
persistentvolumeclaim/test-linux-pvc created
[root@master231 persistentvolumeclaims]#
[root@master231 persistentvolumeclaims]# kubectl get pvc,pv
NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS AGE
persistentvolumeclaim/test-linux-pvc Bound pvc-f47d1e5b-a2f1-463f-b06c-7940add76104 3Gi RWX nfs-csi 14s
​
NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS REASON AGE
persistentvolume/pvc-f47d1e5b-a2f1-463f-b06c-7940add76104 3Gi RWX Delete Bound default/test-linux-pvc nfs-csi 14s
[root@master231 persistentvolumeclaims]#
​
​
7.pod引用pvc
[root@master231 volumes]# kubectl apply -f 17-deploy-pvc.yaml
deployment.apps/deploy-pvc-demo created
[root@master231 volumes]#
[root@master231 volumes]# kubectl get pods -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
deploy-pvc-demo-688b57bdd-td2z7 1/1 Running 0 4s 10.100.1.143 worker232
[root@master231 volumes]#
[root@master231 volumes]# kubectl get pods -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
deploy-pvc-demo-688b57bdd-td2z7 1/1 Running 0 4s 10.100.1.143 worker232
[root@master231 volumes]#
[root@master231 volumes]# curl 10.100.1.143
Fri, 14 Feb 2025 17:27:25 +0800
www.ysl.com
[root@master231 volumes]#
​
​
8.验证pod的后端存储数据
[root@master231 volumes]# kubectl describe pod deploy-pvc-demo-688b57bdd-td2z7 | grep ClaimName
ClaimName: test-linux-pvc
[root@master231 volumes]#
[root@master231 volumes]# kubectl get pvc test-linux-pvc
NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS AGE
test-linux-pvc Bound pvc-b425481e-3b15-4854-bf34-801a29edfcc5 3Gi RWX nfs-csi 2m29s
[root@master231 volumes]#
[root@master231 volumes]# kubectl describe pv pvc-b425481e-3b15-4854-bf34-801a29edfcc5 | grep Source -A 5
Source:
Type: CSI (a Container Storage Interface (CSI) volume source)
Driver: nfs.csi.k8s.io
FSType:
VolumeHandle: 10.0.0.231#ysl/data/nfs-server/sc#pvc-b425481e-3b15-4854-bf34-801a29edfcc5##
ReadOnly: false
[root@master231 volumes]#
[root@master231 volumes]# ll /ysl/data/nfs-server/sc/pvc-b425481e-3b15-4854-bf34-801a29edfcc5/
total 12
drwxr-xr-x 2 root root 4096 Feb 14 17:27 ./
drwxr-xr-x 3 root root 4096 Feb 14 17:26 ../
-rw-r–r– 1 root root 50 Feb 14 17:27 index.html
[root@master231 volumes]#
[root@master231 volumes]# cat /ysl/data/nfs-server/sc/pvc-b425481e-3b15-4854-bf34-801a29edfcc5/index.html
Fri, 14 Feb 2025 17:27:25 +0800
www.ysl.com
[root@master231 volumes]#
​
​
​

– K8S配置默认的存储类及多个存储类定义
1.响应式配置默认存储类
[root@master231 nfs]# kubectl get sc
NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE
nfs-csi nfs.csi.k8s.io Delete Immediate false 165m
[root@master231 nfs]#
[root@master231 nfs]# kubectl patch sc nfs-csi -p ‘{“metadata”: {“annotations”:{“storageclass.kubernetes.io/is-default-class”:”true”}}}’
storageclass.storage.k8s.io/nfs-csi patched
[root@master231 nfs]#
[root@master231 nfs]# kubectl get sc
NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE
nfs-csi (default) nfs.csi.k8s.io Delete Immediate false 166m
[root@master231 nfs]#
[root@master231 nfs]#
​
2.响应式取消默认存储类
[root@master231 nfs]# kubectl get sc
NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE
nfs-csi (default) nfs.csi.k8s.io Delete Immediate false 168m
[root@master231 nfs]#
[root@master231 nfs]# kubectl patch sc nfs-csi -p ‘{“metadata”: {“annotations”:{“storageclass.kubernetes.io/is-default-class”:”false”}}}’
storageclass.storage.k8s.io/nfs-csi patched
[root@master231 nfs]#
[root@master231 nfs]# kubectl get sc
NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE
nfs-csi nfs.csi.k8s.io Delete Immediate false 168m
[root@master231 nfs]#
​
​
3.声明式配置多个存储类
[root@master231 storageclasses]# cat sc.yaml
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: test-sc-xixi
annotations:
storageclass.kubernetes.io/is-default-class: “false”
provisioner: nfs.csi.k8s.io
parameters:
server: 10.0.0.231
share: /ysl/data/nfs-server/sc-xixi
reclaimPolicy: Delete
volumeBindingMode: Immediate
mountOptions:
– nfsvers=4.1
​
​
—
​
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: test-sc-haha
annotations:
storageclass.kubernetes.io/is-default-class: “true”
provisioner: nfs.csi.k8s.io
parameters:
server: 10.0.0.231
share: /ysl/data/nfs-server/sc-haha
reclaimPolicy: Delete
volumeBindingMode: Immediate
mountOptions:
– nfsvers=4.1
​
[root@master231 storageclasses]# kubectl get sc
NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE
nfs-csi nfs.csi.k8s.io Delete Immediate false 174m
[root@master231 storageclasses]#
[root@master231 storageclasses]# kubectl apply -f sc.yaml
storageclass.storage.k8s.io/test-sc-xixi created
storageclass.storage.k8s.io/test-sc-haha created
[root@master231 storageclasses]#
[root@master231 storageclasses]# kubectl get sc
NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE
nfs-csi nfs.csi.k8s.io Delete Immediate false 174m
test-sc-haha (default) nfs.csi.k8s.io Delete Immediate false 2s
test-sc-xixi nfs.csi.k8s.io Delete Immediate false 2s
[root@master231 storageclasses]#
​
​
4.准备目录
[root@master231 storageclasses]# mkdir -pv /ysl/data/nfs-server/sc-{xixi,haha}
​
​
5.测试验证
[root@master231 persistentvolumeclaims]# cat manual-pvc-4.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: pvc-sc
spec:
accessModes:
– ReadWriteMany
resources:
limits:
storage: 4Gi
requests:
storage: 3Gi
[root@master231 persistentvolumeclaims]#
[root@master231 persistentvolumeclaims]# kubectl apply -f manual-pvc-4.yaml
persistentvolumeclaim/pvc-linux94 created
[root@master231 persistentvolumeclaims]#
[root@master231 persistentvolumeclaims]# kubectl get pvc
NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS AGE
test-linux-pvc Bound pvc-f47d1e5b-a2f1-463f-b06c-7940add76104 3Gi RWX nfs-csi 173m
pvc-linux94 Bound pvc-af3b36cc-cf89-4476-895c-7eeef3946564 3Gi RWX test-sc-haha 24s
[root@master231 persistentvolumeclaims]#
​
6.pod引用pvc
[root@master231 deployments]# cat 17-deploy-pvc.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-xiuxian-pvc-default-sc
spec:
replicas: 1
selector:
matchLabels:
apps: xiuxian
template:
metadata:
labels:
apps: xiuxian
spec:
volumes:
– name: data
persistentVolumeClaim:
claimName: pvc-sc
containers:
– name: c1
image: crpi-kxgdi0lp5jdep1gc.cn-chengdu.personal.cr.aliyuncs.com/yangsenlin/apps:v1
volumeMounts:
– name: data
mountPath: /usr/share/nginx/html
[root@master231 deployments]#
[root@master231 deployments]# kubectl apply -f 17-deploy-pvc.yaml
deployment.apps/deploy-xiuxian-pvc-default-sc created
[root@master231 deployments]#
[root@master231 deployments]# kubectl get pods -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
deploy-xiuxian-pvc-default-sc-56c4948fb9-wjqtd 1/1 Running 0 3s 10.100.1.171 worker232
[root@master231 deployments]#
[root@master231 deployments]# kubectl exec -it deploy-xiuxian-pvc-default-sc-56c4948fb9-wjqtd — sh
/ # echo www.ysl.com > /usr/share/nginx/html/index.html
/ #
[root@master231 deployments]#
[root@master231 deployments]# curl 10.100.1.171
www.ysl.com
[root@master231 deployments]#
[root@master231 deployments]# kubectl describe pod deploy-xiuxian-pvc-default-sc-56c4948fb9-wjqtd | grep ClaimName
ClaimName: pvc-linux94
[root@master231 deployments]#
[root@master231 deployments]# kubectl get pvc pvc-linux94
NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS AGE
pvc-linux94 Bound pvc-af3b36cc-cf89-4476-895c-7eeef3946564 3Gi RWX test-sc-haha 3m
[root@master231 deployments]#
[root@master231 deployments]# kubectl describe pv pvc-af3b36cc-cf89-4476-895c-7eeef3946564 | grep Source -A 5
Source:
Type: CSI (a Container Storage Interface (CSI) volume source)
Driver: nfs.csi.k8s.io
FSType:
VolumeHandle: 10.0.0.231#ysl/data/nfs-server/sc-haha#pvc-af3b36cc-cf89-4476-895c-7eeef3946564##
ReadOnly: false
[root@master231 deployments]#
[root@master231 deployments]# ll /ysl/data/nfs-server/sc-haha/pvc-af3b36cc-cf89-4476-895c-7eeef3946564/
total 12
drwxr-xr-x 2 root root 4096 Nov 27 14:53 ./
drwxr-xr-x 3 root root 4096 Nov 27 14:50 ../
-rw-r–r– 1 root root 18 Nov 27 14:53 index.html
[root@master231 deployments]#
[root@master231 deployments]# more /ysl/data/nfs-server/sc-haha/pvc-af3b36cc-cf89-4476-895c-7eeef3946564/index.html
www.ysl.com
[root@master231 deployments]#
​
​
13 local sc
– 为什么要使用local卷
1.使用PV存储数据的痛点
– 1.基于网络存储的PV通常性能损耗较大，因为要涉及到跨节点传输数据，尤其是pod和pv持久卷不在同一个节点的情况下;
​
– 2.直接使用节点本地的SSD磁盘可获取较好的IO性能，更适用于存储类的服务，例如MongoDB、Ceph，MySQL，ElasticSearch等。
​
​
2.hostPath解决pv的问题
这个时候你可能会想到使用hostPath来解决上面提到的问题，但是我们不得不承认以下的问题:
– 1.hostPath卷在Pod被重建后可能被调试至其它节点而无法再次使用此前的数据的情况;
– 2.hostPath卷允许Pod访问节点上的任意路径，也存在一定程度的安全风险;
​
3.local卷解决hostPath存储卷的不足
local卷插件主要用于将本地存储设备（如磁盘、分区或目录）配置为卷。
​
local卷相比hostPath而言，带来了如下优势:
– 1.基于local卷，调度器能自行完成调度绑定；
说白了就是当第一次完成调度后，后续重新创建Pod时都会被调度到该节点，因为K8S调度器之前系统有记录。

– 2.local卷只能关联静态置备的PV，目前尚不支持动态置备;

– 3.local卷支持”延迟绑定”特性，延迟绑定机制，提供了基于消费者的需求来判定将PVC绑定至哪个PV的可能性
说白了，在Pod完成调度之前，还没有消费pvc时，此时的pvc一直处于Pending状态。
举个例子:
Pod有3个节点可以满足调度，但由于Pod没有完成调度前，pvc并不知道调度到那个pv，
因为pv是关联的是local卷，其必须和pod在同一个节点才行。
​
4.local卷案例
1 创建local动态存储类
root@master231:/manifests/volumes# cat 18-local-sc.yaml
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: ysl-local-sc
# “kubernetes.io/no-provisioner”表示不使用动态置备PV，因为local插件不支持
provisioner: kubernetes.io/no-provisioner
# “WaitForFirstConsumer”表示等待消费者（Pod）申请使用PVC时（即第一次被调度时）再进行PV绑定，即“延迟绑定”
# 延迟绑定机制，提供了基于消费者的需求来判定将PVC绑定至哪个PV的可能性
# 说白了，在Pod完成调度之前，还没有消费pvc时，此时的pvc一直处于Pending状态。
# 举个例子:
# Pod有3个节点可以满足调度，但由于Pod没有完成调度前，pvc并不知道调度到那个pv，
# 因为pv是本地卷。其必须和pod在同一个节点才行。
volumeBindingMode: WaitForFirstConsumer
​
2 查看动态存储类（这个存储类无法自动创建pv，因为此配置为”kubernetes.io/no-provisioner”）
root@master231:/manifests/volumes# kubectl apply -f 18-local-sc.yaml
storageclass.storage.k8s.io/ysl-local-sc created
root@master231:/manifests/volumes# kubectl get sc ysl-local-sc
NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE
ysl-local-sc kubernetes.io/no-provisioner Delete WaitForFirstConsumer false 8s
​
3 手动创建pv关联sc
root@master231:/manifests/volumes# kubectl apply -f 19-custom-pv.yaml
persistentvolume/yangsenlin-pv-worker232 created
persistentvolume/yangsenlin-pv-worker233 created
root@master231:/manifests/volumes# cat 19-custom-pv.yaml
apiVersion: v1
kind: PersistentVolume
metadata:
name: yangsenlin-pv-worker232
labels:
type: ssd
spec:
capacity:
storage: 10Gi
volumeMode: Filesystem
accessModes:
– ReadWriteOnce
persistentVolumeReclaimPolicy: Delete
# 指定pv关联的存储类
storageClassName: ysl-local-sc
# 表示卷插件类型是local
local:
# 指定本地的路径，这个路径最好是对应的是一块本地磁盘，此路径最好提前创建好，若路径不存在，将来调度成功后会报错:
# MountVolume.NewMounter initialization failed for volume “…” : path “…” does not exist
path: /yangsenlin/data/sc/local01
# 声明pv与节点的关联关系，与此同时，调度器将基于nodeAffinity将影响Pod调度。
nodeAffinity:
required:
nodeSelectorTerms:
– matchExpressions:
– key: kubernetes.io/hostname
operator: In
values:
– worker232
​
—
apiVersion: v1
kind: PersistentVolume
metadata:
name: yangsenlin-pv-worker233
labels:
type: hdd
spec:
capacity:
storage: 20Gi
volumeMode: Filesystem
accessModes:
– ReadWriteOnce
persistentVolumeReclaimPolicy: Delete
storageClassName: ysl-local-sc
local:
path: /yangsenlin/data/sc/local02
nodeAffinity:
required:
nodeSelectorTerms:
– matchExpressions:
– key: kubernetes.io/hostname
operator: In
values:
– worker233
root@master231:/manifests/volumes#
​
root@master231:/manifests/volumes# kubectl get pv -l type
NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS REASON AGE
yangsenlin-pv-worker232 10Gi RWO Delete Available ysl-local-sc 29s
yangsenlin-pv-worker233 20Gi RWO Delete Available ysl-local-sc 29s
​
​
4 worker节点创建对应目录
root@worker232:~/images# mkdir -pv /yangsenlin/data/sc/local01
mkdir: created directory ‘/yangsenlin’
mkdir: created directory ‘/yangsenlin/data’
mkdir: created directory ‘/yangsenlin/data/sc’
mkdir: created directory ‘/yangsenlin/data/sc/local01’
root@worker232:~/images#
​
root@worker233:~/images# mkdir -pv /yangsenlin/data/sc/local01
mkdir: created directory ‘/yangsenlin’
mkdir: created directory ‘/yangsenlin/data’
mkdir: created directory ‘/yangsenlin/data/sc’
mkdir: created directory ‘/yangsenlin/data/sc/local01’
​
5 创建pvc验证“延迟绑定”
root@master231:/manifests/local-sc# cat 03-custom-pvc.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: yangsenlin-pvc-local
spec:
accessModes:
– ReadWriteOnce
resources:
requests:
storage: 5Gi
# pvc无需关联pv，关联sc即可
storageClassName: ysl-local-sc
root@master231:/manifests/local-sc# kubectl apply -f 03-custom-pvc.yaml
persistentvolumeclaim/yangsenlin-pvc-local created
root@master231:/manifests/local-sc#
​
root@master231:/manifests/local-sc# kubectl get -f 03-custom-pvc.yaml
NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS AGE
yangsenlin-pvc-local Pending
​
6 创建pod并观察pvc状态
root@master231:/manifests/local-sc# cat 04-deploy-xiuxian.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: xiuxian
spec:
replicas: 3
selector:
matchLabels:
apps: v1
template:
metadata:
labels:
apps: v1
spec:
volumes:
– name: data
persistentVolumeClaim:
claimName: yangsenlin-pvc-local
containers:
– name: c1
image: registry.cn-hangzhou.aliyuncs.com/yangsenlin-k8s/apps:v1
ports:
– containerPort: 80
volumeMounts:
– mountPath: “/data”
name: data
root@master231:/manifests/local-sc# kubectl apply -f 04-deploy-xiuxian.yaml
deployment.apps/xiuxian created
root@master231:/manifests/local-sc#
​
[root@master231 local-sc]# kubectl get pods -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
xiuxian-7df7678dcf-kv5fw 1/1 Running 0 9s 10.100.2.38 worker233
xiuxian-7df7678dcf-lcvg4 1/1 Running 0 9s 10.100.2.40 worker233
xiuxian-7df7678dcf-x28bv 1/1 Running 0 9s 10.100.2.39 worker233
[root@master231 local-sc]#
[root@master231 local-sc]# kubectl get pvc yangsenlin-pvc-local
NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS AGE
yangsenlin-pvc-local Bound yangsenlin-pv-worker233 20Gi RWO ysl-local-sc 2m18s
[root@master231 local-sc]#
​
– 如何解决local sc的弊端呢？
CSI: Container Storage Intaerface
​
​
参考官网:
https://openebs.io/docs/concepts/architecture
32 harbor实现https
1 环境准备
10.0.0.250 harbor.ysl.com
2core 4G
​
2 下载harbor
wget https://github.com/goharbor/harbor/releases/download/v2.12.2/harbor-offline-installer-v2.12.2.tgz
​
3 创建工作目录
root@harbor:~# mkdir -pv /harbor/{softwares,logs,data}
​
4 解压软件包
root@harbor:~# tar xf harbor-offline-installer-v2.12.2.tgz -C /harbor/softwares/
​
5 安装docker环境
[root@harbor.ysl.com ~]# tar xf autoinstall-docker-docker-compose.tar.gz
[root@harbor.ysl.com ~]# ./install-docker.sh i
​
6 配置CA证书
6.1 创建工作目录
root@harbor:~/docker# mkdir -pv /harbor/softwares/harbor/certs/{ca,harbor-server,docker-client}
​
6.2 进入到harbor证书存放目录
root@harbor:/harbor/softwares/harbor/certs# ll
total 20
drwxr-xr-x 5 root root 4096 Apr 10 22:41 ./
drwxr-xr-x 3 root root 4096 Apr 10 22:41 ../
drwxr-xr-x 2 root root 4096 Apr 10 22:41 ca/
drwxr-xr-x 2 root root 4096 Apr 10 22:41 docker-client/
drwxr-xr-x 2 root root 4096 Apr 10 22:41 harbor-server/
root@harbor:/harbor/softwares/harbor/certs#
​
6.3 生成自建ca证书
6.3.1 创建ca的私钥
root@harbor:/harbor/softwares/harbor/certs# openssl genrsa -out ca/ca.key 4096
6.3.2 基于自建的CA私钥创建CA证书(注意，证书签发的域名范围)
root@harbor:/harbor/softwares/harbor/certs# openssl req -x509 -new -nodes -sha512 -days 3650 \
-subj “/C=CN/ST=Sichuan/L=Sichuan/O=example/OU=Personal/CN=ysl.com” \
-key ca/ca.key \
-out ca/ca.crt

6.3.3 查看自建证书信息
root@harbor:/harbor/softwares/harbor/certs# openssl x509 -in ca/ca.crt -noout -text
​
7 配置harbor证书
7.1 生成harbor服务器的私钥
root@harbor:/harbor/softwares/harbor/certs# openssl genrsa -out harbor-server/harbor.ysl.com.key 4096
​
7.2 harbor服务器基于私钥签发证书认证请求（csr文件），让自建CA认证
root@harbor:/harbor/softwares/harbor/certs# openssl req -sha512 -new \
-subj “/C=CN/ST=Sichuan/L=Sichuan/O=example/OU=Personal/CN=harbor.ysl.com” \
-key harbor-server/harbor.ysl.com.key \
​
7.3 生成x509 v3的扩展文件用于认证
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
​
[alt_names]
DNS.1=harbor.ysl.com
EOF
​
7.4 基于 x509 v3 的扩展文件认证签发harbor server证书
root@harbor:/harbor/softwares/harbor/certs# openssl x509 -req -sha512 -days 3650 \
-extfile harbor-server/v3.ext \
-CA ca/ca.crt -CAkey ca/ca.key -CAcreateserial \
-in harbor-server/harbor.ysl.com.csr \
-out harbor-server/harbor.ysl.com.crt

7.5 修改harbor的配置文件使用自建证书
root@harbor:/harbor/softwares/harbor/certs# vim ../harbor.yml
…
hostname: harbor.ysl.com
https:
…
certificate: /harbor/softwares/harbor/certs/harbor-server/harbor.ysl.com.crt
private_key: /harbor/softwares/harbor/certs/harbor-server/harbor.ysl.com.key
…
harbor_admin_password: 1
…
data_volume: /harbor/data/harbor
…
​
8 安装harbor环境
root@harbor:/harbor/softwares/harbor/certs# ../install.sh
…..
✔ —-Harbor has been installed and started successfully.—-
​
9 windows访问测试
9.1 修改windows的hosts解析

192.168.137.250 harbor.ysl.com

9.2 访问测试
https://192.168.137.250/
使用admin/1登录

10 生成docker客户端证书
root@harbor:/harbor/softwares/harbor/certs# pwd
/harbor/softwares/harbor/certs
​
root@harbor:/harbor/softwares/harbor/certs# openssl x509 -inform PEM -in harbor-server/harbor.ysl.com.crt -out docker-client/harbor.ysl.com.cert
​
root@harbor:/harbor/softwares/harbor/certs# md5sum docker-client/harbor.ysl.com.cert harbor-server/harbor.ysl.com.crt
6488a8559b05764db9af81a67590a8de docker-client/harbor.ysl.com.cert
6488a8559b05764db9af81a67590a8de harbor-server/harbor.ysl.com.crt
root@harbor:/harbor/softwares/harbor/certs#
​
11 拷贝docker client证书文件
root@harbor:/harbor/softwares/harbor/certs# cp ca/ca.crt harbor-server/harbor.ysl.com.key docker-client/
​
12 将harbor的客户端证书拷贝到k8s集群
12.1 k8s集群每个节点新建证书的目录（域名的名称和目录要一样）
root@master231:~# mkdir -pv /etc/docker/certs.d/harbor.ysl.com/
root@master232:~# mkdir -pv /etc/docker/certs.d/harbor.ysl.com/
root@master233:~# mkdir -pv /etc/docker/certs.d/harbor.ysl.com/
​
12.2 从harbor仓库将证书文件拷贝到k8s集群
[root@harbor.ysl.com certs]# scp docker-client/* 10.0.0.231:/etc/docker/certs.d/harbor.ysl.com/
[root@harbor.ysl.com certs]# scp docker-client/* 10.0.0.232:/etc/docker/certs.d/harbor.ysl.com/
[root@harbor.ysl.com certs]# scp docker-client/* 10.0.0.233:/etc/docker/certs.d/harbor.ysl.com/
​
12.3 客户端验证
root@worker231:~# echo ‘10.0.0.250 harbor.ysl.com’ >> /etc/hosts
root@worker232:~# echo ‘10.0.0.250 harbor.ysl.com’ >> /etc/hosts
root@worker233:~# echo ‘10.0.0.250 harbor.ysl.com’ >> /etc/hosts
​
12.4 k8s集群登录harbor仓库
root@master231:~# docker login -u admin -p 1 harbor.ysl.com
WARNING! Using –password via the CLI is insecure. Use –password-stdin.
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
​
Login Succeeded
​
13 推送镜像到harbor仓库
​
13.1 给镜像打标签
root@master231:~# docker tag crpi-kxgdi0lp5jdep1gc.cn-chengdu.personal.cr.aliyuncs.com/yangsenlin/apps:v1 harbor.ysl.com/ysl-xiuxian/apps:v1
​
13.2 harbor web页面新建一个项目，项目名称为ysl-xiuxian
略
​
13.3 推送镜像到harbor仓库
The push refers to repository [harbor.ysl.com/ysl-xiuxian/apps]
8e2be8913e57: Pushed
9d5b000ce7c7: Pushed
b8dbe22b95f7: Pushed
c39c1c35e3e8: Pushed
5f66747c8a72: Pushed
15d7cdc64789: Pushed
7fcb75871b21: Pushed
v1: digest: sha256:3bee216f250cfd2dbda1744d6849e27118845b8f4d55dda3ca3c6c1227cc2e5c size: 1778
​
13.4 到harbor web查看推送的镜像

14 k8s从harbor仓库拉取镜像
root@master231:/manifests/volumes# cat 06-deploy-xiuxian-harbor.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-xiuxian-harbor
spec:
replicas: 3
selector:
matchLabels:
apps: xiuxian
template:
metadata:
labels:
apps: xiuxian
spec:
volumes:
– emptyDir: {}
name: data
containers:
– name: c1
# image: crpi-kxgdi0lp5jdep1gc.cn-chengdu.personal.cr.aliyuncs.com/yangsenlin/apps:v1
image: harbor.ysl.com/ysl-xiuxian/apps:v1
volumeMounts:
– name: data
mountPath: /usr/share/nginx/html

root@master231:/manifests/volumes# kubectl apply -f 06-deploy-xiuxian-harbor.yaml
​
root@master231:/manifests/volumes# kubectl get pods
NAME READY STATUS RESTARTS AGE
deploy-xiuxian-harbor-6d99f57cb6-4p2cn 1/1 Running 0 31m
deploy-xiuxian-harbor-6d99f57cb6-fk767 1/1 Running 0 31m
deploy-xiuxian-harbor-6d99f57cb6-qwtx6 1/1 Running 0 31m

15 参考链接
https://goharbor.io/docs/1.10/install-config/configure-https/#generate-a-certificate-authority-certificate
https://www.cnblogs.com/yangsenlin/p/17153673.html

16 快速修复harbor服务
docker-compose down -t 0
docker-compose up -d
docker-compose ps -a
33 图形化管理工具
1 部署dashboard
是一款图形化管理K8S集群的解决方案。
参考链接:
https://github.com/kubernetes/dashboard/releases?page=7

1.1 下载资源清单
root@master231:~/manifests/add-ones/dashboard# wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.5.1/aio/deploy/recommended.yaml
​
1.2 修改8443的svc类型为LoadBalancer

1.3 部署服务
[root@master231 dashboard]# kubectl apply -f recommended.yaml
namespace/kubernetes-dashboard created
serviceaccount/kubernetes-dashboard created
service/kubernetes-dashboard created
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-csrf created
secret/kubernetes-dashboard-key-holder created
configmap/kubernetes-dashboard-settings created
role.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
service/dashboard-metrics-scraper created
deployment.apps/dashboard-metrics-scraper created
[root@master231 dashboard]#
​
​
镜像下载地址:
http://192.168.15.253/Resources/Kubernetes/Add-ons/dashboard/
1.4 查看资源
[root@master231 dashboard]# kubectl get pods,svc -n kubernetes-dashboard
NAME READY STATUS RESTARTS AGE
pod/dashboard-metrics-scraper-799d786dbf-xqm2f 1/1 Running 0 104s
pod/kubernetes-dashboard-fb8648fd9-g6szd 1/1 Running 0 104s
​
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/dashboard-metrics-scraper ClusterIP 10.200.4.60 8000/TCP 104s
service/kubernetes-dashboard LoadBalancer 10.200.50.252 10.0.0.152 443:14864/TCP 104s
[root@master231 dashboard]#
​
1.5 访问Dashboard
https://10.0.0.152/#/login
1.6 基于token登录
1.6.1 创建sa
root@master231:~/manifests/add-ones/dashboard# kubectl create serviceaccount ysl
serviceaccount/ysl created
root@master231:~/manifests/add-ones/dashboard#
​
1.6.2 将sa和内置集群角色绑定
root@master231:~/manifests/add-ones/dashboard# kubectl create clusterrolebinding dashboard-ysl –clusterrole=cluster-admin –serviceaccount=default:ysl -o yaml –dry-run=client
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
creationTimestamp: null
name: dashboard-ysl
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
– kind: ServiceAccount
name: ysl
namespace: default
root@master231:~/manifests/add-ones/dashboard#
root@master231:~/manifests/add-ones/dashboard# kubectl create clusterrolebinding dashboard-ysl –clusterrole=cluster-admin –serviceaccount=default:ysl
clusterrolebinding.rbac.authorization.k8s.io/dashboard-ysl created
root@master231:~/manifests/add-ones/dashboard#
​
1.6.3 使用token登录
root@master231:~/manifests/add-ones/dashboard# kubectl get secrets `kubectl get sa ysl -o jsonpath='{.secrets[0].name}’` -o jsonpath='{.data.token}’ |base64 -d ; echo
eyJhbGciOiJSUzI1NiIsImtpZCI6InhRdmpiTWw2WTlrVG04SjlGOTI0a0hrMXVjZUhWUmV6bDc0LVlhZll1MUEifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6InlzbC10b2tlbi1ucmQ5MiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJ5c2wiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiI0OTlhMmRjMS0wNTA5LTRkY2ItYjIwNy03MGM2OWNhMTBmYmMiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6ZGVmYXVsdDp5c2wifQ.1WWAYf9i9ChqYGfbmoJSyqImw5D7hrUZYbznqWk8ExTJFoTiX5_X7ktbZoVxlRwp7oKvepiYn45I8Gw0IAxIZMriMdzAgjcxXTyvYzt4OP2CDKiCwCoGEEJ8HspBCPtXCfIyDejeOawaizDvQLqLwWT5RWg2uy7SEogZpJlfubx3tXW6Z81hoMHFhK9vTPb8BOYpmEHYLHe1ZkW89Zm21A9DKe0yFQo0mIbSvX8OQaluUlyMIKeL3kR2kkdHAbdjWJ7Vlfop5un5SJJZwLeLKlJsTobJJ2uO1FD43G0kLsIz_ITzxVVZ3IN7g0txm2ofyzh3RU2GLTYbWVM_QA0ryA
​
1.7 使用kubeconfig授权登录
root@master231:~/manifests/add-ones/dashboard# cat ysl-generate-tontext-conf.sh
#!/bin/bash
​
​
# 获取secret的名称
SECRET_NAME=`kubectl get sa ysl -o jsonpath='{.secrets[0].name}’`
​
# 指定API SERVER的地址
API_SERVER=10.0.0.231:6443
​
# 指定kubeconfig配置文件的路径名称
KUBECONFIG_NAME=./yangsenlin-k8s-dashboard-admin.conf
​
# 获取ysl用户的tocken
ysl_TOCKEN=`kubectl get secrets $SECRET_NAME -o jsonpath={.data.token} | base64 -d`
​
# 在kubeconfig配置文件中设置群集项
kubectl config set-cluster yangsenlin-k8s-dashboard-cluster –server=$API_SERVER –kubeconfig=$KUBECONFIG_NAME
​
# 在kubeconfig中设置用户项
kubectl config set-credentials yangsenlin-k8s-dashboard-user –token=$ysl_TOCKEN –kubeconfig=$KUBECONFIG_NAME
​
# 配置上下文，即绑定用户和集群的上下文关系，可以将多个集群和用户进行绑定哟~
kubectl config set-context yangsenlin-admin –cluster=yangsenlin-k8s-dashboard-cluster –user=ysl-k8s-dashboard-user –kubeconfig=$KUBECONFIG_NAME
​
# 配置当前使用的上下文
kubectl config use-context yangsenlin-admin –kubeconfig=$KUBECONFIG_NAME
root@master231:~/manifests/add-ones/dashboard# bash ysl-generate-tontext-conf.sh
Cluster “yangsenlin-k8s-dashboard-cluster” set.
User “yangsenlin-k8s-dashboard-user” set.
Context “yangsenlin-admin” created.
Switched to context “yangsenlin-admin”.
root@master231:~/manifests/add-ones/dashboard# ll
total 28
drwxr-xr-x 3 root root 4096 May 2 19:24 ./
drwxr-xr-x 5 root root 4096 May 2 11:16 ../
drwxr-xr-x 2 root root 4096 May 2 11:27 images/
-rw-r–r– 1 root root 7642 May 2 11:24 recommended.yaml
-rw——- 1 root root 1248 May 2 19:24 yangsenlin-k8s-dashboard-admin.conf
-rw-r–r– 1 root root 1063 May 2 19:23 ysl-generate-tontext-conf.sh
root@master231:~/manifests/add-ones/dashboard# cat yangsenlin-k8s-dashboard-admin.conf
apiVersion: v1
clusters:
– cluster:
server: 10.0.0.231:6443
name: yangsenlin-k8s-dashboard-cluster
contexts:
– context:
cluster: yangsenlin-k8s-dashboard-cluster
user: ysl-k8s-dashboard-user
name: yangsenlin-admin
current-context: yangsenlin-admin
kind: Config
preferences: {}
users:
– name: yangsenlin-k8s-dashboard-user
user:
token: eyJhbGciOiJSUzI1NiIsImtpZCI6InhRdmpiTWw2WTlrVG04SjlGOTI0a0hrMXVjZUhWUmV6bDc0LVlhZll1MUEifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6InlzbC10b2tlbi1ucmQ5MiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJ5c2wiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiI0OTlhMmRjMS0wNTA5LTRkY2ItYjIwNy03MGM2OWNhMTBmYmMiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6ZGVmYXVsdDp5c2wifQ.1WWAYf9i9ChqYGfbmoJSyqImw5D7hrUZYbznqWk8ExTJFoTiX5_X7ktbZoVxlRwp7oKvepiYn45I8Gw0IAxIZMriMdzAgjcxXTyvYzt4OP2CDKiCwCoGEEJ8HspBCPtXCfIyDejeOawaizDvQLqLwWT5RWg2uy7SEogZpJlfubx3tXW6Z81hoMHFhK9vTPb8BOYpmEHYLHe1ZkW89Zm21A9DKe0yFQo0mIbSvX8OQaluUlyMIKeL3kR2kkdHAbdjWJ7Vlfop5un5SJJZwLeLKlJsTobJJ2uO1FD43G0kLsIz_ITzxVVZ3IN7g0txm2ofyzh3RU2GLTYbWVM_QA0ryA
root@master231:~/manifests/add-ones/dashboard#
​
​
2 kuboard
官网地址:
https://kuboard.cn/
​
2.1 部署kuboard
root@master231:~/manifests/add-ones/dashboard# wget https://addons.kuboard.cn/kuboard/kuboard-v3-swr.yaml
root@master231:~/manifests/add-ones/kuboard# kubectl apply -f kuboard-v3-swr.yaml
namespace/kuboard created
configmap/kuboard-v3-config created
serviceaccount/kuboard-boostrap created
clusterrolebinding.rbac.authorization.k8s.io/kuboard-boostrap-crb created
daemonset.apps/kuboard-etcd created
deployment.apps/kuboard-v3 created
service/kuboard-v3 created
root@master231:~/manifests/add-ones/kuboard#
​
root@master231:~/manifests/add-ones/kuboard# kubectl -n kuboard get pods
​
root@master231:~/manifests/add-ones/kuboard# kubectl -n kuboard get svc
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kuboard-v3 NodePort 10.200.124.105 80:30080/TCP,10081:30081/TCP,10081:30081/UDP 2m59s
​
在浏览器中打开链接 http://10.0.0.233:30080
​
输入初始用户名和密码，并登录
​
用户名： admin
密码： Kuboard123
​
3 kubesphere
3.1 安装helm
[root@master231 kubesphere]# curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
​
3.2 配置helm的自动补全功能
[root@master231 kubesphere]# helm completion bash > /etc/bash_completion.d/helm
[root@master231 kubesphere]# source /etc/bash_completion.d/helm
[root@master231 kubesphere]# echo ‘source /etc/bash_completion.d/helm’ >> ~/.bashrc
​
3.3 在集群节点，执行以下命令安装 KubeSphere Core。
[root@master231 ~]# helm upgrade –install -n kubesphere-system –create-namespace ks-core https://charts.kubesphere.com.cn/main/ks-core-1.1.3.tgz –debug –wait
…
​
NOTES:
Thank you for choosing KubeSphere Helm Chart.
​
Please be patient and wait for several seconds for the KubeSphere deployment to complete.
​
1. Wait for Deployment Completion
​
Confirm that all KubeSphere components are running by executing the following command:
​
kubectl get pods -n kubesphere-system
2. Access the KubeSphere Console
​
Once the deployment is complete, you can access the KubeSphere console using the following URL:
​
http://10.0.0.231:30880
​
3. Login to KubeSphere Console
​
Use the following credentials to log in:
​
Account: admin
Password: P@88w0rd
​
NOTE: It is highly recommended to change the default password immediately after the first login.
For additional information and details, please visit https://kubesphere.io.
​
​
温馨提示:
如果安装失败，需要手动导入镜像。

3.4 登录kubesphere的WebUI
http://10.0.0.231:30880
​
​
34 wordpress
root@master231:~/manifests/wordpress# cat 01-deploy-mysql.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: pvc-db
spec:
storageClassName: nfs-csi
accessModes:
– ReadWriteMany
resources:
limits:
storage: 2Gi
requests:
storage: 1Gi
​
—
​
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-mysql
spec:
replicas: 1
selector:
matchLabels:
apps: db
template:
metadata:
labels:
apps: db
spec:
volumes:
– name: data
persistentVolumeClaim:
claimName: pvc-db
– name: datetime
hostPath:
path: /etc/localtime
restartPolicy: Always
hostNetwork: true
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
– matchExpressions:
– key: kubernetes.io/hostname
values:
– worker232
operator: In
containers:
– name: c1
image: harbor.ysl.com/wordpress/mysql:8.0.36-oracle
volumeMounts:
– name: datetime
mountPath: /etc/localtime
– name: data
mountPath: /var/lib/mysql
imagePullPolicy: IfNotPresent
args:
– –character-set-server=utf8
– –collation-server=utf8_bin
– –default-authentication-plugin=mysql_native_password
ports:
– containerPort: 3306
env:
– name: MYSQL_ALLOW_EMPTY_PASSWORD
value: “yes”
– name: MYSQL_DATABASE
value: ceshi
– name: MYSQL_USER
value: test
– name: MYSQL_PASSWORD
value: “123456”
​
root@master231:~/manifests/wordpress# cat 02-deploy-wordpress.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-wordpress
spec:
replicas: 1
selector:
matchLabels:
apps: wp
template:
metadata:
labels:
apps: wp
spec:
hostNetwork: true
restartPolicy: Always
nodeSelector:
kubernetes.io/hostname: worker233
containers:
– name: c1
image: harbor.ysl.com/wordpress/wordpress:6.7.1-php8.1-apache
ports:
– containerPort: 80
env:
– name: WORDPRESS_DB_HOST
value: 10.0.0.232
– name: WORDPRESS_DB_NAME
value: ceshi
– name: WORDPRESS_DB_USER
value: test
– name: WORDPRESS_DB_PASSWORD
value: “123456”
volumeMounts:
– name: datetime
mountPath: /etc/localtime
– name: data
mountPath: /var/www/html
volumes:
– name: data
persistentVolumeClaim:
claimName: pvc-wp
– name: datetime
hostPath:
path: /etc/localtime
​
—
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: pvc-wp
spec:
storageClassName: nfs-csi
accessModes:
– ReadWriteMany
resources:
limits:
storage: 500Mi
requests:
storage: 200Mi

– WordPress基于svc
[root@master231 v2]# cat 01-deploy-mysql.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: pvc-db
namespace: kube-public
spec:
storageClassName: nfs-csi
accessModes:
– ReadWriteMany
resources:
limits:
storage: 2Gi
requests:
storage: 1Gi
​
—
​
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-mysql
namespace: kube-public
spec:
replicas: 1
selector:
matchLabels:
apps: db
template:
metadata:
labels:
apps: db
spec:
volumes:
– name: data
persistentVolumeClaim:
claimName: pvc-db
– name: datetime
hostPath:
path: /etc/localtime
restartPolicy: Always
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
– matchExpressions:
– key: kubernetes.io/hostname
values:
– worker232
operator: In
containers:
– name: c1
image: harbor.ysl.com/wordpress/mysql:8.0.36-oracle
volumeMounts:
– name: datetime
mountPath: /etc/localtime
– name: data
mountPath: /var/lib/mysql
imagePullPolicy: IfNotPresent
args:
– –character-set-server=utf8
– –collation-server=utf8_bin
– –default-authentication-plugin=mysql_native_password
ports:
– containerPort: 3306
env:
– name: MYSQL_ALLOW_EMPTY_PASSWORD
value: “yes”
– name: MYSQL_DATABASE
value: ceshi
– name: MYSQL_USER
value: test
– name: MYSQL_PASSWORD
value: “123456”
​
​
—
​
apiVersion: v1
kind: Service
metadata:
name: svc-db
namespace: kube-public
spec:
type: ClusterIP
selector:
apps: db
ports:
– port: 3306
​
​
[root@master231 v2]#
[root@master231 v2]#
[root@master231 v2]#
[root@master231 v2]# cat 02-deploy-wordpress.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-wordpress
spec:
replicas: 1
selector:
matchLabels:
apps: wp
template:
metadata:
labels:
apps: wp
spec:
restartPolicy: Always
containers:
– name: c1
image: harbor.ysl.com/wordpress/wordpress:6.7.1-php8.1-apache
ports:
– containerPort: 80
env:
– name: WORDPRESS_DB_HOST
# 指定数据库svc的名称，CoreDNS组件会自动解析其对应的ClusterIP
# value: svc-db
# 如果不指定名称空间，则默认会在当前资源所属的名称空间找。
# value: svc-db.kube-public
# 当然，我们也可以配置完整的A记录格式
value: svc-db.kube-public.svc.ysl.com
– name: WORDPRESS_DB_NAME
value: ceshi
– name: WORDPRESS_DB_USER
value: test
– name: WORDPRESS_DB_PASSWORD
value: “123456”
volumeMounts:
– name: datetime
mountPath: /etc/localtime
– name: data
mountPath: /var/www/html
volumes:
– name: data
persistentVolumeClaim:
claimName: pvc-wp
– name: datetime
hostPath:
path: /etc/localtime
​
—
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: pvc-wp
spec:
storageClassName: nfs-csi
accessModes:
– ReadWriteMany
resources:
limits:
storage: 500Mi
requests:
storage: 200Mi
​
—
​
apiVersion: v1
kind: Service
metadata:
name: svc-wp
namespace: default
spec:
type: LoadBalancer
selector:
apps: wp
ports:
– port: 80
[root@master231 v2]#
35 pv的回收策略
Retain:
“保留回收”策略允许手动回收资源,删除pvc时，pv仍然存在，并且该卷被视为”已释放(Released)”。
在管理员手动回收资源之前，使用该策略其他Pod将无法直接使用。
温馨提示:
(1)在k8s1.15.12版本测试时，删除pvc发现nfs存储卷的数据并不会被删除，pv也不会被删除;

Delete:
对于支持删除回收策略的卷插件，k8s将删除pv及其对应的数据卷数据。建议使用动态存储类(sc)实现，才能看到效果哟！
对于AWS EBS, GCE PD, Azure Disk, or OpenStack Cinder等存储卷会被删除。
温馨提示:
(1)在k8s1.15.12版本测试时，在不使用sc时，则删除pvc发现nfs存储卷的数据并不会被删除；
(2)在k8s1.15.12版本测试时，在使用sc后，可以看到删除效果哟;
​
Recycle:
对于”回收利用”策略官方已弃用。相反，推荐的方法是使用动态资源调配。而动态存储类已经不支持该类型啦！
如果基础卷插件支持，回收回收策略将对卷执行基本清理（rm -rf /thevolume/*），并使其再次可用于新的声明。
温馨提示，在k8s1.15.12版本测试时，删除pvc发现nfs存储卷的数据被删除。

温馨提示:
对于动态存储类中的配置中，多了一个”archive”，表示归档pv。

[root@master231 csi-driver-nfs]# cat deploy/v4.9.0/storageclass.yaml
—
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: nfs-csi
provisioner: nfs.csi.k8s.io
parameters:
# server: nfs-server.default.svc.cluster.local
server: 10.0.0.231
# share: /
share: /ysl/data/nfs-server/sc
# csi.storage.k8s.io/provisioner-secret is only needed for providing mountOptions in DeleteVolume
# csi.storage.k8s.io/provisioner-secret-name: “mount-options”
# csi.storage.k8s.io/provisioner-secret-namespace: “default”
# 有效值为: delete retain archive，若不指定，则默认值为”delete”，当删除pvc时，会自动删除pv及后端的数据。
# onDelete: “archive”
# onDelete: “retain”
reclaimPolicy: Delete
volumeBindingMode: Immediate
mountOptions:
– nfsvers=4.1
[root@master231 csi-driver-nfs]#
​
36 名称空间
1 概述
k8s的名称空间是用来隔离K8S集群资源的。
​
但是有些资源不支持名称空间隔离，我们称之为全局资源，而支持名称空间的我们称之为局部资源。
​
2 查看资源是否支持名称空间
root@master231:~# kubectl api-resources
NAME SHORTNAMES APIVERSION NAMESPACED KIND
​
NAMESPACED 为true的是支持名称空间的，为false是不支持名称空间的
​
3 查看现有的名称空间
root@master231:~# kubectl get ns
NAME STATUS AGE
default Active 11d
kube-flannel Active 11d
kube-node-lease Active 11d
kube-public Active 11d
kube-system Active 11d
kubesphere-system Active 89m
​
4 查看特定名称空间的资源
root@master231:~# kubectl get cm
NAME DATA AGE
game-demo 7 3d11h
kube-root-ca.crt 1 11d
nginx-subfile 2 2d11h
test-xy 4 2d11h
ysl-cm 2 2d3h
root@master231:~# kubectl get cm –namespace default
root@master231:~# kubectl get cm -n default
root@master231:~# kubectl get cm -n kube-system
root@master231:~# kubectl get cm –namespace kube-system
root@master231:~# kubectl -n kube-system get pods -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
etcd-master231 1/1 Running 16 (3h57m ago) 11d 10.0.0.231 master231
kube-apiserver-master231 1/1 Running 17 (3h57m ago) 11d 10.0.0.231 master231
kube-controller-manager-master231 1/1 Running 16 (3h57m ago) 11d 10.0.0.231 master231
kube-proxy-9zlc6 1/1 Running 16 (3h57m ago) 11d 10.0.0.231 master231
kube-proxy-hn6g6 1/1 Running 23 (124m ago) 11d 10.0.0.233 worker233
kube-proxy-ngs5g 1/1 Running 8 (3h57m ago) 6d23h 10.0.0.232 worker232
kube-scheduler-master231 1/1 Running 16 (3h57m ago) 11d 10.0.0.231 master231
​
5 查看所有名称空间的资源
root@master231:~# kubectl get pods –all-namespaces
​
root@master231:~# kubectl get pods -A
root@master231:~# kubectl get cm -A
​
6 响应式创建名称空间
root@master231:~# kubectl create namespace ysl
namespace/ysl created
root@master231:~# kubectl get ns|grep ysl
ysl Active 12s
​
7 声明式创建名称空间
root@master231:~/manifests# cat 01-ns.yaml
apiVersion: v1
kind: Namespace
metadata:
name: test-ns
root@master231:~/manifests# kubectl apply -f 01-ns.yaml
namespace/test-ns created
root@master231:~/manifests# kubectl get -f 01-ns.yaml
NAME STATUS AGE
test-ns Active 8s
root@master231:~/manifests#
​
8 删除名称空间
root@master231:~/manifests# kubectl delete ns ysl test-ns
namespace “ysl” deleted
namespace “test-ns” deleted
​
9 提示
当删除名称空间时，该名称空间下的所有资源都会被删除！生产环境中谨慎操作！
​
10 将pod放在特点的名称空间
root@master231:~/manifests/pods# cat 23-pods-ns.yaml
apiVersion: v1
kind: Pod
metadata:
name: ns-xiuxian
#资源放在特定的名称空间
namespace: kube-public
spec:
containers:
– name: c1
image: harbor.ysl.com/ysl-xiuxian/apps:v1
root@master231:~/manifests/pods# kubectl apply -f 23-pods-ns.yaml
pod/ns-xiuxian configured
root@master231:~/manifests/pods# kubectl -n kube-public get pods
NAME READY STATUS RESTARTS AGE
ns-xiuxian 1/1 Running 0 79s
​
11 将cm放在特定的名称空间
root@master231:~/manifests/configmaps# cat 02-cm-ns.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: game-demo
namespace: kube-public
data:
player_initial_lives: “3”
ui_properties_file_name: “user-interface.properties”
xingming: zhangsan
city: Sichuan
​
game.properties: |
enemy.types=aliens,monsters
player.maximum-lives=5
user-interface.properties: |
color.good=purple
color.bad=yellow
allow.textmode=true
my.cnf: |
datadir=/ysl/data/mysql80
basedir=/ysl/softwares/mysql80
port=3306
socket=/tmp/mysql80.sock
​
root@master231:~/manifests/configmaps# kubectl apply -f 02-cm-ns.yaml
configmap/game-demo created
root@master231:~/manifests/configmaps# kubectl -n kube-public get cm
NAME DATA AGE
cluster-info 2 11d
game-demo 7 17s
kube-root-ca.crt 1 11d
​
12 有些资源不支持名称空间
比如pv，sc等都是不支持名称空间的，因此就算在资源清单中添加namespace字段也会被无视。
​
37 服务发现 Service
1 概述
服务发现包含以下四种
​
1.1 ClusterIP:
一般用于K8S集群内部应用服务之间的访问。
​
1.2 NodePort:
在CLusterIP的基础之上，对外部提供访问路由。
​
1.3 LoadBalancer:
一般用于云环境的K8S。
​
1.4 ExternalName:
一般映射K8S集群外部的服务到K8S集群内部，底层采用了CNAME技术。
​
1 ClusterIP
root@master231:~/manifests/services# cat 01-svc-clusterIP.yaml
apiVersion: v1
kind: Service
metadata:
name: svc-xiuxian
namespace: default
spec:
# 指定svc的类型，有效值: ExternalName, ClusterIP, NodePort, and LoadBalancer
# 若不指定，则默认值为:”ClusterIP”
type: ClusterIP
selector:
apps: v1
ports:
– name: xiuxian
port: 81
protocol: TCP
targetPort: 80
root@master231:~/manifests/services# kubectl apply -f 01-svc-clusterIP.yaml
service/svc-xiuxian configured
root@master231:~/manifests/services# kubectl get svc
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kubernetes ClusterIP 10.200.0.1 443/TCP 7d23h
svc-xiuxian ClusterIP 10.200.224.60 81/TCP 5d23h
​
2 NodePort
root@master231:~/manifests/services# cat 02-svc-nodePort.yaml
apiVersion: v1
kind: Service
metadata:
name: svc-xiuxian-nodeport
namespace: default
spec:
# 指定svc的类型，有效值: ExternalName, ClusterIP, NodePort, and LoadBalancer
# 若不指定，则默认值为:”ClusterIP”
type: NodePort
# 指定svc的网段即可，我们集群安装时指定的网段: 10.200.0.0/16
clusterIP: 10.200.0.100
selector:
apps: v1
ports:
– name: xiuxian
port: 81
protocol: TCP
targetPort: 80
# 默认的端口范围为: 30000-32767
nodePort: 30080
root@master231:~/manifests/services# kubectl apply -f 02-svc-nodePort.yaml
service/svc-xiuxian-nodeport created
root@master231:~/manifests/services# kubectl get svc
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kubernetes ClusterIP 10.200.0.1 443/TCP 7d23h
svc-xiuxian ClusterIP 10.200.224.60 81/TCP 5d23h
svc-xiuxian-nodeport NodePort 10.200.0.100 81:30080/TCP 6s
root@master231:~/manifests/services#
​
root@master231:~/manifests/services# kubectl get svc svc-xiuxian -o yaml
root@master231:~/manifests/services# kubectl get svc
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kubernetes ClusterIP 10.200.0.1 443/TCP 8d
svc-xiuxian ClusterIP 10.200.224.60 81/TCP 6d1h
svc-xiuxian-nodeport NodePort 10.200.0.100 81:30080/TCP 71m
​
集群外部访问三个节点的30080端口都可以
集群内部访问CLUSTER-IP的81端口即可
​
3 LoadBalancer

3.1 Metallb
如果我们需要在自己的Kubernetes中暴露LoadBalancer的应用，那么Metallb是一个不错的解决方案。
​
Metallb官网地址：
https://metallb.universe.tf/installation

3.2 修改cm配置
kubectl get configmap kube-proxy -n kube-system -o yaml | \
sed -e “s/strictARP: false/strictARP: true/” | \
sed -e ‘s#mode: “”#mode: “ipvs”#’ | \
kubectl apply -f – -n kube-system
​
3.3 删除Kube-proxy组件的pod，让cm的配置生效
root@master231:~# kubectl -n kube-system delete pods –all
root@master231:~# kubectl -n kube-system get pods
​
3.4 部署MetalLb
root@master231:~# kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.14.9/config/manifests/metallb-native.yaml
​
3.5 查看部署是否正常
root@master231:~# kubectl get pods -n metallb-system
NAME READY STATUS RESTARTS AGE
controller-7f77587954-gz425 1/1 Running 0 88s
speaker-f7bwt 1/1 Running 0 88s
speaker-p7z98 1/1 Running 0 88s
speaker-sp7fj 1/1 Running 0 88s
​
3.6 创建地址池
root@master231:~/manifests/metalLB# kubectl apply -f metallb-ip-pool.yaml
ipaddresspool.metallb.io/test-metallb created
l2advertisement.metallb.io/test created
​
3.7 创建svc
root@master231:~/manifests/services# cat 03-svc-LoadBalancer.yaml
apiVersion: v1
kind: Service
metadata:
name: svc-xiuxian-loadbalancer
namespace: default
spec:
# 指定svc的类型，有效值: ExternalName, ClusterIP, NodePort, and LoadBalancer
# 若不指定，则默认值为:”ClusterIP”
type: LoadBalancer
clusterIP: 10.200.0.200
selector:
apps: v1
ports:
– name: xiuxian
port: 81
protocol: TCP
targetPort: 80
nodePort: 30081

root@master231:~/manifests/services# kubectl apply -f 03-svc-LoadBalancer.yaml
service/svc-xiuxian-loadbalancer created
root@master231:~/manifests/services# kubectl get svc | grep load
svc-xiuxian-loadbalancer LoadBalancer 10.200.0.200 10.0.0.150 81:30081/TCP 31s
​
3.8 访问测试
http://10.0.0.150:81/
http://10.0.0.233:30081/
​
​
4 ExternalName
4.1 部署应用
root@master231:~/manifests/services# cat 04-svc-ExteralName.yaml
apiVersion: v1
kind: Service
metadata:
name: svc-xiuxian-externalname
namespace: default
spec:
type: ExternalName
# 配置CNAME
externalName: www.baidu.com
ports:
– name: xiuxian
port: 81
protocol: TCP
targetPort: 80
nodePort: 30082
root@master231:~/manifests/services# kubectl apply -f 04-svc-ExteralName.yaml
service/svc-xiuxian-externalname created
​
4.2 解析测试
[root@master231 services]# dig @10.200.0.10 svc-xiuxian-externalname.default.svc.baidu.com +short
​
4.3 访问A记录格式
访问A记录格式: ..svc.<--service-dns-domain|zone>
举例说明:
svc-xiuxian-externalname.default.svc.baidu.com

4.4 ExternalName是不分配ClusterIP的
root@master231:~/manifests/services# kubectl get svc
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kubernetes ClusterIP 10.200.0.1 443/TCP 8d
svc-xiuxian ClusterIP 10.200.224.60 81/TCP 6d6h
svc-xiuxian-externalname ExternalName www.baidu.com 81:30082/TCP 143m
svc-xiuxian-loadbalancer LoadBalancer 10.200.0.200 10.0.0.150 81:30081/TCP 147m
svc-xiuxian-nodeport NodePort 10.200.0.100 81:30080/TCP 6h39m
​
5 svc和CoreDNS的关系
5.1 CoreDNS为svc提供解析功能【基于svc的名称解析到对应的CLusterIP或者后端的真实IP地址】
​
5.2 查看DNS的服务配置
root@master231:~/manifests/services# kubectl get pods -n kube-system -l k8s-app=kube-dns -o wide
​
5.3 阅读CoreDNS的资源清单
root@master231:~# cat coredns.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: coredns
namespace: kube-system
—
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
kubernetes.io/bootstrapping: rbac-defaults
name: system:coredns
rules:
– apiGroups:
– “”
resources:
– endpoints
– services
– pods
– namespaces
verbs:
– list
– watch
– apiGroups:
– discovery.k8s.io
resources:
– endpointslices
verbs:
– list
– watch
—
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
annotations:
rbac.authorization.kubernetes.io/autoupdate: “true”
labels:
kubernetes.io/bootstrapping: rbac-defaults
name: system:coredns
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: system:coredns
subjects:
– kind: ServiceAccount
name: coredns
namespace: kube-system
—
apiVersion: v1
kind: ConfigMap
metadata:
name: coredns
namespace: kube-system
data:
Corefile: |
.:53 {
errors
health {
lameduck 5s
}
ready
kubernetes cluster.local in-addr.arpa ip6.arpa {
fallthrough in-addr.arpa ip6.arpa
}
prometheus :9153
forward . /etc/resolv.conf {
max_concurrent 1000
}
cache 30
loop
reload
loadbalance
}
—
apiVersion: apps/v1
kind: Deployment
metadata:
name: coredns
namespace: kube-system
labels:
k8s-app: kube-dns
kubernetes.io/name: “CoreDNS”
app.kubernetes.io/name: coredns
spec:
# replicas: not specified here:
# 1. Default is 1.
# 2. Will be tuned in real time if DNS horizontal auto-scaling is turned on.
replicas: 2
strategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
selector:
matchLabels:
k8s-app: kube-dns
app.kubernetes.io/name: coredns
template:
metadata:
labels:
k8s-app: kube-dns
app.kubernetes.io/name: coredns
spec:
priorityClassName: system-cluster-critical
serviceAccountName: coredns
tolerations:
– key: “CriticalAddonsOnly”
operator: “Exists”
nodeSelector:
kubernetes.io/os: linux
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
– labelSelector:
matchExpressions:
– key: k8s-app
operator: In
values: [“kube-dns”]
topologyKey: kubernetes.io/hostname
containers:
– name: coredns
image: registry.aliyuncs.com/google_containers/coredns:v1.8.6
imagePullPolicy: IfNotPresent
resources:
limits:
memory: 170Mi
requests:
cpu: 100m
memory: 70Mi
args: [ “-conf”, “/etc/coredns/Corefile” ]
volumeMounts:
– name: config-volume
mountPath: /etc/coredns
readOnly: true
ports:
– containerPort: 53
name: dns
protocol: UDP
– containerPort: 53
name: dns-tcp
protocol: TCP
– containerPort: 9153
name: metrics
protocol: TCP
securityContext:
allowPrivilegeEscalation: false
capabilities:
add:
– NET_BIND_SERVICE
drop:
– all
readOnlyRootFilesystem: true
livenessProbe:
httpGet:
path: /health
port: 8080
scheme: HTTP
initialDelaySeconds: 60
timeoutSeconds: 5
successThreshold: 1
failureThreshold: 5
readinessProbe:
httpGet:
path: /ready
port: 8181
scheme: HTTP
dnsPolicy: Default
volumes:
– name: config-volume
configMap:
name: coredns
items:
– key: Corefile
path: Corefile
—
apiVersion: v1
kind: Service
metadata:
name: kube-dns
namespace: kube-system
annotations:
prometheus.io/port: “9153”
prometheus.io/scrape: “true”
labels:
k8s-app: kube-dns
kubernetes.io/cluster-service: “true”
kubernetes.io/name: “CoreDNS”
app.kubernetes.io/name: coredns
spec:
selector:
k8s-app: kube-dns
app.kubernetes.io/name: coredns
clusterIP: 10.200.0.10
ports:
– name: dns
port: 53
protocol: UDP
targetPort: 53
– name: dns-tcp
port: 53
protocol: TCP
targetPort: 53
– name: metrics
port: 9153
protocol: TCP
targetPort: 9153
root@master231:~#
​
root@master231:~# kubectl -n kube-system get cm coredns -o yaml
apiVersion: v1
data:
Corefile: |
.:53 {
errors
health {
lameduck 5s
}
ready
kubernetes cluster.local in-addr.arpa ip6.arpa {
fallthrough in-addr.arpa ip6.arpa
}
prometheus :9153
forward . /etc/resolv.conf {
max_concurrent 1000
}
cache 30
loop
reload
loadbalance
}
kind: ConfigMap
metadata:
annotations:
kubectl.kubernetes.io/last-applied-configuration: |
{“apiVersion”:”v1″,”data”:{“Corefile”:”.:53 {\n errors\n health {\n lameduck 5s\n }\n ready\n kubernetes cluster.local in-addr.arpa ip6.arpa {\n fallthrough in-addr.arpa ip6.arpa\n }\n prometheus :9153\n forward . /etc/resolv.conf {\n max_concurrent 1000\n }\n cache 30\n loop\n reload\n loadbalance\n}\n”},”kind”:”ConfigMap”,”metadata”:{“annotations”:{},”name”:”coredns”,”namespace”:”kube-system”}}
creationTimestamp: “2025-04-04T11:30:50Z”
name: coredns
namespace: kube-system
resourceVersion: “619273”
uid: 38fb3251-ee68-4a93-861d-886f0c139671

5.4 查看kubelet组件
root@master231:~# cat /var/lib/kubelet/config.yaml

5.5 dnsconfig自定义DNS配置信息
root@master231:~/manifests/coreDNS# cat 01-deploy-dnsConfig.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-dnsconfig
spec:
replicas: 1
selector:
matchLabels:
apps: xiuxian
template:
metadata:
labels:
apps: xiuxian
address: chaoyang
city: Sichuan
spec:
# 为Pod配置DNS相关信息
dnsConfig:
# 指定DNS服务器
nameservers:
– 223.5.5.5
– 223.6.6.6
# 定义搜索域
searches:
– yangsenlin.top
– baidu.com
# 配置DNS解析选项
options:
– name: edns0
value: trust-ad
– name: ndots
value: “5”
containers:
– name: c1
image: harbor.ysl.com/ysl-xiuxian/apps:v1

root@master231:~/manifests/coreDNS# kubectl apply -f 01-deploy-dnsConfig.yaml
deployment.apps/deploy-dnsconfig created
​
root@master231:~/manifests/coreDNS# kubectl exec -it deploy-dnsconfig-855c67c5b7-pf4kd — sh
/ # cat /etc/resolv.conf
nameserver 10.200.0.10
nameserver 223.5.5.5
nameserver 223.6.6.6
search default.svc.yangsenlin.top svc.yangsenlin.top yangsenlin.top baidu.com
options ndots:5 edns0:trust-ad
​
5.6 dnspolicy和hostNetwork
root@master231:~/manifests/coreDNS# cat 02-deploy-hostNetwork-dnsPolicy.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-hostnetwork
spec:
replicas: 1
selector:
matchLabels:
apps: xiuxian
template:
metadata:
labels:
apps: xiuxian
address: shahe
city: Sichuan
spec:
hostNetwork: true
containers:
– name: c1
image: harbor.ysl.com/ysl-xiuxian/apps:v1
root@master231:~/manifests/coreDNS# kubectl apply -f 02-deploy-hostNetwork-dnsPolicy.yaml
deployment.apps/deploy-hostnetwork created
​
root@master231:~/manifests/coreDNS# kubectl get pods
NAME READY STATUS RESTARTS AGE
deploy-dnsconfig-855c67c5b7-pf4kd 1/1 Running 0 9m4s
deploy-hostnetwork-85ff5498ff-7k7qm 1/1 Running 0 65s
root@master231:~/manifests/coreDNS# kubectl exec -it deploy-hostnetwork-85ff5498ff-7k7qm — sh
/ # cat /etc/resolv.conf
nameserver 223.5.5.5
nameserver 223.6.6.6
search
/ # ping svc-xiuxian-nodeport
ping: bad address ‘svc-xiuxian-nodeport’
​
root@master231:~/manifests/coreDNS# kubectl delete -f 02-deploy-hostNetwork-dnsPolicy.yaml
deployment.apps “deploy-hostnetwork” deleted
root@master231:~/manifests/coreDNS# vi 02-deploy-hostNetwork-dnsPolicy.yaml
root@master231:~/manifests/coreDNS# cat 02-deploy-hostNetwork-dnsPolicy.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-hostnetwork
spec:
replicas: 1
selector:
matchLabels:
apps: xiuxian
template:
metadata:
labels:
apps: xiuxian
address: shahe
city: Sichuan
spec:
hostNetwork: true
# 配置DNS策略，有效值: ‘ClusterFirstWithHostNet’, ‘ClusterFirst’, ‘Default’ or ‘None’
# 默认值为:”ClusterFirst”
dnsPolicy: ClusterFirstWithHostNet
containers:
– name: c1
image: harbor.ysl.com/ysl-xiuxian/apps:v1
root@master231:~/manifests/coreDNS# kubectl apply -f 02-deploy-hostNetwork-dnsPolicy.yaml
deployment.apps/deploy-hostnetwork created
root@master231:~/manifests/coreDNS# kubectl exec -it deploy-hostnetwork-6f64688bbb-5n2n7 — sh
/ # cat /etc/resolv.conf
nameserver 10.200.0.10
search default.svc.yangsenlin.top svc.yangsenlin.top yangsenlin.top
options ndots:5
/ # ping svc-xiuxian-nodeport
​
6 无头服务
6.1 headless Service
本质上还是一个Service，只不过该Service没有ClusterIP而已。
​
一般会结合sts资源使用。
​
6.2 资源清单
[root@master231 services]# cat 05-svc-headless.yaml
apiVersion: v1
kind: Service
metadata:
name: svc-headless
namespace: default
spec:
type: ClusterIP
# 若没有IP地址，则表示的是一个无头服务
clusterIP: None
selector:
apps: xiuxian
ports:
– name: xiuxian
port: 81
protocol: TCP
targetPort: 80

7 endpionts映射K8S集群外部服务
7.1 svc和ep的关系
除了ExternalName类型外，当创建其他类型的svc时，都会自动关联一个同名称的ep资源。
​
当删除svc时，会自动删除同名称的ep资源。
7.2 svc会自动关联ep
root@master231:~/manifests/services# kubectl apply -f 05-svc-headless.yaml
service/svc-headless created
root@master231:~/manifests/services# kubectl describe svc svc-headless
Name: svc-headless
Namespace: default
Labels:
Annotations:
Selector: apps=xiuxian
Type: ClusterIP
IP Family Policy: SingleStack
IP Families: IPv4
IP: None
IPs: None
Port: xiuxian 81/TCP
TargetPort: 80/TCP
Endpoints: 10.0.0.232:80,10.100.2.15:80
Session Affinity: None
Events:
root@master231:~/manifests/services#
​
root@master231:~/manifests/services# kubectl get ep svc-headless
NAME ENDPOINTS AGE
svc-headless 10.0.0.232:80,10.100.2.15:80 64s
​
7.3 将k8s外部的服务映射到k8s集群内部
root@worker233:~# docker run -d -e MYSQL_ALLOW_EMPTY_PASSWORD=yes -e MYSQL_DATABASE=test -e MYSQL_USER=test -e MYSQL_PASSWORD=”123456″ –name mysql-server –network host harbor.ysl.com/wordpress/mysql:8.0.36-oracle
b2975312782cd0d689ec49cb38ba688674fb3f785ae68815619ed126f66addab
​
root@worker233:~# docker ps -l
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
b2975312782c harbor.ysl.com/wordpress/mysql:8.0.36-oracle “docker-entrypoint.s…” 22 seconds ago Up 20 seconds mysql-server
root@worker233:~# ss -ntl | grep 3306
LISTEN 0 70 *:33060 *:*
LISTEN 0 151 *:3306 *:*
​
7.4 k8s集群添加ep资源映射外部服务
root@master231:~/manifests/endpoints# cat 01-ep-mysql.yaml
apiVersion: v1
kind: Endpoints
metadata:
name: harbor-mysql
subsets:
– addresses:
– ip: 10.0.0.250
ports:
– port: 3306
​
—
​
apiVersion: v1
kind: Service
metadata:
name: harbor-mysql
spec:
type: ClusterIP
ports:
– port: 3306
root@master231:~/manifests/endpoints# kubectl apply -f 01-ep-mysql.yaml
endpoints/harbor-mysql created
service/harbor-mysql created
​
[root@master231 endpoints]# kubectl describe svc harbor-mysql | grep Endpoints
Endpoints: 10.0.0.250:3306
[root@master231 endpoints]#
​
​
3.3 改写wordpress案例
[root@master231 v3]# cat deploy-wordpress.yaml
apiVersion: v1
kind: Endpoints
metadata:
name: harbor-mysql
subsets:
– addresses:
– ip: 10.0.0.250
ports:
– port: 3306
​
—
​
apiVersion: v1
kind: Service
metadata:
name: harbor-mysql
spec:
type: ClusterIP
ports:
– port: 3306
​
​
—
​
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-wordpress
spec:
replicas: 1
selector:
matchLabels:
apps: wp
template:
metadata:
labels:
apps: wp
spec:
restartPolicy: Always
containers:
– name: c1
image: harbor.ysl.com/wordpress/wordpress:6.7.1-php8.1-apache
ports:
– containerPort: 80
env:
– name: WORDPRESS_DB_HOST
value: harbor-mysql
– name: WORDPRESS_DB_NAME
value: ceshi
– name: WORDPRESS_DB_USER
value: test
– name: WORDPRESS_DB_PASSWORD
value: “123456”
volumeMounts:
– name: datetime
mountPath: /etc/localtime
– name: data
mountPath: /var/www/html
volumes:
– name: data
persistentVolumeClaim:
claimName: pvc-wp
– name: datetime
hostPath:
path: /etc/localtime
​
—
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: pvc-wp
spec:
storageClassName: nfs-csi
accessModes:
– ReadWriteMany
resources:
limits:
storage: 500Mi
requests:
storage: 200Mi
​
—
​
apiVersion: v1
kind: Service
metadata:
name: svc-wp
namespace: default
spec:
type: LoadBalancer
selector:
apps: wp
ports:
– port: 80
[root@master231 v3]#
​
38 kube-proxy
– kube-proxy的底层工作方式
– iptables：
随着规则的增多效率会降低。

– ipvs (推荐)
在读取规则时，其时间复杂度更低，性能更高，生产推荐使用。

root@master231:~/manifests/coreDNS# kubectl -n kube-system get ds kube-proxy -o yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
annotations:
deprecated.daemonset.template.generation: “1”
creationTimestamp: “2025-04-04T11:30:50Z”
generation: 1
labels:
k8s-app: kube-proxy
name: kube-proxy
namespace: kube-system
resourceVersion: “605353”
uid: e22a01ce-6250-4c2f-ab4f-b456c638d9af
spec:
revisionHistoryLimit: 10
selector:
matchLabels:
k8s-app: kube-proxy
template:
metadata:
creationTimestamp: null
labels:
k8s-app: kube-proxy
spec:
containers:
– command:
– /usr/local/bin/kube-proxy
– –config=/var/lib/kube-proxy/config.conf
– –hostname-override=$(NODE_NAME)
env:
– name: NODE_NAME
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: spec.nodeName
image: registry.aliyuncs.com/google_containers/kube-proxy:v1.23.17
imagePullPolicy: IfNotPresent
name: kube-proxy
resources: {}
securityContext:
privileged: true
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
volumeMounts:
– mountPath: /var/lib/kube-proxy
name: kube-proxy
– mountPath: /run/xtables.lock
name: xtables-lock
– mountPath: /lib/modules
name: lib-modules
readOnly: true
dnsPolicy: ClusterFirst
hostNetwork: true
nodeSelector:
kubernetes.io/os: linux
priorityClassName: system-node-critical
restartPolicy: Always
schedulerName: default-scheduler
securityContext: {}
serviceAccount: kube-proxy
serviceAccountName: kube-proxy
terminationGracePeriodSeconds: 30
tolerations:
– operator: Exists
volumes:
– configMap:
defaultMode: 420
name: kube-proxy
name: kube-proxy
– hostPath:
path: /run/xtables.lock
type: FileOrCreate
name: xtables-lock
– hostPath:
path: /lib/modules
type: “”
name: lib-modules
updateStrategy:
rollingUpdate:
maxSurge: 0
maxUnavailable: 1
type: RollingUpdate
status:
currentNumberScheduled: 3
desiredNumberScheduled: 3
numberAvailable: 3
numberMisscheduled: 0
numberReady: 3
observedGeneration: 1
updatedNumberScheduled: 3
root@master231:~/manifests/coreDNS#
​
root@master231:~/manifests/coreDNS# kubectl -n kube-system get cm kube-proxy -o yaml
apiVersion: v1
data:
config.conf: |-
apiVersion: kubeproxy.config.k8s.io/v1alpha1
bindAddress: 0.0.0.0
bindAddressHardFail: false
clientConnection:
acceptContentTypes: “”
burst: 0
contentType: “”
kubeconfig: /var/lib/kube-proxy/kubeconfig.conf
qps: 0
clusterCIDR: 10.100.0.0/16
configSyncPeriod: 0s
conntrack:
maxPerCore: null
min: null
tcpCloseWaitTimeout: null
tcpEstablishedTimeout: null
detectLocalMode: “”
enableProfiling: false
healthzBindAddress: “”
hostnameOverride: “”
iptables:
masqueradeAll: false
masqueradeBit: null
minSyncPeriod: 0s
syncPeriod: 0s
ipvs:
excludeCIDRs: null
minSyncPeriod: 0s
scheduler: “”
strictARP: true
syncPeriod: 0s
tcpFinTimeout: 0s
tcpTimeout: 0s
udpTimeout: 0s
kind: KubeProxyConfiguration
metricsBindAddress: “”
mode: “ipvs”
nodePortAddresses: null
oomScoreAdj: null
portRange: “”
showHiddenMetricsForVersion: “”
udpIdleTimeout: 0s
winkernel:
enableDSR: false
networkName: “”
sourceVip: “”
kubeconfig.conf: |-
apiVersion: v1
kind: Config
clusters:
– cluster:
certificate-authority: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
server: https://10.0.0.231:6443
name: default
contexts:
– context:
cluster: default
namespace: default
user: default
name: default
current-context: default
users:
– name: default
user:
tokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
kind: ConfigMap
metadata:
annotations:
kubeadm.kubernetes.io/component-config.hash: sha256:aeeb159f672e219d96aa2cc4017cc8f204922445a7014c4c3e9118fe44b87345
kubectl.kubernetes.io/last-applied-configuration: |
{“apiVersion”:”v1″,”data”:{“config.conf”:”apiVersion: kubeproxy.config.k8s.io/v1alpha1\nbindAddress: 0.0.0.0\nbindAddressHardFail: false\nclientConnection:\n acceptContentTypes: \”\”\n burst: 0\n contentType: \”\”\n kubeconfig: /var/lib/kube-proxy/kubeconfig.conf\n qps: 0\nclusterCIDR: 10.100.0.0/16\nconfigSyncPeriod: 0s\nconntrack:\n maxPerCore: null\n min: null\n tcpCloseWaitTimeout: null\n tcpEstablishedTimeout: null\ndetectLocalMode: \”\”\nenableProfiling: false\nhealthzBindAddress: \”\”\nhostnameOverride: \”\”\niptables:\n masqueradeAll: false\n masqueradeBit: null\n minSyncPeriod: 0s\n syncPeriod: 0s\nipvs:\n excludeCIDRs: null\n minSyncPeriod: 0s\n scheduler: \”\”\n strictARP: true\n syncPeriod: 0s\n tcpFinTimeout: 0s\n tcpTimeout: 0s\n udpTimeout: 0s\nkind: KubeProxyConfiguration\nmetricsBindAddress: \”\”\nmode: \”ipvs\”\nnodePortAddresses: null\noomScoreAdj: null\nportRange: \”\”\nshowHiddenMetricsForVersion: \”\”\nudpIdleTimeout: 0s\nwinkernel:\n enableDSR: false\n networkName: \”\”\n sourceVip: \”\””,”kubeconfig.conf”:”apiVersion: v1\nkind: Config\nclusters:\n- cluster:\n certificate-authority: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt\n server: https://10.0.0.231:6443\n name: default\ncontexts:\n- context:\n cluster: default\n namespace: default\n user: default\n name: default\ncurrent-context: default\nusers:\n- name: default\n user:\n tokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token”},”kind”:”ConfigMap”,”metadata”:{“annotations”:{“kubeadm.kubernetes.io/component-config.hash”:”sha256:aeeb159f672e219d96aa2cc4017cc8f204922445a7014c4c3e9118fe44b87345″},”creationTimestamp”:”2025-04-04T11:30:50Z”,”labels”:{“app”:”kube-proxy”},”name”:”kube-proxy”,”namespace”:”kube-system”,”resourceVersion”:”238″,”uid”:”0b0fc09d-780d-4d1e-9737-0a09a020c5e8″}}
creationTimestamp: “2025-04-04T11:30:50Z”
labels:
app: kube-proxy
name: kube-proxy
namespace: kube-system
resourceVersion: “605097”
uid: 0b0fc09d-780d-4d1e-9737-0a09a020c5e8
root@master231:~/manifests/coreDNS#
​
​
39 sts有状态服务
1.sts控制器
K8S 1.9+引入，主要作用就是部署有状态服务，自带特性:
– 1.每个Pod有独立的存储;
– 2.每个Pod有唯一的网络标识;
– 3.有顺序的启动和停止Pod;
所谓的有状态服务，指的是服务在启动时逻辑并不相同，比如部署MySQL主从，第一个启动更多Pod逻辑和第二个Pod启动逻辑并不相通。
​
​
2 sts部署mysql主从
root@master231:~/manifests/mysql-master-slave# cat 01-cm-mysql.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: mysql80
data:
master.cnf: |
[mysqld]
server_id=111
skip-host-cache
skip-name-resolve
log-bin
character-set-server=utf8mb4
datadir=/var/lib/mysql
socket=/var/run/mysqld/mysqld.sock
secure-file-priv=/var/lib/mysql-files
user=mysql
pid-file=/var/run/mysqld/mysqld.pid