configmap概述：數據會存儲在etcd數據庫，其應用場景主要在應用程序的配置
configmap支持的類型（1）鍵值對（2）多行數據
pod使用configmap資源有兩種常見的方式（1）變量注入（2）數據卷掛載
推薦閱讀
https://kubernetes.io/docs/concepts/storage/volumes/
https://kubernetes.io/docs/concepts/configuration/configmap/聲明式創建cm資源
[ root@master231 configmaps]
apiVersion: v1
kind: ConfigMap
metadata:name: game-demo
data:player_initial_lives: "3" ui_properties_file_name: "user-interface.properties" school: oldboyeduclass: linux94game.properties: | enemy.types = aliens,monstersplayer.maximum-lives= 5 user-interface.properties: | color.good = purplecolor.bad = yellowallow.textmode = true my.cnf: | [ mysqld] datadir = /var/lib/mysqlbasedir = /usr/local/mysqlsocket = /tpm/mysql.sockskip-name-resolve= 1 port = 3306 [ client] username = adminpassword = oldboyedu 創建
root@ubuntu0:~/manifests/configmap
configmap/game-demo created查看
root@ubuntu0:~/manifests/configmap
NAME DATA AGE
game-demo 7 29s
kube-root-ca.crt 1 23d
root@ubuntu0:~/manifests/configmap
NAME DATA AGE
game-demo 7 33s 刪除
root@ubuntu0:~/manifests/configmap
configmap "game-demo" deleted響應式創建
root@ubuntu0:~/manifests/configmap
configmap/xp created
root@ubuntu0:~/manifests/configmap
NAME DATA AGE
kube-root-ca.crt 1 23d
xp 2 6s
root@ubuntu0:~/manifests/configmap
NAME DATA AGE
xp 2 8sroot@ubuntu0:~/manifests/configmap
Name: xp
Namespace: default
Labels: < none>
Annotations: < none> Data
== ==
class:
----
linux94
school:
----
oldboyeduBinaryData
== == Events: < none> 基于配置文件創建cm[ root@master231 configmaps]
-rw-r--r-- 1 root root 4406 Nov 15 17 :40 /root/kube-flannel.yml
[ root@master231 configmaps]
[ root@master231 configmaps]
configmap/oldboyedu-cni created3.3 查看cm資源
[ root@master231 configmaps]
NAME DATA AGE
oldboyedu-cni 1 8s
[ root@master231 configmaps]
[ root@master231 configmaps]
[ root@master231 configmaps]
[ root@master231 configmaps]
[ root@master231 configmaps]
[ root@master231 configmaps] 3.3 刪除cm資源
[ root@master231 configmaps]
NAME DATA AGE
kube-root-ca.crt 1 4d16h
oldboyedu-cni 1 2m27s
oldboyedu-linux94 2 4m38s
[ root@master231 configmaps]
[ root@master231 configmaps]
configmap "oldboyedu-cni" deleted
[ root@master231 configmaps]
[ root@master231 configmaps]
NAME DATA AGE
kube-root-ca.crt 1 4d16h
oldboyedu-linux94 2 5m9s
[ root@master231 configmaps] root@ubuntu0:~/manifests/configmap
apiVersion: v1
data:class: linux94school: oldboyedu
kind: ConfigMap
metadata:creationTimestamp: "2025-05-02T10:49:39Z" name: xpnamespace: defaultresourceVersion: "670826" uid: b129e625-7733-4b80-9d9f-55227b473f51那如何在聲明式中引用這個key：vlaue呢
root@ubuntu0:~/manifests/configmap
apiVersion: v1
kind: ReplicationController
metadata:name: xp-configmap
spec:replicas: 1 selector:apps: v1template:metadata:labels:apps: v1spec:nodeName: ubuntu1containers:- name: xiuxian-v1image: registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:v1env:- name: SCHOOLvalueFrom:configMapKeyRef:name: "xp" key: "school" - name: CLassvalueFrom:configMapKeyRef:name: "xp" key: "class"
root@ubuntu0:~/manifests/configmap
replicationcontroller/xp-configmap created
root@ubuntu0:~/manifests/configmap
SCHOOL = oldboyedu
CLass = linux94root@ubuntu0:~/manifests/configmap
apiVersion: v1
kind: ReplicationController
metadata:name: xpxp
spec:replicas: 1 selector: apps: xpxp-v1template:metadata:labels:apps: xpxp-v1spec:nodeName: ubuntu1volumes:- name: dataconfigMap:name: "xp" items:- key: school path: school.txtcontainers:- name: nginximage: registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:v1volumeMounts:- name: datamountPath: /oldboyeduroot@ubuntu0:~/manifests/configmap
replicationcontroller/xpxp created
root@ubuntu0:~/manifests/configmap
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
xpxp-25pwf 1 /1 Running 0 25m 10.100 .2.19 ubuntu1 < none> < none>
root@ubuntu0:~/manifests/configmap
school.txt
root@ubuntu0:~/manifests/configmap
oldboyeduroot@ubuntu0:~/manifests/configmap將"registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:v1" 鏡像的80端口修改為81端口，要求在不重新打鏡像的情況下，使用cm存儲卷的方式掛載。1 .找到nginx的配置文件
root@ubuntu0:~/manifests/configmap
/
/
/etc/nginx/conf.d/default.conf
/
server { listen 80 ; listen [ ::] :80; server_name localhost; location / { root /usr/share/nginx/html; index index.html index.htm; } error_page 500 502 503 504 /50x.html; location = /50x.html { root /usr/share/nginx/html; } }
2 .編寫資源清單root@ubuntu0:~/manifests/configmap
apiVersion: v1
kind: ConfigMap
metadata:name: game-cm
data:port.conf: | server { listen 81 ; listen [ ::] :81; server_name localhost; location / { root /usr/share/nginx/html; index index.html index.htm; } error_page 500 502 503 504 /50x.html; location = /50x.html { root /usr/share/nginx/html; } }
---
apiVersion: v1
kind: ReplicationController
metadata:name: xiuxian-cm
spec:replicas: 1 selector: apps: xpxp-v1template:metadata:labels:apps: xpxp-v1spec:nodeName: ubuntu1volumes:- name: dataconfigMap:name: "game-cm" items:- key: port.confpath: default.confcontainers:- name: nginximage: registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:v1volumeMounts:- name: datamountPath: /etc/nginx/conf.d/
---
apiVersion: v1
kind: Service
metadata:name: svc-mysql
spec:type: NodePortselector:apps: xpxp-v1ports:- port: 80 targetPort: 81 nodePort: 30081
root@ubuntu0:~/manifests/configmap
configmap/game-cm created
replicationcontroller/xiuxian-cm created
service/svc-mysql created
root@ubuntu0:~/manifests/configmap
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
xiuxian-cm-b52m2 1 /1 Running 0 7s 10.100 .2.21 ubuntu1 < none> < none>
root@ubuntu0:~/manifests/configmap
kubernetes svc-mysql
root@ubuntu0:~/manifests/configmap
Name: svc-mysql
Namespace: default
Labels: < none>
Annotations: < none>
Selector: apps = xpxp-v1
Type: NodePort
IP Family Policy: SingleStack
IP Families: IPv4
IP: 192.168 .116.228
IPs: 192.168 .116.228
Port: < unset> 80 /TCP
TargetPort: 81 /TCP
NodePort: < unset> 30081 /TCP
Endpoints: 10.100 .2.21:81
Session Affinity: None
External Traffic Policy: Cluster
Events: < none>
root@ubuntu0:~/manifests/configmap
< ! DOCTYPE html>
< html> < head> < meta charset = "utf-8" /> < title> yinzhengjie apps v1 <> < style> div img { width: 900px; height: 600px; margin: 0 ; } < /style> < /head> < body> < h1 style = "color: green" > 凡人修仙傳 v1 < /h1 >< div> < img src = "1.jpg" > < div> < /body> < /html> 在進入容器內，已經發生改變了
root@ubuntu0:~/manifests/configmap
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
xiuxian-cm-b52m2 1 /1 Running 0 2m38s 10.100 .2.21 ubuntu1 < none> < none>
root@ubuntu0:~/manifests/configmap
/
server { listen 81 ; listen [ ::] :81; server_name localhost; location / { root /usr/share/nginx/html; index index.html index.htm; } error_page 500 502 503 504 /50x.html; location = /50x.html { root /usr/share/nginx/html; } } 1 .實時查看日志
[ root@master231 ~]
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
oldboyedu-xiuxian-cm-844zl 1 /1 Running 0 4m47s 10.100 .1.55 worker232 < none> < none>
[ root@master231 ~]
[ root@master231 ~]
/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
10 -listen-on-ipv6-by-default.sh: info: can not modify /etc/nginx/conf.d/default.conf ( read-only file system?)
/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh
/docker-entrypoint.sh: Configuration complete; ready for start up
2024 /11/20 03:10:00 [ notice] 1
2024 /11/20 03:10:00 [ notice] 1
2024 /11/20 03:10:00 [ notice] 1
2024 /11/20 03:10:00 [ notice] 1
2024 /11/20 03:10:00 [ notice] 1
2024 /11/20 03:10:00 [ notice] 1
2024 /11/20 03:10:00 [ notice] 1
2024 /11/20 03:10:00 [ notice] 1
10.100 .0.0 - - [ 20 /Nov/2024:03:10:08 +0000] "GET / HTTP/1.1" 200 357 "-" "curl/7.81.0" "-"
10.100 .0.0 - - [ 20 /Nov/2024:03:10:13 +0000] "GET / HTTP/1.1" 200 357 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-"
10.100 .0.0 - - [ 20 /Nov/2024:03:10:13 +0000] "GET /1.jpg HTTP/1.1" 200 233472 "http://10.0.0.231:30080/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-"
2024 /11/20 03:10:13 [ error] 24
10.100 .0.0 - - [ 20 /Nov/2024:03:10:13 +0000] "GET /favicon.ico HTTP/1.1" 404 555 "http://10.0.0.231:30080/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" 2 .查看最近5min的日志
[ root@master231 ~]
2024 /11/20 03:16:22 [ error] 24
10.100 .0.0 - - [ 20 /Nov/2024:03:16:22 +0000] "GET /oldboyedu.html HTTP/1.1" 404 153 "-" "curl/7.81.0" "-" 3 .查看指定容器的日志（一般情況下是一個Pod有多個容器時才會使用）
[ root@master231 ~]
2024 /11/20 03:16:22 [ error] 24
10.100 .0.0 - - [ 20 /Nov/2024:03:16:22 +0000] "GET /oldboyedu.html HTTP/1.1" 404 153 "-" "curl/7.81.0" "-"
root@ubuntu0:~/manifests/configmap
apiVersion: v1
kind: ConfigMap
metadata:name: game-cm
data:main.conf: | user nginx; worker_processes auto; error_log /var/log/nginx/error.log notice; pid /var/run/nginx.pid; events { worker_connections 1024 ; } http { include /etc/nginx/mime.types; default_type application/octet-stream; log_format oldboyedu_nginx_json '{"@timestamp":"$time_iso8601",' '"host":"$server_addr",' '"clientip":"$remote_addr",' '"SendBytes":$body_bytes_sent,' '"responsetime":$request_time,' '"upstreamtime":"$upstream_response_time",' '"upstreamhost":"$upstream_addr",' '"http_host":"$host",' '"uri":"$uri",' '"domain":"$host",' '"xff":"$http_x_forwarded_for",' '"referer":"$http_referer",' '"tcp_xff":"$proxy_protocol_addr",' '"http_user_agent":"$http_user_agent",' '"status":"$status"}' ; access_log /var/log/nginx/access.log oldboyedu_nginx_json; sendfile on; keepalive_timeout 65 ; include /etc/nginx/conf.d/*.conf; } port.conf: | server { listen 81 ; listen [ ::] :81; server_name localhost; location / { root /usr/share/nginx/html; index index.html index.htm; } error_page 500 502 503 504 /50x.html; location = /50x.html { root /usr/share/nginx/html; } }
---
apiVersion: v1
kind: ReplicationController
metadata:name: xiuxian-cm
spec:replicas: 1 selector: apps: xpxp-v1template:metadata:labels:apps: xpxp-v1spec:nodeName: ubuntu1volumes:- name: dataconfigMap:name: "game-cm" items:- key: port.confpath: default.conf- name: data1configMap:name: "game-cm" items:- key: main.confpath: nginx.conf containers:- name: nginximage: registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:v1volumeMounts:- name: datamountPath: /etc/nginx/conf.d/- name: data1mountPath: /etc/nginx/nginx.confsubPath: nginx.conf
---
apiVersion: v1
kind: Service
metadata:name: svc-mysql
spec:type: NodePortselector:apps: xpxp-v1ports:- port: 80 targetPort: 81 nodePort: 30081 root@ubuntu0:~/manifests/configmap
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
xiuxian-cm-8q45n 1 /1 Running 0 7s 10.100 .2.22 ubuntu1 < none> < none>
root@ubuntu0:~/manifests/configmap
< ! DOCTYPE html>
< html> < head> < meta charset = "utf-8" /> < title> yinzhengjie apps v1 <> < style> div img { width: 900px; height: 600px; margin: 0 ; } < /style> < /head> < body> < h1 style = "color: green" > 凡人修仙傳 v1 < /h1 >< div> < img src = "1.jpg" > < div> < /body> < /html> root@ubuntu0:~/manifests/ReplicationController
apiVersion: v1
kind: ConfigMap
metadata:name: game-demo
data:master.cnf: | [ mysqld] log-bin= mysqllog-binserver_id = 111 skip-host-cacheskip-name-resolvedatadir = /var/lib/mysqlsocket = /var/run/mysqld/mysqld.socksecure-file-priv= /var/lib/mysql-filesuser = mysqlpid-file= /var/run/mysqld/mysqld.pid[ client] socket = /var/run/mysqld/mysqld.sock ! includedir /etc/mysql/conf.d/slave.cnf: | [ mysqld] log-bin= mysqllog-binserver_id = 222 skip-host-cacheskip-name-resolvedatadir = /var/lib/mysqlsocket = /var/run/mysqld/mysqld.socksecure-file-priv= /var/lib/mysql-filesuser = mysqlpid-file= /var/run/mysqld/mysqld.pid[ client] socket = /var/run/mysqld/mysqld.sock ! includedir /etc/mysql/conf.d/
---
apiVersion: v1
kind: ReplicationController
metadata:name: mysql-master
spec:replicas: 1 selector:apps: v1 template:spec:nodeName: ubuntu1volumes:- name: datanfs:server: ubuntu0path: /oldboyedu/data/nfs-server/master-lib - name: data1configMap:name: "game-demo" items:- key: master.cnfpath: my.cnf containers:- name: mysql-v1image: mysql:5.7.29ports:- containerPort: 3306 name: mysqlportenv:- name: MYSQL_ALLOW_EMPTY_PASSWORDvalue: "yes" - name: MYSQL_USERvalue: linux94- name: MYSQL_PASSWORDvalue: 'oldboyedu' volumeMounts:- name: datamountPath: /var/lib/mysql- name: data1mountPath: /etc/my.cnfsubPath: my.cnfargs:- --character-set-server= utf8- --collation-server= utf8_bin- --default-authentication-plugin= mysql_native_passwordmetadata:labels:apps: v1
---
apiVersion: v1
kind: Service
metadata:name: svc-mysql
spec:selector:apps: v1ports:- port: 3306 name: mysqlport
---apiVersion: v1
kind: ReplicationController
metadata:name: mysql-slave
spec:replicas: 1 selector:apps: v2template:spec:nodeName: ubuntu1volumes:- name: datanfs:server: ubuntu0path: /oldboyedu/data/nfs-server/slave-lib - name: data1configMap:name: "game-demo" items:- key: slave.cnfpath: my.cnf containers:- name: mysql-v2image: mysql:5.7.29env:- name: MYSQL_ALLOW_EMPTY_PASSWORDvalue: "yes" - name: MYSQL_MASTER_HOSTvalue: 'svc-mysql' ports:- containerPort: 3306 volumeMounts:- name: datamountPath: /var/lib/mysql- name: data1mountPath: /etc/my.cnfsubPath: my.cnfmetadata:labels:apps: v2
---
apiVersion: v1
kind: Service
metadata:name: svc-slave
spec:selector:apps: v2ports:- port: 3306 進入主數據庫查看
root@ubuntu0:~/manifests/ReplicationController
Welcome to the MySQL monitor. Commands end with ; or \ g.
Your MySQL connection id is 2
Server version: 5.7 .29-log MySQL Community Server ( GPL) Copyright ( c) 2000 , 2020 , Oracle and/or its affiliates. All rights reserved.Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.授權用戶訪問
mysql> GRANT Replication slave ON *.* TO linux94;
Query OK, 0 rows affected ( 0.00 sec) mysql> SHOW MASTER STATUS\ G
*************************** 1 . row ***************************File: mysqllog-bin.000004Position: 353 Binlog_Do_DB: Binlog_Ignore_DB:
Executed_Gtid_Set:
1 row in set ( 0.00 sec) mysql> SHOW GRANTS FOR linux94;
+-------------------------------------------------+
| Grants for linux94@% |
+-------------------------------------------------+
| GRANT REPLICATION SLAVE ON *.* TO 'linux94' @'%' |
+-------------------------------------------------+從庫配置
mysql> CHANGE MASTER TO MASTER_HOST = 'svc-mysql' ,MASTER_USER= 'linux94' ,MASTER_PASSWORD= 'oldboyedu' ,MASTER_PORT= 3306 ,MASTER_LOG_FILE= 'mysqllog-bin.000004' ,MASTER_LOG_POS= 353 ,MASTER_CONNECT_RETRY= 3 ;
Query OK, 0 rows affected, 2 warnings ( 0.04 sec) mysql> STOP SLAVE;
Query OK, 0 rows affected, 1 warning ( 0.00 sec) mysql> START SLAVE;
Query OK, 0 rows affected ( 0.00 sec) mysql> SHOW SLAVE STATUS\ G
*************************** 1 . row ***************************Slave_IO_State: Waiting for master to send eventMaster_Host: svc-mysqlMaster_User: linux94Master_Port: 3306 Connect_Retry: 3 Master_Log_File: mysqllog-bin.000004Read_Master_Log_Pos: 353 Relay_Log_File: mysql-slave-2pgsd-relay-bin.000002Relay_Log_Pos: 323 Relay_Master_Log_File: mysqllog-bin.000004Slave_IO_Running: YesSlave_SQL_Running: Yes與ConfigMap類似，區別在于secret存儲敏感數據，所有的數據都需要經過base64進行編碼。
使用secret主要存儲的是憑據信息。參考鏈接:https://kubernetes.io/zh/docs/concepts/configuration/secret/secret資源聲明式兩種創建方式2.1 方式一: 基于stringData方式（推薦）
root@ubuntu0:~/manifests/secret
apiVersion: v1
kind: Secret
metadata:name: user-info
stringData:username: adminpassword: "1" my.cnf: | [ mysqld] basedir = /oldboyedu/softwares/mysql80port = 3306 datadir = /oldboyedu/data/mysql80socket = /tmp/mysql80.sock
root@ubuntu0:~/manifests/secret
secret/user-info created
root@ubuntu0:~/manifests/secretNAME TYPE DATA AGE
default-token-hszqs kubernetes.io/service-account-token 3 26d
user-info Opaque 3 7s
root@ubuntu0:~/manifests/secret
NAME TYPE DATA AGE
user-info Opaque 3 46s
root@ubuntu0:~/manifests/secret
Name: user-info
Namespace: default
Labels: < none>
Annotations: < none> Type: OpaqueData
== ==
my.cnf: 113 bytes
password: 1 bytes
username: 5 bytes
root@ubuntu0:~/manifests/secret
apiVersion: v1
data:my.cnf: W215c3FsZF0KYmFzZWRpcj0vb2xkYm95ZWR1L3NvZnR3YXJlcy9teXNxbDgwCnBvcnQ9MzMwNgpkYXRhZGlyPS9vbGRib3llZHUvZGF0YS9teXNxbDgwCnNvY2tldD0vdG1wL215c3FsODAuc29jawo = password: MQ == username: YWRtaW4 =
kind: Secret
metadata:annotations:kubectl.kubernetes.io/last-applied-configuration: | { "apiVersion" : "v1" ,"kind" : "Secret" ,"metadata" :{ "annotations" :{ } ,"name" : "user-info" ,"namespace" : "default" } ,"stringData" :{ "my.cnf" : "[mysqld]\n basedir=/oldboyedu/softwares/mysql80\n port=3306\n datadir=/oldboyedu/data/mysql80\n socket=/tmp/mysql80.sock\n " ,"password" : "1" ,"username" : "admin" } } creationTimestamp: "2025-05-05T02:16:24Z" name: user-infonamespace: defaultresourceVersion: "815355" uid: 90653274 -1030-4208-a555-032c6484029f
type: Opaque解密：
root@ubuntu0:~/manifests/secret
DAuc29jawo = '|base64 -d
[mysqld]
basedir=/oldboyedu/softwares/mysql80
port=3306
datadir=/oldboyedu/data/mysql80
socket=/tmp/mysql80.sock
root@ubuntu0:~/manifests/secret# echo ' MQ == '|base64 -d
1root@ubuntu0:~/manifests/secret# echo ' MQ == '| base64 -d| more
1 方式二: 基于方式（不推薦，編寫時容易出錯）
root@ubuntu0:~/manifests/secret
bGludXg5NAo =
root@ubuntu0:~/manifests/secret
b2xkYm95ZWR1Cg ==
root@ubuntu0:~/manifests/secret
apiVersion: v1
kind: Secret
metadata:name: admin
data:username: bGludXg5NAo = password: b2xkYm95ZWR1Cg ==
root@ubuntu0:~/manifests/secret
bGludXg5NAo =
root@ubuntu0:~/manifests/secret
b2xkYm95ZWR1Cg ==
root@ubuntu0:~/manifests/secret
apiVersion: v1
kind: Secret
metadata:name: admin
data:username: bGludXg5NAo = password: b2xkYm95ZWR1Cg ==
root@ubuntu0:~/manifests/secret
secret/admin created
root@ubuntu0:~/manifests/secret
NAME TYPE DATA AGE
admin Opaque 2 6s
root@ubuntu0:~/manifests/secret
apiVersion: v1
data:password: b2xkYm95ZWR1Cg == username: bGludXg5NAo =
kind: Secret
metadata:annotations:kubectl.kubernetes.io/last-applied-configuration: | { "apiVersion" : "v1" ,"data" :{ "password" : "b2xkYm95ZWR1Cg==" ,"username" : "bGludXg5NAo=" } ,"kind" : "Secret" ,"metadata" :{ "annotations" :{ } ,"name" : "admin" ,"namespace" : "default" } } creationTimestamp: "2025-05-05T02:21:09Z" name: adminnamespace: defaultresourceVersion: "815756" uid: 4e62f0f6-1940-43f7-b81c-16278cda898d
type: Opaqueroot@ubuntu0:~/manifests/secret
secret/test01 created
root@ubuntu0:~/manifests/secret
secret/test02 created
root@ubuntu0:~/manifests/secret
NAME TYPE DATA AGE
test01 Opaque 2 20s
test02 Opaque 2 9s
root@ubuntu0:~/manifests/secret
apiVersion: v1
items:
- apiVersion: v1data:SCHOOL: b2xkYm95ZWR1class: bGludXg5NA == kind: Secretmetadata:creationTimestamp: "2025-05-05T02:39:39Z" name: test01namespace: defaultresourceVersion: "817317" uid: 9255edec-24db-4490-a8b3-d0951b21c470type: Opaque
- apiVersion: v1data:Data: YXBpVmVyc2lvbjogdjEKa2luZDogU2VjcmV0Cm1ldGFkYXRhOgogIG5hbWU6IGFkbWluCmRhdGE6CiAgIyBLRVnml6DpnIDlgZrku7vkvZXmk43kvZzvvIxWQUxVRei/m+ihjEJBU0U2NOaJi+WKqOe8lueggQogIHVzZXJuYW1lOiBiR2x1ZFhnNU5Bbz0KICBwYXNzd29yZDogYjJ4a1ltOTVaV1IxQ2c9PQo= stringData: YXBpVmVyc2lvbjogdjEKa2luZDogU2VjcmV0Cm1ldGFkYXRhOgogIG5hbWU6IHVzZXItaW5mbwpzdHJpbmdEYXRhOgogIHVzZXJuYW1lOiBhZG1pbgogIHBhc3N3b3JkOiAiMSIKCiAgbXkuY25mOiB8CiAgICBbbXlzcWxkXQogICAgYmFzZWRpcj0vb2xkYm95ZWR1L3NvZnR3YXJlcy9teXNxbDgwCiAgICBwb3J0PTMzMDYKICAgIGRhdGFkaXI9L29sZGJveWVkdS9kYXRhL215c3FsODAKICAgIHNvY2tldD0vdG1wL215c3FsODAuc29jawo = kind: Secretmetadata:creationTimestamp: "2025-05-05T02:39:50Z" name: test02namespace: defaultresourceVersion: "817332" uid: b1476fdd-5182-426d-a784-7ee5b16342c1type: Opaque
kind: List
metadata:resourceVersion: "" selfLink: ""
root@ubuntu0:~/manifests/secret
secret "test01" deleted
secret "test02" deleted基于環境變量引入1 .先查看一下user-info的變量
root@ubuntu0:~/manifests/secret
NAME TYPE DATA AGE
user-info Opaque 3 4d21h
root@ubuntu0:~/manifests/secret
apiVersion: v1
data:my.cnf: W215c3FsZF0KYmFzZWRpcj0vb2xkYm95ZWR1L3NvZnR3YXJlcy9teXNxbDgwCnBvcnQ9MzMwNgpkYXRhZGlyPS9vbGRib3llZHUvZGF0YS9teXNxbDgwCnNvY2tldD0vdG1wL215c3FsODAuc29jawo = password: MQ == username: YWRtaW4 =
kind: Secret2 .基于環境變量引入root@ubuntu0:~/manifests/secret
apiVersion: v1
kind: ReplicationController
metadata:name: secret-env
spec:replicas: 1 selector:apps: v1template:metadata:labels:apps: v1spec:nodeName: ubuntu1containers:- name: xpimage: registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:v1env:- name: env_usernamevalueFrom:secretKeyRef:name: user-infokey: username- name: env_mycnfvalueFrom:secretKeyRef:name: user-infokey: my.cnf
root@ubuntu0:~/manifests/secret
replicationcontroller/secret-env created
root@ubuntu0:~/manifests/secret
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
mysql-master-4zxp6 1 /1 Running 0 5d 10.100 .2.30 ubuntu1 < none> < none>
mysql-slave-2pgsd 1 /1 Running 0 5d 10.100 .2.29 ubuntu1 < none> < none>
secret-env-78xjs 1 /1 Running 0 29s 10.100 .2.32 ubuntu1 < none> < none>
查看環境變量，他會自動的解密
root@ubuntu0:~/manifests/secret
env_username = admin
env_mycnf = [ mysqld]
basedir = /oldboyedu/softwares/mysql80
port = 3306
datadir = /oldboyedu/data/mysql80
socket = /tmp/mysql80.sock基于存儲卷的方式引用
root@ubuntu0:~/manifests/secret
apiVersion: v1
kind: ReplicationController
metadata:name: oldboyedu-rc-nfs-v1
spec:replicas: 1 selector:apps: v1template:metadata:labels:apps: v1spec:nodeName: ubuntu1volumes:- name: datasecret: secretName: user-infoitems:- key: usernamepath: username.txt- key: passwordpath: password.txt- key: my.cnfpath: my.cnfcontainers:- name: nginximage: registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:v1 volumeMounts:- name: datamountPath: /oldboyeduroot@ubuntu0:~/manifests/secret
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
mysql-master-4zxp6 1 /1 Running 0 5d 10.100 .2.30 ubuntu1 < none> < none>
mysql-slave-2pgsd 1 /1 Running 0 5d 10.100 .2.29 ubuntu1 < none> < none>
oldboyedu-rc-nfs-v1-5cx5d 1 /1 Running 0 8s 10.100 .2.33 ubuntu1 < none> < none>
root@ubuntu0:~/manifests/secret
/
total 0
lrwxrwxrwx 1 root root 13 May 10 00:42 my.cnf -> .. data/my.cnf
lrwxrwxrwx 1 root root 19 May 10 00:42 password.txt -> .. data/password.txt
lrwxrwxrwx 1 root root 19 May 10 00:42 username.txt -> .. data/username.txt
/
[ mysqld]
basedir = /oldboyedu/softwares/mysql80
port = 3306
datadir = /oldboyedu/data/mysql80
socket = /tmp/mysql80.sock1 .響應式創建harbor的認證信息
[ root@master231 case-demo]
secret/oldboyedu-harbor created
[ root@master231 case-demo]
NAME TYPE DATA AGE
oldboyedu-harbor kubernetes.io/dockerconfigjson 1 9s2 .創建測試
[ root@master231 case-demo]
apiVersion: v1
kind: ReplicationController
metadata:name: oldboyedu-private-harbor
spec:replicas: 3 selector:apps: linuxtemplate:spec:imagePullSecrets:- name: oldboyedu-harborcontainers:- name: c1image: harbor.oldboyedu.com/oldboyedu-linux/alpine:latestimagePullPolicy: Alwaysstdin: true metadata:labels:apps: linux
[ root@master231 case-demo]
[ root@master231 case-demo]
replicationcontroller/oldboyedu-private-harbor created
[ root@master231 case-demo]
[ root@master231 case-demo]
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
oldboyedu-private-harbor-f7hmj 1 /1 Running 0 4s 10.100 .1.64 worker232 < none> < none>
oldboyedu-private-harbor-gkmtm 1 /1 Running 0 4s 10.100 .2.120 worker233 < none> < none>
oldboyedu-private-harbor-pmf5q 1 /1 Running 0 4s 10.100 .2.119 worker233 < none> < none>
[ root@master231 case-demo] 1 .harbor創建用戶名和密碼 用戶名稱: linux94 密碼: Linux@2024郵箱: linux94@oldboyedu.com 2 .對認證信息進行base64編碼[ root@master231 case-demo] bGludXg5NDpMaW51eEAyMDI0[ root@master231 case-demo]
3 .得到最終的認證信息:{ "auths" :{ "harbor.oldboyedu.com" :{ "username" : "linux94" ,"password" : "Linux@2024" ,"email" : "linux94@oldboyedu.com" ,"auth" : "bGludXg5NDpMaW51eEAyMDI0" } } } 4 .編寫資源清單
[ root@master231 case-demo]
apiVersion: v1
kind: Secret
metadata:name: linux94-harbor
stringData:.dockerconfigjson: '{"auths":{"harbor.oldboyedu.com":{"username":"linux94","password":"Linux@2024","email":"linux94@oldboyedu.com","auth":"bGludXg5NDpMaW51eEAyMDI0"}}}'
type: kubernetes.io/dockerconfigjson---apiVersion: v1
kind: ReplicationController
metadata:name: oldboyedu-private-harbor
spec:replicas: 3 selector:apps: linuxtemplate:spec:imagePullSecrets:- name: linux94-harborcontainers:- name: c1image: harbor.oldboyedu.com/oldboyedu-linux/alpine:latestimagePullPolicy: Alwaysstdin: true metadata:labels:apps: linux
[ root@master231 case-demo]
[ root@master231 case-demo]
secret/linux94-harbor created
replicationcontroller/oldboyedu-private-harbor created
[ root@master231 case-demo]
[ root@master231 case-demo]
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
oldboyedu-private-harbor-6kf6t 1 /1 Running 0 3s 10.100 .2.124 worker233 < none> < none>
oldboyedu-private-harbor-prqnv 1 /1 Running 0 3s 10.100 .2.125 worker233 < none> < none>
oldboyedu-private-harbor-tcp27 1 /1 Running 0 3s 10.100 .1.68 worker232 < none> < none>
[ root@master231 case-demo]
root@ubuntu0:/oldboyedu/softwares/harbor
serviceaccounts sa v1 true ServiceAccount1 .響應式創建賬號
root@ubuntu0:/oldboyedu/softwares/harbor
serviceaccount/xixi created
root@ubuntu0:/oldboyedu/softwares/harbor
NAME SECRETS AGE
xixi 1 61s
root@ubuntu0:/oldboyedu/softwares/harbor
apiVersion: v1
kind: ServiceAccount
metadata:creationTimestamp: "2025-05-18T12:03:44Z" name: xixinamespace: defaultresourceVersion: "1617334" uid: 8597121b-be87-4e33-a25b-d7f84a2fc43d
secrets:
- name: xixi-token-f4d9p2 .查看賬號后端的Image pull secrets
root@ubuntu0:/oldboyedu/softwares/harbor
Name: xixi
Namespace: default
Labels: < none>
Annotations: < none>
Image pull secrets: < none>
Mountable secrets: xixi-token-f4d9p
Tokens: xixi-token-f4d9p
Events: < none>
由于上面的鏡像拉去策略為空，所以更新賬號綁定的信息
[ root@master231 serviceaccounts]
serviceaccount/xixi patched
[ root@master231 serviceaccounts]
[ root@master231 serviceaccounts]
Name: xixi
Namespace: default
Labels: < none>
Annotations: < none>
Image pull secrets: oldboyedu-harbor
Mountable secrets: xixi-token-nk9z4
Tokens: xixi-token-nk9z4
Events: < none> 4 .響應式更新賬號的信息
[ root@master231 serviceaccounts]
NAME TYPE DATA AGE
oldboyedu-harbor kubernetes.io/dockerconfigjson 1 66m
[ root@master231 serviceaccounts]
[ root@master231 serviceaccounts]
Name: xixi
Namespace: default
Labels: < none>
Annotations: < none>
Image pull secrets: < none>
Mountable secrets: xixi-token-nk9z4
Tokens: xixi-token-nk9z4
Events: < none>
[ root@master231 serviceaccounts]
[ root@master231 serviceaccounts]
serviceaccount/xixi patched
[ root@master231 serviceaccounts]
[ root@master231 serviceaccounts]
Name: xixi
Namespace: default
Labels: < none>
Annotations: < none>
Image pull secrets: oldboyedu-harbor
Mountable secrets: xixi-token-nk9z4
Tokens: xixi-token-nk9z4
Events: < none>
[ root@master231 serviceaccounts] 5 .Pod使用sa賬號拉取鏡像
[ root@master231 case-demo]
apiVersion: v1
kind: Secret
metadata:name: linux94-harbor
stringData:.dockerconfigjson: '{"auths":{"harbor.oldboyedu.com":{"username":"linux94","password":"Linux@2024","email":"linux94@oldboyedu.com","auth":"bGludXg5NDpMaW51eEAyMDI0"}}}'
type: kubernetes.io/dockerconfigjson---apiVersion: v1
imagePullSecrets:
- name: linux94-harbor
kind: ServiceAccount
metadata:name: linux94namespace: default---apiVersion: v1
kind: ReplicationController
metadata:name: oldboyedu-private-harbor
spec:replicas: 3 selector:apps: linuxtemplate:spec:serviceAccount: linux94containers:- name: c1image: harbor.oldboyedu.com/oldboyedu-linux/alpine:latestimagePullPolicy: Alwaysstdin: true metadata:labels:apps: linux
[ root@master231 case-demo]
- Pod創建流程：Pod的創建，刪除，修改流程:1 .執行kubectl命令時會加載"~/.kube/config" ，從而識別到apiserver的地址，端口及認證證書; 2 .apiserver進行證書認證，鑒權，語法檢查，若成功則可以進行數據的讀取或者寫入; 3 .若用戶是寫入操作( 創建，修改，刪除) 則需要修改etcd數據庫的信息; 4 .如果創建Pod，此時scheduler負責Pod調度，將Pod調度到合適的worker節點，并將結果返回給ApiServer存儲到etcd中; 5 .kubelet組件會周期性上報給apiServer節點，包括Pod內的容器資源( cpu,memory,disk,gpu,.. .) 及worker宿主機節點狀態，apiServer并將結果存儲到etcd中，若有該節點的任務也會直接返回給該節點進行調度; 6 .kubelet開始調用CRI接口創建容器( 依次創建pause，initContainers，containers) ; 7 .在運行過程中，若Pod容器，正常或者異常退出時，kubelet會根據重啟策略是否重啟容器( Never,Always,OnFailure) ; 8 .若一個節點怪掉，則需要controller manager介入維護，比如Pod副本數量缺失，則需要創建watch事件，要求控制器的副本數要達到標準，從而要創建新的Pod，此過程重復步驟4-6。apiVersion: v1
kind: Namespace
metadata:name: devops---apiVersion: v1
kind: ReplicationController
metadata:name: oldboyedu-jenkinsnamespace: devops
spec:replicas: 1 selector:apps: jenkinstemplate:spec:nodeName: worker233volumes:- name: datanfs:server: 10.0 .0.231path: /oldboyedu/data/nfs-server/volumes/devops/jenkinscontainers:- name: c1image: harbor.oldboyedu.com/oldboyedu-devops/jenkins:2.479.1-alpine-jdk21ports:- containerPort: 8080 volumeMounts:- name: datamountPath: /var/jenkins_home/metadata:labels:apps: jenkins---apiVersion: v1
kind: Service
metadata:name: svc-jenkinsnamespace: devops
spec:type: NodePortselector:apps: jenkinsports:- port: 8080 nodePort: 30083
[ root@master231 case-demo] 3 .溫馨提示:- 在使用資源清單之前，應該先將Jenkins運行起來，安裝常用的插件; - 再將/var/jenkins_home/數據拷貝到"/oldboyedu/data/nfs-server/volumes/devops/jenkins" 中。
)
