configmap
字面值创建
kubectl create configmap my-config --from-literal=key1=config1 --from-literal=key2=config2
kubectl get cm
kubectl describe cm my-config
通过文件创建
kubectl create configmap my-config-2 --from-file=/etc/resolv.conf
kubectl describe cm my-config-2
通过目录创建
mkdir test
cp /etc/passwd test/
cp /etc/fstab test/
ls test/
kubectl create configmap my-config-3 --from-file=test
kubectl describe cm my-config-3
通过yaml文件创建
vim cm1.yamlapiVersion: v1
kind: ConfigMap
metadata:
name: cm1-config
data:
db_host: "172.25.0.250"
db_port: "3306"
kubectl apply -f cm1.yaml
kubectl describe cm cm1-config
使用configmap设置环境变量
vim pod1.yamlapiVersion: v1
kind: Pod
metadata:
name: pod1
spec:
containers:
- name: pod1
image: busybox
command: ["/bin/sh", "-c", "env"]
env:
- name: key1
valueFrom:
configMapKeyRef:
name: cm1-config
key: db_host
- name: key2
valueFrom:
configMapKeyRef:
name: cm1-config
key: db_port
restartPolicy: Neverkubectl apply -f pod1.yaml
kubectl logs pod1
kubectl delete pod pod1vim pod2.yamlapiVersion: v1
kind: Pod
metadata:
name: pod2
spec:
containers:
- name: pod2
image: busybox
command: ["/bin/sh", "-c", "env"]
envFrom:
- configMapRef:
name: cm1-config
restartPolicy: Neverkubectl apply -f pod2.yaml
kubectl logs pod2
kubectl delete pod pod2使用conigmap设置命令行参数
vim pod3.yamlapiVersion: v1
kind: Pod
metadata:
name: pod3
spec:
containers:
- name: pod3
image: busybox
command: ["/bin/sh", "-c", "echo $(db_host) $(db_port)"]
envFrom:
- configMapRef:
name: cm1-config
restartPolicy: Never
kubectl apply -f pod3.yaml
kubectl logs pod3
kubectl delete pod pod3通过数据卷使用configmap
vim pod4.yamlapiVersion: v1
kind: Pod
metadata:
name: pod4
spec:
containers:
- name: pod4
image: busybox
command: ["/bin/sh", "-c", "cat /config/db_host"]
volumeMounts:
- name: config-volume
mountPath: /config
volumes:
- name: config-volume
configMap:
name: cm1-config
restartPolicy: Neverkubectl apply -f pod4.yaml
kubectl logs pod4
kubectl delete pod pod4configmap热更新
vim nginx.confserver {
listen 8000;
server_name _;
location / {
root /usr/share/nginx/html;
index index.html index.htm;
}
}
kubectl create configmap nginxconf --from-file=nginx.conf
kubectl describe cm nginxconf
vim my-nginx.yamlapiVersion: apps/v1
kind: Deployment
metadata:
name: my-nginx
spec:
replicas: 1
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- name: nginx
image: nginx
volumeMounts:
- name: config-volume
mountPath: /etc/nginx/conf.d
volumes:
- name: config-volume
configMap:
name: nginxconfkubectl apply -f my-nginx.yaml
kubectl get pod -o wide
kubectl exec my-nginx-85fb986977-87dff -- cat /etc/nginx/conf.d/nginx.conf
curl 10.244.219.17:8000
编辑cm，修改端口
kubectl edit cm nginxconf
kubectl exec my-nginx-85fb986977-87dff -- cat /etc/nginx/conf.d/nginx.conf
修改cm后，过上几秒配置信息会同步到容器，但是容器内运行的服务并不会加载生效，需要手动刷新
方式一：(推荐)
kubectl delete pod my-nginx-85fb986977-87dff方式二：（手动触发版本更新，会新建一个replicaset）
kubectl patch deployments.apps my-nginx --patch '{"spec": {"template": {"metadata": {"annotations": {"version/config": "20231103"}}}}}'kubectl get pod -o wide
curl 10.244.106.133
secrets
从文件创建
echo -n 'admin' > ./username.txt
echo -n 'westos' > ./password.txt
kubectl create secret generic db-user-pass --from-file=./username.txt --from-file=./password.txt
kubectl get secrets db-user-pass -o yaml
编写yaml文件
echo -n 'admin' | base64
echo -n 'westos' | base64
vim mysecret.yamlapiVersion: v1
kind: Secret
metadata:
name: mysecret
type: Opaque
data:
username: YWRtaW4= #必须编码后的值
password: d2VzdG9z
kubectl apply -f mysecret.yaml
kubectl get secrets mysecret -o yaml
将Secret挂载到Volume中
vim pod1.yamlapiVersion: v1
kind: Pod
metadata:
name: mysecret
spec:
containers:
- name: nginx
image: nginx
volumeMounts:
- name: secrets
mountPath: "/secret"
readOnly: true
volumes:
- name: secrets
secret:
secretName: mysecret
kubectl apply -f pod1.yaml
kubectl get pod
kubectl exec mysecret -- ls /secret
kubectl delete -f pod1.yaml向指定路径映射 secret 密钥
vim pod2.yamlapiVersion: v1
kind: Pod
metadata:
name: mysecret
spec:
containers:
- name: nginx
image: nginx
volumeMounts:
- name: secrets
mountPath: "/secret"
readOnly: true
volumes:
- name: secrets
secret:
secretName: mysecret
items:
- key: username
path: my-group/my-usernamekubectl apply -f pod2.yaml
kubectl exec mysecret -- cat /secret/my-group/my-username
kubectl delete -f pod2.yaml将Secret设置为环境变量
vim pod3.yamlapiVersion: v1
kind: Pod
metadata:
name: secret-env
spec:
containers:
- name: pod3
image: busybox
command: ["/bin/sh", "-c", "env"]
env:
- name: SECRET_USERNAME
valueFrom:
secretKeyRef:
name: mysecret
key: username
- name: SECRET_PASSWORD
valueFrom:
secretKeyRef:
name: mysecret
key: password
restartPolicy: Neverkubectl apply -f pod3.yaml
kubectl logs secret-env
存储docker registry的认证信息
kubectl create secret docker-registry myregistrykey --docker-server=reg.westos.org --docker-username=admin --docker-password=westos --docker-email=hjl@westos.org新建私有仓库
vim pod4.yamlapiVersion: v1
kind: Pod
metadata:
name: mypod
spec:
containers:
- name: game2048
image: reg.westos.org/westos/game2048
imagePullSecrets:
- name: myregistrykeykubectl apply -f pod4.yaml
kubectl get pod
推荐把registrykey绑定到sa，这样yaml文件中就可以不用指定，更加安全。
kubectl patch serviceaccount default -p '{"imagePullSecrets": [{"name": "myregistrykey"}]}'
kubectl describe sa default
