第三阶段 Docker进阶与实战

4月13日
20:30-21:30
课时 1
课外基础
0.访问Docker 官网关注 Docker安全。
1.了解当前商业使用的存储类型和方式 。
2.了解docker数据持久化存储方式和后边讲解k8s的存储方式区别 。
3.了解几个常用的经典 docker镜像构建方案 。
4.了解docker安全方案常用的集中方式 。
课程重点
通过存储方案的了解常用方式进而在实际的工作中采用相应的存储方式
数据共享与持久化
为什么需要数据持久化？
挂载数据卷
创建数据卷
数据卷备份
数据卷插件介绍
持久化实践
实际场景落地介绍和刨析
Docker最佳实践
常用命令与实际使用最佳实践
使用Dockerfile构建镜像
Docker安全部署实践
Docker运维实践与技巧

课后作业
1 数据持久化的方式
2 docker save 和 export的区别
3 docker 镜像分层结构理解
4 docker 常用镜像构建

docker import || docker export
docker load || docker save

[root@master ~]# docker history --no-trunc mysql:5.6.41   | tac | tr -s ' ' | cut -d " " -f 5- | sed 's,^/bin/sh -c #(nop) ,,g' | sed 's,^/bin/sh -c,RUN,g' | sed 's, && ,\n  & ,g' | sed 's,\s*[0-9]*[\.]*[0-9]*\s*[kMG]*B\s*$,,g' | head -n -1
ADD file:f8f26d117bc4a9289b7cd7447ca36e1a70b11701c63d949ef35ff9c16e190e50 in /
CMD ["bash"]
RUN groupadd -r mysql
   &&  useradd -r -g mysql mysql
RUN apt-get update
   &&  apt-get install -y --no-install-recommends gnupg dirmngr
   &&  rm -rf /var/lib/apt/lists/*
ENV GOSU_VERSION=1.7
RUN set -x
   &&  apt-get update
   &&  apt-get install -y --no-install-recommends ca-certificates wget
   &&  rm -rf /var/lib/apt/lists/*
   &&  wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)"
   &&  wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc"
   &&  export GNUPGHOME="$(mktemp -d)"
   &&  gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4
   &&  gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu
   &&  gpgconf --kill all
   &&  rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc
   &&  chmod +x /usr/local/bin/gosu
   &&  gosu nobody true
   &&  apt-get purge -y --auto-remove ca-certificates wget
RUN mkdir /docker-entrypoint-initdb.d
RUN apt-get update
   &&  apt-get install -y --no-install-recommends pwgen perl
   &&  rm -rf /var/lib/apt/lists/*
RUN set -ex; key='A4A9406876FCBD3C456770C88C718D3B5072E1F5'; export GNUPGHOME="$(mktemp -d)"; gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$key"; gpg --export "$key" > /etc/apt/trusted.gpg.d/mysql.gpg; gpgconf --kill all; rm -rf "$GNUPGHOME"; apt-key list > /dev/null
ENV MYSQL_MAJOR=5.6
ENV MYSQL_VERSION=5.6.41-1debian9
RUN echo "deb http://repo.mysql.com/apt/debian/ stretch mysql-${MYSQL_MAJOR}" > /etc/apt/sources.list.d/mysql.list
RUN { echo mysql-community-server mysql-community-server/data-dir select ''; echo mysql-community-server mysql-community-server/root-pass password ''; echo mysql-community-server mysql-community-server/re-root-pass password ''; echo mysql-community-server mysql-community-server/remove-test-db select false; } | debconf-set-selections
   &&  apt-get update
   &&  apt-get install -y mysql-server="${MYSQL_VERSION}"
   &&  rm -rf /var/lib/apt/lists/*
   &&  rm -rf /var/lib/mysql
   &&  mkdir -p /var/lib/mysql /var/run/mysqld
   &&  chown -R mysql:mysql /var/lib/mysql /var/run/mysqld
   &&  chmod 777 /var/run/mysqld
   &&  find /etc/mysql/ -name '*.cnf' -print0 | xargs -0 grep -lZE '^(bind-address|log)' | xargs -rt -0 sed -Ei 's/^(bind-address|log)/#&/'
   &&  echo '[mysqld]\nskip-host-cache\nskip-name-resolve' > /etc/mysql/conf.d/docker.cnf
VOLUME [/var/lib/mysql]
COPY file:b79e447a4154d7150da6897e9bfdeac5eef0ebd39bb505803fdb0315c929d983 in /usr/local/bin/
RUN ln -s usr/local/bin/docker-entrypoint.sh /entrypoint.sh # backwards compat
ENTRYPOINT ["docker-entrypoint.sh"]
EXPOSE 3306/tcp
CMD ["mysqld"]
[root@master ~]# 
[root@master ~]# sh image.sh nginx 
ADD file:d1f1b387a158136fb0f8096c8a8ecf5fc146be4e85c1c3c345d44c927692723a in /
CMD ["bash"]
LABEL maintainer=NGINX Docker Maintainers <docker-maint@nginx.com>
ENV NGINX_VERSION=1.17.9
ENV NJS_VERSION=0.3.9
ENV PKG_RELEASE=1~buster
RUN set -x
   &&  addgroup --system --gid 101 nginx
   &&  adduser --system --disabled-login --ingroup nginx --no-create-home --home /nonexistent --gecos "nginx user" --shell /bin/false --uid 101 nginx
   &&  apt-get update
   &&  apt-get install --no-install-recommends --no-install-suggests -y gnupg1 ca-certificates
   &&  NGINX_GPGKEY=573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62; found=''; for server in ha.pool.sks-keyservers.net hkp://keyserver.ubuntu.com:80 hkp://p80.pool.sks-keyservers.net:80 pgp.mit.edu ; do echo "Fetching GPG key $NGINX_GPGKEY from $server"; apt-key adv --keyserver "$server" --keyserver-options timeout=10 --recv-keys "$NGINX_GPGKEY"
   &&  found=yes
   &&  break; done; test -z "$found"
   &&  echo >&2 "error: failed to fetch GPG key $NGINX_GPGKEY"
   &&  exit 1; apt-get remove --purge --auto-remove -y gnupg1
   &&  rm -rf /var/lib/apt/lists/*
   &&  dpkgArch="$(dpkg --print-architecture)"
   &&  nginxPackages=" nginx=${NGINX_VERSION}-${PKG_RELEASE} nginx-module-xslt=${NGINX_VERSION}-${PKG_RELEASE} nginx-module-geoip=${NGINX_VERSION}-${PKG_RELEASE} nginx-module-image-filter=${NGINX_VERSION}-${PKG_RELEASE} nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-${PKG_RELEASE} "
   &&  case "$dpkgArch" in amd64|i386) echo "deb https://nginx.org/packages/mainline/debian/ buster nginx" >> /etc/apt/sources.list.d/nginx.list
   &&  apt-get update ;; *) echo "deb-src https://nginx.org/packages/mainline/debian/ buster nginx" >> /etc/apt/sources.list.d/nginx.list
   &&  tempDir="$(mktemp -d)"
   &&  chmod 777 "$tempDir"
   &&  savedAptMark="$(apt-mark showmanual)"
   &&  apt-get update
   &&  apt-get build-dep -y $nginxPackages
   &&  ( cd "$tempDir"
   &&  DEB_BUILD_OPTIONS="nocheck parallel=$(nproc)" apt-get source --compile $nginxPackages )
   &&  apt-mark showmanual | xargs apt-mark auto > /dev/null
   &&  { [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; }
   &&  ls -lAFh "$tempDir"
   &&  ( cd "$tempDir"
   &&  dpkg-scanpackages . > Packages )
   &&  grep '^Package: ' "$tempDir/Packages"
   &&  echo "deb [ trusted=yes ] file://$tempDir ./" > /etc/apt/sources.list.d/temp.list
   &&  apt-get -o Acquire::GzipIndexes=false update ;; esac
   &&  apt-get install --no-install-recommends --no-install-suggests -y $nginxPackages gettext-base
   &&  apt-get remove --purge --auto-remove -y ca-certificates
   &&  rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx.list
   &&  if [ -n "$tempDir" ]; then apt-get purge -y --auto-remove
   &&  rm -rf "$tempDir" /etc/apt/sources.list.d/temp.list; fi
RUN ln -sf /dev/stdout /var/log/nginx/access.log
   &&  ln -sf /dev/stderr /var/log/nginx/error.log
EXPOSE 80
STOPSIGNAL SIGTERM
CMD ["nginx" "-g" "daemon off;"]
[root@master ~]# 
[root@master ~]# cat image.sh 
#! /bin/bash
docker history --no-trunc $1   | tac | tr -s ' ' | cut -d " " -f 5- | sed 's,^/bin/sh -c #(nop) ,,g' | sed 's,^/bin/sh -c,RUN,g' | sed 's, && ,\n  & ,g' | sed 's,\s*[0-9]*[\.]*[0-9]*\s*[kMG]*B\s*$,,g' | head -n -1
[root@master ~]#

[root@riyimei home]# git clone https://github.com/lukapeschke/dockerfile-from-image.git
Cloning into 'dockerfile-from-image'...
remote: Enumerating objects: 36, done.
remote: Total 36 (delta 0), reused 0 (delta 0), pack-reused 36
Unpacking objects: 100% (36/36), done.
[root@riyimei home]# 
[root@riyimei home]# ll
total 0
drwxr-xr-x 4 root    root    33 Apr 13 14:40 docker
drwxr-xr-x 3 root    root    74 Apr 13 20:48 dockerfile-from-image
drwxr-xr-x 2 root    root    24 Apr  3 14:13 k8s
drwxr-xr-x 2 root    root     6 Apr 13 15:23 mindoc
drwx------ 2 rancher rancher 62 Apr  3 14:13 rancher
[root@riyimei home]# cd dockerfile-from-image/
[root@riyimei dockerfile-from-image]# 
[root@riyimei dockerfile-from-image]# ll
total 12
-rw-r--r-- 1 root root  294 Apr 13 20:48 Dockerfile
-rwxr-xr-x 1 root root 1496 Apr 13 20:48 entrypoint.py
-rw-r--r-- 1 root root 2587 Apr 13 20:48 README.md
[root@riyimei dockerfile-from-image]# 
[root@riyimei dockerfile-from-image]# docker build -t lukapeschke/dfa .
Sending build context to Docker daemon  108.5kB
Step 1/4 : FROM alpine
latest: Pulling from library/alpine
aad63a933944: Pull complete 
Digest: sha256:b276d875eeed9c7d3f1cfa7edb06b22ed22b14219a7d67c52c56612330348239
Status: Downloaded newer image for alpine:latest
 ---> a187dde48cd2
Step 2/4 : RUN  apk add --update python3 wget      && wget -O - --no-check-certificate https://bootstrap.pypa.io/get-pip.py | python3      && apk del wget      && pip3 install -U docker-py      && yes | pip3 uninstall pip
 ---> Running in 983362554de9
fetch http://dl-cdn.alpinelinux.org/alpine/v3.11/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.11/community/x86_64/APKINDEX.tar.gz
(1/11) Installing libbz2 (1.0.8-r1)
(2/11) Installing expat (2.2.9-r1)
(3/11) Installing libffi (3.2.1-r6)
(4/11) Installing gdbm (1.13-r1)
(5/11) Installing xz-libs (5.2.4-r0)
(6/11) Installing ncurses-terminfo-base (6.1_p20200118-r3)
(7/11) Installing ncurses-libs (6.1_p20200118-r3)
(8/11) Installing readline (8.0.1-r0)
(9/11) Installing sqlite-libs (3.30.1-r1)
(10/11) Installing python3 (3.8.2-r0)
(11/11) Installing wget (1.20.3-r0)
Executing busybox-1.31.1-r9.trigger
OK: 65 MiB in 25 packages
--2020-04-13 13:08:11--  https://bootstrap.pypa.io/get-pip.py
Resolving bootstrap.pypa.io... 151.101.228.175, 2a04:4e42:36::175
Connecting to bootstrap.pypa.io|151.101.228.175|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1807342 (1.7M) [text/x-python]
Saving to: 'STDOUT'
     0K .......... .......... .......... .......... ..........  2% 44.5K 39s
    50K .......... .......... .......... .......... ..........  5% 26.5K 50s
   100K .......... .......... .......... .......... ..........  8% 16.6K 65s
   150K .......... .......... .......... .......... .......... 11% 30.1K 60s
   200K .......... .......... .......... .......... .......... 14% 19.9K 62s
   250K .......... .......... .......... .......... .......... 16% 44.0K 55s
   300K .......... .......... .......... .......... .......... 19% 11.8K 63s
   350K .......... .......... .......... .......... .......... 22% 7.96K 75s
   400K .......... .......... .......... .......... .......... 25% 12.8K 75s
   450K .......... .......... .......... .......... .......... 28% 10.2K 78s
   500K .......... .......... .......... .......... .......... 31% 10.1K 79s
   550K .......... .......... .......... .......... .......... 33% 12.8K 77s
   600K .......... .......... .......... .......... .......... 36% 18.5K 72s
   650K .......... .......... .......... .......... .......... 39% 20.1K 68s
   700K .......... .......... .......... .......... .......... 42% 12.2K 66s
   750K .......... .......... .......... .......... .......... 45% 8.73K 66s
   800K .......... .......... .......... .......... .......... 48% 9.89K 64s
   850K .......... .......... .......... .......... .......... 50% 18.2K 60s
   900K .......... .......... .......... .......... .......... 53% 12.9K 57s
   950K .......... .......... .......... .......... .......... 56% 11.7K 54s
  1000K .......... .......... .......... .......... .......... 59% 17.3K 50s
  1050K .......... .......... .......... .......... .......... 62% 9.11K 48s
  1100K .......... .......... .......... .......... .......... 65% 20.9K 43s
  1150K .......... .......... .......... .......... .......... 67% 13.9K 40s
  1200K .......... .......... .......... .......... .......... 70% 12.3K 37s
  1250K .......... .......... .......... .......... .......... 73% 10.9K 33s
  1300K .......... .......... .......... .......... .......... 76% 10.2K 30s
  1350K .......... .......... .......... .......... .......... 79% 19.4K 26s
  1400K .......... .......... .......... .......... .......... 82% 17.6K 23s
  1450K .......... .......... .......... .......... .......... 84% 20.7K 19s
  1500K .......... .......... .......... .......... .......... 87% 14.3K 15s
  1550K .......... .......... .......... .......... .......... 90% 7.73K 12s
  1600K .......... .......... .......... .......... .......... 93% 17.7K 8s
  1650K .......... .......... .......... .......... .......... 96% 11.0K 5s
  1700K .......... .......... .......... .......... .......... 99% 14.4K 1s
  1750K .......... ....                                       100% 17.3K=2m8s
2020-04-13 13:10:21 (13.8 KB/s) - written to stdout [1807342/1807342]
Collecting pip
  Downloading pip-20.0.2-py2.py3-none-any.whl (1.4 MB)
Collecting wheel
  Downloading wheel-0.34.2-py2.py3-none-any.whl (26 kB)
Installing collected packages: pip, wheel
  Attempting uninstall: pip
    Found existing installation: pip 19.2.3
    Uninstalling pip-19.2.3:
      Successfully uninstalled pip-19.2.3
Successfully installed pip-20.0.2 wheel-0.34.2
(1/1) Purging wget (1.20.3-r0)
Executing busybox-1.31.1-r9.trigger
OK: 64 MiB in 24 packages
Collecting docker-py
  Downloading docker_py-1.10.6-py2.py3-none-any.whl (50 kB)
Collecting six>=1.4.0
  Downloading six-1.14.0-py2.py3-none-any.whl (10 kB)
Collecting requests!=2.11.0,>=2.5.2
  Downloading requests-2.23.0-py2.py3-none-any.whl (58 kB)
Collecting websocket-client>=0.32.0
  Downloading websocket_client-0.57.0-py2.py3-none-any.whl (200 kB)
Collecting docker-pycreds>=0.2.1
  Downloading docker_pycreds-0.4.0-py2.py3-none-any.whl (9.0 kB)
Collecting idna<3,>=2.5
  Downloading idna-2.9-py2.py3-none-any.whl (58 kB)
Collecting certifi>=2017.4.17
  Downloading certifi-2020.4.5.1-py2.py3-none-any.whl (157 kB)
Collecting chardet<4,>=3.0.2
  Downloading chardet-3.0.4-py2.py3-none-any.whl (133 kB)
Collecting urllib3!=1.25.0,!=1.25.1,<1.26,>=1.21.1
  Downloading urllib3-1.25.8-py2.py3-none-any.whl (125 kB)
Installing collected packages: six, idna, certifi, chardet, urllib3, requests, websocket-client, docker-pycreds, docker-py
Successfully installed certifi-2020.4.5.1 chardet-3.0.4 docker-py-1.10.6 docker-pycreds-0.4.0 idna-2.9 requests-2.23.0 six-1.14.0 urllib3-1.25.8 websocket-client-0.57.0
Found existing installation: pip 20.0.2
Uninstalling pip-20.0.2:
  Would remove:
    /usr/bin/pip
    /usr/bin/pip3
    /usr/bin/pip3.8
    /usr/lib/python3.8/site-packages/pip-20.0.2.dist-info/*
    /usr/lib/python3.8/site-packages/pip/*
Proceed (y/n)?   Successfully uninstalled pip-20.0.2
Removing intermediate container 983362554de9
 ---> b06b75c6e0e6
Step 3/4 : COPY entrypoint.py /root
 ---> 3027eb4f7f60
Step 4/4 : ENTRYPOINT ["/root/entrypoint.py"]
 ---> Running in be69ded401bd
Removing intermediate container be69ded401bd
 ---> a6576fa3846e
Successfully built a6576fa3846e
Successfully tagged lukapeschke/dfa:latest
[root@riyimei dockerfile-from-image]# docker image ls 
REPOSITORY                         TAG                 IMAGE ID            CREATED              SIZE
lukapeschke/dfa                    latest              a6576fa3846e        About a minute ago   58.5MB
local/c7-systemd-httpd             latest              047bf64886a3        7 hours ago          260MB
local/c7-systemd                   latest              900b71d7e1bb        7 hours ago          203MB
postgres                           latest              9907cacf0c01        13 days ago          314MB
nginx                              latest              ed21b7a8aee9        13 days ago          127MB
alpine                             latest              a187dde48cd2        2 weeks ago          5.6MB
ubuntu                             latest              4e5021d210f6        3 weeks ago          64.2MB
busybox                            latest              83aa35aa1c79        4 weeks ago          1.22MB
centos                             latest              470671670cac        2 months ago         237MB
centos                             7                   5e35e350aded        5 months ago         203MB
jackdanger/dockerfile-from-image   latest              12c48318d21a        14 months ago        148MB
chenlicn163/ubuntu-stress          latest              dc79bd8927d6        15 months ago        112MB
joedval/stress                     latest              89e5b79daa74        4 years ago          215MB
liweiming0611/stress               latest              89e5b79daa74        4 years ago          215MB
[root@riyimei dockerfile-from-image]# docker run --rm -v '/var/run/docker.sock:/var/run/docker.sock' lukapeschke/dfa 4e5021d210f6
FROM ubuntu:latest
ADD file:594fa35cf803361e69d817fc867b6a4069c064ffd20ed50caf42ad9bb11ca999 in /
RUN /bin/sh -c [ -z "$(apt-get indextargets)" ]
RUN /bin/sh -c set -xe         \
    && echo '#!/bin/sh' > /usr/sbin/policy-rc.d     \
    && echo 'exit 101' >> /usr/sbin/policy-rc.d     \
    && chmod +x /usr/sbin/policy-rc.d         \
    && dpkg-divert --local --rename --add /sbin/initctl     \
    && cp -a /usr/sbin/policy-rc.d /sbin/initctl     \
    && sed -i 's/^exit.*/exit 0/' /sbin/initctl         \
    && echo 'force-unsafe-io' > /etc/dpkg/dpkg.cfg.d/docker-apt-speedup         \
    && echo 'DPkg::Post-Invoke { "rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true"; };' > /etc/apt/apt.conf.d/docker-clean     \
    && echo 'APT::Update::Post-Invoke { "rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true"; };' >> /etc/apt/apt.conf.d/docker-clean     \
    && echo 'Dir::Cache::pkgcache ""; Dir::Cache::srcpkgcache "";' >> /etc/apt/apt.conf.d/docker-clean         \
    && echo 'Acquire::Languages "none";' > /etc/apt/apt.conf.d/docker-no-languages         \
    && echo 'Acquire::GzipIndexes "true"; Acquire::CompressionTypes::Order:: "gz";' > /etc/apt/apt.conf.d/docker-gzip-indexes           \
    && echo 'Apt::AutoRemove::SuggestsImportant "false";' > /etc/apt/apt.conf.d/docker-autoremove-suggests
RUN /bin/sh -c mkdir -p /run/systemd \
    && echo 'docker' > /run/systemd/container
CMD ["/bin/bash"]
[root@riyimei dockerfile-from-image]#

[root@riyimei httpd]# docker run --rm busybox sh -c 'ulimit -S -a | grep stack && ulimit -H -a | grep stack'
stack size (kb)                 (-s) 8192
stack size (kb)                 (-s) unlimited
[root@riyimei httpd]# ulimit -S -a
core file size          (blocks, -c) unlimited
data seg size           (kbytes, -d) unlimited
scheduling priority             (-e) 0
file size               (blocks, -f) unlimited
pending signals                 (-i) 3624
max locked memory       (kbytes, -l) 64
max memory size         (kbytes, -m) unlimited
open files                      (-n) 1000000
pipe size            (512 bytes, -p) 8
POSIX message queues     (bytes, -q) 819200
real-time priority              (-r) 0
stack size              (kbytes, -s) 10240
cpu time               (seconds, -t) unlimited
max user processes              (-u) 3624
virtual memory          (kbytes, -v) unlimited
file locks                      (-x) unlimited
[root@riyimei httpd]#

initContainers:
      - name: increase-vm-max-map-count
        image: busybox
        imagePullPolicy: IfNotPresent
        command: ["sysctl", "-w", "vm.max_map_count=1048575"]
        securityContext:
          privileged: true
      - name: increase-ulimit
        image: busybox
        command: [ "sh","-c","ulimit -l unlimited" ]
        securityContext:
          privileged: true

https://raw.githubusercontent.com/strapdata/kubernetes-elassandra/master/elassandra-statefulset.yaml

---
apiVersion: "apps/v1beta1"
kind: StatefulSet
metadata:
  name: elassandra
spec:
  serviceName: elassandra
  replicas: 3
  updateStrategy:  
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: elassandra
    spec:
      # See https://pracucci.com/graceful-shutdown-of-kubernetes-pods.html
      terminationGracePeriodSeconds: 300
      securityContext:
        # allows read/write access for mounted volumes  
        # by users that belong to a group with gid: 999
        fsGroup: 999
      initContainers:
      - name: increase-vm-max-map-count
        image: busybox
        imagePullPolicy: IfNotPresent
        command: ["sysctl", "-w", "vm.max_map_count=1048575"]
        securityContext:
          privileged: true
      - name: increase-ulimit
        image: busybox
        command: [ "sh","-c","ulimit -l unlimited" ]
        securityContext:
          privileged: true
      containers:
        - name: elassandra
          image: strapdata/elassandra:5.5.0.22-rc1
          imagePullPolicy: Always
          securityContext:
            privileged: false
            # applying fix in: https://github.com/kubernetes/kubernetes/issues/3595#issuecomment-287692878 
            # https://docs.docker.com/engine/reference/run/#operator-exclusive-options
            capabilities:
              add: ["IPC_LOCK", "SYS_RESOURCE"]
          livenessProbe:
            tcpSocket:
              port: 7000
            initialDelaySeconds: 15
            periodSeconds: 5
          readinessProbe:
            exec:
              command: [ "/bin/bash", "-c", "/ready-probe.sh" ]
            initialDelaySeconds: 15
            timeoutSeconds: 5
          lifecycle:
            preStop:
              exec:
                command: ["/bin/sh", "-c", "exec nodetool drain"]
          ports:
            - containerPort: 7000
              name: intra-node
            - containerPort: 7001
              name: tls-intra-node
            - containerPort: 7199
              name: jmx
            - containerPort: 9042
              name: cql
            - containerPort: 9200
              name: http
              protocol: TCP
            - containerPort: 9300
              name: transport
              protocol: TCP
          env:
            # environment variables to be directly refrenced from the configuration
            - name: NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: POD_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
            - name: CASSANDRA_SEEDS
              value: elassandra-0.elassandra.default.svc.cluster.local
            - name: MAX_HEAP_SIZE
              value: 2048M
            - name: HEAP_NEWSIZE
              value: 512M
            - name: CASSANDRA_CLUSTER_NAME
              value: "Cassandra"
            - name: CASSANDRA_DC
              value: "DC1"
            - name: CASSANDRA_RACK
              value: "r1"
            - name: CASSANDRA_ENDPOINT_SNITCH
              value: GossipingPropertyFileSnitch
#            - name: CASSANDRA_DAEMON
#              value: "org.apache.cassandra.service.CassandraDaemon"
            # logging variables
            - name: LOGBACK_org_elassandra_discovery
              value: DEBUG
          volumeMounts:
            - name: elassandra-data
              mountPath: /var/lib/cassandra
  volumeClaimTemplates:
    - metadata:
        name: elassandra-data
      spec:
        accessModes: ["ReadWriteOnce"]
        # Define your own storageClassName if needed.
        storageClassName: managed-premium
        resources:
          requests:
            storage: 16Gi