K8S卷类型

K8S卷类型

Pod本地存储：emptyDir,hostPath
SAN：iSCSI,FC
NAS：nfs,cifs(samba)
分布式存储：glusterfs,rbd(ceph的块存储接口),cephfs(ceph的文件存储接口)
云存储：EBS, Azure Disk

在查看K8S集群Pod支持的卷类型

[root@master ~]# kubectl explain pod.spec.volumes
KIND:     Pod
VERSION:  v1
RESOURCE: volumes <[]Object>
DESCRIPTION:
     List of volumes that can be mounted by containers belonging to the pod.
     More info: https://kubernetes.io/docs/concepts/storage/volumes
     Volume represents a named volume in a pod that may be accessed by any
     container in the pod.
FIELDS:
   awsElasticBlockStore    <Object>
     AWSElasticBlockStore represents an AWS Disk resource that is attached to a
     kubelet's host machine and then exposed to the pod. More info:
     https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
   azureDisk    <Object>
     AzureDisk represents an Azure Data Disk mount on the host and bind mount to
     the pod.
   azureFile    <Object>
     AzureFile represents an Azure File Service mount on the host and bind mount
     to the pod.
   cephfs    <Object>
     CephFS represents a Ceph FS mount on the host that shares a pod's lifetime
   cinder    <Object>
     Cinder represents a cinder volume attached and mounted on kubelets host
     machine. More info: https://examples.k8s.io/mysql-cinder-pd/README.md
   configMap    <Object>
     ConfigMap represents a configMap that should populate this volume
   csi    <Object>
     CSI (Container Storage Interface) represents ephemeral storage that is
     handled by certain external CSI drivers (Beta feature).
   downwardAPI    <Object>
     DownwardAPI represents downward API about the pod that should populate this
     volume
   emptyDir    <Object>
     EmptyDir represents a temporary directory that shares a pod's lifetime.
     More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
   ephemeral    <Object>
     Ephemeral represents a volume that is handled by a cluster storage driver
     (Alpha feature). The volume's lifecycle is tied to the pod that defines it
     - it will be created before the pod starts, and deleted when the pod is
     removed.
     Use this if: a) the volume is only needed while the pod runs, b) features
     of normal volumes like restoring from snapshot or capacity tracking are
     needed, c) the storage driver is specified through a storage class, and d)
     the storage driver supports dynamic volume provisioning through a
     PersistentVolumeClaim (see EphemeralVolumeSource for more information on
     the connection between this volume type and PersistentVolumeClaim).
     Use PersistentVolumeClaim or one of the vendor-specific APIs for volumes
     that persist for longer than the lifecycle of an individual pod.
     Use CSI for light-weight local ephemeral volumes if the CSI driver is meant
     to be used that way - see the documentation of the driver for more
     information.
     A pod can use both types of ephemeral volumes and persistent volumes at the
     same time.
   fc    <Object>
     FC represents a Fibre Channel resource that is attached to a kubelet's host
     machine and then exposed to the pod.
   flexVolume    <Object>
     FlexVolume represents a generic volume resource that is
     provisioned/attached using an exec based plugin.
   flocker    <Object>
     Flocker represents a Flocker volume attached to a kubelet's host machine.
     This depends on the Flocker control service being running
   gcePersistentDisk    <Object>
     GCEPersistentDisk represents a GCE Disk resource that is attached to a
     kubelet's host machine and then exposed to the pod. More info:
     https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
   gitRepo    <Object>
     GitRepo represents a git repository at a particular revision. DEPRECATED:
     GitRepo is deprecated. To provision a container with a git repo, mount an
     EmptyDir into an InitContainer that clones the repo using git, then mount
     the EmptyDir into the Pod's container.
   glusterfs    <Object>
     Glusterfs represents a Glusterfs mount on the host that shares a pod's
     lifetime. More info: https://examples.k8s.io/volumes/glusterfs/README.md
   hostPath    <Object>
     HostPath represents a pre-existing file or directory on the host machine
     that is directly exposed to the container. This is generally used for
     system agents or other privileged things that are allowed to see the host
     machine. Most containers will NOT need this. More info:
     https://kubernetes.io/docs/concepts/storage/volumes#hostpath
   iscsi    <Object>
     ISCSI represents an ISCSI Disk resource that is attached to a kubelet's
     host machine and then exposed to the pod. More info:
     https://examples.k8s.io/volumes/iscsi/README.md
   name    <string> -required-
     Volume's name. Must be a DNS_LABEL and unique within the pod. More info:
     https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
   nfs    <Object>
     NFS represents an NFS mount on the host that shares a pod's lifetime More
     info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
   persistentVolumeClaim    <Object>
     PersistentVolumeClaimVolumeSource represents a reference to a
     PersistentVolumeClaim in the same namespace. More info:
     https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
   photonPersistentDisk    <Object>
     PhotonPersistentDisk represents a PhotonController persistent disk attached
     and mounted on kubelets host machine
   portworxVolume    <Object>
     PortworxVolume represents a portworx volume attached and mounted on
     kubelets host machine
   projected    <Object>
     Items for all in one resources secrets, configmaps, and downward API
   quobyte    <Object>
     Quobyte represents a Quobyte mount on the host that shares a pod's lifetime
   rbd    <Object>
     RBD represents a Rados Block Device mount on the host that shares a pod's
     lifetime. More info: https://examples.k8s.io/volumes/rbd/README.md
   scaleIO    <Object>
     ScaleIO represents a ScaleIO persistent volume attached and mounted on
     Kubernetes nodes.
   secret    <Object>
     Secret represents a secret that should populate this volume. More info:
     https://kubernetes.io/docs/concepts/storage/volumes#secret
   storageos    <Object>
     StorageOS represents a StorageOS volume attached and mounted on Kubernetes
     nodes.
   vsphereVolume    <Object>
     VsphereVolume represents a vSphere volume attached and mounted on kubelets
     host machine

emptyDir

busybox容器负责产生数据，也就是我们常说的sidecar；myapp容器负责向外提供生产服务

[root@master volumes]# cat pod-vol-demo.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: pod-demo
spec:
  containers:
  - name: myapp
    image: ikubernetes/myapp:v1
    imagePullPolicy: IfNotPresent
    ports:
    - containerPort: 80
    volumeMounts:
    - name: html
      mountPath: /usr/share/nginx/html/
  - name: busybox
    image: busybox:latest
    imagePullPolicy: IfNotPresent
    volumeMounts:
    - name: html
      mountPath: /data/
    command: ["/bin/sh","-c","while true; do echo $(date) >>/data/index.html; sleep 2; done"]
  volumes:
    - name: html
      emptyDir: {}

hostPath

hostPath卷方式可以将数据持久化到宿主机本地，如下我们先在本地创建好/data/pod/volume1的目录，并在创建好可访问网页文件，但是这种方式如果要提供统一的内容访问，需要在每一个宿主机上创建相应的目录和网页内容发。
节点1：
[root@master volumes]# mkdir /data/pod/volume1 -p
[root@master volumes]# echo node01 >/data/pod/volume1/index.html
节点2：
[root@master volumes]# mkdir /data/pod/volume1 -p
[root@master volumes]# echo node02 >/data/pod/volume1/index.html

[root@master volumes]# cat pod-hostpath-vol.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: pod-hostpath-vol
  namespace: default
spec: 
  containers:
  - name: myapp
    image: ikubernetes/myapp:v1
    volumeMounts:
    - name: html
      mountPath: /usr/share/nginx/html
  volumes:
  - name: html
    hostPath:
      path: /data/pod/volume1
      type: DirectoryOrCreate

nfs

通过nfs存储卷的方式可以实现将数据持久化的存储在远端存储上面，以防止数据丢失

[root@master volumes]# cat pod-nfs-vol.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: pod-nfs-vol
  namespace: default
spec: 
  containers:
  - name: myapp
    image: ikubernetes/myapp:v1
    volumeMounts:
    - name: html
      mountPath: /usr/share/nginx/html
  volumes:
  - name: html
    nfs:
      path: /data/volumes
      server: 172.16.1.31

PV、PVC

让POD创建过程与底层存储解耦合，如下图PV，PVC，storageClass之间的逻辑关系

1、示例，创建pv

[root@master volumes]# cat pv-nfs-demo.yaml 
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv001
  labels: 
    name: pv001
spec:
  nfs: 
    path: /data/volumes/v1
    server: 172.16.1.31
  accessModes: ["ReadWriteMany", "ReadWriteOnce"]
  capacity: 
    storage: 2Gi
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv002
  labels: 
    name: pv002
spec:
  nfs: 
    path: /data/volumes/v2
    server: 172.16.1.31
  accessModes: ["ReadWriteMany", "ReadWriteOnce"]
  capacity: 
    storage: 4Gi

2、使用pvc创建pod，关联pv

[root@master volumes]# cat pvc-demo.yaml 
apiVersion: v1 
kind: PersistentVolumeClaim
metadata:
  name: mypvc
  namespace: default
spec: 
  accessModes: ["ReadWriteMany"]
  resources:
    requests:
      storage: 2Gi
---
apiVersion: v1
kind: Pod
metadata:
  name: pod-pvc
  namespace: default
spec: 
  containers:
  - name: myapp
    image: ikubernetes/myapp:v1
    volumeMounts:
    - name: html
      mountPath: /usr/share/nginx/html
  volumes:
  - name: html
    persistentVolumeClaim:
      claimName: mypvc

configmap

配置容器化应用的方式
1、自定义命令行参数；command,args:[]
2、把配置文件直接备进镜像（但是此种方式耦合度过于紧密）
3、环境变量
1）Cloud Native的应用程序一般可以通过环境变量加载配置
2）Cloud enable,通过entrypoint脚本来预处理变量为配置文件中的配置信息
4、存储卷
怎么
命令行创建configmap

1、命令行创建
[root@master manifests]# kubectl create configmap nginx-config --from-literal=nginx_port=8080 --from-literal=server_name=evn.xsc.com
configmap/nginx-config created
2、查看
[root@master manifests]# kubectl get cm
NAME               DATA   AGE
nginx-config       2      8s
3、查看详细描述
[root@master manifests]# kubectl describe cm nginx-config
Name:         nginx-config
Namespace:    default
Labels:       <none>
Annotations:  <none>
Data
====
nginx_port:
----
8080
server_name:
----
evn.xsc.com
Events:  <none>

通过变量的方式注入配置

[root@master configmap]# kubectl describe cm nginx-config
Name:         nginx-config
Namespace:    default
Labels:       <none>
Annotations:  <none>
Data
====
nginx_port:
----
8080
server_name:
----
evn.xsc.com
Events:  <none>
pod通过env变量引用configmap的值
[root@master configmap]# cat pod-configmap.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: pod-cm-1
spec:
  containers:
  - image: ikubernetes/myapp:v1
    name: myapp
    ports:
    - name: http
      containerPort: 80
    env:
    - name: NGINX_SERVER_PORT
      valueFrom:
        configMapKeyRef:
          name: nginx-config
          key: nginx_port
    - name: NGINX_SERVER_NAME
      valueFrom:
        configMapKeyRef:
          name: nginx-config
          key: server_name
容器内查看注入的变量值
[root@master configmap]# kubectl exec -it pod-cm-1 -- /bin/sh
/ # printenv
MYAPP_SVC_PORT_80_TCP_ADDR=10.98.57.156
KUBERNETES_PORT=tcp://10.96.0.1:443
KUBERNETES_SERVICE_PORT=443
MYAPP_SVC_PORT_80_TCP_PORT=80
HOSTNAME=pod-cm-1
SHLVL=1
MYAPP_SVC_PORT_80_TCP_PROTO=tcp
HOME=/root
NGINX_SERVER_PORT=8080
NGINX_SERVER_NAME=evn.xsc.com

通过挂载configmap卷的方式传递值

configmap的值
[root@master configmap]# kubectl describe cm www.conf
Name:         www.conf
Namespace:    default
Labels:       <none>
Annotations:  <none>
Data
====
www.conf:
----
server {
  server_name evn.xsc.com;
  listen 8088;
  root /data/web/html;
}
Events:  <none>
创建pod
[root@master configmap]# cat pod-configmap-3.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: pod-cm-3
spec:
  containers:
  - image: ikubernetes/myapp:v1
    name: myapp
    ports:
    - name: http
      containerPort: 80
    volumeMounts:
    - name: nginxconf
      mountPath: /etc/nginx/conf.d/
      readOnly: true
  volumes:
  - name: nginxconf
    configMap:
      name: www.conf
进入容器内部可以查看到挂载的值
[root@master configmap]# kubectl exec -it pod-cm-3 -- /bin/sh
/ # 
/ # 
/ # cat /etc/nginx/conf.d/www.conf 
server {
    server_name evn.xsc.com;
    listen 8088;
    root /data/web/html;
}
通过挂载configmap的方式可以实现动态修改，当configmap修改完之后，pod内的配置也会实现自动修改

secret

[root@master ~]# kubectl create secret generic mysql-root-password --from-literal=password=abc123..
secret/mysql-root-password created
[root@master ~]# kubectl describe  secret mysql-root-password
Name:         mysql-root-password
Namespace:    default
Labels:       <none>
Annotations:  <none>
Type:  Opaque
Data
====
password:  8 bytes
但是其实secret是通过base64进行编码的，因此其实是很容易解码的
[root@master ~]# kubectl get secret mysql-root-password -o yaml
apiVersion: v1
data:
  password: YWJjMTIzLi4=
kind: Secret
metadata:
  creationTimestamp: "2021-06-18T08:23:43Z"
  managedFields:
  - apiVersion: v1
    fieldsType: FieldsV1
    fieldsV1:
      f:data:
        .: {}
        f:password: {}
      f:type: {}
    manager: kubectl-create
    operation: Update
    time: "2021-06-18T08:23:43Z"
  name: mysql-root-password
  namespace: default
  resourceVersion: "186277"
  uid: de4cadce-e3eb-430d-b7ea-c95e77e690cc
type: Opaque
You have new mail in /var/spool/mail/root
[root@master ~]# echo YWJjMTIzLi4= | base64 -d
abc123..

Docker与K8S

K8S-存储卷