Kubernetes 学习13 kubernetes pv pvc configmap 和secret

[root@k8smaster volumes]# kubectl explain pods.spec.containers.env
KIND: Pod
VERSION: v1RESOURCE: env <[]Object>DESCRIPTION:
List of environment variables to set in the container. Cannot be updated. EnvVar represents an environment variable present in a Container.FIELDS:
name <string> -required- #变量名
Name of the environment variable. Must be a C_IDENTIFIER. value <string> #数据
Variable references $(VAR_NAME) are expanded using the previous defined
environment variables in the container and any service environment
variables. If a variable cannot be resolved, the reference in the input
string will be unchanged. The $(VAR_NAME) syntax can be escaped with a
double $$, ie: $$(VAR_NAME). Escaped references will never be expanded,
regardless of whether the variable exists or not. Defaults to "". valueFrom <Object> #表示数据不是直接给的字符串而是来自于引用另外一个对象或变量，他的数据拿过来以后我们传给本pod变量。
Source for the environment variable's value. Cannot be used if value is not
empty.

[root@k8smaster volumes]# kubectl explain pods.spec.containers.env.valueFrom
KIND: Pod
VERSION: v1RESOURCE: valueFrom <Object>DESCRIPTION:
Source for the environment variable's value. Cannot be used if value is not
empty. EnvVarSource represents a source for the value of an EnvVar.FIELDS:
configMapKeyRef <Object> #在configmap中
Selects a key of a ConfigMap. fieldRef <Object> #某个字段，可以是pod自身的字段，如解释中所述，将字段对应的值引用过来。
Selects a field of the pod: supports metadata.name, metadata.namespace,
metadata.labels, metadata.annotations, spec.nodeName,
spec.serviceAccountName, status.hostIP, status.podIP. resourceFieldRef <Object> #资源需求和资源限制
Selects a resource of the container: only resources limits and requests
(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu,
requests.memory and requests.ephemeral-storage) are currently supported. secretKeyRef <Object> #在secret中
Selects a key of a secret in the pod's namespace

[root@k8smaster volumes]# kubectl explain configmap
KIND: ConfigMap
VERSION: v1DESCRIPTION:
ConfigMap holds configuration data for pods to consume.FIELDS:
apiVersion <string>
APIVersion defines the versioned schema of this representation of an
object. Servers should convert recognized schemas to the latest internal
value, and may reject unrecognized values. More info:
https://git.k8s.io/community/contributors/devel/api-conventions.md#resources binaryData <map[string]string> #二进制格式给数据
BinaryData contains the binary data. Each key must consist of alphanumeric
characters, '-', '_' or '.'. BinaryData can contain byte sequences that are
not in the UTF- range. The keys stored in BinaryData must not overlap with
the ones in the Data field, this is enforced during validation process.
Using this field will require 1.10+ apiserver and kubelet. data <map[string]string> #
Data contains the configuration data. Each key must consist of alphanumeric
characters, '-', '_' or '.'. Values with non-UTF- byte sequences must use
the BinaryData field. The keys stored in Data must not overlap with the
keys in the BinaryData field, this is enforced during validation process. kind <string>
Kind is a string value representing the REST resource this object
represents. Servers may infer this from the endpoint the client submits
requests to. Cannot be updated. In CamelCase. More info:
https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds metadata <Object>
Standard object's metadata. More info:
https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata

[root@k8smaster volumes]# kubectl create configmap --help
Create a configmap based on a file, directory, or specified literal value. A single configmap may package one or more key/value pairs. When creating a configmap based on a file, the key will default to the basename of the file, and the value will default
to the file content. If the basename is an invalid key, you may specify an alternate key. When creating a configmap based on a directory, each file whose basename is a valid key in the directory will be
packaged into the configmap. Any directory entries except regular files are ignored (e.g. subdirectories, symlinks,
devices, pipes, etc).Aliases:
configmap, cmExamples:
# Create a new configmap named my-config based on folder bar
kubectl create configmap my-config --from-file=path/to/bar #值是来自文件的 # Create a new configmap named my-config with specified keys instead of file basenames on disk
kubectl create configmap my-config --from-file=key1=/path/to/bar/file1.txt --from-file=key2=/path/to/bar/file2.txt # Create a new configmap named my-config with key1=config1 and key2=config2
kubectl create configmap my-config --from-literal=key1=config1 --from-literal=key2=config2 # Create a new configmap named my-config from the key=value pairs in the file
kubectl create configmap my-config --from-file=path/to/bar #指定时也可以不用写key，文件名直接为key # Create a new configmap named my-config from an env file
kubectl create configmap my-config --from-env-file=path/to/bar.envOptions:
--allow-missing-template-keys=true: If true, ignore any errors in templates when a field or map key is missing in
the template. Only applies to golang and jsonpath output formats.
--append-hash=false: Append a hash of the configmap to its name.
--dry-run=false: If true, only print the object that would be sent, without sending it.
--from-env-file='': Specify the path to a file to read lines of key=val pairs to create a configmap (i.e. a Docker
.env file).
--from-file=[]: Key file can be specified using its file path, in which case file basename will be used as
configmap key, or optionally with a key and file path, in which case the given key will be used. Specifying a directory
will iterate each named file in the directory whose basename is a valid configmap key.
--from-literal=[]: Specify a key and literal value to insert in configmap (i.e. mykey=somevalue)
--generator='configmap/v1': The name of the API generator to use.
-o, --output='': Output format. One of:
json|yaml|name|template|go-template|go-template-file|templatefile|jsonpath|jsonpath-file.
--save-config=false: If true, the configuration of current object will be saved in its annotation. Otherwise, the
annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--template='': Template string or path to template file to use when -o=go-template, -o=go-template-file. The
template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--validate=true: If true, use a schema to validate the input before sending itUsage:
kubectl create configmap NAME [--from-file=[key=]source] [--from-literal=key1=value1] [--dry-run] [options]Use "kubectl options" for a list of global command-line options (applies to all commands).

[root@k8smaster volumes]# kubectl create configmap nginx-config --from-literal=nginx_port= --from-literal=server_name=myapp.wohaoshuai.com
configmap/nginx-config created
[root@k8smaster volumes]# kubectl get cm -o wide
NAME DATA AGE
nginx-config 8s
[root@k8smaster volumes]# kubectl describe cm nginx-config
Name: nginx-config
Namespace: default
Labels: <none>
Annotations: <none>Data
====
nginx_port:
----server_name:
----
myapp.wohaoshuai.com
Events: <none>

[root@k8smaster configmap]# cat www.conf
server {
server_name myapp.wohaoshuai.com;
listen ;
root /data/web/html;
}
[root@k8smaster configmap]# kubectl create configmap nginx-www --from-file=./www.conf #不给键直接给文件默认键为文件名
configmap/nginx-www created
[root@k8smaster configmap]# kubectl get cm
NAME DATA AGE
nginx-config 8m
nginx-www 11s
[root@k8smaster configmap]# kubectl get cm nginx-www -o yaml
apiVersion: v1
data:
www.conf: "server {\n\tserver_name myapp.wohaoshuai.com;\n\tlisten 80;\n\troot /data/web/html;\n}\n"
kind: ConfigMap
metadata:
creationTimestamp: --19T09::34Z
name: nginx-www
namespace: default
resourceVersion: ""
selfLink: /api/v1/namespaces/default/configmaps/nginx-www
uid: a9098a25--11e9-814e-000c29d142be
[root@k8smaster configmap]# kubectl describe cm nginx-www
Name: nginx-www
Namespace: default
Labels: <none>
Annotations: <none>Data
====
www.conf:
----
server {
server_name myapp.wohaoshuai.com;
listen ;
root /data/web/html;
}Events: <none>

[root@k8smaster configmap]# cat pod-configmap.yaml
apiVersion: v1
kind: Pod
metadata:
name: pod-cm-
namespace: default
labels: #也可以在此处写上{app:myapp,tier:frontend}代替下面两行
app: myapp #应用层级标签
tier: frontend #架构层级标签，在分层架构中属于frontend层
annotations:
wohaoshuai.com/created-by: "cluster admin"
spec:
containers: #是一个列表，具体定义方式如下
- name: myapp
image: ikubernetes/myapp:v1
ports: #不暴露端口其实也可以被访问，目的是为了说明启动的端口有哪些
- name: http #service 中可以通过名称来引用端口
containerPort:
env:
- name: NGINX_SERVER_PORT
valueFrom:
configMapKeyRef:
name: nginx-config
key: nginx_port
- name: NGINX_SERVER_NAME
valueFrom:
configMapKeyRef:
name: nginx-config
key: server_name
[root@k8smaster configmap]# kubectl apply -f pod-configmap.yaml
pod/pod-cm- created

[root@k8smaster ~]# kubectl exec -it pod-cm- printenv |grep -E "NGINX_SERVER_PORT|NGINX_SERVER_NAME"
NGINX_SERVER_PORT=
NGINX_SERVER_NAME=myapp.wohaoshuai.com

[root@k8smaster ~]# kubectl edit cm nginx-config
configmap/nginx-config edited
[root@k8smaster ~]# kubectl describe cm nginx-config
Name: nginx-config
Namespace: default
Labels: <none>
Annotations: <none>Data
====
nginx_port:
----server_name:
----
myapp.wohaoshuai.com
Events: <none>
[root@k8smaster ~]# kubectl exec -it pod-cm- printenv |grep -E "NGINX_SERVER_PORT|NGINX_SERVER_NAME"
NGINX_SERVER_PORT=
NGINX_SERVER_NAME=myapp.wohaoshuai.com

[root@k8smaster configmap]# cat pod-configmap-.yaml
apiVersion: v1
kind: Pod
metadata:
name: pod-cm-
namespace: default
labels: #也可以在此处写上{app:myapp,tier:frontend}代替下面两行
app: myapp #应用层级标签
tier: frontend #架构层级标签，在分层架构中属于frontend层
annotations:
wohaoshuai.com/created-by: "cluster admin"
spec:
containers: #是一个列表，具体定义方式如下
- name: myapp
image: ikubernetes/myapp:v1
ports: #不暴露端口其实也可以被访问，目的是为了说明启动的端口有哪些
- name: http #service 中可以通过名称来引用端口
containerPort:
volumeMounts: #在容器中使用pod定义的volumes
- name: nginxconfig
mountPath: /etc/nginx/config.d/
readOnly: true
volumes: #在pod中定义volumes
- name: nginxconfig
configMap:
name: nginx-config
[root@k8smaster configmap]# kubectl apply -f pod-configmap-.yaml
pod/pod-cm- created[root@k8smaster ~]# kubectl exec -it pod-cm- ls /etc/nginx/config.d/
nginx_port server_name
[root@k8smaster ~]# kubectl exec -it pod-cm- cat /etc/nginx/config.d/nginx_port[root@k8smaster ~]# kubectl exec -it pod-cm- cat /etc/nginx/config.d/server_name
myapp.wohaoshuai.com

[root@k8smaster configmap]# kubectl edit cm nginx-config
configmap/nginx-config edited
[root@k8smaster configmap]# kubectl describe cm nginx-config
Name: nginx-config
Namespace: default
Labels: <none>
Annotations: <none>Data
====
server_name:
----
myapp.wohaoshuai.com
nginx_port:
----Events: <none>
[root@k8smaster configmap]# kubectl exec -it pod-cm- cat /etc/nginx/config.d/nginx_port

[root@k8smaster configmap]# cat pod-configmap-.yaml
apiVersion: v1
kind: Pod
metadata:
name: pod-cm-
namespace: default
labels: #也可以在此处写上{app:myapp,tier:frontend}代替下面两行
app: myapp #应用层级标签
tier: frontend #架构层级标签，在分层架构中属于frontend层
annotations:
wohaoshuai.com/created-by: "cluster admin"
spec:
containers: #是一个列表，具体定义方式如下
- name: myapp
image: ikubernetes/myapp:v1
ports: #不暴露端口其实也可以被访问，目的是为了说明启动的端口有哪些
- name: http #service 中可以通过名称来引用端口
containerPort:
volumeMounts: #在容器中使用pod定义的volumes
- name: nginxconfig
mountPath: /etc/nginx/conf.d/
readOnly: true
volumes: #在pod中定义volumes
- name: nginxconfig
configMap:
name: nginx-www
[root@k8smaster configmap]# kubectl apply -f pod-configmap-.yaml
pod/pod-cm- created
[root@k8smaster configmap]# kubectl exec -it pod-cm- ls /etc/nginx/conf.d/
www.conf
[root@k8smaster configmap]# kubectl exec -it pod-cm- cat /etc/nginx/conf.d/www.conf
server {
server_name myapp.wohaoshuai.com;
listen ;
root /data/web/html;
}

[root@k8smaster configmap]# kubectl get pod -o wide |grep pod-cm-
pod-cm- / Running 9m 10.244.2.108 k8snode2
[root@k8smaster configmap]# kubectl exec -it pod-cm- /bin/sh
/ # mkdir -p /data/web/html
/ # echo "<h1>Nginx Server configured by CM<h1>" >>/data/web/html/index.html
/ # exit
[root@k8smaster configmap]# curl 10.244.2.108

<h1>Nginx Server configured by CM<h1>

[root@k8smaster configmap]# kubectl describe cm nginx-www
Name: nginx-www
Namespace: default
Labels: <none>
Annotations: <none>Data
====
www.conf:
----
server {
server_name myapp.wohaoshuai.com;
listen ;
root /data/web/html;
}Events: <none>
[root@k8smaster configmap]# kubectl exec -it pod-cm- cat /etc/nginx/conf.d/www.conf
server {
server_name myapp.wohaoshuai.com;
listen ;
root /data/web/html;
}[root@k8smaster configmap]# kubectl exec -it pod-cm- /bin/sh/ # netstat -anpt
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0.0.0.0: 0.0.0.0:* LISTEN /nginx: master pro
/ # nginx -s reload #重载配置文件
// :: [notice] #: signal process started
/ # netstat -anpt
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0.0.0.0: 0.0.0.0:* LISTEN /nginx: master pro

[root@k8smaster configmap]# kubectl create secret generic mysql-root-password --from-literal=password=MyP@ss123
secret/mysql-root-password created[root@k8smaster configmap]# kubectl get secret
NAME TYPE DATA AGE
default-token-jvtl7 kubernetes.io/service-account-token 42d
mysql-root-password Opaque 19s
tomcat-ingress-secret kubernetes.io/tls 6d
[root@k8smaster configmap]# kubectl describe secret mysql-root-password
Name: mysql-root-password
Namespace: default
Labels: <none>
Annotations: <none>Type: OpaqueData
====
password: bytes

[root@k8smaster configmap]# kubectl get secret mysql-root-password -o yaml
apiVersion: v1
data:
password: TXlQQHNzMTIz
kind: Secret
metadata:
creationTimestamp: --20T06::03Z
name: mysql-root-password
namespace: default
resourceVersion: ""
selfLink: /api/v1/namespaces/default/secrets/mysql-root-password
uid: 9b9d1d06--11e9-814e-000c29d142be
type: Opaque

[root@k8smaster configmap]# echo TXlQQHNzMTIz |base64 -d
MyP@ss123

[root@k8smaster configmap]# cat pod-secret-.yaml
apiVersion: v1
kind: Pod
metadata:
name: pod-secret-
namespace: default
labels: #也可以在此处写上{app:myapp,tier:frontend}代替下面两行
app: myapp #应用层级标签
tier: frontend #架构层级标签，在分层架构中属于frontend层
annotations:
wohaoshuai.com/created-by: "cluster admin"
spec:
containers: #是一个列表，具体定义方式如下
- name: myapp
image: ikubernetes/myapp:v1
ports: #不暴露端口其实也可以被访问，目的是为了说明启动的端口有哪些
- name: http #service 中可以通过名称来引用端口
containerPort:
env:
- name: MYSQL_ROOT_PASSWORD
valueFrom:
secretKeyRef:
name: mysql-root-password
key: password
[root@k8smaster configmap]# kubectl apply -f pod-secret-.yaml
pod/pod-secret- created
[root@k8smaster configmap]# kubectl exec -it pod-secret- printenv |grep MYSQL_ROOT_PASSWORD
MYSQL_ROOT_PASSWORD=MyP@ss123