Harbor 使用 Helm 一键安装

Kubernetes 配置与密钥管理实践指南，使用 ConfigMap 和 Secret 管理应用配置，实现 dev/prod 环境切换，并通过 Helm 实现集中化管理和版本控制。 --- ### 一、基础概念快速理解 1. **ConfigMap**：存储非敏感配置数据（如环境变量、配置文件） 2. **Secret**：存储敏感信息（如密码、API密钥），数据以 Base64 编码存储 3. **Helm**：Kubernetes 包管理工具，实现配置模板化和版本控制 4. **多环境管理**：使用不同配置文件切换开发和生产环境 --- ### 二、详细实现步骤 #### 步骤1：创建目录结构 ```bash myapp/ ├── base/ # 基础配置 │ ├── configmap.yaml │ ├── secret.yaml │ └── kustomization.yaml ├── overlays/ # 环境覆盖配置 │ ├── dev/ │ │ ├── configmap-patch.yaml │ │ ├── secret-patch.yaml │ │ └── kustomization.yaml │ └── prod/ │ ├── configmap-patch.yaml │ ├── secret-patch.yaml │ └── kustomization.yaml └── helm/ # Helm 模板 ├── Chart.yaml ├── values.yaml └── templates/ ├── deployment.yaml ├── configmap.yaml └── secret.yaml ``` #### 步骤2：创建基础配置（base/） **base/configmap.yaml** ```yaml apiVersion: v1 kind: ConfigMap metadata: name: app-config data: # 公共配置 app.properties: | server.port=8080 logging.level=INFO # 环境特定占位符 db.host=${DB_HOST} db.port=${DB_PORT} ``` **base/secret.yaml** ```yaml apiVersion: v1 kind: Secret metadata: name: app-secret type: Opaque data: # 使用base64编码占位符 db.username: ${DB_USERNAME} db.password: ${DB_PASSWORD} ``` **base/kustomization.yaml** ```yaml apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - configmap.yaml - secret.yaml ``` #### 步骤3：创建开发环境覆盖配置（overlays/dev/） **overlays/dev/configmap-patch.yaml** ```yaml apiVersion: v1 kind: ConfigMap metadata: name: app-config data: app.properties: | db.host=dev-db.example.com db.port=3306 ``` **overlays/dev/secret-patch.yaml** ```yaml apiVersion: v1 kind: Secret metadata: name: app-secret data: db.username: ZGV2LXVzZXI= # base64("dev-user") db.password: ZGV2LXBhc3M= # base64("dev-pass") ``` **overlays/dev/kustomization.yaml** ```yaml apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../../base patches: - path: configmap-patch.yaml - path: secret-patch.yaml ``` #### 步骤4：创建生产环境覆盖配置（overlays/prod/） **overlays/prod/configmap-patch.yaml** ```yaml apiVersion: v1 kind: ConfigMap metadata: name: app-config data: app.properties: | db.host=prod-db.example.com db.port=5432 ``` **overlays/prod/secret-patch.yaml** ```yaml apiVersion: v1 kind: Secret metadata: name: app-secret data: db.username: cHJvZC11c2Vy # base64("prod-user") db.password: cHJvZC1wYXNzd29yZA== # base64("prod-password") ``` **overlays/prod/kustomization.yaml** ```yaml apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../../base patches: - path: configmap-patch.yaml - path: secret-patch.yaml ``` #### 步骤5：创建 Helm 模板（helm/） **helm/Chart.yaml** ```yaml apiVersion: v2 name: myapp description: My Application Helm Chart version: 0.1.0 ``` **helm/values.yaml** ```yaml # 默认值 environment: dev replicaCount: 1 config: dbHost: "default-db.example.com" dbPort: "3306" secret: dbUsername: "default-user" dbPassword: "default-pass" ``` **helm/templates/configmap.yaml** ```yaml apiVersion: v1 kind: ConfigMap metadata: name: {{ .Release.Name }}-config data: app.properties: | server.port=8080 logging.level=INFO db.host={{ .Values.config.dbHost }} db.port={{ .Values.config.dbPort }} ``` **helm/templates/secret.yaml** ```yaml apiVersion: v1 kind: Secret metadata: name: {{ .Release.Name }}-secret type: Opaque data: db.username: {{ .Values.secret.dbUsername | b64enc }} db.password: {{ .Values.secret.dbPassword | b64enc }} ``` **helm/templates/deployment.yaml** ```yaml apiVersion: apps/v1 kind: Deployment metadata: name: {{ .Release.Name }}-deployment spec: replicas: {{ .Values.replicaCount }} selector: matchLabels: app: myapp template: metadata: labels: app: myapp spec: containers: - name: app image: myapp:{{ .Values.environment }} volumeMounts: - name: config-volume mountPath: /etc/config - name: secret-volume mountPath: /etc/secret readOnly: true env: - name: ENVIRONMENT value: {{ .Values.environment }} volumes: - name: config-volume configMap: name: {{ .Release.Name }}-config - name: secret-volume secret: secretName: {{ .Release.Name }}-secret ``` #### 步骤6：部署应用到不同环境 ```bash # 部署开发环境 helm install myapp-dev ./helm \ --set environment=dev \ --set config.dbHost="dev-db.example.com" \ --set config.dbPort="3306" \ --set secret.dbUsername="dev-user" \ --set secret.dbPassword="dev-pass" # 部署生产环境 helm install myapp-prod ./helm \ --set environment=prod \ --set replicaCount=3 \ --set config.dbHost="prod-db.example.com" \ --set config.dbPort="5432" \ --set secret.dbUsername="prod-user" \ --set secret.dbPassword="prod-password" ``` #### 步骤7：验证配置 ```bash # 检查ConfigMap kubectl get configmap -l app=myapp -o yaml # 检查Secret（注意：密码会以base64显示） kubectl get secret -l app=myapp -o yaml # 查看Pod中的环境变量 kubectl exec <pod-name> -- env | grep DB_ ``` --- ### 三、配置热重载（可选） 在Deployment中添加注解实现配置自动重载： ```yaml # 在helm/templates/deployment.yaml中添加 spec: template: metadata: annotations: config.reload/reload: "true" spec: containers: - name: app lifecycle: postStart: exec: command: ["/bin/sh", "-c", "touch /etc/config/reload"] ``` --- ### 四、版本控制与CI/CD集成 1. 将整个配置目录提交到Git仓库 2. 使用Helm版本管理： ```bash # 打包Chart helm package ./helm # 查看版本历史 helm history myapp-dev # 回滚到上一版本 helm rollback myapp-dev 1 ``` 3. 在CI/CD流水线中添加： ```yaml # GitLab CI示例 deploy_dev: stage: deploy script: - helm upgrade --install myapp-dev ./helm -f ./overlays/dev/values.yaml only: - dev deploy_prod: stage: deploy script: - helm upgrade --install myapp-prod ./helm -f ./overlays/prod/values.yaml only: - main ``` --- ### 五、安全最佳实践 1. **Secret加密**： ```bash # 使用Kubernetes加密Secret kubectl create secret generic prod-secret \ --from-literal=username=prod-user \ --from-literal=password=prod-password \ --dry-run=client -o yaml | \ kubeseal --format yaml > sealed-secret.yaml ``` 2. **RBAC权限控制**： ```yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: config-reader rules: - apiGroups: [""] resources: ["configmaps", "secrets"] verbs: ["get", "watch", "list"] ``` --- ### 六、常见问题解决 1. **ConfigMap未更新**： ```bash # 手动重启Pod kubectl rollout restart deployment/<deployment-name> ``` 2. **Secret解码**： ```bash echo <base64-string> | base64 --decode ``` 3. **环境变量注入**： ```yaml env: - name: DB_HOST valueFrom: configMapKeyRef: name: app-config key: db.host ``` --- ### 七、学习资源推荐 1. 官方文档：[ConfigMap](https://kubernetes.io/docs/concepts/configuration/configmap/) | [Secret](https://kubernetes.io/docs/concepts/configuration/secret/) 2. 入门书籍：《Kubernetes in Action》 3. 实践教程：[Kustomize 官方指南](https://kubectl.docs.kubernetes.io/guides/config_management/) ---按照以上步骤实现后，怎么去演示各个功能点