活动介绍
file-type

Kubernetes配置清单详解

ZIP文件

下载需积分: 5 | 3KB | 更新于2025-01-01 | 201 浏览量 | 0 下载量 举报 收藏
download 立即下载
知识点1:Kubernetes简介 Kubernetes,简称K8s,是一个开源的容器编排平台,用于自动化部署、扩展和管理容器化应用。它最初是由Google设计并捐赠给Cloud Native Computing Foundation(CNCF)的,旨在提供一个简单易用的系统,以便实现容器化应用的部署、调度以及运维。Kubernetes具有高度的扩展性,并支持多种容器工具,如Docker。 知识点2:配置清单概念 在Kubernetes中,配置清单(Manifest)是用于定义集群中资源对象的YAML或JSON格式的文件。它是描述期望状态的声明性配置,用于创建、更新和删除资源。配置清单文件通常包含一个或多个资源的定义,比如Pods、Services、Deployments等。通过编辑和应用配置清单文件,用户可以对Kubernetes集群进行管理。 知识点3:YAML文件格式 YAML(YAML Ain't Markup Language)是一种易读的、友好的数据序列化语言,常用于配置文件。Kubernetes的配置清单文件通常使用YAML格式。YAML通过空格缩进来表示数据结构,支持嵌套的数据结构,这使得它非常适合用来描述Kubernetes对象的层次性和关联性。 知识点4:Kubernetes基本对象 Kubernetes的基本对象包括但不限于以下几种: - Pod:Kubernetes中最小的部署单元,一组运行在相同节点上的容器的集合。 - Service:定义一组Pod访问策略,通常用于提供服务发现和负载均衡。 - Deployment:管理Pod和ReplicaSets(副本集),用于无状态应用的部署。 - ReplicaSet:确保指定数量的Pod副本始终运行,是Deployment的底层机制。 - ConfigMap:用来存储非敏感配置信息,以键值对的形式挂载到Pod中。 - Secret:用于存储敏感信息,如密码或OAuth令牌。 知识点5:资源清单文件编写 编写资源清单文件时需要遵循Kubernetes API的规范。一个基本的资源清单文件通常包括以下几个部分: - apiVersion:指定Kubernetes API版本。 - kind:指定资源对象的类型。 - metadata:包含数据的元信息,如name、namespace、labels等。 - spec:定义资源的期望状态。 例如,创建一个简单的Deployment资源清单文件示例如下: ```yaml apiVersion: apps/v1 kind: Deployment metadata: name: my-deployment spec: replicas: 3 selector: matchLabels: app: my-app template: metadata: labels: app: my-app spec: containers: - name: my-container image: nginx:latest ``` 知识点6:资源配置清单的管理和应用 配置清单文件的管理和应用通常通过kubectl命令行工具进行。kubectl会将YAML文件发送给Kubernetes API服务器,以创建、更新或删除集群中的资源。常用命令如下: - kubectl apply -f <file.yaml>:应用或更新资源配置清单文件。 - kubectl get <resource>:获取指定资源的详细信息。 - kubectl describe <resource>:查看指定资源的详细状态描述。 - kubectl delete -f <file.yaml>:删除资源配置清单文件中定义的资源。 知识点7:k8s-config-main文件内容分析 在本案例中,提供的压缩包子文件的文件名称列表中包含了 "k8s-config-main"。这暗示该文件可能是一个主配置文件,用于存储或引用集群中核心的配置清单。此文件可能包含集群级别的配置,如命名空间、网络策略、存储配置等,或者是对多个资源对象的集中管理。由于没有具体的内容,无法详细分析其结构和内容,但可以确定它是Kubernetes集群配置和管理不可或缺的一部分。

相关推荐

filetype

--- kind: Namespace apiVersion: v1 metadata: name: kube-flannel labels: k8s-app: flannel pod-security.kubernetes.io/enforce: privileged --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: labels: k8s-app: flannel name: flannel rules: - apiGroups: - "" resources: - pods verbs: - get - apiGroups: - "" resources: - nodes verbs: - get - list - watch - apiGroups: - "" resources: - nodes/status verbs: - patch --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: labels: k8s-app: flannel name: flannel roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: flannel subjects: - kind: ServiceAccount name: flannel namespace: kube-flannel --- apiVersion: v1 kind: ServiceAccount metadata: labels: k8s-app: flannel name: flannel namespace: kube-flannel --- kind: ConfigMap apiVersion: v1 metadata: name: kube-flannel-cfg namespace: kube-flannel labels: tier: node k8s-app: flannel app: flannel data: cni-conf.json: | { "name": "cbr0", "cniVersion": "0.3.1", "plugins": [ { "type": "flannel", "delegate": { "hairpinMode": true, "isDefaultGateway": true } }, { "type": "portmap", "capabilities": { "portMappings": true } } ] } net-conf.json: | { "Network": "10.244.0.0/16", "EnableNFTables": false, "Backend": { "Type": "vxlan" } } --- apiVersion: apps/v1 kind: DaemonSet metadata: name: kube-flannel-ds namespace: kube-flannel labels: tier: node app: flannel k8s-app: flannel spec: selector: matchLabels: app: flannel template: metadata: labels: tier: node app: flannel spec: affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: kubernetes.io/os operator: In values: - linux hostNetwork: true priorityClassName: system-node-critical tolerations: - operator: Exists effect: NoSchedule serviceAccountName: flannel initContainers: - name: install-cni-plugin image: ghcr.io/flannel-io/flannel-cni-plugin:v1.7.1-flannel1 command: - cp args: - -f - /flannel - /opt/cni/bin/flannel volumeMounts: - name: cni-plugin mountPath: /opt/cni/bin - name: install-cni image: ghcr.io/flannel-io/flannel:v0.27.0 command: - cp args: - -f - /etc/kube-flannel/cni-conf.json - /etc/cni/net.d/10-flannel.conflist volumeMounts: - name: cni mountPath: /etc/cni/net.d - name: flannel-cfg mountPath: /etc/kube-flannel/ containers: - name: kube-flannel image: ghcr.io/flannel-io/flannel:v0.27.0 command: - /opt/bin/flanneld args: - --ip-masq - --kube-subnet-mgr resources: requests: cpu: "100m" memory: "50Mi" securityContext: privileged: false capabilities: add: ["NET_ADMIN", "NET_RAW"] env: - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: EVENT_QUEUE_DEPTH value: "5000" - name: CONT_WHEN_CACHE_NOT_READY value: "false" volumeMounts: - name: run mountPath: /run/flannel - name: flannel-cfg mountPath: /etc/kube-flannel/ - name: xtables-lock mountPath: /run/xtables.lock volumes: - name: run hostPath: path: /run/flannel - name: cni-plugin hostPath: path: /opt/cni/bin - name: cni hostPath: path: /etc/cni/net.d - name: flannel-cfg configMap: name: kube-flannel-cfg - name: xtables-lock hostPath: path: /run/xtables.lock type: FileOrCreate

filetype

Kubernetes 配置与密钥管理实践指南,使用 ConfigMap 和 Secret 管理应用配置,实现 dev/prod 环境切换,并通过 Helm 实现集中化管理和版本控制。 --- ### 一、基础概念快速理解 1. **ConfigMap**:存储非敏感配置数据(如环境变量、配置文件) 2. **Secret**:存储敏感信息(如密码、API密钥),数据以 Base64 编码存储 3. **Helm**:Kubernetes 包管理工具,实现配置模板化和版本控制 4. **多环境管理**:使用不同配置文件切换开发和生产环境 --- ### 二、详细实现步骤 #### 步骤1:创建目录结构 ```bash myapp/ ├── base/ # 基础配置 │ ├── configmap.yaml │ ├── secret.yaml │ └── kustomization.yaml ├── overlays/ # 环境覆盖配置 │ ├── dev/ │ │ ├── configmap-patch.yaml │ │ ├── secret-patch.yaml │ │ └── kustomization.yaml │ └── prod/ │ ├── configmap-patch.yaml │ ├── secret-patch.yaml │ └── kustomization.yaml └── helm/ # Helm 模板 ├── Chart.yaml ├── values.yaml └── templates/ ├── deployment.yaml ├── configmap.yaml └── secret.yaml ``` #### 步骤2:创建基础配置(base/) **base/configmap.yaml** ```yaml apiVersion: v1 kind: ConfigMap metadata: name: app-config data: # 公共配置 app.properties: | server.port=8080 logging.level=INFO # 环境特定占位符 db.host=${DB_HOST} db.port=${DB_PORT} ``` **base/secret.yaml** ```yaml apiVersion: v1 kind: Secret metadata: name: app-secret type: Opaque data: # 使用base64编码占位符 db.username: ${DB_USERNAME} db.password: ${DB_PASSWORD} ``` **base/kustomization.yaml** ```yaml apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - configmap.yaml - secret.yaml ``` #### 步骤3:创建开发环境覆盖配置(overlays/dev/) **overlays/dev/configmap-patch.yaml** ```yaml apiVersion: v1 kind: ConfigMap metadata: name: app-config data: app.properties: | db.host=dev-db.example.com db.port=3306 ``` **overlays/dev/secret-patch.yaml** ```yaml apiVersion: v1 kind: Secret metadata: name: app-secret data: db.username: ZGV2LXVzZXI= # base64("dev-user") db.password: ZGV2LXBhc3M= # base64("dev-pass") ``` **overlays/dev/kustomization.yaml** ```yaml apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../../base patches: - path: configmap-patch.yaml - path: secret-patch.yaml ``` #### 步骤4:创建生产环境覆盖配置(overlays/prod/) **overlays/prod/configmap-patch.yaml** ```yaml apiVersion: v1 kind: ConfigMap metadata: name: app-config data: app.properties: | db.host=prod-db.example.com db.port=5432 ``` **overlays/prod/secret-patch.yaml** ```yaml apiVersion: v1 kind: Secret metadata: name: app-secret data: db.username: cHJvZC11c2Vy # base64("prod-user") db.password: cHJvZC1wYXNzd29yZA== # base64("prod-password") ``` **overlays/prod/kustomization.yaml** ```yaml apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../../base patches: - path: configmap-patch.yaml - path: secret-patch.yaml ``` #### 步骤5:创建 Helm 模板(helm/) **helm/Chart.yaml** ```yaml apiVersion: v2 name: myapp description: My Application Helm Chart version: 0.1.0 ``` **helm/values.yaml** ```yaml # 默认值 environment: dev replicaCount: 1 config: dbHost: "default-db.example.com" dbPort: "3306" secret: dbUsername: "default-user" dbPassword: "default-pass" ``` **helm/templates/configmap.yaml** ```yaml apiVersion: v1 kind: ConfigMap metadata: name: {{ .Release.Name }}-config data: app.properties: | server.port=8080 logging.level=INFO db.host={{ .Values.config.dbHost }} db.port={{ .Values.config.dbPort }} ``` **helm/templates/secret.yaml** ```yaml apiVersion: v1 kind: Secret metadata: name: {{ .Release.Name }}-secret type: Opaque data: db.username: {{ .Values.secret.dbUsername | b64enc }} db.password: {{ .Values.secret.dbPassword | b64enc }} ``` **helm/templates/deployment.yaml** ```yaml apiVersion: apps/v1 kind: Deployment metadata: name: {{ .Release.Name }}-deployment spec: replicas: {{ .Values.replicaCount }} selector: matchLabels: app: myapp template: metadata: labels: app: myapp spec: containers: - name: app image: myapp:{{ .Values.environment }} volumeMounts: - name: config-volume mountPath: /etc/config - name: secret-volume mountPath: /etc/secret readOnly: true env: - name: ENVIRONMENT value: {{ .Values.environment }} volumes: - name: config-volume configMap: name: {{ .Release.Name }}-config - name: secret-volume secret: secretName: {{ .Release.Name }}-secret ``` #### 步骤6:部署应用到不同环境 ```bash # 部署开发环境 helm install myapp-dev ./helm \ --set environment=dev \ --set config.dbHost="dev-db.example.com" \ --set config.dbPort="3306" \ --set secret.dbUsername="dev-user" \ --set secret.dbPassword="dev-pass" # 部署生产环境 helm install myapp-prod ./helm \ --set environment=prod \ --set replicaCount=3 \ --set config.dbHost="prod-db.example.com" \ --set config.dbPort="5432" \ --set secret.dbUsername="prod-user" \ --set secret.dbPassword="prod-password" ``` #### 步骤7:验证配置 ```bash # 检查ConfigMap kubectl get configmap -l app=myapp -o yaml # 检查Secret(注意:密码会以base64显示) kubectl get secret -l app=myapp -o yaml # 查看Pod中的环境变量 kubectl exec <pod-name> -- env | grep DB_ ``` --- ### 三、配置热重载(可选) 在Deployment中添加注解实现配置自动重载: ```yaml # 在helm/templates/deployment.yaml中添加 spec: template: metadata: annotations: config.reload/reload: "true" spec: containers: - name: app lifecycle: postStart: exec: command: ["/bin/sh", "-c", "touch /etc/config/reload"] ``` --- ### 四、版本控制与CI/CD集成 1. 将整个配置目录提交到Git仓库 2. 使用Helm版本管理: ```bash # 打包Chart helm package ./helm # 查看版本历史 helm history myapp-dev # 回滚到上一版本 helm rollback myapp-dev 1 ``` 3. 在CI/CD流水线中添加: ```yaml # GitLab CI示例 deploy_dev: stage: deploy script: - helm upgrade --install myapp-dev ./helm -f ./overlays/dev/values.yaml only: - dev deploy_prod: stage: deploy script: - helm upgrade --install myapp-prod ./helm -f ./overlays/prod/values.yaml only: - main ``` --- ### 五、安全最佳实践 1. **Secret加密**: ```bash # 使用Kubernetes加密Secret kubectl create secret generic prod-secret \ --from-literal=username=prod-user \ --from-literal=password=prod-password \ --dry-run=client -o yaml | \ kubeseal --format yaml > sealed-secret.yaml ``` 2. **RBAC权限控制**: ```yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: config-reader rules: - apiGroups: [""] resources: ["configmaps", "secrets"] verbs: ["get", "watch", "list"] ``` --- ### 六、常见问题解决 1. **ConfigMap未更新**: ```bash # 手动重启Pod kubectl rollout restart deployment/<deployment-name> ``` 2. **Secret解码**: ```bash echo <base64-string> | base64 --decode ``` 3. **环境变量注入**: ```yaml env: - name: DB_HOST valueFrom: configMapKeyRef: name: app-config key: db.host ``` --- ### 七、学习资源推荐 1. 官方文档:[ConfigMap](https://kubernetes.io/docs/concepts/configuration/configmap/) | [Secret](https://kubernetes.io/docs/concepts/configuration/secret/) 2. 入门书籍:《Kubernetes in Action》 3. 实践教程:[Kustomize 官方指南](https://kubectl.docs.kubernetes.io/guides/config_management/) ---按照以上步骤实现后,怎么去演示各个功能点