Kubernetes-k8s

部署Kubernetes之前⼀定要确保etcd、flannel、docker是正常工作的，否则先解决问题再继续。
检查etcd：
/opt/etcd/bin/etcdctl --ca-file=/opt/etcd/ssl/ca.pem --cert-file=/opt/etcd/ssl/server.pem --key-file=/opt/etcd/ssl/server-key.pem --endpoints="https://192.168.209.143:2379,https://192.168.209.11:2379,https://192.168.209.12:2379" cluster-health

1、生成证书（给api-server创建的证书，别的服务访问api-server的时候需要通过证书认证
）

mkdir -p /opt/crt/
cd /opt/crt/
vim ca-config.json

{
    "signing": {
        "default": {
            "expiry": "87600h"
        },
        "profiles": {
            "kubernetes": {
                "expiry": "87600h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth",
                    "client auth"
                ]
            }
        }
    }
}

vim ca-csr.json  #定义生产签名所需要的信息参数

{
    "CN": "kubernetes",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "Beijing",
            "ST": "Beijing",
            "O": "k8s",
            "OU": "System"
        }
    ]
}

2、生产ca证书和私钥

cfssl gencert -initca ca-csr.json | cfssljson -bare ca -

3、生成apiserver证书

vim server-csr.json

{
    "CN": "kubernetes",
    "hosts": [
        "10.0.0.1", 	#这是后⾯dns要使用的虚拟网络的网关，不用改，就用这个切忌
        "127.0.0.1",
        "192.168.209.143", 	# master的IP地址。
        "192.168.209.11",
        "192.168.209.12",
        "kubernetes",
        "kubernetes.default",
        "kubernetes.default.svc",
        "kubernetes.default.svc.cluster",
        "kubernetes.default.svc.cluster.local"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "BeiJing",
            "ST": "BeiJing",
            "O": "k8s",
            "OU": "System"
        }
    ]
}

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes server-csr.json | cfssljson -bare server

4、生成kube-proxy证书

vim kube-proxy-csr.json

{
    "CN": "system:kube-proxy",
    "hosts": [],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "BeiJing",
            "ST": "BeiJing",
            "O": "k8s",
            "OU": "System"
        }
    ]
}

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy

最终效果：

[root@master crt]# ls *.pem

ca-key.pem  ca.pem  kube-proxy-key.pem  kube-proxy.pem  server-key.pem  server.pem

1、下载二进制包

wget https://dl.k8s.io/v1.11.10/kubernetes-server-linux-amd64.tar.gz
mkdir /opt/kubernetes/{bin,cfg,ssl} -pv
tar zxvf kubernetes-server-linux-amd64.tar.gz

cd kubernetes/server/bin
cp kube-apiserver kube-scheduler kube-controller-manager kubectl /opt/kubernetes/bin

因为在本机生成的证书 直接拷贝即可
cp /opt/crt/*.pem /opt/kubernetes/ssl/

2、创建token文件

cd /opt/kubernetes/cfg/
vim token.csv

674c457d4dcf2eefe4920d7dbb6b0ddc,kubelet-bootstrap,10001,"system:kubelet-bootstrap"
第⼀列：随机字符串，自⼰可生成
第二列：用户名
第三列：UID
第四列：用户组

3、创建apiserver配置文件

cd /opt/kubernetes/cfg
vim kube-apiserver	#不要有多余空格换行等

KUBE_APISERVER_OPTS="--logtostderr=true \
--v=4 \
--etcd-servers=https://192.168.209.143:2379,https://192.168.209.11:2379,https://192.168.209.12:2379 \
--bind-address=192.168.209.143 \#master的ip地址，就是安装api-server的机器地址
--secure-port=6443 \
--advertise-address=192.168.209.143 \
--allow-privileged=true \
--service-cluster-ip-range=10.0.0.0/24 \ #这里就用这个网段切记不要修改
--enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,ResourceQuota,NodeRestriction \
--authorization-mode=RBAC,Node \
--enable-bootstrap-token-auth \
--token-auth-file=/opt/kubernetes/cfg/token.csv \
--service-node-port-range=30000-50000 \
--tls-cert-file=/opt/kubernetes/ssl/server.pem \
--tls-private-key-file=/opt/kubernetes/ssl/server-key.pem \
--client-ca-file=/opt/kubernetes/ssl/ca.pem \
--service-account-key-file=/opt/kubernetes/ssl/ca-key.pem \
--etcd-cafile=/opt/etcd/ssl/ca.pem \
--etcd-certfile=/opt/etcd/ssl/server.pem \
--etcd-keyfile=/opt/etcd/ssl/server-key.pem"

参数说明：

* --logtostderr 启用⽇志 
* --v ⽇志等级 
* --etcd-servers etcd集群地址 
* --bind-address 监听地址 
* --secure-port https安全端⼝ 
* --advertise-address 集群通告地址 
* --allow-privileged 启用授权 
* --service-cluster-ip-range Service虚拟IP地址段 
* --enable-admission-plugins 准⼊控制模块 
* --authorization-mode 认证授权，启用RBAC授权和节点自管理 
* --enable-bootstrap-token-auth 启用TLS bootstrap功能，后面会讲到 
* --token-auth-file token文件 
* --service-node-port-range Service Node类型默认分配端⼝范围

4、systemd管理apiserver

cd /usr/lib/systemd/system
vim kube-apiserver.service

[Unit]
Description=Kubernetes API Server
Documentation=https://github.com/kubernetes/kubernetes

[Service]
EnvironmentFile=-/opt/kubernetes/cfg/kube-apiserver
ExecStart=/opt/kubernetes/bin/kube-apiserver $KUBE_APISERVER_OPTS
Restart=on-failure

[Install]
WantedBy=multi-user.target

systemctl daemon-reload
systemctl enable kube-apiserver
systemctl start kube-apiserver
systemctl status kube-apiserver

1、创建schduler配置文件

vim /opt/kubernetes/cfg/kube-scheduler

KUBE_SCHEDULER_OPTS="--logtostderr=true \
--v=4 \
--master=127.0.0.1:8080 \
--leader-elect"

参数说明：
* --master 连接本地apiserver
* --leader-elect 当该组件启动多个时，自动选举（HA）

2、systemd管理schduler组件

cd /usr/lib/systemd/system/
vim kube-scheduler.service

[Unit]
Description=Kubernetes Scheduler
Documentation=https://github.com/kubernetes/kubernetes
[Service]
EnvironmentFile=/opt/kubernetes/cfg/kube-scheduler
ExecStart=/opt/kubernetes/bin/kube-scheduler $KUBE_SCHEDULER_OPTS
Restart=on-failure
[Install]
WantedBy=multi-user.target

3、启动

systemctl daemon-reload
systemctl enable kube-scheduler
systemctl start kube-scheduler
systemctl status kube-scheduler

1、创建controller-manager配置文件

cd /opt/kubernetes/cfg/
vim kube-controller-manager

KUBE_CONTROLLER_MANAGER_OPTS="--logtostderr=true \
--v=4 \
--master=127.0.0.1:8080 \
--leader-elect=true \
--address=127.0.0.1 \
--service-cluster-ip-range=10.0.0.0/24 \	#这是后⾯dns要使用的虚拟网络，不用改，就用这个 切忌
--cluster-name=kubernetes \
--cluster-signing-cert-file=/opt/kubernetes/ssl/ca.pem \
--cluster-signing-key-file=/opt/kubernetes/ssl/ca-key.pem \
--root-ca-file=/opt/kubernetes/ssl/ca.pem \
--service-account-private-key-file=/opt/kubernetes/ssl/ca-key.pem"

2、systemd管理controller-manager组件

cd /usr/lib/systemd/system/
vim kube-controller-manager.service

[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/kubernetes/kubernetes
[Service]
EnvironmentFile=-/opt/kubernetes/cfg/kube-controller-manager
ExecStart=/opt/kubernetes/bin/kube-controller-manager $KUBE_CONTROLLER_MANAGER_OPTS
Restart=on-failure
[Install]
WantedBy=multi-user.target

3、启动

systemctl daemon-reload
systemctl enable kube-controller-manager
systemctl start kube-controller-manager
systemctl status kube-controller-manager.service

4、通过kubectl⼯具查看当前集群组件状态

[root@master system]# /opt/kubernetes/bin/kubectl get cs

效果示例：

NAME                 STATUS    MESSAGE              ERROR
controller-manager   Healthy   ok
scheduler            Healthy   ok
etcd-1               Healthy   {"health": "true"}
etcd-0               Healthy   {"health": "true"}
etcd-2               Healthy   {"health": "true"}

下面这些操作在master节点完成

1、将kubelet-bootstrap用户绑定到系统集群⻆⾊

ln -s /opt/kubernetes/bin/kubectl  /usr/bin/kubectl

/opt/kubernetes/bin/kubectl create clusterrolebinding kubelet-bootstrap --clusterrole=system:node-bootstrapper --user=kubelet-bootstrap

2、创建kubeconfig文件

cd /opt/crt/

KUBE_APISERVER="https://192.168.209.143:6443" 
BOOTSTRAP_TOKEN=674c457d4dcf2eefe4920d7dbb6b0ddc

写你master的ip地址，集群中就写负载均衡的ip地址

3、设置集群参数

/opt/kubernetes/bin/kubectl config set-cluster kubernetes --certificate-authority=ca.pem --embed-certs=true --server=${KUBE_APISERVER}  --kubeconfig=bootstrap.kubeconfig

4、设置客户端认证参数

/opt/kubernetes/bin/kubectl config set-credentials kubelet-bootstrap --token=${BOOTSTRAP_TOKEN} --kubeconfig=bootstrap.kubeconfig

5、设置上下文参数

/opt/kubernetes/bin/kubectl config set-context default  --cluster=kubernetes  --user=kubelet-bootstrap --kubeconfig=bootstrap.kubeconfig

6、设置默认上下文

/opt/kubernetes/bin/kubectl config use-context default --kubeconfig=bootstrap.kubeconfig

7、创建kube-proxy kubeconfig文件

/opt/kubernetes/bin/kubectl config set-cluster kubernetes  --certificate-authority=ca.pem  --embed-certs=true  --server=${KUBE_APISERVER}  --kubeconfig=kube-proxy.kubeconfig

/opt/kubernetes/bin/kubectl config set-credentials kube-proxy  --client-certificate=kube-proxy.pem  --client-key=kube-proxy-key.pem  --embed-certs=true  --kubeconfig=kube-proxy.kubeconfig

/opt/kubernetes/bin/kubectl config set-context default --cluster=kubernetes --user=kube-proxy --kubeconfig=kube-proxy.kubeconfig

/opt/kubernetes/bin/kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig

效果示例：

ls *.kubeconfig

bootstrap.kubeconfig kube-proxy.kubeconfig

8、将这两个 kubeconfig 文件拷贝到 Node 节点 /opt/kubernetes/cfg ⽬录下

scp *.kubeconfig k8s-node1:/opt/kubernetes/cfg/

1、将master中下载的二进制包中的kubelet和kube-proxy拷贝到node节点/opt/kubernetes/bin⽬录下

cd /root/kubernetes/server/bin/
scp kubelet kube-proxy k8s-node1:/opt/kubernetes/bin/

下面这些操作在node节点完成
2、创建kubelet配置文件

vim /opt/kubernetes/cfg/kubelet

KUBELET_OPTS="--logtostderr=true \
--v=4 \
--hostname-override=192.168.209.11 \	#每个节点自⼰的ip地址
--kubeconfig=/opt/kubernetes/cfg/kubelet.kubeconfig \
--bootstrap-kubeconfig=/opt/kubernetes/cfg/bootstrap.kubeconfig \
--config=/opt/kubernetes/cfg/kubelet.config \
--cert-dir=/opt/kubernetes/ssl \
--pod-infra-container-image=registry.cn-hangzhou.aliyuncs.com/google-containers/pause-amd64:3.0"	#这个镜像需要提前下载

下载镜像：
docker pull registry.cn-hangzhou.aliyuncs.com/google-containers/pause-amd64:3.0

参数说明：
--hostname-override 在集群中显示的主机名
--kubeconfig 指定kubeconfig文件位置，会自动生成
--bootstrap-kubeconfig 指定刚才生成的bootstrap.kubeconfig文件
--cert-dir 颁发证书存放位置
--pod-infra-container-image 管理Pod网络的镜像

3、kubelet.config配置

/opt/kubernetes/cfg/kubelet.config配置

vim /opt/kubernetes/cfg/kubelet.config

kind: KubeletConfiguration
apiVersion: kubelet.config.k8s.io/v1beta1
address: 192.168.209.11 #写你机器的ip地址
port: 10250
readOnlyPort: 10255
cgroupDriver: cgroupfs
clusterDNS: ["10.0.0.2"] #不要改，就是这个ip地址
clusterDomain: cluster.local.
failSwapOn: false
authentication:
anonymous:
enabled: true
webhook:
enabled: false

4、systemd管理kubelet组件

vim /usr/lib/systemd/system/kubelet.service

[Unit]
Description=Kubernetes Kubelet
After=docker.service
Requires=docker.service
[Service]
EnvironmentFile=/opt/kubernetes/cfg/kubelet
ExecStart=/opt/kubernetes/bin/kubelet $KUBELET_OPTS
Restart=on-failure
KillMode=process
[Install]
WantedBy=multi-user.target

5、启动kubelet

systemctl daemon-reload
systemctl enable kubelet
systemctl start kubelet

6、查看申请加入集群的节点

/opt/kubernetes/bin/kubectl get csr

NAME                                                   AGE       REQUESTOR           CONDITION
node-csr-3Qm5ndW4_aKjhhWSKhLhSfGw_tq04C6pkTG0gEDLpJ0   11s       kubelet-bootstrap   Pending
node-csr-ldXf2ozPyVVGz8Hs5ND8njKmbQ7kFO5nvVitVPgAKIA   7m        kubelet-bootstrap   Pending

7、master审批通过允许加入集群

启动后还没加⼊到集群中，需要手动允许该节点才可以。在Master节点查看请求签名的Node

/opt/kubernetes/bin/kubectl certificate approve XXXXID

xxxid 指的是上一步的NAME这⼀列

8、再次检查证书签名状态

/opt/kubernetes/bin/kubectl get csr

NAME                                                   AGE       REQUESTOR           CONDITION
node-csr-3Qm5ndW4_aKjhhWSKhLhSfGw_tq04C6pkTG0gEDLpJ0   3m        kubelet-bootstrap   Approved,Issued
node-csr-ldXf2ozPyVVGz8Hs5ND8njKmbQ7kFO5nvVitVPgAKIA   10m       kubelet-bootstrap   Approved,Issued

输出中可以看到，两个证书签名请求（CSR）的状态都已经变为 Approved,Issued。这意味着这些 CSR 不仅已经被批准，而且相应的证书也已经被签发并可以供节点使用。

现在，可以检查相应的节点是否已经成功加入到 Kubernetes 集群中，并且状态是否为 Ready。使用以下命令来查看集群中的节点状态：

9、查看集群节点信息

/opt/kubernetes/bin/kubectl get node

NAME             STATUS    ROLES     AGE       VERSION
192.168.209.11   Ready     <none>    3m        v1.11.10
192.168.209.12   Ready     <none>    3m        v1.11.10

在所有node节点进行

1、创建kube-proxy配置文件

vim /opt/kubernetes/cfg/kube-proxy

KUBE_PROXY_OPTS="--logtostderr=true \
--v=4 \
--hostname-override=192.168.209.143 \	#写每个node节点ip
--cluster-cidr=10.0.0.0/24 \	#不要改，就是这个ip
--kubeconfig=/opt/kubernetes/cfg/kube-proxy.kubeconfig"

2、systemd管理kube-proxy组件

cd /usr/lib/systemd/system
vim  /usr/lib/systemd/system/kube-proxy.service

[Unit]
Description=Kubernetes Proxy
After=network.target
[Service]
EnvironmentFile=-/opt/kubernetes/cfg/kube-proxy
ExecStart=/opt/kubernetes/bin/kube-proxy $KUBE_PROXY_OPTS
Restart=on-failure
[Install]
WantedBy=multi-user.target

3、启动

systemctl daemon-reload
systemctl enable kube-proxy
systemctl start kube-proxy

4、在master查看集群状态

/opt/kubernetes/bin/kubectl get node

NAME             STATUS    ROLES     AGE       VERSION
192.168.209.11   Ready     <none>    5h        v1.11.10
192.168.209.12   Ready     <none>    5h        v1.11.10

5、查看集群组件的状态

opt/kubernetes/bin/kubectl get cs

NAME                 STATUS    MESSAGE              ERROR
controller-manager   Healthy   ok
scheduler            Healthy   ok
etcd-1               Healthy   {"health": "true"}
etcd-2               Healthy   {"health": "true"}
etcd-0               Healthy   {"health": "true"}

1、部署Pod，提供Web服务

mkdir webui
cd webui/
vim dashboard-deployment.yaml

apiVersion: apps/v1beta2
kind: Deployment
metadata:
  name: kubernetes-dashboard
  namespace: kube-system
  labels:
    k8s-app: kubernetes-dashboard
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile
spec:
  selector:
    matchLabels:
      k8s-app: kubernetes-dashboard
  template:
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ''
    spec:
      serviceAccountName: kubernetes-dashboard
      containers:
        - name: kubernetes-dashboard
          image: registry.cn-hangzhou.aliyuncs.com/kube_containers/kubernetes-dashboard-amd64:v1.8.1
          resources:
            limits:
              cpu: 100m
              memory: 300Mi
            requests:
              cpu: 100m
              memory: 100Mi
          ports:
            - containerPort: 9090
              protocol: TCP
          livenessProbe:
            httpGet:
              scheme: HTTP
              path: /
              port: 9090
            initialDelaySeconds: 30
            timeoutSeconds: 30
      tolerations:
        - key: "CriticalAddonsOnly"
          operator: "Exists"

2、授权访问apiserver获取信息

vim dashboard-rbac.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    k8s-app: kubernetes-dashboard
    addonmanager.kubernetes.io/mode: Reconcile
  name: kubernetes-dashboard
  namespace: kube-system

---

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: kubernetes-dashboard-minimal
  namespace: kube-system
  labels:
    k8s-app: kubernetes-dashboard
    addonmanager.kubernetes.io/mode: Reconcile
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: kubernetes-dashboard
    namespace: kube-system
[root@k8s-master webui]# cat dashboard-service.yaml
apiVersion: v1
kind: Service
metadata:
  name: kubernetes-dashboard
  namespace: kube-system
  labels:
    k8s-app: kubernetes-dashboard
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile
spec:
  type: NodePort
  selector:
    k8s-app: kubernetes-dashboard
  ports:
    - port: 80
      targetPort: 9090

3、发布服务，提供对外访问

/opt/kubernetes/bin/kubectl create -f dashboard-rbac.yaml
/opt/kubernetes/bin/kubectl create -f dashboard-deployment.yaml
/opt/kubernetes/bin/kubectl create -f dashboard-service.yaml

4、等待数分钟，查看资源状态，查看名称空间

/opt/kubernetes/bin/kubectl get all -n kube-system

NAME READY STATUS RESTARTS 
 AGE
pod/kubernetes-dashboard-d9545b947-442ft 1/1 Running 0 
 21m
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT
(S) AGE
service/kubernetes-dashboard NodePort 10.0.0.143 <none> 80:4
7520/TCP 21m
NAME DESIRED CURRENT UP-TO-DATE A
VAILABLE AGE
deployment.apps/kubernetes-dashboard 1 1 1 1
 21m
NAME DESIRED CURRENT READ
Y AGE
replicaset.apps/kubernetes-dashboard-d9545b947 1 1 1 
 21m

5、查看访问端⼝，查看指定命名空间的服务

/opt/kubernetes/bin/kubectl get svc -n kube-system

NAME                   TYPE       CLUSTER-IP   EXTERNAL-IP   PORT(S)        AGE
kubernetes-dashboard   NodePort   10.0.0.125   <none>        80:48876/TCP   2m

6、测试

运行⼀个测试示例--在master节点先安装docker服务
创建⼀个Nginx Web，判断集群是否正常
/opt/kubernetes/bin/kubectl run nginx --image=daocloud.io/nginx --replicas=3
/opt/kubernetes/bin/kubectl expose deployment nginx --port=88 --target-port=80 --type=NodePort
/opt/kubernetes/bin/kubectl delete -f deployment --all
在master上面查看：
查看Pod，Service：
/opt/kubernetes/bin/kubectl get pods #需要等⼀会

NAME READY STATUS RESTARTS AGE
nginx-64f497f8fd-fjgt2 1/1 Running 3 28d
nginx-64f497f8fd-gmstq 1/1 Running 3 28d
nginx-64f497f8fd-q6wk9 1/1 Running 3 28d

查看pod详细信息：
/opt/kubernetes/bin/kubectl describe pod nginx-64f497f8fd-fjgt2
/opt/kubernetes/bin/kubectl get svc

NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) 
 AGE
kubernetes ClusterIP 10.0.0.1 <none> 443/TCP 
 28d
nginx NodePort 10.0.0.175 <none> 88:38696/TCP 
 28d

访问nodeip加端⼝
打开浏览器输⼊：http://192.168.209.11:38696
恭喜你，集群部署成功！

⽅式1：使用kubectl create secret命令
⽅式2：yaml文件创建Secret

命令⽅式创建secret

假如某个Pod要访问数据库，需要用户名密码，分别存放在2个文件中：username.txt，password.txt

echo -n 'admin' > ./username.txt
echo -n "sunyaowei1" > password.txt

kubectl create secret generic db-user-pass --from-file=./username.txt --from-file=./password.txt

创建一个名为db-user-pass的secret ，里面引入的有username.txt 和password.txt

查看创建结果

kubectl get secret

NAME                  TYPE                                  DATA   AGE
db-user-pass          Opaque                                2      15s

查看详细信息

kubectl describe secret db-user-pass

Name:         db-user-pass
Namespace:    default
Labels:       <none>
Annotations:  <none>

Type:  Opaque

Data
====
password.txt:  10 bytes
username.txt:  5 bytes

describe指令不会展示secret的实际内容，这是出于对数据的保护的考虑，如果想查看实际内容使用命令：

kubectl get secret db-user-pass -o yaml

通过字面数据创建secret

kubectl create secret generic mysecret \
  --from-literal=name=aglarevv\
  --from-literal=password=123

kubectl get secret mysecret -o yaml
kubectl describe secret mysecret

yaml⽅式创建Secret

创建⼀个secret.yaml文件，内容用base64编码:明文显示容易被别⼈发现，这⾥先转码

cho -n 'admin' | base64
echo -n '123456' | base64

创建⼀个secret.yaml文件，内容用base64编码

vim secret.yml

---
apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Opaque #模糊
data:
  username: YWRtaW4=
  password: MTIzNDU2

kubectl apply -f secret.yml secret/mysecret created

查看创建的secret

kubectl get secret

NAME                  TYPE                                  DATA   AGE
db-user-pass          Opaque                                2      38m
default-token-stcpf   kubernetes.io/service-account-token   3      25h
mysecret              Opaque                                2      54s

解析Secret中内容,还是经过编码的---需要解码

kubectl get secret mysecret -o yaml

apiVersion: v1
data:
  password: MTIzNDU2
  username: YWRtaW4=

解码：
echo -n "MTIzNDU2" |base64 --decode
echo -n "YWRtaW4=" |base64 --decode

可以把比较敏感的数据创建在secret中
创建的时候都是加密的数据，来到容器后，自动解密
弊端：
​会把整个数据卷的secret映射到指定目录中，
如果只想映射secret中的某一个数据，就需要用到映射secret key的方式

⼀个Pod中引用Secret的例⼦

1、创建一个pod

vim pod_use_secret.yaml

apiVersion: v1
kind: Pod
metadata:
  name: mypod
spec:
  containers:
  - name: nginx
    image: nginx
    volumeMounts: #数据卷挂载
      - name: foo # 挂载名为foo的数据卷
        mountPath: "/root/" #挂载到容器的/root/目录下
        readOnly: true #挂载的数据只读
  volumes: #数据卷的定义
  - name: foo #卷的名字这个名字自定义
    secret: #卷是直接使用的secret。
      secretName: mysecret #调用刚才定义的secret

kubectl apply -f pod_use_secret.yaml

2、查看pod

kubectl get pod

NAME    READY   STATUS    RESTARTS   AGE
mypod   1/1     Running   0          87s

3、进入到mypod，查看/root/

[root@k8s-master prome]# kubectl exec -it mypod /bin/bash
root@mypod:/# ls /root/
password  username
root@mypod:/# cat /root/password
123456
root@mypod:/# cat /root/username
adminroot

映射secret key到指定的路径

1、清除mypod

kubectl get pod

NAME    READY   STATUS    RESTARTS   AGE
mypod   1/1     Running   0          7m47s

2、修改

vim pod_use_secret.yaml

apiVersion: v1
kind: Pod
metadata:
  name: mypod
spec:
  containers:
  - name: nginx
    image: nginx
    volumeMounts: #数据卷挂载
      - name: foo # 挂载名为foo的数据卷
        mountPath: "/root/" #挂载到容器的/root/目录下
        readOnly: true #挂载的数据只读
  volumes: #数据卷的定义
  - name: foo #卷的名字这个名字自定义
    secret: #卷是直接使用的secret。
      secretName: mysecret #调用刚才定义的secret
      items: #定义一个选项，即选择mysecret数据中的部分键
      - key: username # 指定映射的键
        path: my_dir/my_username # 映射到挂载容器目录下 /my_dir/my_username

kubectl apply -f pod_use_secret.yaml

3、查看pod

kubectl get  pod

NAME    READY   STATUS    RESTARTS   AGE
mypod   1/1     Running   0          38s

4、进入pod，并查看文件

[root@k8s-master prome]# kubectl exec -it mypod /bin/bash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
root@mypod:/# pwd
/
root@mypod:/# ls /root/
my_dir
root@mypod:/# ls /root/my_dir
my_username
root@mypod:/# cat /root/my_dir/my_username
admin

被挂载的secret内容自动更新

1、设置base64加密

echo -n "sunyaowei" | base64

2、将admin替换成sunyaowei

vim secret.yml

---
apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Opaque
data:
  username: YWRtaW4=
  password: Y2hlbmZ1Z3Vv #将admin 替换为sunyaowei加密后的数据

3、创建

kubectl apply -f secret.yml

4、连接pod容器

[root@kub-k8s-master prome]# kubectl exec -it mypod /bin/bash
root@mypod:/# cat /root/my_dir/my_password
sunyaowei

以环境变量的形式使用Secret（常用）

如果secret更新，pod引用中，并不会自动更新

1、创建secret文件夹，里面存放yml文件

生成root 和  sunyaowei的加密数据

echo -n 'root' | base64
echo -n 'ChenFuguo@123' | base64

2、编写创建secret的yml文件

vim  mysql-sec.yaml

---
kind: Secret
apiVersion: v1
metadata:
  name: mysql-user-pass
type: Opaque
data:
  username: cm9vdA== # root
  password: Q2hlbkZ1Z3VvQDEyMw== #sunyaowei

3、执行生成secret

kubectl apply -f mysql-sec.yaml secret/mysql-user-pass created
kubectl get secret

NAME                  TYPE                                  DATA   AGE
db-user-pass          Opaque                                2      8h
default-token-stcpf   kubernetes.io/service-account-token   3      33h
mysecret              Opaque                                2      7h58m
mysql-user-pass       Opaque                                2      20s

4、继续在mysql-sec.yaml中追加剧本，生成创建容器的pod

vim  mysql-sec.yaml

---
kind: Secret
apiVersion: v1
metadata:
  name: mysql-user-pass
type: Opaque
data:
  username: cm9vdA== # root
  password: Q2hlbkZ1Z3VvQDEyMw== #sunyaowei

---
apiVersion: v1
kind: Pod
metadata:
  name: mysql
spec:
  containers:
  - name: mysql
    image: mysql:5.7
    env:
    - name: MYSQL_ROOT_PASSWORD #创建新的环境变量名称
      valueFrom:
        secretKeyRef: #调用的key是什么
          name: mysql-user-pass #变量的值来自于my-user-pass这个secret
          key: password #取mysql-user-pass的password的值 即 sunyaowei

5、继续执行mysql-sec.yaml文件

kubectl apply -f mysql-sec.yaml secret/mysql-user-pass unchanged pod/mysql created

6、查看pod状态，进入该pod，测试密码

kubectl get pod  -o wide

NAME    READY   STATUS    RESTARTS   AGE   IP           NODE        NOMINATED NODE   READINESS GATES
mysql   1/1     Running   0          68s   10.244.2.8   k8s-node2   <none>           <none>

kubectl get pod

NAME    READY   STATUS    RESTARTS   AGE
mysql   1/1     Running   0          63s


[root@k8s-master secret]# kubectl exec -it mysql /bin/bash
bash-4.2# mysql -uroot -p'sunyaowei'
mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| performance_schema |
| sys                |
+--------------------+
登录成功！！

docker私仓secret应用

1、编写pod3.yml，从阿里云私有仓库下载地址

提前登录！！！

vim pod3.yml

---
apiVersion: v1
kind: Pod
metadata:
  namespace: kube-system
  name: mynginx
  labels:
    name: mynginx_name_pod
spec:
  nodeName: k8s-node1
  containers:
    - name: nginx
      image: registry.cn-hangzhou.aliyuncs.com/cfgnginx/nginx:1.24.0 #阿里云私有仓库的地址
      ports:
      - containerPort: 80

2、执行

kubectl apply -f pod3.yml pod/mynginx created

通过命令⾏参数--from-literal创建
创建命令

kubectl create configmap test-configmap --from-literal=user=admin --from-literal=pass=1122334

删除

kubectl delete cm test-configmap

通过指定文件创建
编辑配置文件app.properties

vim app.properties

property.1 = value-1
property.2 = value-2
property.3 = value-3
property.4 = value-4
[mysqld]
!include /home/wing/mysql/etc/mysqld.cnf
port = 3306
socket = /home/wing/mysql/tmp/mysql.sock
pid-file = /wing/mysql/mysql/var/mysql.pid
basedir = /home/mysql/mysql
datadir = /wing/mysql/mysql/var

创建（可以有多个--from-file）

kubectl create configmap test-config2 --from-file=app.properties

指定⽬录创建
创建

vim config1

aaa
bbb
c=d


 vim config2

eee
fff
h=k

kubectl create configmap test-config3 --from-file=./config

指定⽬录创建时，configmap内容中的各个文件会创建⼀个key/value对，key是文件名，value是文件内容。

通过事先写好configmap的标准yaml文件创建
创建

vim configmap.yaml

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: test-config4
  namespace: default
data:
  cache_host: memcached-gcxt
  cache_port: "11211"
  cache_prefix: gcxt
  my.cnf: |
    [mysqld]
    log-bin = mysql-bin
    haha = hehe

kubectl apply -f configmap.yaml

查看configmap的详细信息

kubectl describe configmap test-config4

示例ConfigMap文件

vim config-map.yml

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: config-map
  namespace: default
data:
  special.how: very
  special.type: charm

=========分割线============

创建

kubectl apply -f config-map.yml

通过环境变量使用

vim testpod.yml

---
apiVersion: v1
kind: Pod
metadata:
  name: dapi-test-pod
spec:
  containers:
    - name: test-container
      image: daocloud.io/library/nginx
      env: #专门在容器里设置变量的关键字
        - name: SPECIAL_LEVEL_KEY #这里的-name,是容器⾥设置的新变量的名字
          valueFrom:
            configMapKeyRef:
              name: config-map #这里是来源于哪个configMap
              key: special.how #configMap里的key
        - name: SPECIAL_TYPE_KEY
          valueFrom:
            configMapKeyRef:
              name: config-map
              key: special.type
  restartPolicy: Never #当容器退出的时候 不要自动重启

创建pod

kubectl apply -f testpod.yml

测试

[root@kub-k8s-master prome]# kubectl exec -it dapi-test-pod /bin/bash
root@dapi-test-pod:/# echo $SPECIAL_TYPE_KEY
charm

通过envFrom、configMapRef、name使得configmap中的所有key/value对都自动变成环境变量

kubectl delete -f testpod.yml
cp testpod.yml testpod.yml.bak
vim testpod.yml

---
apiVersion: v1
kind: Pod
metadata:
  name: dapi-test-pod
spec:
  containers:
    - name: test-container
      image: nginx
      envFrom:
        - configMapRef:
            name: config-map  #直接把config-map中的数据全部作为环境变量 即cm中的键就是env的键
                              # vm中key对应的值 就是env中同名key对应的值
  restartPolicy: Never

这样容器⾥的变量名称直接使用configMap⾥的key名

创建容器

kubectl apply -f testpod.yml

进入容器查看环境变量

[root@kub-k8s-master prome]# kubectl exec -it dapi-test-pod /bin/bash
root@dapi-test-pod:/# env
HOSTNAME=dapi-test-pod
NJS_VERSION=0.3.3
NGINX_VERSION=1.17.1
KUBERNETES_PORT_443_TCP_PROTO=tcp
KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1
PKG_RELEASE=1~stretch
KUBERNETES_PORT=tcp://10.96.0.1:443
PWD=/
special.how=very
HOME=/root
KUBERNETES_SERVICE_PORT_HTTPS=443
KUBERNETES_PORT_443_TCP_PORT=443
KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443
TERM=xterm
SHLVL=1
KUBERNETES_SERVICE_PORT=443
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
special.type=charm
KUBERNETES_SERVICE_HOST=10.96.0.1
_=/usr/bin/env

作为volume挂载使用
把步骤【通过事先写好configmap的标准yaml文件创建】中test-config4所有key/value挂载进来

kubectl delete -f testpod.yml
vim volupod.yml

---
apiVersion: v1
kind: Pod
metadata:
  name: nginx-configmap
spec:
  containers:
    - name: nginx-configmap
      image: daocloud.io/library/nginx
      volumeMounts:
        - name: config-volume4
          mountPath: "/tmp/config4"
  volumes:
    - name: config-volume4
      configMap:
        name: test-config4
  restartPolicy: Always

创建pod

kubectl apply -f volupod.yml

进⼊容器中/tmp/config4查看

[root@kub-k8s-master prome]# kubectl exec -it nginx-configmap /bin/bash
root@nginx-configmap:/# ls /tmp/config4/
cache_host cache_port cache_prefix my.cnf
root@nginx-configmap:/# cat /tmp/config4/cache_host
memcached-gcxt

可以看到，在config4文件夹下以每⼀个key为文件名value为值创建了多个文件