K8s 云原生技术 2

1
apiVersion: v1
2
kind: Pod
3
metadata:
4
  name: pod-with-init
5
spec:
6
  initContainers:
7
  - name: wait-for-db        # 这个先跑
8
    image: busybox
9
    command: ['sh', '-c', 'until nc -z db-service 3306; do echo waiting for db; sleep 2; done']
10
  - name: init-config        # 然后跑这个
11
    image: busybox
12
    command: ['sh', '-c', 'echo “server=db-service” > /config/db.conf']
13
    volumeMounts:
14
    - name: config-vol
15
      mountPath: /config
16
  containers:
17
  - name: main-app           # 最后才跑主容器
18
    image: my-app:latest
19
    volumeMounts:
20
    - name: config-vol
21
      mountPath: /etc/app
22
  volumes:
23
  - name: config-vol
24
    emptyDir: {}

1
apiVersion: apps/v1
2
kind: Deployment
3
metadata:
4
  name: nginx-deploy
5
spec:
6
  replicas: 3   # 我要3个完全相同的Pod
7
  selector:
8
    matchLabels:
9
      app: nginx    # 管理带这个标签的Pod
10
  template:         # Pod模板
11
    metadata:
12
      labels:
13
        app: nginx
14
    spec:
15
      containers:
16
      - name: nginx
17
        image: nginx:1.25

1
apiVersion: apps/v1
2
kind: Deployment
3
metadata:
4
  name: nginx-deploy
5
spec:
6
  replicas: 5
7
  strategy:
8
    type: RollingUpdate           # 滚动更新
9
    rollingUpdate:
10
      maxSurge: 2                 # 最多临时多出 2 个 Pod
11
      maxUnavailable: 1           # 最多允许 1 个 Pod 不可用
12
  selector:
13
    matchLabels:
14
      app: nginx
15
  template:
16
    metadata:
17
      labels:
18
        app: nginx
19
    spec:
20
      containers:
21
      - name: nginx
22
        image: nginx:1.26         # 改镜像版本就会触发滚动更新

1
apiVersion: apps/v1
2
kind: StatefulSet
3
metadata:
4
  name: mysql
5
spec:
6
  serviceName: mysql   # 必须有一个无头Service，后面讲
7
  replicas: 2
8
  selector:
9
    matchLabels:
10
      app: mysql
11
  template:
12
    metadata:
13
      labels:
14
        app: mysql
15
    spec:
16
      containers:
17
      - name: mysql
18
        image: mysql:8.0
19
        volumeMounts:
20
        - name: data
21
          mountPath: /var/lib/mysql
22
  volumeClaimTemplates:   # 为每个Pod自动创建独立PVC
23
  - metadata:
24
      name: data
25
    spec:
26
      accessModes: [ "ReadWriteOnce" ]
27
      resources:
28
        requests:
29
          storage: 10Gi

1
apiVersion: apps/v1
2
kind: DaemonSet
3
metadata:
4
  name: node-exporter
5
spec:
6
  selector:
7
    matchLabels:
8
      name: node-exporter
9
  template:
10
    metadata:
11
      labels:
12
        name: node-exporter
13
    spec:
14
      containers:
15
      - name: node-exporter
16
        image: prom/node-exporter

1
apiVersion: networking.k8s.io/v1
2
kind: Ingress
3
metadata:
4
  name: app-ingress
5
spec:
6
  rules:
7
  - host: www.example.com
8
    http:
9
      paths:
10
      - path: /api
11
        pathType: Prefix
12
        backend:
13
          service:
14
            name: api-service
15
            port:
16
              number: 8080
17
      - path: /
18
        pathType: Prefix
19
        backend:
20
          service:
21
            name: web-service
22
            port:
23
              number: 80

1
apiVersion: networking.k8s.io/v1
2
kind: Ingress
3
metadata:
4
  name: app-ingress-tls
5
spec:
6
  tls:
7
  - hosts:
8
    - www.example.com
9
    secretName: example-tls-secret    # TLS 证书存在 Secret 里
10
  rules:
11
  - host: www.example.com
12
    http:
13
      paths:
14
      - path: /
15
        pathType: Prefix
16
        backend:
17
          service:
18
            name: web-service
19
            port:
20
              number: 80

1
apiVersion: v1
2
kind: ConfigMap
3
metadata:
4
  name: app-config
5
data:
6
  database_url: "db.internal:3306"
7
  log_level: "debug"
8
---
9
apiVersion: v1
10
kind: Secret
11
metadata:
12
  name: db-credentials
13
type: Opaque
14
data:
15
  username: dXNlcg==    # base64编码的"user"
16
  password: cGFzc3dvcmQ= # "password"

1
spec:
2
  containers:
3
  - name: app
4
    image: my-app:latest
5
    env:
6
    - name: DB_URL
7
      valueFrom:
8
        configMapKeyRef:
9
          name: app-config
10
          key: database_url     # 只取这一个 key
11
    - name: DB_PASSWORD
12
      valueFrom:
13
        secretKeyRef:
14
          name: db-credentials
15
          key: password         # 只取这一个 key

1
apiVersion: v1
2
kind: Pod
3
metadata:
4
  name: app-file-demo
5
spec:
6
  containers:
7
  - name: app
8
    image: my-app:latest
9
    volumeMounts:
10
    - name: config-volume
11
      mountPath: /etc/app/config    # ConfigMap 内容出现在这个目录
12
      readOnly: true
13
    - name: secret-volume
14
      mountPath: /etc/app/secrets   # Secret 内容出现在这个目录
15
      readOnly: true
16
  volumes:
17
  - name: config-volume
18
    configMap:
19
      name: app-config
20
  - name: secret-volume
21
    secret:
22
      secretName: db-credentials

1
apiVersion: v1
2
kind: LimitRange
3
metadata:
4
  name: dev-limits
5
  namespace: dev
6
spec:
7
  limits:
8
  - type: Container
9
    default:              # 不声明时的默认值
10
      cpu: "500m"
11
      memory: "256Mi"
12
    defaultRequest:       # 不声明 request 时的默认 request
13
      cpu: "200m"
14
      memory: "128Mi"
15
    max:                  # 单个容器能设的最大值（防流氓 Pod）
16
      cpu: "2"
17
      memory: "2Gi"
18
    min:                  # 单个容器的最小值
19
      cpu: "100m"
20
      memory: "64Mi"

1
apiVersion: autoscaling/v2
2
kind: HorizontalPodAutoscaler
3
metadata:
4
  name: nginx-hpa
5
spec:
6
  scaleTargetRef:
7
    apiVersion: apps/v1
8
    kind: Deployment
9
    name: nginx-deploy
10
  minReplicas: 2
11
  maxReplicas: 10
12
  metrics:
13
  - type: Resource
14
    resource:
15
      name: cpu
16
      target:
17
        type: Utilization
18
        averageUtilization: 70

1
apiVersion: rbac.authorization.k8s.io/v1
2
kind: Role
3
metadata:
4
  namespace: dev
5
  name: pod-reader
6
rules:
7
- apiGroups: [""]
8
  resources: ["pods"]
9
  verbs: ["get", "list", "watch"]
10
---
11
apiVersion: rbac.authorization.k8s.io/v1
12
kind: RoleBinding
13
metadata:
14
  name: read-pods
15
  namespace: dev
16
subjects:
17
- kind: ServiceAccount
18
  name: my-sa
19
  namespace: dev
20
roleRef:
21
  kind: Role
22
  name: pod-reader
23
  apiGroup: rbac.authorization.k8s.io

1
apiVersion: networking.k8s.io/v1
2
kind: NetworkPolicy
3
metadata:
4
  name: allow-from-frontend
5
spec:
6
  podSelector:              # 这个策略作用在哪些 Pod 上？
7
    matchLabels:
8
      role: db              # 选中带 role=db 标签的 Pod
9
  policyTypes:
10
  - Ingress                 # 控制入站流量（别人访问数据库）
11
  ingress:
12
  - from:
13
    - podSelector:          # 允许哪些 Pod 进来？
14
        matchLabels:
15
          role: frontend    # 只有带 role=frontend 标签的 Pod
16
    ports:
17
    - protocol: TCP
18
      port: 3306            # 而且只能访问 3306 端口

1
apiVersion: networking.k8s.io/v1
2
kind: NetworkPolicy
3
metadata:
4
  name: db-isolation
5
spec:
6
  podSelector:
7
    matchLabels:
8
      app: mysql
9
  policyTypes:
10
  - Ingress
11
  ingress:
12
  - from:
13
    - namespaceSelector:       # 允许某个 Namespace 下所有 Pod
14
        matchLabels:
15
          kubernetes.io/metadata.name: backend
16
    - ipBlock:                 # 允许某个 IP 段
17
        cidr: 10.0.0.0/24
18
    ports:                     # ports 属于这个 ingress 规则
19
    - protocol: TCP
20
      port: 3306

1
apiVersion: apiextensions.k8s.io/v1
2
kind: CustomResourceDefinition
3
metadata:
4
  name: databaseusers.example.com    # 格式：<复数名>.<组名>
5
spec:
6
  group: example.com                 # API 组
7
  names:
8
    kind: DatabaseUser               # 资源类型名（驼峰）
9
    plural: databaseusers            # 复数，会出现在 URL 路径
10
    singular: databaseuser           # 单数
11
    shortNames:
12
    - dbu                            # kubectl get dbu 就能查到
13
  scope: Namespaced                  # Namespace 级别
14
  versions:
15
  - name: v1
16
    served: true
17
    storage: true
18
    schema:
19
      openAPIV3Schema:
20
        type: object
21
        properties:
22
          spec:
23
            type: object
24
            properties:
25
              username:
26
                type: string
27
              database:
28
                type: string
29
              privileges:
30
                type: array
31
                items:
32
                  type: string
33
                  enum: [SELECT, INSERT, UPDATE, DELETE]
34
            required: [username, database]