kubectl create configmap <cmName> --from-file=<fileName>

#这种方式创建，文件名会变成“键”，文件内容会变成“值”，文件内容要一行一行的写

​

kubectl create cm <cmName> --from-file=<dirPath>

#此方式创建，目录下的每个文件名作为键，文件内容作为值

​

apiVersion: v1
kind: ConfigMap
metadata:
  name: cm1
data:
  name: jim
  password: pass

apiVersion: v1
kind: ConfigMap
metadata:
  name: cm1
data:
  app.conf: |
    database.host=mysql.local
    database.port=3306
    logs.level=INFO
  script.sh: |
    #!/bin/bash
    echo "Hello World"

apiVersion: v1
kind: ConfigMap
metadata:
  name: cm1
data:
  config.json: |
    {
      "name": "tom",
      "debug": true,
      "timeout": 30
    }

apiVersion: v1
kind: ConfigMap
metadata:
  name: cm1
data:
  name: jim
  password: pass

---

apiVersion: v1
kind: ConfigMap
metadata:
  name: cm2
data:
  logs_level: INFO
  debug_level: BUG

---

apiVersion: v1
kind: Pod
metadata:
  name: test-cm
spec:
  containers:
  - name: test-cm-container
    image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/busybox:1.28
    imagePullPolicy: IfNotPresent
    command:
    - sh
    - -c
    - env
    env:  # 定义容器的环境变量
    - name: USERNAME    #变量名
      valueFrom:    #环境变量引用
        configMapKeyRef:      #指定变量从ConfigMap中引用
          name: cm1    #指定引用的ConfigMap名称
          key: name    #这个key后面跟的是键名，告诉我们值要去哪个键找。实际是引用键后面的值
    - name: PASSWORD
      valueFrom:
        configMapKeyRef:
          name: cm1
          key: password
    envFrom:    # 使用ConfigMap将多个键值对作为环境变量传递
    - configMapRef:    
        name: cm2
  restartPolicy: Never  #Pod的重启策略：不会自动重启,不加这个的话容器运行结束会不断的重启。因为pod的重启策略是Always，不管什么原因结束pod他都会重启

​

apiVersion: v1
kind: ConfigMap
metadata:
  name: cm1
data:
  name: tom
  password: pass

---

apiVersion: v1
kind: Pod
metadata:
  name: test-cm
spec:
  containers:
  - name: test-cm-contianer
    image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/busybox:1.28
    imagePullPolicy: IfNotPresent
    command:
    - sh
    - -c
    - echo $USERNAME $PASSWORD
    env:
    - name: USERNAME
      valueFrom:
        configMapKeyRef: 
          name: cm1
          key: name
    - name: PASSWORD
      valueFrom:
        configMapKeyRef:
          name: cm1
          key: password

apiVersion: v1
kind: ConfigMap
metadata:
  name: cm1
data:
  name: tom
  password: pass

---

apiVersion: v1
kind: Pod
metadata:
  name: test-cm
spec:
  containers:
  - name: test-cm-container
    image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/busybox:1.28
    imagePullPolicy: IfNotPresent
    command:
    - sh
    - -c
    - sleep 3600
    volumeMounts:    #定义容器中的挂载卷
    - name: cm-volume    #挂载的卷的名称
      mountPath: /etc/config    #卷挂载到容器内的路径
  volumes:    #定义pod中使用的卷
  - name: cm-volume  #挂载卷的名字
    configMap:        #卷的数据来源
      name: cm1
  restartPolicy: Never

vim nginx.conf
server {
    listen 80 default_server;
    server_name  example.com www.example.com;
    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }
}

​

apiVersion: apps/v1
kind: Deployment
metadata:
  name: cm-deploy
spec:
  replicas: 3
  selector:
    matchLabels:
      app: stu
  template:
    metadata:
      labels:
        app: stu
    spec:
      containers:
      - name: cm-nginx
        image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/nginx:1.27.0
        imagePullPolicy: IfNotPresent
        volumeMounts:
        - name: config-volume
          mountPath: /etc/nginx/conf.d/
      volumes:
      - name: config-volume
        configMap:
          name: nginx-default

​

​

​

​

​

[root@k8s-master ~]# echo test |base64 
dGVzdAo=
[root@k8s-master ~]# echo dGVzdAo= |base64 -d
test
[root@k8s-master ~]#

如果解码没有编码过的数据会报错

[root@k8s-master ~]# echo 666 |base64 -d
뭢ase64: 输入无效
[root@k8s-master ~]# 

#用户和密码先进行编码

[root@k8s-master ~]# echo admin |base64 
YWRtaW4K
[root@k8s-master ~]# echo 12345 |base64 
MTIzNDUK


apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Opaque
data:
  username: YWRtaW4K
  password: MTIzNDUK

#secret中，values会自动进行解码，所以一旦使用Opaque类型切记要先进行数据编码，不然解码会出错

​

​

​

apiVersion: apps/v1
kind: Deployment
metadata:
  name: opaque-secret-env-deploy
  labels:
    app: opaque-secret-env
spec:
  replicas: 5
  selector:
    matchLabels:
      app: op-se-env-pod
  template:
    metadata:
      labels:
        app: op-se-env-pod
    spec:
      containers:
        - name: myapp-container
          image: nginx:v1
          imagePullPolicy: IfNotPresent
          env:
            - name: TEST_USER
              valueFrom:
                secretKeyRef:
                  name: mysecret
                  key: username
            - name: TEST_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: mysecret
                  key: password

apiVersion: apps/v1
kind: Deployment
metadata:
  name: secret-opaque-volume
spec:
  replicas: 3
  selector:
    matchLabels:
      app: stu
  template:
    metadata:
      labels:
        app: stu
    spec:
      containers:
      - name: opaque-container
        image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/busybox:1.28
        imagePullPolicy: IfNotPresent
        command:
        - sh
        - -c
        - sleep 3600
        volumeMounts:
        - name: secret-volume
          mountPath: "/data"
      volumes:
      - name: secret-volume
        secret:
          secretName: secret-opaque

apiVersion: apps/v1
kind: Deployment
metadata:
  name: secret-opaque-volume
spec:
  replicas: 3
  selector:
    matchLabels:
      app: stu
  template:
    metadata:
      labels:
        app: stu
    spec:
      containers:
      - name: opaque-container
        image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/busybox:1.28
        imagePullPolicy: IfNotPresent
        command:
        - sh
        - -c
        - sleep 3600
        volumeMounts:
        - name: secret-volume
          mountPath: "/data"
      volumes:
      - name: secret-volume
        secret:
          secretName: secret-opaque
          defaultMode: 256    #十进制数字，转换八进制后，会变成400权限，不加这个字段会默认填充，默认值是420，也就是644权限

apiVersion: apps/v1
kind: Deployment
metadata:
  name: secret-opaque-volume
spec:
  replicas: 3
  selector:
    matchLabels:
      app: stu
  template:
    metadata:
      labels:
        app: stu
    spec:
      containers:
      - name: opaque-container
        image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/busybox:1.28
        imagePullPolicy: IfNotPresent
        command:
        - sh
        - -c
        - sleep 3600
        volumeMounts:
        - name: secret-volume
          mountPath: "/data"
      volumes:
      - name: secret-volume
        secret:
          secretName: secret-opaque
          defaultMode: 256
          items:
          - key: username
            path: 1/username

#itemes.path:这个字段，他是以mountPath字段中写的路径为基础的相对路径，且必须是相对路径。items.path的意思就是/data/1/username，文件名就是键，内容就是值。

#挂载的同时可以更改键名，username可任意修改为符合要求的键名，

#如果想直接挂载到mountPath字段路径下，就在path字段中写键名即可，无需写任务

apiVersion: apps/v1
kind: Deployment
metadata:
  name: secret-opaque-volume
spec:
  replicas: 3
  selector:
    matchLabels:
      app: stu
  template:
    metadata:
      labels:
        app: stu
    spec:
      containers:
      - name: opaque-container
        image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/busybox:1.28
        imagePullPolicy: IfNotPresent
        command:
        - sh
        - -c
        - sleep 3600
        volumeMounts:
        - name: secret-volume
          mountPath: "/data"
      volumes:
      - name: secret-volume
        secret:
          secretName: secret-opaque
          defaultMode: 256
          items:
          - key: username
            path: sername    #唯一不同的是这里

apiVersion: v1
kind: Pod
metadata:
  name: downwards
  labels:
    app: stu
  annotations:
    version: "v1"
spec:
  containers:
  - name: downwards-container
    image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/busybox:1.28
    imagePullPolicy: IfNotPresent
    command:
    - env
    env:
    - name: POD_NAME
      valueFrom:
        fieldRef:
          fieldPath: metadata.name
    - name: POD_NAMESPACE
      valueFrom:
        fieldRef:
          fieldPath: metadata.namespace
    - name: POD_UID
      valueFrom:
        fieldRef:
          fieldPath: metadata.uid
    - name: POD_LABELS
      valueFrom:
        fieldRef:
          fieldPath: metadata.labels['app']    #单个标签的意思就是只能选择一个标签键
    - name: POD_ANNOTATIONS
      valueFrom:
        fieldRef:
          fieldPath: metadata.annotations['version']    #同上
    - name: POD_SERVICEACCOUNTNAME
      valueFrom:
        fieldRef:
          fieldPath: spec.serviceAccountName
    - name: POD_PODIP
      valueFrom:
        fieldRef:
          fieldPath: status.podIP
    - name: POD_HOSTIP
      valueFrom:
        fieldRef:
          fieldPath: status.hostIP
    - name: POD_NODENAME
      valueFrom:
        fieldRef:
          fieldPath: spec.nodeName
    - name: LIMITS__CPU
      valueFrom:
        resourceFieldRef:
          resource: limits.cpu
    - name: LIMITS_MEMORY
      valueFrom:
        resourceFieldRef:
          resource: limits.memory
    - name: LIMITS_STORAGE
      valueFrom:
        resourceFieldRef:
          resource: limits.ephemeral-storage
    - name: REQUEST_CPU
      valueFrom:
        resourceFieldRef:
          resource: requests.cpu      
    - name: REQUEST_MEMORY
      valueFrom:
        resourceFieldRef:
          resource: requests.memory
    - name: REQUEST_STORAGE
      valueFrom:
        resourceFieldRef:
          resource: requests.ephemeral-storage
  restartPolicy: Never

​

apiVersion: v1
kind: Pod
metadata:
  name: da-volume
  labels:
    good: study
    day: up
  annotations:
    one: "v1"
    two: "v2"
spec:
  containers:
  - name: da-volume-container
    image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/busybox:1.28
    imagePullPolicy: IfNotPresent
    command: ["sleep","3600"]
    volumeMounts:
    - name: da-volume
      mountPath: /etc/podinfo
  volumes:
  - name: da-volume
    downwardAPI:
      items:
      - path: podname
        fieldRef:
          fieldPath: metadata.name
      - path: namespace
        fieldRef:
          fieldPath: metadata.namespace
      - path: uid
        fieldRef:
          fieldPath: metadata.uid
      - path: oneannotations
        fieldRef:
          fieldPath: metadata.annotations['one']
      - path: onelabels
        fieldRef:
          fieldPath: metadata.labels['good']
      - path: allannotations
        fieldRef:
          fieldPath: metadata.annotations
      - path: alllabels
        fieldRef:
          fieldPath: metadata.labels
      - path: licpu
        resourceFieldRef:
          containerName: da-volume-container
          resource: limits.cpu
      - path: limem
        resourceFieldRef:
          containerName: da-volume-container
          resource: limits.memory
      - path: listorage
        resourceFieldRef:
          containerName: da-volume-container
          resource: limits.ephemeral-storage
      - path: recpu
        resourceFieldRef:
          containerName: da-volume-container
          resource: requests.cpu
      - path: remem
        resourceFieldRef:
          containerName: da-volume-container
          resource: requests.memory
      - path: restorage
        resourceFieldRef:
          containerName: da-volume-container
          resource: requests.ephemeral-storage
  restartPolicy: Never

​

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: test-api
subjects:
  - kind: ServiceAccount
    name: test-api
    namespace: default
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io

kubectl create sa test-api

apiVersion: v1
kind: Pod
metadata:
  name: curl
spec:
  serviceAccountName: test-api
  containers:
  - name: curl-container
    image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/yauritux/busybox-curl:latest
    imagePullPolicy: IfNotPresent
    command: ["sleep","3600"]

#镜像我换了新的busybox，因为带curl命令

apiVersion: v1
kind: Pod
metadata:
  name: volume
spec:
  containers:
  - name: nginx
    image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/nginx:1.27.0
    imagePullPolicy: IfNotPresent
    volumeMounts:
    - name: logs-volume
      mountPath: /var/log/nginx
  - name: busybox
    image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/busybox:1.28
    imagePullPolicy: IfNotPresent
    command: 
    - tail
    - -f 
    - /logs/access.log
    volumeMounts:
    - name: logs-volume
      mountPath: /logs
  volumes:
  - name: logs-volume
    emptyDir: {}

#用内存作为emptyDir卷，特定场景使用手段，不做演示，代码放在这里了解即可
apiVersion: v1
kind: Pod
metadata:
  name: test-pd
spec:
  containers:
  - image: registry.k8s.io/test-webserver
    name: test-container
    volumeMounts:
    - mountPath: /cache
      name: cache-volume
  volumes:
  - name: cache-volume
    emptyDir:
      sizeLimit: 500Mi
      medium: Memory

ps：谁会用内存当持久卷用?知不知道内存多贵？

apiVersion: v1
kind: Pod
metadata:
  name: hostpath
spec:
  containers:
  - name: hostpath-container
    image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/busybox:1.28
    imagePullPolicy: IfNotPresent
    command: ["sleep","3600"]
    volumeMounts:
    - name: hostpath-volume
      mountPath: /tmp/testpod
  volumes:
  - name: hostpath-volume
    hostPath:
      type: Directory
      path: /data    #这个/data是最后pod分配节点的/data，不是master的/data
        type: Directory

#搭建nfs服务器，每个节点都安装
yum -y install nfs-utils rpcbind
systemctl start rpcbind
systemctl start nfs-server.service

#因为服务名称错误导致启动nfs报错的同志，用systemctl list-unit-files |grep -i nfs过滤

回到master节点，我选了此节点作为nfs服务器

mkdir /nfsdata
useradd nfsnobody
chmod 666 /nfsdata
chown nfsnobody /nfsdata
cd /nfsdata

#为了更好呈现pvc效果，多建几个目录进行pv制作，并且每个目录下都有内容
for i in {1..10} ;do mkdir $i ;echo $i > $i/index.html ;done

vim /etc/exports
/nfsdata/1 *(rw,no_root_squash,no_all_squash,sync)
/nfsdata/2 *(rw,no_root_squash,no_all_squash,sync)
/nfsdata/3 *(rw,no_root_squash,no_all_squash,sync)
/nfsdata/4 *(rw,no_root_squash,no_all_squash,sync)
/nfsdata/5 *(rw,no_root_squash,no_all_squash,sync)
/nfsdata/6 *(rw,no_root_squash,no_all_squash,sync)
/nfsdata/7 *(rw,no_root_squash,no_all_squash,sync)
/nfsdata/8 *(rw,no_root_squash,no_all_squash,sync)
/nfsdata/9 *(rw,no_root_squash,no_all_squash,sync)
/nfsdata/10 *(rw,no_root_squash,no_all_squash,sync)

exportfs -r

showmount -e <hostIP>    #查看共享

#可以在集群中其他节点测试挂载nfs目录
mount -t nfs <nfsServerIP:/path> <localPath>

#这样就模拟了十个nfs的共享存储，并且将十个目录以读写权限共享给所有客户端，保留客户端 root 权限（无映射限制），并确保数据同步写入磁盘

apiVersion: v1
kind: PersistentVolume
metadata:
  name: nfspv1
spec:
  capacity:
    storage: 0.9Gi
  accessModes: 
  - ReadOnlyMany
  persistentVolumeReclaimPolicy: Retain
  storageClassName: nfs
  nfs:
    path: /nfsdata/1
    server: 192.168.100.101
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: nfspv2
spec:
  capacity:
    storage: 500Mi
  accessModes:
  - ReadWriteMany
  persistentVolumeReclaimPolicy: Retain
  storageClassName: nfs
  nfs:
    path: /nfsdata/2
    server: 192.168.100.101
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: nfspv3
spec:
  capacity:
    storage: 1Gi
  accessModes:
  - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: nfs
  nfs:
    path: /nfsdata/3
    server: 192.168.100.101
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: nfspv4
spec:
  capacity:
    storage: 1Gi
  accessModes:
  - ReadWriteOnce
  persistentVolumeReclaimPolicy:  Retain
  storageClassName: nfs
  nfs:
    path: /nfsdata/4
    server: 192.168.100.101
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: nfspv5
spec:
  capacity:
    storage: 1Gi
  accessModes:
  - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: nfs
  nfs:
    path: /nfsdata/5
    server: 192.168.100.101

apiVersion: v1
kind: Service
metadata:
  name: nginx
spec:
  clusterIP: None # 配置为无头服务（Headless Service），允许直接访问 Pod
  ports:
    - name: web
      port: 80
  selector:
    app: nginx

创建PVC，设置PV筛选条件来选择PV使用

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: web
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  serviceName: nginx # 关联的 Service 名称，且service必须是 Headless Service
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - name: nginx-container
          image: nginx:one
          imagePullPolicy: IfNotPresent
          volumeMounts:
            - name: www
              mountPath: /usr/share/nginx/html
  volumeClaimTemplates: # 定义持久化卷模板
    - metadata:
        name: www # PVC 名称，需与 volumeMounts 一致
      spec:
        accessModes: 
          - ReadWriteOnce
        storageClassName: nfs
        resources:
          requests:
            storage: 1Gi

#一般pvc是配合sfs使用，pod分配的pv也是一致，假设想pod分别用不同规格的pv可以用另种方式。先写pvc，但是pvc名称一定要和sfs产生的pod名称完全一致，pod会自动按序号挂载同名pvc，所以还是可以工作的。但这样失去了动态创建的便利性

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: www-pod-0
spec:
  accessModes: 
    - ReadWriteOnce
  storageClassName: nfs
  resources:
    requests:
      storage: 1Gi  # pod-0 用 1G
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: www-pod-1
spec:
  accessModes: 
    - ReadWriteOnce
  storageClassName: nfs
  resources:
    requests:
      storage: 2Gi  # pod-1 用 2G
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: www-pod-2
spec:
  accessModes: 
    - ReadWriteOnce
  storageClassName: nfs
  resources:
    requests:
      storage: 3Gi  # pod-2 用 3G
---
# 2. StatefulSet 中不使用 volumeClaimTemplates，改用 volumes 手动指定
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: nginx-statefulset
spec:
  serviceName: nginx-svc
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx-container
        image: nginx:latest
        volumeMounts:
        - name: www
          mountPath: /usr/share/nginx/html
  volumeClaimTemplates: []   #volumeClaimTemplates留空