k8s-项目部署

1、docker启动mysql

docker pull mysql:8.0
docker run --name mysql -p 3306:3306 -e MYSQL_ROOT_PASSWORD=123456 -d mysql:8.0

• -p 3306:3306 ：映射容器服务的 3306 端口到宿主机的 3306 端口，外部主机可以直接通过 宿主机ip:3306 访问到 MySQL 的服务。
• MYSQL_ROOT_PASSWORD=123456：设置 MySQL 服务 root 用户的密码。

2、单节点mysql服务

1）创建pvc

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mysql-pvc
  namespace: app-001
spec:
  storageClassName: csi-hostpath-sc 
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi

kubectl apply -f mysql-pvc.yaml

2）创建service

apiVersion: v1
kind: Service
metadata:
  name: mysql-svc
  namespace: app-001
spec:
  ports:
  - port: 3306
  selector:
    app: mysql
  clusterIP: None

kubectl apply -f mysql-svc.yaml

3）创建statefulset

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mysql
  namespace: app-001
spec:
  serviceName: mysql-svc
  selector:
    matchLabels:
      app: mysql
  template:
    metadata:
      labels:
        app: mysql
    spec:
      containers:
      - image: mysql:5.7
        name: mysql
        env:
          # Use secret in real usage
        - name: MYSQL_ROOT_PASSWORD
          value: password # 密码
        ports:
        - containerPort: 3306
          name: mysql
        resources:
          limits:
            cpu: 800m
            memory: 1Gi
          requests:
            cpu: 500m
            memory: 800Mi
        volumeMounts:
        - name: mysql-persistent-storage
          mountPath: /var/lib/mysql
      volumes:
      - name: mysql-persistent-storage
        persistentVolumeClaim:
          claimName: mysql-pvc

kubectl apply -f mysql-sts.yaml

4）测试

kubectl run -it --rm --image=mysql:5.7 --restart=Never mysql-client -- mysql -h mysql-0.mysql-svc.app-001.svc.cluster.local -ppassword
kubectl delete po mysql-client

导入SQL

youyiyuan.sql

$ docker run -itd --rm --name import-test geray/centos:v7-1 bash
$ docker cp youyiyuan.sql import-test:/
$ docker exec -it import-test bash 
$ yum -y install mysql
$ mysql -h 10.244.36.126 -uroot -ppassword
$ mysql -h 10.244.36.126 -uroot -ppassword < youyiyuan.sql

3、部署web

1）创建configmap或者secret

cat db.properties
driverClass=com.mysql.cj.jdbc.Driver
# 应该使用mysql的svc名称(mysql-svc.app-001.svc.cluster.local)
# 由于是单实例mysql，所以这里直接使用了pod名称
url=jdbc:mysql://mysql-0.mysql-svc.app-001.svc.cluster.local:3306/youyiyuan
username=root
userpwd=password

$ kubectl create secret generic web-youyiyuan-secret --from-file=db.properties -n app-001 -o yaml --dry-run=client | tee web-secret.yaml
apiVersion: v1
data:
  db.properties: ZHJpdmVyQ2xhc3M9Y29tLm15c3FsLmNqLmpkYmMuRHJpdmVyCnVybD1qZGJjOm15c3FsOi8vbXlzcWwtMC5teXNxbC1zdmMuYXBwLTAwMS5zdmMuY2x1c3Rlci5sb2NhbDozMzA2L3lvdXlpeXVhbgp1c2VybmFtZT1yb290CnVzZXJwd2Q9cGFzc3dvcmQK
kind: Secret
metadata:
  name: web-youyiyuan-secret
  namespace: app-001

kubectl apply -f web-secret.yaml

2）创建deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-youyiyuan
  namespace: app-001
  labels:
    app: web-youyiyuan
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web-youyiyuan
  template:
    metadata:
      labels:
        app: web-youyiyuan
    spec:
      containers:
      - image: geray/youyiyuan:v1
        name: youyiyuan
        resources:
          limits:
            memory: "200Mi"
            cpu: "500m"
          requests:
            memory: "200Mi"
            cpu: "300m"
        livenessProbe:
          httpGet:
            path: /
            port: 8080
          initialDelaySeconds: 3
          periodSeconds: 3
        volumeMounts:
        - name: db-file
          mountPath: "/usr/local/tomcat/webapps/youyiyuan3/WEB-INF/classes/db.properties"
          subPath: db.properties # subPath不会覆盖原有目录或目录的其他文件
          readOnly: true
      volumes:
        - name: db-file
          secret:
            secretName: web-youyiyuan-secret

kubectl apply -f web-deployemnt.yaml

3）创建service

kubectl expose deployment web-youyiyuan --type=NodePort --port=8080 --target-port=8080 --name web-youyiyuan-svc -o yaml --dry-run=client | tee web-youyiyuan-svc.yaml
apiVersion: v1
kind: Service
metadata:
  name: web-youyiyuan-svc
  namespace: app-001
spec:
  ports:
  - port: 8080
    protocol: TCP
    targetPort: 8080
  selector:
    app: web-youyiyuan
  type: NodePort

kubectl apply -f  web-youyiyuan-svc.yaml

4）创建ingress（https）

• 自制证书文件

openssl genrsa -out tls-yyy.key 2048
openssl req -new -x509 -key tls-yyy.key -out tls-yyy.crt -subj /C=CN/ST=GS/L=LZ/O=devops/CN=demo.youyiyuan.cn
# 两个文件tls-yyy.key  tls-yyy.crt

• 生成secret

kubectl create secret tls web-yyy -n app-001 --cert=tls-yyy.crt --key=tls-yyy.key -o yaml --dry-run=client | tee secret-yyy.yaml

下面是第二种方式

cat crets.sh 
cat > ca-config.json <<EOF
{
  "signing": {
    "default": {
      "expiry": "87600h"
    },
    "profiles": {
      "kubernetes": {
         "expiry": "87600h",
         "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"
        ]
      }
    }
  }
}
EOF
cat > ca-csr.json <<EOF
{
    "CN": "kubernetes",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "Beijing",
            "ST": "Beijing"
        }
    ]
}
EOF
cfssl gencert -initca ca-csr.json | cfssljson -bare ca -
cat > demo.youyiyuan.cn-csr.json <<EOF
{
  "CN": "demo.youyiyuan.cn",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "L": "BeiJing",
      "ST": "BeiJing"
    }
  ]
}
EOF
# 这里可以使用k8s的ca和ca-key
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes demo.youyiyuan.cn-csr.json | cfssljson -bare demo.youyiyuan.cn

ingress.yaml

$ kubectl -n app-001 create ingress web-youyiyun-ing --rule="demo.youyiyuan.cn/*=web-youyiyuan-svc:8080" -o yaml --dry-run=client | tee /aliang-cka-06/mysql/mysql/web/web-youyiyuan-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-youyiyuan-ing
  namespace: app-001
spec:
  rules:
  - host: demo.youyiyuan.cn
    http:
      paths:
      - backend:
          service:
            name: web-youyiyuan-svc
            port:
              number: 8080
        path: /
        pathType: Prefix
  tls:
  - hosts:
      - demo.youyiyuan.cn
    secretName: web-youyiyuan-svc

4、网络策略

只允许本名称空间下的带有app=web-youyiyuan标签的pod访问3306端口

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: db-network-policy
  namespace: app-001
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: web-youyiyuan
    ports:
    - protocol: TCP
      port: 3306