存储卷 #

容器存储问题
    │
    ├── 容器重启数据丢失
    │
    ├── 容器间数据不共享
    │
    └── 数据需要持久化保存

Volume解决方案
    │
    ├── 数据持久化
    │
    ├── 容器间数据共享
    │
    └── 外部存储挂载

apiVersion: v1
kind: Pod
metadata:
  name: emptydir-demo
spec:
  containers:
  - name: writer
    image: busybox
    command: ["sh", "-c", "echo 'Hello' > /data/hello.txt && sleep 3600"]
    volumeMounts:
    - name: shared-data
      mountPath: /data
  - name: reader
    image: busybox
    command: ["sh", "-c", "cat /data/hello.txt && sleep 3600"]
    volumeMounts:
    - name: shared-data
      mountPath: /data
  volumes:
  - name: shared-data
    emptyDir: {}

volumes:
- name: cache-volume
  emptyDir:
    medium: Memory
    sizeLimit: 256Mi

emptyDir特点
    │
    ├── Pod创建时创建
    │
    ├── Pod删除时删除
    │
    ├── 同Pod容器间共享
    │
    └── 可使用内存存储

apiVersion: v1
kind: Pod
metadata:
  name: hostpath-demo
spec:
  containers:
  - name: app
    image: nginx
    volumeMounts:
    - name: host-volume
      mountPath: /usr/share/nginx/html
  volumes:
  - name: host-volume
    hostPath:
      path: /data/nginx
      type: DirectoryOrCreate

hostPath注意事项
    │
    ├── 节点依赖性
    │   └── Pod迁移后数据不可访问
    │
    ├── 安全风险
    │   └── 可访问节点敏感文件
    │
    └── 权限问题
        └── 需要适当的文件权限

apiVersion: v1
kind: Pod
metadata:
  name: nfs-demo
spec:
  containers:
  - name: app
    image: nginx
    volumeMounts:
    - name: nfs-volume
      mountPath: /usr/share/nginx/html
  volumes:
  - name: nfs-volume
    nfs:
      server: 192.168.1.100
      path: /data/share
      readOnly: false

# 安装NFS服务端
sudo apt install nfs-kernel-server

# 配置导出目录
echo "/data/share *(rw,sync,no_subtree_check)" >> /etc/exports

# 重启NFS服务
sudo systemctl restart nfs-kernel-server

apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-config
data:
  nginx.conf: |
    server {
      listen 80;
      location / {
        root /usr/share/nginx/html;
      }
    }
---
apiVersion: v1
kind: Pod
metadata:
  name: configmap-volume-demo
spec:
  containers:
  - name: nginx
    image: nginx
    volumeMounts:
    - name: config
      mountPath: /etc/nginx/conf.d
  volumes:
  - name: config
    configMap:
      name: nginx-config

volumes:
- name: config
  configMap:
    name: nginx-config
    items:
    - key: nginx.conf
      path: default.conf

volumeMounts:
- name: config
  mountPath: /etc/nginx/conf.d/default.conf
  subPath: nginx.conf

apiVersion: v1
kind: Secret
metadata:
  name: db-secret
type: Opaque
data:
  username: YWRtaW4=
  password: cGFzc3dvcmQ=
---
apiVersion: v1
kind: Pod
metadata:
  name: secret-volume-demo
spec:
  containers:
  - name: app
    image: mysql
    volumeMounts:
    - name: secret
      mountPath: /etc/secrets
      readOnly: true
  volumes:
  - name: secret
    secret:
      secretName: db-secret

volumes:
- name: secret
  secret:
    secretName: db-secret
    defaultMode: 0400
    items:
    - key: username
      path: user.txt
      mode: 0444

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: my-pvc
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
---
apiVersion: v1
kind: Pod
metadata:
  name: pvc-demo
spec:
  containers:
  - name: app
    image: nginx
    volumeMounts:
    - name: data
      mountPath: /usr/share/nginx/html
  volumes:
  - name: data
    persistentVolumeClaim:
      claimName: my-pvc

apiVersion: v1
kind: Pod
metadata:
  name: sidecar-demo
spec:
  containers:
  - name: app
    image: nginx
    volumeMounts:
    - name: logs
      mountPath: /var/log/nginx
  - name: log-collector
    image: busybox
    command: ["sh", "-c", "tail -f /logs/access.log"]
    volumeMounts:
    - name: logs
      mountPath: /logs
  volumes:
  - name: logs
    emptyDir: {}

apiVersion: v1
kind: Pod
metadata:
  name: ambassador-demo
spec:
  containers:
  - name: app
    image: nginx
  - name: proxy
    image: envoyproxy/envoy
    volumeMounts:
    - name: config
      mountPath: /etc/envoy
  volumes:
  - name: config
    configMap:
      name: envoy-config

# 查看Pod Volume
kubectl describe pod <pod-name>

# 查看PVC
kubectl get pvc

# 查看PV
kubectl get pv

# 进入容器查看挂载
kubectl exec -it <pod-name> -- df -h

# 查看挂载点
kubectl exec -it <pod-name> -- mount | grep /data

# 查看文件
kubectl exec -it <pod-name> -- ls -la /data

# 只读挂载
volumeMounts:
- name: config
  mountPath: /etc/config
  readOnly: true

# 限制权限
volumes:
- name: secret
  secret:
    secretName: my-secret
    defaultMode: 0400