如何将 secret 挂载到 kubernetes StatefulSet

Question

所以，查看 Kubernetes API 文档：https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#statefulsetspec-v1-apps 看来我确实可以拥有一个卷，因为它使用 podspec 并且 podspec 确实有一个卷字段，所以我可以列出秘密，然后像在部署或任何其他 pod 中一样安装它。

问题是 kubernetes 似乎认为卷实际上不在 StatefulSet 的 podspec 中？这是正确的吗？如果这是真的，我如何将秘密安装到我的状态集。

错误：error validating "mysql-stateful-set.yaml": error validating data: ValidationError(StatefulSet.spec.template.spec.containers[0]): unknown field "volumes" in io.k8s.api.core.v1.Container; if you choose to ignore these errors, turn validation off with --validate=false

状态集：

apiVersion: v1
kind: Service
metadata:
  name: mysql
  labels:
    app: mysql
spec:
  ports:
  - port: 3306
    name: database
  selector:
    app: mysql
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mysql
spec:
  selector:
    matchLabels:
      app: mysql # has to match .spec.template.metadata.labels
  serviceName: "mysql"
  replicas: 1
  template:
    metadata:
      labels:
        app: mysql
    spec:
      terminationGracePeriodSeconds: 60
      containers:
      - name: mysql
        image: mysql
        ports:
        - containerPort: 3306
          name: database
        volumeMounts:
        - name: data
          mountPath: /var/lib/mysql
        - name: mysql
          mountPath: /run/secrets/mysql
        env:
        - name: MYSQL_ROOT_PASSWORD_FILE
          value: /run/secrets/mysql/root-pass
        volumes:
          - name: mysql
            secret:
              secretName: mysql
              items:
                - key: root-pass
                  path: root-pass
                  mode: 511
  volumeClaimTemplates:
  - metadata:
      name: data
    spec:
      accessModes: [ "ReadWriteOnce" ]
      storageClassName: do-block-storage
      resources:
        requests:
          storage: 10Gi```

Answer 1

体积字段应位于模板规范内，而不是容器内（如您的模板中所做的那样）。请参阅此以获得确切的结构 (https://godoc.org/k8s.io/api/apps/v1#StatefulSetSpec)，转到 PodTemplateSpec，您将找到 volumes 字段。

以下模板应该适合您：

apiVersion: v1
kind: Service
metadata:
  name: mysql
  labels:
    app: mysql
spec:
  ports:
  - port: 3306
    name: database
  selector:
    app: mysql
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mysql
spec:
  selector:
    matchLabels:
      app: mysql # has to match .spec.template.metadata.labels
  serviceName: "mysql"
  replicas: 1
  template:
    metadata:
      labels:
        app: mysql
    spec:
      terminationGracePeriodSeconds: 60
      containers:
      - name: mysql
        image: mysql
        ports:
        - containerPort: 3306
          name: database
        volumeMounts:
        - name: data
          mountPath: /var/lib/mysql
        - name: mysql
          mountPath: /run/secrets/mysql
        env:
        - name: MYSQL_ROOT_PASSWORD_FILE
          value: /run/secrets/mysql/root-pass
      volumes:
       - name: mysql
         secret:
           secretName: mysql
           items:
            - key: root-pass
              path: root-pass
               mode: 511
  volumeClaimTemplates:
  - metadata:
      name: data
    spec:
      accessModes: [ "ReadWriteOnce" ]
      storageClassName: do-block-storage
      resources:
        requests:
          storage: 10Gi

如何将 secret 挂载到 kubernetes StatefulSet

How to mount a secret to kubernetes StatefulSet

kubernetes

statefulset

kubernetes-secrets