k8s 之如何创建一个WordPress
方法一：nodePort + haproxy 外网访问 WordPress
1. 创建 StorageClass、Namespace 和 pvc 资源
1.1 创建 StorageClass
- 创建命令
$ kubectl create -f sc.yaml
$ kubectl get sc
NAME PROVISIONER AGE
wordpress-sc-001 cds/nas 30m
- sc.yaml 内容如下
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: wordpress-sc-001
provisioner: cds/nas
parameters:
archiveOnDelete: "false"
server: "164.52.43.137" # 替换为集群配置的存储NAS云盘ip地址
path: "/nfsshare/wordpress" # 目录可自行修改为 /nfssahre/
vers: "4.0"
mode: "777"
reclaimPolicy: "Delete"
1.2 创建Namespace 和 pvc
- 创建命令
$ kubectl create -f wordpress-storageclass-pvc.yaml
- wordpress-storageclass-pvc.yaml 内容如下
apiVersion: v1
kind: Namespace
metadata:
name: wordpress
labels:
app: wordpress
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: mysql-pv-claim
namespace: wordpress
labels:
app: wordpress
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 20Gi
storageClassName: wordpress-sc-001
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: wp-pv-claim
namespace: wordpress
labels:
app: wordpress
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 20Gi
storageClassName: wordpress-sc-001
2. 部署MySQL容器组
- 创建一个Secret变量存放MySQL密码
$ kubectl create secret generic mysql-pass --from-literal=password= -n
$ kubectl get secret -n wordpress
NAME TYPE DATA AGE
default-token-5k6fs kubernetes.io/service-account-token 3 43m
mysql-pass Opaque 1 41m
- 部署MySQL容器
$ kubectl create -f mysql-deployment.yaml
- mysql-deployment.yaml 内容如下
apiVersion: v1
kind: Service
metadata:
name: wordpress-mysql
namespace: wordpress
labels:
app: wordpress
spec:
ports:
- port: 3306
selector:
app: wordpress
tier: mysql
clusterIP: None
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: mysql-pv-claim
labels:
app: wordpress
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 20Gi
---
apiVersion: apps/v1 # for versions before 1.9.0 use apps/v1beta2
kind: Deployment
metadata:
name: wordpress-mysql
namespace: wordpress
labels:
app: wordpress
spec:
selector:
matchLabels:
app: wordpress
tier: mysql
strategy:
type: Recreate
template:
metadata:
labels:
app: wordpress
tier: mysql
spec:
containers:
- image: mysql:5.6
name: mysql
env:
- name: MYSQL_ROOT_PASSWORD
valueFrom:
secretKeyRef:
name: mysql-pass
key: password
ports:
- containerPort: 3306
name: mysql
volumeMounts:
- name: mysql-persistent-storage
mountPath: /var/lib/mysql
volumes:
- name: mysql-persistent-storage
persistentVolumeClaim:
claimName: mysql-pv-claim
- 检查MySQL部署情况
$ kubectl get deployment -n wordpress
NAME READY UP-TO-DATE AVAILABLE AGE
wordpress-mysql 1/1 1 1 39m
$ kubectl get pods -n wordpress
NAME READY STATUS RESTARTS AGE
wordpress-mysql-5b697dbbfc-5rwrl 1/1 Running 0 39m
3. 部署WordPress容器组
- 部署命令
$ kubectl create -f wordpress-deployment.yaml
- wordpress-deployment.yaml 内容如下
apiVersion: v1
kind: Service
metadata:
name: wordpress
namespace: wordpress
labels:
app: wordpress
spec:
type: NodePort # 设置 NodePort 方式访问 Wordpress
ports:
- port: 80
targetPort: 80
nodePort: 30080 # 设置映射端口为 30080
selector:
app: wordpress
tier: frontend
---
apiVersion: apps/v1 # for versions before 1.9.0 use apps/v1beta2
kind: Deployment
metadata:
name: wordpress
namespace: wordpress
labels:
app: wordpress
spec:
selector:
matchLabels:
app: wordpress
tier: frontend
strategy:
type: Recreate
template:
metadata:
labels:
app: wordpress
tier: frontend
spec:
containers:
- image: wordpress:4.8-apache
name: wordpress
env:
- name: WORDPRESS_DB_HOST
value: wordpress-mysql
- name: WORDPRESS_DB_PASSWORD
valueFrom:
secretKeyRef:
name: mysql-pass
key: password
ports:
- containerPort: 80
name: wordpress
volumeMounts:
- name: wordpress-persistent-storage
mountPath: /var/www/html
volumes:
- name: wordpress-persistent-storage
persistentVolumeClaim:
claimName: wp-pv-claim
- 部署结果检查
$ kubectl get deployment -n wordpress
NAME READY UP-TO-DATE AVAILABLE AGE
wordpress 1/1 1 1 41m
wordpress-mysql 1/1 1 1 44m
$ kubectl get pods -n wordpress
NAME READY STATUS RESTARTS AGE
wordpress-578744754c-lhq5d 1/1 Running 0 41m
wordpress-mysql-5b697dbbfc-5rwrl 1/1 Running 0 44m
4. 配置 Haproxy 负载均衡（可略过）
- 复用部署 WordPress 集群使用的 Haproxy -> 点击策略配置
- 点击添加策略
- 填写 Haproxy 策略名称 -> 选择 HTTP 类型 -> 填写上述暴露的 NodePort -> 选择负载均衡算法 -> 添加服务器（集群的工作节点）-> 点击确认
- 查看 Haproxy 服务的内外网 IP 地址
5. 访问WordPress
- 集群中查看映射的 nodePort
$ kubectl get svc -n wordpress
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
wordpress NodePort 10.104.56.86 80:30080/TCP 43m
wordpress-mysql ClusterIP None 3306/TCP 45m
$ kubectl get nodes -o wide
NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP
master001 Ready master 87d v1.16.3 ***
master002 Ready master 87d v1.16.3 ***
master003 Ready master 87d v1.16.3 ***
worker001 Ready 87d v1.16.3 ***
worker002 Ready 87d v1.16.3 ***
worker003 Ready 87d v1.16.3 ***
- 本机验证访问（无负载均衡），NodeIP 可以是任意Node节点IP地址，nodePort 为设置的 30080
$ curl :
- 浏览器访问，开始安装WordPress
1）使用负载均衡 Haproxy：http://:haproxyIP:nodePort，haproxyIP 为上步创建的负责均衡服务的 IP，nodePort为设置的30080
2）使用负载均衡 Haproxy：http://:NodeIP:nodePort
方法二：Ingress 外网访问 WordPress
1. 创建 StorageClass、Namespace 和 pvc 资源
1.1 创建 StorageClass
- 创建命令
$ kubectl create -f sc.yaml
$ kubectl get sc
NAME PROVISIONER AGE
wordpress-sc-001 cds/nas 30m
- sc.yaml 内容如下
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: wordpress-sc-001
provisioner: cds/nas
parameters:
archiveOnDelete: "false"
server: "164.52.43.137" # 替换为集群配置的存储NAS云盘ip地址
path: "/nfsshare/wordpress" # 目录可自行修改为 /nfssahre/
vers: "4.0"
mode: "777"
reclaimPolicy: "Delete"
1.2 创建Namespace 和 pvc
- 创建命令
$ kubectl create -f wordpress-storageclass-pvc.yaml
- wordpress-storageclass-pvc.yaml 内容如下
apiVersion: v1
kind: Namespace
metadata:
name: wordpress
labels:
app: wordpress
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: mysql-pv-claim
namespace: wordpress
labels:
app: wordpress
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 20Gi
storageClassName: wordpress-sc-001
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: wp-pv-claim
namespace: wordpress
labels:
app: wordpress
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 20Gi
storageClassName: wordpress-sc-001
2. 部署MySQL容器组
- 创建一个Secret变量存放MySQL密码
$ kubectl create secret generic mysql-pass --from-literal=password= -n
$ kubectl get secret -n wordpress
NAME TYPE DATA AGE
default-token-5k6fs kubernetes.io/service-account-token 3 43m
mysql-pass Opaque 1 41m
- 部署MySQL容器
$ kubectl create -f mysql-deployment.yaml
- mysql-deployment.yaml 内容如下
apiVersion: v1
kind: Service
metadata:
name: wordpress-mysql
namespace: wordpress
labels:
app: wordpress
spec:
ports:
- port: 3306
selector:
app: wordpress
tier: mysql
clusterIP: None
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: mysql-pv-claim
labels:
app: wordpress
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 20Gi
---
apiVersion: apps/v1 # for versions before 1.9.0 use apps/v1beta2
kind: Deployment
metadata:
name: wordpress-mysql
namespace: wordpress
labels:
app: wordpress
spec:
selector:
matchLabels:
app: wordpress
tier: mysql
strategy:
type: Recreate
template:
metadata:
labels:
app: wordpress
tier: mysql
spec:
containers:
- image: mysql:5.6
name: mysql
env:
- name: MYSQL_ROOT_PASSWORD
valueFrom:
secretKeyRef:
name: mysql-pass
key: password
ports:
- containerPort: 3306
name: mysql
volumeMounts:
- name: mysql-persistent-storage
mountPath: /var/lib/mysql
volumes:
- name: mysql-persistent-storage
persistentVolumeClaim:
claimName: mysql-pv-claim
- 检查MySQL部署情况
$ kubectl get deployment -n wordpress
NAME READY UP-TO-DATE AVAILABLE AGE
wordpress-mysql 1/1 1 1 39m
$ kubectl get pods -n wordpress
NAME READY STATUS RESTARTS AGE
wordpress-mysql-5b697dbbfc-5rwrl 1/1 Running 0 39m
3. 部署WordPress容器组
- 部署命令
$ kubectl create -f wordpress-deployment.yaml
- wordpress-deployment.yaml 内容如下
apiVersion: v1
kind: Service
metadata:
name: wordpress
namespace: wordpress
labels:
app: wordpress
spec:
ports:
- port: 8080
targetPort: 80
selector:
app: wordpress
tier: frontend
---
apiVersion: apps/v1 # for versions before 1.9.0 use apps/v1beta2
kind: Deployment
metadata:
name: wordpress
namespace: wordpress
labels:
app: wordpress
spec:
selector:
matchLabels:
app: wordpress
tier: frontend
strategy:
type: Recreate
template:
metadata:
labels:
app: wordpress
tier: frontend
spec:
containers:
- image: wordpress:4.8-apache
name: wordpress
env:
- name: WORDPRESS_DB_HOST
value: wordpress-mysql
- name: WORDPRESS_DB_PASSWORD
valueFrom:
secretKeyRef:
name: mysql-pass
key: password
ports:
- containerPort: 80
name: wordpress
volumeMounts:
- name: wordpress-persistent-storage
mountPath: /var/www/html
volumes:
- name: wordpress-persistent-storage
persistentVolumeClaim:
claimName: wp-pv-claim
- 部署结果检查
$ kubectl get svc -n wordpress
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
wordpress ClusterIP 10.108.144.175 8080/TCP 19s
wordpress-mysql ClusterIP None 3306/TCP 10d
$ kubectl get pods -n wordpress
NAME READY STATUS RESTARTS AGE
wordpress-578744754c-6snkd 1/1 Running 0 30s
wordpress-mysql-5b697dbbfc-5rwrl 1/1 Running 0 10d
4. 部署 Ingress Controller
- 部署命令
$ kubecreate -f mandatory.yaml
- mandatory.yaml 内容如下
官网获取地址：https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/mandatory.yaml
备注：需要自行修改如下两点
1）修改其中的镜像地址为：registry.cn-hangzhou.aliyuncs.com/google_containers/nginx-ingress-controller:0.30.0
2）将默认的 Deployment 修改为 Daemonset，去掉 replicas 字段
apiVersion: v1
kind: Namespace
metadata:
name: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
---
kind: ConfigMap
apiVersion: v1
metadata:
name: nginx-configuration
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
---
kind: ConfigMap
apiVersion: v1
metadata:
name: tcp-services
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
---
kind: ConfigMap
apiVersion: v1
metadata:
name: udp-services
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: nginx-ingress-serviceaccount
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
name: nginx-ingress-clusterrole
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
rules:
- apiGroups:
- ""
resources:
- configmaps
- endpoints
- nodes
- pods
- secrets
verbs:
- list
- watch
- apiGroups:
- ""
resources:
- nodes
verbs:
- get
- apiGroups:
- ""
resources:
- services
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- events
verbs:
- create
- patch
- apiGroups:
- "extensions"
- "networking.k8s.io"
resources:
- ingresses
verbs:
- get
- list
- watch
- apiGroups:
- "extensions"
- "networking.k8s.io"
resources:
- ingresses/status
verbs:
- update
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
name: nginx-ingress-role
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
rules:
- apiGroups:
- ""
resources:
- configmaps
- pods
- secrets
- namespaces
verbs:
- get
- apiGroups:
- ""
resources:
- configmaps
resourceNames:
# Defaults to "-"
# Here: "-"
# This has to be adapted if you change either parameter
# when launching the nginx-ingress-controller.
- "ingress-controller-leader-nginx"
verbs:
- get
- update
- apiGroups:
- ""
resources:
- configmaps
verbs:
- create
- apiGroups:
- ""
resources:
- endpoints
verbs:
- get
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
name: nginx-ingress-role-nisa-binding
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: nginx-ingress-role
subjects:
- kind: ServiceAccount
name: nginx-ingress-serviceaccount
namespace: ingress-nginx
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: nginx-ingress-clusterrole-nisa-binding
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: nginx-ingress-clusterrole
subjects:
- kind: ServiceAccount
name: nginx-ingress-serviceaccount
namespace: ingress-nginx
---
apiVersion: apps/v1
# 修改 Deployment 部署方式为 DaemonSet 方式
kind: DaemonSet
metadata:
name: nginx-ingress-controller
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
spec:
selector:
matchLabels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
template:
metadata:
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
annotations:
prometheus.io/port: "10254"
prometheus.io/scrape: "true"
spec:
# wait up to five minutes for the drain of connections
terminationGracePeriodSeconds: 300
serviceAccountName: nginx-ingress-serviceaccount
nodeSelector:
kubernetes.io/os: linux
containers:
- name: nginx-ingress-controller
# 自行修改镜像地址为如下最新版本 0.30.0
image: registry.cn-hangzhou.aliyuncs.com/google_containers/nginx-ingress-controller:0.30.0
args:
- /nginx-ingress-controller
- --configmap=$(POD_NAMESPACE)/nginx-configuration
- --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
- --udp-services-configmap=$(POD_NAMESPACE)/udp-services
- --publish-service=$(POD_NAMESPACE)/ingress-nginx
- --annotations-prefix=nginx.ingress.kubernetes.io
securityContext:
allowPrivilegeEscalation: true
capabilities:
drop:
- ALL
add:
- NET_BIND_SERVICE
# www-data -> 101
runAsUser: 101
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
ports:
- name: http
containerPort: 80
protocol: TCP
- name: https
containerPort: 443
protocol: TCP
livenessProbe:
failureThreshold: 3
httpGet:
path: /healthz
port: 10254
scheme: HTTP
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 10
readinessProbe:
failureThreshold: 3
httpGet:
path: /healthz
port: 10254
scheme: HTTP
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 10
lifecycle:
preStop:
exec:
command:
- /wait-shutdown
---
apiVersion: v1
kind: LimitRange
metadata:
name: ingress-nginx
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
spec:
limits:
- min:
memory: 90Mi
cpu: 100m
type: Container
- 部署结果检查（所属命名空间为 ingress-nginx）
$ kubectl get ds -n ingress-nginx
NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE
nginx-ingress-controller 3 3 3 3 3 kubernetes.io/os=linux 22s
$ kubectl get pods -n ingress-nginx
NAME READY STATUS RESTARTS AGE
nginx-ingress-controller-54hlp 1/1 Running 0 112s
nginx-ingress-controller-dqlm5 1/1 Running 0 112s
nginx-ingress-controller-xl62f 1/1 Running 0 112s
5. 部署 service-port.yaml
官网获取 service-port.yaml 地址：https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/provider/baremetal/service-nodeport.yaml
备注：增加NodePort，固定端口为：30082（后续用于外网访问 Ingress）
- 部署命令
$ kubectl create -f service-port.yaml
- service-port.yaml 内容如下
apiVersion: v1
kind: Service
metadata:
name: ingress-nginx
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
spec:
type: NodePort # 增加 NodePort
ports:
- name: http
port: 80
targetPort: 80
nodePort: 30082 # 设置端口为 30082
protocol: TCP
- name: https
port: 443
targetPort: 443
nodePort: 30443
protocol: TCP
selector:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
- 部署结果检查（所属命名空间为 ingress-nginx）
$ kubectl get svc -n ingress-nginx
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
ingress-nginx NodePort 10.106.203.4 80:30082/TCP,443:30443/TCP 60m
6. 为 Ingress 创建一个默认的后端服务
- 部署命令
$ kubectl create -f nginx-default-backend.yaml
- nginx-backend-demo.yaml 内容如下
apiVersion: v1
kind: Service
metadata:
name: nginx
namespace: default
spec:
selector:
app: nginx
ports:
- port: 80
targetPort: 80
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx
namespace: default
spec:
replicas: 3
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- name: nginx
image: nginx:alpine
ports:
- containerPort: 80
- 结果检查
$ kubectl create -f nginx-backend-demo.yaml
service/nginx created
deployment.apps/nginx created
$ kubectl get pods
NAME READY STATUS RESTARTS AGE
nginx-5c559d5697-5khd8 1/1 Running 0 3s
nginx-5c559d5697-9zkjh 1/1 Running 0 3s
nginx-5c559d5697-dnksg 1/1 Running 0 3s
7. 创建和配置 Ingress 服务
- 部署命令
$ kubectl create -f ingress.yaml
- ingress.yaml 内容如下
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: nginx
namespace: wordpress
labels:
app: nginx
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /
spec:
rules:
- host: wordpress.demo.me
http:
paths:
- path: /
backend:
serviceName: wordpress # 指向 wordpress 的 svc
servicePort: 8080 # 配置 wordpress 的 svc 的 port
- path: /nginx
backend:
serviceName: nginx
servicePort: 80
- 部署结果检查
$ kubectl get ingress -n wordpress
NAME HOSTS ADDRESS PORTS AGE
nginx wordpress.demo.me 10.106.203.4 80 13m
8. 访问 Wordpress
- 本机配置 hosts 域名解析
wordpress.demo.me - 浏览器访问：http://wordpress.demo.me:（nodePort 前文设置为 30082），开始安装 WordPress