千知博客

环境信息

• K8S版本： V1.16.6
• 集群RBAC状态：启用
• NFS服务器IP： 192.168.61.163
• NFS共享目录： /home/nfsdata

1.创建授权

cat > rbac.yaml<<EOF
apiVersion: v1
kind: ServiceAccount
metadata:
  name: nfs-client-provisioner
  # replace with namespace where provisioner is deployed
  namespace: default
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: nfs-client-provisioner-runner
rules:
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["persistentvolumes"]
    verbs: ["get", "list", "watch", "create", "delete"]
  - apiGroups: [""]
    resources: ["persistentvolumeclaims"]
    verbs: ["get", "list", "watch", "update"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["storageclasses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["create", "update", "patch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: run-nfs-client-provisioner
subjects:
  - kind: ServiceAccount
    name: nfs-client-provisioner
    # replace with namespace where provisioner is deployed
    namespace: default
roleRef:
  kind: ClusterRole
  name: nfs-client-provisioner-runner
  apiGroup: rbac.authorization.k8s.io
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: leader-locking-nfs-client-provisioner
  # replace with namespace where provisioner is deployed
  namespace: default
rules:
  - apiGroups: [""]
    resources: ["endpoints"]
    verbs: ["get", "list", "watch", "create", "update", "patch"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: leader-locking-nfs-client-provisioner
  # replace with namespace where provisioner is deployed
  namespace: default
subjects:
  - kind: ServiceAccount
    name: nfs-client-provisioner
    # replace with namespace where provisioner is deployed
    namespace: default
roleRef:
  kind: Role
  name: leader-locking-nfs-client-provisioner
  apiGroup: rbac.authorization.k8s.io
EOF
kubectl create -f rbac.yaml

成功输出

> kubectl get clusterroles.rbac.authorization.k8s.io  nfs-client-provisioner-runner 
NAME                            AGE
nfs-client-provisioner-runner   41m
> kubectl get clusterrolebindings.rbac.authorization.k8s.io run-nfs-client-provisioner
NAME                         AGE
run-nfs-client-provisioner   43m
> kubectl get serviceaccounts nfs-client-provisioner 
NAME                     SECRETS   AGE
nfs-client-provisioner   1         43m

2.创建NFS动态供给应用

cat > deployment.yaml<<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nfs-client-provisioner
  labels:
    app: nfs-client-provisioner
  # replace with namespace where provisioner is deployed
  namespace: default
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: nfs-client-provisioner
  template:
    metadata:
      labels:
        app: nfs-client-provisioner
    spec:
      serviceAccountName: nfs-client-provisioner
      containers:
        - name: nfs-client-provisioner
          image: lank8s.cn/sig-storage/nfs-subdir-external-provisioner:v4.0.2
          volumeMounts:
            - name: nfs-client-root
              mountPath: /persistentvolumes
          env:
            - name: PROVISIONER_NAME
              value: lank8s.cn/nfs-subdir-external-provisioner
            - name: NFS_SERVER
              value: 192.168.61.163
            - name: NFS_PATH
              value: /home/nfsdata
      volumes:
        - name: nfs-client-root
          nfs:
            server: 192.168.61.163
            path: /home/nfsdata
EOF
kubectl create -f deployment.yaml

成功输出

> kubectl get deployments.apps nfs-client-provisioner 
NAME                     READY   UP-TO-DATE   AVAILABLE   AGE
nfs-client-provisioner   1/1     1            1           40m

3.创建NFS存储类

cat >nfs_storage_class.yaml<<EOF
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: nfs-client
provisioner: lank8s.cn/nfs-subdir-external-provisioner # or choose another name, must match deployment's env PROVISIONER_NAME'
parameters:
  archiveOnDelete: "false"
EOF
kubectl create -f nfs_storage_class.yaml

成功输出

> kubectl get storageclasses.storage.k8s.io nfs-client 
NAME         PROVISIONER                                 AGE
nfs-client   lank8s.cn/nfs-subdir-external-provisioner   36m

4.PV测试

cat >test_pv.yaml<<EOF
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: test-claim
spec:
  storageClassName: nfs-client
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 1Mi
EOF
kubectl create -f test_pv.yaml

成功输出

> kubectl get pv
NAME                                       CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS      CLAIM                STORAGECLASS   REASON   AGE
pvc-b4728700-d9fb-48ae-812a-fcdf505db00a   1Mi        RWX            Delete           Bound       default/test-claim   nfs-client              31m

5.POD挂载测试

cat >test_pod.yaml<<EOF
kind: Pod
apiVersion: v1
metadata:
  name: test-pod
spec:
  containers:
  - name: test-pod
    image: busybox:stable
    command:
      - "/bin/sh"
    args:
      - "-c"
      - "touch /mnt/SUCCESS && exit 0 || exit 1"
    volumeMounts:
      - name: nfs-pvc
        mountPath: "/mnt"
  restartPolicy: "Never"
  volumes:
    - name: nfs-pvc
      persistentVolumeClaim:
        claimName: test-claim
EOF
kubectl create -f test_pod.yaml

成功结果

NFS服务器/home/nfsdata/default-test-claim-pvc-b4728700-d9fb-48ae-812a-fcdf505db00a/目录下生成一个SUCCESS的空文件