Kubernetes: k8s 基础篇-配置管理

# 指定目录
kubectl create configmap *** --from-file=/path

# 指定文件或多个文件
kubectl create configmap *** --from-file=file1

#其中，--from-file可以使用多次，比如：
kubectl create configmap *** --from-file=file1 --from-file=file2

# 自定义 key 名称， 默认为文件名
kubectl create configmap *** --from-file=keyname=file1

kubectl create configmap *** --from-literal=config1=123 --from-literal=PASSWORD=234
kubectl create cm *** --from-env-file=conf/game1.conf

apiVersion: v1
kind: ConfigMap
metadata: 
  name: test-conf
  namespace: test
data:
  test-conf: |+
    SESSION_LIFETIME: 3600
    URL: "http://test-server:8080"

$ cat dp-cm.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: dp-cm
  name: dp-cm
spec:
  replicas: 1
  selector:
    matchLabels:
      app: dp-cm
  template:
    metadata:
      labels:
        app: dp-cm
    spec:
      containers:
      - env:  # 定义环境变量
        - name: TZ  # 请注意这里可以和 ConfigMap 中的键名不一样的
          valueFrom:
            configMapKeyRef:
              name: app-config # 这个值来自 ConfigMap
              key: TZ          # 需要取值的键
        - name: KAFKA_TOPIC_NAME
          valueFrom:
            configMapKeyRef:
              name: app-config
              key: APP_NAMESPACE
        - name: SERVICE_NAME
          value: "ludo-user"
        image: nginx
        name: nginx

$ kubectl apply -f app-config.yaml
$ kubectl apply -f dp-cm.yaml

$ kubectl  exec -it dp-cm-f86b8cdf-glfnt -- env |grep -iE "TZ|KAFKA"
KAFKA_TOPIC_NAME=ludo-prd
TZ=Asia/Calcutta

#  根据 kubecet get po -ojson 查看自带的变量
        - name: NODE_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: spec.nodeName
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: POD_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.podIP

$ cat dp-cm.yaml
...
    spec:
      containers:
      - env:
        - name: SERVICE_NAME
          value: "ludo-user"
        envFrom:
        - configMapRef:
            name: app-config
        image: nginx
        name: nginx

$ cat dp-cm.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: dp-cm
  name: dp-cm
spec:
  replicas: 1
  selector:
    matchLabels:
      app: dp-cm
  template:
    metadata:
      labels:
        app: dp-cm
    spec:
      containers:
      - image: nginx
        name: nginx
        volumeMounts:
        - mountPath: /opt/PreStop.sh
          name: app-config             # volumes 中对应的名称
          subPath: PreStop.sh          # 取 key 对应的 value 值，文件权限511
        - mountPath: /opt/a/PreStop.sh
          name: test   
          subPath: PreStop.sh.bak
        - mountPath: /opt/conf.d/
          name: test                   # 挂载目录，目录本身文件因挂载而消失，可自动更新文件
      volumes:
      - configMap:
          defaultMode: 0777
          name: app-config
        name: app-config
      - configMap:
          defaultMode: 0644
          items:                       # 只使用 ConfigMap 部分的 key
          - key: PreStop.sh            # 指定 ConfigMap 中的 key
            path: PreStop.sh           # 指定挂载的名称
          - key: PreStop.sh
            path: PreStop.sh.bak
            mode: 0755                 # 指定文件权限，优先级高
          name: app-config
        name: test

$ kubectl  exec -it dp-cm-bc6f948f-qd8jr -- bash
root@dp-cm-bc6f948f-qd8jr:/# ls /opt/
PreStop.sh  a  conf.d
root@dp-cm-bc6f948f-qd8jr:/# ls /opt/a/
PreStop.sh
root@dp-cm-bc6f948f-qd8jr:/# ls /opt/conf.d/
PreStop.sh  PreStop.sh.bak

- configMap:
    defaultMode: 420    # 即 8 进制的 0644
    items:              # 只使用 ConfigMap 部分的 key
    - key: PreStop.sh
      path: PreStop.sh.bak
      mode: 0755        # 指定文件权限，优先级高

root@dp-cm-5f766576cb-kjmrv:/opt/conf.d/..data# ls -l
total 8
-rw-r--r-- 1 root root 251 Sep  6 17:18 PreStop.sh
-rwxr-xr-x 1 root root 251 Sep  6 17:18 PreStop.sh.bak

printf '%d\n' 0644 # 8 转 10
420
# printf '%o\n' 511 # 10 转 8 
777

apiVersion: v1
data:
  APP_ENV: prod
  APP_JVM_CONFIG: |-
    -Dfile.encoding=utf-8
    -server
    -XX:+UseG1GC
    -XX:+ExitOnOutOfMemoryError
    -XX:InitialRAMPercentage=75.0
    -XX:MinRAMPercentage=75.0
    -XX:MaxRAMPercentage=75.0
    -XX:+HeapDumpOnOutOfMemoryError
    -XX:HeapDumpPath=/opt/logs/
  APP_NAMESPACE: default
  TZ: Asia/ShangHai
  postStart.sh: |-
    #!/bin/bash
    #set -ex

    service_name=$1
    [ -z ${service_name} ] && { echo "未定义service_name...退出" ; exit; }

    #service_port=""
    #if [ ${service_name}  = "x11" ]; then
    #  service_port='1028'
    #elif [ ${service_name}  = "x12" ]; then
    #  service_port='1034'
    #else
    #  service_port=""
    #fi
    #[ -z ${service_port} ] && { echo "未定义service_port...退出" ; exit; }

    declare -A name_port
    name_port=()
    name_port+=([x11]='1028') 
    name_port+=([x12]='1029') 
    service_port=${name_port[${service_name}]}

    APP_NAME="ROOT.jar" 
    CAPTURE_DIR="/tmp/debug/${HOSTNAME}-`hostname -i`/arthas_captures"

    REPORT_FILE="$CAPTURE_DIR/report.txt"

    monitor_health() {
      while : 
      do
          command -v curl &> /dev/null || { echo "没有curl命令，退出循环" ; break; }
          val=$(curl -o /dev/null -s  -w "%{http_code}" http://127.0.0.1:${service_port}/actuator/health/liveness)
          echo "val-> ${val}"
          if [[ $val != "200" ]];then
              # 创建目录
              mkdir -p $CAPTURE_DIR
              echo "-----" > $REPORT_FILE
              echo "----------http://127.0.0.1:${service_port}/actuator/health/liveness 非200，开始分析： $(TZ='CST-8' date +%Y%m%d_%H%M%S.%N)" |tee  $REPORT_FILE
              take_thread_dump |tee -a $REPORT_FILE
          fi
          sleep 5
      done
    }

    take_thread_dump() {
        # 获取PID
        PID=$(jps -l | grep "$APP_NAME" | awk '{print $1}')

        if [ -z "$PID" ]; then
            echo "错误: 找不到 $APP_NAME 的进程"
            echo "当前Java进程:"
            jps -l
            exit 1
        fi

        echo "=== 应用信息 ==="
        echo "进程名称: $APP_NAME"
        echo "进程PID: $PID"
        echo "监听端口: $PORT"

        # 生成唯一时间戳（纳秒级）
        TIMESTAMP=$(TZ='CST-8' date +%Y%m%d_%H%M%S.%N)
        echo "=== 开始抓取现场数据: $TIMESTAMP ==="

        # 1. 抓取完整线程栈（最关键的）
        echo "1. 抓取jstack线程栈..."
        jstack -l $PID > $CAPTURE_DIR/${TIMESTAMP}_jstack_full.log 2>&1

        # 2. 重点抓取XNIO/Undertow线程（根据你的线程名）
        echo "2. 抓取XNIO相关线程..."
        jstack -l $PID | grep -B 5 -A 25 "XNIO" > $CAPTURE_DIR/${TIMESTAMP}_jstack_xnio.log 2>&1

        # 3. 抓取GC信息
        echo "3. 抓取GC信息..."
        jstat -gcutil $PID 1000 3 > $CAPTURE_DIR/${TIMESTAMP}_jstat_gc.log 2>&1

        # 4. 抓取堆内存信息
        echo "4. 抓取堆内存信息..."
        jmap -heap $PID > $CAPTURE_DIR/${TIMESTAMP}_jmap_heap.log 2>&1

        # 5. 网络连接信息
        echo "5. 抓取网络连接..."
        netstat -ant | grep ":$PORT" > $CAPTURE_DIR/${TIMESTAMP}_netstat.log 2>&1
        netstat -ant | grep ESTABLISHED | wc -l > $CAPTURE_DIR/${TIMESTAMP}_established_count.log 2>&1

        # 6. 系统负载
        echo "6. 抓取系统信息..."
        uptime > $CAPTURE_DIR/${TIMESTAMP}_system.log 2>&1
        free -m >> $CAPTURE_DIR/${TIMESTAMP}_system.log 2>&1

        # 7. 尝试通过Arthas抓取（如果已连接）
        echo "7. 尝试通过Arthas抓取..."
        if command -v arthas &> /dev/null; then
            # 这里需要根据你的Arthas连接方式来调整
            echo "注意: Arthas命令需要根据实际情况调整" > $CAPTURE_DIR/${TIMESTAMP}_arthas_note.txt
        else
            echo "Arthas未安装或不在PATH中" > $CAPTURE_DIR/${TIMESTAMP}_arthas_note.txt
        fi

        # 8. 生成摘要报告
        echo "8. 生成摘要报告..."
        {
            echo "=== 现场抓取摘要 ==="
            echo "时间: $(TZ='CST-8' date)"
            echo "PID: $PID"
            echo "应用: $APP_NAME"
            echo ""
            echo "=== 线程状态统计 ==="
            grep "java.lang.Thread.State:" $CAPTURE_DIR/${TIMESTAMP}_jstack_full.log | sort | uniq -c
            echo ""
            echo "=== 活跃连接数 ==="
            cat $CAPTURE_DIR/${TIMESTAMP}_established_count.log
            echo ""
            echo "=== 抓取的文件 ==="
            ls -la $CAPTURE_DIR/${TIMESTAMP}_*
        } > $CAPTURE_DIR/${TIMESTAMP}_summary.txt

        echo ""
        echo "=== 抓取完成 ==="
        echo "数据已保存到 $CAPTURE_DIR/"
        echo ""
        echo "=== 关键信息摘要 ==="
        tail -20 $CAPTURE_DIR/${TIMESTAMP}_summary.txt

        # 提供分析建议
        echo ""
        echo "=== 分析建议 ==="
        echo "1. 查看慢线程: grep -A 30 'XNIO-2 task' $CAPTURE_DIR/${TIMESTAMP}_jstack_full.log"
        echo "2. 查看线程状态: grep 'java.lang.Thread.State:' $CAPTURE_DIR/${TIMESTAMP}_jstack_full.log | sort | uniq -c"
        echo "3. 查看GC情况: cat $CAPTURE_DIR/${TIMESTAMP}_jstat_gc.log"
        echo "4. 查看连接数: cat $CAPTURE_DIR/${TIMESTAMP}_established_count.log"
    }

    wtime=$2
    [ -z $wtime ] && wtime=300 || :
    echo "启动监听，预处理等待 $wtime s"
    sleep $wtime
    monitor_health

kind: ConfigMap
metadata:
  name: app-config
  namespace: default

apiVersion: v1
kind: Pod
metadata:
  name: app1
  namespace: default
spec:
  containers:
  - name: app1
    image: nginx
    command: ["/bin/sh"]
    args: ["-c", "while true; do echo $(date -u) >> /data/out1.txt; sleep 5; done"]

    lifecycle:
      postStart:  #  只有 postStart 处理函数执行完毕，容器的状态才会变成 RUNNING。 不能是死循环脚本
        exec:
          command:
          - /bin/bash
          - -c 
          - '/opt/postStart.sh'
    volumeMounts:
    - mountPath: "/tmp/debug"
      name: "volume-0"
      readOnly: false
    - mountPath: /opt/postStart.sh
      name: app-config
      subPath: postStart.sh
  volumes:
  - name: "volume-0"
    nfs:
      path: "/mnt/nfs/debug"
      readOnly: false
      server: "10.2.0.1"
  - configMap:
      defaultMode: 420
      items:
      - key: postStart.sh
        path: postStart.sh
        mode: 0755 
      name: app-config
    name: app-config

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: x11
  name: x11
  namespace: default
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: x11
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: x11
    spec:
      containers:
        - command:
            - sh
            - '-c'
            - /opt/bin/postStart.sh x11 & /start.sh
          env:
            - name: LANG
              value: C.UTF-8
            - name: JAVA_HOME
              value: /usr/local/openjdk-8
            - name: JAVA_BASE_URL
              value: >-
                https://github.com/AdoptOpenJDK/openjdk8-upstream-binaries/releases/download/jdk8u222-b10/OpenJDK8U-jre_
            - name: TZ
              value: Asia/Shanghai
            - name: JAVA_OPTS
              value: '-Xmx1g -Xms1g'
            - name: aliyun_logs_x11-stdout
              value: stdout
          image: >-
            x.cr.xx.com/x/x11:273
          imagePullPolicy: Always
          lifecycle:
            preStop:
              exec:
                command:
                  - sh
                  - '-c'
                  - >-
                    curl -X POST http://127.0.0.1:1028/actuator/eureka-registry
                    &&  sleep 90
          livenessProbe:
            failureThreshold: 8
            httpGet:
              path: /actuator/health/liveness
              port: 1028
              scheme: HTTP
            initialDelaySeconds: 30
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 3
          name: x11
          readinessProbe:
            failureThreshold: 5
            httpGet:
              path: /actuator/health/readiness
              port: 1028
              scheme: HTTP
            initialDelaySeconds: 30
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 3
          resources:
            limits:
              cpu: '1'
              memory: 2Gi
            requests:
              cpu: 100m
              memory: 1Gi
          volumeMounts:
            - mountPath: /tmp/debug
              name: volume-0
            - mountPath: /opt/bin/
              name: app-config
      dnsPolicy: ClusterFirst
      imagePullSecrets:
        - name: x1-docker-hub
        - name: x2-docker-hub
      restartPolicy: Always
      terminationGracePeriodSeconds: 100
      volumes:
        - name: volume-0
          nfs:
            path: /mnt/nfs/debug
            server: 10.2.0.1
        - configMap:
            defaultMode: 420
            items:
              - key: postStart.sh
                mode: 493
                path: postStart.sh
            name: app-config
          name: app-config

#kubectl create secret docker-registry docker-pull --docker-username=k8s-pull --docker-password=QpJUfm9LBv --docker-server=https://pg-ops-harbor.xxx.com -n default
---
apiVersion: v1
data:
  .dockerconfigjson: eyIjoiY0NVRFSjIifX19
kind: Secret
metadata:
  name: docker-pull
  namespace: default
type: kubernetes.io/dockerconfigjson

openssl genrsa -out tls.key 2048
openssl req -new -x509 -days 365  -key tls.key -out tls.crt -subj /C=CN/ST=Beijing/L=Beijing/O=DevOps/CN=test.com

#kubectl -n default create secret tls nginx-test-tls --key=tls.key --cert=tls.crt
---
apiVersion: v1
data:
  tls.crt: ***
  tls.key: ***
kind: Secret
metadata:
  name: nginx-test-tls
  namespace: default
type: kubernetes.io/tls

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: "nginx"
  name: example
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - nginx.test.com  # SSL 证书对应的域名 (必填)。
    secretName: nginx-test-tls
  rules:
  - host: "nginx.test.com"
    http:
      paths:
      - backend:
          service:
            name: nginx
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific