[英]How can I reference value from one Kubernetes resource when defining another resource
我正在使用 GKE 和 Helm v3,我正在嘗試使用 ComputeAddress 創建/保留 static IP 地址,然后使用先前保留的 IP 地址創建 DNS A 記錄。
預留IP地址
apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeAddress
metadata:
name: ip-address
annotations:
cnrm.cloud.google.com/project-id: project-id
spec:
location: global
獲取保留的IP地址
kubectl get computeaddress ip-address -o jsonpath='{.spec.address}'
創建 DNS A 記錄
apiVersion: dns.cnrm.cloud.google.com/v1beta1
kind: DNSRecordSet
metadata:
name: dns-record-a
annotations:
cnrm.cloud.google.com/project-id: project-id
spec:
name: "{{ .Release.Name }}.example.com"
type: "A"
ttl: 300
managedZoneRef:
external: example-com
rrdatas:
- **IP-ADDRESS-VALUE** <----
有沒有辦法在 DNSRecordSet 資源中引用由 ComputeAddress 創建的 IP 地址值?
基本上,我需要類似於 Terraform 中的 output 值的東西。
謝謝!
目前,不可能在字段“rrdatas”上分配不同的值作為字符串(IP 地址)。 因此,您無法“調用”另一個資源,例如之前創建的 IP 地址。 您需要將值放在格式 xxxx 上
有趣的是,GKE Ingress 也存在類似的東西,我們可以使用注釋引用保留的 IP 地址和托管的 SSL 證書:
annotations:
kubernetes.io/ingress.global-static-ip-name: my-static-address
我不知道為什么 DNSRecordSet 資源沒有這樣的東西。 希望 GKE 將來會引入它。
我沒有運行兩個命令,而是通過使用 Helm 的掛鈎找到了解決方法。
首先,我們需要將 Job 定義為安裝后和升級后掛鈎,它將在准備就緒時獲取保留的 IP 地址,然后使用它創建適當的 DNSRecordSet 資源。 檢索 IP 地址的腳本和 DNSRecordSet 的清單通過 ConfigMap 傳遞並掛載到 Pod。
apiVersion: batch/v1
kind: Job
metadata:
name: "{{ .Release.Name }}-dns-record-set-hook"
annotations:
# This is what defines this resource as a hook. Without this line, the
# job is considered part of the release.
"helm.sh/hook": post-install,post-upgrade
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
spec:
template:
metadata:
name: "{{ .Release.Name }}-dns-record-set-hook"
spec:
restartPolicy: OnFailure
containers:
- name: post-install-job
image: alpine:latest
command: ['sh', '-c', '/opt/run-kubectl-command-to-set-dns.sh']
volumeMounts:
- name: volume-dns-record-scripts
mountPath: /opt
- name: volume-writable
mountPath: /mnt
volumes:
- name: volume-dns-record-scripts
configMap:
name: dns-record-scripts
defaultMode: 0777
- name: volume-writable
emptyDir: {}
使用腳本和清單文件的 ConfigMap 定義:
apiVersion: v1
kind: ConfigMap
metadata:
creationTimestamp: null
name: dns-record-scripts
data:
run-kubectl-command-to-set-dns.sh: |-
# install kubectl command
apk add curl && \
curl -LO https://storage.googleapis.com/kubernetes-release/release/v1.15.1/bin/linux/amd64/kubectl && \
chmod u+x kubectl && \
mv kubectl /bin/kubectl
# wait for reserved IP address to be ready
kubectl wait --for=condition=Ready computeaddress/ip-address
# get reserved IP address
IP_ADDRESS=$(kubectl get computeaddress ip-address -o jsonpath='{.spec.address}')
echo "Reserved address: $IP_ADDRESS"
# update IP_ADDRESS in manifest
sed "s/##IP_ADDRESS##/$IP_ADDRESS/g" /opt/dns-record.yml > /mnt/dns-record.yml
# create DNS record
kubectl apply -f /mnt/dns-record.yml
dns-record.yml: |-
apiVersion: dns.cnrm.cloud.google.com/v1beta1
kind: DNSRecordSet
metadata:
name: dns-record-a
annotations:
cnrm.cloud.google.com/project-id: project-id
spec:
name: "{{ .Release.Name }}.example.com"
type: A
ttl: 300
managedZoneRef:
external: example-com
rrdatas:
- "##IP_ADDRESS##"
最后,為了(默認)服務帳戶能夠檢索 IP 地址並創建/更新 DNSRecordSet,我們需要為其分配一些角色:
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: dnsrecord-setter
rules:
- apiGroups: ["compute.cnrm.cloud.google.com"]
resources: ["computeaddresses"]
verbs: ["get", "list"]
- apiGroups: ["dns.cnrm.cloud.google.com"]
resources: ["dnsrecordsets"]
verbs: ["get", "create", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: dnsrecord-setter
subjects:
- kind: ServiceAccount
name: default
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: dnsrecord-setter
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.