downwardAPI存储卷
有时候，应用程序需要基于其所在的环境信息设定运行特性等，这类环境信息包括节点及集群的部分详细属性信息等，例如，Nginx 进程可根据节点的 CPU 核心数量自动设定要启动的 worker 进程数，JVM 虚拟机可根据节点内存资源自动设定其堆内存大小。类似地，托管运行于 Kubernetes 的 Pod 对象中的容器化应用偶尔也需要获取其所属 Pod 对象的 IP、主机名、标签、注解、UID、请求的 CPU 及内存资源量及其限额，甚至是 Pod 所在的节点名称等，容器可以通过环境变量或 downwardAPI 存储卷访问此类信息，不过，标签和注解仅支持通过存储卷暴露给容器。
一、环境变量式元数据注入
引用 downwardAPI 元数据信息的常用方式之一是使用容器的环境变量，它通过在 valueFrom 字段中嵌套 fieldRef 或 resourceFieldRef 字段引用相应的数据源。不过，通常只有常量类的属性才能够通过环境变量注入容器中，毕竟，在进程启动完成后将无法再向其告知变量值的变动，于是，环境变量也就不支持中途的更新操作。
可通过 fieldRef 字段引用的信息具体如下：
-
- spec.nodeName: 节点名称。
- status.hostIP: 节点 IP 地址。
- metadata.name: Pod 对象的名称。
- metadata.namespace: Pod 对象隶属的名称空间。
- status.podIP: Pod 对象的 IP 地址。
- spec.serviceAccountName: Pod 对象使用的 ServiceAccount 资源的名称。
- metadata.uid: Pod 对象的 UID。
- metadata.labels['KEY']: Pod 对象标签中的指定键的值，例如 metadata.labels['mylabel']，仅 Kubernetes 1.9及之后的版本才支持。
另外，可通过 resourceFieldRef 字段引用的信息是指当前容器的资源请求及资源限额的定义，因此它们包括 requests.cpu、limits.cpu、requests.memory 和 limits.memory 四项。
下面的资源配置清单示例（downwardAPI-env.yaml）中定义的 Pod 对象通过环境变量向容器 env-test-container 中注入了 Pod 对象的名称、隶属的名称空间、标签的 app 的值以及容器自身的 CPU 资源限额和内存资源请求等信息：
apiVersion: v1
kind: Pod
metadata:
name: env-test-pod
labels:
app: env-test-pod
spec:
containers:
- name: env-test-containers
image: busybox
command: ["/bin/sh", "-c", "env"]
resources:
requests:
memory: "32Mi"
cpu: "125m"
limits:
memory: "64Mi"
cpu: "250m"
env:
- name: MY_POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: MY_POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.labels['app']
- name: MY_CPU_LIMIT
valueFrom:
resourceFieldRef:
resource: limits.cpu
- name: MY_MEM_REQUEST
valueFrom:
resourceFieldRef:
resource: requests.memory
divisor: 1Mi
restartPolicy: Never
而后，可以通过控制台日志获取注入的环境变量：
kubectl logs env-test-pod | grep "^MY_"
二、存储卷式元数据注入
向容器注入元数据信息的另外一种方式是使用 downwardAPI 存储卷，它将配置的字段数据映射为文件并可通过容器中的挂载进行访问。
downwardAPI 字段定义如下：
[root@mh-k8s-master-247-10 ~]# kubectl explain pod.spec.volumes.downwardAPI
KIND: Pod
VERSION: v1
RESOURCE: downwardAPI <Object>
DESCRIPTION:
DownwardAPI represents downward API about the pod that should populate this
volume
DownwardAPIVolumeSource represents a volume containing downward API info.
Downward API volumes support ownership management and SELinux relabeling.
FIELDS:
defaultMode <integer>
Optional: mode bits to use on created files by default. Must be a value
between 0 and 0777. Defaults to 0644. Directories within the path are not
affected by this setting. This might be in conflict with other options that
affect the file mode, like fsGroup, and the result can be other mode bits
set.
items <[]Object>
Items is a list of downward API volume file
[root@mh-k8s-master-247-10 ~]#
在 downwardAPI 存储卷中使用 fieldRef 引用如下两个数据源：
-
- metadata.labels: Pod 对象的所有标签信息，每行一个，格式为 label-key="escaped-label-value"。
- metadata.annotations: Pod 对象的所有注解信息，每行一个，格式为 annotation-key="escaped-annotation-value"。
下面的资源撇脂清单示例（downwardAPI-vol.yaml）中定义的 Pod 对象通过 downwardAPI 存储卷向容器 volume-test-container 中注入了 Pod 对象隶属的名称空间、标签、注解以及容器自身的 CPU 资源限额和内存资源请求等信息。存储卷在容器中的挂载点 为 /etc/podinfo 目录，因此，注入的每一项信息均会映射为此路径下的一个文件：
apiVersion: v1
kind: Pod
metadata:
labels: east-china
rack: rack-101
app: dapi-vol-pod
name: dapi-vol-pod
annotations:
annotation1: "test-value-1"
spec:
containers:
- name: volume-test-container
image: busybox
command: ["/bin/sh", "-c", "sleep 864000"]
resources:
requests:
memory: "32Mi"
cpu: "125m"
limits:
memory: "64Mi"
cpu: "256m"
volueMounts:
- name: podinfo
mountPath: /etc/podinfo
readOnly: false
volumes:
- name: podinfo
downwardAPI:
defaultMode: 420
items:
- fieldRef:
fieldPath: metadata.namespace
path: pod_namespace
- fieldRef:
fieldPath: metadata.labels
path: pod_labels
- fieldRef:
fieldPath: metadata.annotations
path: pod_annotations
- resourceFieldRef:
containerName: volume-test-container
resource: requests.memory
divisor: "1Mi"
path: "mem_request"
pod.spec.volumes.downwardAPI.items 字段定义如下：
[root@mh-k8s-master-247-10 ~]# kubectl explain pod.spec.volumes.downwardAPI.items
KIND: Pod
VERSION: v1
RESOURCE: items <[]Object>
DESCRIPTION:
Items is a list of downward API volume file
DownwardAPIVolumeFile represents information to create the file containing
the pod field
FIELDS:
fieldRef <Object>
Required: Selects a field of the pod: only annotations, labels, name and
namespace are supported.
mode <integer>
Optional: mode bits to use on this file, must be a value between 0 and
0777. If not specified, the volume defaultMode will be used. This might be
in conflict with other options that affect the file mode, like fsGroup, and
the result can be other mode bits set.
path <string> -required-
Required: Path is the relative path name of the file to be created. Must
not be absolute or contain the '..' path. Must be utf-8 encoded. The first
item of the relative path must not start with '..'
resourceFieldRef <Object>
Selects a resource of the container: only resources limits and requests
(limits.cpu, limits.memory, requests.cpu and requests.memory) are currently
supported.
[root@mh-k8s-master-247-10 ~]#
pod.spec.volumes.downwardAPI.items.resourceFieldRef 字段定义如下：
[root@mh-k8s-master-247-10 ~]# ^C
[root@mh-k8s-master-247-10 ~]# kubectl explain pod.spec.volumes.downwardAPI.items.resourceFieldRef
KIND: Pod
VERSION: v1
RESOURCE: resourceFieldRef <Object>
DESCRIPTION:
Selects a resource of the container: only resources limits and requests
(limits.cpu, limits.memory, requests.cpu and requests.memory) are currently
supported.
ResourceFieldSelector represents container resources (cpu, memory) and
their output format
FIELDS:
containerName <string>
Container name: required for volumes, optional for env vars
divisor <string>
Specifies the output format of the exposed resources, defaults to "1"
resource <string> -required-
Required: resource to select
[root@mh-k8s-master-247-10 ~]#
通过查看 Pod 对象的标签列表：
kubectl exec dapi-vol-pod -- cat /etc/podinfo/pod_labels