在更新K8秘密时更新K8存储类、持久卷和持久卷声明

Question

我有一个K8集群，它将smb安装的驱动器连接到/文件共享。我们最近已经将这个SGW迁移到了另一个AWS帐户，在这样做的同时，SGW的IP地址和密码也发生了变化。

我注意到我们现有的设置有一个K8存储类，它查找一个名为"smbcreds“的K8秘密。在这个K8秘密中，他们有“用户名”和“密码”。我假设它与我们使用的“csi驱动程序-smb”的Helm图表的安装指南一致。

我认为更改用于存储类的秘密将更新使用该存储类的下游所有内容，但显然没有。我显然有点谨慎，当涉及到潜在的吹走重要数据，我需要做什么来更新所有使用新的秘密和IP配置？

下面是我们在Terraform中设置的一个简单例子-

provider "kubernetes" {
  config_path    = "~/.kube/config"
  config_context = "minikube"
}

resource "helm_release" "container_storage_interface_for_aws" {
  count      = 1
  name       = "local-filesystem-csi"
  repository = "https://raw.githubusercontent.com/kubernetes-csi/csi-driver-smb/master/charts"
  chart      = "csi-driver-smb"
  namespace  = "default"
}

resource "kubernetes_storage_class" "aws_storage_gateway" {
  count = 1
  metadata {
    name = "smbmount"
  }
  storage_provisioner = "smb.csi.k8s.io"
  reclaim_policy      = "Retain"
  volume_binding_mode = "WaitForFirstConsumer"
  parameters = {
    source                                           = "//1.2.3.4/old-file-share"
    "csi.storage.k8s.io/node-stage-secret-name"      = "smbcreds"
    "csi.storage.k8s.io/node-stage-secret-namespace" = "default"
  }
  mount_options = ["vers=3.0", "dir_mode=0777", "file_mode=0777"]
}

resource "kubernetes_persistent_volume_claim" "aws_storage_gateway" {
  count = 1
  metadata {
    name = "smbmount-volume-claim"
  }
  spec {
    access_modes = ["ReadWriteMany"]
    resources {
      requests = {
        storage = "10Gi"
      }
    }
    storage_class_name = "smbmount"
  }
}


resource "kubernetes_deployment" "main" {
  metadata {
    name = "sample-pod"
  }
  spec {
    replicas = 1

    selector {
      match_labels = {
        app = "sample-pod"
      }
    }

    template {
      metadata {
        labels = {
          app = "sample-pod"
        }
      }

      spec {
        volume {
          name = "shared-fileshare"

          persistent_volume_claim {
            claim_name = "smbmount-volume-claim"
          }
        }

        container {
          name              = "ubuntu"
          image             = "ubuntu"
          command           = ["sleep", "3600"]
          image_pull_policy = "IfNotPresent"

          volume_mount {
            name       = "shared-fileshare"
            read_only  = false
            mount_path = "/data"
          }
        }
      }
    }
  }
}

我最初的更改是更改K8秘密"smbcreds“，并将source = "//1.2.3.4/old-file-share"更改为source = "//5.6.7.8/new-file-share"。

Answer 1

我确定的解决方案是创建第二个K8存储类和与新的连接的持久卷声明。然后，我将K8部署改为使用新的PVC。