k8s动手任务1：K8s 环境变量

开始一个动手任务，只围绕 K8s 环境变量 这一个点来进行实操

1 任务目标

创建一个 Pod，里面跑 1 个 busybox 容器，一次性验证 4 种环境变量来源：

1. 直接写死
2. 把整个 ConfigMap 所有键值变成变量
3. 只拿 ConfigMap 里某一个键
4. 只拿 Secret 里某一个键（密码）

2 任务yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: demo-cfg
data:
  DB_HOST: "mysql.test.svc"
  DB_PORT: "3306"
---
apiVersion: v1
kind: Secret
metadata:
  name: demo-secret
type: Opaque
stringData:          # 免手动 base64
  DB_PASSWORD: "123456"
---
apiVersion: v1
kind: Pod
metadata:
  name: env-demo-pod
spec:
  dnsPolicy: Default               # 上一招继续保留
  initContainers:
  - name: fix-resolv
    image: registry.cn-hangzhou.aliyuncs.com/google_containers/busybox
    imagePullPolicy: Never
    command:
    - sh
    - -c
    - |
      # 先去掉只读 symlink，再建一个空文件
      ls -l /etc/resolv.conf
      rm /etc/resolv.conf 2>/dev/null || true
      touch /etc/resolv.conf
    volumeMounts:
    - name: etc
      mountPath: /etc
  containers:
  - name: test
    image: registry.cn-hangzhou.aliyuncs.com/google_containers/busybox
    imagePullPolicy: Never
    command: ["sh", "-c", "echo 'env demo start'; sleep 3600"]
    envFrom:
    - configMapRef:
        name: demo-cfg
    env:
    - name: USER
      value: "root"
    - name: DB_PASSWORD
      valueFrom:
        secretKeyRef:
          name: demo-secret
          key: DB_PASSWORD
    volumeMounts:
    - name: etc
      mountPath: /etc
  volumes:
  - name: etc
    emptyDir: {}

3 调试

#  Running  exec 进去自己玩
hw@host2:~/istack$ kubectl exec -it env-demo-pod -- sh
Defaulted container "test" out of: test, fix-resolv (init)
/ # 
/ # echo "1) 直接写死: USER=$USER"
1) 直接写死: USER=root
/ # echo "2) 整份 ConfigMap 注入: DB_HOST=$DB_HOST  DB_PORT=$DB_PORT"
2) 整份 ConfigMap 注入: DB_HOST=mysql.test.svc  DB_PORT=3306
/ # echo "3) 单键 ConfigMap: LOG_LEVEL=$LOG_LEVEL"
3) 单键 ConfigMap: LOG_LEVEL=
/ # echo "4) 单键 Secret: DB_PASSWORD=$DB_PASSWORD"
4) 单键 Secret: DB_PASSWORD=123456
/ # env | grep -E 'USER|DB_|LOG_LEVEL' | sort
DB_HOST=mysql.test.svc
DB_PASSWORD=123456
DB_PORT=3306
USER=root
/ # 

4 小结

场景	YAML 关键字
直接写死	value: "字符串"
整份 ConfigMap 全注入	envFrom.configMapRef
只拿 ConfigMap 某个键	valueFrom.configMapKeyRef
只拿 Secret 某个键	valueFrom.secretKeyRef

问题

问题1

hw@host2:~/istack$ kubectl logs env-demo-pod
Error from server (BadRequest): container "test" in pod "env-demo-pod" is waiting to start: trying and failing to pull image

应该使用本地的image: registry.cn-hangzhou.aliyuncs.com/google_containers/busybox， imagePullPolicy: Never imagePullPolicy只有三种取值

取值	何时拉取镜像	典型场景
Always	每次启动容器都强制远程拉取	标签为 latest 时的默认值；适合 CI/CD 持续覆盖同标签
IfNotPresent	节点不存在该镜像才拉取	带具体版本号（如 v1.27）时的默认值；节省带宽、提速
Never	只使用节点本地已存在镜像；不尝试任何网络拉取	离线、私有镜像 tar 导入、调试时

解决