k8s部署 nfs-client-provisioner

k8s部署nfs-client-provisioner是 Kubernetes 中实现 NFS 动态存储供应的核心方式

1.NFS 服务端已部署需提前准备一台 NFS 服务器（如 CentOS/Ubuntu），并创建共享目录.如果有单独的NFS存储，此步骤可忽略。

# 1. 安装 NFS 服务（以 CentOS 为例） yum install -y nfs-utils rpcbind # 2. 创建共享目录 mkdir -p /kubernetes-nfs # 3. 配置 NFS 共享（修改 /etc/exports） echo "/kubernetes-nfs *(rw,sync,no_root_squash,no_all_squash)" >> /etc/exports # 4. 生效配置并启动服务 exportfs -r systemctl start rpcbind && systemctl enable rpcbind systemctl start nfs-server && systemctl enable nfs-server # 5. 验证 NFS 共享 showmount -e 本机IP # 输出应包含 /kubernetes-nfs

2.K8s 集群节点能访问 NFS 服务端所有 K8s 节点安装 NFS 客户端（避免挂载失败）

# CentOS yum install -y nfs-utils # Ubuntu apt install -y nfs-common

3.部署步骤

3.1创建命名空间，本次使用的是kube-system命名空间，可忽略

kubectl create ns nfs-deploy

3.2创建 ServiceAccount 和 RBAC 权限

apiVersion: v1 kind: ServiceAccount metadata: name: nfs-client-provisioner-sa # replace with namespace where provisioner is deployed namespace: kube-system --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: nfs-client-provisioner-runner rules: - apiGroups: [""] resources: ["persistentvolumes"] verbs: ["get", "list", "watch", "create", "delete"] - apiGroups: [""] resources: ["persistentvolumeclaims"] verbs: ["get", "list", "watch", "update"] - apiGroups: ["storage.k8s.io"] resources: ["storageclasses"] verbs: ["get", "list", "watch"] - apiGroups: [""] resources: ["events"] verbs: ["create", "update", "patch"] --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: run-nfs-client-provisioner subjects: - kind: ServiceAccount name: nfs-client-provisioner-sa # replace with namespace where provisioner is deployed namespace: kube-system roleRef: kind: ClusterRole name: nfs-client-provisioner-runner apiGroup: rbac.authorization.k8s.io --- kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: leader-locking-nfs-client-provisioner # replace with namespace where provisioner is deployed namespace: kube-system rules: - apiGroups: [""] resources: ["endpoints"] verbs: ["get", "list", "watch", "create", "update", "patch"] --- kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: leader-locking-nfs-client-provisioner # replace with namespace where provisioner is deployed namespace: kube-system subjects: - kind: ServiceAccount name: nfs-client-provisioner-sa # replace with namespace where provisioner is deployed namespace: kube-system roleRef: kind: Role name: leader-locking-nfs-client-provisioner apiGroup: rbac.authorization.k8s.io ---

应用配置

kubectl apply -f nfs-client-provisioner-rbac.yaml

3.3部署 nfs-client-provisioner 应用

--- apiVersion: apps/v1 kind: Deployment metadata: name: nfs-client-provisioner labels: app: nfs-client-provisioner # replace with namespace where provisioner is deployed namespace: kube-system spec: replicas: 1 strategy: type: Recreate selector: matchLabels: app: nfs-client-provisioner template: metadata: labels: app: nfs-client-provisioner spec: serviceAccountName: nfs-client-provisioner-sa containers: - name: nfs-client-provisioner image: quay.io/external_storage/nfs-client-provisioner:latest volumeMounts: - name: nfs-client-root mountPath: /persistentvolumes env: - name: PROVISIONER_NAME value: choerodon.io/nfs-client-provisioner - name: NFS_SERVER value: 10.10.10.211 - name: NFS_PATH value: /kubernetes_data volumes: - name: nfs-client-root nfs: server: 10.10.10.211 path: /kubernetes_data ---

应用配置

kubectl apply -f nfs-client-provisioner-deploy.yaml

3.4创建 StorageClass（存储类）

--- apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: name: nfs-cloud provisioner: choerodon.io/nfs-client-provisioner # or choose another name, must match deployment's env PROVISIONER_NAME' parameters: archiveOnDelete: "false" reclaimPolicy: Delete # PV 回收策略（Delete/Retain） volumeBindingMode: Immediate # 立即绑定 PVC 和 PV

应用配置

kubectl apply -f nfs-client-storageclass.yaml # 可选：设置为默认存储类（PVC 不指定 storageClassName 时自动使用） kubectl patch storageclass nfs-cloud -p '{"metadata":{"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'

4.自动执行脚本

#!/bin/bash # 安装nfs-storageclass NS=kube-system NFS_SERVER_HOST=10.10.20.8 # 填写NFS服务器IP地址 NFS_SERVER_PATH=/kubernetes-nfs # 填写NFS路径 NFS_PROVISIONER_NAME=nfs-server # 服务供应商标识，随便起 NFS_STORAGE_CLASS_NAME=managed-nfs-storage # K8S中StorageClass的显示名称，随便起 cat << EOF > /tmp/k8s-init-nfs-storageclass.yaml apiVersion: v1 kind: ServiceAccount metadata: name: nfs-client-provisioner # replace with namespace where provisioner is deployed namespace: ${NS} --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: nfs-client-provisioner-runner rules: - apiGroups: [""] resources: ["persistentvolumes"] verbs: ["get", "list", "watch", "create", "delete"] - apiGroups: [""] resources: ["persistentvolumeclaims"] verbs: ["get", "list", "watch", "update"] - apiGroups: ["storage.k8s.io"] resources: ["storageclasses"] verbs: ["get", "list", "watch"] - apiGroups: [""] resources: ["events"] verbs: ["create", "update", "patch"] --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: run-nfs-client-provisioner subjects: - kind: ServiceAccount name: nfs-client-provisioner # replace with namespace where provisioner is deployed namespace: ${NS} roleRef: kind: ClusterRole name: nfs-client-provisioner-runner apiGroup: rbac.authorization.k8s.io --- kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: leader-locking-nfs-client-provisioner # replace with namespace where provisioner is deployed namespace: ${NS} rules: - apiGroups: [""] resources: ["endpoints"] verbs: ["get", "list", "watch", "create", "update", "patch"] --- kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: leader-locking-nfs-client-provisioner # replace with namespace where provisioner is deployed namespace: ${NS} subjects: - kind: ServiceAccount name: nfs-client-provisioner # replace with namespace where provisioner is deployed namespace: ${NS} roleRef: kind: Role name: leader-locking-nfs-client-provisioner apiGroup: rbac.authorization.k8s.io --- apiVersion: apps/v1 kind: Deployment metadata: name: nfs-client-provisioner labels: app: nfs-client-provisioner # replace with namespace where provisioner is deployed namespace: ${NS} spec: replicas: 1 strategy: type: Recreate selector: matchLabels: app: nfs-client-provisioner template: metadata: labels: app: nfs-client-provisioner spec: serviceAccountName: nfs-client-provisioner containers: - name: nfs-client-provisioner image: quay.io/external_storage/nfs-client-provisioner:latest volumeMounts: - name: nfs-client-root mountPath: /persistentvolumes env: - name: PROVISIONER_NAME value: ${NFS_PROVISIONER_NAME} - name: NFS_SERVER value: ${NFS_SERVER_HOST} - name: NFS_PATH value: ${NFS_SERVER_PATH} volumes: - name: nfs-client-root nfs: server: ${NFS_SERVER_HOST} path: ${NFS_SERVER_PATH} --- apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: name: ${NFS_STORAGE_CLASS_NAME} provisioner: ${NFS_PROVISIONER_NAME} # or choose another name, must match deployment's env PROVISIONER_NAME' parameters: archiveOnDelete: "false" EOF kubectl apply -f /tmp/k8s-init-nfs-storageclass.yaml