nginx 掛載gcs
睡睡念
今天要上QA測試了，然後我突然發現我之前測完沒留下筆記。
現在都快忘光了，還好最後有找回記憶。
來補一下了。
正文
今天要做的是把GCS變成一個圖片上傳空間，
可以用nginx來訪問。
會使用到gcsfuse這個指令，
所以我選擇直接建一個image，
然後掛載的時候直接用那個image就好。
gcs-download.json 是 要掛載GCS用的權限json檔
FROM nginx:latest
WORKDIR /app
COPY gcs-download.json .
#Start CloudStorage
RUN apt update && apt install -y gnupg lsb-release
RUN echo "deb https://packages.cloud.google.com/apt gcsfuse-$(lsb_release -c -s) main" | tee /etc/apt/sources.list.d/gcsfuse.list
RUN curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add -
RUN apt-get update && apt-get install -y gcsfuse
ENV GOOGLE_APPLICATION_CREDENTIALS=/app/gcs-download.json
WORKDIR /usr/share/nginx/html/files
然後部署的yaml，
這邊要注意的地方是
1.
nginx.conf 要加上 user root ，
這是因爲gcs掛載資料夾是用root的角色，所以如果nginx不用root啓動，
會出現403的權限問題。
ref. 四種解決Nginx出現403 forbidden 報錯的方法
2.
daemon off; 這部分指的是要讓nginx能夠在前景執行，不然pod會一直重開。
ref. nginx -g "daemon off;" 你學廢了嗎？
apiVersion: v1
kind: ConfigMap
metadata:
name: systemfile-nginx-config
namespace: default
data:
nginx.conf: |
user root;
worker_processes auto;
error_log /var/log/nginx/error.log notice;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
#gzip on;
include /etc/nginx/conf.d/*.conf;
}
---
apiVersion: v1
kind: ConfigMap
metadata:
name: sms-systemfile-config
namespace: default
data:
default.conf: |
server {
listen 80 default_server;
server_name _;
server_tokens off;
index index.html;
location /files {
alias /usr/share/nginx/html/files;
autoindex on;
}
location / {
root /usr/share/nginx/html;
index index.html;
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/share/nginx/html;
}
}
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: systemmanageservice-systemfile
namespace: default
labels:
group: systemmanageservice
app: systemfile
spec:
replicas: 1
revisionHistoryLimit: 5
progressDeadlineSeconds: 15
selector:
matchLabels:
group: systemmanageservice
app: systemfile
strategy:
rollingUpdate:
maxSurge: 25%
maxUnavailable: 25%
type: RollingUpdate
template:
metadata:
labels:
group: systemmanageservice
app: systemfile
spec:
containers:
- name: systemmanageservice-systemfile
image: gcs-nginx:0.0.2
command:
- /bin/bash
- '-c'
- >-
gcsfuse systemfile-qa /usr/share/nginx/html/files && nginx -g
"daemon off;";
imagePullPolicy: Always # IfNotPresent, Always, Never
securityContext:
privileged: true
ports:
- name: http
containerPort: 80
protocol: TCP
resources: {}
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
volumeMounts:
- name: config-volume
mountPath: /etc/nginx/conf.d/default.conf
subPath: default.conf
readOnly: true
- name: nginx-config-volume
mountPath: /etc/nginx/nginx.conf
subPath: nginx.conf
readOnly: true
volumes:
- name: config-volume
configMap:
name: sms-systemfile-config
items:
- key: default.conf
path: default.conf
defaultMode: 420
- name: nginx-config-volume
configMap:
name: systemfile-nginx-config
items:
- key: nginx.conf
path: nginx.conf
defaultMode: 420
dnsPolicy: ClusterFirst
restartPolicy: Always
terminationGracePeriodSeconds: 30
schedulerName: default-scheduler
securityContext: {}