kubernetes - 创建后为什么某些Kubernetes的资源不可变？

Question

浏览Kubernetes源代码https://github.com/kubernetes/kubernetes/blob/master/pkg/apis/core/validation/validation.go，至少持久性卷和存储类在创建后是不变的。

这是为什么 ？

Answer 1

这是Kubernetes的核心概念。一些规范是不可变的，因为它们的更改会影响所连接资源的基本结构。

例如，更改持久卷可能会影响使用此PV的 pods 。假设您有一个在PV上运行的mysql pod，并且以一种方式删除了所有数据。

在Kubernetes 1.18上，Secrets和ConfigMaps也作为Alpha功能变得不可变，这意味着它将很快成为新的默认设置。检查GitHub Issue here。

What is it good for?

The most popular and the most convenient way of consuming Secrets and ConfigMaps by Pods is consuming it as a file. However, any update to a Secret or ConfigMap object is quickly (roughly within a minute) reflected in updates of the file mounted for all Pods consuming them. That means that a bad update (push) of Secret and/or ConfigMap can very quickly break the entire application.

Here，您可以了解有关此决定背后动机的更多信息。

In this KEP, we are proposing to introduce an ability to specify that contents of a particular Secret/ConfigMap should be immutable for its whole lifetime. For those Secrets/ConfigMap, Kubelets will not be trying to watch/poll for changes to updated mounts for their Pods. Given there are a lot of users not really taking advantage of automatic updates of Secrets/ConfigMaps due to consequences described above, this will allow them to:

• protect themselves better for accidental bad updates that could cause outages of their applications
• achieve better performance of their cluster thanks to significant reduction of load on apiserver