Kubernetes存储体系与CSI驱动深度解析

# 管理员手动创建 PV
apiVersion: v1
kind: PersistentVolume
metadata:
  name: manual-pv
spec:
  capacity:
    storage: 100Gi
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  csi:
    driver: ebs.csi.aws.com
    volumeHandle: vol-0a1b2c3d4e5f6789a
    fsType: ext4

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: fast-ssd
provisioner: ebs.csi.aws.com           # CSI 驱动名称
volumeBindingMode: WaitForFirstConsumer  # 或 Immediate
allowVolumeExpansion: true             # 支持扩容
reclaimPolicy: Delete                  # 或 Retain
parameters:
  type: gp3                            # AWS EBS 类型
  encrypted: "true"
  kmsKeyId: alias/aws/ebs
mountOptions:
  - debug
allowedTopologies:                     # 拓扑约束
  - matchLabelExpressions:
      - key: topology.ebs.csi.aws.com/zone
        values:
          - cn-north-1a
          - cn-north-1b

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: postgres-data
  namespace: production
spec:
  accessModes:
    - ReadWriteOnce             # 单节点读写
  storageClassName: fast-ssd    # 引用 StorageClass
  volumeMode: Filesystem        # 或 Block（直接暴露块设备）
  resources:
    requests:
      storage: 100Gi

apiVersion: v1
kind: Pod
spec:
  containers:
    - name: app
      image: postgres:16
      volumeMounts:
        # 方式1：挂载整个 PVC
        - name: data
          mountPath: /var/lib/postgresql/data
        # 方式2：subPath — 只挂载卷中的子目录
        - name: data
          mountPath: /var/lib/postgresql/logs
          subPath: logs
        # 方式3：subPathExpr — 使用环境变量动态指定子路径
        - name: data
          mountPath: /var/lib/postgresql/backups
          subPathExpr: $(POD_NAME)/backups
  volumes:
    - name: data
      persistentVolumeClaim:
        claimName: postgres-data

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: postgres
spec:
  serviceName: postgres
  replicas: 3
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      containers:
        - name: postgres
          image: postgres:16
          volumeMounts:
            - name: data
              mountPath: /var/lib/postgresql/data
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes: ["ReadWriteOnce"]
        storageClassName: fast-ssd
        resources:
          requests:
            storage: 100Gi

# StatefulSet 已删除，但 PVC 仍存在
kubectl get pvc -l app=postgres
# 手动删除
kubectl delete pvc data-postgres-0 data-postgres-1 data-postgres-2

apiVersion: snapshot.storage.k8s.io/v1
kind: VolumeSnapshotClass
metadata:
  name: fast-snapshot
driver: ebs.csi.aws.com
deletionPolicy: Delete      # 或 Retain
parameters:
  tags: "env=production,app=postgres"

---
apiVersion: snapshot.storage.k8s.io/v1
kind: VolumeSnapshot
metadata:
  name: postgres-snapshot-20260101
  namespace: production
spec:
  volumeSnapshotClassName: fast-snapshot
  source:
    persistentVolumeClaimName: postgres-data  # 对 PVC 做快照

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: postgres-clone
  namespace: staging
spec:
  dataSource:
    name: postgres-data
    kind: PersistentVolumeClaim
  accessModes: ["ReadWriteOnce"]
  storageClassName: fast-ssd
  resources:
    requests:
      storage: 100Gi    # 必须 >= 源卷大小

# 1. 直接修改 PVC 大小
kubectl patch pvc postgres-data -p '{"spec":{"resources":{"requests":{"storage":"200Gi"}}}}'

# 2. 验证扩容状态
kubectl get pvc postgres-data
# STATUS: FileSystemResizeSuccessful

# 3. 检查 Pod 内的文件系统
kubectl exec -it postgres-0 -- df -h /var/lib/postgresql/data

# 启用存储加密
storageClass:
  parameters:
    encrypted: "true"
    kmsKeyId: arn:aws:kms:us-east-1:111122223333:key/12345678-1234-1234-1234-123456789012

# Pod 安全上下文
spec:
  securityContext:
    fsGroup: 2000          # 卷挂载后设置组所有权
    fsGroupChangePolicy: OnRootMismatch   # 仅在根目录不匹配时修改权限，加速启动

# 1. 定期快照（CronJob 自动化）
# 2. 快照上传到对象存储（Velero 工具）

# Velero 安装和使用
velero install \
  --provider aws \
  --bucket my-backup-bucket \
  --plugins velero/velero-plugin-for-aws:v1.8.0

# 备份整个 namespace
velero backup create postgres-backup --include-namespaces production

# 恢复
velero restore create --from-backup postgres-backup

# PVC 使用率监控（Prometheus）
- alert: PersistentVolumeUsageHigh
  expr: |
    kubelet_volume_stats_used_bytes / kubelet_volume_stats_capacity_bytes > 0.85
  for: 5m
  labels:
    severity: warning
  annotations:
    summary: "PVC 使用率超过 85%"