Kubernetes를 활용한 Native-Wordpress 구성

* KVM 환경입니다.

* kubernetes Version : 1.16v

 

 

1. Wordpress Architecture

2. 목표

* Ingress TLS termination 을 이용한 외부 연결

* Wordpress 에 Ceph를 이용하여 /var/www/html nfs로 마운트 하기

* DB서버 Headless 로 구성하여 ClusterIP 없이 구성 및 Ceph 를 이용하여 storage block 연결

* PodAffinity 와 AntiAffinity를 이용하요 Wordpress 와 DB서버 짝 만들어주기

* HPA 를 이용한 Auto-Scaling

 

3. YAML 소스

 

사용한 YAML 파일

1. wordpress.yml #워드프래스 Deployment로 구성

apiVersion: apps/v1
kind: Deployment
metadata:
  name: wordpress
  labels:
    app: wordpress
spec:
  replicas: 2
  selector:
    matchLabels:
      app: wordpress
      tier: cache
  template:
    metadata:
      labels:
        app: wordpress
        tier: cache
    spec: 
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: tier
                operator: In
                values:
                - cache
            topologyKey: "kubernetes.io/hostname"
      containers:
      - name: wordpress
        image: wordpress
        readinessProbe:
          exec:
            command:
            - ls
            - /var/www/html
        livenessProbe:
          exec:
            command:
            - ls
            - /var/www/html
        env:
        - name: WORDPRESS_DB_HOST
          value: mysql
     #   - name: WORDPRESS_DB_NAME
     #     value: wordpress
     #   - name: WORDPRESS_DB_USER
     #     value: wordpress_admin
     #   - name: WORDPRESS_DB_PASSWORD
     #     value: dkagh1.
        resources:
          requests:
            cpu: 500m
            memory: 500Mi
          limits:
            cpu: 1000m
            memory: 1000Mi
        ports:
        - containerPort: 80
        volumeMounts: 
        - name: wordpress-pvc
          mountPath: /var/www/html

      volumes:
      - name: wordpress-pvc
        persistentVolumeClaim:
          claimName: wordpress-pvc

 

2. wordpress-svc.yml  #워드프레스 서비스 설정

apiVersion: v1
kind: Service
metadata:
  name: wordpress-svc
spec:
  ports:
  - port: 80
    targetPort: 80
  selector:
    app: wordpress

3. wordpress-svc-ingress.yml #워드프레스 ingress TLS 구성

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: wordpress-svc-ingress
spec:
  tls:
  - hosts:
    - sw.homepage.com
    secretName: ingress-tls-secret
  rules:
  - host: sw.homepage.com
    http:
      paths:
      - path: /
        backend:
          serviceName: wordpress-svc
          servicePort: 80

4. wordpress.pvc.yml #워드프레스 ceph-block 구성

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: wordpress-pvc
spec:
  accessModes:
  - ReadWriteMany
  resources:
    requests:
      storage: 1Gi
  storageClassName: rook-cephfs

5. wordpress-hpa-cpu.yml # 워드프래스 hpa 구성

apiVersion: autoscaling/v1
kind: HorizontalPodAutoscaler
metadata:
  name: wordpress-hpa-spu
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: wordpress
  minReplicas: 2
  maxReplicas: 3
  targetCPUUtilizationPercentage: 70

 

6. mysql-sf.yml # 워드프레스 statefulSet으로 구성

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mysql
spec:
  selector:
    matchLabels:
      app: mysql
      tier: frontend
  serviceName: mysql
  replicas: 2
  template:
    metadata:
      labels:
        app: mysql
        tier: frontend
    spec:
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: tier
                operator: In
                values:
                - frontend
            topologyKey: "kubernetes.io/hostname"
        podAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: tier
                operator: In
                values:
                - cache
            topologyKey: "kubernetes.io/hostname"

      initContainers:
      - name: init-mysql
        image: mysql:5.7
        command:
        - bash
        - "-c"
        - |
          set -ex
          # Generate mysql server-id from pod ordinal index.
          [[ `hostname` =~ -([0-9]+)$ ]] || exit 1
          ordinal=${BASH_REMATCH[1]}
          echo [mysqld] > /mnt/conf.d/server-id.cnf
          # Add an offset to avoid reserved server-id=0 value.
          echo server-id=$((100 + $ordinal)) >> /mnt/conf.d/server-id.cnf
          # Copy appropriate conf.d files from config-map to emptyDir.
          if [[ $ordinal -eq 0 ]]; then
            cp /mnt/config-map/master.cnf /mnt/conf.d/
          else
            cp /mnt/config-map/slave.cnf /mnt/conf.d/
          fi
        volumeMounts:
        - name: conf
          mountPath: /mnt/conf.d
        - name: config-map
          mountPath: /mnt/config-map
      - name: clone-mysql
        image: gcr.io/google-samples/xtrabackup:1.0
        command:
        - bash
        - "-c"
        - |
          set -ex
          # Skip the clone if data already exists.
          [[ -d /var/lib/mysql/mysql ]] && exit 0
          # Skip the clone on master (ordinal index 0).
          [[ `hostname` =~ -([0-9]+)$ ]] || exit 1
          ordinal=${BASH_REMATCH[1]}
          [[ $ordinal -eq 0 ]] && exit 0
          # Clone data from previous peer.
          ncat --recv-only mysql-$(($ordinal-1)).mysql 3307 | xbstream -x -C /var/lib/mysql
          # Prepare the backup.
          xtrabackup --prepare --target-dir=/var/lib/mysql
        volumeMounts:
        - name: data
          mountPath: /var/lib/mysql
          subPath: mysql
        - name: conf
          mountPath: /etc/mysql/conf.d
      containers:
      - name: mysql
        image: mysql:5.7
        env:
        - name: MYSQL_ALLOW_EMPTY_PASSWORD
          value: "1"
        ports:
        - name: mysql
          containerPort: 3306
        volumeMounts:
        - name: data
          mountPath: /var/lib/mysql
          subPath: mysql
        - name: conf
          mountPath: /etc/mysql/conf.d
        resources:
          requests:
            cpu: 500m
            memory: 1Gi
        livenessProbe:
          exec:
            command: ["mysqladmin", "ping"]
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
        readinessProbe:
          exec:
            # Check we can execute queries over TCP (skip-networking is off).
            command:
              - ls
              - /var/lib/mysql
          initialDelaySeconds: 5
          periodSeconds: 2
          timeoutSeconds: 1
      - name: xtrabackup
        image: gcr.io/google-samples/xtrabackup:1.0
        ports:
        - name: xtrabackup
          containerPort: 3307
        command:
        - bash
        - "-c"
        - |
          set -ex
          cd /var/lib/mysql

          # Determine binlog position of cloned data, if any.
          if [[ -f xtrabackup_slave_info && "x$(<xtrabackup_slave_info)" != "x" ]]; then
            # XtraBackup already generated a partial "CHANGE MASTER TO" query
            # because we're cloning from an existing slave. (Need to remove the tailing semicolon!)
            cat xtrabackup_slave_info | sed -E 's/;$//g' > change_master_to.sql.in
            # Ignore xtrabackup_binlog_info in this case (it's useless).
            rm -f xtrabackup_slave_info xtrabackup_binlog_info
          elif [[ -f xtrabackup_binlog_info ]]; then
            # We're cloning directly from master. Parse binlog position.
            [[ `cat xtrabackup_binlog_info` =~ ^(.*?)[[:space:]]+(.*?)$ ]] || exit 1
            rm -f xtrabackup_binlog_info xtrabackup_slave_info
            echo "CHANGE MASTER TO MASTER_LOG_FILE='${BASH_REMATCH[1]}',\
                  MASTER_LOG_POS=${BASH_REMATCH[2]}" > change_master_to.sql.in
          fi

          # Check if we need to complete a clone by starting replication.
          if [[ -f change_master_to.sql.in ]]; then
            echo "Waiting for mysqld to be ready (accepting connections)"
            until mysql -h 127.0.0.1 -e "SELECT 1"; do sleep 1; done

            echo "Initializing replication from clone position"
            mysql -h 127.0.0.1 \
                  -e "$(<change_master_to.sql.in), \
                          MASTER_HOST='mysql-0.mysql', \
                          MASTER_USER='root', \
                          MASTER_PASSWORD='', \
                          MASTER_CONNECT_RETRY=10; \
                        START SLAVE;" || exit 1
            # In case of container restart, attempt this at-most-once.
            mv change_master_to.sql.in change_master_to.sql.orig
          fi

          # Start a server to send backups when requested by peers.
          exec ncat --listen --keep-open --send-only --max-conns=1 3307 -c \
            "xtrabackup --backup --slave-info --stream=xbstream --host=127.0.0.1 --user=root"
        volumeMounts:
        - name: data
          mountPath: /var/lib/mysql
          subPath: mysql
        - name: conf
          mountPath: /etc/mysql/conf.d
        resources:
          requests:
            cpu: 100m
            memory: 100Mi
      volumes:
      - name: conf
        emptyDir: {}
      - name: config-map
        configMap:
          name: mysql
  volumeClaimTemplates:
  - metadata:
      name: data
    spec:
      accessModes: ["ReadWriteOnce"]
      storageClassName: "rook-ceph-block"
      resources:
        requests:
          storage: 1Gi

7. mysql-svc.yml # mysql Headless 구성

apiVersion: v1
kind: Service
metadata:
  name: mysql
  labels:
    app: mysql
spec:
  clusterIP: None
  ports:
    - port: 3306
      targetPort: 3306
  selector:
    app: mysql

8. mysql-hpa-cpu.yml # mysql HPA 구성

apiVersion: autoscaling/v1
kind: HorizontalPodAutoscaler
metadata:
  name: mysql-hpa-spu
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: StatefulSet
    name: mysql
  minReplicas: 2
  maxReplicas: 3
  targetCPUUtilizationPercentage: 70

9. mysql-configMap.yml   # mysql configMap 구성

apiVersion: autoscaling/v1
kind: HorizontalPodAutoscaler
metadata:
  name: mysql-hpa-spu
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: StatefulSet
    name: mysql
  minReplicas: 2
  maxReplicas: 3
  targetCPUUtilizationPercentage: 70

 

10. wordpress ingress TLS 인증을 위한 Key 생성

$ mkdir ingress
$ cd ingress
$ openssl genrsa -out ./ingress-tls key 2048

$ openssl -req -new -x509 --key ./ingress-tls.key -out ./ingress-tls.crt -days 3650 -subj /CN=sw.homepage.com

$ kubectl create secret tls ingress-tls-secret --key=./ingress-tls.key --cert=ingress-tls.crt