江西中创建设有限公司网站,手工折纸,WordPress自定义密码的插件,wordpress 进后台由于Ceph Squid#xff08;v19.2.1#xff09;不原生支持直接导出 SMB 服务器#xff0c;需通过手动集成 Samba 或其他第三方工具实现 所以直接部署最简单的
安装软件包
apt install samba编辑配置文件 vim /etc/samba/smb.conf在最末尾添加以下
# cp /etc/samba/sm…由于Ceph Squidv19.2.1不原生支持直接导出 SMB 服务器需通过手动集成 Samba 或其他第三方工具实现 所以直接部署最简单的
安装软件包
apt install samba编辑配置文件 vim /etc/samba/smb.conf在最末尾添加以下
# cp /etc/samba/smb.conf /etc/samba/smb.conf.bak [Share]
comment Shared Folder
path /srv/samba/share
browsable yes
read only no # 允许写入
valid users smbjbl
create mask 0664 # 客户端文件权限上限
directory mask 0775 # 客户端目录权限上限
force create mode 0664 # 强制文件权限
force directory mode 0775 # 强制目录权限重启服务
#创建目录
mkdir -p /srv/samba/share
#创建用户和设置密码
useradd -M -s /usr/sbin/nologin smbjbl
smbpasswd -a smbjbl
#查看
pdbedit -L | grep smbjbl# 授权假设 smbuser 属于组 smbgroup
chown -R smbuser:smbgroup /srv/samba/share
chmod -R 0775 /srv/samba/share # 目录权限
find /srv/samba/share -type f -exec chmod 0664 {} \; # 文件权限
#重启服务
systemctl restart smbd普通客户端挂测试必须通过
#安装挂载工具
apt install cifs-utils -y# smbclient -L //172.16.8.56 -U smbjbl%123456 用户%密码Sharename Type Comment--------- ---- -------print$ Disk Printer DriversShare Disk Shared FolderIPC$ IPC IPC Service (Samba 4.17.12-Debian)smbjbl Disk Home Directories
SMB1 disabled -- no workgroup available
#挂载成功
mount -t cifs //172.16.8.56/Share /mnt/smb -o usernamesmbjbl,password123456
# df -h | tail -n 1//172.16.8.56/Share 46G 2.5G 43G 6% /mnt/smb
以下配置SMB-Csi
# 官网
https://github.com/kubernetes-csi/csi-driver-smb/tree/master/charts/v1.17.0helm repo add csi-driver-smb https://raw.githubusercontent.com/kubernetes-csi/csi-driver-smb/master/charts
helm pull csi-driver-smb csi-driver-smb/csi-driver-smb --version v1.17.0 --untar我的values.yaml文件已经替换好国内镜像了
# egrep -v ^[[:space:]]*#|^$ values.yaml
image:baseRepo: registry.cn-hangzhou.aliyuncs.com/google_containerssmb:repository: ccr.ccs.tencentyun.com/abcdh/abpaytag: smbpullPolicy: IfNotPresentcsiProvisioner:repository: /csi-provisionertag: v5.2.0pullPolicy: IfNotPresentcsiResizer:repository: /csi-resizertag: v1.13.1pullPolicy: IfNotPresentlivenessProbe:repository: /livenessprobetag: v2.15.0pullPolicy: IfNotPresentnodeDriverRegistrar:repository: /csi-node-driver-registrartag: v2.13.0pullPolicy: IfNotPresent#csiproxy: ----------注释windows#repository: ghcr.io/kubernetes-sigs/sig-windows/csi-proxy#tag: v1.1.2#pullPolicy: IfNotPresentserviceAccount:create: true # When true, service accounts will be created for you. Set to false if you want to use your own.controller: csi-smb-controller-sanode: csi-smb-node-sa
rbac:create: truename: smb
driver:name: smb.csi.k8s.io
feature:enableGetVolumeStats: trueenableInlineVolume: true
controller:name: csi-smb-controllerreplicas: 1dnsPolicy: ClusterFirstWithHostNet # available values: Default, ClusterFirstWithHostNet, ClusterFirstmetricsPort: 29644livenessProbe:healthPort: 29642runOnMaster: falserunOnControlPlane: falselogLevel: 5workingMountDir: /tmpresources:csiProvisioner:limits:memory: 400Mirequests:cpu: 10mmemory: 20MicsiResizer:limits:memory: 400Mirequests:cpu: 10mmemory: 20MilivenessProbe:limits:memory: 100Mirequests:cpu: 10mmemory: 20Mismb:limits:memory: 200Mirequests:cpu: 10mmemory: 20Miaffinity: {}nodeSelector: {}tolerations:- key: node-role.kubernetes.io/masteroperator: Existseffect: NoSchedule- key: node-role.kubernetes.io/controlplaneoperator: Existseffect: NoSchedule- key: node-role.kubernetes.io/control-planeoperator: Existseffect: NoSchedule- key: CriticalAddonsOnlyoperator: Existseffect: NoSchedule
node:maxUnavailable: 1logLevel: 5livenessProbe:healthPort: 29643affinity: {}nodeSelector: {}
linux:enabled: truedsName: csi-smb-node # daemonset namednsPolicy: ClusterFirstWithHostNet # available values: Default, ClusterFirstWithHostNet, ClusterFirstkubelet: /var/lib/kubeletkrb5CacheDirectory: # directory for kerberos credential cache, empty string means default(/var/lib/kubelet/kerberos/)krb5Prefix: # prefix for kerberos credential cache, empty string means default(krb5cc_)tolerations:- operator: Existsresources:livenessProbe:limits:memory: 100Mirequests:cpu: 10mmemory: 20MinodeDriverRegistrar:limits:memory: 100Mirequests:cpu: 10mmemory: 20Mismb:limits:memory: 200Mirequests:cpu: 10mmemory: 20Mi
windows:enabled: false -------------修改此处为falseuseHostProcessContainers: truedsName: csi-smb-node-win # daemonset namekubelet: C:\var\lib\kubeletremoveSMBMappingDuringUnmount: truetolerations:- key: node.kubernetes.io/osoperator: Existseffect: NoScheduleresources:livenessProbe:limits:memory: 150Mirequests:cpu: 10mmemory: 40MinodeDriverRegistrar:limits:memory: 150Mirequests:cpu: 10mmemory: 40Mismb:limits:memory: 600Mirequests:cpu: 10mmemory: 40Micsiproxy: -------------修改此处为falseenabled: false # required if windows.enabled is true and useHostProcessContainers is false, but may be installed manually alsodsName: csi-proxy-win # daemonset nametolerations: {}affinity: {}username: NT AUTHORITY\\SYSTEMnodeSelector:kubernetes.io/os: windows
customLabels: {}
podAnnotations: {}
podLabels: {}
priorityClassName: system-cluster-critical
securityContext: { seccompProfile: {type: RuntimeDefault} }配置Secret和StorageClass
apiVersion: v1
kind: Secret
metadata:name: smbcredsnamespace: default
type: Opaque
data:username: c21iamJsCg base64 - encoded - usernamepassword: MTIzNDU2Cg base64 - encoded - password
---apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:name: smb-sc
provisioner: smb.csi.k8s.io
parameters:source: //172.16.8.56/Share. -------服务器地址和共享名csi.storage.k8s.io/provisioner-secret-name: smbcredscsi.storage.k8s.io/provisioner-secret-namespace: defaultcsi.storage.k8s.io/node-stage-secret-name: smbcredscsi.storage.k8s.io/node-stage-secret-namespace: default
volumeBindingMode: Immediate
mountOptions:- dir_mode0777- file_mode0777- uid1001- gid1001- noserverino测试
apiVersion: v1
kind: PersistentVolumeClaim
metadata:name: smb-pvc
spec:accessModes:- ReadWriteManyresources:requests:storage: 1GistorageClassName: smb-sc
---
kind: Pod
apiVersion: v1
metadata:name: nginx-smbnamespace: default
spec:containers:- image: mcr.microsoft.com/oss/nginx/nginx:1.17.3-alpinename: nginx-smbcommand:- /bin/sh- -c- while true; do echo $(date) /mnt/smb/outfile; sleep 1; donevolumeMounts:- name: smb01mountPath: /mnt/smbreadOnly: falsevolumes:- name: smb01persistentVolumeClaim:claimName: smb-pvc总结: SMB 在 跨平台混合环境 中不可替代尤其适合需深度集成 Windows 生态的场景25。 建议根据集群操作系统分布、性能需求及运维复杂度综合选择。
SMB和NFS比较
优先选择 NFS 的场景
纯 Linux 环境需高性能共享存储如 AI 训练、日志聚合
多 Pod 共享读写如 CI/CD 流水线共享构建目录
简化运维社区支持成熟动态供给方案稳定。优先选择 SMB 的场景
混合操作系统集群含 Windows 节点的 K8S 环境25
企业级权限管理需与 Active Directory 集成或细粒度 ACL 控制5
遗留系统整合对接已有 Windows 文件服务器核心特性对比
特性NFSSMB协议兼容性原生支持类 Unix 系统Windows 兼容性较差需额外配置原生支持 Windows跨平台兼容性更优Linux/macOS 需 cifs-utils性能在 Linux 环境下性能更高内核级支持传输效率高处理小文件时性能略低适合通用文件共享场景权限管理依赖服务端本地文件系统权限需手动同步 UID/GID支持 ACL 细粒度权限控制与 Windows AD 集成更便捷动态供给支持成熟通过 nfs-client-provisioner 实现动态 PV 创建依赖第三方 CSI 驱动如 smb.csi.k8s.io配置复杂度较高安全性默认无加密需结合 Kerberos 或 VPN 增强支持 SMB 3.0 加密传输安全性更优
statefulset测试
---
apiVersion: apps/v1
kind: StatefulSet
metadata:name: statefulset-smbnamespace: defaultlabels:app: nginx
spec:serviceName: statefulset-smbreplicas: 1template:metadata:labels:app: nginxspec:nodeSelector:kubernetes.io/os: linuxcontainers:- name: statefulset-smbimage: mcr.microsoft.com/oss/nginx/nginx:1.19.5command:- /bin/bash- -c- set -euo pipefail; while true; do echo $(date) /mnt/smb/outfile; sleep 1; donevolumeMounts:- name: persistent-storagemountPath: /mnt/smbreadOnly: falseupdateStrategy:type: RollingUpdateselector:matchLabels:app: nginxvolumeClaimTemplates:- metadata:name: persistent-storagespec:storageClassName: smbaccessModes: [ReadWriteOnce]resources:requests:storage: 10Gi
