Table of Contents

说明
#

目前 K8S 已相当成熟，完全具备生产环境的落地应用。在各应用复杂的运行场景下，有时也会将 MySQL 这类有状态应用也部署至 K8S 中，但是部署后，如何保证其数据的安全性，却成了运维人员一个棘手的问题，本文将论述，如何使用 CronJob 将 MySQL 实例数据备份至MinIO S3存储中，来保证其数据安全性。

备份
#

下述 YAML 中所使用的镜像，我已整理至下述仓库中。
https://github.com/cdryzun/kube-mysqldump-tominio-cron

CronJob 部署清单
#

更改下述 Secret 环境变量为你实际环境中所对应的。
MINIO_SERVER: Minio 实例地址
MINIO_ACCESS_KEY: MinIO 用户
MINIO_SECRET_KEY: MinIO 密码
MINIO_BUCKET: 存储桶 / 存放路径
MINIO_BUCKET
更改下述 ConfigMap 环境变量为你实际环境中所对应的
dbhost: mysql service 地址
all_databases: 是否备份所有数据库

apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: mysqldump
spec:
  schedule: 0 4 * * *
  failedJobsHistoryLimit: 1
  successfulJobsHistoryLimit: 3
  suspend: false
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: mysqldump
            image: cdryzun/kube-mysqldump-tominio-cron:v0.1.0
            env:
            # Injecting NAME_SPACE using Downward API
              - name: MYSQL_ENV_NAME_SPACE
                valueFrom:
                  fieldRef:
                    fieldPath: metadata.namespace
              - name: ALL_DATABASES
                valueFrom:
                  configMapKeyRef:
                    name: mysqldump
                    key: all_databases
              - name: DB_HOST
                valueFrom:
                  configMapKeyRef:
                    name: mysqldump
                    key: dbhost
              - name: DB_USER
                value: root
              - name: DB_PASS
                valueFrom:
                  secretKeyRef:
                    name: mysql-server
                    key: mysql-root-password
              - name: MINIO_SERVER
                valueFrom:
                  secretKeyRef:
                    name: miniocreds
                    key: MINIO_SERVER
              - name: MINIO_ACCESS_KEY
                valueFrom:
                  secretKeyRef:
                    name: miniocreds
                    key: MINIO_ACCESS_KEY
              - name: MINIO_SECRET_KEY
                valueFrom:
                  secretKeyRef:
                    name: miniocreds
                    key: MINIO_SECRET_KEY
              - name: MINIO_BUCKET
                valueFrom:
                  secretKeyRef:
                    name: miniocreds
                    key: MINIO_BUCKET
            imagePullPolicy: Always
            volumeMounts:
              - mountPath: /mysqldump
                name: mysqldump
          volumes:
            - name: mysqldump
              emptyDir: {}
          restartPolicy: OnFailure
---
apiVersion: v1
data:
  dbhost: "mysql-server"
  all_databases: "true"
kind: ConfigMap
metadata:
  name: mysqldump
---
apiVersion: v1
kind: Secret
metadata:
  name: miniocreds
type: Opaque
stringData:
  MINIO_SERVER: http://oss.example.com:9000
  MINIO_ACCESS_KEY: root
  MINIO_SECRET_KEY: iexample
  MINIO_BUCKET: "mysql-backups/example-dev"