如何在Kubernetes CronJob中通过环境变量获取运行中Services？

你的需求可以实现，但不能直接在环境变量的value字段中执行shell命令——Kubernetes的环境变量value只会原样解析字符串，不会触发命令执行。下面是两种可行的实现方式：

方式一：在容器启动命令中直接执行命令并赋值 #

把获取Services信息的逻辑放到容器的启动命令里，通过shell脚本的方式完成赋值和输出。但需要注意两个前提：

1. 容器镜像必须包含kubectl工具（比如bitnami/kubectl），或者你手动将kubectl二进制文件挂载到容器中。
2. 容器使用的ServiceAccount需要有读取集群所有Services的权限。

修改后的CronJob配置示例：

---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: hello-cron-job
  namespace: hello-world
spec:
  schedule: "0 * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: service-reader-sa  # 需提前创建具备权限的ServiceAccount
          containers:
          - name: hello
            image: bitnami/kubectl:latest
            imagePullPolicy: IfNotPresent
            command: ["/bin/sh", "-c"]
            args:
            - |
              services=$(kubectl get service -A)
              echo "$services"
            volumeMounts:
            - name: scripts
              mountPath: /tmp/python
          restartPolicy: OnFailure
          volumes:
          - name: scripts
            configMap:
              name: test-scripts

对应的ServiceAccount、ClusterRole和ClusterRoleBinding配置示例：

apiVersion: v1
kind: ServiceAccount
metadata:
  name: service-reader-sa
  namespace: hello-world
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: service-reader-cr
rules:
- apiGroups: [""]
  resources: ["services"]
  verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: service-reader-crb
subjects:
- kind: ServiceAccount
  name: service-reader-sa
  namespace: hello-world
roleRef:
  kind: ClusterRole
  name: service-reader-cr
  apiGroup: rbac.authorization.k8s.io

方式二：用Init容器提前获取Services信息 #

通过Init容器先执行kubectl get service -A，将结果写入共享的临时卷，主容器再从卷中读取内容。这种方式适合主容器不需要kubectl的场景：

修改后的CronJob配置示例：

---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: hello-cron-job
  namespace: hello-world
spec:
  schedule: "0 * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: service-reader-sa
          initContainers:
          - name: fetch-services
            image: bitnami/kubectl:latest
            command: ["/bin/sh", "-c"]
            args:
            - kubectl get service -A > /tmp/services-data/services.txt
            volumeMounts:
            - name: services-data
              mountPath: /tmp/services-data
          containers:
          - name: hello
            image: busybox
            imagePullPolicy: IfNotPresent
            command: ["cat", "/tmp/services-data/services.txt"]
            volumeMounts:
            - name: services-data
              mountPath: /tmp/services-data
            - name: scripts
              mountPath: /tmp/python
          restartPolicy: OnFailure
          volumes:
          - name: services-data
            emptyDir: {}
          - name: scripts
            configMap:
              name: test-scripts

同样需要提前创建上述的ServiceAccount、ClusterRole和ClusterRoleBinding来赋予权限。

内容的提问来源于stack exchange，提问作者andythsu