apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: wordpress-disk
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi

# WordPressデプロイ先のネームスペースを作成。`wordpress` として作る。
$ kubectl create namespace wordpress
namespace "wordpress" created


# PVCを作成。`-n` で操作対象のネームスペースを指定する。
$ kubectl -n wordpress apply -f pvc.yml
persistentvolumeclaim "wordpress-disk" created


# 作成されたPVCを確認する
$ kubectl -n wordpress get pvc
NAME             STATUS    VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS   AGE
wordpress-disk   Bound     pvc-XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX   1Gi        RWO            standard       1X

# PVCにより作成された永続ボリュームの実態（PersistentVolume = PV）を確認する
$ kubectl -n wordpress get pv
NAME                                       CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS    CLAIM                      STORAGECLASS   REASON    AGE
pvc-XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX   1Gi        RWO            Delete           Bound     wordpress/wordpress-disk   standard                 1X

# RECLAIM POLICY を Delete から Retain に変更する
$ kubectl -n wordpress patch pv pvc-XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX -p '{"spec": {"persistentVolumeReclaimPolicy":"Retain"}}'
persistentvolume "pvc-XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX" patched

apiVersion: v1
kind: Pod
metadata:
  name: data-copy
spec:
  containers:
    - name: sleep-pod
      image: busybox
      command:
      - sleep
      - "3600"
      volumeMounts:
      - name: disk
        mountPath: "/tmp/wp-disk"
  volumes:
    - name: disk
      persistentVolumeClaim:
        claimName: wordpress-disk

# Podの作成
$ kubectl -n wordpress apply -f datacopy-pod.yml
pod "data-copy" created

$ kubectl -n wordpress get all
NAME            READY     STATUS    RESTARTS   AGE
pod/data-copy   1/1       Running   0          18s

# 持っていくコンテンツを public_html.tar.gz として、コンテナにコピー `cp` する
$ kubectl -n wordpress cp ./public_html.tar.gz data-copy:/tmp
# 転送完了後、レスポンスメッセージは特になし。

# データ移行用コンテナにINする
$ kubectl -n wordpress exec -it data-copy sh
/ #

# データがあることを確認しましょう。
$ cd /tmp/
$ ls -al

# ...その後、よしなにデータを配置します
# Ownerにも注意しましょう。Apacheの場合は www-data (id 33) です

# 前述の通り、`wp-config.php` は自動生成するので一旦削除（あるいはリネームで退避）しておきます！！

$ eixt

$ kubectl -n wordpress delete -f datacopy-pod.yml
pod "data-copy" deleted

$ kubectl -n wordpress get all
NAME            READY     STATUS        RESTARTS   AGE
pod/data-copy   1/1       Terminating   0          5m
                          # Terminatingの後しばらく放っておくと消えます

$ docker run -it \\
  -v /path/to/keyfile.json:/config \\
  -p 127.0.0.1:3306:3306 \\
  gcr.io/cloudsql-docker/gce-proxy:1.12 /cloud_sql_proxy \\
  -instances=<INSTANCE CONNECTION NAME>=tcp:0.0.0.0:3306 -credential_file=/config

 ...
 2019/01/03 06:35:59 Listening on 0.0.0.0:3306 for <INSTANCE CONNECTION NAME>
 2019/01/03 06:35:59 Ready for new connections

$ mysql -uroot -p$ROOT_PASS -h127.0.0.1 -P3306
mysql: [Warning] Using a password on the command line interface can be insecure.

Welcome to the MySQL monitor.  Commands end with ; or \\g.
Your MySQL connection id is XXXXXX
Server version: 5.7.14-google-log (Google)

Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.

mysql>

mysql> create database wordpress;
Query OK, 1 row affected (0.12 sec)

mysql> select User,Host from user;
+-----------+-----------+
| User      | Host      |
+-----------+-----------+
| root      | %         |
| mysql.sys | localhost |
+-----------+-----------+
2 rows in set (0.10 sec)


mysql> CREATE USER 'wordpress'@'%' IDENTIFIED BY 'XXXXXXXX';
Query OK, 0 rows affected (0.10 sec)

mysql> GRANT ALL PRIVILEGES ON wordpress.* TO 'wordpress'@'%' WITH GRANT OPTION;
Query OK, 0 rows affected (0.10 sec)

mysql> SHOW GRANTS FOR 'wordpress'@'%';
+----------------------------------------------------------------------------+
| Grants for wordpress@%                                                     |
+----------------------------------------------------------------------------+
| GRANT USAGE ON *.* TO 'wordpress'@'%'                                      |
| GRANT ALL PRIVILEGES ON `wordpress`.* TO 'wordpress'@'%' WITH GRANT OPTION |
+----------------------------------------------------------------------------+
2 rows in set (0.10 sec)


mysql> select User,Host from user;
+-----------+-----------+
| User      | Host      |
+-----------+-----------+
| root      | %         |
| wordpress | %         |
| mysql.sys | localhost |
+-----------+-----------+
3 rows in set (0.10 sec)

gzcat wordpress.dump.gz | mysql -uwordpress -p$WORDPRESS_PASS -h127.0.0.1 -P3306 wordpress

mysql> show tables;
+------------------------+
| Tables_in_wordpress    |
+------------------------+
| wp_ak_404_log          |
| wp_commentmeta         |
| wp_comments            |
 ...

# `jq` はJSONフォーマットを操作する定番コマンドです。入ってない場合は `brew install jq` にて入れておきましょう。
$ curl -s <https://registry.hub.docker.com/v1/repositories/wordpress/tags> | jq -r '.[].name' | grep 4.9.8

4.9.8
4.9.8-apache
4.9.8-fpm
4.9.8-fpm-alpine
4.9.8-php5.6
4.9.8-php5.6-apache
4.9.8-php5.6-fpm
4.9.8-php5.6-fpm-alpine
4.9.8-php7.0
4.9.8-php7.0-apache
4.9.8-php7.0-fpm
4.9.8-php7.0-fpm-alpine
4.9.8-php7.1
4.9.8-php7.1-apache
4.9.8-php7.1-fpm
4.9.8-php7.1-fpm-alpine
4.9.8-php7.2
4.9.8-php7.2-apache
4.9.8-php7.2-fpm
4.9.8-php7.2-fpm-alpine

apiVersion: v1
kind: Service
metadata:
  name: wordpress
  labels:
    name: wordpress
spec:
  type: NodePort
  selector:
    app: wordpress
  ports:
  - name: http
    port: 80
    targetPort: 80
    # GKEクラスタ外からWordPressへ接続するためのポート番号 (範囲: 30000-32767 から指定)
    nodePort: 30000

apiVersion: apps/v1
kind: Deployment
metadata:
  name: wordpress
  labels:
    app: wordpress
spec:
  replicas: 1
  selector:
    matchLabels:
      app: wordpress
  strategy:
    # kubectl apply 時の挙動。詳細後述 *1
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 0%
      maxUnavailable: 100%
  template:
    metadata:
      labels:
        app: wordpress
    spec:
      containers:
      # CONTAINER 1: WordPressコンテナ
      - name: wordpress
        image: wordpress:4.9.8-php7.1-apache
        # このコンテナではどの程度の最低リソースを要求するかを記載 *2
        resources:
          requests:
            cpu: 50m
            memory: 200Mi
        env:
        # Cloud SQL に接続するための情報。同一Podなので 127.0.0.1 でアクセスできる
        - name: WORDPRESS_DB_HOST
          value: "127.0.0.1"
        - name: WORDPRESS_DB_NAME
          value: "wordpress"
        # パスワードのような秘匿情報は Secret リソースから取得する（コンフィグに値を直接書かない）
        - name: WORDPRESS_DB_USER
          valueFrom:
            secretKeyRef:
              name: cloudsql-db-credentials
              key: username
        - name: WORDPRESS_DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: cloudsql-db-credentials
              key: password
        - name: WORDPRESS_DB_CHARSET
          value: "utf8"
        - name: WORDPRESS_DB_COLLATE
          value: ""
        - name: WORDPRESS_TABLE_PREFIX
          value: "wp_"
        # データ移行用コンテナで準備したボリュームを配置する場所
        volumeMounts:
        - name: disk
          mountPath: "/var/www/html"

      # CONTAINER 2: CLOUD SQLコンテナ
      - name: cloudsql-proxy
        image: gcr.io/cloudsql-docker/gce-proxy:1.11
        command: ["/cloud_sql_proxy",
                  "-instances=<INSTANCE CONNECTION NAME>=tcp:3306",
                  "-credential_file=/secrets/cloudsql/credentials.json"]
        securityContext:
          runAsUser: 2  # non-root user
          allowPrivilegeEscalation: false
        # IAMサービスアカウントのキーファイルをマウントしている。ファイル作成は後述
        volumeMounts:
        - name: cloudsql-instance-credentials
          mountPath: /secrets/cloudsql
          readOnly: true

      volumes:
      - name: disk
        persistentVolumeClaim:
          claimName: wordpress-disk
      - name: cloudsql-instance-credentials
        secret:
          secretName: cloudsql-instance-credentials

$ kubectl -n wordpress create secret generic cloudsql-instance-credentials \\
    --from-file=credentials.json=/path/to/keyfile.json

    # 先の手順で mysqldumpファイルをインポートした時にローカルで利用したものと同じキーファイルを指定する


$ kubectl -n wordpress create secret generic cloudsql-db-credentials \\
    --from-literal=username=<string username> --from-literal=password=<string password>

    # username / password それぞれの値を記載する。カッコ <> は不要です

$  kubectl -n wordpress get secret
NAME                            TYPE                                  DATA      AGE
cloudsql-db-credentials         Opaque                                2         1d
cloudsql-instance-credentials   Opaque                                1         1d

$ kubectl -n wordpress get all
NAME                             READY     STATUS    RESTARTS   AGE
pod/wordpress-XXXXXXXXXX-YYYYY   2/2       Running   0          13h

NAME                TYPE       CLUSTER-IP    EXTERNAL-IP   PORT(S)        AGE
service/wordpress   NodePort   10.X.Y.Z      <none>        80:30000/TCP   1d

NAME                        DESIRED   CURRENT   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/wordpress   1         1         1            1           1d

$ kubectl describe node | grep IP
  InternalIP:  10.0.0.4
  ExternalIP:  XX.XXX.XXX.C
  InternalIP:  10.0.0.3
  ExternalIP:  XX.XXX.XXX.B
  InternalIP:  10.0.0.2
  ExternalIP:  XX.XXX.XXX.A
  # 動かしているKubernetesノードの数により返却数は異なる

$ curl -I 10.0.0.4:30180
HTTP/1.1 301 Moved Permanently
Server: Apache/2.X.XX (Debian)
X-Powered-By: PHP/7.X.XX
Location: <http://10.0.0.4/>
Content-Type: text/html; charset=UTF-8

upstream k8snodes {
    least_conn;
    server 10.0.0.2:30000;
    server 10.0.0.3:30000;
    server 10.0.0.4:30000;
}

server {
    server_name your.domai.n;

    listen 443 ssl http2;

    ...中略...

    location / {
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_pass <http://k8snodes>;
    }
}

Events:
...
Warning  FailedAttachVolume      1m    attachdetach-controller                       Multi-Attach error for volume "pvc-XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX" Volume is already used by pod(s) wordpress-XXXXXXXXX-XXXXX
Normal   SuccessfulAttachVolume  47s   attachdetach-controller                       AttachVolume.Attach succeeded for volume "pvc-XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"

Warning  FailedAttachVolume      11m   attachdetach-controller                       Multi-Attach error for volume "pvc-XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX" Volume is already used by pod(s) wordpress-XXXXXXXXX-XXXXX

The Deployment "wordpress" is invalid: spec.strategy.rollingUpdate: Forbidden: may not be specified when strategy `type` is 'Recreate'

  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 0%
      maxUnavailable: 100%

  resources:
    requests:
      cpu: 50m
      memory: 200Mi

$  kubectl describe node

Non-terminated Pods:         (6 in total)
  Namespace                  Name                                              CPU Requests  CPU Limits  Memory Requests  Memory Limits
  ---------                  ----                                              ------------  ----------  ---------------  -------------
  kube-system                fluentd-gcp-v3.1.0-7b4jr                          100m (10%)    1 (106%)    200Mi (17%)      500Mi (43%)
  kube-system                heapster-v1.6.0-beta.1-155fb8fd97-pafmt           138m (14%)    138m (14%)  301856Ki (25%)   301856Ki (25%)
  kube-system                kube-dns-148976df6c-ra98z                         260m (27%)    0 (0%)      110Mi (9%)       170Mi (14%)
  kube-system                kube-proxy-gke-default-pool-b76614f2-8agq         100m (10%)    0 (0%)      0 (0%)           0 (0%)
  wordpress                  wordpress-XXXXXXXXX-XXXXX                         0 (0%)        0 (0%)      0 (0%)           0 (0%)

Concurrency Level:      4
Complete requests:      100
Failed requests:        0
Write errors:           0
Requests per second:    5.59 [#/sec] (mean)
Transfer rate:          328.74 [Kbytes/sec] received

Connection Times (ms)
              min  mean[+/-sd] median   max
Connect:      287  291   4.6    290     321
Processing:   355  397  58.2    373     646
Waiting:      261  299  54.6    277     552
Total:        644  688  60.3    663     936

Concurrency Level:      4
Complete requests:      100
Failed requests:        0
Write errors:           0
Requests per second:    3.76 [#/sec] (mean)
Transfer rate:          220.89 [Kbytes/sec] received

Connection Times (ms)
              min  mean[+/-sd] median   max
Connect:      287  292   5.5    290     320
Processing:   364  714 925.1    551    7613
Waiting:      269  478 613.2    399    5724
Total:        653 1006 927.0    843    7920