yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nifi
  namespace: default
  labels:
    app: nifi
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nifi
  template:
    metadata:
      labels:
        app: nifi
    spec:
      # 调度到指定节点（对应你的 sl-18）
      nodeSelector:
        kubernetes.io/hostname: sl-18

      containers:
        - name: nifi
          image: registry.cn-hangzhou.aliyuncs.com/leiuvn/nifi:2.12
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8443
              name: https

          # 资源限制（NiFi 相对吃内存，建议给予适当的配额）
          resources:
            limits:
              cpu: "2000m"
              memory: "3Gi"
            requests:
              cpu: "500m"
              memory: "1Gi"

          # 环境变量映射（初始化单用户后台管理员账号密码）
          env:
            - name: NIFI_WEB_PROXY_HOST
              value: "20.wiki"
            - name: NIFI_WEB_HTTPS_HOST
              value: "0.0.0.0"
            - name: NIFI_WEB_HTTPS_PORT
              value: "8443"
            - name: SINGLE_USER_CREDENTIALS_USERNAME
              value: "admin"
            - name: SINGLE_USER_CREDENTIALS_PASSWORD
              value: "Shimujiuxia" # 请修改为你的强密码（至少12位，含大小写和数字）
            - name: KEYSTORE_PATH
              value: /opt/certs/keystore.p12
            - name: KEYSTORE_TYPE
              value: PKCS12
            - name: KEYSTORE_PASSWORD
              valueFrom:
                secretKeyRef: { name: nifi-tls, key: password }
            - name: TRUSTSTORE_PATH
              value: /opt/certs/truststore.p12
            - name: TRUSTSTORE_TYPE
              value: PKCS12
            - name: TRUSTSTORE_PASSWORD
              valueFrom:
                secretKeyRef: { name: nifi-tls, key: password }

          # 挂载宿主机目录（实现数据持久化与配置管理）
          volumeMounts:
            - name: nifi-conf
              mountPath: /opt/nifi/nifi-current/conf
            - name: nifi-db
              mountPath: /opt/nifi/nifi-current/database_repository
            - name: nifi-flowfile
              mountPath: /opt/nifi/nifi-current/flowfile_repository
            - name: nifi-content
              mountPath: /opt/nifi/nifi-current/content_repository
            - name: nifi-provenance
              mountPath: /opt/nifi/nifi-current/provenance_repository
            - name: nifi-logs
              mountPath: /opt/nifi/nifi-current/logs
            - name: tls
              mountPath: /opt/certs
              readOnly: true

      volumes:
        - name: nifi-conf
          hostPath:
            path: /lei/data/nifi/conf
            type: DirectoryOrCreate
        - name: nifi-db
          hostPath:
            path: /lei/data/nifi/database_repository
            type: DirectoryOrCreate
        - name: nifi-flowfile
          hostPath:
            path: /lei/data/nifi/flowfile_repository
            type: DirectoryOrCreate
        - name: nifi-content
          hostPath:
            path: /lei/data/nifi/content_repository
            type: DirectoryOrCreate
        - name: nifi-provenance
          hostPath:
            path: /lei/data/nifi/provenance_repository
            type: DirectoryOrCreate
        - name: nifi-logs
          hostPath:
            path: /lei/data/nifi/logs
            type: DirectoryOrCreate
        - name: tls
          secret:
            secretName: nifi-tls

---
apiVersion: v1
kind: Service
metadata:
  name: nifi-service
  namespace: default
spec:
  type: NodePort
  selector:
    app: nifi
  ports:
    - port: 8443        # 集群内部 Service 访问端口
      targetPort: 8443  # 容器内部端口（NiFi 默认 HTTPS 端口）
      nodePort: 30333   # NodePort 映射端口（可在外部通过 宿主机IP:30443 访问）

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nifi-ingress
  namespace: default
  annotations:
    kubernetes.io/ingress.class: traefik
    # 如果你的 Traefik 后端需要走 HTTPS，可能需要根据实际情况配置后端协议注解，默认通常自动识别
    # traefik.ingress.kubernetes.io/service.serversscheme: "https"
spec:
  ingressClassName: traefik
  rules:
    - host: 20.wiki   # 请修改为你实际的 NiFi 访问域名
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: nifi-service
                port:
                  number: 8443

配置证书

mkdir -p /lei/yaml/nifi/certs && cd /lei/yaml/nifi/certs
PASS='换成你自己的强密码'

# 自签证书，SAN 包含 20.wiki 和 localhost
openssl req -x509 -newkey rsa:4096 -nodes -days 825 \
  -keyout tls.key -out tls.crt \
  -subj "/CN=20.wiki" \
  -addext "subjectAltName=DNS:20.wiki,DNS:localhost"

# keystore（NiFi 的身份）
openssl pkcs12 -export -in tls.crt -inkey tls.key -name nifi \
  -out keystore.p12 -passout pass:$PASS

# truststore（信任这张证书）
keytool -importcert -alias nifi -file tls.crt -noprompt \
  -storetype PKCS12 -keystore truststore.p12 -storepass $PASS

# 生成 truststore.p12
openssl pkcs12 -export -nokeys -in tls.crt -name nifi \
  -out truststore.p12 -passout pass:$PASS

# 创建类似docker仓库密钥
kubectl create secret generic nifi-tls -n default \
  --from-file=keystore.p12 --from-file=truststore.p12 \
  --from-literal=password="$PASS"

替换nifi.properties 
sed -i \
 -e 's|^nifi.security.keystore=.*|nifi.security.keystore=/opt/certs/keystore.p12|' \
 -e 's|^nifi.security.keystorePasswd=.*|nifi.security.keystorePasswd=Shimujiuxia|' \
 -e 's|^nifi.security.truststore=.*|nifi.security.truststore=/opt/certs/truststore.p12|' \
 -e 's|^nifi.security.truststorePasswd=.*|nifi.security.truststorePasswd=Shimujiuxia|' \
 nifi.properties

修改nifi.properties
nifi.security.keyPasswd=Shimujiuxia

配置nifi

Database Connection URL
jdbc:mysql://172.22.0.20:30336/newdb_zh?useUnicode=true&characterEncoding=utf8&serverTimezone=GMT%2B8&useSSL=false

Database Driver Class Name
com.mysql.cj.jdbc.Driver（适用于 MySQL 8.x 及以上）
com.mysql.jdbc.Driver（适用于老版本 MySQL 5.x）

Database Driver Location
/opt/nifi/nifi-current/conf/mysql-connector-java-5.1.49.jar

« 上一篇： 53.bs文档

55.nas挂载 ：下一篇 »