7 kubernets核心实战

7.1 资源创建方式

命令行
yaml

7.2 namespace

名称空间来隔离资源

命令行方式

kubectl create ns hello

kubectl delete ns hello

yaml方式

apiVersion: v1

kind: Namespace

metadata:

  name: hellp

使用 kubectl apply -f xx.yaml

7.3 pod

运行中的一组容器，pod是kubernetes中应用最小的单位

7.3.1 通过kubectl run 创建容器

kubectl run mynginx --image=nginx

7.3.2 通过yaml的方式创建容器

一个pod一个服务

apiVersion: v1

kind: Pod

metadata:

  labels:

    run: mynginx

  name: mynginx

  namespace: default

spec:

  containers:

  - image: nginx

    name: mynginx

一个pod多个服务

apiVersion: v1

kind: Pod

metadata:

  labels:

    run: apps

  name: apps

  namespace: default

spec:

  containers:

  - image: nginx

    name: nginx

  - image: tomcat:8.5.68

    name: tomcat

常用命令

# 查看default命名空间的pod

kubectl get pod

# 查看描述

kubectl describe pod 你的pod名字

# 删除

kubectl delete pod 你的pod名字

# 查看日志

kubectl logs 你的pod名字

# 每个pod k8s都会分配一个ip，查看分配的ip

# 集群中的任意一个机器以及任意的应用都能通过pod分配的ip来访问这个pod

kubectl get pod -owide

7.4 deployment

控制pod，使pod拥有多个副本、自愈、扩缩容等能力

# 使用两种方式创建pod，然后再删除pod，对比一下效果

kubectl run mynginx --image=nginx

kubectl create deployment mytomcat --image=tomcat:8.5.68

结论：使用run没有自愈能力，而使用create deployment 有自愈能力

8 多副本、扩缩容

8.1 多副本

命令行方式：

kubectl create deployment my-dep --image=nginx --replicas=3

yaml方式：

vi my-dep.yaml

kubectl apply -f my-dep.yaml

yaml内容：

apiVersion: apps/v1

kind: Deployment

metadata:

  labels:

    app: my-dep

  name: my-dep

spec:

  replicas: 3

  selector:

    matchLabels:

      app: my-dep

  template:

    metadata:

      labels:

        app: my-dep

    spec:

      containers:

      - image: nginx

        name: nginx

常用命令

# 查看default命名空间的pod

kubectl get pod

# 查看描述

kubectl describe pod 你的pod名字

# 删除

kubectl delete pod 你的pod名字

# 查看日志

kubectl logs 你的pod名字

# 每个pod k8s都会分配一个ip，查看分配的ip

# 集群中的任意一个机器以及任意的应用都能通过pod分配的ip来访问这个pod

kubectl get pod -owide

# deployment 方式删除

kubectl delete deploy 你的pod名称

8.2 扩缩容

扩容

# 方式一

kubectl scale --replicas=5 deployment/my-dep

# 方式二

kubectl edit deployment my-dep

# 修改 replicas

8.3 自愈&故障转移

自愈：当pod因为某种原因宕机时，k8s会自动重启pod

故障转移：当pod所在服务器宕机时，能在其他节点重新部署对应的pod，所在服务恢复时，所在服务的pod将被删除

8.4 滚动更新

查看当前pod内应用使用的版本

kubectl get deployment my-dep -oyaml

滚动更新

方式一：--record 记录更新版本信息

kubectl set image deployment/my-dep nginx=nginx:1.16.1 --record

方式二：

修改 image 对应的版本号

kubectl edit deployment/my-dep

流程：先创建一个新的pod，当新的running后，删除一个老的pod，依次执行这个流程，知道所有旧版本全部被替换

8.5 版本回退

查看历史版本

kubectl rollout history deployment/my-dep

查看某个历史版本详情

kubectl rollout history deployment/my-dep --revision=2

回滚到上个版本

kubectl rollout undo deployment/my-dep

回滚版本到指定版本

kubectl rollout undo deployment/my-dep --to-revision=1

8.6 更多知识

工作负载：

Deployment：无状态应用部署，类似一些微服务、提供多副本等功能

StatefulSet：有状态应用部署，类似Redis，mysql，提供稳定的存储、网络等功能

DaemonSet：守护进程集，守护型应用部署，比如日志收集组件，在每个机器都有一份

Job/CronJob：任务/定时任务，比如垃圾清理组件，可以指定时间运行

9 Service

9.1 将一组Pods公开为网络服务的抽象方法

9.1.1 不带type 模式type 是 ClusterIP

方式一：

# 暴露deploy --port pod对外暴露的端口，--target-port=80 pod内部的端口 my-dep:pod名 my-dep-service：service名字

kubectl expose deployment my-dep --name=my-dep-service --prot=8000 --target-port=80

方式二：

apiVersion: v1

kind: Service

metadata:

  labels:

    app: my-dep

  name: my-dep-service

spec:

  selector:

    app: my-dep

  ports:

  - port: 8000

    protocol: TCP

    targetPort: 80

使用标签检索pod

kubectl get pod -l app=my-dep

查看使用service 暴露的ip和端口

# 查看所有的service暴露的ip和端口

kubectl get service

# 查看指定的

kubectl get service 你的service名字

# 删除指定的service

kubectl delete service 你的service名字

9.1.2 带type

9.1.2.1 ClusterIP

方式一：

# 暴露deploy --port pod对外暴露的端口，--target-port=80 pod内部的端口 my-dep:pod名 my-dep-service：service名字

kubectl expose deployment my-dep --name=my-dep-service --prot=8000 --target-port=80 --type=ClusterIP

方式二：

apiVersion: v1

kind: Service

metadata:

  labels:

    app: my-dep

  name: my-dep-service

spec:

  selector:

    app: my-dep

  type: ClusterIP

  ports:

  - port: 8000

    protocol: TCP

    targetPort: 80

9.1.2.2 NodePort

方式一：

# 暴露deploy --port pod对外暴露的端口，--target-port=80 pod内部的端口 my-dep:pod名 my-dep-service：service名字

kubectl expose deployment my-dep --name=my-dep-service --prot=8000 --target-port=80 --type=NodePort

方式二：

apiVersion: v1

kind: Service

metadata:

  labels:

    app: my-dep

  name: my-dep-service

spec:

  selector:

    app: my-dep

  type: NodePort

  ports:

  - port: 8000

    protocol: TCP

    targetPort: 80

NodePort范围在 30000-32767 之间

9 Ingress

9.1.1 安装

wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v0.47.0/deploy/static/provider/baremetal/deploy.yaml

#修改镜像

vi deploy.yaml

#1、将image k8s.gcr.io/ingress-nginx/controller:v0.46.0@sha256:52f0058bed0a17ab0fb35628ba97e8d52b5d32299fbc03cc0f6c7b9ff036b61a的值改为如下值：

registry.cn-hangzhou.aliyuncs.com/lfy_k8s_images/ingress-nginx-controller:v0.46.0

#2、在修改了image的上一层增加 hostNetwork: true，如下图1

#3、找到secretName将ingress-nginx-admission改为ingress-nginx-admission-token

# 安装

kubectl apply -f deploy.yaml

# 检查安装的结果

kubectl get pod,svc -n ingress-nginx

图1：

如果下载不到这个文件或者不想修改，就用下面的文件(当前文件已经修改了image的值和其他内容)

apiVersion: v1

kind: Namespace

metadata:

  name: ingress-nginx

  labels:

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/instance: ingress-nginx

---

# Source: ingress-nginx/templates/controller-serviceaccount.yaml

apiVersion: v1

kind: ServiceAccount

metadata:

  labels:

    helm.sh/chart: ingress-nginx-3.33.0

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/instance: ingress-nginx

    app.kubernetes.io/version: 0.47.0

    app.kubernetes.io/managed-by: Helm

    app.kubernetes.io/component: controller

  name: ingress-nginx

  namespace: ingress-nginx

automountServiceAccountToken: true

---

# Source: ingress-nginx/templates/controller-configmap.yaml

apiVersion: v1

kind: ConfigMap

metadata:

  labels:

    helm.sh/chart: ingress-nginx-3.33.0

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/instance: ingress-nginx

    app.kubernetes.io/version: 0.47.0

    app.kubernetes.io/managed-by: Helm

    app.kubernetes.io/component: controller

  name: ingress-nginx-controller

  namespace: ingress-nginx

data:

---

# Source: ingress-nginx/templates/clusterrole.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRole

metadata:

  labels:

    helm.sh/chart: ingress-nginx-3.33.0

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/instance: ingress-nginx

    app.kubernetes.io/version: 0.47.0

    app.kubernetes.io/managed-by: Helm

  name: ingress-nginx

rules:

  - apiGroups:

      - ''

    resources:

      - configmaps

      - endpoints

      - nodes

      - pods

      - secrets

    verbs:

      - list

      - watch

  - apiGroups:

      - ''

    resources:

      - nodes

    verbs:

      - get

  - apiGroups:

      - ''

    resources:

      - services

    verbs:

      - get

      - list

      - watch

  - apiGroups:

      - extensions

      - networking.k8s.io   # k8s 1.14+

    resources:

      - ingresses

    verbs:

      - get

      - list

      - watch

  - apiGroups:

      - ''

    resources:

      - events

    verbs:

      - create

      - patch

  - apiGroups:

      - extensions

      - networking.k8s.io   # k8s 1.14+

    resources:

      - ingresses/status

    verbs:

      - update

  - apiGroups:

      - networking.k8s.io   # k8s 1.14+

    resources:

      - ingressclasses

    verbs:

      - get

      - list

      - watch

---

# Source: ingress-nginx/templates/clusterrolebinding.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRoleBinding

metadata:

  labels:

    helm.sh/chart: ingress-nginx-3.33.0

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/instance: ingress-nginx

    app.kubernetes.io/version: 0.47.0

    app.kubernetes.io/managed-by: Helm

  name: ingress-nginx

roleRef:

  apiGroup: rbac.authorization.k8s.io

  kind: ClusterRole

  name: ingress-nginx

subjects:

  - kind: ServiceAccount

    name: ingress-nginx

    namespace: ingress-nginx

---

# Source: ingress-nginx/templates/controller-role.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: Role

metadata:

  labels:

    helm.sh/chart: ingress-nginx-3.33.0

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/instance: ingress-nginx

    app.kubernetes.io/version: 0.47.0

    app.kubernetes.io/managed-by: Helm

    app.kubernetes.io/component: controller

  name: ingress-nginx

  namespace: ingress-nginx

rules:

  - apiGroups:

      - ''

    resources:

      - namespaces

    verbs:

      - get

  - apiGroups:

      - ''

    resources:

      - configmaps

      - pods

      - secrets

      - endpoints

    verbs:

      - get

      - list

      - watch

  - apiGroups:

      - ''

    resources:

      - services

    verbs:

      - get

      - list

      - watch

  - apiGroups:

      - extensions

      - networking.k8s.io   # k8s 1.14+

    resources:

      - ingresses

    verbs:

      - get

      - list

      - watch

  - apiGroups:

      - extensions

      - networking.k8s.io   # k8s 1.14+

    resources:

      - ingresses/status

    verbs:

      - update

  - apiGroups:

      - networking.k8s.io   # k8s 1.14+

    resources:

      - ingressclasses

    verbs:

      - get

      - list

      - watch

  - apiGroups:

      - ''

    resources:

      - configmaps

    resourceNames:

      - ingress-controller-leader-nginx

    verbs:

      - get

      - update

  - apiGroups:

      - ''

    resources:

      - configmaps

    verbs:

      - create

  - apiGroups:

      - ''

    resources:

      - events

    verbs:

      - create

      - patch

---

# Source: ingress-nginx/templates/controller-rolebinding.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: RoleBinding

metadata:

  labels:

    helm.sh/chart: ingress-nginx-3.33.0

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/instance: ingress-nginx

    app.kubernetes.io/version: 0.47.0

    app.kubernetes.io/managed-by: Helm

    app.kubernetes.io/component: controller

  name: ingress-nginx

  namespace: ingress-nginx

roleRef:

  apiGroup: rbac.authorization.k8s.io

  kind: Role

  name: ingress-nginx

subjects:

  - kind: ServiceAccount

    name: ingress-nginx

    namespace: ingress-nginx

---

# Source: ingress-nginx/templates/controller-service-webhook.yaml

apiVersion: v1

kind: Service

metadata:

  labels:

    helm.sh/chart: ingress-nginx-3.33.0

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/instance: ingress-nginx

    app.kubernetes.io/version: 0.47.0

    app.kubernetes.io/managed-by: Helm

    app.kubernetes.io/component: controller

  name: ingress-nginx-controller-admission

  namespace: ingress-nginx

spec:

  type: ClusterIP

  ports:

    - name: https-webhook

      port: 443

      targetPort: webhook

  selector:

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/instance: ingress-nginx

    app.kubernetes.io/component: controller

---

# Source: ingress-nginx/templates/controller-service.yaml

apiVersion: v1

kind: Service

metadata:

  annotations:

  labels:

    helm.sh/chart: ingress-nginx-3.33.0

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/instance: ingress-nginx

    app.kubernetes.io/version: 0.47.0

    app.kubernetes.io/managed-by: Helm

    app.kubernetes.io/component: controller

  name: ingress-nginx-controller

  namespace: ingress-nginx

spec:

  type: NodePort

  ports:

    - name: http

      port: 80

      protocol: TCP

      targetPort: http

    - name: https

      port: 443

      protocol: TCP

      targetPort: https

  selector:

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/instance: ingress-nginx

    app.kubernetes.io/component: controller

---

# Source: ingress-nginx/templates/controller-deployment.yaml

apiVersion: apps/v1

kind: Deployment

metadata:

  labels:

    helm.sh/chart: ingress-nginx-3.33.0

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/instance: ingress-nginx

    app.kubernetes.io/version: 0.47.0

    app.kubernetes.io/managed-by: Helm

    app.kubernetes.io/component: controller

  name: ingress-nginx-controller

  namespace: ingress-nginx

spec:

  selector:

    matchLabels:

      app.kubernetes.io/name: ingress-nginx

      app.kubernetes.io/instance: ingress-nginx

      app.kubernetes.io/component: controller

  revisionHistoryLimit: 10

  minReadySeconds: 0

  template:

    metadata:

      labels:

        app.kubernetes.io/name: ingress-nginx

        app.kubernetes.io/instance: ingress-nginx

        app.kubernetes.io/component: controller

    spec:

      hostNetwork: true

      dnsPolicy: ClusterFirst

      containers:

        - name: controller

          image: registry.cn-hangzhou.aliyuncs.com/lfy_k8s_images/ingress-nginx-controller:v0.46.0

          imagePullPolicy: IfNotPresent

          lifecycle:

            preStop:

              exec:

                command:

                  - /wait-shutdown

          args:

            - /nginx-ingress-controller

            - --election-id=ingress-controller-leader

            - --ingress-class=nginx

            - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller

            - --validating-webhook=:8443

            - --validating-webhook-certificate=/usr/local/certificates/cert

            - --validating-webhook-key=/usr/local/certificates/key

          securityContext:

            capabilities:

              drop:

                - ALL

              add:

                - NET_BIND_SERVICE

            runAsUser: 101

            allowPrivilegeEscalation: true

          env:

            - name: POD_NAME

              valueFrom:

                fieldRef:

                  fieldPath: metadata.name

            - name: POD_NAMESPACE

              valueFrom:

                fieldRef:

                  fieldPath: metadata.namespace

            - name: LD_PRELOAD

              value: /usr/local/lib/libmimalloc.so

          livenessProbe:

            failureThreshold: 5

            httpGet:

              path: /healthz

              port: 10254

              scheme: HTTP

            initialDelaySeconds: 10

            periodSeconds: 10

            successThreshold: 1

            timeoutSeconds: 1

          readinessProbe:

            failureThreshold: 3

            httpGet:

              path: /healthz

              port: 10254

              scheme: HTTP

            initialDelaySeconds: 10

            periodSeconds: 10

            successThreshold: 1

            timeoutSeconds: 1

          ports:

            - name: http

              containerPort: 80

              protocol: TCP

            - name: https

              containerPort: 443

              protocol: TCP

            - name: webhook

              containerPort: 8443

              protocol: TCP

          volumeMounts:

            - name: webhook-cert

              mountPath: /usr/local/certificates/

              readOnly: true

          resources:

            requests:

              cpu: 100m

              memory: 90Mi

      nodeSelector:

        kubernetes.io/os: linux

      serviceAccountName: ingress-nginx

      terminationGracePeriodSeconds: 300

      volumes:

        - name: webhook-cert

          secret:

            secretName: ingress-nginx-admission-token

---

# Source: ingress-nginx/templates/admission-webhooks/validating-webhook.yaml

# before changing this value, check the required kubernetes version

# https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#prerequisites

apiVersion: admissionregistration.k8s.io/v1

kind: ValidatingWebhookConfiguration

metadata:

  labels:

    helm.sh/chart: ingress-nginx-3.33.0

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/instance: ingress-nginx

    app.kubernetes.io/version: 0.47.0

    app.kubernetes.io/managed-by: Helm

    app.kubernetes.io/component: admission-webhook

  name: ingress-nginx-admission

webhooks:

  - name: validate.nginx.ingress.kubernetes.io

    matchPolicy: Equivalent

    rules:

      - apiGroups:

          - networking.k8s.io

        apiVersions:

          - v1beta1

        operations:

          - CREATE

          - UPDATE

        resources:

          - ingresses

    failurePolicy: Fail

    sideEffects: None

    admissionReviewVersions:

      - v1

      - v1beta1

    clientConfig:

      service:

        namespace: ingress-nginx

        name: ingress-nginx-controller-admission

        path: /networking/v1beta1/ingresses

---

# Source: ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml

apiVersion: v1

kind: ServiceAccount

metadata:

  name: ingress-nginx-admission

  annotations:

    helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade

    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded

  labels:

    helm.sh/chart: ingress-nginx-3.33.0

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/instance: ingress-nginx

    app.kubernetes.io/version: 0.47.0

    app.kubernetes.io/managed-by: Helm

    app.kubernetes.io/component: admission-webhook

  namespace: ingress-nginx

---

# Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRole

metadata:

  name: ingress-nginx-admission

  annotations:

    helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade

    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded

  labels:

    helm.sh/chart: ingress-nginx-3.33.0

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/instance: ingress-nginx

    app.kubernetes.io/version: 0.47.0

    app.kubernetes.io/managed-by: Helm

    app.kubernetes.io/component: admission-webhook

rules:

  - apiGroups:

      - admissionregistration.k8s.io

    resources:

      - validatingwebhookconfigurations

    verbs:

      - get

      - update

---

# Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRoleBinding

metadata:

  name: ingress-nginx-admission

  annotations:

    helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade

    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded

  labels:

    helm.sh/chart: ingress-nginx-3.33.0

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/instance: ingress-nginx

    app.kubernetes.io/version: 0.47.0

    app.kubernetes.io/managed-by: Helm

    app.kubernetes.io/component: admission-webhook

roleRef:

  apiGroup: rbac.authorization.k8s.io

  kind: ClusterRole

  name: ingress-nginx-admission

subjects:

  - kind: ServiceAccount

    name: ingress-nginx-admission

    namespace: ingress-nginx

---

# Source: ingress-nginx/templates/admission-webhooks/job-patch/role.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: Role

metadata:

  name: ingress-nginx-admission

  annotations:

    helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade

    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded

  labels:

    helm.sh/chart: ingress-nginx-3.33.0

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/instance: ingress-nginx

    app.kubernetes.io/version: 0.47.0

    app.kubernetes.io/managed-by: Helm

    app.kubernetes.io/component: admission-webhook

  namespace: ingress-nginx

rules:

  - apiGroups:

      - ''

    resources:

      - secrets

    verbs:

      - get

      - create

---

# Source: ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: RoleBinding

metadata:

  name: ingress-nginx-admission

  annotations:

    helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade

    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded

  labels:

    helm.sh/chart: ingress-nginx-3.33.0

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/instance: ingress-nginx

    app.kubernetes.io/version: 0.47.0

    app.kubernetes.io/managed-by: Helm

    app.kubernetes.io/component: admission-webhook

  namespace: ingress-nginx

roleRef:

  apiGroup: rbac.authorization.k8s.io

  kind: Role

  name: ingress-nginx-admission

subjects:

  - kind: ServiceAccount

    name: ingress-nginx-admission

    namespace: ingress-nginx

---

# Source: ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml

apiVersion: batch/v1

kind: Job

metadata:

  name: ingress-nginx-admission-create

  annotations:

    helm.sh/hook: pre-install,pre-upgrade

    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded

  labels:

    helm.sh/chart: ingress-nginx-3.33.0

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/instance: ingress-nginx

    app.kubernetes.io/version: 0.47.0

    app.kubernetes.io/managed-by: Helm

    app.kubernetes.io/component: admission-webhook

  namespace: ingress-nginx

spec:

  template:

    metadata:

      name: ingress-nginx-admission-create

      labels:

        helm.sh/chart: ingress-nginx-3.33.0

        app.kubernetes.io/name: ingress-nginx

        app.kubernetes.io/instance: ingress-nginx

        app.kubernetes.io/version: 0.47.0

        app.kubernetes.io/managed-by: Helm

        app.kubernetes.io/component: admission-webhook

    spec:

      containers:

        - name: create

          image: docker.io/jettech/kube-webhook-certgen:v1.5.1

          imagePullPolicy: IfNotPresent

          args:

            - create

            - --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc

            - --namespace=$(POD_NAMESPACE)

            - --secret-name=ingress-nginx-admission

          env:

            - name: POD_NAMESPACE

              valueFrom:

                fieldRef:

                  fieldPath: metadata.namespace

      restartPolicy: OnFailure

      serviceAccountName: ingress-nginx-admission

      securityContext:

        runAsNonRoot: true

        runAsUser: 2000

---

# Source: ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml

apiVersion: batch/v1

kind: Job

metadata:

  name: ingress-nginx-admission-patch

  annotations:

    helm.sh/hook: post-install,post-upgrade

    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded

  labels:

    helm.sh/chart: ingress-nginx-3.33.0

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/instance: ingress-nginx

    app.kubernetes.io/version: 0.47.0

    app.kubernetes.io/managed-by: Helm

    app.kubernetes.io/component: admission-webhook

  namespace: ingress-nginx

spec:

  template:

    metadata:

      name: ingress-nginx-admission-patch

      labels:

        helm.sh/chart: ingress-nginx-3.33.0

        app.kubernetes.io/name: ingress-nginx

        app.kubernetes.io/instance: ingress-nginx

        app.kubernetes.io/version: 0.47.0

        app.kubernetes.io/managed-by: Helm

        app.kubernetes.io/component: admission-webhook

    spec:

      containers:

        - name: patch

          image: docker.io/jettech/kube-webhook-certgen:v1.5.1

          imagePullPolicy: IfNotPresent

          args:

            - patch

            - --webhook-name=ingress-nginx-admission

            - --namespace=$(POD_NAMESPACE)

            - --patch-mutating=false

            - --secret-name=ingress-nginx-admission

            - --patch-failure-policy=Fail

          env:

            - name: POD_NAMESPACE

              valueFrom:

                fieldRef:

                  fieldPath: metadata.namespace

      restartPolicy: OnFailure

      serviceAccountName: ingress-nginx-admission

      securityContext:

        runAsNonRoot: true

        runAsUser: 2000

kubectl apply -f deploy.yaml

9.1.2 查看状态

kubectl get pod -n ingress-nginx

我们看到ingress-nginx-controller-78965bffd5-qp6k8容器处于ContainerCreating，我们需要修改

也看参考这个issues：https://github.com/kubernetes/ingress-nginx/issues/5932

kubectl get secret -A | grep ingress-nginx

9.1.2.1 命令行修改方式：

# 复制 （自己的）-mh7zg ,将下图对应的位置，加上-mh7zg

kubectl edit deployment ingress-nginx-controller -n ingress-nginx

完成修改后

查看状态已经可以了

kubectl get pod -n ingress-nginx

9.1.2.2 界面修改修改方式：

找到Deployments

编辑

更新

9.1.3 验证

kubectl get svc -A

分别可以使用以下网址，如果能展示下图，就成功了

http://k8s集群任意ip:31483

https://k8s集群任意ip:30893

9.2 使用

ingress的一些高价功能：https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/

9.2.1 测试环境准备

应用如下yaml，准备好测试环境

vi test.yaml

apiVersion: apps/v1

kind: Deployment

metadata:

  name: hello-server

spec:

  replicas: 2

  selector:

    matchLabels:

      app: hello-server

  template:

    metadata:

      labels:

        app: hello-server

    spec:

      containers:

      - name: hello-server

        image: registry.cn-hangzhou.aliyuncs.com/lfy_k8s_images/hello-server

        ports:

        - containerPort: 9000

---

apiVersion: apps/v1

kind: Deployment

metadata:

  labels:

    app: nginx-demo

  name: nginx-demo

spec:

  replicas: 2

  selector:

    matchLabels:

      app: nginx-demo

  template:

    metadata:

      labels:

        app: nginx-demo

    spec:

      containers:

      - image: nginx

        name: nginx

---

apiVersion: v1

kind: Service

metadata:

  labels:

    app: nginx-demo

  name: nginx-demo

spec:

  selector:

    app: nginx-demo

  ports:

  - port: 8000

    protocol: TCP

    targetPort: 80

---

apiVersion: v1

kind: Service

metadata:

  labels:

    app: hello-server

  name: hello-server

spec:

  selector:

    app: hello-server

  ports:

  - port: 8000

    protocol: TCP

    targetPort: 9000

部署

kubectl apply -f test.yaml

查看是否已经部署完成

kubectl get pod

kubectl get svc

访问

9.2.2 域名访问

vi ingress-rule.yaml

apiVersion: networking.k8s.io/v1

kind: Ingress

metadata:

  name: ingress-host-bar

spec:

  ingressClassName: nginx

  rules:

  - host: "hello.hg.com"

    http:

      paths:

      - pathType: Prefix

        path: "/"

        backend:

          service:

            name: hello-server

            port:

              number: 8000

  - host: "demo.hg.com"

    http:

      paths:

      - pathType: Prefix

        path: "/"  # 把请求会转给下面的服务，下面的服务一定要能处理这个路径，不能处理就是404

        backend:

          service:

            name: nginx-demo  ## java，比如使用路径重写，去掉前缀nginx

            port:

              number: 8000

kubectl apply -f ingress-rule.yaml

如果执行有报错

查看

kubectl get validatingwebhookconfigurations

删除

kubectl delete -A ValidatingWebhookConfiguration ingress-nginx-admission

kubectl delete -A ValidatingWebhookConfiguration ingress-nginx-admission-token

重新部署

kubectl apply -f ingress-rule.yaml

查看ingress状态

kubectl get ingress

访问机器增加hosts域名配置

浏览器访问

修改对应的ingress

kubectl edit ingress ingress名称

kubectl edit ingress ingress-host-bar

9.2.3 路径重写

vi ingress-rule.yaml

apiVersion: networking.k8s.io/v1

kind: Ingress

metadata:

  annotations:

    nginx.ingress.kubernetes.io/rewrite-target: /$2

  name: ingress-host-bar

spec:

  ingressClassName: nginx

  rules:

  - host: "hello.hg.com"

    http:

      paths:

      - pathType: Prefix

        path: "/"

        backend:

          service:

            name: hello-server

            port:

              number: 8000

  - host: "demo.hg.com"

    http:

      paths:

      - pathType: Prefix

        path: "/nginx(/|$)(.*)"  # 把请求会转给下面的服务，下面的服务一定要能处理这个路径，不能处理就是404

        backend:

          service:

            name: nginx-demo  ## java，比如使用路径重写，去掉前缀nginx

            port:

              number: 8000

部署

kubectl apply -f ingress-rule.yaml

查看

kubectl get ingress

使用浏览器访问

效果：和之前不加/nginx一致，相当于在ingress处理的时候，将/nginx去掉了

9.2.4 流量限制

vi ingress-limit-rate.yaml

apiVersion: networking.k8s.io/v1

kind: Ingress

metadata:

  name: ingress-limit-rate

  annotations:

    nginx.ingress.kubernetes.io/limit-rps: "1"

spec:

  ingressClassName: nginx

  rules:

  - host: "haha.hg.com"

    http:

      paths:

      - pathType: Exact

        path: "/"

        backend:

          service:

            name: nginx-demo

            port:

              number: 8000

部署

kubectl apply -f ingree-limit-rate.yaml

查看状态

kubectl get ingress

使用浏览器查看，当快速访问时：

10 存储抽象

10.1 环境准备

10.1.1 所有节点

yum install -y nfs-utils

10.1.2 主节点

#nfs主节点

echo "/nfs/data/ *(insecure,rw,sync,no_root_squash)" > /etc/exports

mkdir -p /nfs/data

systemctl enable rpcbind --now

systemctl enable nfs-server --now

#配置生效

exportfs -r

10.1.3 从节点

# 查看nfs服务能挂载的信息

showmount -e nfs服务所在ip

#执行以下命令挂载 nfs 服务器上的共享目录到本机路径 /nfs/data

mkdir -p /nfs/data

mount -t nfs nfs服务所在ip:/nfs/data /nfs/data

# 写入一个测试文件

echo "hello nfs server" > /nfs/data/test.txt

永久挂载方式

vi /etc/fstab

# 新增一行

192.168.68.210:/nfs/data /nfs/data nfs defaults        0 0

nfs服务器端，也能看到新增的文件

10.1.4 原生方式数据挂载

vi mount.yaml

修改对应nfs服务的ip

server: 192.168.68.204
创建路径

path: /nfs/data/nginx-pv

apiVersion: apps/v1

kind: Deployment

metadata:

  labels:

    app: nginx-pv-demo

  name: nginx-pv-demo

spec:

  replicas: 2

  selector:

    matchLabels:

      app: nginx-pv-demo

  template:

    metadata:

      labels:

        app: nginx-pv-demo

    spec:

      containers:

      - image: nginx

        name: nginx

        volumeMounts:

        - name: html

          mountPath: /usr/share/nginx/html

      volumes:

        - name: html

          nfs:

            server: 192.168.68.204

            path: /nfs/data/nginx-pv

kubectl get pod

注意，如果一直在创建中，请使用 kubectl describe pod 对应的pod名字，一般是没有创建对应的文件夹

验证

# 进入pod容器内部

kubectl exec -it nginx-pv-demo-5b74676b65-cb9mh -- /bin/bash

# 查看nginx存放页面的信息

ls /usr/share/nginx/html/

发现对应的文件夹下，并没有数据

新建一个连接，在nfs宿主机服务的 /nfs/data/nginx-pv下,或者挂载的服务器下，新建一个index.html文件，并填充内容

echo 111 > /nfs/data/nginx-pv/index.html

然后，在之前的容器中再查看是否有新的文件

ls /usr/share/nginx/html/

cat /usr/share/nginx/html/index.html

更换另一个pod，结果也是一样

10.2 PV&PVC

PV：持久卷（Persistent Volume），将应用需要持久化的数据保存到指定位置

PVC：持久卷申明（Persistent Volume Claim），申明需要使用的持久卷规格

10.2.1 创建PV池

静态供应

mkdir -p /nfs/data/{01,02,03}

创建PV

vi pv.yaml

修改nfs服务ip

server: 自己的nfs服务ip

apiVersion: v1

kind: PersistentVolume

metadata:

  name: pv01-10m

spec:

  capacity:

    storage: 10M

  accessModes:

    - ReadWriteMany

  storageClassName: nfs

  nfs:

    path: /nfs/data/01

    server: 192.168.68.204

---

apiVersion: v1

kind: PersistentVolume

metadata:

  name: pv02-1gi

spec:

  capacity:

    storage: 1Gi

  accessModes:

    - ReadWriteMany

  storageClassName: nfs

  nfs:

    path: /nfs/data/02

    server: 192.168.68.204

---

apiVersion: v1

kind: PersistentVolume

metadata:

  name: pv03-3gi

spec:

  capacity:

    storage: 3Gi

  accessModes:

    - ReadWriteMany

  storageClassName: nfs

  nfs:

    path: /nfs/data/03

    server: 192.168.68.204

部署

kubectl apply -f pv.yaml

查看

kubectl get pv

10.2.2 PVC创建与绑定

10.2.2.1 创建PVC

vi pvc.yaml

apiVersion: v1

kind: PersistentVolumeClaim

metadata:

  name: nginx-pvc

spec:

  accessModes:

    - ReadWriteMany

  resources:

    requests:

      storage: 200Mi

  storageClassName: nfs

部署

kubectl apply -f pvc.yaml

查看

kubectl get pvc

测试删除

kubectl delete -f pvc.yaml

查看

kubectl get pvc

再次部署

kubectl apply -f pvc.yaml

查看

kubectl get pvc

结论：会选用大于200M的pv，正在使用的pv会被 Bound，之前使用的，后面删除了，就会释放

10.2.2.2 创建Pod绑定PVC

vi pod-pvc.yaml

apiVersion: apps/v1

kind: Deployment

metadata:

  labels:

    app: nginx-deploy-pvc

  name: nginx-deploy-pvc

spec:

  replicas: 2

  selector:

    matchLabels:

      app: nginx-deploy-pvc

  template:

    metadata:

      labels:

        app: nginx-deploy-pvc

    spec:

      containers:

      - image: nginx

        name: nginx

        volumeMounts:

        - name: html

          mountPath: /usr/share/nginx/html

      volumes:

        - name: html

          persistentVolumeClaim:

            claimName: nginx-pvc

部署

kubectl apply -f pod-pvc.yaml

查看pod

kubectl get pod

查看pvc和pv绑定关系

kubectl get pvc,pv

验证

进入启动一个pod容器内

# 进入容器，对应的pod名字修改为自己的

kubectl exec -it nginx-deploy-pvc-79fc8558c7-c8mh7 -- /bin/bash

## 展示容器内文件夹下的内容

ls /usr/share/nginx/html/

我们发现，文件夹下，还没有文件

从绑定关系中得知，使用的pv03-3gi在nfs服务对应的 /nfs/data/03文件夹或者挂载了nfs的服务器上，我们这03文件夹中创建文件 index.html文件

echo 333 > /nfs/data/03/index.html

再次查看，已经有了index.html文件

查看另外一个pod，也是如此

10.3 ConfigMap

抽取应用配置，并且可以自动更新

10.3.1 redis示例

10.3.1.1 创建redis.conf配置文件

vi redis.conf

内容

appendonly yes

10.3.1.2 把配置文件创建为配置集

方式一：命令行方式

# 创建配置，redis保存到k8s的etcd；

kubectl create cm redis-conf --from-file=redis.conf

删除cm配置

# kubectl delete cm cm名称

kubectl delete cm redis-conf

方式二：yaml方式

vi cm.yaml

apiVersion: v1

data:    #data是所有真正的数据，key：默认是文件名   value：配置文件的内容

  redis.conf: |

    appendonly yes

kind: ConfigMap

metadata:

  name: redis-conf

  namespace: default

部署

kubectl apply -f cm.yaml

10.3.1.3 创建pod

vi redis-pod.yaml

apiVersion: v1

kind: Pod

metadata:

  name: redis

spec:

  containers:

  - name: redis

    image: redis

    command:

      - redis-server

      - "/redis-master/redis.conf"  #指的是redis容器内部的位置

    ports:

    - containerPort: 6379

    volumeMounts:

    - mountPath: /data

      name: data

    - mountPath: /redis-master

      name: config

  volumes:

    - name: data

      emptyDir: {}

    - name: config

      configMap:

        name: redis-conf

        items:

        - key: redis.conf

          path: redis.conf

查看

kubectl get pod

10.3.1.3 检查默认配置

kubectl exec -it redis -- redis-cli

10.3.1.4 修改ConfigMap

kubectl edit cm redis-conf

    maxmemory 2mb

    maxmemory-policy allkeys-lru

10.3.1.5 检查配置是否更新

kubectl exec -it redis -- redis-cli

检查指定文件内容是否已经更新

修改了CM。Pod里面的配置文件会跟着变

配置值未更改，因为需要重新启动 Pod 才能从关联的 ConfigMap 中获取更新的值。

原因：我们的Pod部署的中间件自己本身没有热更新能力

重启pod

kubectl replace --force -f redis-pod.yaml

检查配置是否更新

kubectl exec -it redis -- redis-cli

10.4 Secret

Secret 对象类型用来保存敏感信息，例如密码、OAuth 令牌和 SSH 密钥。将这些信息放在 secret 中比放在 Pod 的定义或者容器镜像中来说更加安全和灵活。

10.4.1 命令方式

kubectl create secret docker-registry 密钥名 \

  --docker-server=<你的镜像仓库服务器> \

  --docker-username=<你的用户名> \

  --docker-password=<你的密码> \

  --docker-email=<你的邮箱地址>

10.4.2 创建容器

apiVersion: v1

kind: Pod

metadata:

  name: private-nginx

spec:

  containers:

  - name: private-nginx

    image: xx/xx:v1.0

  imagePullSecrets:

  - name: 密钥名

巴特西

3、k8s 核心实战

7 kubernets核心实战

7.1 资源创建方式

7.2 namespace

7.3 pod

7.3.1 通过kubectl run 创建容器

7.3.2 通过yaml的方式创建容器

7.4 deployment

8 多副本、扩缩容

8.1 多副本

8.2 扩缩容

8.3 自愈&故障转移

8.4 滚动更新

8.5 版本回退

8.6 更多知识

9 Service

9.1 将一组Pods公开为网络服务的抽象方法

9.1.1 不带type 模式type 是 ClusterIP

9.1.2 带type

9.1.2.1 ClusterIP

9.1.2.2 NodePort

9 Ingress

9.1.1 安装

9.1.2 查看状态

9.1.2.1 命令行修改方式：

9.1.2.2 界面修改修改方式：

9.1.3 验证

9.2 使用

9.2.1 测试环境准备

9.2.2 域名访问

9.2.3 路径重写

9.2.4 流量限制

10 存储抽象

10.1 环境准备

10.1.1 所有节点

10.1.2 主节点

10.1.3 从节点

10.1.4 原生方式数据挂载

10.2 PV&PVC

10.2.1 创建PV池

10.2.2 PVC创建与绑定

10.2.2.1 创建PVC

10.2.2.2 创建Pod绑定PVC

10.3 ConfigMap

10.3.1 redis示例

10.3.1.1 创建redis.conf配置文件

10.3.1.2 把配置文件创建为配置集

10.3.1.3 创建pod

10.3.1.3 检查默认配置

10.3.1.4 修改ConfigMap

10.3.1.5 检查配置是否更新

10.4 Secret

10.4.1 命令方式

10.4.2 创建容器

最新文章

热门文章