K8s深入了解
Ingress控制器介绍
1.没有ingress之前，pod对外提供服务只能通过NodeIP:NodePort的形式，但是这种形式有缺点，一个节点上的PORT不能重复利用。比如某个服务占用了80，那么其他服务就不能在用这个端口了。2.NodePort是4层代理，不能解析7层的http，不能通过域名区分流量3.为了解决这个问题，我们需要用到资源控制器叫Ingress，作用就是提供一个统一的访问入口。工作在7层4.虽然我们可以使用nginx/haproxy来实现类似的效果，但是传统部署不能动态的发现我们新创建的资源，必须手动修改配置文件并重启。5.适用于k8s的ingress控制器主流的有ingress-nginx和traefik6.ingress-nginx == nginx + go --> deployment部署 7.traefik有一个UI界面 
安装部署traefik
1.traefik_dp.yamlkind: DeploymentapiVersion: apps/v1metadata: name: traefik-ingress-controller namespace: kube-system labels: k8s-app: traefik-ingress-lbspec: replicas: 1 selector: matchLabels: k8s-app: traefik-ingress-lb template: metadata: labels: k8s-app: traefik-ingress-lb name: traefik-ingress-lb spec: serviceAccountName: traefik-ingress-controller terminationGracePeriodSeconds: 60 tolerations: - operator: "Exists" nodeSelector: kubernetes.io/hostname: node1 containers: - image: traefik:v1.7.17 name: traefik-ingress-lb ports: - name: http containerPort: 80 hostPort: 80 - name: admin containerPort: 8080 args: - --api - --kubernetes - --logLevel=INFO2.traefik_rbac.yaml---apiVersion: v1kind: ServiceAccountmetadata: name: traefik-ingress-controller namespace: kube-system---kind: ClusterRoleapiVersion: rbac.authorization.k8s.io/v1beta1metadata: name: traefik-ingress-controllerrules: - apiGroups: - "" resources: - services - endpoints - secrets verbs: - get - list - watch - apiGroups: - extensions resources: - ingresses verbs: - get - list - watch---kind: ClusterRoleBindingapiVersion: rbac.authorization.k8s.io/v1beta1metadata: name: traefik-ingress-controllerroleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: traefik-ingress-controllersubjects:- kind: ServiceAccount name: traefik-ingress-controller namespace: kube-system3.traefik_svc.yamlkind: ServiceapiVersion: v1metadata: name: traefik-ingress-service namespace: kube-systemspec: selector: k8s-app: traefik-ingress-lb ports: - protocol: TCP port: 80 name: web - protocol: TCP port: 8080 name: admin type: NodePort4.应用资源配置kubectl create -f ./5.查看并访问kubectl -n kube-system get svc 创建traefik的web-ui的ingress规则
1.类比nginx:upstream traefik-ui { server traefik-ingress-service:8080;}server { location / { proxy_pass http://traefik-ui; include proxy_params; }}2.ingress写法:apiVersion: extensions/v1beta1kind: Ingressmetadata: name: traefik-ui namespace: kube-systemspec: rules: - host: traefik.ui.com http: paths: - path: / backend: serviceName: traefik-ingress-service servicePort: 80803.访问测试：traefik.ui.comingress实验
1.实验目标未使用ingress之前只能通过IP+端口访问：tomcat 8080nginx 8090使用ingress之后直接可以使用域名访问：traefik.nginx.com:80 --> nginx 8090traefik.tomcat.com:80 --> tomcat 80802.创建2个pod和svcmysql-dp.yaml mysql-svc.yaml tomcat-dp.yaml tomcat-svc.yamlnginx-dp.yaml nginx-svc-clusterip.yaml 3.创建ingress控制器资源配置清单并应用cat >nginx-ingress.yaml <<EOFapiVersion: extensions/v1beta1kind: Ingressmetadata: name: traefik-nginx namespace: default spec: rules: - host: traefik.nginx.com http: paths: - path: / backend: serviceName: nginx-service servicePort: 80EOFcat >tomcat-ingress.yaml<<EOFapiVersion: extensions/v1beta1kind: Ingressmetadata: name: traefik-tomcat namespace: default spec: rules: - host: traefik.tomcat.com http: paths: - path: / backend: serviceName: myweb servicePort: 8080EOFkubectl apply -f nginx-ingress.yaml kubectl apply -f tomcat-ingress.yaml 4.查看创建的资源kubectl get svckubectl get ingresseskubectl describe ingresses traefik-nginxkubectl describe ingresses traefik-tomcat5.访问测试traefik.nginx.comtraefik.tomcat.com数据持久化
Volume介绍
Volume是Pad中能够被多个容器访问的共享目录Kubernetes中的Volume不Pad生命周期相同，但不容器的生命周期丌相关Kubernetes支持多种类型的Volume，并且一个Pod可以同时使用任意多个VolumeVolume类型包括:- EmptyDir：Pod分配时创建， K8S自动分配，当Pod被移除数据被清空。用于临时空间等。- hostPath：为Pod上挂载宿主机目录。用于持久化数据。- nfs：挂载相应磁盘资源。EmptyDir实验
cat >emptyDir.yaml <<EOFapiVersion: v1kind: Podmetadata: name: busybox-emptyspec: containers: - name: busybox-pod image: busybox volumeMounts: - mountPath: /data/busybox/ name: cache-volume command: ["/bin/sh","-c","while true;do echo $(date) >> /data/busybox/index.html;sleep 3;done"] volumes: - name: cache-volume emptyDir: {}EOFhostPath实验
1.发现的问题：- 目录必须存在才能创建- POD不固定会创建在哪个Node上，数据不统一2.type类型说明https://kubernetes.io/docs/concepts/storage/volumes/#hostpathDirectoryOrCreate 目录不存在就自动创建Directory 目录必须存在FileOrCreate 文件不存在则创建File 文件必须存在3.根据Node标签选择POD创建在指定的Node上方法1: 直接选择Node节点名称apiVersion: v1kind: Podmetadata: name: busybox-nodenamespec: nodeName: node2 containers: - name: busybox-pod image: busybox volumeMounts: - mountPath: /data/pod/ name: hostpath-volume command: ["/bin/sh","-c","while true;do echo $(date) >> /data/pod/index.html;sleep 3;done"] volumes: - name: hostpath-volume hostPath: path: /data/node/ type: DirectoryOrCreate 方法2: 根据Node标签选择Node节点kubectl label nodes node3 disktype=SSDapiVersion: v1kind: Podmetadata: name: busybox-nodenamespec: nodeSelector: disktype: SSD containers: - name: busybox-pod image: busybox volumeMounts: - mountPath: /data/pod/ name: hostpath-volume command: ["/bin/sh","-c","while true;do echo $(date) >> /data/pod/index.html;sleep 3;done"] volumes: - name: hostpath-volume hostPath: path: /data/node/ type: DirectoryOrCreate 4.实验-编写mysql的持久化deploymentapiVersion: apps/v1kind: Deploymentmetadata: name: mysql-dp namespace: defaultspec: selector: matchLabels: app: mysql replicas: 1 template: metadata: name: mysql-pod namespace: default labels: app: mysql spec: containers: - name: mysql-pod image: mysql:5.7 ports: - name: mysql-port containerPort: 3306 env: - name: MYSQL_ROOT_PASSWORD value: "123456" volumeMounts: - mountPath: /var/lib/mysql name: mysql-volume volumes: - name: mysql-volume hostPath: path: /data/mysql type: DirectoryOrCreate nodeSelector: disktype: SSDPV和PVC
1.master节点安装nfsyum install nfs-utils -ymkdir /data/nfs-volume -pvim /etc/exports/data/nfs-volume 10.0.0.0/24(rw,async,no_root_squash,no_all_squash)systemctl start rpcbindsystemctl start nfsshowmount -e 127.0.0.12.所有node节点安装nfsyum install nfs-utils.x86_64 -yshowmount -e 10.0.0.113.编写并创建nfs-pv资源cat >nfs-pv.yaml <<EOFapiVersion: v1kind: PersistentVolumemetadata: name: pv01spec: capacity: storage: 5Gi accessModes: - ReadWriteOnce persistentVolumeReclaimPolicy: Recycle storageClassName: nfs nfs: path: /data/nfs-volume/mysql server: 10.0.0.11EOFkubectl create -f nfs-pv.yamlkubectl get persistentvolume3.创建mysql-pvccat >mysql-pvc.yaml <<EOFapiVersion: v1kind: PersistentVolumeClaimmetadata: name: mysql-pvc spec: accessModes: - ReadWriteOnce resources: requests: storage: 1Gi storageClassName: nfsEOFkubectl create -f mysql-pvc.yamlkubectl get pvc4.创建mysql-deploymentcat >mysql-dp.yaml <<EOFapiVersion: apps/v1kind: Deployment metadata: name: mysqlspec: replicas: 1 selector: matchLabels: app: mysql template: metadata: labels: app: mysql spec: containers: - name: mysql image: mysql:5.7 ports: - containerPort: 3306 env: - name: MYSQL_ROOT_PASSWORD value: "123456" volumeMounts: - name: mysql-pvc mountPath: /var/lib/mysql - name: mysql-log mountPath: /var/log/mysql volumes: - name: mysql-pvc persistentVolumeClaim: claimName: mysql-pvc - name: mysql-log hostPath: path: /var/log/mysql nodeSelector: disktype: SSDEOFkubectl create -f mysql-dp.yamlkubectl get pod -o wide 5.测试方法1.创建nfs-pv2.创建mysql-pvc3.创建mysql-deployment并挂载mysq-pvc4.登陆到mysql的pod里创建一个数据库5.将这个pod删掉，因为deployment设置了副本数，所以会自动再创建一个新的pod6.登录这个新的pod，查看刚才创建的数据库是否依然能看到7.如果仍然能看到，则说明数据是持久化保存的6.accessModes字段说明ReadWriteOnce 单路读写ReadOnlyMany 多路只读ReadWriteMany 多路读写resources 资源的限制，比如至少5G7.volumeName精确匹配#capacity 限制存储空间大小#reclaim policy pv的回收策略#retain pv被解绑后上面的数据仍保留#recycle pv上的数据被释放#delete pvc和pv解绑后pv就被删除备注：用户在创建pod所需要的存储空间时，前提是必须要有pv存在才可以，这样就不符合自动满足用户的需求，而且之前在k8s 9.0版本还可删除pv，这样造成数据不安全性configMap资源
1.为什么要用configMap？将配置文件和POD解耦2.congiMap里的配置文件是如何存储的？键值对key:value文件名:配置文件的内容3.configMap支持的配置类型 直接定义的键值对 基于文件创建的键值对4.configMap创建方式 命令行 资源配置清单 5.configMap的配置文件如何传递到POD里 变量传递 数据卷挂载6.命令行创建configMapkubectl create configmap --helpkubectl create configmap nginx-config --from-literal=nginx_port=80 --from-literal=server_name=nginx.cookzhang.comkubectl get cmkubectl describe cm nginx-config 7.POD环境变量形式引用configMapkubectl explain pod.spec.containers.env.valueFrom.configMapKeyRefcat >nginx-cm.yaml <<EOFapiVersion: v1kind: Podmetadata: name: nginx-cmspec: containers: - name: nginx-pod image: nginx:1.14.0 ports: - name: http containerPort: 80 env: - name: NGINX_PORT valueFrom: configMapKeyRef: name: nginx-config key: nginx_port - name: SERVER_NAME valueFrom: configMapKeyRef: name: nginx-config key: server_name EOFkubectl create -f nginx-cm.yaml8.查看pod是否引入了变量[root@node1 ~/confimap]# kubectl exec -it nginx-cm /bin/bashroot@nginx-cm:~# echo ${NGINX_PORT}80root@nginx-cm:~# echo ${SERVER_NAME}nginx.cookzhang.comroot@nginx-cm:~# printenv |egrep "NGINX_PORT|SERVER_NAME"NGINX_PORT=80SERVER_NAME=nginx.cookzhang.com注意：变量传递的形式，修改confMap的配置，POD内并不会生效因为变量只有在创建POD的时候才会引用生效，POD一旦创建好，环境变量就不变了8.文件形式创建configMap创建配置文件：cat >www.conf <<EOFserver { listen 80; server_name www.cookzy.com; location / { root /usr/share/nginx/html/www; index index.html index.htm; } }EOF创建configMap资源：kubectl create configmap nginx-www --from-file=www.conf=./www.conf 查看cm资源kubectl get cmkubectl describe cm nginx-www编写pod并以存储卷挂载模式引用configMap的配置cat >nginx-cm-volume.yaml <<EOFapiVersion: v1kind: Podmetadata: name: nginx-cmspec: containers: - name: nginx-pod image: nginx:1.14.0 ports: - name: http containerPort: 80 volumeMounts: - name: nginx-www mountPath: /etc/nginx/conf.d/ volumes: - name: nginx-www configMap: name: nginx-www items: - key: www.conf path: www.confEOF测试：1.进到容器内查看文件kubectl exec -it nginx-cm /bin/bashcat /etc/nginx/conf.d/www.conf 2.动态修改configMapkubectl edit cm nginx-www3.再次进入容器内观察配置会不会自动更新cat /etc/nginx/conf.d/www.conf nginx -T安全认证和RBAC
API Server是访问控制的唯一入口在k8s平台上的操作对象都要经历三种安全相关的操作1.认证操作 http协议 token 认证令牌 ssl认证 kubectl需要证书双向认证2.授权检查 RBAC 基于角色的访问控制 3.准入控制 进一步补充授权机制，一般在创建，删除，代理操作时作补充k8s的api账户分为2类 1.实实在在的用户 人类用户 userAccount 2.POD客户端 serviceAccount 默认每个POD都有认真信息RBAC就要角色的访问控制 你这个账号可以拥有什么权限 以traefik举例：1.创建了账号 ServiceAccount:traefik-ingress-controller2.创建角色 ClusterRole: traefik-ingress-controller Role POD相关的权限 ClusterRole namespace级别操作 3.将账户和权限角色进行绑定 traefik-ingress-controller RoleBinding ClusterRoleBinding4.创建POD时引用ServiceAccount serviceAccountName: traefik-ingress-controller注意！！！kubeadm安装的k8s集群，证书默认只有1年k8s dashboard
1.官方项目地址https://github.com/kubernetes/dashboard2.下载配置文件wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-rc5/aio/deploy/recommended.yaml3.修改配置文件 39 spec: 40 type: NodePort 41 ports: 42 - port: 443 43 targetPort: 8443 44 nodePort: 300004.应用资源配置kubectl create -f recommended.yaml5.创建管理员账户并应用cat > dashboard-admin.yaml<<EOFapiVersion: v1kind: ServiceAccountmetadata: name: admin-user namespace: kubernetes-dashboard---apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleBindingmetadata: name: admin-userroleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-adminsubjects:- kind: ServiceAccount name: admin-user namespace: kubernetes-dashboardEOFkubectl create -f dashboard-admin.yaml6.查看资源并获取tokenkubectl get pod -n kubernetes-dashboard -o widekubectl get svc -n kubernetes-dashboardkubectl get secret -n kubernetes-dashboardkubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep admin-user | awk '{print $1}')7.浏览器访问https://10.0.0.11:30000google浏览器打不开就换火狐浏览器黑科技 this is unsafe研究的方向
0.namespace1.ServiceAccount2.Service3.Secret4.configMap5.RBAC6.Deployment重启k8s二进制安装(kubeadm)需要重启组件
1.kube-apiserver2.kube-proxy3.kube-sechduler4.kube-controller5.etcd6.coredns7.flannel8.traefik9.docker10.kubelet 赞 (0)