Kubernetes学习记录
编写：梁木
- 20210907 第一次编写
- 20210908 追加内容
- 202210909 整理更新
- 20210910 整理更新
容器学习
地址：阿里巴巴开源镜像站-OPSX镜像站-阿里云开发者社区 (aliyun.com)
1. 安装容器镜像yum源
sudo yum install -y yum-utils device-mapper-persistent-data lvm2 wget
sudo yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
sudo sed -i 's+download.docker.com+mirrors.aliyun.com/docker-ce+' /etc/yum.repos.d/docker-ce.repo
sudo yum makecache fast
sudo yum -y install docker-ce
sudo service docker start
yum repolist
2. Kubernetes 镜像配置
cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF
yum repolist
3.容器
轻量级虚拟化技术，核心为Namepace + Cgroup，主机上展现形式为进程
? Namespace实现资源隔离，Cgroup 是对隔离资源限制(CPU、MEM、IO等)
UTS CLONE_NEWUTS 主机名或域名
IPC CLONE_NEWIPC 信号量、消息队列和共享内存
PID CLONE_NEWPID 进程编号
Network CLONE_NEWNET 网络设备、网络战、端口等
Mount CLONE_NEWNS 挂载点（文件系统）
User CLONE_NEWUSER 用户组和用户组
3.1 容器基本操作
systemctl start docker
systemctl status docker
docker ps
docker run -d --name nginx nginx:alpine
docker ps
curl 172.17.0.2
docker exec busybox ls
docker exec -
docker logs nginx
docker rmi -f nginx:alpine
vim Dockerfile
FROM centos:centos7.6.1810
RUN yum install -y bind-utils tcpdump
ADD code /data/code/
docker build -t centos:v1
docker commit -a author -m message container image
docker cp 1 busybox:/tmp
docker rename nginx ngix1
docker save -o nginx-image.tar nginx:alpine
docker load -i nginx-image.tar
docker inspect nginx
docker inspect nginx:alpine
"""
{
"bip":"1.0.0.1/16",
"data-root":"/data",
"insecure-registries": ["0.0.0.0/0","https://www.aliyun.com"]
}
"""
systemctl cat docker
3.2 容器网络
journalctl -xeu docker --no-pager
docker network list
yum -y install bridge-utils
brctl show docker0
ip link show
ss -tnlp | grep 80
netstat -tnlp | grep 80
docker run -d --name nginx01 --network host nginx:alpine
curl http://10.10.24.76
curl 10.10.24.76:80
curl 10.10.24.76
wget -O - http://127.0.0.1
wget -O - localhost
docker run -d --name nginx1 nginx:alpine
docker run -d --name tomcat1 --network container:nginx1 tomcat
docker inspect nginx1 |grep id
ll /proc/16797/ns
docker inspect tomcat1 |grep id
ll /proc/18575/ns
docker run -itd --name nginx01 --cpus 3 nginx:alpine
docker exec -it nginx01 sh
cd /sys/fs/cgroup/cpu,cpuacct
cat cpu.cfs_quota_us
docker run -itd --name nginx02 --cpuset-cpus 0-5 nginx:alpine
docker exec -it nginx02 sh
cd /sys/fs/cgroup/cpuset
cat cpuset.cpus
4.Kubernetes 介绍
一种容器编排系统，Google开源，
控制平面master → 负载节点node pool
4.1master：
apiserver：网关、路由器：认证、授权、准入控制
controller manager ：查看当前状态和用户状态，控制器组合
scheduler：调度器 ，预选：排除不符合节点，优选：符合节点打分
etcd ：唯一存储
4.2Node:
kubelet：负载容器的创建等操作。接收来自apiserver指令向apiserver汇报自身状态消
kube-proxy ：定期从apiserver获取服务的定义，生成iptables/ipvs规则
docker
4.3集群共用
CoreDNS 域名解析
Network plugin ip
4.4pod
pod 包含一个或多个container
Kubernetes中调度的最小单元
共享网络及外部挂载的存储
4.Kubernetes部署
4.1环境准备
yum repolist
yum clean all
yum repolist
systemctl stop firewalld
systemctl disable firewalld
setenforce 0
sed -i 's/^SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
free -mh
swapoff -a
date
yum -y install ntpdate
ntpdate ntp.aliyun.com
bash
cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
gpgcheck=0
EOF
cat > /etc/sysconfig/modules/ipvs.modules <<EOF
#！/bin/bash
modprobe -- ip_vs_rr
modprobe -- ip_vs_wrr
modprobe -- ip_vs_sh
modprobe -- nf_conntrack_ipv4
modprobe br_netfilter
EOF
source /etc/sysconfig/modules/ipvs.modules
lsmod | grep nf_conntrack
lsmod | grep br_netfilter
cat > /etc/sysctl.d/k8s.conf <<EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
EOF
sysctl --system
cat > /etc/docker/daemon.json <<EOF
{
"exec-opts": ["native.cgroupdriver=systemd"],
"data-root": "/data/docker"
}
EOF
systemctl restart docker
systemctl enable docker
4.2开始部署
yum -y install kubeadm-1.18.9 kubectl-1.18.9 kubelet-1.18.9
systemctl start kubelet
systemctl enable kubelet
kubeadm init \
--kubernetes-version=v1.18.9 \
--image-repository registry.aliyuncs.com/google_containers \
--pod-network-cidr=10.244.0.0/16 \
--service-cidr=10.96.0.0/12
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
kubeadm join 10.10.24.76:6443 --token n48lar.yyj328vs7hsh6tpt \
--discovery-token-ca-cert-hash sha256:d36bbd2b709d6aa786533229c7d007302ff7625833fe88542f89b4e22be611a0
kubectl get nodes
kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
kubectl get pod -n kube-system
kubectl get pod -n kube-system --kubeconfig=/root/.kube/config
kubeadm config images list
4.3kubectl命令
4.3.1bash命令补全
yum install bash-completion -y
source <(kubectl completion bash)
echo "source <(kubectl completion bash)" >> ~/.bashrc
echo "alias kd='kubectl get pod'" >> ~/.bashrc
alias k=kubectl
complete -F __start_kubectl k
4.3.2kubectl命令操作
kubectl get node --show-labels
kubectl get namespace
kubectl explain pod
kubectl explain pod.spec
kubectl explain pod.spec.containers
kubectl explain pod.spec.volumes
kubectl create ns canway
kubectl exec -it nginx -n canway -c nginx -- sh
kubectl set image deploy deploy-nginx nginx=nginx:latest -n canway
kubectl edit deployment deploy-nginx -n canway
kubectl get node --show-labels
4.3.3pod简单编写
vim containers-pod.yml
kubectl explain pod
kubectl explain pod.spec
kubectl explain pod.spec.containers
kubectl explain pod.spec.volumes
apiVersion: v1
kind: Pod
metadata:
name: nginx
namespace: canway
spec:
nodeName: node01
hostNetwork: true
volumes:
- name: work-dir
hostPath:
path: /opt/nginx
initContainers:
- name: centos-init
image: centos:centos7.6.1810
command: ["sh"]
args: ["-c","echo 'hello!'>/data/kug.jsp"]
volumeMounts:
- name: tomcat-workdir
mountPath: /data
containers:
- name: nginx
image: nginx:alpine
imagePullPolicy: IfNotPresent
ports:
- name: http-port
containerPort: 80
volumeMounts:
- name: work-dir
mountPath: /usr/share/nginx/html/kug.jsp
subPath: kug.jsp
- name: busybox
image: busybox
imagePullPolicy: IfNotPresent
tty: true
stdin: true
volumeMounts:
- name: work-dir
mountPath: /opt/container/busybox
- name: tomcat
image: tomcat
ports:
- name: http-port
containerPort: 8080
volumeMounts:
- name: tomcat-workdir
mountPath: /usr/local/tomcat/webapps/ROOT
resources:
requests:
memory: "80Mi"
cpu: "100m"
limits:
memory: "200Mi"
cpu: "200m"
kuberctl apply -f nginx-pod.yml
kuberctl get pod -n canwat
kubectl logs -n canway nainx
kubectl delete pod -n canway nainx
模板及说明
apiVersion: v1
kind: Pod
metadata:
name: string
namespace: string
labels:
- name: string
annotations:
- name: string
spec:
containers:
- name: string
image: string
imagePullPolicy: [Always | Never | IfNotPresent]
command: [string]
args: [string]
workingDir: string
volumeMounts:
- name: string
mountPath: string
readOnly: boolean
ports:
- name: string
containerPort: int
hostPort: int
protocol: string
env:
- name: string
value: string
resources:
limits:
cpu: string
memory: string
requests:
cpu: string
memory: string
livenessProbe:
exec:
command: [string]
httpGet:
path: string
port: number
host: string
scheme: string
HttpHeaders:
- name: string
value: string
tcpSocket:
port: number
initialDelaySeconds: 0
timeoutSeconds: 0
periodSeconds: 0
successThreshold: 0
failureThreshold: 0
securityContext:
privileged:false
restartPolicy: [Always | Never | OnFailure]
nodeSelector: obeject
imagePullSecrets:
- name: string
hostNetwork:false
volumes:
- name: string
emptyDir: {}
hostPath: string
path: string
secret:
scretname: string
items:
- key: string
path: string
configMap:
name: string
items:
- key: string
path: string
4.3.4 deployment简单编写
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-nginx
namespace: canway
spec:
selector:
matchLabels:
app: ng
web: nginx
template:
metadata:
labels:
app: ng
web: nginx
front: website
spec:
containers:
- name: nginx
image: nginx:alpine
imagePullPolicy: IfNotPresent
ports:
- name: http-port
containerPort: 80
env:
- name: MYSQL_ROOT_PASSWORD
value: "123456"
4.3.5service 简单编写
apiVersion: v1
kind: Service
metadata:
name: tomcat-svc
namespace: canway
spec:
selector:
app: ng
web: nginx
ports:
- name: http-port
port: 8080
targetPort: 8080
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: centos7
namespace: canway
spec:
selector:
matchLabels:
app: centos
template:
metadata:
labels:
app: centos
spec:
containers:
- name: centos7
image: centos:centos7.6.1810
tty: true
stdin: true
service 模板说明
apiVersion: v1
kind: Service
metadata:
name: service
namespace: dev
spec:
selector:
app: nginx
type:
clusterIP:
sessionAffinity:
ports:
- protocol: TCP
port: 80
targetPort: 80
nodePort: 30000
4.3.6进入mysql容器
kubectl get pod -n database -owide
mysql -h 10.244.2.13 -p123456
kubectl get svc -n database -owide
mysql -h10.98.88.227 -p123456
mysql -h mysql-svc.database.svc.cluster.local -p123456
4.3.7configmap 简单编写
kubectl create configmap map --from-file=index.html=./index.html -n canway --dry-run -oyaml >configmap.yaml
apiVersion: v1
data:
index.html: |
dadadadadadada
kind: ConfigMap
metadata:
creationTimestamp: null
name: map
namespace: canway
其他笔记
快捷命令
history > history重定向
yum工具
yum -y install \
nmap-ncat
nmap
tcpdump
|