namespace: my-app
spec:
podSelector:
matchLabels:
policyTypes:
- Ingress
ingress:
-
from:
-
podSelector:
matchLabels:
ports:
- protocol: TCP
port: 9200
[student@vms20 ~]$ kubectl apply -f 5.yaml
Error from server (NotFound): error when creating “5.yaml”: namespaces “my-app” not found
[student@vms20 ~]$ kubectl create ns my-app
namespace/my-app created
[student@vms20 ~]$ kubectl apply -f 5.yaml
networkpolicy.networking.k8s.io/allow-port-from-namespace created
[student@vms20 ~]$
-
设置配置环境kubectl config use-context k8s
-
Task
-
在internal 命名空间创建一个名为allow-port-from-namespace 的确保新的NetworkPolicy 允
许namespace internal 中的Pods 来连接到namespace big-corp 中的端口9200。
-
确保新的NetworkPolicy：
-
不允许对没有在监听端口9200 的pods 访问
-
不允许不来自namespace internal 的pods 的访问
-
答案
这里要用Egress，而不是Ingress，要从internal连接到big-corp的ns，应该能很明显看出来是出的吧！
-
文件获取呢，和上面一样到官方复制，我这不累赘，然后因为这个是要多另一个ns空间的，所以需要加上
namespaceSelector:并指定标签【这个在Ingress中有，复制到Egress中即可】 -
然后因为要指定标签，所以我们需要先查看到big-corp的标签【如果没这个ns，就创建】
-
全部流程如下
[student@vms20 ~]$ kubectl config use-context k8s
Switched to context “k8s”.
[student@vms20 ~]$
[student@vms20 ~]$ kubectl get ns --show-labels | grep big-corp
[student@vms20 ~]$ kubectl create ns big-corp
namespace/big-corp created
[student@vms20 ~]$ kubectl get ns --show-labels | grep big-corp
big-corp Active 2s kubernetes.io/metadata.name=big-corp
[student@vms20 ~]$
#最终配置文件如下，名称做修改，ns修改
#注意复制的标签= 要改为: ，并在后面加一个空格
[student@vms20 ~]$ #vi 5-2.yaml
[student@vms20 ~]$ cat 5-2.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-port-from-namespace
namespace: internal
spec:
podSelector:
matchLabels:
policyTypes:
- Egress
egress:
-
to:
-
namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: big-corp
ports:
- protocol: TCP
port: 9200
[student@vms20 ~]$
[student@vms20 ~]$ kubectl apply -f 5-2.yaml
Error from server (NotFound): error when creating “5-2.yaml”: namespaces “internal” not found
[student@vms20 ~]$ kubectl create ns internal
namespace/internal created
[student@vms20 ~]$ kubectl apply -f 5-2.yaml
networkpolicy.networking.k8s.io/allow-port-from-namespace created
[student@vms20 ~]$
========================================================================
设置配置环境kubectl config use-context k8s
Task
请重新配置现有的部署front-end 以及添加名为http 的端口规范来公开现有容器nginx 的端
口80/tcp。
创建一个名为front-end-svc 的新服务，以公开容器端口http。
配置此服务，以通过在排定的节点上的NodePort 来公开各个pods。
-
编辑我们可以用edit来编辑哦
-
因为上面说了名为http的端口规范，所以增加一个名为http的port，然后指定80端口和tcp类型即可
-
80端口的containerport记不住可以官网搜索deployment，进入配置文件查看
-
tcp类型的portocol记不住可以官网搜索networkpolicy【上面第五题】，进入配置文件查看
[student@vms20 ~]$ kubectl config use-context k8s
Switched to context “k8s”.
[student@vms20 ~]$
[student@vms20 ~]$ kubectl get deployments
NAME READY UP-TO-DATE AVAILABLE AGE
cpupod 3/3 3 3 28d
front-end 1/1 1 1 28d
webserver 1/1 1 1 28d
[student@vms20 ~]$ kubectl edit deployments front-end
找到nginx镜像部分，大概在42行左右
增加下面43-46行内容保存退出即可
41 name: nginx
42 resources: {}
43 ports:
44 - name: http
45 containerPort: 80
46 protocol: TCP
47 terminationMessagePath: /dev/termination-log
#保存退出
:wq
“/tmp/kubectl-edit-943303888.yaml” 72L, 2433C written
deployment.apps/front-end edited
[student@vms20 ~]$
- 创建一个服务公开80端口，实际上就是创建一个svc
[student@vms20 ~]$ kubectl expose --name=front-end-svc deployment front-end --port=80 --type=NodePort
service/front-end-svc exposed
[student@vms20 ~]$
–name=front-end-svc -svc名称【题目有说】
deployment front-end --port=80 --deploy类型 deploy的pod名称 这个pod的端口
–type=NodePort -类型【题目有说】
========================================================================
设置配置环境kubectl config use-context k8s
Task
如下创建一个新的nginx ingress 资源：
名称：pong
namespace： ing-internal
使用服务端口5678 在路径/hello 上公开服务hello
可以使用一下命令检查服务hello 的可用性，该命令返回hello：
curl -kL < INTERNAL_IP>/hello/
- 因为题目让创建ingress资源，所以，直接官网搜索 ingress即可，进去以后找到ingress资源的yaml文件内容并复制代码
- 进入k8s集群并vi任意yaml文件粘贴代码
[student@vms20 ~]$ kubectl config use-context k8s
Switched to context “k8s”.
- 需要在name下面增加一行
namespace，指定名称和ns后，修改下面的path和path下面name和port即可
最后生成
[student@vms20 ~]$ vi 7.yaml
[student@vms20 ~]$ cat 7.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: pong
namespace: ing-internal
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /
kubernetes.io/ingress.class: “nginx”
spec:
rules:
- http:
paths:
- path: /hello
pathType: Prefix
backend:
service:
name: hello
port:
number: 5678
[student@vms20 ~]$
[student@vms20 ~]$ kubectl apply -f 7.yaml
ingress.networking.k8s.io/pong created
[student@vms20 ~]$
[student@vms20 ~]$ kubectl get ingress -n ing-internal
NAME CLASS HOSTS ADDRESS PORTS AGE
pong * 80 24s
- 测试
测试前需要查看ingress的ip，用下面方法，等待一会后ADDRESS 下面会出现一个ip
然后：curl -kL < INTERNAL_IP>/hello/即可看到内容了，然后本题就完了
[student@vms20 ~]$ kubectl get ingress -n ing-internal
NAME CLASS HOSTS ADDRESS PORTS AGE
pong * 192.168.26.23 80 66s
[student@vms20 ~]$ curl -KL 192.168.26.23/hello/
hello
[student@vms20 ~]$
========================================================================
设置配置环境kubectl config use-context k8s
Task
将deployment 从webserver 扩展至6pods
- 修改命令
kubectl scale deployment webserver --replicas=6
[student@vms20 ~]$ kubectl config use-context k8s
Switched to context “k8s”.
[student@vms20 ~]$
[student@vms20 ~]$ kubectl get deployments
NAME READY UP-TO-DATE AVAILABLE AGE
cpupod 3/3 3 3 28d
front-end 1/1 1 1 28d
webserver 1/1 1 1 28d
[student@vms20 ~]$ kubectl scale deployment webserver --replicas=6
deployment.apps/webserver scaled
[student@vms20 ~]$
[student@vms20 ~]$ kubectl get deployments
NAME READY UP-TO-DATE AVAILABLE AGE
cpupod 3/3 3 3 28d
front-end 1/1 1 1 28d
webserver 1/6 6 1 28d
[student@vms20 ~]$ kubectl get deployments
NAME READY UP-TO-DATE AVAILABLE AGE
cpupod 3/3 3 3 28d
front-end 1/1 1 1 28d
webserver 3/6 6 3 28d
[student@vms20 ~]$ kubectl get deployments
NAME READY UP-TO-DATE AVAILABLE AGE
cpupod 3/3 3 3 28d
front-end 1/1 1 1 28d
webserver 6/6 6 6 28d
[student@vms20 ~]$
========================================================================
设置配置环境kubectl config use-context k8s
Task
按如下要求调度一个pod：
名称：nginx-kusc00401
image: nginx
Node selector: disk=ssd
- 用命令生成吧
kubectl run nginx-kusc00401 --image=nginx --dry-run=client -o yaml > 9.yaml
生成以后呢在编辑配置文件，在spec下面增加一行指定标签即可，然后创建pod，该题就结束了
[student@vms20 ~]$ kubectl config use-context k8s
Switched to context “k8s”.
[student@vms20 ~]$
[student@vms20 ~]$ kubectl run nginx-kusc00401 --image=nginx --dry-run=client -o yaml > 9.yaml
[student@vms20 ~]$ vi 9.yaml
[student@vms20 ~]$ cat 9.yaml
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
run: nginx-kusc00401
name: nginx-kusc00401
spec:
nodeSelector:
disk: ssd
containers:
- image: nginx
name: nginx-kusc00401
resources: {}
dnsPolicy: ClusterFirst
restartPolicy: Always
status: {}
[student@vms20 ~]$
[student@vms20 ~]$ kubectl apply -f 9.yaml
pod/nginx-kusc00401 created
[student@vms20 ~]$ kubectl get pods | grep kusc004
nginx-kusc00401 1/1 Running 0 5s
[student@vms20 ~]$
- 测试环境加上
imagePullPolicy: IfNotPresent否则下载镜像太慢了
=========================================================================
设置配置环境kubectl config use-context k8s
Task
检查有多少个worker nodes 已准备就绪（不包括被打上Taint: NoSchedule 的节点），并将数
量写入/opt/KUSC00402/kusc00402.txt
- 这个题呢，实际上就是查看node状态，为Ready且没有NoSchedule污点的即可
[student@vms20 ~]$ kubectl config use-context k8s
Switched to context “k8s”.
[student@vms20 ~]$
[student@vms20 ~]$ kubectl get nodes
NAME STATUS ROLES AGE VERSION
vms21.rhce.cc Ready control-plane,master 29d v1.22.2
vms22.rhce.cc Ready 29d v1.22.2
vms23.rhce.cc Ready 29d v1.22.2
[student@vms20 ~]$
#其实上面命令已经可以看出来了，下面这个只是验证下而已
[student@vms20 ~]$ kubectl describe node vms21.rhce.cc | grep Taint
Taints: node-role.kubernetes.io/master:NoSchedule
[student@vms20 ~]$ kubectl describe node vms22.rhce.cc | grep Taint
Taints:
[student@vms20 ~]$ kubectl describe node vms23.rhce.cc | grep Taint
Taints:
[student@vms20 ~]$
直接将数量写入题目中的路径即可
[student@vms20 ~]$ echo 2 > /opt/KUSC00402/kusc00402.txt
-bash: /opt/KUSC00402/kusc00402.txt: 权限不够
[student@vms20 ~]$
- 提示权限不够，处理方法如下
进入root使用：chmod -R o+w file给权限
[student@vms20 ~]$ sudo -i
[root@vms20 ~]# chmod -R o+w /opt/KUSC00402/
[root@vms20 ~]# exit
登出
[student@vms20 ~]$ echo 2 > /opt/KUSC00402/kusc00402.txt
[student@vms20 ~]$
[student@vms20 ~]$ cat /opt/KUSC00402/kusc00402.txt
2
[student@vms20 ~]$
=========================================================================
设置配置环境kubectl config use-context k8s
Task
创建一个名字为kucc4 的pod，在pod 里面分别为以下每个images 单独运行一个app container
（可能会有1-4 个images）：
nginx+redis+memcached+consul
- 我们进入k8s集群后可以先生成一个yaml文件
[student@vms20 ~]$ kubectl config use-context k8s
Switched to context “k8s”.
[student@vms20 ~]$
[student@vms20 ~]$ kubectl run kucc4 --image=nginx --dry-run=client -o yaml > 11.yaml
[student@vms20 ~]$ cat 11.yaml
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
run: kucc4
name: kucc4
spec:
containers:
- image: nginx
name: kucc4
resources: {}
dnsPolicy: ClusterFirst
restartPolicy: Always
status: {}
[student@vms20 ~]$
- 然后编辑这个yaml文件，增加镜像内容即可【题目就几个就增加即可】image-resources为一组
因为镜像名称没有指定，所以我们可以自定义名称，最终得到下面这个yaml文件
[student@vms20 ~]$ cat 11.yaml
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
run: kucc4
name: kucc4
spec:
containers:
- image: nginx
name: c1
resources: {}
- image: redis
name: c2
resources: {}
- image: memcached
name: c3
resources: {}
- image: consul
name: c4
resources: {}
dnsPolicy: ClusterFirst
restartPolicy: Always
status: {}
[student@vms20 ~]$
- 然后生成，全部为run即正常，此题结束
[student@vms20 ~]$ kubectl apply -f 11.yaml
pod/kucc4 created
[student@vms20 ~]$ kubectl get pods | grep kucc4
kucc4 4/4 Running 0 10s
[student@vms20 ~]$
- 测试环境需要加上：
imagePullPolicy: IfNotPresent
===============================================================================
设置配置环境kubectl config use-context k8s kubectl config use-context hk8s
Task
创建名为app-data 的persistent volume，容量为1Gi，访问模式为ReadWriteMany。volume
类型为hostPath，位于/srv/app-data
- 官网搜索
persist，下拉，找到持久卷并复制代码
- 进入k8s集群并vi任意yaml文件粘贴代码
[student@vms20 ~]$ kubectl config use-context k8s
Switched to context “k8s”.
[student@vms20 ~]$
[student@vms20 ~]$ vi 12.yaml
[student@vms20 ~]$ cat 12.yaml
apiVersion: v1
kind: PersistentVolume
metadata:
name: pv0003
spec:
capacity:
storage: 5Gi
volumeMode: Filesystem
accessModes:
- ReadWriteOnce
persistentVolumeReclaimPolicy: Recycle
storageClassName: slow
mountOptions:
-
hard
-
nfsvers=4.1
nfs:
path: /tmp
server: 172.17.0.2
[student@vms20 ~]$
- 根据题目需求，得到如下yaml文件
1、修改name
2、修改storage
3、修改accessmodes选项
4、修改nfs类型为hostpath并指定路径
5、删除多余项内容
[student@vms20 ~]$ cat 12.yaml
apiVersion: v1
kind: PersistentVolume
metadata:
name: app-data
spec:
capacity:
storage: 1Gi
volumeMode: Filesystem
accessModes:
- ReadWriteMany
persistentVolumeReclaimPolicy: Recycle
hostPath:
path: /srv/app-data
[student@vms20 ~]$
[student@vms20 ~]$ kubectl apply -f 12.yaml
persistentvolume/app-data created
[student@vms20 ~]$
[student@vms20 ~]$ kubectl get pv
NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS REASON AGE
app-data 1Gi RWX Recycle Available 16s
[student@vms20 ~]$
===============================================================================
设置配置环境kubectl config use-context k8s ok8s
Task
创建一个新的PersistentVolumeClaim：
名称：pvvolume
class：csi-hostpath-sc
容量：10Mi
创建一个新的pod，此pod 将作为volume 挂载到PersistentVolumeClaim：
名称：web-server
image: nginx
挂载路径: /usr/share/nginx/html
配置新的pod，以对volume 具有ReadWriteOnce 权限。
最后，使用kubectl edit 或者kubectl patch 将PersistentVolumeClaim 的容量扩展为70Mi，并
记录此次更改。
- 官网搜索
persist【和12题在一个页面】，下拉，找到persisten…并复制代码
- 进入k8s集群并vi任意yaml文件粘贴代码
[student@vms20 ~]$ kubectl config use-context k8s
Switched to context “k8s”.
[student@vms20 ~]$
[student@vms20 ~]$ vi 13.yaml
[student@vms20 ~]$ cat 13.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: myclaim
spec:
accessModes:
- ReadWriteOnce
volumeMode: Filesystem
resources:
requests:
storage: 8Gi
storageClassName: slow
selector:
matchLabels:
release: “stable”
matchExpressions:
- {key: environment, operator: In, values: [dev]}
[student@vms20 ~]$
-
根据题目需求，得到如下yaml文件
-
1、修改name
-
2、修改accessmodes【下面创建pod有说指定为readwriteonce
-
3、修改大小
-
4、指定classname
-
5、下面用不到的删掉
[student@vms20 ~]$ vi 13.yaml
[student@vms20 ~]$ cat 13.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: pvvolume
spec:
accessModes:
- ReadWriteOnce
volumeMode: Filesystem
resources:
requests:
storage: 10Mi
storageClassName: csi-hostpath-sc
[student@vms20 ~]$
[student@vms20 ~]$ kubectl apply -f 13.yaml
persistentvolumeclaim/pvvolume created
[student@vms20 ~]$
[student@vms20 ~]$ kubectl get pvc
NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS AGE
pvvolume Bound pvc-c3ca5b13-206e-43cc-8982-983f4cc8fbe7 10Mi RWO csi-hostpath-sc 111s
[student@vms20 ~]$
[student@vms20 ~]$ kubectl get pv
NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS REASON AGE
app-data 1Gi RWX Recycle Available 8m25s
pvc-c3ca5b13-206e-43cc-8982-983f4cc8fbe7 10Mi RWO Delete Bound default/pvvolume csi-hostpath-sc 5s
[student@vms20 ~]$
- 上面进入的官网文档界面继续往下拉，然后复制
使用申领作为卷的yaml内容
- vi任意yaml文件并编辑，最终得到如下yaml文件
这个比较直观，不需要删代码，只需要修改几个值就行
-
1、3个name改为web-server
-
2、修改mountpath
-
3、修改cliamname为上面创建的PersistentVolumeClaim名称
[student@vms20 ~]$ cat 13-2.yaml
apiVersion: v1
kind: Pod
metadata:
name: web-server
spec:
containers:
- name: myfrontend
image: nginx
volumeMounts:
- mountPath: “/usr/share/nginx/html”
name: web-server
volumes:
- name: web-server
persistentVolumeClaim:
claimName: pvvolume
[student@vms20 ~]$
[student@vms20 ~]$ kubectl apply -f 13-2.yaml
pod/web-server created
[student@vms20 ~]$
[student@vms20 ~]$ kubectl get pods | grep web-server
web-server 1/1 Running 0 71s
[student@vms20 ~]$
扫一扫
3556
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
