k8s理论学习
部分内容未声明版权,敬请谅解!
2021/10/25 k8s 工作流程
namepace、node、pod
当我们讨论 k8s 时总是会讨论集群,k8s 中的每个集群由多个机器/虚拟机组成,集群也被称为 命名空间(namespace),命名空间是虚拟的,因此也叫虚拟集群。
Namespace 是对一组资源和对象的抽象集合。
node 是集群中的单个机器/虚拟机,node 有两种,一种是 master ,一种是 worker。master 用来运行 kubernetes 服务,例如 API Server;worker 是真正工作的节点,用来运行你的容器。
master 节点控制其它节点,向 worker 节点发送消息,将工作分配给他们,worker 节点向 master 节点汇报工作。
每个节点上运行着多个服务,有时 服务A 和 服务B 是关联起来的,需要一起启动一起注销,那么可以设置为一个 pod。pod 是逻辑分组,是 k8s 中独立的、隔离的最小的工作单元。pod 中可以有一个或多个容器/服务,pod 允许你把多个容器结合起来,指导这些容器如何组合创建应用程序。
多个 pod 可以组成一个 service ,service 提供了一个单一的 IP 地址和 DNS 名称,可以通过它访问 service 内的所有 pod(所以是一个pod中部署的容器或服务应该是有关联的吗)。有了 service 我们可以很容易的设置和管理负载均衡。
** 之前我好像看到过“一个node上可以有多个prod,但一个prod只能部署在一个node上” **
k8s实例
1.安装流程
版权声明:本文为CSDN博主「叁滴水」的原创文章,遵循CC 4.0 BY-SA版权协议,转载请附上原文出处链接及本声明。
原文链接:https://blog.csdn.net/qq_30285985/article/details/113752034
1)准备工作
关闭防火墙:systemctl stop firewalld
关闭swap(k8s禁止虚拟内存以提高性能):swapoff -a
关闭selinux(服务器没这个应用程序,可忽略):setenforce 0
2)配置阿里镜像源:/etc/yum.repos.d/kubernetes.repo
https://blog.csdn.net/curry10086/article/details/107579113
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
3)下载v1.19.15 版k8s安装kubeadm,kubectl,kubelet
yum install -y kubelet-1.19.15
yum install -y kubeadm-1.19.15
yum install -y kubectl-1.19.15
卸载不匹配版本k8s的kubelet组件,使用rpm -qa | egrep kubelet列出kubelet组件安装包的全名,然后使用yum remove kubelet-1.19.4-0.x86_64卸载安装包即可。
4)下载k8s相关组件的容器
https://blog.csdn.net/curry10086/article/details/107579113
获取所要求的镜像信息:kubeadm config images list
I1103 14:26:20.045777 19581 version.go:252] remote version is much newer: v1.22.3; falling back to: stable-1.19
W1103 14:26:21.221020 19581 configset.go:348] WARNING: kubeadm cannot validate component configs for API groups [kubelet.config.k8s.io kubeproxy.config.k8s.io]
k8s.gcr.io/kube-apiserver:v1.19.16
k8s.gcr.io/kube-controller-manager:v1.19.16
k8s.gcr.io/kube-scheduler:v1.19.16
k8s.gcr.io/kube-proxy:v1.19.16
k8s.gcr.io/pause:3.2
k8s.gcr.io/etcd:3.4.13-0
k8s.gcr.io/coredns:1.7.0
依次拉去相关镜像:docker pull registry.cn-hangzhou.aliyuncs.com/google_containers/组件名:版本号
例:docker pull registry.cn-hangzhou.aliyuncs.com/google_containers/kube-proxy:v1.14.2
改为所需镜像名
docker tag registry.aliyuncs.com/google_containers/kube-proxy:v1.14.2 k8s.gcr.io/kube-proxy:v1.14.2
,先从google下载镜像,在改为k8s的对应名称即可
5)IP选自己的网段,这里只有172.24.21.186 izuf6d8625u9fcx4v9r6kqz生效,不知道为什么
cat >> /etc/hosts << EOF
172.24.21.186 izuf6d8625u9fcx4v9r6kqz
172.24.21.186 k8smaster
172.24.21.186 k8snode
EOF
6)初始化集群
https://blog.csdn.net/curry10086/article/details/107579113
step1:初始化master节点
kubeadm init (–apiserver-advertise-address=172.24.21.186 --image-repository registry.aliyuncs.com/google_containers) --kubernetes-version=v1.19.15 --pod-network-cidr=10.244.0.0/16 --service-cidr=10.96.0.0/12 --ignore-preflight-errors=Swap
若出错的,把–apiserver-advertise-address=172.24.21.186去掉
step2:加入worker节点
https://www.cnblogs.com/CoderLinkf/p/12395710.html
https://blog.csdn.net/boss2967/article/details/103474340
https://www.cnblogs.com/liuyi778/p/12229416.html
删除文件或文件夹,消除占用port后,连master节点也不能用了
7)kubectl get nodes
查看的时候所有的节点是NotReady状态
此时,执行kubectl apply -f kube-flannel.yml,会报错,没有该文件
直接创建kube-flannel.yml,
然后,再执行kubectl apply -f kube-flannel.yml,稍等后,
再执行kubectl get nodes,查看的时候所有的节点是Ready状态
https://www.cnblogs.com/CoderLinkf/p/12395710.html(有获取的链接)
NAME STATUS ROLES AGE VERSION
izuf6d8625u9fcx4v9r6kqz Ready master 56s v1.19.4
kube-flannel.yml
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: psp.flannel.unprivileged
annotations:
seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default
seccomp.security.alpha.kubernetes.io/defaultProfileName: docker/default
apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
spec:
privileged: false
volumes:
- configMap
- secret
- emptyDir
- hostPath
allowedHostPaths:
- pathPrefix: "/etc/cni/net.d"
- pathPrefix: "/etc/kube-flannel"
- pathPrefix: "/run/flannel"
readOnlyRootFilesystem: false
# Users and groups
runAsUser:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
fsGroup:
rule: RunAsAny
# Privilege Escalation
allowPrivilegeEscalation: false
defaultAllowPrivilegeEscalation: false
# Capabilities
allowedCapabilities: ['NET_ADMIN', 'NET_RAW']
defaultAddCapabilities: []
requiredDropCapabilities: []
# Host namespaces
hostPID: false
hostIPC: false
hostNetwork: true
hostPorts:
- min: 0
max: 65535
# SELinux
seLinux:
# SELinux is unused in CaaSP
rule: 'RunAsAny'
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: flannel
rules:
- apiGroups: ['extensions']
resources: ['podsecuritypolicies']
verbs: ['use']
resourceNames: ['psp.flannel.unprivileged']
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- apiGroups:
- ""
resources:
- nodes
verbs:
- list
- watch
- apiGroups:
- ""
resources:
- nodes/status
verbs:
- patch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: flannel
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: flannel
subjects:
- kind: ServiceAccount
name: flannel
namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: flannel
namespace: kube-system
---
kind: ConfigMap
apiVersion: v1
metadata:
name: kube-flannel-cfg
namespace: kube-system
labels:
tier: node
app: flannel
data:
cni-conf.json: |
{
"name": "cbr0",
"cniVersion": "0.3.1",
"plugins": [
{
"type": "flannel",
"delegate": {
"hairpinMode": true,
"isDefaultGateway": true
}
},
{
"type": "portmap",
"capabilities": {
"portMappings": true
}
}
]
}
net-conf.json: |
{
"Network": "10.244.0.0/16",
"Backend": {
"Type": "vxlan"
}
}
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: kube-flannel-ds
namespace: kube-system
labels:
tier: node
app: flannel
spec:
selector:
matchLabels:
app: flannel
template:
metadata:
labels:
tier: node
app: flannel
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/os
operator: In
values:
- linux
hostNetwork: true
priorityClassName: system-node-critical
tolerations:
- operator: Exists
effect: NoSchedule
serviceAccountName: flannel
initContainers:
- name: install-cni
image: quay.io/coreos/flannel:v0.13.0
command:
- cp
args:
- -f
- /etc/kube-flannel/cni-conf.json
- /etc/cni/net.d/10-flannel.conflist
volumeMounts:
- name: cni
mountPath: /etc/cni/net.d
- name: flannel-cfg
mountPath: /etc/kube-flannel/
containers:
- name: kube-flannel
image: quay.io/coreos/flannel:v0.13.0
command:
- /opt/bin/flanneld
args:
- --ip-masq
- --kube-subnet-mgr
resources:
requests:
cpu: "100m"
memory: "50Mi"
limits:
cpu: "100m"
memory: "50Mi"
securityContext:
privileged: false
capabilities:
add: ["NET_ADMIN", "NET_RAW"]
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
volumeMounts:
- name: run
mountPath: /run/flannel
- name: flannel-cfg
mountPath: /etc/kube-flannel/
volumes:
- name: run
hostPath:
path: /run/flannel
- name: cni
hostPath:
path: /etc/cni/net.d
- name: flannel-cfg
configMap:
name: kube-flannel-cfg
2021/10/26 k8s部署deployment
1.因为,创建k8s集群时,无法加入worker节点,所以新建的prod要放在master上,这就需要master允许部署pod(depolyment)
https://www.jianshu.com/p/e14e5a704eda
https://www.jianshu.com/p/09356acd6991
kubectl taint node izuf6d8625u9fcx4v9r6kqz key1=value1:NoSchedule(k8s容忍master上的污点,即容忍在master上建立pod)
2.创建deployment
kubectl create deployment testnginx --image=nginx:latest
3.部署服务
kubectl expose deployment testnginx --port=80 --type=NodePort
4.访问服务:curl “http://172.24.21.186:32078”
发现service拒绝访问
原因:pod不能容忍master节点上的污点,没有成功部署到master节点,testnginx-589d46898d-rrq9c的ready状态为0
[root@iZuf6d8625u9fcx4v9r6kqZ /]# kubectl get pod,svc -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
pod/nginx-0 0/1 Pending 0 15m <none> <none> <none> <none>
pod/testnginx-589d46898d-rrq9c 0/1 ContainerCreating 0 6s <none> izuf6d8625u9fcx4v9r6kqz <none> <none>
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
service/kubernetes ClusterIP 10.96.0.1 <none> 443/TCP 93m <none>
service/testnginx NodePort 10.102.187.158 <none> 80:30202/TCP 14m app=testnginx
解决办法:修改pod的yaml,让其可容忍node上的污点
先得到yaml:kubectl get deployments testnginx -o yaml > nginx.yaml
修改yaml:
主要是添加最后的两行,"Exists"表示容忍任意node的污点
修改完yaml,创建deployment及Service: kubectl create -f nginx.yaml (该命令有些慢,要等一下)
https://blog.frognew.com/2018/05/taint-and-toleration.html
补充:这里pod要设置toleration的原因是想让master成为一个worker node,所以给他添加一个污点,从而导致了要部署到该节点的pod也得容忍这些污点;所以可以尝试https://www.cnblogs.com/UncleZhao/p/14646127.html提到的方法将master节点设置成worker node,查看是否还要再配置pod容忍污点taint
apiVersion: apps/v1
kind: Deployment
metadata:
annotations:
deployment.kubernetes.io/revision: "1"
creationTimestamp: "2021-11-03T07:03:13Z"
generation: 1
labels:
app: testnginx
name: testnginx
namespace: default
resourceVersion: "4473"
selfLink: /apis/apps/v1/namespaces/default/deployments/testnginx
uid: cbaf93f7-5f3c-4e97-b5e5-756b15b73ad4
spec:
progressDeadlineSeconds: 600
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
app: testnginx
strategy:
rollingUpdate:
maxSurge: 25%
maxUnavailable: 25%
type: RollingUpdate
template:
metadata:
creationTimestamp: null
labels:
app: testnginx
spec:
containers:
- image: nginx:latest
imagePullPolicy: Always
name: nginx
resources: {}
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
dnsPolicy: ClusterFirst
restartPolicy: Always
schedulerName: default-scheduler
securityContext: {}
terminationGracePeriodSeconds: 30
tolerations:
- operator: "Exists"