CC00229.CloudKubernetes——|KuberNetes&细粒度权限控制.V13|——|Ratel.v01|k8s资源管理平台部署|

yanqi_vip

已于 2022-04-02 16:37:11 修改

阅读量275

点赞数

分类专栏： cloudv017——kubernetes.v002 文章标签： docker kubernetes mongodb 运维 git

于 2022-03-31 13:01:00 首次发布

不予转载

本文链接：https://blog.csdn.net/yanqi_vip/article/details/123874741

版权

cloudv017——kubernetes.v002 专栏收录该内容

417 篇文章 9 订阅

订阅专栏

一、k8s资源管理平台Ratel

### --- ratel官方hub地址：

~~~     https://github.com/dotbalo/ratel-doc

二、安装Ratel

### --- 创建secret 
~~~     # 安装Ratel

[root@k8s-master01 ~]# mkdir ratel  
[root@k8s-master01 ~]# cd ratel

### --- 创建servers.yaml文件

[root@k8s-master01 ratel]# vim servers.yaml
- serverName: 'test1'
  serverAddress: 'https://192.168.1.20:8443'
  #serverAdminUser: 'xxx'
  #serverAdminPassword: 'xxx#'
  serverAdminToken: 'null'
  serverDashboardUrl: "https://k8s.test1.com.cn/#"
  production: 'false'
  kubeConfigPath: "/mnt/test1.config"
~~~     注：
- serverName: 'test1'
  serverAddress: 'https://192.168.1.20:8443'       # 因为没有配置账号密码，也没有使用token，直接配置 kubeConfigPath即可
  #serverAdminUser: 'xxx'
  #serverAdminPassword: 'xxx#'
  serverAdminToken: 'null'
  serverDashboardUrl: "https://k8s.test1.com.cn/#" # 该工具会使用到原生的dashboard，可以配置上该地址
  production: 'false'                       
  kubeConfigPath: "/mnt/test1.config"              # 因为我们是基于kubeconfig这个文件去访问的，所以只需要配置这个文件即可

~~~     # 查询serveraddress的地址

[root@k8s-master01 ~]# kubectl cluster-info
Kubernetes control plane is running at https://192.168.1.20:8443
CoreDNS is running at https://192.168.1.20:8443/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy

### --- kube/config文件copy到当前目录并定义为test1.config
~~~     这个文件名字和kubeConfigPath:文件名保持一致

[root@k8s-master01 ratel]# cp /root/.kube/config test1.config

### --- 创建一个secret

~~~     多个集群的话可以加入进去，这个可以动态加入的
~~~     注：创建的这个secret会挂载到这个deployment的文件中，
~~~     这个deployment就可以读取到这个secret，
~~~     启动之后就可以把这个集群给挂载进去

[root@k8s-master01 ratel]# kubectl create secret generic ratel-config  --from-file=test1.config --from-file=servers.yaml -n kube-system
secret/ratel-config created

三、创建RBAC

### --- 创建权限管理namespace

[root@k8s-master01 ratel]# kubectl create ns kube-users
namespace/kube-users created

### --- 然后添加如下的ClusterroleBinding

[root@k8s-master01 ratel]# vim ratel-rbac.yaml
apiVersion: v1
items:
- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    annotations:
      rbac.authorization.kubernetes.io/autoupdate: "true"
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
      rbac.authorization.k8s.io/aggregate-to-edit: "true"
    name: ratel-namespace-readonly
  rules:
  - apiGroups:
    - ""
    resources:
    - namespaces
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - metrics.k8s.io
    resources:
    - pods
    verbs:
    - get
    - list
    - watch
- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: ratel-pod-delete
  rules:
  - apiGroups:
    - ""
    resources:
    - pods
    verbs:
    - get
    - list
    - delete
- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: ratel-pod-exec
  rules:
  - apiGroups:
    - ""
    resources:
    - pods
    - pods/log
    verbs:
    - get
    - list
  - apiGroups:
    - ""
    resources:
    - pods/exec
    verbs:
    - create
- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    annotations:
      rbac.authorization.kubernetes.io/autoupdate: "true"
    name: ratel-resource-edit
  rules:
  - apiGroups:
    - ""
    resources:
    - configmaps
    - persistentvolumeclaims
    - services
    - services/proxy
    verbs:
    - patch
    - update
  - apiGroups:
    - apps
    resources:
    - daemonsets
    - deployments
    - deployments/rollback
    - deployments/scale
    - statefulsets
    - statefulsets/scale
    verbs:
    - patch
    - update
  - apiGroups:
    - autoscaling
    resources:
    - horizontalpodautoscalers
    verbs:
    - patch
    - update
  - apiGroups:
    - batch
    resources:
    - cronjobs
    - jobs
    verbs:
    - patch
    - update
  - apiGroups:
    - extensions
    resources:
    - daemonsets
    - deployments
    - deployments/rollback
    - deployments/scale
    - ingresses
    - networkpolicies
    verbs:
    - patch
    - update
  - apiGroups:
    - networking.k8s.io
    resources:
    - ingresses
    - networkpolicies
    verbs:
    - patch
    - update
- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: ratel-resource-readonly
  rules:
  - apiGroups:
    - ""
    resources:
    - configmaps
    - endpoints
    - persistentvolumeclaims
    - pods
    - replicationcontrollers
    - replicationcontrollers/scale
    - serviceaccounts
    - services
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    resources:
    - bindings
    - events
    - limitranges
    - namespaces/status
    - pods/log
    - pods/status
    - replicationcontrollers/status
    - resourcequotas
    - resourcequotas/status
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    resources:
    - namespaces
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - apps
    resources:
    - controllerrevisions
    - daemonsets
    - deployments
    - deployments/scale
    - replicasets
    - replicasets/scale
    - statefulsets
    - statefulsets/scale
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - autoscaling
    resources:
    - horizontalpodautoscalers
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - batch
    resources:
    - cronjobs
    - jobs
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - extensions
    resources:
    - daemonsets
    - deployments
    - deployments/scale
    - ingresses
    - networkpolicies
    - replicasets
    - replicasets/scale
    - replicationcontrollers/scale
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - policy
    resources:
    - poddisruptionbudgets
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - networking.k8s.io
    resources:
    - networkpolicies
    - ingresses
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - metrics.k8s.io
    resources:
    - pods
    verbs:
    - get
    - list
    - watch
kind: List
metadata:
  resourceVersion: ""
  selfLink: ""

### --- 创建ratel.rbac

[root@k8s-master01 ratel]# kubectl create -f ratel-rbac.yaml
clusterrole.rbac.authorization.k8s.io/ratel-namespace-readonly created
clusterrole.rbac.authorization.k8s.io/ratel-pod-delete created
clusterrole.rbac.authorization.k8s.io/ratel-pod-exec created
clusterrole.rbac.authorization.k8s.io/ratel-resource-edit created
clusterrole.rbac.authorization.k8s.io/ratel-resource-readonly created

### --- 创建rabtel-rbac-binding

[root@k8s-master01 ratel]# vim ratel-rbac-binding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: ratel-namespace-readonly-sa
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ratel-namespace-readonly
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:serviceaccounts:kube-users
[root@k8s-master01 ratel]# kubectl create -f ratel-rbac-binding.yaml
clusterrolebinding.rbac.authorization.k8s.io/ratel-namespace-readonly-sa created

四、部署Ratel

### --- 创建yaml文件

~~~     # 需要更改的内容如下:
~~~     ProRunMode: 区别在于dev模式打印的是debug日志, 其他模式是info级别的日志, 实际使用时应该配置为非dev
~~~     ADMIN_USERNAME: ratel自己的管理员账号
~~~     ADMIN_PASSWORD: ratel自己的管理员密码
~~~     实际使用时账号密码应满足复杂性要求,因为ratel可以直接操作所有配置的资源。
~~~     其他无需配置, 端口配置暂不支持。

[root@k8s-master01 ratel]# vim ratel.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: ratel
  name: ratel
  namespace: kube-system
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ratel
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
    type: RollingUpdate
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: ratel
    spec:
      containers:
        - command:
            - sh
            - -c
            - ./ratel -c /mnt/servers.yaml  # 启动的时候就 指定指定了这个文件
          env:
            - name: TZ
              value: Asia/Shanghai
            - name: LANG
              value: C.UTF-8
            - name: ProRunMode
              value: prod
            - name: ADMIN_USERNAME          # 管理员账号
              value: admin
            - name: ADMIN_PASSWORD          # 管理员密码
              value: password
          image: registry.cn-beijing.aliyuncs.com/dotbalo/ratel:latest
          imagePullPolicy: Always           # 设置为Always，开发者每次更新功能都会推到这个镜像上
          livenessProbe:
            failureThreshold: 2
            initialDelaySeconds: 10
            periodSeconds: 60
            successThreshold: 1
            tcpSocket:
              port: 8888
            timeoutSeconds: 2
          name: ratel
          ports:
            - containerPort: 8888
              name: web
              protocol: TCP
          readinessProbe:
            failureThreshold: 2
            initialDelaySeconds: 10
            periodSeconds: 60
            successThreshold: 1
            tcpSocket:
              port: 8888
            timeoutSeconds: 2
          resources:
            limits:
              cpu: 500m
              memory: 512Mi
            requests:
              cpu: 500m
              memory: 512Mi
          volumeMounts:
            - mountPath: /mnt                # /mnt/servers.yaml这个文件就是我们挂载到了mnt下
              name: ratel-config
      dnsPolicy: ClusterFirst
#      imagePullSecrets:                     # 这个secret是没有的，没有直接去掉即可
#        - name: myregistrykey
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      terminationGracePeriodSeconds: 30
      volumes:
        - name: ratel-config
          secret:
            defaultMode: 420
            secretName: ratel-config

### --- 创建Ratel

[root@k8s-master01 ratel]# kubectl create -f ratel.yaml -n kube-system
deployment.apps/ratel created
[root@k8s-master01 ratel]# kubectl get po -n kube-system
NAME                                       READY   STATUS              RESTARTS   AGE
ratel-85bd5d5697-2h65z                     0/1     ContainerCreating   0          30s

~~~     # 拉取镜像阶段

[root@k8s-master01 ratel]# kubectl get po -n kube-system -owide
NAME                                       READY   STATUS    RESTARTS   AGE     IP               NODE           NOMINATED NODE   READINESS GATES
ratel-85bd5d5697-2h65z                     0/1     Running   0          77s     172.25.244.202   k8s-master01   <none>           <none>

五、service和Ingress配置

~~~     # 注意：如果没有安装ingress controller，
~~~     需要把type: ClusterIP改成type: NodePort，然后通过主机IP+Port进行访问
### --- 编写service和ingress的yaml文件

[root@k8s-master01 Ratel]# vim ratel-svc.yaml
apiVersion: v1
kind: Service 
metadata:
  labels: 
    app: ratel
  name: ratel
  namespace: kube-system
spec:   
  ports:  
    - name: container-1-web-1
      port: 8888
      protocol: TCP
      targetPort: 8888
  selector:
    app: ratel
  type: ClusterIP
---                             # 写在一起使用---来划分
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ratel
  namespace: kube-system
spec:
  rules:
  - host: krm.test.com
    http:
      paths:
      - backend:
          serviceName: ratel
          servicePort: 8888
        path: /

### --- 创建service和ingress

[root@k8s-master01 ratel]# kubectl create -f ratel-svc.yaml -n kube-system
ingress.extensions/ratel created

### --- 查看创建的资源

[root@k8s-master01 ratel]# kubectl get svc,ingress,po -n kube-system
NAME                     TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                  AGE
service/ratel            ClusterIP   10.105.168.163   <none>        8888/TCP                 4m50s
NAME                              CLASS    HOSTS          ADDRESS        PORTS   AGE
ingress.networking.k8s.io/ratel   <none>   krm.test.com   10.107.59.89   80      4m49s
NAME                                           READY   STATUS    RESTARTS   AGE
pod/ratel-85bd5d5697-2h65z                     1/1     Running   0          17m

yanqi_vip

关注

0
点赞
踩
2

收藏

觉得还不错? 一键收藏
打赏
0
评论
CC00229.CloudKubernetes——|KuberNetes&细粒度权限控制.V13|——|Ratel.v01|k8s资源管理平台部署|

一、k8s资源管理平台Ratel### --- ratel官方hub地址：~~~ https://github.com/dotbalo/ratel-doc二、安装Ratel### --- 创建secret ~~~ # 安装Ratel[root@k8s-master01 ~]# mkdir ratel [root@k8s-mast...
复制链接

扫一扫