补充信息
#补全
# apt install bash-completion
source <(kubectl completion bash)# kubectl config get-contexts
# cat ~/.kube/config |grep current# kubectl config current-context
kubectl config use-context复制粘贴 ctrl+shift+c ctrl+shift+v
# edit编辑时只能使用空格，不要TAB否则保存不了
Day1-RBAC 授权
SA
RBAC
cani
Authorization Overview | Kubernetes
创建一个名为 deployment-clusterrole 且仅允许创建以下资源类型的新ClusterRole：
Deployment
StatefulSet
DaemonSet在现有的 namespace app-team中创建一个名为cicd-token的新 ServiceAccount。
限于 namespace app-team中，将新的ClusterRole deployment-clusterrole绑定到新的 ServiceAccount cicd-token。
# kubectl create ns app-team
# kubectl create clusterrole deployment-clusterrole --verb=create --resource=deployments,statefulsets,daemonsets
# kubectl create serviceaccount cicd-token -n app-team
# kubectl create rolebinding cicd-token-rolebinding --clusterrole=deployment-clusterrole --serviceaccount=app-team:cicd-token -n app-team #这里注意rolebinding的名称没指定 任取
测试服务账号（SA）权限：
kubectl --as=system:serviceaccount:app-team:cicd-token get pods -n app-team[root@ek8s-master 1]# kubectl --as=system:serviceaccount:app-team:cicd-token create deployment web --image=nginx:alpine -n app-team
deployment.apps/web created[root@ek8s-master 1]# kubectl get deployment -n app-team
NAME READY UP-TO-DATE AVAILABLE AGE
web 1/1 1 1 15s[root@ek8s-master 1]# kubectl --as=system:serviceaccount:app-team:cicd-token get deployment -n app-team
Error from server (Forbidden): deployments.apps is forbidden: User "system:serviceaccount:app-team:cicd-token" cannot list resource "deployments" in API group "apps" in the namespace "app-team"
[root@ek8s-master 1]# kubectl get pod -n app-team
NAME READY STATUS RESTARTS AGE
web-5bf684665b-w5hhf 1/1 Running 0 46s##测试
[root@ek8s-master 1]# kubectl --as=system:serviceaccount:app-team:cicd-token get pod
Error from server (Forbidden): pods is forbidden: User "system:serviceaccount:app-team:cicd-token" cannot list resource "pods" in API group "" in the namespace "default"https://kubernetes.io/zh-cn/docs/reference/access-authn-authz/authorization/#checking-api-access
##官网搜索关键词 can-i 可以找到格式
[root@ek8s-master 1]# kubectl auth can-i --as=system:serviceaccount:app-team:cicd-token create deployment -n app-team
yes
[root@ek8s-master 1]# kubectl auth can-i --as=system:serviceaccount:app-team:cicd-token create statefulset -n app-team
yes
[root@ek8s-master 1]# kubectl auth can-i --as=system:serviceaccount:app-team:cicd-token create daemonset -n app-team
yes
[root@ek8s-master 1]# kubectl auth can-i --as=system:serviceaccount:app-team:cicd-token get pod -n app-team
no
yaml:
# cat sa.yaml
apiVersion: v1
kind: ServiceAccount
metadata:name: cicd-tokennamespace: app-team
---
# cat clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:# "namespace" omitted since ClusterRoles are not namespacedname: deployment-clusterrole
rules:
- apiGroups: ["*"] #注意这里，官网没有resources: ["deployments","statefulSets","daemonSets"]verbs: ["create"]---
# cat rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:name: cicd-token-rolebindingnamespace: app-team
subjects:
- kind: ServiceAccountname: cicd-tokennamespace: app-team
roleRef:kind: ClusterRolename: deployment-clusterroleapiGroup: rbac.authorization.k8s.ioDay2-节点设置不可用
将名字为 ek8s-node-1 的节点设置为不可调度，同时驱逐运行在它上面的所有 Pods
#--> 切换到指定集群
# kubectl config use-context [NAME]
# kubectl cordon ek8s-node-1
# kubectl drain ek8s-node-1 --delete-emptydir-data --force --ignore-daemonsets
#--> 查看
kubectl get node备注：
–force 不被控制器 (RC、RS、Job、DaemonSet 或 StatefulSet) 管理的pod也会被强制删除
–ignore-daemonsets 表示不会驱逐 daemonset 管理的 Pods
–delete-emptydir-data 如果 pods 使用 emptyDir，也会继续被删除注：如果执行 drain 提示错误，根据提示再加上选项，例如--delete-local-data --force
Day3- K8s 升级
K8S升级
upgrade kubeadm
Upgrading kubeadm clusters | Kubernetes
给定运行版本1.22.1的现有Kubernetes集群，仅将主节点上的所有Kubernete控制平面和节点组件升级到版本1.22.2
您还需要在master节点上升级kubelet和kubectl。
确保drain主节点
在升级之前和升级后uncordon.
不要升级工作节点、etcd、容器管理器、CNI插件、DNS服务或任何其他插件
## 备注：要升级的集群中，只有一个 master 节点
#--> 切换到指定集群
kubectl config use-context [NAME]
#--> 查看当前集群的版本信息和要升级的节点名称
kubectl get node
#--> 登录到要升级的 master 节点
ssh master01
sudo su -
apt update && apt-cache madison kubeadm #查看对应的版本，一样可以查kubectl和kubeletapt-get update && apt-get install -y kubeadm=1.22.2-00 #注意这里是“=”如果异常可以添加参数：apt-get install -y --allow-change-held-packages kubeadm=1.22.2-00 #可以用man apt-get找到
#--> 检查 kubeadm 版本是否正确
kubeadm version
#--> 腾空控制面节点
kubectl drain master01 --force --delete-emptydir-data --ignore-daemonsets
#--> 查看可升级的版本信息
kubeadm upgrade plan
#--> 控制面板升级，etcd 不进行升级
kubeadm upgrade apply v1.22.2 --etcd-upgrade=false #可以kubeadm upgrade apply -h找到--etcd-upgrade参数
#--> 升级各个控制面节点上的 kubelet 和 kubectl 组件
apt-get update && apt-get install -y kubelet=1.22.2-00 kubectl=1.22.2-00
#--> 重启 kubelet
systemctl daemon-reload && systemctl restart kubelet
#--> 取消对控制面节点的保护
kubeadm uncordon master01
#--> 查看集群当前版本信息
kubectl get node
# kubectl version
# kubeadm version
# kubelet --version
##ubuntu
apt update
apt-cache madison kubeadm |grep 1.28.1
apt-get update && apt-get install -y --allow-change-held-packages kubeadm=1.25.1
kubeadm version
kubectl drain master --ignore-daemonsets --delete-local-data --force #腾空控制面节点
sudo kubeadm upgrade plan #命令查看可升级的版本信息
sudo kubeadm upgrade apply v1.25.1 --etcd-upgrade=false #查看版本信息时，排除etcd
kubectl uncordon master
sudo kubeadm upgrade node #命令查看控制面节点
apt-get update && apt-get install -y --allow-change-held-packages kubelet=1.25.1 kubectl=1.25.1
sudo systemctl daemon-reload
sudo systemctl restart kubelet
Day4- etcd 备份与恢复
为 Kubernetes 运行 etcd 集群 | Kubernetes
etcdctl
Operating etcd clusters for Kubernetes | Kubernetes
首先，创建运行于的现有etcd实例的快照https://127.0.0.1:2379，将快照保存到/var/lib/backup/etcd-snapshot.db
创建给定实例的快照预计将在几秒钟内完成。如果操作似乎挂起，那么您的命令可能有问题。使用CTRL+C取消操作，然后重试。
接下来，恢复位于/var/lib/backup/etcd-snapshot-previous.db的现有先前快照。数据库。
使用etcdctl连接到服务器时提供了以下TLS证书/密钥：CA证书：/opt/KUIN0061/CA.crt
客户端证书：/opt/KUIN0061/etcd-client.crt
客户端密钥：/opt/KUIN0061/etcd-client.key
#快照etcd 对应的参数可以去看etcd.yaml确认# ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/opt/KUIN00601/ca.crt --cert=/opt/KUIN00601/etcd-client.crt --key=/opt/KUIN00601/etcd-client.key snapshot save /var/lib/backup/etcd-snapshot.db#恢复
# ETCDCTL_API=3 etcdctl snapshot restore --data-dir=<data-dir-location> snapshotdb #官方# systemctl stop etcd #确认是systemctl拉起的etcd服务还是yaml，如果是yaml移除静态pod
# systemctl cat etcd # 确认下数据目录（--data-dir 值）
# mv /var/lib/etcd /var/lib/etcd.bak #很重要# ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/opt/KUIN00601/ca.crt --cert=/opt/KUIN00601/etcd-client.crt --key=/opt/KUIN00601/etcd-client.key snapshot restore /var/lib/backup/etcd-snapshot-previous.db# ETCDCTL_API=3 etcdctl snapshot restore --data-dir=/var/lib/backup/etcd /data/backup/etcd-snapshot-previous.db# chown -R etcd:etcd /var/lib/etcd #考试的时候要注意这个权限
# systemctl start etcd##如果是yaml文件的，前面不需要移除目录文件也可以
# docker ps|grep etcd
# docker stop xxx && docker start XXX #很重要注：执行备份命令如果提示没证书文件，exit 退回上一步操作
Day5-网络策略
网络策略 | Kubernetes
networkpolicy
Network Policies | Kubernetes
在现有的namespace my-app中创建一个名为allow-port-from-namespace的新NetworkPolicy。
确保新的NetworkPolicy允许命名空间big-corp的能访问my-app的所有pod的8080端口。
进一步确保新的NetworkPolicy：不允许对没有在监听端口8080的Pods的访问
不允许非来自 namespace big-corp中的Pods的访问
双重否定就是肯定，所以最后两句话的意思就是：
仅允许端口为 8080 的 pod 访问。
仅允许 big-corp命名空间中的 pod 访问。
kubectl config use-context hk8s
给命名空间打标签：kubectl label namespace big-corp name=big-corpapiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:name: allow-port-from-namespacenamespace: my-app
spec:podSelector: {}policyTypes:- Ingressingress:- from:- namespaceSelector:matchLabels:name: big-corpports:- protocol: TCPport: 8080
总结：
给命名空间打标签：kubectl label namespace myapp name=myapp
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:name: allow-port-from-namespacenamespace: big-corp
spec:
# podSelector: {} #表示在big-corp的NS下所有podpodSelector:matchLabels: #表示在big-corp的NS下，pod标签选择li=kai的podli: kaipolicyTypes:- Ingressingress:- from:- namespaceSelector:matchLabels:name: myapp #表示允许NS中有name=myapp的标签内的资源才能访问ports: #表示上述匹配中的pod只开放了8080端口给访问- protocol: TCPport: 8080Day6-SVC暴露应用
官网搜索 service
服务（Service） | Kubernetes
service
Service | Kubernetes
请重新配置现有的deployment:front-end以及添加名为http的端口规范来公开现有容器 nginx 的端口80/tcp。创建一个名为front-end-svc的新服务，以公开容器端口http。配置此服务，以通过在排定的节点上的 NodePort 来公开各个 Pods。
重新配置已经存在、名称为 front-end 的工作负载，为已经存在容器 nginx，添加一个名称为 http、暴露 80/tcp 的端口
创建一个名为 front-end-svc 的 svc，暴露容器的端口http
将其配置为 NodePort 类型的 svc
#如果没有deployment，用下面命令生成模板
# kubectl create deployment front-end --image=nginx:alpine --port=80 --dry-run=client -o yamlapiVersion: apps/v1
kind: Deployment
metadata:labels:app: front-endname: front-end
spec:replicas: 1selector:matchLabels:app: front-endtemplate:metadata:labels:app: front-endspec:containers:- image: nginx:alpinename: nginxports:- name: http #为自己提供服务的端口取个名称protocol: TCPcontainerPort: 80 #容器内本身提供服务端口按照要求编辑 deployment 添加 ports 端口属性信息
kubectl edit deployment front-end
apiVersion: apps/v1
kind: Deployment
metadata:name: front-endnamespace: default
spec:replicas: 3selector:matchLabels:app: nginxtemplate:metadata:labels:app: nginxspec: containers:- name: nginximage: nginx:1.14.2ports:- name: httpcontainerPort: 80protocol: TCP### --port=80 SVC服务端口80 会自动映射容器内部服务端口 --target-port=http 名称称为http的端口，也就是TCP 80
# kubectl expose deployment front-end --name=front-end-svc --port=80 --target-port=http --type=NodePort ###直接用容器内服务端口--target-port=80
# kubectl expose deployment front-end --name=front-end-svc --port=80 --target-port=80 --type=NodePort
Day7-Ingress
Ingress | Kubernetes
ingress
Ingress | Kubernetes
Create a new nginx Ingress resources as follows:
Name: pone
Namespace: ing-internal
Exposing service hi on path /hello using service port 5678
The avaliability of service hello can be checked using the following command,which should return hello: curl -kL <INTERNAL_IP> /hello
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:name: ponenamespace: ing-internalannotations:nginx.ingress.kubernetes.io/rewrite-target: /
spec:rules:- http:paths:- path: /hellopathType: Prefixbackend:service:name: hiport:number: 5678
Day8-扩容 Pod 数量
Deployments | Kubernetes
扩容名字为loadbalancer的deployment的副本数为5
# kubectl scale deployment loadbalancer --replicas=5或者用$ kubectl edit deployment loadbalancer 直接在线扩容也可以
Day9-nodeSelector
将 Pod 分配给节点 | Kubernetes
nodeSelector
Assigning Pods to Nodes | Kubernetes --->See Assign Pods to Nodes for more informationpod node
Assign Pods to Nodes | Kubernetes #注意这里是Assign
Schedule a pod as follows:
name: nginx-kusc00401
Image: nginx
Node selector: disk=ssd
apiVersion: v1
kind: Pod
metadata:name: nginx-kusc00401
spec:containers:- name: nginximage: nginximagePullPolicy: IfNotPresentnodeSelector:disk: ssd
Day10-统计准备就绪节点数量
Check to see how many nodes are ready (not including nodes tained NoSchedule) and write the number to /opt/KUSC00402/kusc00402.txt
# kubectl describe node `kubectl get node|grep "Ready"|awk 'NR>1{print $1}'`|grep -i Taints|grep -v "NoSchedule"|wc -l > /opt/KUSC00402/kusc00402.txt
Day11-Pod 配置多容器
Create a pod named kucc8 with a single app container for each of the following images runing inside(there may be between 1 and 4 images specified):nginx+memcached+redis
# kubectl run kucc8 --image=nginx --dry-run=client -o yaml > kucc8.yaml
# cat kucc8.yaml
apiVersion: v1
kind: Pod
metadata:labels:run: kucc8name: kucc8
spec:containers:- image: nginxname: nginx- image: redisname: redis- image: memcachedname: memcached
Day12-创建 PV
配置 Pod 以使用 PersistentVolume 作为存储 | Kubernetes
pv hostpath pod
Configure a Pod to Use a PersistentVolume for Storage
Create a persistent volume with name app-config, of capacity 1Gi and access mode ReadOnlyMany, the type of volume is hostPath and its location is /svc/app-config.
apiVersion: v1
kind: PersistentVolume
metadata:name: app-config
spec:capacity:storage: 1GiaccessModes:- ReadOnlyManyhostPath:path: "/svc/app-config"storageClassName: manual #可以去掉
Day13-PVC-pod
持久卷 | Kubernetes
持久卷 | Kubernetes
pv hostpath pod
Configure a Pod to Use a PersistentVolume for Storagepvc pod
Persistent Volumes | Kubernetes #有volumeMode: Filesystem
Create a new PersistentVolumeClaim:
Name: pv-volume
Class: csi-hostpath-sc
Capacity: 10Mi
Create a new Pod which mounts the PersistentVolumeClaim as a volume:
Name: web-server
Image: nginx
Mount Path: /usr/share/nginx/html
Configure the new Pod to have ReadWriteOnce access on the volume.
Finally,using kubectl edit or Kubectl patch expand the PersistentVolumeClaim to a capacity of 70Mi and record that change
apiVersion: v1
kind: PersistentVolumeClaim
metadata:name: pv-volume
spec:accessModes:- ReadWriteOncevolumeMode: Filesystem resources:requests:storage: 10MistorageClassName: csi-hostpath-sc---
apiVersion: v1
kind: Pod
metadata:name: web-server
spec:containers:- name: nginximage: nginxvolumeMounts:- mountPath: "/usr/share/nginx/html"name: data-volumevolumes:- name: data-volumepersistentVolumeClaim:claimName: pv-volume# kubectl edit pvc pv-volume -o yaml --save-config #--save-config 参数可以通过kubectl edit -h 查找Day14-获取 Pod 错误日志
Monitor the logs of pod bar and:
Extract log lines corresponding to error unable-to-access-website
Write them to /opt/KUTR00101/bar
# kubectl logs bar|grep "unable-to-access-website" >> /opt/KUTR00101/bar
Day15-给Pod增加一个容器（边车）
日志架构 | Kubernetes
logging
Logging Architecture | Kubernetes
Without changing its existing containers, an existing Pod needs to be integrated into Kubernetes’s build-in logging architecture(e.g kubectl logs). Adding a streaming sidecar container is a good and common way to accomplish this requirement.
Task
Add a busybox sidecar container to the existing Pod big-corp-app.The new sidecar container has to run the following command:
/bin/sh -c tail -n+1 -f /var/log/big-corp-app.log
Use a volume mount named logs to make the file /var/log/big-corp-app.log available to the sidecar container.
Don’t modify the existing container.
Don’t modify the path of the log file, both containers must access it at /var/log/bin-corp-app.log
# cat legacy-app.yaml
apiVersion: v1
kind: Pod
metadata:name: legacy-app
spec:containers:- name: countimage: busybox:1.28args:- /bin/sh- -c- >i=0;while true;doecho "$i: $(date)" >> /var/log/legacy-app.log;i=$((i+1));sleep 1;donevolumeMounts:- name: varlogmountPath: /var/log- name: sidecarimage: busybox:1.28.4command: ["/bin/sh", "-c", "tail -n+1 -f /var/log/legacy-app.log"]
# args: [/bin/sh, -c , "tail -n+1 -f /var/log/legacy-app.log"] #在这里command 和 args 命令等价 volumeMounts:- name: varlogmountPath: /var/logvolumes:- name: varlogemptyDir: {}
Day16-统计使用 CPU 最高的 Pod
From the pod label name=cpu-loader,find pods running high CPU workloads and write the name of the pod consuming most CPU to the file /opt/KUTR00401/KURT00401.txt (while alreay exists).
# kubectl top pod -l name=cpu-utilizer -A --sort-by=cpu|awk 'NR==2{print $2}' > /opt/KUTR00401/KURT00401.txt# kubectl top -h 就可以看到相关参数
Day17-节点 NotReady 处理
A kubernetes worker node, named wk8s-node-0 is in state NotReady.
Investigate why this is the case, and perform an appropriate steps to bring the node to a Ready stat, ensuring that any changes are made permanent
You can ssh to the failed node using:
— ssh wk8s-node-0
You can assume elevated privileges on the node with the following command:
— sudo -i
#--> 切换到指定集群
kubectl config use-context [NAME]
#--> 查看那个节点 notready
kubectl get node
kubectl get cs
#进到对应异常节点
ssh wk8s-node-0
sudo -i
## 查看 kubelet 服务是否正常运行
systemctl status kubelet
## 如果状态不是running，启动 kubelet 服务
systemctl restart kubelet
## 设置 kubelet 服务开机启动
systemctl enable kubelet
##检查
kubectl get node
可参考url
##真题
https://blog.csdn.net/qq_35583325/article/details/126739295?spm=1001.2101.3001.6650.10&utm_medium=distribute.pc_relevant.none-task-blog-2%7Edefault%7EOPENSEARCH%7ERate-10-126739295-blog-124554634.pc_relevant_aa2&depth_1-utm_source=distribute.pc_relevant.none-task-blog-2%7Edefault%7EOPENSEARCH%7ERate-10-126739295-blog-124554634.pc_relevant_aa2&utm_relevant_index=19https://blog.csdn.net/weixin_72758284/article/details/128142352?spm=1001.2101.3001.6650.12&utm_medium=distribute.pc_relevant.none-task-blog-2%7Edefault%7EOPENSEARCH%7ERate-12-128142352-blog-124554634.pc_relevant_aa2&depth_1-utm_source=distribute.pc_relevant.none-task-blog-2%7Edefault%7EOPENSEARCH%7ERate-12-128142352-blog-124554634.pc_relevant_aa2&utm_relevant_index=21https://blog.csdn.net/weixin_39246554/article/details/126874141?spm=1001.2014.3001.5502https://blog.csdn.net/zhouwenjun0820/article/details/105881669
K8S部署
https://blog.csdn.net/weixin_39246554/article/details/127336350?spm=1001.2014.3001.5502
)
方法和enumerate()方法)
