k8s杂记

在node节点内部使用kubectl：

root@multinode-demo-m02:/# ps aux | grep kubelet
root         218 3.1 1.6 2066316 62516 ?       Ssl 07:35   0:29 /var/lib/minikube/binaries/v1.30.0/kubelet --bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --config=/var/lib/kubelet/config.yaml --hostname-override=multinode-demo-m02 --kubeconfig=/etc/kubernetes/kubelet.conf --node-ip=192.168.49.3
root        3941 0.0 0.0   3456   720 pts/1    S+   07:51   0:00 grep --color=auto kubelet
root@multinode-demo-m02:/#
root@multinode-demo-m02:/#
root@multinode-demo-m02:/# kubectl get pods --kubeconfig=/etc/kubernetes/kubelet.conf
NAME                     READY   STATUS    RESTARTS      AGE
nginx-6c485c9fbb-hpbjj   1/1     Running   1 (23h ago)   24h
nginx-6c485c9fbb-nrw6c   1/1     Running   1 (23h ago)   24h
root@multinode-demo-m02:/#
root@multinode-demo-m02:/# kubectl get pod nginx-6c485c9fbb-hpbjj -o yaml --kubeconfig=/etc/kubernetes/kubelet.conf

apiVersion: v1
kind: Pod
metadata:
creationTimestamp: "2024-10-08T07:05:05Z"
generateName: nginx-6c485c9fbb-
labels:
    app: nginx
    pod-template-hash: 6c485c9fbb
name: nginx-6c485c9fbb-hpbjj

在etcd容器内部使用etcdctl：

etcdctl --endpoints=https://192.168.58.2:2379 --cert=/var/lib/minikube/certs/etcd/peer.crt --key=/var/lib/minikube/certs/etcd/peer.key --cacert=/var/lib/minikube/certs/etcd/ca.crt get /registry/configmaps --prefix --keys-only

在容器内部请求kubernetes api获取本机的pod列表：

添加角色绑定：

kubectl create clusterrolebinding cluster-admin-default-bind --clusterrole=cluster-admin --group=system:serviceaccounts --namespace=default
clusterrolebinding.rbac.authorization.k8s.io/cluster-admin-default-bind created

没有上面的角色绑定会报错：

{
"kind": "Status",
"apiVersion": "v1",
"metadata": {},
"status": "Failure",
"message": "pods is forbidden: User \"system:serviceaccount:default:default\" cannot list resource \"pods\" in API group \"\" in the namespace \"default\"",
"reason": "Forbidden",
"details": {
"kind": "pods"
},
"code": 403
}

参考k8s api文档：https://v1-31.kubernetes.ac.cn/docs/reference/kubernetes-api/workload-resources/pod-v1/

api请求脚本：

curl https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}/api/v1/namespaces/$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)/pods \
--cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt\
--header "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)"

返回json结果，从中过滤出属于本机ip的容器ip：