1、资源创建方式

  • 命令行
  • YAML

2、Namespace

名称空间用来隔离资源

  1. kubectl create ns hello
  2. kubectl delete ns hello
  1. apiVersion: v1
  2. kind: Namespace
  3. metadata:
  4.   name: hello

3、Pod

运行中的一组容器，Pod是kubernetes中应用的最小单位.

image.png

  1. kubectl run mynginx --image=nginx
  3. # 查看default名称空间的Pod
  4. kubectl get pod 
  5. # 描述
  6. kubectl describe pod 你自己的Pod名字
  7. # 删除
  8. kubectl delete pod Pod名字
  9. # 查看Pod的运行日志
  10. kubectl logs Pod名字
  12. # 每个Pod - k8s都会分配一个ip
  13. kubectl get pod -owide
  14. # 使用Pod的ip+pod里面运行容器的端口
  15. curl 192.168.169.136
  17. # 集群中的任意一个机器以及任意的应用都能通过Pod分配的ip来访问这个Pod
  1. apiVersion: v1
  2. kind: Pod
  3. metadata:
  4.   labels:
  5.     run: mynginx
  6.   name: mynginx
  7. #  namespace: default
  8. spec:
  9.   containers:
  10.   - image: nginx
  11.     name: mynginx
  1. apiVersion: v1
  2. kind: Pod
  3. metadata:
  4.   labels:
  5.     run: myapp
  6.   name: myapp
  7. spec:
  8.   containers:
  9.   - image: nginx
  10.     name: nginx
  11.   - image: tomcat:8.5.68
  12.     name: tomcat

image.png
此时的应用还不能外部访问

4、Deployment

控制Pod，使Pod拥有多副本，自愈，扩缩容等能力

  1. # 清除所有Pod，比较下面两个命令有何不同效果？
  2. kubectl run mynginx --image=nginx
  4. kubectl create deployment mytomcat --image=tomcat:8.5.68
  5. # 自愈能力

1、多副本

  1. kubectl create deployment my-dep --image=nginx --replicas=3
  1. apiVersion: apps/v1
  2. kind: Deployment
  3. metadata:
  4.   labels:
  5.     app: my-dep
  6.   name: my-dep
  7. spec:
  8.   replicas: 3
  9.   selector:
  10.     matchLabels:
  11.       app: my-dep
  12.   template:
  13.     metadata:
  14.       labels:
  15.         app: my-dep
  16.     spec:
  17.       containers:
  18.       - image: nginx
  19.         name: nginx

2、扩缩容

  1. kubectl scale --replicas=5 deployment/my-dep
  1. kubectl edit deployment my-dep
  3. #修改 replicas

3、自愈&故障转移

  • 停机
  • 删除Pod
  • 容器崩溃
  • ….

4、滚动更新

  1. kubectl set image deployment/my-dep nginx=nginx:1.16.1 --record
  2. kubectl rollout status deployment/my-dep
  1. # 修改 kubectl edit deployment/my-dep

5、版本回退

  1. #历史记录
  2. kubectl rollout history deployment/my-dep
  5. #查看某个历史详情
  6. kubectl rollout history deployment/my-dep --revision=2
  8. #回滚(回到上次)
  9. kubectl rollout undo deployment/my-dep
  11. #回滚(回到指定版本)
  12. kubectl rollout undo deployment/my-dep --to-revision=2

更多： 除了Deployment，k8s还有 StatefulSet 、DaemonSet 、Job 等 类型资源。我们都称为 工作负载。 有状态应用使用 StatefulSet 部署，无状态应用使用 Deployment 部署 https://kubernetes.io/zh/docs/concepts/workloads/controllers/

5、Service

将一组 Pods 公开为网络服务的抽象方法。

  1. #暴露Deploy
  2. kubectl expose deployment my-dep --port=8000 --target-port=80
  4. #使用标签检索Pod
  5. kubectl get pod -l app=my-dep
  1. apiVersion: v1
  2. kind: Service
  3. metadata:
  4.   labels:
  5.     app: my-dep
  6.   name: my-dep
  7. spec:
  8.   selector:
  9.     app: my-dep
  10.   ports:
  11.   - port: 8000
  12.     protocol: TCP
  13.     targetPort: 80

1、ClusterIP

  1. # 等同于没有--type的
  2. kubectl expose deployment my-dep --port=8000 --target-port=80 --type=ClusterIP
  1. apiVersion: v1
  2. kind: Service
  3. metadata:
  4.   labels:
  5.     app: my-dep
  6.   name: my-dep
  7. spec:
  8.   ports:
  9.   - port: 8000
  10.     protocol: TCP
  11.     targetPort: 80
  12.   selector:
  13.     app: my-dep
  14.   type: ClusterIP

2、NodePort

  1. kubectl expose deployment my-dep --port=8000 --target-port=80 --type=NodePort
  1. apiVersion: v1
  2. kind: Service
  3. metadata:
  4.   labels:
  5.     app: my-dep
  6.   name: my-dep
  7. spec:
  8.   ports:
  9.   - port: 8000
  10.     protocol: TCP
  11.     targetPort: 80
  12.   selector:
  13.     app: my-dep
  14.   type: NodePort

NodePort范围在 30000-32767 之间

6、Ingress

1、安装

  1. wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v0.47.0/deploy/static/provider/baremetal/deploy.yaml
  3. #修改镜像
  4. vi deploy.yaml
  5. #将image的值改为如下值：
  6. registry.cn-hangzhou.aliyuncs.com/lfy_k8s_images/ingress-nginx-controller:v0.46.0
  8. # 检查安装的结果
  9. kubectl get pod,svc -n ingress-nginx
  11. # 最后别忘记把svc暴露的端口要放行

image.png

如果下载不到，用以下文件

  1. apiVersion: v1
  2. kind: Namespace
  3. metadata:
  4.   name: ingress-nginx
  5.   labels:
  6.     app.kubernetes.io/name: ingress-nginx
  7.     app.kubernetes.io/instance: ingress-nginx
  9. ---
  10. # Source: ingress-nginx/templates/controller-serviceaccount.yaml
  11. apiVersion: v1
  12. kind: ServiceAccount
  13. metadata:
  14.   labels:
  15.     helm.sh/chart: ingress-nginx-3.33.0
  16.     app.kubernetes.io/name: ingress-nginx
  17.     app.kubernetes.io/instance: ingress-nginx
  18.     app.kubernetes.io/version: 0.47.0
  19.     app.kubernetes.io/managed-by: Helm
  20.     app.kubernetes.io/component: controller
  21.   name: ingress-nginx
  22.   namespace: ingress-nginx
  23. automountServiceAccountToken: true
  24. ---
  25. # Source: ingress-nginx/templates/controller-configmap.yaml
  26. apiVersion: v1
  27. kind: ConfigMap
  28. metadata:
  29.   labels:
  30.     helm.sh/chart: ingress-nginx-3.33.0
  31.     app.kubernetes.io/name: ingress-nginx
  32.     app.kubernetes.io/instance: ingress-nginx
  33.     app.kubernetes.io/version: 0.47.0
  34.     app.kubernetes.io/managed-by: Helm
  35.     app.kubernetes.io/component: controller
  36.   name: ingress-nginx-controller
  37.   namespace: ingress-nginx
  38. data:
  39. ---
  40. # Source: ingress-nginx/templates/clusterrole.yaml
  41. apiVersion: rbac.authorization.k8s.io/v1
  42. kind: ClusterRole
  43. metadata:
  44.   labels:
  45.     helm.sh/chart: ingress-nginx-3.33.0
  46.     app.kubernetes.io/name: ingress-nginx
  47.     app.kubernetes.io/instance: ingress-nginx
  48.     app.kubernetes.io/version: 0.47.0
  49.     app.kubernetes.io/managed-by: Helm
  50.   name: ingress-nginx
  51. rules:
  52.   - apiGroups:
  53.       - ''
  54.     resources:
  55.       - configmaps
  56.       - endpoints
  57.       - nodes
  58.       - pods
  59.       - secrets
  60.     verbs:
  61.       - list
  62.       - watch
  63.   - apiGroups:
  64.       - ''
  65.     resources:
  66.       - nodes
  67.     verbs:
  68.       - get
  69.   - apiGroups:
  70.       - ''
  71.     resources:
  72.       - services
  73.     verbs:
  74.       - get
  75.       - list
  76.       - watch
  77.   - apiGroups:
  78.       - extensions
  79.       - networking.k8s.io   # k8s 1.14+
  80.     resources:
  81.       - ingresses
  82.     verbs:
  83.       - get
  84.       - list
  85.       - watch
  86.   - apiGroups:
  87.       - ''
  88.     resources:
  89.       - events
  90.     verbs:
  91.       - create
  92.       - patch
  93.   - apiGroups:
  94.       - extensions
  95.       - networking.k8s.io   # k8s 1.14+
  96.     resources:
  97.       - ingresses/status
  98.     verbs:
  99.       - update
  100.   - apiGroups:
  101.       - networking.k8s.io   # k8s 1.14+
  102.     resources:
  103.       - ingressclasses
  104.     verbs:
  105.       - get
  106.       - list
  107.       - watch
  108. ---
  109. # Source: ingress-nginx/templates/clusterrolebinding.yaml
  110. apiVersion: rbac.authorization.k8s.io/v1
  111. kind: ClusterRoleBinding
  112. metadata:
  113.   labels:
  114.     helm.sh/chart: ingress-nginx-3.33.0
  115.     app.kubernetes.io/name: ingress-nginx
  116.     app.kubernetes.io/instance: ingress-nginx
  117.     app.kubernetes.io/version: 0.47.0
  118.     app.kubernetes.io/managed-by: Helm
  119.   name: ingress-nginx
  120. roleRef:
  121.   apiGroup: rbac.authorization.k8s.io
  122.   kind: ClusterRole
  123.   name: ingress-nginx
  124. subjects:
  125.   - kind: ServiceAccount
  126.     name: ingress-nginx
  127.     namespace: ingress-nginx
  128. ---
  129. # Source: ingress-nginx/templates/controller-role.yaml
  130. apiVersion: rbac.authorization.k8s.io/v1
  131. kind: Role
  132. metadata:
  133.   labels:
  134.     helm.sh/chart: ingress-nginx-3.33.0
  135.     app.kubernetes.io/name: ingress-nginx
  136.     app.kubernetes.io/instance: ingress-nginx
  137.     app.kubernetes.io/version: 0.47.0
  138.     app.kubernetes.io/managed-by: Helm
  139.     app.kubernetes.io/component: controller
  140.   name: ingress-nginx
  141.   namespace: ingress-nginx
  142. rules:
  143.   - apiGroups:
  144.       - ''
  145.     resources:
  146.       - namespaces
  147.     verbs:
  148.       - get
  149.   - apiGroups:
  150.       - ''
  151.     resources:
  152.       - configmaps
  153.       - pods
  154.       - secrets
  155.       - endpoints
  156.     verbs:
  157.       - get
  158.       - list
  159.       - watch
  160.   - apiGroups:
  161.       - ''
  162.     resources:
  163.       - services
  164.     verbs:
  165.       - get
  166.       - list
  167.       - watch
  168.   - apiGroups:
  169.       - extensions
  170.       - networking.k8s.io   # k8s 1.14+
  171.     resources:
  172.       - ingresses
  173.     verbs:
  174.       - get
  175.       - list
  176.       - watch
  177.   - apiGroups:
  178.       - extensions
  179.       - networking.k8s.io   # k8s 1.14+
  180.     resources:
  181.       - ingresses/status
  182.     verbs:
  183.       - update
  184.   - apiGroups:
  185.       - networking.k8s.io   # k8s 1.14+
  186.     resources:
  187.       - ingressclasses
  188.     verbs:
  189.       - get
  190.       - list
  191.       - watch
  192.   - apiGroups:
  193.       - ''
  194.     resources:
  195.       - configmaps
  196.     resourceNames:
  197.       - ingress-controller-leader-nginx
  198.     verbs:
  199.       - get
  200.       - update
  201.   - apiGroups:
  202.       - ''
  203.     resources:
  204.       - configmaps
  205.     verbs:
  206.       - create
  207.   - apiGroups:
  208.       - ''
  209.     resources:
  210.       - events
  211.     verbs:
  212.       - create
  213.       - patch
  214. ---
  215. # Source: ingress-nginx/templates/controller-rolebinding.yaml
  216. apiVersion: rbac.authorization.k8s.io/v1
  217. kind: RoleBinding
  218. metadata:
  219.   labels:
  220.     helm.sh/chart: ingress-nginx-3.33.0
  221.     app.kubernetes.io/name: ingress-nginx
  222.     app.kubernetes.io/instance: ingress-nginx
  223.     app.kubernetes.io/version: 0.47.0
  224.     app.kubernetes.io/managed-by: Helm
  225.     app.kubernetes.io/component: controller
  226.   name: ingress-nginx
  227.   namespace: ingress-nginx
  228. roleRef:
  229.   apiGroup: rbac.authorization.k8s.io
  230.   kind: Role
  231.   name: ingress-nginx
  232. subjects:
  233.   - kind: ServiceAccount
  234.     name: ingress-nginx
  235.     namespace: ingress-nginx
  236. ---
  237. # Source: ingress-nginx/templates/controller-service-webhook.yaml
  238. apiVersion: v1
  239. kind: Service
  240. metadata:
  241.   labels:
  242.     helm.sh/chart: ingress-nginx-3.33.0
  243.     app.kubernetes.io/name: ingress-nginx
  244.     app.kubernetes.io/instance: ingress-nginx
  245.     app.kubernetes.io/version: 0.47.0
  246.     app.kubernetes.io/managed-by: Helm
  247.     app.kubernetes.io/component: controller
  248.   name: ingress-nginx-controller-admission
  249.   namespace: ingress-nginx
  250. spec:
  251.   type: ClusterIP
  252.   ports:
  253.     - name: https-webhook
  254.       port: 443
  255.       targetPort: webhook
  256.   selector:
  257.     app.kubernetes.io/name: ingress-nginx
  258.     app.kubernetes.io/instance: ingress-nginx
  259.     app.kubernetes.io/component: controller
  260. ---
  261. # Source: ingress-nginx/templates/controller-service.yaml
  262. apiVersion: v1
  263. kind: Service
  264. metadata:
  265.   annotations:
  266.   labels:
  267.     helm.sh/chart: ingress-nginx-3.33.0
  268.     app.kubernetes.io/name: ingress-nginx
  269.     app.kubernetes.io/instance: ingress-nginx
  270.     app.kubernetes.io/version: 0.47.0
  271.     app.kubernetes.io/managed-by: Helm
  272.     app.kubernetes.io/component: controller
  273.   name: ingress-nginx-controller
  274.   namespace: ingress-nginx
  275. spec:
  276.   type: NodePort
  277.   ports:
  278.     - name: http
  279.       port: 80
  280.       protocol: TCP
  281.       targetPort: http
  282.     - name: https
  283.       port: 443
  284.       protocol: TCP
  285.       targetPort: https
  286.   selector:
  287.     app.kubernetes.io/name: ingress-nginx
  288.     app.kubernetes.io/instance: ingress-nginx
  289.     app.kubernetes.io/component: controller
  290. ---
  291. # Source: ingress-nginx/templates/controller-deployment.yaml
  292. apiVersion: apps/v1
  293. kind: Deployment
  294. metadata:
  295.   labels:
  296.     helm.sh/chart: ingress-nginx-3.33.0
  297.     app.kubernetes.io/name: ingress-nginx
  298.     app.kubernetes.io/instance: ingress-nginx
  299.     app.kubernetes.io/version: 0.47.0
  300.     app.kubernetes.io/managed-by: Helm
  301.     app.kubernetes.io/component: controller
  302.   name: ingress-nginx-controller
  303.   namespace: ingress-nginx
  304. spec:
  305.   selector:
  306.     matchLabels:
  307.       app.kubernetes.io/name: ingress-nginx
  308.       app.kubernetes.io/instance: ingress-nginx
  309.       app.kubernetes.io/component: controller
  310.   revisionHistoryLimit: 10
  311.   minReadySeconds: 0
  312.   template:
  313.     metadata:
  314.       labels:
  315.         app.kubernetes.io/name: ingress-nginx
  316.         app.kubernetes.io/instance: ingress-nginx
  317.         app.kubernetes.io/component: controller
  318.     spec:
  319.       dnsPolicy: ClusterFirst
  320.       containers:
  321.         - name: controller
  322.           image: registry.cn-hangzhou.aliyuncs.com/lfy_k8s_images/ingress-nginx-controller:v0.46.0
  323.           imagePullPolicy: IfNotPresent
  324.           lifecycle:
  325.             preStop:
  326.               exec:
  327.                 command:
  328.                   - /wait-shutdown
  329.           args:
  330.             - /nginx-ingress-controller
  331.             - --election-id=ingress-controller-leader
  332.             - --ingress-class=nginx
  333.             - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
  334.             - --validating-webhook=:8443
  335.             - --validating-webhook-certificate=/usr/local/certificates/cert
  336.             - --validating-webhook-key=/usr/local/certificates/key
  337.           securityContext:
  338.             capabilities:
  339.               drop:
  340.                 - ALL
  341.               add:
  342.                 - NET_BIND_SERVICE
  343.             runAsUser: 101
  344.             allowPrivilegeEscalation: true
  345.           env:
  346.             - name: POD_NAME
  347.               valueFrom:
  348.                 fieldRef:
  349.                   fieldPath: metadata.name
  350.             - name: POD_NAMESPACE
  351.               valueFrom:
  352.                 fieldRef:
  353.                   fieldPath: metadata.namespace
  354.             - name: LD_PRELOAD
  355.               value: /usr/local/lib/libmimalloc.so
  356.           livenessProbe:
  357.             failureThreshold: 5
  358.             httpGet:
  359.               path: /healthz
  360.               port: 10254
  361.               scheme: HTTP
  362.             initialDelaySeconds: 10
  363.             periodSeconds: 10
  364.             successThreshold: 1
  365.             timeoutSeconds: 1
  366.           readinessProbe:
  367.             failureThreshold: 3
  368.             httpGet:
  369.               path: /healthz
  370.               port: 10254
  371.               scheme: HTTP
  372.             initialDelaySeconds: 10
  373.             periodSeconds: 10
  374.             successThreshold: 1
  375.             timeoutSeconds: 1
  376.           ports:
  377.             - name: http
  378.               containerPort: 80
  379.               protocol: TCP
  380.             - name: https
  381.               containerPort: 443
  382.               protocol: TCP
  383.             - name: webhook
  384.               containerPort: 8443
  385.               protocol: TCP
  386.           volumeMounts:
  387.             - name: webhook-cert
  388.               mountPath: /usr/local/certificates/
  389.               readOnly: true
  390.           resources:
  391.             requests:
  392.               cpu: 100m
  393.               memory: 90Mi
  394.       nodeSelector:
  395.         kubernetes.io/os: linux
  396.       serviceAccountName: ingress-nginx
  397.       terminationGracePeriodSeconds: 300
  398.       volumes:
  399.         - name: webhook-cert
  400.           secret:
  401.             secretName: ingress-nginx-admission
  402. ---
  403. # Source: ingress-nginx/templates/admission-webhooks/validating-webhook.yaml
  404. # before changing this value, check the required kubernetes version
  405. # https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#prerequisites
  406. apiVersion: admissionregistration.k8s.io/v1
  407. kind: ValidatingWebhookConfiguration
  408. metadata:
  409.   labels:
  410.     helm.sh/chart: ingress-nginx-3.33.0
  411.     app.kubernetes.io/name: ingress-nginx
  412.     app.kubernetes.io/instance: ingress-nginx
  413.     app.kubernetes.io/version: 0.47.0
  414.     app.kubernetes.io/managed-by: Helm
  415.     app.kubernetes.io/component: admission-webhook
  416.   name: ingress-nginx-admission
  417. webhooks:
  418.   - name: validate.nginx.ingress.kubernetes.io
  419.     matchPolicy: Equivalent
  420.     rules:
  421.       - apiGroups:
  422.           - networking.k8s.io
  423.         apiVersions:
  424.           - v1beta1
  425.         operations:
  426.           - CREATE
  427.           - UPDATE
  428.         resources:
  429.           - ingresses
  430.     failurePolicy: Fail
  431.     sideEffects: None
  432.     admissionReviewVersions:
  433.       - v1
  434.       - v1beta1
  435.     clientConfig:
  436.       service:
  437.         namespace: ingress-nginx
  438.         name: ingress-nginx-controller-admission
  439.         path: /networking/v1beta1/ingresses
  440. ---
  441. # Source: ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml
  442. apiVersion: v1
  443. kind: ServiceAccount
  444. metadata:
  445.   name: ingress-nginx-admission
  446.   annotations:
  447.     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
  448.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  449.   labels:
  450.     helm.sh/chart: ingress-nginx-3.33.0
  451.     app.kubernetes.io/name: ingress-nginx
  452.     app.kubernetes.io/instance: ingress-nginx
  453.     app.kubernetes.io/version: 0.47.0
  454.     app.kubernetes.io/managed-by: Helm
  455.     app.kubernetes.io/component: admission-webhook
  456.   namespace: ingress-nginx
  457. ---
  458. # Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml
  459. apiVersion: rbac.authorization.k8s.io/v1
  460. kind: ClusterRole
  461. metadata:
  462.   name: ingress-nginx-admission
  463.   annotations:
  464.     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
  465.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  466.   labels:
  467.     helm.sh/chart: ingress-nginx-3.33.0
  468.     app.kubernetes.io/name: ingress-nginx
  469.     app.kubernetes.io/instance: ingress-nginx
  470.     app.kubernetes.io/version: 0.47.0
  471.     app.kubernetes.io/managed-by: Helm
  472.     app.kubernetes.io/component: admission-webhook
  473. rules:
  474.   - apiGroups:
  475.       - admissionregistration.k8s.io
  476.     resources:
  477.       - validatingwebhookconfigurations
  478.     verbs:
  479.       - get
  480.       - update
  481. ---
  482. # Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml
  483. apiVersion: rbac.authorization.k8s.io/v1
  484. kind: ClusterRoleBinding
  485. metadata:
  486.   name: ingress-nginx-admission
  487.   annotations:
  488.     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
  489.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  490.   labels:
  491.     helm.sh/chart: ingress-nginx-3.33.0
  492.     app.kubernetes.io/name: ingress-nginx
  493.     app.kubernetes.io/instance: ingress-nginx
  494.     app.kubernetes.io/version: 0.47.0
  495.     app.kubernetes.io/managed-by: Helm
  496.     app.kubernetes.io/component: admission-webhook
  497. roleRef:
  498.   apiGroup: rbac.authorization.k8s.io
  499.   kind: ClusterRole
  500.   name: ingress-nginx-admission
  501. subjects:
  502.   - kind: ServiceAccount
  503.     name: ingress-nginx-admission
  504.     namespace: ingress-nginx
  505. ---
  506. # Source: ingress-nginx/templates/admission-webhooks/job-patch/role.yaml
  507. apiVersion: rbac.authorization.k8s.io/v1
  508. kind: Role
  509. metadata:
  510.   name: ingress-nginx-admission
  511.   annotations:
  512.     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
  513.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  514.   labels:
  515.     helm.sh/chart: ingress-nginx-3.33.0
  516.     app.kubernetes.io/name: ingress-nginx
  517.     app.kubernetes.io/instance: ingress-nginx
  518.     app.kubernetes.io/version: 0.47.0
  519.     app.kubernetes.io/managed-by: Helm
  520.     app.kubernetes.io/component: admission-webhook
  521.   namespace: ingress-nginx
  522. rules:
  523.   - apiGroups:
  524.       - ''
  525.     resources:
  526.       - secrets
  527.     verbs:
  528.       - get
  529.       - create
  530. ---
  531. # Source: ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml
  532. apiVersion: rbac.authorization.k8s.io/v1
  533. kind: RoleBinding
  534. metadata:
  535.   name: ingress-nginx-admission
  536.   annotations:
  537.     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
  538.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  539.   labels:
  540.     helm.sh/chart: ingress-nginx-3.33.0
  541.     app.kubernetes.io/name: ingress-nginx
  542.     app.kubernetes.io/instance: ingress-nginx
  543.     app.kubernetes.io/version: 0.47.0
  544.     app.kubernetes.io/managed-by: Helm
  545.     app.kubernetes.io/component: admission-webhook
  546.   namespace: ingress-nginx
  547. roleRef:
  548.   apiGroup: rbac.authorization.k8s.io
  549.   kind: Role
  550.   name: ingress-nginx-admission
  551. subjects:
  552.   - kind: ServiceAccount
  553.     name: ingress-nginx-admission
  554.     namespace: ingress-nginx
  555. ---
  556. # Source: ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml
  557. apiVersion: batch/v1
  558. kind: Job
  559. metadata:
  560.   name: ingress-nginx-admission-create
  561.   annotations:
  562.     helm.sh/hook: pre-install,pre-upgrade
  563.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  564.   labels:
  565.     helm.sh/chart: ingress-nginx-3.33.0
  566.     app.kubernetes.io/name: ingress-nginx
  567.     app.kubernetes.io/instance: ingress-nginx
  568.     app.kubernetes.io/version: 0.47.0
  569.     app.kubernetes.io/managed-by: Helm
  570.     app.kubernetes.io/component: admission-webhook
  571.   namespace: ingress-nginx
  572. spec:
  573.   template:
  574.     metadata:
  575.       name: ingress-nginx-admission-create
  576.       labels:
  577.         helm.sh/chart: ingress-nginx-3.33.0
  578.         app.kubernetes.io/name: ingress-nginx
  579.         app.kubernetes.io/instance: ingress-nginx
  580.         app.kubernetes.io/version: 0.47.0
  581.         app.kubernetes.io/managed-by: Helm
  582.         app.kubernetes.io/component: admission-webhook
  583.     spec:
  584.       containers:
  585.         - name: create
  586.           image: docker.io/jettech/kube-webhook-certgen:v1.5.1
  587.           imagePullPolicy: IfNotPresent
  588.           args:
  589.             - create
  590.             - --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
  591.             - --namespace=$(POD_NAMESPACE)
  592.             - --secret-name=ingress-nginx-admission
  593.           env:
  594.             - name: POD_NAMESPACE
  595.               valueFrom:
  596.                 fieldRef:
  597.                   fieldPath: metadata.namespace
  598.       restartPolicy: OnFailure
  599.       serviceAccountName: ingress-nginx-admission
  600.       securityContext:
  601.         runAsNonRoot: true
  602.         runAsUser: 2000
  603. ---
  604. # Source: ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml
  605. apiVersion: batch/v1
  606. kind: Job
  607. metadata:
  608.   name: ingress-nginx-admission-patch
  609.   annotations:
  610.     helm.sh/hook: post-install,post-upgrade
  611.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  612.   labels:
  613.     helm.sh/chart: ingress-nginx-3.33.0
  614.     app.kubernetes.io/name: ingress-nginx
  615.     app.kubernetes.io/instance: ingress-nginx
  616.     app.kubernetes.io/version: 0.47.0
  617.     app.kubernetes.io/managed-by: Helm
  618.     app.kubernetes.io/component: admission-webhook
  619.   namespace: ingress-nginx
  620. spec:
  621.   template:
  622.     metadata:
  623.       name: ingress-nginx-admission-patch
  624.       labels:
  625.         helm.sh/chart: ingress-nginx-3.33.0
  626.         app.kubernetes.io/name: ingress-nginx
  627.         app.kubernetes.io/instance: ingress-nginx
  628.         app.kubernetes.io/version: 0.47.0
  629.         app.kubernetes.io/managed-by: Helm
  630.         app.kubernetes.io/component: admission-webhook
  631.     spec:
  632.       containers:
  633.         - name: patch
  634.           image: docker.io/jettech/kube-webhook-certgen:v1.5.1
  635.           imagePullPolicy: IfNotPresent
  636.           args:
  637.             - patch
  638.             - --webhook-name=ingress-nginx-admission
  639.             - --namespace=$(POD_NAMESPACE)
  640.             - --patch-mutating=false
  641.             - --secret-name=ingress-nginx-admission
  642.             - --patch-failure-policy=Fail
  643.           env:
  644.             - name: POD_NAMESPACE
  645.               valueFrom:
  646.                 fieldRef:
  647.                   fieldPath: metadata.namespace
  648.       restartPolicy: OnFailure
  649.       serviceAccountName: ingress-nginx-admission
  650.       securityContext:
  651.         runAsNonRoot: true
  652.         runAsUser: 2000

2、使用

官网地址：https://kubernetes.github.io/ingress-nginx/ 就是nginx做的

https://139.198.163.211:32401/ http://139.198.163.211:31405/

测试环境

应用如下yaml，准备好测试环境

apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello-server
spec:
  replicas: 2
  selector:
    matchLabels:
      app: hello-server
  template:
    metadata:
      labels:
        app: hello-server
    spec:
      containers:
      - name: hello-server
        image: registry.cn-hangzhou.aliyuncs.com/lfy_k8s_images/hello-server
        ports:
        - containerPort: 9000
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: nginx-demo
  name: nginx-demo
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx-demo
  template:
    metadata:
      labels:
        app: nginx-demo
    spec:
      containers:
      - image: nginx
        name: nginx
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: nginx-demo
  name: nginx-demo
spec:
  selector:
    app: nginx-demo
  ports:
  - port: 8000
    protocol: TCP
    targetPort: 80
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: hello-server
  name: hello-server
spec:
  selector:
    app: hello-server
  ports:
  - port: 8000
    protocol: TCP
    targetPort: 9000

1、域名访问

apiVersion: networking.k8s.io/v1
kind: Ingress  
metadata:
  name: ingress-host-bar
spec:
  ingressClassName: nginx
  rules:
  - host: "hello.atguigu.com"
    http:
      paths:
      - pathType: Prefix
        path: "/"
        backend:
          service:
            name: hello-server
            port:
              number: 8000
  - host: "demo.atguigu.com"
    http:
      paths:
      - pathType: Prefix
        path: "/nginx"  # 把请求会转给下面的服务，下面的服务一定要能处理这个路径，不能处理就是404
        backend:
          service:
            name: nginx-demo  ## java，比如使用路径重写，去掉前缀nginx
            port:
              number: 8000

问题： path: “/nginx” 与 path: “/“ 为什么会有不同的效果？

2、路径重写

apiVersion: networking.k8s.io/v1
kind: Ingress  
metadata:
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$2
  name: ingress-host-bar
spec:
  ingressClassName: nginx
  rules:
  - host: "hello.atguigu.com"
    http:
      paths:
      - pathType: Prefix
        path: "/"
        backend:
          service:
            name: hello-server
            port:
              number: 8000
  - host: "demo.atguigu.com"
    http:
      paths:
      - pathType: Prefix
        path: "/nginx(/|$)(.*)"  # 把请求会转给下面的服务，下面的服务一定要能处理这个路径，不能处理就是404
        backend:
          service:
            name: nginx-demo  ## java，比如使用路径重写，去掉前缀nginx
            port:
              number: 8000

3、流量限制

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-limit-rate
  annotations:
    nginx.ingress.kubernetes.io/limit-rps: "1"
spec:
  ingressClassName: nginx
  rules:
  - host: "haha.atguigu.com"
    http:
      paths:
      - pathType: Exact
        path: "/"
        backend:
          service:
            name: nginx-demo
            port:
              number: 8000

7、存储抽象

环境准备

1、所有节点

#所有机器安装
yum install -y nfs-utils

2、主节点

#nfs主节点
echo "/nfs/data/ *(insecure,rw,sync,no_root_squash)" > /etc/exports

mkdir -p /nfs/data
systemctl enable rpcbind --now
systemctl enable nfs-server --now
#配置生效
exportfs -r

3、从节点

showmount -e 172.31.0.4

#执行以下命令挂载 nfs 服务器上的共享目录到本机路径 /root/nfsmount
mkdir -p /nfs/data

mount -t nfs 172.31.0.4:/nfs/data /nfs/data
# 写入一个测试文件
echo "hello nfs server" > /nfs/data/test.txt

4、原生方式数据挂载

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: nginx-pv-demo
  name: nginx-pv-demo
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx-pv-demo
  template:
    metadata:
      labels:
        app: nginx-pv-demo
    spec:
      containers:
      - image: nginx
        name: nginx
        volumeMounts:
        - name: html
          mountPath: /usr/share/nginx/html
      volumes:
        - name: html
          nfs:
            server: 172.31.0.4
            path: /nfs/data/nginx-pv

1、PV&PVC

PV：持久卷（Persistent Volume），将应用需要持久化的数据保存到指定位置 PVC：持久卷申明（Persistent Volume Claim），申明需要使用的持久卷规格

1、创建pv池

静态供应

#nfs主节点
mkdir -p /nfs/data/01
mkdir -p /nfs/data/02
mkdir -p /nfs/data/03

创建PV

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv01-10m
spec:
  capacity:
    storage: 10M
  accessModes:
    - ReadWriteMany
  storageClassName: nfs
  nfs:
    path: /nfs/data/01
    server: 172.31.0.4
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv02-1gi
spec:
  capacity:
    storage: 1Gi
  accessModes:
    - ReadWriteMany
  storageClassName: nfs
  nfs:
    path: /nfs/data/02
    server: 172.31.0.4
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv03-3gi
spec:
  capacity:
    storage: 3Gi
  accessModes:
    - ReadWriteMany
  storageClassName: nfs
  nfs:
    path: /nfs/data/03
    server: 172.31.0.4


2、PVC创建与绑定

创建PVC

kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: nginx-pvc
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 200Mi
  storageClassName: nfs

创建Pod绑定PVC

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: nginx-deploy-pvc
  name: nginx-deploy-pvc
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx-deploy-pvc
  template:
    metadata:
      labels:
        app: nginx-deploy-pvc
    spec:
      containers:
      - image: nginx
        name: nginx
        volumeMounts:
        - name: html
          mountPath: /usr/share/nginx/html
      volumes:
        - name: html
          persistentVolumeClaim:
            claimName: nginx-pvc

2、ConfigMap

抽取应用配置，并且可以自动更新

1、redis示例

1、把之前的配置文件创建为配置集

# 创建配置，redis保存到k8s的etcd；
kubectl create cm redis-conf --from-file=redis.conf

apiVersion: v1
data:    #data是所有真正的数据，key：默认是文件名   value：配置文件的内容
  redis.conf: |
    appendonly yes
kind: ConfigMap
metadata:
  name: redis-conf
  namespace: default

2、创建Pod

apiVersion: v1
kind: Pod
metadata:
  name: redis
spec:
  containers:
  - name: redis
    image: redis
    command:
      - redis-server
      - "/redis-master/redis.conf"  #指的是redis容器内部的位置
    ports:
    - containerPort: 6379
    volumeMounts:
    - mountPath: /data
      name: data
    - mountPath: /redis-master
      name: config
  volumes:
    - name: data
      emptyDir: {}
    - name: config
      configMap:
        name: redis-conf
        items:
        - key: redis.conf
          path: redis.conf

3、检查默认配置

kubectl exec -it redis -- redis-cli

127.0.0.1:6379> CONFIG GET appendonly
127.0.0.1:6379> CONFIG GET requirepass

4、修改ConfigMap

apiVersion: v1
kind: ConfigMap
metadata:
  name: example-redis-config
data:
  redis-config: |
    maxmemory 2mb
    maxmemory-policy allkeys-lru

5、检查配置是否更新

kubectl exec -it redis -- redis-cli

127.0.0.1:6379> CONFIG GET maxmemory
127.0.0.1:6379> CONFIG GET maxmemory-policy

检查指定文件内容是否已经更新 修改了CM。Pod里面的配置文件会跟着变

配置值未更改，因为需要重新启动 Pod 才能从关联的 ConfigMap 中获取更新的值。 原因：我们的Pod部署的中间件自己本身没有热更新能力


3、Secret

Secret 对象类型用来保存敏感信息，例如密码、OAuth 令牌和 SSH 密钥。 将这些信息放在 secret 中比放在 Pod 的定义或者 容器镜像 中来说更加安全和灵活。

kubectl create secret docker-registry leifengyang-docker \
--docker-username=leifengyang \
--docker-password=Lfy123456 \
--docker-email=534096094@qq.com

##命令格式
kubectl create secret docker-registry regcred \
  --docker-server=<你的镜像仓库服务器> \
  --docker-username=<你的用户名> \
  --docker-password=<你的密码> \
  --docker-email=<你的邮箱地址>

apiVersion: v1
kind: Pod
metadata:
  name: private-nginx
spec:
  containers:
  - name: private-nginx
    image: leifengyang/guignginx:v1.0
  imagePullSecrets:
  - name: leifengyang-docker