k8s集群安装-pod创建

后续所有安装都基于上一篇文章的1个master和3个node的基础。

yaml文件：区分大小写、使用空格而不是tab、键值之间有空格

• apiVersion: #api版本
• kind: #资源类型，pod、service、deployment等
• matedata: #属性
• spec: #详细信息

创建一个nginx的yaml文件

[root@master ~ ]# mkdir -p k8s/pod
[root@master ~ ]# cd k8s/pod
[root@master pod ]# vi nginx_pod.yaml
apiVersion: v1
kind: Pod
metadata:
  name: nginx
  labels:
    app: web
spec:
  containers:
    - name: nginx
      image: nginx:1.13
      ports:
        - containerPort: 80

基于yaml文件创建pod，命令为kubectl create -f yaml文件

[root@master pod]# kubectl create -f nginx_pod.yaml 
Error from server (ServerTimeout): error when creating "nginx_pod.yaml": No API token found for service account "default", retry after the token is automatically created and added to the service account

但是会报错，根据报错需要修改master的apiserver配置文件，删除ServiceAccount，修改后重新创建pod

[root@master pod ]# vi /etc/kubernetes/apiserver  #删除ServiceAccount 
# default admission control policies
KUBE_ADMISSION_CONTROL="--admission-control=NamespaceLifecycle,NamespaceExists,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota"
[root@master pod ]# systemctl restart kube-apiserver
[root@master pod]# kubectl create -f nginx_pod.yaml 
pod "nginx" created

但是查看这个pod的状态一直是ContainerCreating，此时需要查看日志

[root@master pod]# kubectl get pods
NAME      READY     STATUS              RESTARTS   AGE
nginx     0/1       ContainerCreating   0          2m

通过kubectl describe pod nginx查看日志，显示该pod调度到node2上，并且在pull镜像pod-infrastructure:latest的时候报错，在node2上手动pull也显示没有该镜像

[root@master pod]# kubectl describe pod nginx
Name:           nginx
Namespace:      default
Node:           node2/192.168.85.32
Start Time:     Sun, 30 Aug 2020 10:50:45 +0800
Labels:         app=web
Status:         Pending
IP:
Controllers:    <none>
Containers:
  nginx:
    Container ID:
    Image:                      nginx:1.13
    Image ID:
    Port:                       80/TCP
    State:                      Waiting
      Reason:                   ContainerCreating
    Ready:                      False
    Restart Count:              0
    Volume Mounts:              <none>
    Environment Variables:      <none>
Conditions:
  Type          Status
  Initialized   True 
  Ready         False 
  PodScheduled  True 
No volumes.
QoS Class:      BestEffort
Tolerations:    <none>
Events:
  FirstSeen     LastSeen        Count   From                    SubObjectPath   Type            Reason      Message
  ---------     --------        -----   ----                    -------------   --------        ------      -------
  3m            3m              1       {default-scheduler }                    Normal          Scheduled   Successfully assigned nginx to node2
  3m            1m              4       {kubelet node2}                         Warning         FailedSync  Error syncing pod, skipping: failed to "StartContainer" for "POD" with ErrImagePull: "image pull failed for registry.access.redhat.com/rhel7/pod-infrastructure:latest, this may be because there are no credentials on this request.  details: (open /etc/docker/certs.d/registry.access.redhat.com/redhat-ca.crt: no such file or directory)"

  2m    7s      10      {kubelet node2}         Warning FailedSync      Error syncing pod, skipping: failed to "StartContainer" for "POD" with ImagePullBackOff: "Back-off pulling image "registry.access.redhat.com/rhel7/pod-infrastructure:latest""
[root@node2 ~]# docker pull registry.access.redhat.com/rhel7/pod-infrastructure:latest
Trying to pull repository registry.access.redhat.com/rhel7/pod-infrastructure ... 
open /etc/docker/certs.d/registry.access.redhat.com/redhat-ca.crt: no such file or directory

查看node2上的kubelet配置文件，/etc/kubernetes/kubelet

# pod infrastructure container
KUBELET_POD_INFRA_CONTAINER="--pod-infra-container-image=registry.access.redhat.com/rhel7/pod-infrastructure:latest"
#修改为通过docker search pod-infrastructure查找到的镜像路径
KUBELET_POD_INFRA_CONTAINER="--pod-infra-container-image=docker.io/tianyebj/pod-infrastructure:latest"

再重启node2的kubelet服务，在master上再次通过describe查看日志，pod-infrastructure:latest镜像的下载地址已经变为kubelet配置文件修改后的路径，但是还是timeout，因为镜像是在国外，下载会比较耗时。

配置镜像加速，修改docker配置文件/etc/sysconfig/docker，将原OPTIONS修改为如下，ip为master地址

OPTIONS='--selinux-enabled --log-driver=journald --signature-verification=false --registry-mirror=https://registry.docker-cn.com --insecure-registry=192.168.85.30:5000'

重启docker，可在/var/lib/docker/tmp镜像包临时存放目录查看下载进度，但是镜像包下载特别慢，建议将已经下载好的镜像包上传并通过load导入。

通过这种情况创建的pod，如果kubectl delete pod nginx，再kubectl apply -f nginx_pod.yaml创建pod时，就可能调度到node1，此时node1会再需要经过一遍node2修改kubelet配置文件、加速镜像并且镜像下载异常慢的过程。因此通常建议配置私有镜像仓库harbor，将基础镜像上传到harbor上，后续都通过内网到harbor上下载所需镜像。

为了节省资源，此处使用官方的registry仓库。

[root@master pod]# docker search registry
INDEX       NAME                                           DESCRIPTION                                     STARS     OFFICIAL   AUTOMATED
docker.io   docker.io/registry                             The Docker Registry 2.0 implementation for...   3064      [OK]       
docker.io   docker.io/distribution/registry                WARNING: NOT the registry official image!!...   57                   [OK]
docker.io   docker.io/stefanscherer/registry-windows       Containerized docker registry for Windows ...   32                   
docker.io   docker.io/budry/registry-arm                   Docker registry build for Raspberry PI 2 a...   18                   
docker.io   docker.io/deis/registry                        Docker image registry for the Deis open so...   12                   
docker.io   docker.io/jc21/registry-ui                     A nice web interface for managing your Doc...   12                   
……
[root@master pod]# docker pull docker.io/registry    #下载官方registry
[root@master pod]# docker images
REPOSITORY           TAG                 IMAGE ID            CREATED             SIZE
docker.io/busybox    latest              018c9d7b792b        4 weeks ago         1.22 MB
docker.io/registry   latest              2d4f4b5309b1        2 months ago        26.2 MB
[root@master pod]# docker run -d -p 5000:5000 --restart=always --name registry -v /opt/myregistry:/var/lib/registry registry   #创建私有仓库
daf346fb2c98d11f8ac261d8568339723a6f5f7df40df907cbc07b5fe2166759
[root@master pod]# docker ps   #
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                    NAMES
daf346fb2c98        registry            "/entrypoint.sh /e..."   8 seconds ago       Up 6 seconds        0.0.0.0:5000->5000/tcp   registry

修改docker配置文件/etc/sysconfig/docker

OPTIONS='--selinux-enabled --log-driver=journald --signature-verification=false --registry-mirror=https://registry.docker-cn.com --insecure-registry=192.168.85.30:5000'   #ip为master

修改kubelet配置文件/etc/kubernetes/kubelet

# pod infrastructure container
KUBELET_POD_INFRA_CONTAINER="--pod-infra-container-image=192.168.85.30:5000/pod-infrastructure:latest"

重启docker和kubelet服务，然后将已经下载好的镜像push到私有仓库192.168.85.30:5000/上。

pod常用操作

创建pod：kubectl create -f yaml

更新pod：kubectl apply -f yaml

查看pod：kubectl get pods [-n namespace]

删除pod：kubectl delete pod podname [--force [--grace-period=0]]

查看pod创建：kubectl describe pod podname

容器常用操作

查看运行的容器：docker ps

查看指定的容器：docker inspect dockername