day02 K8S

1.前情回顾

源码部署k8s

gitlib就是github的开源实现
harbor类似这样
// 计算节点要关闭swap分区
apiServer启动默认监听6443（tls通信）以及8080（http通信）
controllerManager和scheduler和apiServer部署在同一个物理机的目的，保证这2个服务和apiServer是通过本机的127.0.0.1:8080通信的，比tls的证书通信要效率高一些

1.1重要节点工作职责

etcd（监听2380端口对外，2379是集群内部之间通信）无所谓，和etcd是通过tcp socket
etcd要保证计数个，自己有自己的高可用机制
apiServer->接受api请求，该存etcd，该调度scheduler调度，该去找controller-manager就去找
kubelet->干活最累的，去起容器的
kube-proxy->实现了k8s里面pod网络和service网络的连接（1.12开始使用ipvs的流量调度算法，调度集群的流量，1.3版本用的userspace调度造成了极大的资源浪费，很多公有云厂商用的还是iptables规则）

2.cfssl工具

cfssl:证书签发的主要工具
cfssl-json:将cfssl生成的证书(json格式)变为文件承载式证书
cfssl-certinof:验证证书的信息,证书有效期。入职时一定要注意看

[root@jdss7-200 certs]# cfssl-certinfo -cert apiserver.pem 
{
  "subject": {
    "common_name": "k8s-apiserver",
    "country": "CN",
    "organization": "od",
    "organizational_unit": "ops",
    "locality": "beijing",
    "province": "beijing",
    "names": [
      "CN",
      "beijing",
      "beijing",
      "od",
      "ops",
      "k8s-apiserver"
    ]
  },
  "issuer": {
    "common_name": "OldboyEdu",
    "country": "CN",
    "organization": "od",
    "organizational_unit": "ops",
    "locality": "beijing",
    "province": "beijing",
    "names": [
      "CN",
      "beijing",
      "beijing",
      "od",
      "ops",
      "OldboyEdu"
    ]
  },
  "serial_number": "623283726608787615526450732742237323307482519058",
  "sans": [
    "kubernetes.default",
    "kubernetes.default.svc",
    "kubernetes.default.svc.cluster",
    "kubernetes.default.svc.cluster.local",
    "127.0.0.1",
    "192.168.0.1",
    "10.4.7.10",
    "10.4.7.21",
    "10.4.7.22",
    "10.4.7.23"
  ],
  "not_before": "2021-12-20T07:01:00Z",
  "not_after": "2041-12-15T07:01:00Z",
  "sigalg": "SHA256WithRSA",
  "authority_key_id": "41:78:51:4F:F0:70:FC:4D:4E:55:4E:AD:97:FD:4C:49:11:14:FE:1C",
  "subject_key_id": "84:31:2D:E8:51:7A:EC:6:E5:90:4C:2E:CD:75:C6:64:F4:5:BA:C9",
  "pem": "-----BEGIN CERTIFICATE-----\nMIIEbzCCA1egAwIBAgIUbS0CSPhhJRCd4sycnqc4IZ7ClhIwDQYJKoZIhvcNAQEL\nBQAwYDELMAkGA1UEBhMCQ04xEDAOBgNVBAgTB2JlaWppbmcxEDAOBgNVBAcTB2Jl\naWppbmcxCzAJBgNVBAoTAm9kMQwwCgYDVQQLEwNvcHMxEjAQBgNVBAMTCU9sZGJv\neUVkdTAeFw0yMTEyMjAwNzAxMDBaFw00MTEyMTUwNzAxMDBaMGQxCzAJBgNVBAYT\nAkNOMRAwDgYDVQQIEwdiZWlqaW5nMRAwDgYDVQQHEwdiZWlqaW5nMQswCQYDVQQK\nEwJvZDEMMAoGA1UECxMDb3BzMRYwFAYDVQQDEw1rOHMtYXBpc2VydmVyMIIBIjAN\nBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuWxN2q0u068b1vgmGecRlPLfsTjo\nDssLvNRxF3ePufsxScPzxMrWi8AyaBD8RLM5SR2wh/4tosjeyLl09cgeKuKAksC5\n4yIqXJUmYqT6PfxCeGnjRhrvOL1pWSYUqaFEYto7nfFZrpXq32SPDvO8/3TnucGi\nNTC3rBTdpeZN51GaQegIYJBdIfkF0/eQB3XFF3KDtujvPd5UGx0rU0wE0/cPFm+S\nWIl7AlMPSU6OPXp+6n/CGOHaCrmWJz62lRTvDG+mHiTHO90XfTEcyl7T42fFZBeF\n3EdFsIlvACsFU8k7bjA8IoxiI/uZv5PhSgJC8WDFfFxasibUz3pLwVq2mQIDAQAB\no4IBGzCCARcwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwG\nA1UdEwEB/wQCMAAwHQYDVR0OBBYEFIQxLehReuwG5ZBMLs11xmT0BbrJMB8GA1Ud\nIwQYMBaAFEF4UU/wcPxNTlVOrZf9TEkRFP4cMIGhBgNVHREEgZkwgZaCEmt1YmVy\nbmV0ZXMuZGVmYXVsdIIWa3ViZXJuZXRlcy5kZWZhdWx0LnN2Y4Iea3ViZXJuZXRl\ncy5kZWZhdWx0LnN2Yy5jbHVzdGVygiRrdWJlcm5ldGVzLmRlZmF1bHQuc3ZjLmNs\ndXN0ZXIubG9jYWyHBH8AAAGHBMCoAAGHBAoEBwqHBAoEBxWHBAoEBxaHBAoEBxcw\nDQYJKoZIhvcNAQELBQADggEBAJ9Q0tRsM1tF5uYl6GrPYvzu89mwECqEyQF2P05J\nHomzFt6iGPZhE10e7pkdfEBQrtgk0xptd3loyLzYOlSXUiRfA1e9BshkeDpB43uM\nx+3dE9YpmQrRE4HedM/IfSLg8Jgv3Wcat6D3luRqCOu0GB9i2cIwplxORj1SAacj\ncBwSzOHlUk6g+u6HkuiTo3wnSZDstE98qnNCrqvyohlcHYozth+yFvtydN/O4S1i\nxcpNga8CG4iFtl97rWnVHnssFkgNh0EYpb+8bJBjv3Tm5tmdXHLsAn8DU4rY+eQs\nM05d3rNklfLWhThQv8It3bNiIO22a/pSm1mcsVVCd4QGjlo=\n-----END CERTIFICATE-----\n"
}

cfssl-certinfo -domain www.baidu.com 查看百度的证书信息

{
  "subject": {
    "common_name": "baidu.com",
    "country": "CN",
    "organization": "Beijing Baidu Netcom Science Technology Co., Ltd",
    "organizational_unit": "service operation department",
    "locality": "beijing",
    "province": "beijing",
    "names": [
      "CN",
      "beijing",
      "beijing",
      "service operation department",
      "Beijing Baidu Netcom Science Technology Co., Ltd",
      "baidu.com"
    ]
  },
  "issuer": {
    "common_name": "GlobalSign Organization Validation CA - SHA256 - G2",
    "country": "BE",
    "organization": "GlobalSign nv-sa",
    "names": [
      "BE",
      "GlobalSign nv-sa",
      "GlobalSign Organization Validation CA - SHA256 - G2"
    ]
  },
  "serial_number": "35351242533515273557482149369",
  "sans": [
    "baidu.com",
    "baifubao.com",
    "www.baidu.cn",
    "www.baidu.com.cn",
    "mct.y.nuomi.com",
    "apollo.auto",
    "dwz.cn",
    "*.baidu.com",
    "*.baifubao.com",
    "*.baidustatic.com",
    "*.bdstatic.com",
    "*.bdimg.com",
    "*.hao123.com",
    "*.nuomi.com",
    "*.chuanke.com",
    "*.trustgo.com",
    "*.bce.baidu.com",
    "*.eyun.baidu.com",
    "*.map.baidu.com",
    "*.mbd.baidu.com",
    "*.fanyi.baidu.com",
    "*.baidubce.com",
    "*.mipcdn.com",
    "*.news.baidu.com",
    "*.baidupcs.com",
    "*.aipage.com",
    "*.aipage.cn",
    "*.bcehost.com",
    "*.safe.baidu.com",
    "*.im.baidu.com",
    "*.baiducontent.com",
    "*.dlnel.com",
    "*.dlnel.org",
    "*.dueros.baidu.com",
    "*.su.baidu.com",
    "*.91.com",
    "*.hao123.baidu.com",
    "*.apollo.auto",
    "*.xueshu.baidu.com",
    "*.bj.baidubce.com",
    "*.gz.baidubce.com",
    "*.smartapps.cn",
    "*.bdtjrcv.com",
    "*.hao222.com",
    "*.haokan.com",
    "*.pae.baidu.com",
    "*.vd.bdstatic.com",
    "*.cloud.baidu.com",
    "click.hm.baidu.com",
    "log.hm.baidu.com",
    "cm.pos.baidu.com",
    "wn.pos.baidu.com",
    "update.pan.baidu.com"
  ],
  "not_before": "2021-07-01T01:16:03Z",
  "not_after": "2022-08-02T01:16:03Z",
  "sigalg": "SHA256WithRSA",
  "authority_key_id": "96:DE:61:F1:BD:1C:16:29:53:1C:C0:CC:7D:3B:83:0:40:E6:1A:7C",
  "subject_key_id": "34:92:9A:2F:C:71:62:BC:3D:DB:23:6D:6D:3E:B3:D1:1D:11:9D:ED",
  "pem": "-----BEGIN CERTIFICATE-----\nMIIKQDCCCSigAwIBAgIMcjncyb61yc15VBX5MA0GCSqGSIb3DQEBCwUAMGYxCzAJ\nBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMTwwOgYDVQQDEzNH\nbG9iYWxTaWduIE9yZ2FuaXphdGlvbiBWYWxpZGF0aW9uIENBIC0gU0hBMjU2IC0g\nRzIwHhcNMjEwNzAxMDExNjAzWhcNMjIwODAyMDExNjAzWjCBpzELMAkGA1UEBhMC\nQ04xEDAOBgNVBAgTB2JlaWppbmcxEDAOBgNVBAcTB2JlaWppbmcxJTAjBgNVBAsT\nHHNlcnZpY2Ugb3BlcmF0aW9uIGRlcGFydG1lbnQxOTA3BgNVBAoTMEJlaWppbmcg\nQmFpZHUgTmV0Y29tIFNjaWVuY2UgVGVjaG5vbG9neSBDby4sIEx0ZDESMBAGA1UE\nAxMJYmFpZHUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAm1HB\nm0ZQIHnU05khvgJXhkUKZn2K4iK1E4Kavx+DGar7z3MELQdMQ7ZbhVg37haeoI+n\nbwWDpMhbF3PNgNaTLjiHsGrdl0s3eLVh0zrTkjtH0Q0UBddlilbpPExNPFWq4Wed\n22Y5AfKpuo/LUjCzmKc+aEDv2WoTrPjXTENYqyFj8ugGgNL5lHurgVFWdcMssVoO\n66Mo/q7+1jLr00+OCUO/gdcYxULEtPaoH5w8d6+Fx2ebBcO/GS5sh/dJ4Xbdl5KV\nBmJ4kVW2WeI57eR2ps8WGoDQFxd1Q4b7pOf0MGgGzut6hQQsJC/FZq22H9rQ7gZH\nDljQqEm14sQvfaj1YQIDAQABo4IGqjCCBqYwDgYDVR0PAQH/BAQDAgWgMIGgBggr\nBgEFBQcBAQSBkzCBkDBNBggrBgEFBQcwAoZBaHR0cDovL3NlY3VyZS5nbG9iYWxz\naWduLmNvbS9jYWNlcnQvZ3Nvcmdhbml6YXRpb252YWxzaGEyZzJyMS5jcnQwPwYI\nKwYBBQUHMAGGM2h0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9nc29yZ2FuaXph\ndGlvbnZhbHNoYTJnMjBWBgNVHSAETzBNMEEGCSsGAQQBoDIBFDA0MDIGCCsGAQUF\nBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzAIBgZn\ngQwBAgIwCQYDVR0TBAIwADBJBgNVHR8EQjBAMD6gPKA6hjhodHRwOi8vY3JsLmds\nb2JhbHNpZ24uY29tL2dzL2dzb3JnYW5pemF0aW9udmFsc2hhMmcyLmNybDCCA2EG\nA1UdEQSCA1gwggNUggliYWlkdS5jb22CDGJhaWZ1YmFvLmNvbYIMd3d3LmJhaWR1\nLmNughB3d3cuYmFpZHUuY29tLmNugg9tY3QueS5udW9taS5jb22CC2Fwb2xsby5h\ndXRvggZkd3ouY26CCyouYmFpZHUuY29tgg4qLmJhaWZ1YmFvLmNvbYIRKi5iYWlk\ndXN0YXRpYy5jb22CDiouYmRzdGF0aWMuY29tggsqLmJkaW1nLmNvbYIMKi5oYW8x\nMjMuY29tggsqLm51b21pLmNvbYINKi5jaHVhbmtlLmNvbYINKi50cnVzdGdvLmNv\nbYIPKi5iY2UuYmFpZHUuY29tghAqLmV5dW4uYmFpZHUuY29tgg8qLm1hcC5iYWlk\ndS5jb22CDyoubWJkLmJhaWR1LmNvbYIRKi5mYW55aS5iYWlkdS5jb22CDiouYmFp\nZHViY2UuY29tggwqLm1pcGNkbi5jb22CECoubmV3cy5iYWlkdS5jb22CDiouYmFp\nZHVwY3MuY29tggwqLmFpcGFnZS5jb22CCyouYWlwYWdlLmNugg0qLmJjZWhvc3Qu\nY29tghAqLnNhZmUuYmFpZHUuY29tgg4qLmltLmJhaWR1LmNvbYISKi5iYWlkdWNv\nbnRlbnQuY29tggsqLmRsbmVsLmNvbYILKi5kbG5lbC5vcmeCEiouZHVlcm9zLmJh\naWR1LmNvbYIOKi5zdS5iYWlkdS5jb22CCCouOTEuY29tghIqLmhhbzEyMy5iYWlk\ndS5jb22CDSouYXBvbGxvLmF1dG+CEioueHVlc2h1LmJhaWR1LmNvbYIRKi5iai5i\nYWlkdWJjZS5jb22CESouZ3ouYmFpZHViY2UuY29tgg4qLnNtYXJ0YXBwcy5jboIN\nKi5iZHRqcmN2LmNvbYIMKi5oYW8yMjIuY29tggwqLmhhb2thbi5jb22CDyoucGFl\nLmJhaWR1LmNvbYIRKi52ZC5iZHN0YXRpYy5jb22CESouY2xvdWQuYmFpZHUuY29t\nghJjbGljay5obS5iYWlkdS5jb22CEGxvZy5obS5iYWlkdS5jb22CEGNtLnBvcy5i\nYWlkdS5jb22CEHduLnBvcy5iYWlkdS5jb22CFHVwZGF0ZS5wYW4uYmFpZHUuY29t\nMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBSW3mHx\nvRwWKVMcwMx9O4MAQOYafDAdBgNVHQ4EFgQUNJKaLwxxYrw92yNtbT6z0R0Rne0w\nggF9BgorBgEEAdZ5AgQCBIIBbQSCAWkBZwB1ACJFRQdZVSRWlj+hL/H3bYbgIyZj\nrcBLf13Gg1xu4g8CAAABel+jJjkAAAQDAEYwRAIgIPt5kWXsm47PrqSljzkXx3xD\nt0xLC/fIIWbRTrvyJFUCIDxgcy89XYHRxW/WLY/pBDAv1fnK5MpocUYZi7c4uvDl\nAHYAKXm+8J45OSHwVnOfY6V35b5XfZxgCvj5TV0mXCVdx4QAAAF6X6MmKgAABAMA\nRzBFAiEAzl3C9AQOsbfgoBe61Dnc72Fa+8X3MmImCrsG6kb2f8oCIGeDQqgTEHzx\nbjQzGKr4nnjBDPkVpljrV4SUc3n5ysgvAHYAVYHUwhaQNgFK6gubVzxT8MDkOHhw\nJQgXL6OqHQcT0wwAAAF6X6MmSwAABAMARzBFAiB5KnN89d/LeQheoojaviS16dad\n95CR2Wr8pZWVamxDfgIhAL+3MqWq+E+8mtOIWDyebnH2nS+mm91pmO1mA5CSyiKR\nMA0GCSqGSIb3DQEBCwUAA4IBAQA5igBJkkgWWN4+nM6DORuxrJqV+Vb/fC2C06g2\nW+bPff1KmHJI8rf2UtQLCSyiXDNH4pqbPpe92LoACcmuHrO83uge4d7ZBfipsD3t\nuXqyqTyTTgeM8F7Mi/N1M25VguWZQp+cgVT7rc4oDDhCYJVo4U1fgy2kMnbYURwd\nZrecrR8Z+UDkfHRN2yq76vMkTek4dyFSPP0egR6QAISuyGb844F4kdBDeJkqpIUx\nPJ9r70ieHjlNUQe3U03/4hOr48ptfCH24voic/RlcXV32giO9y1b5gHJ95YMXy2o\n1z5MXsKSeOQbTpsoNp8Yd/K79WpkcXgP6tVofxFXtP8PsORz\n-----END CERTIFICATE-----\n"
}

从kube-config里可以反解证书

[root@jdss7-200 certs]# echo "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUR0RENDQXB5Z0F3SUJBZ0lVRlpUZ2tmc3NDNWdHQ2w5am1vS0trL0xDNnFnd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1lERUxNQWtHQTFVRUJoTUNRMDR4RURBT0JnTlZCQWdUQjJKbGFXcHBibWN4RURBT0JnTlZCQWNUQjJKbAphV3BwYm1jeEN6QUpCZ05WQkFvVEFtOWtNUXd3Q2dZRFZRUUxFd052Y0hNeEVqQVFCZ05WQkFNVENVOXNaR0p2CmVVVmtkVEFlRncweU1URXlNakF3TlRBeU1EQmFGdzAwTVRFeU1UVXdOVEF5TURCYU1HQXhDekFKQmdOVkJBWVQKQWtOT01SQXdEZ1lEVlFRSUV3ZGlaV2xxYVc1bk1SQXdEZ1lEVlFRSEV3ZGlaV2xxYVc1bk1Rc3dDUVlEVlFRSwpFd0p2WkRFTU1Bb0dBMVVFQ3hNRGIzQnpNUkl3RUFZRFZRUURFd2xQYkdSaWIzbEZaSFV3Z2dFaU1BMEdDU3FHClNJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUUMvek45aUdqR2xwOXM1VnlBM0Rvb0RENUpvKzNwZWphVjAKckRrNjVnaldnVUdWd3ZxQTFPalNEZWdEbE5QSTV1N285OTc4NnRqMDl3UHdzUFZxK2t5ZkR3SFkrUXdoVVlMKwpITFBXWlhmcVZhRml5RDQzMW9vWkdKd052eUVHVUtuWDhaUzdjVkJIWHZEWXBhUjh4MXdiZnQ1ckovY29TblVaClF6b0wreTFRaEI2aUx3cmhjNklLQjVjYy9Bb1hWTThlQjJIbnUxMExuaC92SGtkV2xwTUNpWVFJd1hkM2l3cVQKa05GZ2FHSE81T2d4TnRMbHVXRlI4OEY4MGFSWjBCTld6UU56LzErc0hCVjNPdVFEWHR1cUl6NGxQTXZrTUJpMwpFbHBERUl3dG1vMDFrSERnOWFHL1BHd3JQckFzblNsWWcyaGZrSDhrKzU4a1JUbXVsRDhaQWdNQkFBR2paakJrCk1BNEdBMVVkRHdFQi93UUVBd0lCQmpBU0JnTlZIUk1CQWY4RUNEQUdBUUgvQWdFQ01CMEdBMVVkRGdRV0JCUkIKZUZGUDhIRDhUVTVWVHEyWC9VeEpFUlQrSERBZkJnTlZIU01FR0RBV2dCUkJlRkZQOEhEOFRVNVZUcTJYL1V4SgpFUlQrSERBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQVNWbCsrRTNyZFlFMmIxUmJVVHBnYkdtSERxRmVvL2VYCmNUVUhHVHJSM2RzNUpOdUUxMnBUS21Ed0pJTzBtMlJTYmVsSWw5akFMQnBxSndZU216d2RSTjVRN1ZqWkVKSTcKMFdTcTFsajgrR3dNRDZYdUpzOVY2N2JreDZvMXVHV1dFWFFXa3doTEp2NWV2bjQzUkhoNXh2TGtFdVVEd3RXMgpPck54aDkyQXBmK3ZGMzNFVUoweGl1RWdWOUFxVE5zU1UrUnU4eXU4UVgydHZmOGY1UTNOSUR6djdzZjBpSjRpCmhDYXJ3SkhWTTVIMW5oa2d6cjRzQVBwekNZNlU2bE81RmtubHpKbmVXbnZLVFg4K3dHMk1HZklxTG9WdnlRQjQKRnJxTTNHb0xwUmw0NnVKRkpJaVJlL1IyQnBWeHg1TFZCdklKdW50MjhXUDZISkI4NUw5SXVnPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=" | base64 -d

k8s里面证书要做的门清才行

2.1 kubeconfig文件

• 其实是一个k8s用户的配置文件
• 里面包含证书的信息
• 证书过期或者更换，需要同步替换该文件
  （证书过期，重新签发证书，这个kubeconfig文件要重新去生成）
  kublet.kubeconfig以及kube-proxy.kubeconfig

3.kubectl命令行工具的使用

CNI网络插件flannel，解决pod之间不能跨主机通信
服务发现插件coredns
服务暴露插件trafilk
GUI管理工具dashboard(k8s 在1.16以上跑步起来)
rbac基于角色的访问控制
heapster，dashboard的监控小插件，让dashboard看着好看一些，基本不用了
kubernetes维护的生产经验

4.管理k8s核心资源（pod，pod控制器，service，ingress）的三种基本方法

• 陈述式管理方法-主要依赖命令行cli工具进行管理
• 声明式管理方法-主要依赖统一资源配置清单（mainfest）进行管理
• gui管理方法-主要依赖图形化操作界面（web页面）进行管理

5. 陈述式资源管理

命令行工具用于与apiserver进行通信，用户在命令行输入的命令，组织并转化为apiserver能识别的信息，交互与本机127.0.0.1的apiserver，从而进行管理k8s各种资源的有效途径

5.1 命名空间

• 查看名称空间

[root@jdss7-21 ~]# kubectl get namespace
NAME              STATUS   AGE
default           Active   14d
kube-node-lease   Active   14d
kube-public       Active   14d
kube-system       Active   14d
[root@jdss7-21 ~]# kubectl get ns
NAME              STATUS   AGE
default           Active   14d
kube-node-lease   Active   14d
kube-public       Active   14d
kube-system       Active   14d

不同名称空间的资源是有可能重名的

• 查询default空间里的所有资源

[root@jdss7-21 ~]# kubectl get all -n default
NAME                 READY   STATUS    RESTARTS   AGE
pod/nginx-ds-8gbdr   1/1     Running   1          14d
pod/nginx-ds-twfkj   1/1     Running   2          14d


NAME                 TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)   AGE
service/kubernetes   ClusterIP   192.168.0.1   <none>        443/TCP   14d

NAME                      DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
daemonset.apps/nginx-ds   2         2         2       2            2           <none>          14d

daemonset是pod控制器

• 创建名称空间

创建一个名叫app的namespace
[root@jdss7-21 ~]# kubectl create namespace app
namespace/app created

• 删除名称空间

[root@jdss7-21 ~]# kubectl delete namespace app
namespace "app" deleted

5.2 pod控制器

• 创建pod控制器，用来保证给你拉起一个pod，使的无限接近你，预先设置一个值，让资源无限向我靠近

创建一个名为nginx-dp的pod控制器
[root@jdss7-21 ~]# kubectl create deployment nginx-dp --image=harbor.od.com/public/nginx:v1.7.9 -n kube-public
deployment.apps/nginx-dp created

查看新创建的pod控制器

[root@jdss7-21 ~]# kubectl get deploy -n kube-public
NAME       READY   UP-TO-DATE   AVAILABLE   AGE
nginx-dp   1/1     1            1           42s
[root@jdss7-21 ~]# kubectl get pods -n kube-public
NAME                        READY   STATUS    RESTARTS   AGE
nginx-dp-5dfc689474-jnznx   1/1     Running   0          52s

用扩展的方式显示我们的资源

[root@jdss7-21 ~]# kubectl get pods -n kube-public -o wide
NAME                        READY   STATUS    RESTARTS   AGE     IP           NODE                NOMINATED NODE   READINESS GATES
nginx-dp-5dfc689474-jnznx   1/1     Running   0          2m42s   172.7.22.3   jdss7-22.host.com   <none>           <none>

可以看到起来的ip地址是172.7.22.3，一下看出来是存在于7.22的计算节点上
7.22计算节点使用docker ps -a 查看5dfc689474的容器

pause镜像和你的业务镜像是边车模式运行的，帮你业务容器拉起来前，先帮你ipc空间，网络空间。uts等空间先占上
查看详细资源，查看详细pod控制器

/opt/kubernetes/server/bin/conf/kubelet.kubeconfig 文件里写死了server是

server: https://10.4.7.10:7443

• 查看pod资源

[root@jdss7-21 ~]# kubectl get pods -n kube-public
NAME                        READY   STATUS    RESTARTS   AGE
nginx-dp-5dfc689474-jnznx   1/1     Running   0          37m

• 进入pod资源

[root@jdss7-21 ~]# kubectl exec -ti nginx-dp-5dfc689474-jnznx /bin/bash -n kube-public

• 删除pod资源(其实是重启pod容器,pod控制器来保证即使delete的pod后，pod控制器用来保证要和预期一样还会新拉取一个pod起来,拉起来的pod可能ip会变)

[root@jdss7-22 ~]# kubectl delete pods nginx-dp-5dfc689474-jnznx -n kube-public
pod "nginx-dp-5dfc689474-jnznx" deleted

强制删除pod参数(--force --grace-period=0)

• 删除deployment资源

[root@jdss7-21 ~]# kubectl delete deployment nginx-dp -n kube-public
deployment.extensions "nginx-dp" deleted

查看

No resources found.
[root@jdss7-21 ~]# kubectl get all -n kube-public









No resources found.

5.3 service资源

• 创建service资源
  service给pod提供一个稳定的接入点

[root@jdss7-21 ~]# kubectl expose deployment nginx-dp --port=80 -n kube-public
service/nginx-dp exposed

clusterIp就是你pod的固定接入点，你pod的ip怎么变，这个clusterIp不会变


搞成2份

[root@jdss7-21 ~]# kubectl scale deployment nginx-dp --replicas=2 -n kube-public
deployment.extensions/nginx-dp scaled

• 查看service

[root@jdss7-21 ~]# kubectl describe svc nginx-dp -n kube-public
Name:              nginx-dp
Namespace:         kube-public
Labels:            app=nginx-dp
Annotations:       <none>
Selector:          app=nginx-dp
Type:              ClusterIP
IP:                192.168.5.14
Port:              <unset>  80/TCP
TargetPort:        80/TCP
Endpoints:         172.7.21.3:80
Session Affinity:  None
Events:            <none>

service如何找到pod的，依赖lable selector

6.k8s中文社区

docs.kubernetes.org.cn/683.html

7.命令行的缺点

命令冗长，复杂，难以记忆
特定场景下，无法实现管理需求
对资源增，删，查操作比较容易，改就很痛苦

8.特色的声明资源管理方法

依赖于资源配置清单(yaml/json)

• 查看pod的资源配置清单

[root@jdss7-21 ~]# kubectl get pods nginx-dp-5dfc689474-t98fx -o yaml -n kube-public
apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: "2022-01-04T07:49:48Z"
  generateName: nginx-dp-5dfc689474-
  labels:
    app: nginx-dp
    pod-template-hash: 5dfc689474
  name: nginx-dp-5dfc689474-t98fx
  namespace: kube-public
  ownerReferences:
  - apiVersion: apps/v1
    blockOwnerDeletion: true
    controller: true
    kind: ReplicaSet
    name: nginx-dp-5dfc689474
    uid: e6029552-05d5-40f3-8640-af3c915a0b6c
  resourceVersion: "73732"
  selfLink: /api/v1/namespaces/kube-public/pods/nginx-dp-5dfc689474-t98fx
  uid: 8fbb5af0-f41a-4229-ada5-c2e61747cbbd
spec:
  containers:
  - image: harbor.od.com/public/nginx:v1.7.9
    imagePullPolicy: IfNotPresent
    name: nginx
    resources: {}
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: default-token-f7th5
      readOnly: true
  dnsPolicy: ClusterFirst
  enableServiceLinks: true
  nodeName: jdss7-21.host.com
  priority: 0
  restartPolicy: Always
  schedulerName: default-scheduler
  securityContext: {}
  serviceAccount: default
  serviceAccountName: default
  terminationGracePeriodSeconds: 30
  tolerations:
  - effect: NoExecute
    key: node.kubernetes.io/not-ready
    operator: Exists
    tolerationSeconds: 300
  - effect: NoExecute
    key: node.kubernetes.io/unreachable
    operator: Exists
    tolerationSeconds: 300
  volumes:
  - name: default-token-f7th5
    secret:
      defaultMode: 420
      secretName: default-token-f7th5
status:
  conditions:
  - lastProbeTime: null
    lastTransitionTime: "2022-01-04T07:49:48Z"
    status: "True"
    type: Initialized
  - lastProbeTime: null
    lastTransitionTime: "2022-01-04T07:49:49Z"
    status: "True"
    type: Ready
  - lastProbeTime: null
    lastTransitionTime: "2022-01-04T07:49:49Z"
    status: "True"
    type: ContainersReady
  - lastProbeTime: null
    lastTransitionTime: "2022-01-04T07:49:48Z"
    status: "True"
    type: PodScheduled
  containerStatuses:
  - containerID: docker://03a9fa9a975386441944201489c936fab0e6bd8562c201ef2c5cb82fa35a8e46
    image: harbor.od.com/public/nginx:v1.7.9
    imageID: docker-pullable://harbor.od.com/public/nginx@sha256:b1f5935eb2e9e2ae89c0b3e2e148c19068d91ca502e857052f14db230443e4c2
    lastState: {}
    name: nginx
    ready: true
    restartCount: 0
    state:
      running:
        startedAt: "2022-01-04T07:49:49Z"
  hostIP: 10.4.7.21
  phase: Running
  podIP: 172.7.21.3
  qosClass: BestEffort
  startTime: "2022-01-04T07:49:48Z"

• 查看svc的资源配置清单

[root@jdss7-21 ~]# kubectl get svc nginx-dp -o yaml -n kube-public
apiVersion: v1
kind: Service
metadata:
  creationTimestamp: "2022-01-04T07:57:19Z"
  labels:
    app: nginx-dp
  name: nginx-dp
  namespace: kube-public
  resourceVersion: "74379"
  selfLink: /api/v1/namespaces/kube-public/services/nginx-dp
  uid: 2cc6d303-ba90-4580-91b9-82af20840ee3
spec:
  clusterIP: 192.168.5.14
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    app: nginx-dp
  sessionAffinity: None
  type: ClusterIP
status:
  loadBalancer: {}

• 用explain 查看帮助文档

[root@jdss7-21 ~]# kubectl explain service.metadata

• 创建资源配置清单nginx-ds-svc.yaml

apiVersion: v1
kind: Service
metadata:
  labels:
    app: nginx-ds
  name: nginx-ds
  namespace: default
spec:
  
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    app: nginx-ds
  sessionAffinity: None
  type: ClusterIP

使用声明式方式使用资源配置清单

• 干掉名为nginx-ds的svc

[root@jdss7-21 ~]# kubectl delete svc nginx-ds
service "nginx-ds" deleted

• 修改资源配置清单并应用
  离线修改
  kubectl apply -f nginx-ds-svc.yaml
  在线修改
  kubectl edit svc nginx-ds

• 删除资源配置清单

[root@jdss7-21 ~]# kubectl delete svc nginx-ds
service "nginx-ds" deleted
[root@jdss7-21 ~]# kubectl delete -f nginx-ds-svc.yaml 

9.声明式资源管理方法小结

依赖于资源配置清单yaml文件对资源进行管理
对资源的管理，通过事先定义在同一资源配置清单内，陈述式命令应用到K8S集群里

预发格式

kubectl create/apply/delete -f /path/to/yaml

资源配置清单的学习方法:
tip1：多看别人（官方）写的，能读懂
tip2：能照现成的文件改着用
tip3：遇到不懂的，用kubectl explain 查
tip4：初学切忌上来无中生有，自己憋着写

10.flanneId（cni里面的一个插件）

k8s里面的网络模型，集群之间，两个运算节点的docker还不能正常通信

最主要的功能就是：pod资源能够跨宿主机进行通信

不同环境部署多套k8s，要做物理的网络隔离，不要用网络插件做网络隔离的东西

10.1 部署flanned

下载二进制包，解压
必要的配置，签证书，启动脚本
创建目录，用户，委托给
380油费，13次洗车，验车，3月领年检标，验车。年检标。3135.76。（合计2755）

在7.21和7.22计算节点上都装flannel
https://github.com/flannel-io/flannel/releases
下载0.11.0的版本

cd /opt/src
- 二进制包放这里
mkdir -p /opt/flannel-v0.11.0
tar xf flannel-v0.11.0-linux-amd64.tar.gz  -C /opt/flannel-v0.11.0/
 ln -s /opt/flannel-v0.11.0/ /opt/flannel
mkdir -p /opt/flannel/cert
scp jdss7-200:/opt/certs/ca.pem .
scp jdss7-200:/opt/certs/client.pem .
scp jdss7-200:/opt/certs/client-key.pem 
// flannel默认使用etcd做一些存储及配置的

• 创建配置文件

/opt/flannel/subnet.env

FLANNEL_NETWORK=172.7.0.0/16
FLANNEL_SUBNET=172.7.21.1/24
FLANNEL_MTU=1500
FLANNEL_IPMASQ=false

• 创建启动脚本
  /opt/flannel/flanneld.sh

#!/bin/sh
./flanneld \
  --public-ip=10.4.7.21 \
  --etcd-endpoints=https://10.4.7.12:2379,https://10.4.7.21:2379,https://10.4.7.22:2379 \
  --etcd-keyfile=./cert/client-key.pem \
  --etcd-certfile=./cert/client.pem \
  --etcd-cafile=./cert/ca.pem \
  --iface=enp0s3 \
  --subnet-file=./subnet.env \
  --healthz-port=2401

mkdir -p /data/logs/flanneld

• 增加etcd的基础配置
  etcd上设置flanneld的网络配置(7.21上就有etcd)

./etcdctl set /coreos.com/network/config '{"Network":"172.7.0.0/16","Backend":{"Type":"host-gw"}}'

• 添加supervisor配置
  /etc/supervisord.d/flanneld.ini

[program:flanneld-7-21]
command=/opt/flannel/flanneld.sh                        ;
numprocs=1                                              ;
directory=/opt/flannel                                  ;
autostart=true                                          ;
autorestart=true                                        ;
startsecs=30                                            ;
startretries=3                                          ;
exitcodes=0,2                                           ;
stopsignal=QUIT                                         ;
stopwaitsecs=10                                         ;
user=root                                               ;
redirect_stderr=true                                    ;
stdout_logfile=/data/logs/flanneld/flanneld.stdout.log  ;
stdout_logfile_maxbytes=64MB                            ;
stdout_logfile_backups=4                                ;
stdout_capture_maxbytes=1MB                             ;
stdout_events_enabled=false                             ;

• supervisorctl update
  21及22的机器上，都保证flanneld服务开启，各自宿主机上面的pod之间就可以互通了

10.2 flanneId 的host-gateway原理

局限：宿主机必须公用一个网关，在一个网段下
7.22机器上添加了一条路由表(flanneId的host的gateway模式,效率最高,内核转发)

route add -net 172.7.22.0/24 gw 10.4.7.22 dev eth0
route add -net 172.7.21.0/24 gw 10.4.7.21 dev eth0

10.3 flanneId 的vxlan原理（网络隧道）

两台不同的宿主机，每台宿主机虚拟化出来1个虚拟设备flannel.1
网络封包，解包,像VPN

vxlan如何使用
配置不一样

{"Network":"172.7.0.0/16","Backend":{"Type":"VxLAN"}}

查看目前使用的flanneId模式

etcdctl get /coreos.com/network/config
etcdctl rm /coreos.com/network/config
etcdctl set /coreos.com/network/config '{"Network":"172.7.0.0/16","Backend":{"Type":"VxLAN"}}'
重启flanneId，大概需要30秒时间

通过两个虚拟设备，打通虚拟网络设备

10.4 直接路由模型(vxlan和直接路由的混合模型)

当发现两台宿主机在同一个二层网络下的时候，就走host-gateway

{"Network":"172.7.0.0/16","Backend":{"Type":"VxLAN","Directrouting":true}}

10.5 flannel之snat规则优化

修改7.21机器上家目录的nginx-ds.yaml

apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: nginx-ds
spec:
  template:
    metadata:
      labels:
        app: nginx-ds
    spec:
      containers:
      - name: my-nginx
        image: harbor.od.com/public/nginx:curl
        ports:
        - containerPort: 8

kubectl apply -f nginx-ds.yaml
kubectl delete pod nginx-ds-twfkj // 重启pod

172.7.21.3 去访问http://172.7.22.2/ ，发现对端nginx记录的是宿主机的ip

怎么办SNAT转换

[root@jdss7-21 ~]# iptables-save | grep -i postrouting
:POSTROUTING ACCEPT [4:240]
:KUBE-POSTROUTING - [0:0]
-A POSTROUTING -s 172.7.21.0/24 ! -o docker0 -j MASQUERADE // 源地址是172.7.21.0地址段的出口是docker0网卡的，做转换
-A POSTROUTING -m comment --comment "kubernetes postrouting rules" -j KUBE-POSTROUTING
-A KUBE-POSTROUTING -m comment --comment "kubernetes service traffic requiring SNAT" -m mark --mark 0x4000/0x4000 -j MASQUERADE
-A KUBE-POSTROUTING -m comment --comment "Kubernetes endpoints dst ip:port, source ip for solving hairpin purpose" -m set --match-set KUBE-LOOP-BACK dst,dst,src -j MASQUERADE

修改规则
yum install iptables-services -y
systemctl enable iptables
systemctl start iptables

干掉规则-A POSTROUTING -s 172.7.21.0/24 ! -o docker0 -j MASQUERADE
iptables -t nat -D POSTROUTING -s 172.7.21.0/24 ! -o docker0 -j MASQUERADE
添加规则-A POSTROUTING -s 172.7.21.0/24 ! -d 172.7.0.0/16 ! -o docker0 -j MASQUERADE//来源是172.7.21.0/24网段的docker的ip，目标ip不是172.7.0.0/16段，网络发包不从docker0设备出站的，才进行SNAT转换
iptables -t nat -I POSTROUTING -s 172.7.21.0/24 ! -d 172.7.0.0/16 ! -o docker0 -j MASQUERADE
保存规则
iptables-save > /etc/sysconfig/iptables
删除无用的过滤规则
iptables -t filter -D INPUT -j REJECT --reject-with icmp-host-prohibited
iptables -t filter -D FORWARD -j REJECT --reject-with icmp-host-prohibited

容器与容器交互，每次都iptables做snat转换，但容器之间是同一个2类网络
docker与docker之间要坦诚相见，22也做类似的动作，就都不需要做snat转换了

11.coreDns

服务发现核心依赖的组件

• 服务发现，就是服务（应用）之间相互定位的过程
• 服务发现并非云计算时代独有的，传统单体架构也会用到，一下应用场景，更需要服务发现
  • 服务的动态性强（今天服务还在10.4.7.21上，后台就跑了10.4.7.22上）
  • 服务更新发布频繁（小步快跑，先实现，再优化）
  • 服务支持自动伸缩（扩容）

在k8s集群里，pod的ip是不断变化的，如何“以不变应万变”？

• 抽象出了service概念，通过标签选择器，关联一组pod
• 抽象集群网络，通过相对固定集群ip，使服务接入点固定

如何自动关联service资源的名称和集群网络ip呢，从而达到服务被集群自动发现呢

• 传统DNS模型：jdss7-21.host.com -> 10.4.7.21
• 能否在k8s建立这样的模型：nginx-ds -> 192.168.0.5

11.1 安装部署coreDns（通过交付容器的方式交付服务）

11.1.1 部署k8s内网资源配置清单http服务

运维主机7-200上，配置一个虚拟主机，提供k8s统一的资源配置清单访问入口

/etc/nginx/conf.d/k8s-yaml.od.com.conf
server {
	listen	80;
	server_name	k8s-yaml.od.com;
	location / {
		autoindex on;
		default_type text/plain;
		root /data/k8s-yaml;
	}

}

nginx -t
nginx -s reload
然后到dns服务器7-11机器上修改dns配置用于解析k8s-yaml.od.com域名

vim /var/named/od.com.zone
添加内容k8s-yaml        A       10.4.7.200
并序列化后滚动一位

重启dns服务systemctl restart named
验证解析是否生效dig -t -A k8s-yaml.od.com @10.4.7.11 +short

11.1.2 部署coreDns

不下载二进制包了，以容器的方式交付到k8s容器里
选择1.6.1版本

jdss7-200机器上
cd /data/k8s-yaml/coredns

docker pull docker.io/coredns/coredns:1.6.1
docker images | grep coredns
然后打标签，推送到自己的harbor私服中

准备4个yaml文件在jdss7-200机器上
rbac.yaml //权限

apiVersion: v1
kind: ServiceAccount
metadata:
  name: coredns
  namespace: kube-system
  labels:
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    kubernetes.io/bootstrapping: rbac-defaults
    addonmanager.kubernetes.io/mode: Reconcile
  name: system:coredns
rules:
- apiGroups:
  - ""
  resources:
  - endpoints
  - services
  - pods
  - namespaces
  verbs:
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  labels:
    kubernetes.io/bootstrapping: rbac-defaults
    addonmanager.kubernetes.io/mode: EnsureExists
  name: system:coredns
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:coredns
subjects:
- kind: ServiceAccount
  name: coredns
  namespace: kube-system

cm.yaml //ConfigMap

apiVersion: v1
kind: ConfigMap
metadata:
  name: coredns
  namespace: kube-system
data:
  Corefile: |
    .:53 {
        errors
        log
        health
        ready
        kubernetes cluster.local 192.168.0.0/16
        forward . 10.4.7.11
        cache 30
        loop
        reload
        loadbalance
         }

dp.yaml // pod控制器

apiVersion: apps/v1
kind: Deployment
metadata:
  name: coredns
  namespace: kube-system
  labels:
    k8s-app: coredns
    kubernetes.io/name: "CoreDNS"
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: coredns
  template:
    metadata:
      labels:
        k8s-app: coredns
    spec:
      priorityClassName: system-cluster-critical
      serviceAccountName: coredns
      containers:
      - name: coredns
        image: harbor.od.com/public/coredns:v1.6.1
        args:
        - -conf
        - /etc/coredns/Corefile
        volumeMounts:
        - name: config-volume
          mountPath: /etc/coredns
        ports:
        - containerPort: 53
          name: dns
          protocol: UDP
        - containerPort: 53
          name: dns-tcp
          protocol: TCP
        - containerPort: 9153
          name: metrics
          protocol: TCP
        livenessProbe:
          httpGet:
            path: /health
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 60
          timeoutSeconds: 5
          successThreshold: 1
          failureThreshold: 5
      dnsPolicy: Default
      volumes:
        - name: config-volume
          configMap:
            name: coredns
            items:
            - key: Corefile
              path: Corefile

svc.yaml // service

apiVersion: v1
kind: Service
metadata:
  name: coredns
  namespace: kube-system
  labels:
    k8s-app: coredns
    kubernetes.io/cluster-service: "true"
    kubernetes.io/name: "CoreDNS"
spec:
  selector:
    k8s-app: coredns
  clusterIP: 192.168.0.2
  ports:
  - name: dns
    port: 53
    protocol: UDP
  - name: dns-tcp
    port: 53
    protocol: TCP
  - name: metrics
    port: 9153
    protocol: TCP

kubectl apply -f http://k8s-yaml.od.com/coredns/rbac.yaml
kubectl apply -f http://k8s-yaml.od.com/coredns/cm.yaml
kubectl apply -f http://k8s-yaml.od.com/coredns/dp.yaml
kubectl apply -f http://k8s-yaml.od.com/coredns/svc.yaml
kubectl get all -n kube-system

11.2 验证coreDns

[root@jdss7-21 ~]# dig -t A jdss7-21.host.com @192.168.0.2 +short
10.4.7.21

给pod控制器nginx-dp创建一个service
kubectl expose deployment nginx-dp-5dfc689474-t98fx --port=80 -n kube-public
kubectl get service -n kube-public

使用fdn全域名，coreDns来解析，服务名-》具体集群ip的

// service名为nginx-dp
// kube-public是namespace
// svc是service的缩写
// cluster集群
// local 本地后缀
[root@jdss7-21 ~]# dig -t A nginx-dp.kube-public.svc.cluster.local @192.168.0.2 +short
192.168.5.14
[root@jdss7-21 ~]# dig -t A nginx-dp.kube-public.svc.cluster.local. @192.168.0.2 +short
192.168.5.14

只有集群内部的pod里才能使用短域名直接到对端nginx-dp.kube-public
是因为dns配置文件中使用了search 短域名匹配规则

12.服务暴露

集群内部通过服务名去找
集群外怎么找？nginx-dp.kube-public.svc.cluster.local 是不通的
(coreDns只在集群内部生效，外部不生效)

12.1 nodeport模式

12.1.1 修改kube-proxy使用iptables模式，而不是ipvs模式，nodeport的service演示

• 7.21和7.22的计算节点上修改kube-proxy使用iptables模式
  vim /opt/kubernets/server/bin/kube-proxy.sh
  
  supervisorctl restart kube-proxy
• 7.21和7.22的计算节点上删除ipvs的计算规则
  

12.1.2 nginx-ds的service使用nodeport方式暴露外面（pod里的80端口映射到宿主机的8000端口）

12.1.3 实际是写iptables规则

12.2 ingress模式

专门暴露7层应用，特指http和https协议（https还比较麻烦，建议暴露http就可以了）

www.od.com/abc -> tomcat
www.od.com/edf -> nodejs
www.od.com/qwe -> php

ingress规则可以定义一个www.od.com的域名支持，根据不同的url，分发到不同的service
实际的流量调度是从集群外面的用户请求->ingress->根据不同的域名及路径的匹配规则抛给不同的service
service再通过label selector去找到pod，真正提供服务的是pod
kube-proxy是service的一个实现

ingress其实就是简化版的nginx+一个go脚本
常用的ingress控制器的实现软件

• Ingress-nginx
• HAProxy
• Tracfik

12.2.1 部署Tracfik

以资源配置清单，也就是pod启动的方式部署tracfik

• 准备好镜像

7.200机器/data/k8s-yaml目录
# mkdir -p /data/k8s-yaml/traefik
# cd /data/k8s-yaml/traefik
// 建议使用1.7.2版本
# docker pull traefik:v1.7.2-alpine
# docker images | grep traefik
# docker tag add5fac61ae5 harbor.od.com/public/traefik:v1.7.2
# docker push harbor.od.com/public/traefik:v1.7.2

• 准备好资源配置清单
  rbac.yaml（鉴权）

apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik-ingress-controller
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: traefik-ingress-controller
rules:
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: traefik-ingress-controller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik-ingress-controller
subjects:
- kind: ServiceAccount
  name: traefik-ingress-controller
  namespace: kube-system

ds.yaml(daemonSet控制器，每个宿主机都要起一个pod)

apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: traefik-ingress
  namespace: kube-system
  labels:
    k8s-app: traefik-ingress
spec:
  template:
    metadata:
      labels:
        k8s-app: traefik-ingress
        name: traefik-ingress
    spec:
      serviceAccountName: traefik-ingress-controller
      terminationGracePeriodSeconds: 60
      containers:
      - image: harbor.od.com/public/traefik:v1.7.2
        name: traefik-ingress
        ports:
        - name: controller
          containerPort: 80
          hostPort: 81 // 映射到宿主机的81端口
        - name: admin-web
          containerPort: 8080
        securityContext:
          capabilities:
            drop:
            - ALL
            add:
            - NET_BIND_SERVICE
        args:
        - --api
        - --kubernetes
        - --logLevel=INFO
        - --insecureskipverify=true
        - --kubernetes.endpoint=https://10.4.7.10:7443
        - --accesslog
        - --accesslog.filepath=/var/log/traefik_access.log/traefik_access
        - --traefiklog
        - --traefiklog.filepath=/var/log/traefik.log
        - --metrics.prometheus

service.yaml（服务）

apiVersion: v1
kind: Service
metadata:
  name: traefik-ingress-service
  namespace: kube-system
spec:
  selector:
    k8s-app: traefik-ingress
  ports:
    - protocol: TCP
      port: 80
      name: controller
    - protocol: TCP
      port: 8080
      name: admin-web 

ingress.yaml

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: traefik-web-ui
  namespace: kube-system
  annotations:
    kubernetes.io/ingress.class: traefik
spec:
  rules:
  - host: traefik.od.com
    http:
      paths:
      - path: /
        backend:
          serviceName: traefik-ingress-service
          servicePort: 8080   

• 使资源配置清单文件生效
  kubectl apply -f http://k8s-yaml.od.com/traefik/rbac.yaml
  kubectl apply -f http://k8s-yaml.od.com/traefik/ds.yaml
  kubectl apply -f http://k8s-yaml.od.com/traefik/service.yaml
  kubectl apply -f http://k8s-yaml.od.com/traefik/ingress.yaml

kubectl get pods -n kube-system
kubectl describe pod traefik-ingress-qjp62
(重启kubectl)

• 配置反代（10.4.7.11 ，10.4.7.12机器上od.com.conf）

upstream default_backend_traefik {
    server 10.4.7.21:81 max_fails=3 fail_timeout=10s;
    server 10.4.7.22:81 max_fails=3 fail_timeout=10s;
}
server {
    server_name *.od.com;
    location / {
      proxy_pass http://default_backend_traefik;
      proxy_set_header Host  $http_host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

}

• dns添加A记录
  traefik.od.com

• 展示