K8S学习笔记

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

# 更新前
Deployment「Pod模板:v1，副本数量：3」
└─ RS「副本数量：3」
		├─ Pod:v1
		├─ Pod:v1
		└─ Pod:v1
# 更新Pod模板:v2
# 更新中：
Deployment「Pod模板:v1，副本数量：3」
├─ RS「副本数量：2」
│  ├── Pod:v1
│  └── Pod:v1
└─ RS「副本数量：1」
	 └─ Pod:v2
# 更新完毕：
Deployment「Pod模板:v1，副本数量：3」
├─ RS「副本数量：0」
└─ RS「副本数量：3」
		├─ Pod:v2
		├─ Pod:v2
		└─ Pod:v2
	 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

# 添加阿里云镜像源
sudo apt update && sudo apt install -y apt-transport-https
sudo curl https://mirrors.aliyun.com/kubernetes/apt/doc/apt-key.gpg | sudo apt-key add - 

# 添加阿里云或者官方 api 源
# 阿里云
echo "deb https://mirrors.aliyun.com/kubernetes/apt/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list
# 官方
sudo curl -o /usr/share/keyrings/kubernetes-archive-keyring.gpg https://packages.cloud.google.com/apt/doc/apt-key.gpg 
echo "deb [signed-by=/usr/share/keyrings/kubernetes-archive-keyring.gpg] https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list

# 安装软件
sudo apt update && sudo apt install -y kubelet kubeadm kubectl

# 开机自启
systemctl enable kubelet.service
# 注意，此时可能 kublet 没正常运行，不用管继续往下走

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

# 打印 kubeadm 默认配置
sudo kubeadm config print init-defaults > kubeadm-config.yaml

# 修改：`localAPIEndpoint.advertiseAddress`的值为当前主节点的 ip 地址
...
localAPIEndpoint:
  advertiseAddress: 1.2.3.4 # 这里
  bindPort: 6443
...

# 修改：`nodeRegistration.name` 的值为当前主节点名称
···
nodeRegistration:
  criSocket: unix:///var/run/containerd/containerd.sock
  imagePullPolicy: IfNotPresent
  name: k8s-master01 # 这里
  taints: null
···

# 添加 Pod 网段，Flannel 需要工作在指定的网段
...
networking:
  dnsDomain: cluster.local
  serviceSubnet: 10.96.0.0/12
  podSubnet: 10.244.0.0/16 # 新增该行
···

# 设置负载均衡方式为 ipvs（可选），下列配置添加到末尾，注意 --- 也需要添加
···
---
apiVersion: kubeproxy.config.k8s.io/v1alpha1
kind: KubeProxyConfiguration
featureGates:
	SupportIPVSProxyMode: true
mode: ipvs
···

# k8s.gcr.io 国内无法直接访问，所以替换为阿里云镜像地址
sed -i 's/k8s.gcr.io/registry.cn-hangzhou.aliyuncs.com\/google_containers/g' kubeadm-config.yaml
# 配置文件准备完毕，开始初始化
sudo kubeadm init --config=kubeadm-config.yaml --ignore-preflight-errors=all --v=5 | tee kubeadm-init.log

# 初始化成功根据页面提示
  # 非 root 用户
  mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config
  # root 用户
  export KUBECONFIG=/etc/kubernetes/admin.conf

# 查看集群信息
kubectl cluster-info

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

# 在初始化主节点成功后，打印出的日志内的最后一段，告诉了我们应该如何加入一个主节点
# 也可以 cat kubeadm-init.log 查看

# 加入前查看当前主机名称 hostnamectl，可以修改为自己便于识别的名称
sudo hostnamectl set-hostname k8s-node01 --static
# 加入节点
sudo kubeadm join 192.168.31.100:6443 --token xxx.xxx \
        --discovery-token-ca-cert-hash sha256:xxx

# 如果提示 unable to fetch the kubeadm-config ConfigMap: faild to get config map: Unauthorized
# 这个代表 token 过期，重新生成即可
sudo kubeadm token create --ttl 0 --print-join-command

# 如果提示
# [kubelet-check] Initial timeout of 40s passed.
# error execution phase kubelet-start: error uploading crisocket: timed out waiting for the condition
# To see the stack trace of this error execute with --v=5 or higher
sudo kubeadm reset -f

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# 1、将节点设置为维护模式
kubectl drain k8s-node01 --delete-local-data --force --ignore-daemonsets node/k8s-node01
# 2、删除节点
kubectl delete node k8s-node01

# 登陆上节点机器
# 3、停止 kubelet
systemctl stop kubelet
# 4、k8s 重置
sudo kubeadm reset -f

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# 拷贝配置文件
sudo mkdir -p /usr/local/kubernetes/cni/flannel/
cd /usr/local/kubernetes/cni/flannel/
wget https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml

# 应用配置
kubectl apply -f kube-flannel.yml

# 等待2～3分钟，查看是否成功
kubectl get nodes
# 可以看到所有节点都显示 ready

1
2
3
4

# 创建一个 deployment 任务 指定镜像
kubectl create deployment nginx --image=nginx
# 获取 pod 列表
kubectl get po -o wide

1
2
3
4

# 创建一个 svc 网络
kubectl create svc clusterip nginx --tcp=80:80
# 查看当前 svc 网络
kubectl get svc

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

apiVersion: group/apiversion # 如果没有给定 group 名称，那么默认为 core，可以使用 kubectl apt-versions 获取当前 k8s 版本上所有的 apiVersion 版本信息（每个版本可能不同）
kind: # 资源类别
metadate: # 资源元数据
	name
	namespace
	lables
	annotations # 主要目的是方便用户阅读查找
spec: # 期望的状态 （disired state）

status: # 当前状态，本字段由 kubernetes 自身维护，用户不能定义

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

# 查询
# -n 指定命名空间，默认为 default
kuebctl get pod -o wide -l [key/key=values] # 获取 pod 列表
kubectl get pod podName -o json/yaml # 获取 pod 详细信息
kubectl log podName # 获取 pod 日志
kubectl describe pod podName # 获取 pod 事件信息

# 操作
kubectl create -f filename # 创建资源
kubectl exec -it podName -c containerName -- [script] # 在某个容器内执行脚本
kubectl delete [res] [--all | name] # 删除资源
kubectl scale --replicas=[num] [controllerKind]/[resName] # 修改某个控制器的副本数量

1
2
3
4
5
6
7

kubectl api-versions
# output:
admissionregistration.k8s.io/v1
apiextensions.k8s.io/v1
apiregistration.k8s.io/v1
apps/v1
...

1
2
3
4
5
6
7
8

apiVersion <string>        # 表示字符串类型
metadata <object>          # 表示需要嵌套多层字段
labels <map[string]string> # 表示由 k:v 组成的映射
finalizers <[]string>      # 表示字符串列表
ownerReferences <[]object> # 表示对象列表
hostPID <boolean>          # true | flase
priority <integer>         # 整型
name <string> -required-   # 如果类型后面接 required，表示为必填字段

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

apiVersion: v1
kind: Pod
metadate:
	name: pod-demo
	namespace: default
	lables:
		app: myPod
spec:
	containers:
  - name: myPod-1
	  image: nginx
  - name: myPod-2
    image: busybos:1.34.1
    command:
    - "/bin/sh"
    - "-c"
    - "sleep 3600"

1
2

# 使用 -o 选项加 yaml，可以将资源的配置以 yaml 的格式输出，也可以使用 json
kubectl get pod xxx.xxx.xxx -o yaml

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

# testpod.yaml
apiVersion: v1
kind: Pod
metadata:
  name: my-nginx-pod
  labels:
    app: my-nginx
spec:
  containers:
  - name: my-nginx
    image: nginx
  initContainers:
  - name: init-my-service
    image: busybox
    command: ['sh', '-c', 'until nslookup my-service; do echo waiting for my-service; sleep 2; done;']
  - name: init-my-db
    image: busybox
    command: ['sh', '-c', 'until nslookup my-db; do echo waiting for my-db; sleep 2; done;']

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

# init-testpod.yaml
apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  ports:
  - protocol: TCP
    port: 80
    targetPort: 9376
---
apiVersion: v1
kind: Service
metadata:
  name: my-db
spec:
  ports:
  - protocol: TCP
    port: 80
    targetPort: 9377

1

kubectl create -f init-pod.yaml

1

kubectl get po

1

kubectl logs my-nginx-pod -c init-my-service

1

kubectl create -f init-test-pod.yaml

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

# readinessProbe-httpget
apiVersion: v1
kind: Pod
metadata:
  name: reaadiness-httpget-pod
  namespace: default
  labels:
    app: myapp
spec:
  containers:
  - name: readiness-httpget-container
    image: nginx
    imagePullPolice: IfNotPresent
    readinessProbe: # 配置就绪探针
      httpGet: # 探针类型，请求端口和 path
        port: 80
        path: readiness.html
      initialDelaySeconds: 1 # 开始探测延迟
      periodSeconds: 3 # 探测间隔

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

# livenessProbe-exec
apiVersion: v1
kind: Pod
metadata:
  name: liveness-exec-pod
  namespace: default
spec:
  containers:
  - name: liveness-exec-container
    image: busybox
    imagePullPolicy: IfNotPresent
    command: ["/bin/sh", "-c", "touch /tmp/live; sleep 60; rm -rf /tmp/live; sleep 3600"] # 运行脚本
    livenessProbe:
      exec: # exec 类型探针
        command: ["test", "-e", "/tmp/live"] # 执行脚本
      initialDelaySeconds: 1 # 开始探测延迟
      periodSeconds: 3 # 探测间隔

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

# livenessProbe-httpget
apiVersion: v1
kind: Pod
metadata:
  name: liveness-httpget-pod
  namespace: default
spec:
  containers:
  - name: liveness-httpget-container
    image: nginx
    imagePullPolicy: IfNotPresent
    ports:
    - name: http
      containerPort: 80
    livenessProbe:
      httpGet: # 探针类型，请求端口和 path
        port: 80
        path: index.html
      initialDelaySeconds: 3 # 开始探测延迟
      periodSeconds: 3 # 探测间隔
      timeoutSeconds: 3 # 超时时间

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

# livenessProbe-tcp
apiVersion: v1
kind: Pod
metadata:
  name: liveness-tcp-pod
  namespace: default
spec:
  containers:
  - name: liveness-tcp-container
    image: nginx
    imagePullPolicy: IfNotPresent
    ports:
    - name: tcp
      containerPort: 80
    livenessProbe:
      tcpSocket: # 探针类型，请求端口
        port: 80
      initialDelaySeconds: 5 # 开始探测延迟
      timeoutSeconds: 1 # 超时时间

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

apiVersion: v1
kind: Pod
metadata:
  name: lifecycle-demo
spec:
  containers:
  - name: lifecycle-demo-container
    image: nginx
    lifecycle: # 生命周期
      postStart: # 启动前
        exec:
          command: ["/bin/sh", "-c", "echo postStart > /usr/share/message"]
      preStart: # 关闭前
        exec:
          command: ["/bin/sh", "-c", "echo preStart > /usr/share/message"]

1

while true; do cat /usr/share/message; done

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

# file: rc.yaml
apiVersion: v1
kind: ReplicationController
metadata:
  name: frontend
spec:
  replicas: 3 # 副本数量
  selector: # 标签选择器，寻找 app=nginx 的 Pod
    app: nginx
  template: # 创建 Pod 模板
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80

1

kubectl create -f rc.yaml

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

apiVersion: v1
kind: ReplicaSet
metadata:
  name: frontend
spec:
  replicas: 3 # 副本数量
  selector: # 标签选择器，寻找 app=nginx 的 Pod
    matchLabels:
      app: nginx1
    # matchExpressions: 可选
  template: # 创建 Pod 模板
    metadata:
      labels:
        app: nginx1
    spec:
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80

1

kubectl explain rs.spec.selector

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

# selector exists demo
apiVersion: v1
kind: ReplicaSet
metadata:
  name: rs-demo
spec:
  selector:
    matchExpressions: # 这里
      - key: app
        operator: Exists # label 中 key 为 app 存在即可
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

# selector In demo
apiVersion: v1
kind: ReplicaSet
metadata:
  name: rs-demo
spec:
  selector:
    matchExpressions: # 这里
      - key: app
        operator: In # label 中 key 对应的 value 在枚举的 values 中即可
        values:
        - nginx
        - nginx1
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  replicas: 3
  template:
    metadate:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80

1
2

kubectl apply -f https://kubernetes.io/docs/user-guide/nginx-deployment.yaml --record
# --record 可以记录当前命令到 deployment 到历史记录中

1
2

# 修改副本数量为 10，不会影响 deployment 已经创建的 rs
kubectl scale deployment nginx-deployment --replicas 10

1

kubectl autoscale deployment nginx-deployment --min=10 --max=15 --cpu-percent=80

1

kubectl set image deployment/nginx-deployment nginx=nginx:1.9.1

1

kubectl rollout undo deployment/nginx-deployment

1
2
3
4
5
6
7
8
9

# 查看历史版本记录，如果使用了 --replicas 会显示当时的命令
kubectl rollout history deployment/nginx-deployment
# 回滚到指定版本
kubectl rollout undo deployment/nginx-deployment --to-revision=2

# 暂停 deployment 的更新
kubectl rollout pause deployment/nginx-deployment
# 可以使用 kubectl rollout status 查看回滚是否完成，同时命令返回 code 为 0，可以使用脚本来判断
kubectl rollout status depoyment/nginx-deployment

1
2
3
4
5
6
7

# 查询当前更新策略
kubectl describe deployments {控制器名称} # 找到 RollingUpdateStrategy

# 修改当前更新策略
kubectl edit deployment {控制器名称} # 找到 rollingUpdate
# 或者使用 patch 打补丁
kubectl patch deployment nginx-deployment -p '{"spec": {"strategy": {"rollingUpdate": {"maxSurge":1, "maxUnavailable": 0}}}}'

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# 需要设置当前更新策略为 maxSurge:1 maxUnavailable:0
kubectl patch deployment nginx-deployment -p '{"spec": {"strategy": {"rollingUpdate": {"maxSurge":1, "maxUnavailable": 0}}}}'

# 开始更新后直接暂停，此时只会新建一个新版本的 Pod，旧版本的 Pod 不会进行删除
# 此时 svc 网络会将流量负载均衡至当前全部 Pod，就可以测试新版本了
kubectl set image deployment nginx-deployment nginx=nginx:1.9.1 \
&& kubectl rollout pause deployment nginx-deployment

# 等待测试结束后，继续更新
kubectl rollout resume deployment nginx-deployment

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: daemonset-example
  labels:
    app: daemonset
spec:
  selector:
    matchLabels:
      name: daemonset-example
  template:
    metadata:
      labels:
        name: daemonset-example
    spec:
      containers:
      - name: daemonset-example
        image: nginx

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

apiVersion: batch/v1
kind: Job
metadata:
  name: job
spec:
  template:
    metadata:
      name: job
    spec:
      containers:
      - name: job
        image: busybox
        command: ['echo', 'this is a job container']
      restartPolicy: Never

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

apiVersion: v1
kind: Service
metadata:
  name: myapp
  namespace: default
spec:
  type: ClusterIP
  selector:
    app: myapp
    relese: stable
  ports:
  - name: http
    port: 80
    targetPort: 80

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

apiVersion: v1
kind: Service
metadata:
  name: myapp-headless
  namespace:  default
spec:
  selector:
    app: myapp
  clusterIP: "None"
  ports:
  - port: 80
    targetPort: 80

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

apiVersion: v1
kind: Service
metadata:
  name: myapp-nodeport
  namespace: default
spec:
  type: NodePort
  selector:
    app: myapp
    relese: stable
  ports:
  - name: http
    port: 80
    targetPort: 80
    nodePort: 30000 # 可指定

1
2
3
4
5
6
7
8

kind: Service
apiVersion: v1
metadata:
  name: my-service
  namespace: default
spec:
  type: ExternalName
  externalName: myapp.otherNS

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: myapp
spec:
  replicas: 2
  template:
    metadata:
      labels:
        name: app
      spec:
        containers:
          - name: nginx
            image: myapp:v1
            imagePullPolicy: IfNotPresent
            ports:
              - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: app-svc
spec:
  ports:
    - port: 80
      targetPort: 80
      protocol: TCP
  selector:
    name: app
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: app-ingress
spec:
  rules:
    - host: test.localhost
      http:
        paths:
          - path: /
            backend:
              serviceName: app-svc
              servicePort: 80

1
2
3

# 创建证书
openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=nginxsvc /O=nginxsvc"
kubectl create secret tls tls-secret --key tls.key --cert tls.crt

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: app-ingress
spec:
  tls:
    - hosts:
      - test.localhost
      secretName: tls-secret
  rules:
    - host: test.localhost
      http:
        paths:
          - path: /
            backend:
              serviceName: app-svc
              servicePort: 80

1
2
3

yum -y install httpd-tools
htpasswd -c auth foo
kubectl create secret generic basic-auth --form-file=auth

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress-with-auth
  anntations:
    nginx.ingress.kubernetes.io/auth-type: basic
    nginx.ingress.kubernetes.io/auth-secret: basic-auth
    nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - foo'
spec:
  rules:
    - host: test.localhost
      http:
        paths:
          - path: /
            backend:
              serviceName: app-svc
              servicePort: 80 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

ls /root/game
# game.file
# ui.file

cat /root/game/game.file
# version=1.17
# name=dave
# age=18

cat /root/game/ui.file
# level=2
# color=yellow

kubectl create configmap game-config --from-file=/root/game

1

kubectl create configmap game-config-2 --from-file=/root/game/game.file

1
2
3

kubectl create configmap literal-config --from-literal=name=dave --from-literal=password=pass

kubectl get configmap literal-config -o yaml

1
2
3
4
5
6
7
8

apiVersion: v1
kind: ConfigMap
metadata:
  name: literal-config
  namespace: default
data:
  name: dave
  password: pass

1
2
3
4
5
6
7

apiVersion: v1
kind: ConfigMap
metadata:
  name: env-config
  namespace: default
data:
  log_level: INFO

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

apiVersion: v1
kind: Pod
metadata:
  name: cm-env-test-pod
spec:
  containers:
    - name: test-container
      image: myapp:v1
      command: ["/bin/sh", "-c", "env"]
      env: # 单个指定
        - name: USERNAME
          valueFrom:
            configMapKeyRef:
              name: literal-config
              key: name
        - name: PASSWORD
          valueForm:
            configMapKeyRef:
              name: literal-config
              key: password
      envFrom: # 批量注入
        - configMapRef:
          name: env-config
  restartPolicy: Never

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

apiVersion: v1
kind: Pod
metadata:
  name: cm-env-test-pod
spec:
  containers:
    - name: test-container
      image: myapp:v1
      command: ["/bin/sh", "-c", "echo $(USERNAME) $(PASSWORD)"]
      env: # 单个指定
        - name: USERNAME
          valueFrom:
            configMapKeyRef:
              name: literal-config
              key: name
        - name: PASSWORD
          valueForm:
            configMapKeyRef:
              name: literal-config
              key: password
  restartPolicy: Never

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

apiVersion: v1
kind: Pod
metadata:
  name: cm-volume-test-pod
spec:
  containers:
    - name: test-container
      image: myapp:v1
      volumeMounts:
      - name: config-volume
        mountPath: /etc/config
   volumes:
     - name: config-volume
       configMap:
         name: literal-config
  restartPolicy: Never

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

# 初始内容
apiVersion: v1
kind: ConfigMap
metadata:
  name: log-cofnig
  namespace: default
data:
  log_level: INFO
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: hot-update
spec:
  replicas: 1
  template:
    metadata:
      labels:
        run: my-nginx
    spec:
      containers:
        - name: my-nginx
          image: myapp:v1
          ports:
            - containerPort: 80
          volumeMounts:
            - name: config-volume
              mountPath: /etc/config
      volumes:
        - name: config-volume
          configMap:
            name: log-config

1
2

kubectl exec pod-xxx cat /etc/config/log_level
# INFO

1
2

kubectl edit cm log-config
# log_level=ERROR

1
2

kubectl exec pod-xxx cat /etc/config/log_level
# ERROR

1

kubectl patch deploy my-nginx --patch '{"spec": {"template": {"metadata": {"anntations": {"version/config": "20190411"}}}}}'

1
2
3
4

kubectl exec pod-xxx -- ls /run/secrets/kubernetes.io/serviceaccount
# ca.crt
# namespace
# token

1
2
3
4

$ echo -n "admin" | base64
YWRtaW4=
$ echo -n "123456" | base64
MTIzNDU2

1
2
3
4
5
6
7
8

apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Opaque
data:
  username: YWRtaW4=
  password: MTIzNDU2

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

apiVersion: v1
kind: Pod
metadata:
  labels:
    name: secret-test
  name: secret-test
spec:
  volumes:
    - name: volumes12
      secret:
        secretName: mysecret
  containers:
    - image: myapp:v1
      name: db
      volumeMounts:
        - name: volumes12
          mountPath: "/data"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  labels:
    name: pod-deployment
spec:
  replicas: 2
  template:
    metadata:
      labels:
        app: pod-deployment
    spec:
      containers:
        - name: pod-1
          image: myapp:v1
          ports:
            - containerPort: 80
          env:
            - name: TEST_USER
              valueFrom:
                secretKeyRef:
                  name: mysecret
                  key: username
            - name: TEST_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: mysecret
                  key: password

1
2
3
4
5
6
7

$ kubectl create secret docker-registry myregistrykey \
--docker-server=DOCKER_REGISTRY_SERVER \
--docker-username=DOCKER_USER \
--docker-password=DOCKER_PASSWOED \
--docker-email=DOCKER_EMAIL

secret "myregistrykey" created。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

apiVersion: v1
kind: Pod
metadata:
  name: foo
spec:
  containers:
    - name: foo
      image: hub.xxx.com/xxx/xxxx
  imagePullSecrets:
    - name: myregistrykey

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

apiVersion: batch/v1
kind: Job
metadata:
  name: jobs-empty
spec:
  template:
    spce:
      restartPolicy: Never
      initContainers:
        - name: job-1
          image: busybox:1.34.1
          command:
            - "sh"
            - "-c"
            - >
              for i in 1 2 3;
              do
                echo "job-1 `date`";
                sleep 1s;
              done;
              echo job-1 GG > /src/input/code              
          volumeMounts: # 挂载一个卷
            - name: input
              mountPath: /src/input/
        - name: job-2
          image: busybox:1.34.1
          command:
            - "sh"
            - "-c"
            - >
              for i in 1 2 3;
              do
                echo "job-2 `date`";
                sleep 1s;
              done;
              cat /src/input/code &&
              echo job-2 GG > /sec/input/output/file              
          volumeMounts: # 挂载两个卷
            - name: input
              mountPath: /src/input/
            - name: output
              mountPath: /src/input/output/
      containers:
        - name: job-3
          image: busybox:1.34.1
          command:
            - "sh"
            - "-c"
            - >
              echo "job-1 and job-2 completed";
              sleep 3s;
              cat /src/output/file              
          volumeMounts:
            - name: output
              mountPath: /src/output/
      volumes:
        - name: input
          emptyDir: {}
        - name: output
          emptyDir: {}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

apiVersion: v1
kind: Pod
metadata:
  name: test-pd
spec:
  containers:
    - image: myapp:v1
      name: test-container
      volumeMounts:
        - name: test-volume
          mountPath: /test-pd
  volumes:
    - name: test-volume
      hostPath:
        path: /data
        type: Dirctory