kubectl get pod -A #可以查看所有命名空间podkubectl get ns #可以查看所有命名空间namespace每个 Pod 必须属于且仅属于一个 NamespaceNamespace 是 Pod 的 作用域用来隔离你执行kubectl get pod不加参数只看default楼层的小组加-n kube-system才看kube-system这个 运维部专用楼层 的小组加-A就是查看整栋大楼所有楼层的所有小组创建namespace的两种方式一直接create· kubectl create namespace tuling二yaml方式yaml格式——:后必须有一个空格下一级必须空两格apiVersion: v1kind: Namespacemetadata:name: ljh然后apply进行创建kubectl apply -f ns.yaml删除namespacekubectl delete namespace ljhpodpod 里面可以有一个或多个容器运行一个podkubectl run mynginx --imagenginx:1.14.2 -n ljhpod名 指定镜像 指定ns排错技巧万一哪个没起来或者什么报错可以用kubectl describe排错例如kubectl describe pod mynginx -n ljh #-n没有就不用kubectl logs pod-namekubectl get pod name -owide查看详情[rootk8s-master ~]# kubectl get pod -owideNAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATESmynginx 1/1 Running 0 27m 10.244.113.129 k8s-node none none这个网段10.244.0.0是在初始化master节点时就设定的了检查这个ready是否为1/1,0/1的话很可能是网卡选错了编辑配置文件kubectl edit daemonset calico-node -n kube-system在env部分添加- name: IP_AUTODETECTION_METHODvalue: interfaceens33#设为自己的内网网卡#yaml创建podapiVersion: v1 # Pod的API版本固定写法kind: Pod # 资源类型这里是创建Podmetadata:labels:run: mynginx # Pod的标签用来被Service筛选name: mynginx # Pod的名称spec:containers:- name: nginx # 容器名image: nginx # 用的镜像这里是最新版nginxports:- containerPort: 80 # 声明容器暴露80端口之前kubectl run没加这个现在补上了如果是一个pod含多个容器apiVersion: v1kind: Podmetadata:labels:run: mynginxname: mynginxspec:containers:- name: nginximage: nginxports:- containerPort: 80- image: tomcat:9.0.55name: tomcat#name和image的顺序有要求吗完全没有要求谁在前谁在后都可以YAML 不关心对象里键的顺序只要缩进对就行。进入pod容器内kubectl exec -it mynginx -c tomcat -- sh#deployment用deployment创建podkubectl create deployment my-tomcat --imagetomcat:9.0.55用了deployment后再删除pod会立刻又拉取一个pod如果是要真的删除的话kubectl delete deployment my-tomcat多副本kubectl create deployment my-tomcat --imagetomcat:9.0.55 --replicas3#一次创建三个#yaml形式创建deploymentapiVersion: apps/v1# Deployment的稳定API版本固定写法kind: Deployment# 资源类型声明这是一个Deploymentmetadata:# 元数据资源的基本身份信息labels:# 给Deployment本身打标签方便后续筛选查询app: my-tomcat# 标签键值对标识这个Deployment属于my-tomcatname: my-tomcat# Deployment的名称后续所有操作都用这个名字spec:# 核心规格定义Deployment的具体行为replicas: 3# 副本数要求集群中永远保持3个相同的Pod在运行selector:# 筛选器告诉Deployment要管理哪些PodmatchLabels:# 按标签匹配Podapp: my-tomcat# 只管理带【appmy-tomcat】标签的Podtemplate:# Pod模板Deployment按这个模板批量创建Podmetadata:# Pod的元数据labels:# 给创建出来的Pod打标签app: my-tomcat# Pod的标签必须和上面selector的标签完全一致spec:# Pod的核心规格containers:# Pod内的容器列表一个Pod可以跑多个容器- image: tomcat:9.0.55# 容器使用的镜像指定版本9.0.55name: tomcat# 容器的名称在Pod内唯一方便看日志/进容器排障#扩容与缩容# 扩容到5个Podkubectl scale --replicas5 deployment my-tomcat# 缩容到3个Podkubectl scale --replicas3 deployment my-tomcat#升级回滚升级kubectl set image deployment my-tomcat tomcattomcat:10.1.11 --record查看历史版本kubectl rollout history deploy my-tomcat回滚kubectl rollout undo deployment my-tomcat#暴露端口-在已有的pod中servicekubectl expose deployment my-tomcat --nametomcat --port8080 --typeNodePort#my-tomcat 要暴露的 Deployment 名字kubectl get svc -owide#查看service端口ip——不搞service的话浏览器访问不了#yaml格式——app my-tomcatdeployment名label是打标签selector才是 **“找目标” 的规则 **它会在集群里找到所有带有app: my-tomcat标签的 Pod然后把流量转发给它们。#target我们想要暴露的端口#nodeport对外暴露能访问的端口#portserver内部访问端口#挂载nfs先在所以节点安装nfs# 1. 所有节点master/node都要执行安装 NFS 客户端工具yum install -y nfs-utils# 2. 在 master 节点配置共享目录权限echo /nfs/data/ *(insecure,rw,sync,no_root_squash) /etc/exports# 3. 创建共享目录mkdir -p /nfs/data# 4. 启用并启动 rpcbind 和 nfs-server 服务systemctl enable rpcbindsystemctl enable nfs-serversystemctl start rpcbindsystemctl start nfs-server# 5. 使配置生效exportfs -r#node节点的nfs挂载mkdir -p /nfs/datamount -t nfs masterip:/nfs/data /nfs/data#nginx-pv.yamlapiVersion: apps/v1kind: Deploymentmetadata:labels:app: nginx-pv-demoname: nginx-pv-demospec:replicas: 2selector:matchLabels:app: nginx-pv-demotemplate:metadata:labels:app: nginx-pv-demospec:containers:- image: nginxname: nginxvolumeMounts:- name: htmlmountPath: /usr/share/nginx/htmlvolumes:- name: htmlnfs:server: 192.168.11.101 # 替换为你的 NFS 服务器 IPmaster 节点 IPpath: /nfs/data/nginx-pv#缺点需要知道ip地址还有删除pod时会保留不可自主决定去留#pv挂载要管理员先创有pv.yaml静态供应apiVersion: v1kind: PersistentVolumemetadata:name: pv01-10mspec:capacity:storage: 10M # 声明这个卷的容量为 10MBaccessModes:- ReadWriteMany # 支持多节点同时读写storageClassName: nfs # 存储类和 PVC 对应nfs:path: /nfs/data/01 # NFS 服务器上的目录server: 192.168.11.101 # NFS 服务器 IP---apiVersion: v1kind: PersistentVolumemetadata:name: pv02-1gispec:capacity:storage: 1Gi # 声明这个卷的容量为 1GBaccessModes:- ReadWriteManystorageClassName: nfsnfs:path: /nfs/data/02server: 192.168.11.101---apiVersion: v1kind: PersistentVolumemetadata:name: pv03-3gi # 注意你截图里写的是 py03-3gi应该是笔误标准写法是 pv03-3gispec:capacity:storage: 3Gi # 声明卷容量为 3GBaccessModes:- ReadWriteMany # 允许多个节点同时读写storageClassName: nfs # 存储类和 PVC 绑定匹配用nfs:path: /nfs/data/03 # NFS 服务器上的共享目录server: 192.168.11.101 # NFS 服务器 IPmaster 节点#pvc.yaml创建一个存储空间pvc申请一般是自己写apiVersion: v1kind: PersistentVolumeClaimmetadata:name: nginx-pvcspec:accessModes:- ReadWriteManyresources:requests:storage: 200MistorageClassName: nfs#最后创建pod也是自己写apiVersion: apps/v1kind: Deploymentmetadata:labels:app: nginx-deploy-pvcname: nginx-deploy-pvcspec:replicas: 2selector:matchLabels:app: nginx-deploy-pvctemplate:metadata:labels:app: nginx-deploy-pvcspec:containers:- image: nginxname: nginxvolumeMounts:- name: htmlmountPath: /usr/share/nginx/html # 挂载到Nginx网页目录volumes:- name: htmlpersistentVolumeClaim:claimName: nginx-pvc # 绑定你之前创建的PVC缺点容易资源浪费#动态供应nfs-storage.yamlapiVersion: storage.k8s.io/v1kind: StorageClassmetadata:name: nfs-storageannotations:storageclass.kubernetes.io/is-default-class: false #决定是不是作为默认的provisioner: k8s-sigs.io/nfs-subdir-external-provisionerparameters:archiveOnDelete: true---apiVersion: apps/v1kind: Deploymentmetadata:name: nfs-client-provisionerlabels:app: nfs-client-provisionernamespace: defaultspec:replicas: 1strategy:type: Recreateselector:matchLabels:app: nfs-client-provisionertemplate:metadata:labels:app: nfs-client-provisionerspec:serviceAccountName: nfs-client-provisionercontainers:- name: nfs-client-provisionerimage: registry.cn-hangzhou.aliyuncs.com/lfy_k8s_images/nfs-subdir-external-provisioner:v4.0.2volumeMounts:- name: nfs-client-rootmountPath: /persistentvolumesenv:- name: PROVISIONER_NAMEvalue: k8s-sigs.io/nfs-subdir-external-provisioner- name: NFS_SERVERvalue: 192.168.255.30- name: NFS_PATHvalue: /nfs/datavolumes:- name: nfs-client-rootnfs:server: 192.168.255.30path: /nfs/data---apiVersion: v1kind: ServiceAccountmetadata:name: nfs-client-provisionernamespace: default---apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRolemetadata:name: nfs-client-provisioner-runnerrules:- apiGroups: []resources: [nodes]verbs: [get, list, watch]- apiGroups: []resources: [persistentvolumes]verbs: [get, list, watch, create, delete]- apiGroups: []resources: [persistentvolumeclaims]verbs: [get, list, watch, update]- apiGroups: [storage.k8s.io]resources: [storageclasses]verbs: [get, list, watch]- apiGroups: []resources: [events]verbs: [create, update, patch]---apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleBindingmetadata:name: run-nfs-client-provisionersubjects:- kind: ServiceAccountname: nfs-client-provisionernamespace: defaultroleRef:kind: ClusterRolename: nfs-client-provisioner-runnerapiGroup: rbac.authorization.k8s.io---apiVersion: rbac.authorization.k8s.io/v1kind: Rolemetadata:name: leader-locking-nfs-client-provisionernamespace: defaultrules:- apiGroups: []resources: [endpoints]verbs: [get, list, watch, create, update, patch]---apiVersion: rbac.authorization.k8s.io/v1kind: RoleBindingmetadata:name: leader-locking-nfs-client-provisionernamespace: defaultsubjects:- kind: ServiceAccountname: nfs-client-provisionernamespace: defaultroleRef:kind: Rolename: leader-locking-nfs-client-provisionerapiGroup: rbac.authorization.k8s.io#创建pvcapiVersion: v1kind: PersistentVolumeClaimmetadata:name: nginx-pvc02spec:storageClassName: nfs-storageaccessModes:- ReadWriteManyresources:requests:storage: 200Mi#需要多少就分配多少ConfigMap用来存储非敏感信息#创建pod时 创建configmapapiVersion: v1kind: Podmetadata:name: redisspec:containers:- name: redisimage: rediscommand:- redis-server- /redis-master/redis.conf # 指的是redis容器内部的位置ports:- containerPort: 6379volumeMounts:- mountPath: /dataname: data- mountPath: /redis-mastername: configvolumes:- name: dataemptyDir: {}- name: configconfigMap:name: redis-confitems:- key: redis.confpath: redis.conf#如果要改configmap内容kubectl edit cm redis-conf#创建一个阿里云仓库的secretkubectl create secret docker-registry myregistrykey \--docker-serverregistry.cn-hangzhou.aliyuncs.com \--docker-username你的阿里云用户名 \--docker-password你的阿里云密码 \--docker-email你的邮箱#拉取阿里云仓库镜像创podapiVersion: v1kind: Podmetadata:name: redis1spec:containers:- name: redisimage: crpi-cz1mig0dgcoo0245.cn-hangzhou.personal.cr.aliyuncs.com/ljh1234/ljh1234:redis-v1imagePullSecrets:- name: regcred #serect名字来获取login阿里云账号密码#ingress下载ingresscurl -C - -LO https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v0.47.0/deploy/static/provider/cloud/deploy.yaml#下载好后进入deploy.yaml文件修改镜像地址改成国内的找到这行image: k8s.gcr.io/ingress-nginx/controller:v0.46.0sha256:52f0058bed0a17ab0fb35628ba97e8d52b5d32299fbc03cc0f6c7b9ff036b61a#改成registry.cn-hangzhou.aliyuncs.com/lfy_k8s_images/ingress-nginx-controller:v0.46.0通过命令查看kubectl get pod -n ingress-nginx -owidekubectl get svc -n ingress-nginx#注意ingress-nginx-controller这行 右边一定要是NodePort#可以进入命令进行修改kubectl edit svc -n ingress-nginx ingress-nginx-controller可以注意的两处修改·externalTrafficPolicy: Cluster#如果是local的话是只能是control所在节点ip才能访问改成Cluster是集群所以节点都可以· type: NodePort但没配置策略浏览器访问不到资源配置规则转发tomcat-ingress.yamlapiVersion: networking.k8s.io/v1kind: Ingressmetadata:name: web-ingressannotations:nginx.ingress.kubernetes.io/limit-rps: 1spec:ingressClassName: nginxrules:- host: tomcat.tuling.comhttp:paths:- path: /pathType: Prefixbackend:service:name: tomcatport:number: 8080apply后kubectl get ing查看再来访问#这样就已经实现了资源转发通过ingress转发到service访问ingress的端口即跟访问service的一样面试题master与个节点之间的通信通过apiservermaster怎么控制pod调度到哪个节点调度器scheduler示例apiVersion: apps/v1kind: Deploymentmetadata:name: tomcatspec:replicas: 1selector:matchLabels:app: tomcattemplate:metadata:labels:app: tomcatspec:nodeName: k8s-node1 # 直接写节点名containers:- name: tomcatimage: tomcat:8ports:- containerPort: 8080#pod的信息都是统一维护到哪里etcd数据存储中心#pod如何动态缩容扩容调整副本数kubectl scale deployment tomcat --replicas3#创建deploy形式的两个server每个server里有两个pod并由ingress管理两个server#ing-ser.yaml——创建deploy和server#ing-ljh.yaml——创建ingress规则#ing-ser.yaml# server-aapiVersion: apps/v1kind: Deploymentmetadata:labels:app: server-aname: server-aspec:replicas: 2selector:matchLabels:app: server-atemplate:metadata:labels:app: server-aspec:containers:- name: nginximage: nginxports:- containerPort: 80---apiVersion: v1kind: Servicemetadata:labels:app: server-aname: server-aspec:selector:app: server-aports:- port: 8000protocol: TCPtargetPort: 80---# server-bapiVersion: apps/v1kind: Deploymentmetadata:labels:app: server-bname: server-bspec:replicas: 2selector:matchLabels:app: server-btemplate:metadata:labels:app: server-bspec:containers:- name: nginximage: nginxports:- containerPort: 80---apiVersion: v1kind: Servicemetadata:labels:app: server-bname: server-bspec:selector:app: server-bports:- port: 8000protocol: TCPtargetPort: 80#ing-ljh.yamlapiVersion: networking.k8s.io/v1kind: Ingressmetadata:name: ljh-ingressannotations:nginx.ingress.kubernetes.io/limit-rps: 1spec:ingressClassName: nginxrules:- host: hello.ljh.comhttp:paths:- path: /pathType: Prefixbackend:service:name: server-aport:number: 80- host: demo.ljh.comhttp:paths:- path: /pathType: Prefixbackend:service:name: server-bport:number: 80#补充知识点当path是/nginx时如果浏览器只是访问demo.ljh.com:30460结果如下图因为规则是只把demo.ljh.com:30460/nginx/下的交到server-b 所以不加/nginx/是找不到东西的而上面根本没到server层还只是在ingress层加了之后才能看到这个版本号才是server里的pod里的nginx版本号#还有一种rewrite功能表面输入ip:30460/nginx/abc——ip:30460/abc#实现方法1.在metadata处加上图片所示2.在path处加上#还想要ingress-nginx其他功能可以访问自行搜索https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/#kubesphere
