Skip to content

Commit 0a4e935

Browse files
petergithubpetergithub
committed
k8s: Kubernetes REST API
1 parent 19879fa commit 0a4e935

1 file changed

Lines changed: 142 additions & 19 deletions

File tree

‎01Technology/kubernetes/kubernetesNotes/kubernetesNotes.md‎

Lines changed: 142 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -111,14 +111,125 @@ kubectl port-forward pod-name 8888:8080
111111
kubectl port-forward --address 0.0.0.0 svc/[service-name] -n [namespace] [external-port]:[internal-port]
112112
```
113113

114-
COMMUNICATING WITH PODS THROUGH THE API SERVER
115-
`kubectl proxy`
116-
use localhost:8001 rather than the actual API server host and port. You’ll send a request to the kubia-0 pod like this:
117-
`curl localhost:8001/api/v1/namespaces/default/pods/kubia-0/proxy/`
118-
119114
`kubectl autoscale deployment kubia --cpu-percent=30 --min=1 --max=5` creates the HorizontalPodAutoscaler(HPA) object for you and sets the Deployment called kubia as the scaling target
120115
`kubectl get hpa` HorizontalPodAutoscaler
121-
a container’s CPU utilization is the container’s actual CPU usage divided by its requested CPU
116+
a container's CPU utilization is the container's actual CPU usage divided by its requested CPU
117+
118+
### Kubernetes REST API
119+
120+
communicating with pods through the api server
121+
122+
```sh
123+
kubectl proxy
124+
# You can then point your browser to
125+
curl http://localhost:8001/api/v1/namespaces/default/pods
126+
# use localhost:8001 rather than the actual API server host and port. You'll send a request to the kubia-0 pod like this:
127+
# curl http://localhost:8001/api/v1/namespaces/default/pods/kubia-0/proxy/
128+
```
129+
130+
```sh
131+
# with yaml
132+
kubectl exec -n ai-test netshoot -- sh -c '
133+
TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
134+
NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
135+
API_SERVER="https://kubernetes.default.svc"
136+
137+
cat > /tmp/deployment.yml << EOF
138+
apiVersion: apps/v1
139+
kind: Deployment
140+
metadata:
141+
namespace: ai-test
142+
name: nginx-deployment
143+
labels:
144+
app: nginx
145+
spec:
146+
replicas: 1
147+
selector:
148+
matchLabels:
149+
app: nginx
150+
template:
151+
metadata:
152+
labels:
153+
app: nginx
154+
spec:
155+
containers:
156+
- name: nginx
157+
image: docker.jasolar.com/base/nginx:1.27.0
158+
ports:
159+
- containerPort: 80
160+
EOF
161+
162+
curl -k -X POST \
163+
-H "Authorization: Bearer $TOKEN" \
164+
-H "Content-Type: application/yaml" \
165+
--data-binary @/tmp/deployment.yml \
166+
"$API_SERVER/apis/apps/v1/namespaces/$NAMESPACE/deployments"
167+
')
168+
169+
# with json
170+
tee /tmp/deployment.json <<EOF
171+
{
172+
"apiVersion": "apps/v1",
173+
"kind": "Deployment",
174+
"metadata": {
175+
"name": "nginx-deployment",
176+
"labels": {
177+
"app": "nginx"
178+
}
179+
},
180+
"spec": {
181+
"replicas": 3,
182+
"selector": {
183+
"matchLabels": {
184+
"app": "nginx"
185+
}
186+
},
187+
"template": {
188+
"metadata": {
189+
"labels": {
190+
"app": "nginx"
191+
}
192+
},
193+
"spec": {
194+
"containers": [
195+
{
196+
"name": "nginx",
197+
"image": "nginx:1.27.0",
198+
"ports": [
199+
{
200+
"containerPort": 80
201+
}
202+
]
203+
}
204+
]
205+
}
206+
}
207+
}
208+
}
209+
EOF
210+
211+
kubectl proxy
212+
KUBE_API_SERVER_URL=http://localhost:8001
213+
214+
# Replace <KUBE_API_SERVER_URL> and <NAMESPACE> with your cluster details.
215+
# Replace <SERVICE_ACCOUNT_TOKEN> with an actual token.
216+
# Assume the JSON body is saved in 'deployment.json'
217+
# -H "Authorization: Bearer <SERVICE_ACCOUNT_TOKEN>" \
218+
curl -X POST \
219+
-H "Content-Type: application/json" \
220+
--data @/tmp/deployment.json \
221+
"${KUBE_API_SERVER_URL}/apis/apps/v1/namespaces/default/deployments"
222+
223+
# get pods
224+
kubectl exec -n ai-test netshoot -- sh -c 'TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token); curl -s -k -H "Authorization: Bearer $TOKEN" https://kubernetes.default.svc/api/v1/namespaces/ai-test/pods'
225+
# get deployments
226+
kubectl exec -n ai-test netshoot -- sh -c 'TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token); curl -s -k -H "Authorization: Bearer $TOKEN" https://kubernetes.default.svc/apis/apps/v1/namespaces/ai-test/deployments' | head -20
227+
228+
# create deployment
229+
kubectl exec -n ai-test netshoot -- sh -c 'TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token); curl -X POST -k -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d @/tmp/deployment.json https://kubernetes.default.svc/apis/apps/v1/namespaces/ai-test/deployments'
230+
# create service
231+
kubectl exec -n ai-test netshoot -- sh -c 'TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token); curl -X POST -k -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d @/tmp/service.json https://kubernetes.default.svc/api/v1/namespaces/ai-test/services'
232+
```
122233

123234
### Cluster
124235

@@ -154,7 +265,7 @@ kubectl cluster-info dump
154265
```sh
155266
kubectl cluster-info dump
156267

157-
# retrieving a pod’s log with kubectl logs
268+
# retrieving a pod's log with kubectl logs
158269
kubectl logs kubia-manual
159270
kubectl logs -f --tail=10 pod-name
160271
# `-o custom-columns`
@@ -239,6 +350,9 @@ complete -o default -F __start_kubectl k
239350
# ZSH
240351
source <(kubectl completion zsh) # set up autocomplete in zsh into the current shell
241352
echo '[[ $commands[kubectl] ]] && source <(kubectl completion zsh)' >> ~/.zshrc # a
353+
354+
# Shortcut to change namespace
355+
alias kcn='kubectl config set-context --current --namespace'
242356
```
243357

244358
`brew install kube-ps1 stern`
@@ -385,7 +499,7 @@ kubectl rollout history deployment deployment-name
385499
kubectl set image deployment kubia nodejs=luksa/kubia:v3
386500
# the progress of the rollout
387501
kubectl rollout status deployment kubia
388-
# displaying a deployment’s rollout history
502+
# displaying a deployment's rollout history
389503
kubectl rollout history deployment kubia
390504
# undoing a rollout
391505
kubectl rollout undo deployment kubia
@@ -670,13 +784,13 @@ kubectl delete job <job-name> -n <namespace>
670784

671785
#### Exceeding the limits
672786

673-
CPU: when a CPU limit is set for a container, the process isn’t given more CPU time than the configured limit.
674-
Memory: When a process tries to allocate memory over its limit, the process is killed (it’s said the container is OOMKilled, where OOM stands for Out Of Memory)
787+
CPU: when a CPU limit is set for a container, the process isn't given more CPU time than the configured limit.
788+
Memory: When a process tries to allocate memory over its limit, the process is killed (it's said the container is OOMKilled, where OOM stands for Out Of Memory)
675789

676790
#### pod QoS classes
677791

678792
- BestEffort (the lowest priority)
679-
1. It’s assigned to pods that don’t have any requests or limits set at all (in any of their containers)
793+
1. It's assigned to pods that don't have any requests or limits set at all (in any of their containers)
680794
2. They will be the first ones killed when memory needs to be freed for other pods.
681795
- Burstable
682796
In between BestEffort and Guaranteed is the Burstable QoS class. All other pods fall into this class
@@ -831,9 +945,9 @@ kubectl get --all-namespaces pods --field-selector=spec.nodeName=<node name>
831945

832946
Three possible effects exist:
833947

834-
- `NoSchedule`, which means pods won’t be scheduled to the node if they don’t tol- erate the taint.
835-
- `PreferNoSchedule` is a soft version of NoSchedule, meaning the scheduler will try to avoid scheduling the pod to the node, but will schedule it to the node if it can’t schedule it somewhere else.
836-
- `NoExecute`, unlike NoSchedule and PreferNoSchedule that only affect schedul- ing, also affects pods already running on the node. If you add a NoExecute taint to a node, pods that are already running on that node and don’t tolerate the NoExecute taint will be evicted from the node.
948+
- `NoSchedule`, which means pods won't be scheduled to the node if they don't tol- erate the taint.
949+
- `PreferNoSchedule` is a soft version of NoSchedule, meaning the scheduler will try to avoid scheduling the pod to the node, but will schedule it to the node if it can't schedule it somewhere else.
950+
- `NoExecute`, unlike NoSchedule and PreferNoSchedule that only affect schedul- ing, also affects pods already running on the node. If you add a NoExecute taint to a node, pods that are already running on that node and don't tolerate the NoExecute taint will be evicted from the node.
837951

838952
```sh
839953
# Remove the taint
@@ -907,6 +1021,8 @@ kg VolumeAttachment | sort -k 3
9071021
Kubernetes 对集群网络有以下要求：
9081022
所有的 Pod 之间可以在不使用 NAT 网络地址转换的情况下相互通信；所有的 Node 之间可以在不使用 NAT 网络地址转换的情况下相互通信；每个 Pod 看到的自己的 IP 和其他 Pod 看到的一致。
9091023

1024+
[kubeshark: The API traffic analyzer for Kubernetes providing real-time K8s protocol-level visibility, capturing and monitoring all traffic and payloads going in, out and across containers, pods, nodes and clusters. Inspired by Wireshark, purposely built for Kubernetes](https://github.com/kubeshark/kubeshark)
1025+
9101026
#### Kubernetes CNI
9111027

9121028
[从零开始入门 K8s | 理解 CNI 和 CNI 插件](https://developer.aliyun.com/article/748866)
@@ -1087,7 +1203,7 @@ for intf in /sys/devices/virtual/net/cni0/brif/*; do echo "$intf"; cat $intf/hai
10871203
- The Scheduler
10881204
- The Controller Manager
10891205

1090-
These components store and manage the state of the cluster, but they aren’t what runs the application containers.
1206+
These components store and manage the state of the cluster, but they aren't what runs the application containers.
10911207

10921208
### Components running on the worker nodes
10931209

@@ -1118,7 +1234,7 @@ helm pull <chart> # Download/pull chart
11181234
helm pull <chart> --untar=true # If set to true, will untar the chart after downloading it
11191235
helm pull <chart> --verify # Verify the package before using it
11201236
helm pull <chart> --version <number> # Default-latest is used, specify a version constraint for the chart version to use
1121-
helm dependency list <chart> # Display a list of a chart’s dependencies:
1237+
helm dependency list <chart> # Display a list of a chart's dependencies:
11221238
```
11231239

11241240
### helm push chart
@@ -1482,7 +1598,13 @@ done
14821598
echo "所有 YAML 文件处理完成！"
14831599
```
14841600

1485-
## 集群配置
1601+
## 集群 setup
1602+
1603+
[easzlab/kubeasz: 使用Ansible脚本安装K8S集群，介绍组件交互原理，方便直接，不受国内网络环境影响](https://github.com/easzlab/kubeasz)
1604+
1605+
### Create user
1606+
1607+
[Generating kubeconfig files for additional users](https://v1-30.docs.kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#kubeconfig-additional-users)
14861608

14871609
### kubelet 配置
14881610

@@ -1754,7 +1876,7 @@ Common exit codes (`128+x`) associated with docker containers are:
17541876

17551877
- Exit Code 0: Absence of an attached foreground process
17561878
- Exit Code 1: Indicates failure due to application error
1757-
- Exit Code 137: `128+9` Indicates failure as container received SIGKILL (Manual intervention or ‘oom-killer’ [OUT-OF-MEMORY])
1879+
- Exit Code 137: `128+9` Indicates failure as container received SIGKILL (Manual intervention or ‘oom-killer' [OUT-OF-MEMORY])
17581880
- Exit Code 139: `128+11` Indicates failure as container received SIGSEGV
17591881
- Exit Code 143: `128+15` Indicates failure as container received SIGTERM
17601882

@@ -1781,7 +1903,7 @@ Automated Certificate Management Environment (ACME).
17811903
3. Check the issuer state
17821904
1. `kubectl describe issuer <Issuer name>`
17831905
2. `kubectl describe clusterissuer <ClusterIssuer name>`
1784-
4. [Troubleshooting Issuing ACME Certificates | cert-manager](https://cert-manager.io/docs/faq/acme/): ACME(e.g. Let’s Encrypt)
1906+
4. [Troubleshooting Issuing ACME Certificates | cert-manager](https://cert-manager.io/docs/faq/acme/): ACME(e.g. Let's Encrypt)
17851907
1. Check Orders `kubectl describe order example-com-2745722290-439160286`. If the Order is not completing successfully, you can debug the challenges for the Order
17861908
2. Check Challenges `kubectl describe challenge example-com-2745722290-4391602865-0`
17871909
1. [HTTP01 troubleshooting](https://cert-manager.io/docs/faq/acme/#http01-troubleshooting)
@@ -1872,6 +1994,7 @@ crictl images
18721994
# kubeadm config images list --kubernetes-version=v1.15.2
18731995
ctr image pull k8s.gcr.io/prometheus-adapter/prometheus-adapter:v0.9.1
18741996
crictl pull k8s.gcr.io/prometheus-adapter/prometheus-adapter:v0.9.1
1997+
crictl --debug pull image_name
18751998
18761999
# 创建 k8s.io 命名空间
18772000
ctr ns create k8s.io

0 commit comments

Comments
 (0)