云原生之k8s入门

#各个机器设置自己的域名
hostnamectl set-hostname xxxx
# 刷新，显示主机名
bash

# 将 SELinux 设置为 permissive 模式（相当于将其禁用）
sudo setenforce 0
sudo sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config

#关闭swap
swapoff -a  
sed -ri 's/.*swap.*/#&/' /etc/fstab

#允许 iptables 检查桥接流量
cat <<EOF | sudo tee /etc/modules-load.d/k8s.conf
br_netfilter
EOF

cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF
sudo sysctl --system

# 配置yum源
cat <<EOF | sudo tee /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=http://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=http://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg
   http://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
exclude=kubelet kubeadm kubectl
EOF

# 下载指定版本
sudo yum install -y kubelet-1.20.9 kubeadm-1.20.9 kubectl-1.20.9 --disableexcludes=kubernetes

sudo systemctl enable --now kubelet

sudo tee ./images.sh <<-'EOF'
#!/bin/bash
images=(
kube-apiserver:v1.20.9
kube-proxy:v1.20.9
kube-controller-manager:v1.20.9
kube-scheduler:v1.20.9
coredns:1.7.0
etcd:3.4.13-0
pause:3.2
)
for imageName in ${images[@]} ; do
docker pull registry.cn-hangzhou.aliyuncs.com/lfy_k8s_images/$imageName
done
EOF

# 执行该命令行需要下载docker环境，可以参考https://zerlina-ysl.github.io/posts/blog/devops_docker/
chmod +x ./images.sh && ./images.sh

# 所有机器添加master域名映射，需要修改为自己的master节点的私有ip,设置该ip机器为集群入口节点
echo "171.31.0.86  cluster-endpoint" >> /etc/hosts
# 执行后各节点执行ping命令，能ping通即配置成功
ping cluster-endpoint```
**以下命令只在主节点中运行**
```shell
# 同理，第一个addr是master的私有ip
kubeadm init \
--apiserver-advertise-address=171.31.0.86 \
--control-plane-endpoint=cluster-endpoint \
--image-repository registry.cn-hangzhou.aliyuncs.com/lfy_k8s_images \
--kubernetes-version v1.20.9 \
--service-cidr=10.96.0.0/16 \ # service的ip范围
--pod-network-cidr=192.168.0.0/16 # pod的ip范围
#所有网络范围不重叠

# 主节点初始化成功后会返回以下指令，需要保留
Your Kubernetes control-plane has initialized successfully!

To start using your cluster, you need to run the following as a regular user:

  mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config

Alternatively, if you are the root user, you can run:

  export KUBECONFIG=/etc/kubernetes/admin.conf

You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
  https://kubernetes.io/docs/concepts/cluster-administration/addons/

You can now join any number of control-plane nodes by copying certificate authorities
and service account keys on each node and then running the following as root:

  kubeadm join cluster-endpoint:6443 --token 7okoz9.ti7losttdfw118hi \
    --discovery-token-ca-cert-hash sha256:92dad63ae98727291c666b048098178e19c9b1584f560283fe2b5d8e9613a941 \
    --control-plane 

Then you can join any number of worker nodes by running the following on each as root:

kubeadm join cluster-endpoint:6443 --token 7okoz9.ti7losttdfw118hi \
    --discovery-token-ca-cert-hash sha256:92dad63ae98727291c666b048098178e19c9b1584f560283fe2b5d8e9613a941

mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config

curl https://docs.projectcalico.org/v3.20/manifests/calico.yaml -O

# 运行后生成.yaml文件，根据配置文件为集群创建资源
kubectl apply -f calico.yaml

# 查询此时集群中的所有应用(Pod)
kubectl get pod -A

kubeadm join cluster-endpoint:6443 --token 7okoz9.ti7losttdfw118hi \
    --discovery-token-ca-cert-hash sha256:92dad63ae98727291c666b048098178e19c9b1584f560283fe2b5d8e9613a941

# 运行远程配置文件，安装可视化工具
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.3.1/aio/deploy/recommended.yaml
# 设置访问端口，将配置文件中spec.type的value设置为 NodePort
kubectl edit svc kubernetes-dashboard -n kubernetes-dashboard
# 找到端口
kubectl get svc -A |grep kubernetes-dashboard

apiVersion: v1 # 版本号
kind: Namespace # 资源类型
metadata:
  name: hello # namespace的名称
# 使用kubectl apply -f对该配置文件进行应用，就成功创建了名称为hello的namespace

apiVersion: v1
kind: Pod
metadata:
	labels:
		run: mynginx
	name: mynginx # pod名称
	namespace: default
spec:
	containers: # 容器
	- image: nginx # 镜像名称 
      name: mynginx		 
	- image: tomcat
	  name: mytomcat

apiVersion: apps/v1
kind: Deployment
metadata:
	labesl: 
		app: my-dep
	name: my-dep # deployment名称
spec:
	replicas: 3 # 副本数量
	selector:
		matchLabels: 
			app: my-dep 
	template:
		metadata:
			labels:
				app: my-dep 
			spec:
				containers:
				- image: nginx # 镜像
				  name: nginx # 镜像名称

apiVersion: v1
kind: Service
metadata:
	labels:
		app: my-dep
	name: my-dep
spec:
	selector:
		app: my-dep
	ports:
	- port: 8000
	  protocal: TCP
	  targetPort: 80

wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v0.47.0/deploy/static/provider/baremetal/deploy.yaml

#修改镜像
vi deploy.yaml
#将image的值改为如下值：
registry.cn-hangzhou.aliyuncs.com/lfy_k8s_images/ingress-nginx-controller:v0.46.0

# 检查安装的结果
kubectl get pod,svc -n ingress-nginx
# 此时会因NodePort模式暴露访问端口，需要在安全组把svc暴露的端口放行

apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello-server # deployment的名称
spec:
  replicas: 2 # 副本
  selector:
    matchLabels:
      app: hello-server
  template:
    metadata:
      labels:
        app: hello-server
    spec:
      containers:
      - name: hello-server
        image: registry.cn-hangzhou.aliyuncs.com/lfy_k8s_images/hello-server
        ports:
        - containerPort: 9000 # 容器的工作端口
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: nginx-demo # deployment的名称
  name: nginx-demo
spec:
  replicas: 2 # 副本
  selector:
    matchLabels:
      app: nginx-demo
  template:
    metadata:
      labels:
        app: nginx-demo
    spec:
      containers:
      - image: nginx
        name: nginx
---
apiVersion: v1
kind: Service 
metadata:
  labels:
    app: nginx-demo
  name: nginx-demo # Service的名称
spec:
  selector:
    app: nginx-demo
  ports:
  - port: 8000 # 访问端口
    protocol: TCP
    targetPort: 80
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: hello-server
  name: hello-server # Service的名称
spec:
  selector:
    app: hello-server
  ports:
  - port: 8000 # 访问端口
    protocol: TCP
    targetPort: 9000

apiVersion: networking.k8s.io/v1
kind: Ingress  
metadata:
  name: ingress-host-bar
spec:
  ingressClassName: nginx
  rules:
  - host: "hello.atguigu.com"  
    http:
      paths:
      - pathType: Prefix
        path: "/"
        backend:
          service:
            name: hello-server
            port:
              number: 8000
  - host: "demo.atguigu.com"
    http:
      paths:
      - pathType: Prefix
        path: "/nginx"  # 把请求会转给下面的服务，下面的服务一定要能处理这个路径，不能处理就是404
        backend:
          service:
            name: nginx-demo  ## java，比如使用路径重写，去掉前缀nginx
            port:
              number: 8000

apiVersion: networking.k8s.io/v1
kind: Ingress  
metadata:
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$2
  name: ingress-host-bar
spec:
  ingressClassName: nginx
  rules:
  - host: "hello.atguigu.com"
    http:
      paths:
      - pathType: Prefix
        path: "/"
        backend:
          service:
            name: hello-server
            port:
              number: 8000
  - host: "demo.atguigu.com"
    http:
      paths:
      - pathType: Prefix
        path: "/nginx(/|$)(.*)"  # 把请求会转给下面的服务,如/nginx解析为/，/nginx/router解析为/router
        backend:
          service:
            name: nginx-demo  ## java，比如使用路径重写，去掉前缀nginx
            port:
              number: 8000

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-limit-rate
  annotations:
    nginx.ingress.kubernetes.io/limit-rps: "1" # 每s限流1个
spec:
  ingressClassName: nginx
  rules:
  - host: "haha.atguigu.com"
    http:
      paths:
      - pathType: Exact # 精确匹配
        path: "/"
        backend:
          service:
            name: nginx-demo
            port:
              number: 8000

# 主节点配置
#nfs主节点 向其他节点以非安全、读写、同步的方式暴露/nfs/data/目录
echo "/nfs/data/ *(insecure,rw,sync,no_root_squash)" > /etc/exports
mkdir -p /nfs/data 
systemctl enable rpcbind --now # 启动rpc远程绑定
systemctl enable nfs-server --now 
# 检查配置是否生效
exportfs -r
exportfs # 输出共享目录

# 从节点配置 
showmount -e 172.31.0.4 # 注意：这里需要主节点机器的私有ip地址
 #执行以下命令挂载 nfs 服务器上的共享目录到本机路径 /nfs/data
 mkdir -p /nfs/data
# 挂载命令 远程服务器的ip地址 远程服务器的文件夹 本地文件夹
mount -t nfs 172.31.0.4:/nfs/data /nfs/data
# 测试 nfs系统部署成功后，主节点进行如下操作 从节点也会同步该数据
echo "hello nfs server" > /nfs/data/test.txt

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: nginx-pv-demo
  name: nginx-pv-demo
spec:
  replicas: 2 # 部署两个pod，两个 pod中文件的修改都会影响到外层文件的内容
  selector:
    matchLabels:
      app: nginx-pv-demo
  template:
    metadata:
      labels:
        app: nginx-pv-demo
    spec:
      containers:
      - image: nginx
        name: nginx
        volumeMounts: # 卷挂载
        - name: html # 配置命名
          mountPath: /usr/share/nginx/html # 将nginx内部的该路径文件挂载到外部
      volumes:
        - name: html  # 配置命名
          nfs: # 挂载方式，使用nfs网络文件系统
            server: 172.31.0.4 # nfs服务器主节点ip
            path: /nfs/data/nginx-pv # 即nginx镜像到mountPath路径挂在到容器的path路径 挂在前外部目录需要先创建

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv01-10m # 名称需要全小写，命名规则和域名规则类似
spec:
  capacity:
    storage: 10M # 限制PV容量
  accessModes:
    - ReadWriteMany # 可读可写多节点
  storageClassName: nfs # 需要和PVC的name对应
  nfs:
    path: /nfs/data/01 # 需要提前创建该文件
    server: 172.31.0.4 # nfs服务器主节点的私有ip地址
--- # 文档分割，表示该yaml文件由三个独立的文档组成
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv02-1gi
spec:
  capacity:
    storage: 1Gi
  accessModes:
    - ReadWriteMany
  storageClassName: nfs 
  nfs:
    path: /nfs/data/02
    server: 172.31.0.4
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv03-3gi
spec:
  capacity:
    storage: 3Gi
  accessModes:
    - ReadWriteMany
  storageClassName: nfs
  nfs:
    path: /nfs/data/03
    server: 172.31.0.4

kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: nginx-pvc
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 200Mi
  storageClassName: nfs # 和PV的spec.storageClassName对应

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: nginx-deploy-pvc
  name: nginx-deploy-pvc
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx-deploy-pvc
  template:
    metadata:
      labels:
        app: nginx-deploy-pvc
    spec:
      containers:
      - image: nginx
        name: nginx
        volumeMounts:
        - name: html
          mountPath: /usr/share/nginx/html
      volumes:
        - name: html
	#	  nfs:  没有PV和PVC之前的配置
    #        server: 172.31.0.4
    #        path: /nfs/data/nginx-pv 
          persistentVolumeClaim: # 从PV池申请PV
            claimName: nginx-pvc

# 创建配置，redis保存到k8s的etcd；
kubectl create cm redis-conf --from-file=redis.conf

apiVersion: v1
data:    #data是所有真正的数据 
  redis.conf: | # key：默认是文件名  
    appendonly yes # value：配置文件的内容
kind: ConfigMap # 创建ConfigMap
metadata:
  name: redis-conf
  namespace: default

apiVersion: v1
kind: Pod
metadata:
  name: redis
spec:
  containers:
  - name: redis
    image: redis
    command: # 启动镜像
      - redis-server
      - "/redis-master/redis.conf"  # redis容器内部的位置
    ports:
    - containerPort: 6379 
    volumeMounts: # 卷挂载
    - mountPath: /data # redis中的/data目录
      name: data # 挂载名称为name
    - mountPath: /redis-master # redis中的/redis-master文件，redis.conf在该文件下
      name: config # 挂载名称为config
  volumes:
    - name: data
      emptyDir: {}
    - name: config # name=config的挂载
      configMap:
        name: redis-conf # name=redis-conf的配置集，即第一步创建的
        items:
        - key: redis.conf # 引入ConfigMap中key=redis.conf的配置
          path: redis.conf # 指redis镜像中的redis.conf，/redis-master/redis.conf

apiVersion: v1
kind: ConfigMap
metadata:
  name: example-redis-config
data:
  redis-config: | # 修改配置集中redis的配置
    maxmemory 2mb
    maxmemory-policy allkeys-lru 

# 创建Secret
kubectl create secret docker-registry [secret-name] \
  --docker-server=<你的镜像仓库服务器> \
  --docker-username=<你的用户名> \
  --docker-password=<你的密码> \
  --docker-email=<你的邮箱地址>
# 以yaml格式查看创建的Secret
kubectl get secret secret-name -oyaml
# 此时再创建镜像，就避免账号密码的泄漏
apiVersion: v1
kind: Pod
metadata:
  name: private-nginx
spec:
  containers:
  - name: private-nginx
    image: leifengyang/guignginx:v1.0 # 拉取私有镜像时，避免账号密码的暴露
  imagePullSecrets:
  - name: secret-name # secret名称