Kubernetes

vim kubeadm.config.yml
apiVersion: kubeadm.k8s.io/v1beta2
bootstrapTokens:
- groups:
  - system:bootstrappers:kubeadm:default-node-token
  token: abcdef.0123456789abcdef
  ttl: 24h0m0s
  usages:
  - signing
  - authentication
kind: InitConfiguration
localAPIEndpoint:
  # 改成master节点IP地址
  advertiseAddress: 192.168.88.10
  bindPort: 6443
nodeRegistration:
  criSocket: /var/run/dockershim.sock
  name: node
  taints: null
---
apiServer:
  timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta2
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controllerManager: {}
dns:
  type: CoreDNS
etcd:
  local:
    dataDir: /var/lib/etcd
imageRepository: k8s.gcr.io
kind: ClusterConfiguration
kubernetesVersion: 1.21.0
networking:
  dnsDomain: cluster.local
  podSubnet: 10.244.0.0/16
  serviceSubnet: 10.96.0.0/12
scheduler: {}
# 添加这一段
---
apiVersion: kubeproxy.config.k8s.io/v1alpha1
kind: KubeProxyConfiguration
kubeproxy:
  config:
    mode: ipvs

---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: psp.flannel.unprivileged
  annotations:
    seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default
    seccomp.security.alpha.kubernetes.io/defaultProfileName: docker/default
    apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
    apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
spec:
  privileged: false
  volumes:
  - configMap
  - secret
  - emptyDir
  - hostPath
  allowedHostPaths:
  - pathPrefix: "/etc/cni/net.d"
  - pathPrefix: "/etc/kube-flannel"
  - pathPrefix: "/run/flannel"
  readOnlyRootFilesystem: false
  # Users and groups
  runAsUser:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  fsGroup:
    rule: RunAsAny
  # Privilege Escalation
  allowPrivilegeEscalation: false
  defaultAllowPrivilegeEscalation: false
  # Capabilities
  allowedCapabilities: ['NET_ADMIN', 'NET_RAW']
  defaultAddCapabilities: []
  requiredDropCapabilities: []
  # Host namespaces
  hostPID: false
  hostIPC: false
  hostNetwork: true
  hostPorts:
  - min: 0
    max: 65535
  # SELinux
  seLinux:
    # SELinux is unused in CaaSP
    rule: 'RunAsAny'
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: flannel
rules:
- apiGroups: ['extensions']
  resources: ['podsecuritypolicies']
  verbs: ['use']
  resourceNames: ['psp.flannel.unprivileged']
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
- apiGroups:
  - ""
  resources:
  - nodes
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - nodes/status
  verbs:
  - patch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: flannel
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: flannel
subjects:
- kind: ServiceAccount
  name: flannel
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: flannel
  namespace: kube-system
---
kind: ConfigMap
apiVersion: v1
metadata:
  name: kube-flannel-cfg
  namespace: kube-system
  labels:
    tier: node
    app: flannel
data:
  cni-conf.json: |
    {
      "name": "cbr0",
      "cniVersion": "0.3.1",
      "plugins": [
        {
          "type": "flannel",
          "delegate": {
            "hairpinMode": true,
            "isDefaultGateway": true
          }
        },
        {
          "type": "portmap",
          "capabilities": {
            "portMappings": true
          }
        }
      ]
    }
  net-conf.json: |
    {
      "Network": "10.244.0.0/16",
      "Backend": {
        "Type": "vxlan"
      }
    }
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: kube-flannel-ds
  namespace: kube-system
  labels:
    tier: node
    app: flannel
spec:
  selector:
    matchLabels:
      app: flannel
  template:
    metadata:
      labels:
        tier: node
        app: flannel
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: kubernetes.io/os
                operator: In
                values:
                - linux
      hostNetwork: true
      priorityClassName: system-node-critical
      tolerations:
      - operator: Exists
        effect: NoSchedule
      serviceAccountName: flannel
      initContainers:
      - name: install-cni
        image: quay.io/coreos/flannel:v0.14.0-rc1
        command:
        - cp
        args:
        - -f
        - /etc/kube-flannel/cni-conf.json
        - /etc/cni/net.d/10-flannel.conflist
        volumeMounts:
        - name: cni
          mountPath: /etc/cni/net.d
        - name: flannel-cfg
          mountPath: /etc/kube-flannel/
      containers:
      - name: kube-flannel
        image: quay.io/coreos/flannel:v0.14.0-rc1
        command:
        - /opt/bin/flanneld
        args:
        - --ip-masq
        - --kube-subnet-mgr
        resources:
          requests:
            cpu: "100m"
            memory: "50Mi"
          limits:
            cpu: "100m"
            memory: "50Mi"
        securityContext:
          privileged: false
          capabilities:
            add: ["NET_ADMIN", "NET_RAW"]
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        volumeMounts:
        - name: run
          mountPath: /run/flannel
        - name: flannel-cfg
          mountPath: /etc/kube-flannel/
      volumes:
      - name: run
        hostPath:
          path: /run/flannel
      - name: cni
        hostPath:
          path: /etc/cni/net.d
      - name: flannel-cfg
        configMap:
          name: kube-flannel-cfg

vim nginx.yaml
# 此处只有必要字段
apiVersion: v1
kind: Pod
metadata:
  name: nginx-pod
  labels:
    app: nginx
spec:
  containers:
  - name: nginx
    image: daocloud.io/library/nginx:latest

vim busybox.yaml
apiVersion: v1
kind: Pod
# 定义了一个 Pod 叫 busybox-pod，busybox 封装了 linux 的大量命令
metadata:
  name: busybox-pod
  labels:
    app: busybox
# 定义该 Pod 下的资源，也就是容器
spec:
  # 定义了一个 busybox 容器
  containers:
  - name: busybox
    image: busybox:latest
    command: ['sh','-c','echo The busybox app is running! && sleep 3600']
  # 定义 init 容器，init 容器全部执行完前不会执行 busybox 容器
  initContainers:
    # 第一个 init 容器，如果检查 service 中没有注册 myservice，则休眠2秒继续执行，直到成功
  - name: init-myservice
    image: busybox
    command: ['sh','-c','until nslookup myservice; do echo waiting for myservice; sleep 2; done']
    # 第一个 init 容器运行完就运行该 init 容器，检查 service 中有没有注册 mydb
  - name: init-mydb
    image: busybox
    command: ['sh','-c','until nslookup mydb; do echo waiting for mydb; sleep 2; done']

vim service.yaml
apiVersion: v1
kind: Service
metadata:
  name: myservice
spec:
  ports:
  - protocol: TCP
    port: 80
    targetPort: 9376
---
apiVersion: v1
kind: Service
metadata:
  name: mydb
spec:
  ports:
  - protocol: TCP
    port: 80
    targetPort: 9377

vim readinessProbe.yaml
apiVersion: v1
kind: Pod
metadata:
  name: readiness-httpget-pod
  namespace: default
spec:
  containers:
    - name: readiness-httpget-container
      image: daocloud.io/library/nginx:latest
      # 调用readinessProbe探针
      readinessProbe:
        httpGet:
          # 检查80端口
          port: 80
          # 检查该目录下的网页
          path: /test.html
        # 容器启动1秒后才进行检测
        initialDelaySeconds: 1
        # 每3秒检测一次
        periodSeconds: 3

vim livenessProbe_exec.yaml
apiVersion: v1
kind: Pod
metadata:
  name: liveness-exec-pod
  namespace: default
spec:
  containers:
  - name: liveness-exec-container
    image: busybox
    command: ['sh','-c','touch /tmp/test; sleep 60; rm -rf /tmp/test; sleep 3600']
    # 查看本地是否有镜像，有则使用，没有则下载
    imagePullPolicy: IfNotPresent
    livenessProbe:
      exec:
        command: ['test','-e','/tmp/test']
      initialDelaySeconds: 1
      periodSeconds: 3

vim livenessProbe_httpget.yaml
apiVersion: v1
kind: Pod
metadata:
  name: liveness-httpget-pod
  namespace: default
spec:
  containers:
    - name: liveness-httpget-container
      image: daocloud.io/library/nginx:latest
      ports:
      - name: http
        containerPort: 80
      # Pod生成1秒之后会每3秒检测一次是否存在index.html文件，如果超过10秒没有则重启Pod
      livenessProbe:
        httpGet:
          port: http
          path: /index.html
        initialDelaySeconds: 1
        periodSeconds: 3
        # 允许超时时间
        timeoutSeconds: 10

vim livenessProbe_tcp.yaml
apiVersion: v1
kind: Pod
metadata:
  name: liveness-tcp-pod
  namespace: default
spec:
  containers:
  - name: liveness-tcp-container
    image: daocloud.io/library/nginx:latest
    livenessProbe:
      initialDelaySeconds: 5
      timeoutSeconds: 1
      tcpSocket:
        port: 8080
      periodSeconds: 3

vim start_stop.yml
apiVersion: v1
kind: Pod
metadata:
  name: start-stop-pod
  namespace: default
spec:
  containers:
  - name: start-stop-container
    image: daocloud.io/library/nginx:latest
    lifecycle:
      postStart:
        exec:
          command: ['/bin/sh','-c','echo this is postStart test > /usr/share/message']
      preStop:
        exec:
          command: ['/bin/sh','-c','echo this is preStop test > /usr/share/message']

vim rs_test.yaml
apiVersion: apps/v1
kind: ReplicaSet
metadata:
  # RS名称
  name: rs-test
spec:
  # 设置副本数
  replicas: 3
  selector:
    # 设置标签
    matchLabels:
      tier: rs-test
  # 设置模板，会根据此模板生成Pod
  template:
    metadata:
      # 与上边RS设置的标签相对应，说明根据该模板创建的Pod都由标签相对RS管理
      labels:
        tier: rs-test
    spec:
      containers:
      - name: rs-nginx-container
        image: daocloud.io/library/nginx:latest

vim nginx_deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
# Deployment详细信息
spec:
  # 副本数
  replicas: 3
  # 选择标签
  selector:
    # 标签匹配，与Deployment对应
    matchLabels:
      app: nginx-deployment
  # Pod模板
  template:
    metadata:
      # 定义标签
      labels:
        app: nginx-deployment
    spec:
      containers:
      - name: nginx-deployment-container
        image: daocloud.io/library/nginx:latest
        ports:
        - containerPort: 80

vim daemonset_test.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  # DaemonSet名称
  name: daemonset-test
  # 设置标签
  labels:
    app: daemonset-nginx
spec:
  selector:
    # 该标签要与上边标签一致
    matchLabels:
      name: daemonset-nginx
  template:
    metadata:
      labels:
        name: daemonset-nginx-pod
    spec:
      containers:
      - name: daemonset-nginx-container
        image: daocloud.io/library/nginx:latest

vim job.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: job
spec:
  template:
    metadata:
      name: job-pod
    spec:
      containers:
      - name: job-pod-container
        image: perl
        imagePullPolicy: IfNotPresent
        # 通过perl语言进行圆周率计算，计算小数点后2000位
        command: ['perl','-Mbignum=bpi','-wle','print bpi(2000)']
      restartPolicy: Never

vim crontjob.yaml
apiVersion: batch/v1
kind: CronJob
metadata:
  name: cronjob
spec:
  # CronJob必要字段，格式为分时日月周
  schedule: "*/1 * * * *"
  # job模板
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: crontab-pod
            image: busybox
            imagePullPolicy: IfNotPresent
            command:
            - /bin/sh
            - -c
            - date; echo 'Welcome My K8s'
          restartPolicy: OnFailure

vim nginx_svc_deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  namespace: default
spec:
  replicas: 3
  selector:
    # 创建两个标签
    matchLabels:
      app: nginx
      version: latest
  template:
    metadata:
      labels:
        app: nginx
        version: latest
    spec:
      containers:
      - name: nginx-pod
        image: daocloud.io/library/nginx:latest
        # 释放的端口
        ports:
        - name: http-port
          containerPort: 80

vim clusterip_svc.yaml
apiVersion: v1
kind: Service
metadata:
  name: nginx-clusterip-service
  namespace: default
spec:
  type: ClusterIP
  # 用来匹配Pod中的标签，全部匹配才会管理该Pod
  selector:
    app: nginx
    version: latest
  ports:
  - name: http-port
    port: 80
    targetPort: 80

vim headless_service.yaml
apiVersion: v1
kind: Service
metadata:
  name: headless-service
  namespace: default
spec:
  selector:
    app: nginx
    version: latest
  clusterIP: "None"
  ports:
  - port: 80
    targetPort: 80

vim nodeport_svc.yaml
apiVersion: v1
kind: Service
metadata:
  name: nginx-nodeport-service
  namespace: default
spec:
  type: NodePort
  selector:
    app: nginx
    version: latest
  ports:
  - name: http-port
    port: 80
    targetPort: 80

apiVersion: v1
kind: Pod
metadata:
  name: curl-pod
spec:
  containers:
  - name: curl-pod-container
    # curl镜像包含测试网络和DNS的工具
    image: docker.io/appropriate/curl
    imagePullPolicy: IfNotPresent
    command: ['sh', '-c']
    args: ['echo "curl test"; sleep 3600']

apiVersion: v1
kind: Service
metadata:
  name: externalname-svc
spec:
  type: externalname
  # 引入百度的网址
  externalName: www.baidu.com

vim nginx_deployment_svc1.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment1
spec:
  replicas: 2
  selector:
    matchLabels:
      name: nginx1
  template:
    metadata:
      labels:
        name: nginx1
    spec:
      containers:
        - name: nginx-pod
          image: daocloud.io/library/nginx:latest
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 80

---

apiVersion: v1
kind: Service
metadata:
  name: nginx-service1
spec:
  ports:
    - port: 80
      targetPort: 80
      protocol: TCP
  selector:
    name: nginx1

vim nginx_deployment_svc2.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment2
spec:
  replicas: 2
  selector:
    matchLabels:
      name: nginx2
  template:
    metadata:
      labels:
        name: nginx2
    spec:
      containers:
        - name: nginx-pod
          image: daocloud.io/library/nginx:latest
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 80

---

apiVersion: v1
kind: Service
metadata:
  name: nginx-service2
spec:
  ports:
    - port: 80
      targetPort: 80
      protocol: TCP
  selector:
    name: nginx2

vim nginx_ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress1
spec:
  rules:
  # 设置虚拟主机，通过该域名访问
  - host: www.cqm1.com
    http:
      paths:
      # 路径列表
      - path: /pod.html
        # 路径类型
        pathType: ImplementationSpecific
        # 后端
        backend:
          # 指定连接哪个SVC
          serviceName: nginx-service1
          servicePort: 80

---

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress2
spec:
  rules:
  - host: www.cqm2.com
    http:
      paths:
      - path: /pod.html
        pathType: ImplementationSpecific
        backend:
          service:
            name: nginx-service2
            port:
              number: 80

vim nginx_deployment_svc3.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment3
spec:
  replicas: 2
  selector:
    matchLabels:
      name: nginx3
  template:
    metadata:
      labels:
        name: nginx3
    spec:
      containers:
        - name: nginx-pod
          image: daocloud.io/library/nginx:latest
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 80

---

apiVersion: v1
kind: Service
metadata:
  name: nginx-service3
spec:
  ports:
    - port: 80
      targetPort: 80
      protocol: TCP
  selector:
    name: nginx3

vim nginx_ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress3
spec:
  tls:
  - hosts:
      - www.cqm3.com
    secretName: tls-secret
  rules:
  - host: www.cqm3.com
    http:
      paths:
      - path: /pod.html
        pathType: ImplementationSpecific
        backend:
          serviceName: nginx-service3
          servicePort: 80

vim nginx_ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-nginx-auth
  # 添加基础认证字段
  annotations:
    nginx.ingress.kubernetes.io/auth-type: basic
    nginx.ingress.kubernetes.io/auth-secret: basic-auth
    nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - cqm'
spec:
  rules:
  - host: auth.cqm.com
    http:
      paths:
      - path: /pod.html
        pathType: ImplementationSpecific
        backend:
          service:
            # 这里使用HTTP代理实验的service1
            name: nginx-service1
            port:
              number: 80

vim rewrite_ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: rewrite-ingress
  annotations:
    # 访问 www.rewritecqm.com:30779 将跳转到 http://www.cqm1.com:30779/pod.html
    nginx.ingress.kubernetes.io/rewrite-target: http://www.cqm1.com:30779/pod.html
spec:
  rules:
  - host: www.rewritecqm.com
    http:
      paths:
      - path: /pod.html
        pathType: Prefix
        backend:
          service:
            name: nginx-service1
            port:
              number: 80

vim special_cm.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: special-cm
  namespace: default
data:
  special.how: very
  special.type: charm

vim env_cm.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: env-cm
  namespace: default
data:
  log_level: INFO

vim pod1.yaml
apiVersion: v1
kind: Pod
metadata:
  name: pod1
spec:
  containers:
    - name: pod1-container
      image: busybox
      imagePullPolicy: IfNotPresent
      command: ["/bin/bash", "-c", "env"]
      # env:取某个 ConfigMap 中的某个键值
      env:
        - name: SPECIAL_HOW_KEY
          # 定义环境变量
          valueFrom:
            # 表示从 ConfigMap 中引用
            configMapKeyRef:
              # 要引用的 ConfigMap 名称
              name: special-cm
              # 引用 ConfigMap 中的哪个键值对
              key: special.how
        - name: SPECIAL_TYPE_KEY
          valueFrom:
            configMapKeyRef:
              name: special-cm
              key: special.type
      # envFrom:取某个 ConfigMap 的所有键值
      envFrom:
      - configMapRef:
          name: env-cm
  restartPolicy: Never