云原生第三周作业
1.总结从负载均衡访问K8S nodeport类型的pod的访问流程
- 外部请求发起：客户端向负载均衡器的公网 IP / 域名发起请求
- LB 转发流量：负载均衡器将请求转发到集群任意节点的「NodePort 端口」，LB 会通过健康检查过滤故障节点；
- 节点接收请求：节点的网卡监听 NodePort 端口，接收到 LB 转发的流量；
- kube-proxy 转发：节点上的 kube-proxy 组件通过 iptables/IPVS 规则，将 NodePort 端口的流量转发到对应 Service 的 ClusterIP（虚拟 IP）；
- Service 匹配 Pod：Service 通过标签选择器（selector）匹配后端健康 Pod，生成 Endpoint 列表；
- 流量分发到 Pod：kube-proxy 将流量从 Service ClusterIP 转发到 Endpoint 列表中的某个健康 Pod（默认轮询）；
- Pod 响应请求：Pod 内的应用容器处理请求，响应结果按原路径反向返回给客户端。
2.掌握pod挂载NFS及静态PVC的使用
1.myapp-persistentvolume.yaml apiVersion: v1 kind: PersistentVolume metadata: name: myserver-myapp-static-pv spec: capacity: storage: 10Gi persistentVolumeReclaimPolicy: Retain #默认,https://kubernetes.io/zh-cn/docs/concepts/storage/persistent-volumes/#reclaim-policy accessModes: - ReadWriteOnce nfs: path: /data/k8sdata/myserver/myappdata server: 192.168.9.16
2.myapp-persistentvolumeclaim.yaml apiVersion: v1 kind: PersistentVolumeClaim metadata: name: myserver-myapp-static-pvc namespace: myserver spec: volumeName: myserver-myapp-static-pv accessModes: - ReadWriteOnce resources: requests: storage: 10Gi
3.myapp-nginx-webserver.yaml kind: Deployment #apiVersion: extensions/v1beta1 apiVersion: apps/v1 metadata: labels: app: myserver-myapp name: myserver-myapp-deployment-name namespace: myserver spec: replicas: 1 selector: matchLabels: app: myserver-myapp-frontend template: metadata: labels: app: myserver-myapp-frontend spec: containers: - name: myserver-myapp-container image: registry.cn-hangzhou.aliyuncs.com/zhangshijie/nginx:1.22.0-alpine #imagePullPolicy: Always ports: - containerPort: 80 name: http protocol: TCP - containerPort: 443 name: https protocol: TCP volumeMounts: - mountPath: "/usr/share/nginx/html/statics" name: statics-datadir volumes: - name: statics-datadir persistentVolumeClaim: claimName: myserver-myapp-static-pvc --- kind: Service apiVersion: v1 metadata: labels: app: myserver-myapp-service name: myserver-myapp-service-name namespace: myserver spec: type: NodePort ports: - name: http port: 80 targetPort: 80 nodePort: 30009 selector: app: myserver-myapp-frontend
4.总结NFS实现动态PVC的使用-重点要熟练StorageClass的使用
rbac apiVersion: v1 kind: Namespace metadata: name: nfs --- apiVersion: v1 kind: ServiceAccount metadata: name: nfs-client-provisioner # replace with namespace where provisioner is deployed namespace: nfs --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: nfs-client-provisioner-runner rules: - apiGroups: [""] resources: ["nodes"] verbs: ["get", "list", "watch"] - apiGroups: [""] resources: ["persistentvolumes"] verbs: ["get", "list", "watch", "create", "delete"] - apiGroups: [""] resources: ["persistentvolumeclaims"] verbs: ["get", "list", "watch", "update"] - apiGroups: ["storage.k8s.io"] resources: ["storageclasses"] verbs: ["get", "list", "watch"] - apiGroups: [""] resources: ["events"] verbs: ["create", "update", "patch"] --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: run-nfs-client-provisioner subjects: - kind: ServiceAccount name: nfs-client-provisioner # replace with namespace where provisioner is deployed namespace: nfs roleRef: kind: ClusterRole name: nfs-client-provisioner-runner apiGroup: rbac.authorization.k8s.io --- kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: leader-locking-nfs-client-provisioner # replace with namespace where provisioner is deployed namespace: nfs rules: - apiGroups: [""] resources: ["endpoints"] verbs: ["get", "list", "watch", "create", "update", "patch"] --- kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: leader-locking-nfs-client-provisioner # replace with namespace where provisioner is deployed namespace: nfs subjects: - kind: ServiceAccount name: nfs-client-provisioner # replace with namespace where provisioner is deployed namespace: nfs roleRef: kind: Role name: leader-locking-nfs-client-provisioner apiGroup: rbac.authorization.k8s.io
StorageClass apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: name: nfs provisioner: k8s-sigs.io/nfs-subdir-external-provisioner # or choose another name, must match deployment's env PROVISIONER_NAME' reclaimPolicy: Retain #PV的删除策略，默认为delete，删除PV后立即删除NFS server的数据 mountOptions: #- vers=4.1 #containerd有部分参数异常 #- noresvport #告知NFS客户端在重新建立网络连接时，使用新的传输控制协议源端口 - noatime #访问文件时不更新文件inode中的时间戳，高并发环境可提高性能 parameters: archiveOnDelete: "true" #删除PVC后对PV进行归档保留,PV切换为Released 状态
nfs-provisioner apiVersion: apps/v1 kind: Deployment metadata: name: nfs-client-provisioner labels: app: nfs-client-provisioner # replace with namespace where provisioner is deployed namespace: nfs spec: replicas: 1 strategy: #部署策略 type: Recreate selector: matchLabels: app: nfs-client-provisioner template: metadata: labels: app: nfs-client-provisioner spec: serviceAccountName: nfs-client-provisioner containers: - name: nfs-client-provisioner #image: k8s.gcr.io/sig-storage/nfs-subdir-external-provisioner:v4.0.2 image: registry.cn-qingdao.aliyuncs.com/zhangshijie/nfs-subdir-external-provisioner:v4.0.2 volumeMounts: - name: nfs-client-root mountPath: /persistentvolumes env: - name: PROVISIONER_NAME value: k8s-sigs.io/nfs-subdir-external-provisioner - name: NFS_SERVER value: 172.31.7.109 - name: NFS_PATH value: /data/volumes volumes: - name: nfs-client-root nfs: server: 172.31.7.109 path: /data/volumes
pvc # Test PVC kind: PersistentVolumeClaim apiVersion: v1 metadata: name: myserver-myapp-dynamic-pvc namespace: myserver spec: storageClassName: nfs #调用的storageclass 名称 accessModes: - ReadWriteMany #访问权限 resources: requests: storage: 500Mi #空间大小
webserver kind: Deployment #apiVersion: extensions/v1beta1 apiVersion: apps/v1 metadata: labels: app: myserver-myapp name: myserver-myapp-deployment-name namespace: myserver spec: replicas: 1 selector: matchLabels: app: myserver-myapp-frontend template: metadata: labels: app: myserver-myapp-frontend spec: containers: - name: myserver-myapp-container image: registry.cn-hangzhou.aliyuncs.com/zhangshijie/nginx:1.22.0-alpine #imagePullPolicy: Always ports: - containerPort: 80 name: http protocol: TCP - containerPort: 443 name: https protocol: TCP volumeMounts: - mountPath: "/usr/share/nginx/html/statics" name: statics-datadir volumes: - name: statics-datadir persistentVolumeClaim: claimName: myserver-myapp-dynamic-pvc --- kind: Service apiVersion: v1 metadata: labels: app: myserver-myapp-service name: myserver-myapp-service-name namespace: myserver spec: type: NodePort ports: - name: http port: 80 targetPort: 80 nodePort: 30010 selector: app: myserver-myapp-frontend
5.通过ConfigMap为pod提供配置文件-准生产使用模式
1.nginx-deploy_configmap.yml apiVersion: v1 kind: ConfigMap metadata: name: nginx-config data: mysite: | server { listen 80; server_name www.mysite.com; index index.html index.php index.htm; location / { root /data/nginx/mysite; if (!-e $request_filename) { rewrite ^/(.*) /index.html last; } } } myserver: | server { listen 80; server_name www.myserver.com; index index.html index.php index.htm; location / { root /data/nginx/myserver; if (!-e $request_filename) { rewrite ^/(.*) /index.html last; } } } --- #apiVersion: extensions/v1beta1 apiVersion: apps/v1 kind: Deployment metadata: name: nginx-deployment spec: replicas: 1 selector: matchLabels: app: myserver-nginx-selector template: metadata: labels: app: myserver-nginx-selector spec: containers: - name: myserver-nginx-container image: registry.cn-hangzhou.aliyuncs.com/zhangshijie/nginx:1.22.0-alpine ports: - containerPort: 80 name: http protocol: TCP - containerPort: 443 name: https protocol: TCP volumeMounts: - mountPath: /data/nginx/mysite name: nginx-mysite-statics readOnly: true - mountPath: /data/nginx/myserver name: nginx-myserver-statics readOnly: true - name: nginx-mysite-config mountPath: /etc/nginx/conf.d/mysite/ readOnly: true - name: nginx-myserver-config mountPath: /etc/nginx/conf.d/myserver/ readOnly: true - mountPath: /etc/localtime name: timefile readOnly: true volumes: - name: nginx-mysite-config configMap: name: nginx-config items: - key: mysite path: mysite.conf - name: nginx-myserver-config configMap: name: nginx-config items: - key: myserver path: myserver.conf - name: nginx-myserver-statics nfs: server: 172.31.7.109 path: /data/k8sdata/myserver - name: nginx-mysite-statics nfs: server: 172.31.7.109 path: /data/k8sdata/mysite - name: timefile hostPath: path: /etc/localtime type: File --- apiVersion: v1 kind: Service metadata: name: myserver-nginx-selector spec: ports: - name: http port: 81 targetPort: 80 nodePort: 30019 protocol: TCP type: NodePort selector: app: myserver-nginx-selector
2.nginx-deploy_configmap_env.yml apiVersion: v1 kind: ConfigMap metadata: name: nginx-config data: host: "172.31.7.189" username: "user1" password: "12345678" --- #apiVersion: extensions/v1beta1 apiVersion: apps/v1 kind: Deployment metadata: name: nginx-deployment spec: replicas: 1 selector: matchLabels: app: ng-deploy-80 template: metadata: labels: app: ng-deploy-80 spec: containers: - name: ng-deploy-80 image: registry.cn-hangzhou.aliyuncs.com/zhangshijie/nginx:1.22.0-alpine env: - name: HOST valueFrom: configMapKeyRef: name: nginx-config key: host - name: USERNAME valueFrom: configMapKeyRef: name: nginx-config key: username - name: PASSWORD valueFrom: configMapKeyRef: name: nginx-config key: password ###### - name: "MySQLPass" value: "123456" ports: - containerPort: 80 name: http protocol: TCP - containerPort: 443 name: https protocol: TCP
6.使用Secret为nginx pod提供SSL证书并实现https访问
1、自签发证书 root@192:~/apply/k8s-Resources/case11-secret/certs# openssl req -x509 -sha256 -newkey rsa:4096 -keyout ca.key -out ca.crt -days 3560 -nodes -subj '/CN=www.ca.com' root@192:~/apply/k8s-Resources/case11-secret/certs# ll total 20 drwxr-xr-x 3 root root 4096 Feb 21 14:22 ./ drwxr-xr-x 3 root root 4096 Jan 17 16:12 ../ drwxr-xr-x 2 root root 4096 Feb 21 14:22 bak/ -rw-r--r-- 1 root root 1809 Feb 21 14:22 ca.crt -rw------- 1 root root 3272 Feb 21 14:22 ca.key root@192:~/apply/k8s-Resources/case11-secret/certs# openssl req -new -newkey rsa:4096 -keyout server.key -out server.csr -nodes -subj '/CN=www.mysite.com' root@192:~/apply/k8s-Resources/case11-secret/certs# ll total 28 drwxr-xr-x 3 root root 4096 Feb 21 14:24 ./ drwxr-xr-x 3 root root 4096 Jan 17 16:12 ../ drwxr-xr-x 2 root root 4096 Feb 21 14:22 bak/ -rw-r--r-- 1 root root 1809 Feb 21 14:22 ca.crt -rw------- 1 root root 3272 Feb 21 14:22 ca.key -rw-r--r-- 1 root root 1590 Feb 21 14:24 server.csr -rw------- 1 root root 3272 Feb 21 14:24 server.key root@192:~/apply/k8s-Resources/case11-secret/certs# openssl x509 -req -sha256 -days 3650 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt Certificate request self-signature ok subject=CN = www.mysite.com root@192:~/apply/k8s-Resources/case11-secret/certs# kubectl create secret tls myserver-tls-key --cert=./server.crt --key=./server.key -n myserver secret/myserver-tls-key created root@192:~/apply/k8s-Resources/case11-secret/certs# kubectl get secrets -n myserver NAME TYPE DATA AGE myserver-tls-key kubernetes.io/tls 2 20s root@192:~/apply/k8s-Resources/case11-secret/certs# kubectl get secrets -n myserver myserver-tls-key -o yaml apiVersion: v1 data: tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVvakNDQW9vQ0FRRXdEUVlKS29aSWh2Y05BUUVMQlFBd0ZURVRNQkVHQTFVRUF3d0tkM2QzTG1OaExtTnYKYlRBZUZ3MHlOakF5TWpFeE5ESTJNVEphRncwek5qQXlNVGt4TkRJMk1USmFNQmt4RnpBVkJnTlZCQU1NRG5kMwpkeTV0ZVhOcGRHVXVZMjl0TUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQ0FnRUF0RXkwCkYvTzZZMUZXWnB2T3A1UkNlYUkxc3luYXhyeUttMWJjQzNaMjV6MXdPZlBWdWVOM05Db2pzdWt2QUdUTkNNNk0KRlFUZ2VqTklzcnJLZjk3TzBtL042a2JhOW1DbGNVUHZnOStBVXl4dWJ0TXRRZ1I5akU0dVo5WnUyMkRzQkhLRgpoZmNXVU5NdnV1M2lYOGpiUlVBVlNSem9RcXZWdW03N0h2blgxN05xL0hoQVk2QkxYMmpKeWlhbW9kV1cvMm5uCm9WcjdLOEs5SFdETkRhWHVWNklYVG0vZEpHN0xiUmd0b0hYWWlDQXQ0WTFjWklUc3p4dWhKZVdnU3l0bWxqcFYKVWJnZGdsb25RUS9TaEYyTFRGQXZhelo3MFY1dFRiU0VpZXVIRVZTNlNQSWFmM0s3Tit3M2c1eHlPYXRlUWxuSApvbHpIb1JDMUMxYVo0TWtWM1ZiRFhNTzNCa1A5aXloSmU2ZUo5Mnp4a1JiaGhad2srQ2t2ZVpRRkZvUTlpZExTCitldVB4MU9reno5cGw1Q1VEMnAxRXVlWktQRVJpL01XZHlYT3g1bDNydkdkYzd1cmNWa2ttSSt2K1pKWGVRenUKZ3pQTW4yVkNJUWZrNml4ZUFJT2Zza1lnbTFVSVpmSTZCZ1Bhay82MGZuUHZzRm1HaWZvQWxhb25UakQ4QXlPZwpobkFWUDNoSWttenZRNzVYWFByTWYybDdwRmVCWHVWMkIzSDRpMlQ1QVZvN1IzbDdyVGh1eFNJSjIvOHNXWWFXCnZtUmxUQXJtbVFXajNjd0NRUDFzRlFaSTNYL0FGMDB1aUZMUjN2OHNPTlcwQXJaeERXZlRXeWpmSzlQMm1ZdWwKUkQvZU5OSVdnekZtSXVmVE0zWjhWUVRQbTRYc3c3Mk5wbStwOURNQ0F3RUFBVEFOQmdrcWhraUc5dzBCQVFzRgpBQU9DQWdFQXR5dGRWY1NHcGFuYmROck92ajErbGQrQ3g4OVczRlNtVGdOZG9FYjlZMktjeU1FckxHaVF5aUVHClBKOWRrQ0xXdjFXbGs5OGp5dnVxbFBnYno0eEJxWkE0eWtwR05lUXdCVlJDcXp0RFdZYnFzQnhmYUo0TkdQNXQKTS9XZE90SmdNaGtzdDNrOEVzWkRuOE41VmgvaE5GTHBKNEpEYVo1aHRqemxOZ0twSEF4RUZ3bDFkdHY1T0twQQo0ZTZOZW5jVmJ4cHYxVFFFb2hBZTZmS05iSDNmTDVlZnNPSWxtS1BCQlNhWVZVazBZZS9MbjBxL21jaExPQmJmClZEUEFkNnIzaVFhbDA0UU91bEJpQUowYUQ4SGxhWkdXRUpSOEZXc09HQUdET0ZwZnBxL3F0VWNXUERlK0tjaEUKR3VaTTZmVTBFazNIeWJ5Vm0wWVdicDlMTzArdzBkTzdJaGIyZ0lSbnVyMnlaaWRRcUtlQy82Z2FHTnNSaHBHawpLZ1lod1hNa0RmUmQwVVhscUh4MWdsYlFuRm9TSVZSQlhEb3kreGJBVFdZVkg3dVRRQVFicElyNEFYUThjUVhDCktuandwSFN4akp4S0JVdGVMZlVnU0VSTElFL2FXYjV5TVdlUWtmV05EWUx4TTBhenQxS3QvdHJGS1UzVG1KN3AKNFFXVHNLMElXWmkvdUFaWGVCNEduR1J0d2F3WWQ0SndpOEpaNWlwUXpYUThKdVZtTVNZa3Q3SkNVVWZRTGM4bwpyNUhMMHRZZFlWSVNpT01vck8xdktZQllqR2VSQytXcktjTCtKdWNWbXVJL2tXLzZhQ3BMNEJXeVNLNS9heEh4CmlpZTUyeHJSNlczZ3V4eU1qZWhQcDB1RUVPbDhtWXNzZlZrS1ZqTUlJWWJuR2RVOTNGRT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUpRd0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQ1Mwd2dna3BBZ0VBQW9JQ0FRQzBUTFFYODdwalVWWm0KbTg2bmxFSjVvald6S2RyR3ZJcWJWdHdMZG5iblBYQTU4OVc1NDNjMEtpT3k2UzhBWk0wSXpvd1ZCT0I2TTBpeQp1c3AvM3M3U2I4M3FSdHIyWUtWeFErK0QzNEJUTEc1dTB5MUNCSDJNVGk1bjFtN2JZT3dFY29XRjl4WlEweSs2CjdlSmZ5TnRGUUJWSkhPaENxOVc2YnZzZStkZlhzMnI4ZUVCam9FdGZhTW5LSnFhaDFaYi9hZWVoV3ZzcndyMGQKWU0wTnBlNVhvaGRPYjkwa2JzdHRHQzJnZGRpSUlDM2hqVnhraE96UEc2RWw1YUJMSzJhV09sVlJ1QjJDV2lkQgpEOUtFWFl0TVVDOXJObnZSWG0xTnRJU0o2NGNSVkxwSThocC9jcnMzN0RlRG5ISTVxMTVDV2NlaVhNZWhFTFVMClZwbmd5UlhkVnNOY3c3Y0dRLzJMS0VsN3A0bjNiUEdSRnVHRm5DVDRLUzk1bEFVV2hEMkowdEw1NjQvSFU2VFAKUDJtWGtKUVBhblVTNTVrbzhSR0w4eFozSmM3SG1YZXU4WjF6dTZ0eFdTU1lqNi81a2xkNURPNkRNOHlmWlVJaApCK1RxTEY0QWc1K3lSaUNiVlFobDhqb0dBOXFUL3JSK2MrK3dXWWFKK2dDVnFpZE9NUHdESTZDR2NCVS9lRWlTCmJPOUR2bGRjK3N4L2FYdWtWNEZlNVhZSGNmaUxaUGtCV2p0SGVYdXRPRzdGSWduYi95eFpocGErWkdWTUN1YVoKQmFQZHpBSkEvV3dWQmtqZGY4QVhUUzZJVXRIZS95dzQxYlFDdG5FTlo5TmJLTjhyMC9hWmk2VkVQOTQwMGhhRApNV1lpNTlNemRueFZCTStiaGV6RHZZMm1iNm4wTXdJREFRQUJBb0lDQUZMRmRkWWJJNkd0dVFzUkV6MldrQy96CjJsQStjanZUV1pSM3V6d2Q3ZmM1bXRoWUN2RzBMY2pLWWFva1o5bjM3TExTMDdkZ2prYzdYUEFFVmF0L1Y1Wi8KRWxxdm5aMEhBRnl2c2ZqcDlhajVXRmRUWms4TTdiQW9RaUNVYmo4VFR6YTVkbmZxVjVuU1lmS2dlOUM2VG9PTApxRm53eGVXNXFqeFU3NzhvTnNGRkVtUUdOcFVtQlFRdmdKZm54NDY3RmY5Nm1JWllWTCtodnAwS2tBaG9lVE5NCjdBTXIwcXVEbTZzaE11MGJ2TVM5ZFNLN2VVT0NUSTdGNGVTYWRzeWJoNVNIQWgwcWQ0MmNvckc1T0UxZy9tNlIKenpzYWY1dytDOUxsQVFXcUZVOU5CTm94SHg0TVIwdWtpMVhGMENDT2ZnN2ExWTNCcHpuWGlDM0UyNDY0OGVwdApWNjQvU2VkZWhFZ0FpbTJPQ0Q1WStVRjROZjd2aWh2MjhraExFS3dFbXU2YzEvNjFOSmdubEFkYWUzZHBrY1U2CmdaNXhkbFg3V2oyMXRPTis4Nkc0dmNrSWF4aVdpcjF6UGRER3FsSjFlNHNSSGR6N1gyTlViU3Y1NjRKMno0eFcKUFIrMjFzenVGcitzV29XN2hOVDVBcGsvdHBnTDdkK211Y2F2Q0xpTTdsVkl2Vm1TeElZc21SRFd2Qm9QM0hNagpKUE5JdzBTWDhJRUxkUHlZV256TGdKZ0wrcXFzSDFnUUtMVlBCc2ZHSFNjKzhqR0ZBYkl2bXBjNmt0emhOTWgzCkNTeFNSd0Y0TUxDa2cxMkhOM2QxSmF0RFdQQzZ2VDNCSUZoa2ZwQnROTERkQnRNSlFheG1aYnlNNUphb3R0VUgKZGZXT0t1TzQ4OGFUM1kxR000VXBBb0lCQVFEc3JHbDR1VVZjUmdpT1lnNkFnSzU3ck1NZ2N3ZGFrZWhjRExTYQpsNXJKMDdxNndyYXNESUFMRXQ1ZFY4cmJNWG5VRVVSRWcwc2lKQ2dCdENIWUVYeTdFVS9QYkJPUmRkRDJELzFoCnIycXhHdTJmNmdSQmpuaDZaZk01MFZrTUwzUEU3THM1djZrb1hvcytjdWRUMmdWV0RvTjJBRFBQWjhaZlhIOVkKS2lJWmxDODlpalJQVzJRVWExOFJlTmFRNGlMUzROYTFHeDd0NCswWVd2dkNNREhLTUdTdTNzTWJKVXBJUlcvMwpMaUlQaVA1eWEweWgvSi9nQ01Yd25MVzdEWU5SbTVjSGRKTmR3bnFWZlpQdVNIRXVWNWdMTUY1dFNvVktqSi9ECklvaEIrRHA3ZEZFWWJUMDV0K1hYc2ZXdGRyNFJCQ2h1OGo2MWplLzFaem9VbUhScEFvSUJBUUREQmRBWXR6ZnYKZDVJVWlJNkVEVXNwVWRHNVNydlViRmFRZEFXdE1ZRUxON0hNMCtyM3RGaDdpQytxU0hwanpSbGxHWVdEQVQ3dgpSWWhUdE9yN3V3UE8vN2dZZUhEcTQzSEFIaUd5Q25oR0MyT05ZSXNSdlR6YjQ0bzBuS0hERHFMaStnZnEyR3VHCkRqQVdVaUNkU1ZtaENFbjFucFk4Wkpsd0YrU0pjaVJZM1dFVWxpNE1yYTV2NDZOWDRZTHVQZCtKVXdRWWhuRWIKMmk0MEQ5VzVwdkYyRlBZR0gzbEE2TjBuZk5SdWVRUjJHRU44djJRMEJEdW5MWDV0TzlCSTNKaUJtZUV4QWRLRApyL1pZOW5NdWdISktWL3FzYzI2TUFTQ0hoQzJicnRyNUdSZTNFWVdrRUVueWJ4OUdRR056dE0vWHFGblJMaFVNClBocysvTFVxNmlBN0FvSUJBSGNVTUdVTFlyaVFqQkdIaUtCakhtY2ZmM1crS244SlZvMnAzdHpCVnFJaG81d0EKQ0FUOHJSZmxRSGhhaWJoTFptNnEyVnhYYXVBY3JQeGVjNERSRzU3TGtRcGQ2R0tSa3JlYlIvTjBYUXdLN25BOQpRREx6eWU1YmlVc1g1K1BYcERuNm1pRHVLK0FoNFpGa0lydnZ3Q3VTVmRaek41NHRLb1FrZC9ZV0RONHR6cTc1CjhHUFZLYitVWGxyZUg2YjZBR2QxdE5HZWVhdGJ1SmsrZmRrd2dueW1hS0lMZHNNYnVnb3UxYXphUzB6aHNwUkQKSkdXRVE3Um05YUNnV0ZkcTd4MktXU3pwSEpSYUcyOUhwYnlJT2xvRXZIMDBzdTN1UnE1Qm5zaUJnV2tmeWR6LwpveVhWSUs3L3RlY1dwUFBJQU0xeStCMEtTVDd6MFQzNTJDRXdxN0VDZ2dFQkFKeWdYSUtkRTJWVmFKTHBJVnhZCnVOYVVpWlVBdWwxZUxSK1Nyc1JzRDdHTXAxVlRsVkFmSFRrSkpRN2phcmdnanBhdHFwYU9ONWMvQnNBRGV2MTEKTXhmYU5HWWl4TDFBc2FpVUNvZk05TTk4Y2hXblJjbVhhL3RGZ1VmRHkvNjJFSWV1T3hHWGdyT0ZUWVYvckFYbQpWUCtKZ3F5ckV3bXAyYmsyMXlxejZ4RWJxczQzMXdBRHRTYlRjZW93aVZFQmpEZmozbFE4RlRkRFFQdzdBM0U0CjdJL2pRYnVsSjJMRUltbUdUYTN6cjJ1UkRSSnhPKzZ5djU0Q1laa2xBcUNoMmpHci9qbTN0dlJnSzc5REh6cG4KbW1LdXlmb2FNdHhxUTAvVERqWU1kbnk4ZEZsb3p5WDJsdzBIeGR4TDloT0ZVYTluMjhxdDhlV0ZNNmlnbUhmQQoxT1VDZ2dFQkFMNTZuTlNZNC9aUzlRS3Z4dUw1WkQxNlkySzFXNURrOEIyYmJxdGtRQ0dsa2VNWkFseElNelF3Cm9EVWdpQmJiNk1lbkVrMTNGYTVLbGVmYkl2QlEralF6QVM2cGJyc3REQXh2cGFhdnJlcHdWV01XamsvUnlZNDIKbHhkbmxwY1Y5NXE1MGNndktDUGhhWTFDVE5HcGNBRzNQQ0xCei83blU0RytwdHV6eUtFOUd1elhHSVBJMVc2dgpYZ1M4YTBETEFRN2IrNzg4bU9xQ2duQWdEd2Eyd0lTT0o4RTVZTHgvSUlhZGdodW94S0p1WE5pWUI2a3prY2UwCmZnbXI0ZFU4eWRlMmZWK2ZBVEpJL1VZVzJuQm5qcXIxN2h0S2NVTlhtVFlOdkNQRUpjV1pBNlkxbFZqaXFPSnUKWFBjczljeE1LNnByL2ExOExoSTl5UXMyVmt0ZEQzcz0KLS0tLS1FTkQgUFJJVkFURSBLRVktLS0tLQo= kind: Secret metadata: creationTimestamp: "2026-02-21T14:27:00Z" name: myserver-tls-key namespace: myserver resourceVersion: "4253541" uid: c67349e2-cb1e-4cee-b6ba-0e67122bd0ae type: kubernetes.io/tls
root@192:~/apply/k8s-Resources/case11-secret# kubectl apply -f 4-secret-tls.yaml configmap/nginx-config created deployment.apps/myserver-myapp-frontend-deployment created service/myserver-myapp-frontend created apiVersion: v1 kind: ConfigMap metadata: name: nginx-config namespace: myserver data: default: | server { listen 80; server_name www.mysite.com; listen 443 ssl; ssl_certificate /etc/nginx/conf.d/certs/tls.crt; ssl_certificate_key /etc/nginx/conf.d/certs/tls.key; location / { root /usr/share/nginx/html; index index.html; if ($scheme = http ){ #未加条件判断，会导致死循环 rewrite / https://www.mysite.com permanent; } if (!-e $request_filename) { rewrite ^/(.*) /index.html last; } } } --- #apiVersion: extensions/v1beta1 apiVersion: apps/v1 kind: Deployment metadata: name: myserver-myapp-frontend-deployment namespace: myserver spec: replicas: 1 selector: matchLabels: app: myserver-myapp-frontend template: metadata: labels: app: myserver-myapp-frontend spec: containers: - name: myserver-myapp-frontend image: registry.cn-hangzhou.aliyuncs.com/zhangshijie/nginx:1.20.2-alpine ports: - containerPort: 80 name: http protocol: TCP - containerPort: 443 name: https protocol: TCP volumeMounts: - name: nginx-config mountPath: /etc/nginx/conf.d/myserver - name: myserver-tls-key mountPath: /etc/nginx/conf.d/certs volumes: - name: nginx-config configMap: name: nginx-config items: - key: default path: mysite.conf - name: myserver-tls-key secret: secretName: myserver-tls-key --- apiVersion: v1 kind: Service metadata: name: myserver-myapp-frontend namespace: myserver spec: type: NodePort ports: - name: http port: 80 targetPort: 80 nodePort: 30018 protocol: TCP - name: htts port: 443 targetPort: 443 nodePort: 30019 protocol: TCP selector: app: myserver-myapp-frontend root@192:~/apply/k8s-Resources/case11-secret# kubectl exec -it -n myserver myserver-myapp-frontend-deployment-d48668b78-qqcrc -- sh / # ls /etc/nginx/conf.d/certs/ tls.crt tls.key
7.基于nerdctl+BuildKit可以构建镜像并push到镜像仓库
#安装buildkitd root@k8s-master1:/usr/local/src# tar xvf buildkit-v0.27.0.linux-amd64.tar.gz bin/ bin/buildctl bin/buildkit-cni-bridge bin/buildkit-cni-firewall bin/buildkit-cni-host-local bin/buildkit-cni-loopback bin/buildkit-qemu-aarch64 bin/buildkit-qemu-arm bin/buildkit-qemu-i386 bin/buildkit-qemu-ppc64le bin/buildkit-qemu-riscv64 bin/buildkit-qemu-s390x bin/buildkit-runc bin/buildkitd root@k8s-master1:/usr/local/src# mv bin/* /usr/local/bin/ root@k8s-master1:/usr/local/src# vim /lib/systemd/system/buildkit.socket [Unit] Description=BuildKit Documentation=https://github.com/moby/buildkit [Socket] ListenStream=%t/buildkit/buildkitd.sock SocketMode=0660 [Install] WantedBy=sockets.target root@k8s-master1:/usr/local/src# vim /lib/systemd/system/buildkit.service [Unit] Description=BuildKit Requires=buildkit.socket After=buildkit.socketDocumentation=https://github.com/moby/buildkit [Service] ExecStart=/usr/local/bin/buildkitd --oci-worker=false --containerd-worker=true [Install] WantedBy=multi-user.target root@k8s-master1:/usr/local/src# systemctl daemon-reload && systemctl enable buildkit && systemctl restart buildkit && systemctl status buildkit
#构建镜像 root@k8s-master1:~/apply/ubuntu2404-nginx-1.28-dockerfile-example/1.ubuntu-24.04.3-base# vim Dockerfile FROM harbor.myarchitect.online/library/ubuntu:24.04.3 RUN apt update && apt install -y ca-certificates curl gnupg root@k8s-master1:~/apply/ubuntu2404-nginx-1.28-dockerfile-example/1.ubuntu-24.04.3-base# vim build-command.sh #!/bin/bash nerdctl build -t harbor.myarchitect.online/library/ubuntu:24.04.3-base . nerdctl push harbor.myarchitect.online/library/ubuntu:24.04.3-base root@k8s-master1:~/apply/ubuntu2404-nginx-1.28-dockerfile-example/1.ubuntu-24.04.3-base# bash build-command.sh [+] Building 3.4s (7/7) [+] Building 3.6s (7/7) [+] Building 3.7s (7/7) FINISHED => [internal] load build definition from Dockerfile 0.0s => => transferring dockerfile: 152B 0.0s => [internal] load metadata for harbor.myarchitect.online/library/ubuntu:24.04.3 0.3s => [auth] library/ubuntu:pull token for harbor.myarchitect.online 0.0s => [internal] load .dockerignore 0.0s => => transferring context: 2B 0.0s => [1/2] FROM harbor.myarchitect.online/library/ubuntu:24.04.3@sha256:fcbc9d753c56097228f485fcc2cad7af620c8a832d7514e320451f721e3680a9 0.1s => => resolve harbor.myarchitect.online/library/ubuntu:24.04.3@sha256:fcbc9d753c56097228f485fcc2cad7af620c8a832d7514e320451f721e3680a9 0.1s => CACHED [2/2] RUN apt update && apt install -y ca-certificates curl gnupg 0.0s => exporting to docker image format 2.4s => => exporting layers 0.0s => => exporting manifest sha256:65ac0fbcf467dc1fd456139892d26eb40d8954e033f684fc14b4dc5620afdd9f 0.0s => => exporting config sha256:42d3e96a548183bacd07695d70a8f28a51d32796b6268e3be97ab5e041bd8aff 0.0s => => sending tarball 2.4s INFO[0000] pushing as a reduced-platform image (application/vnd.docker.distribution.manifest.v2+json, sha256:65ac0fbcf467dc1fd456139892d26eb40d8954e033f684fc14b4dc5620afdd9f) WARN[0000] skipping verifying HTTPS certs for "harbor.myarchitect.online" manifest-sha256:65ac0fbcf467dc1fd456139892d26eb40d8954e033f684fc14b4dc5620afdd9f: done |++++++++++++++++++++++++++++++++++++++| layer-sha256:68610dd97717fdf0c95e3503551b7a04ac13cba77d00f79bb3bf7d03867b000c: done |++++++++++++++++++++++++++++++++++++++| config-sha256:42d3e96a548183bacd07695d70a8f28a51d32796b6268e3be97ab5e041bd8aff: done |++++++++++++++++++++++++++++++++++++++| layer-sha256:a3629ac5b9f4680dc2032439ff2354e73b06aecc2e68f0035a2d7c001c8b4114: done |++++++++++++++++++++++++++++++++++++++| elapsed: 1.1 s root@k8s-master1:~/apply/ubuntu2404-nginx-1.28-dockerfile-example/2.ubuntu2404-nginx-1.28-case# bash build-command.sh nerdctl build -t harbor.myarchitect.online/library/nginx-base:ubuntu2204-nginx-1.28.1 .
8.总结各种探针的功能
startupProbe: #启动探针
- 判断容器内的应用程序是否已启动完成，如果配置了启动探测，则会先禁用所有其它的探测，直到startupProbe检测成功为止，如果startupProbe探测失败，则kubelet将杀死容器，容器将按照重启策略进行下一步操作，如果容器没有提供启动探测，则默认状态为成功
livenessProbe: #存活探针
- 检测容器容器是否正在运行，如果存活探测失败，则kubelet会杀死容器，并且容器将受到其重启策略的影响，如果容器不提供存活探针，则默认状态为 Success，livenessProbe用于控制是否重启pod。
readinessProbe: #就绪探针
- 如果就绪探测失败，端点控制器将从与Pod匹配的所有Service的端点中删除该Pod的IP地址，初始延迟之前的就绪状态默认为Failure(失败)，如果容器不提供就绪探针，则默认状态为 Success，readinessProbe用于控制pod是否添加至service
存活探针和就绪探针的区别
- 存活探针：监控「容器是否活着」，解决「容器假死（进程在但不工作）」问题，失败则重启容器；
- 就绪探针：监控「容器是否能提供服务」，解决「容器活着但没准备好接收请求」问题，失败则从 Service 摘除 Pod（不重启容器）。
浙公网安备 33010602011771号