K8S---Service

编程语言 2023-05-05 14:10:08 阅读次数: 0

服务原理

容器化的问题：

1.自动调度 无法预知pod所在节点，pod的IP地址

2.有故障时，换新节点新ip进行部署

service就是解决这些问题

自动跟踪  clusterip不变 都能找到对应pod  主要靠后端pod的标签

负载均衡 通过iptables/LVS规则将访问的请求最终映射到Pod容器内部，自动在多个容器之间实现负载均衡

自动发现 服务创建时会自动在内部DNS上注册域名 <服务名称>.<名称空间>.svc.cluster.local服务工作原理，kube-proxy是在所有节点上运行的代理。可以实现简单的数据转发，可以设置更新iptable/LVS规则，在创建服务时，还提供服务地址DNS自动注册与服务发现功能

ClusterIP服务

        默认的ServiceType，通过集群的内部IP暴露服务，选择这个时，只能在集群内部访问

 

自动注册域名

[root@master ~]# vim mysvc.yaml
---
kind: Service
apiVersion: v1
metadata:
  name: mysvc
spec:
  type: ClusterIP
  selector:
    app: web
  ports:
  - protocol: TCP
    port: 80
    targetPort: 80

[root@master ~]# kubectl apply -f mysvc.yaml 
service/mysvc created
[root@master ~]# kubectl get service
NAME         TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)   AGE
kubernetes   ClusterIP   10.245.0.1      <none>        443/TCP   2d18h
mysvc        ClusterIP   10.245.1.80     <none>        80/TCP    8s
[root@master ~]# yum install -y bind-utils
[root@master ~]# host mysvc.default.svc.cluster.local 10.245.0.10
Using domain server:
Name: 10.245.0.10
Address: 10.245.0.10#53
Aliases: 

mysvc.default.svc.cluster.local has address 10.245.1.80

后端Pod

[root@master ~]# vim myweb.yaml 
---
kind: Pod
apiVersion: v1
metadata:
  name: myweb
  labels:
    app: web
spec:
  terminationGracePeriodSeconds: 0
  restartPolicy: Always
  containers:
  - name: apache
    image: myos:httpd
    imagePullPolicy: IfNotPresent
    ports:
    - name: myhttp
      protocol: TCP
      containerPort: 80

[root@master ~]# sed 's,myweb,web1,' myweb.yaml |kubectl apply -f - 
pod/web1 created
[root@master ~]# curl http://10.245.1.80
Welcome to The Apache.

# service 靠标签寻找 Pod
[root@master ~]# kubectl label pod web1 app-
pod/web1 labeled
[root@master ~]# curl http://10.245.1.80
curl: (7) Failed connect to 10.245.1.80:80; Connection refused
[root@master ~]# kubectl label pod web1 app=web
pod/web1 labeled
[root@master ~]# curl http://10.245.1.80
Welcome to The Apache.

多个Pod负载均衡

[root@master ~]# sed 's,myweb,web2,' myweb.yaml |kubectl apply -f -
pod/web2 created
[root@master ~]# sed 's,myweb,web3,' myweb.yaml |kubectl apply -f -
pod/web3 created
[root@master ~]# curl -s http://10.245.1.80/info.php |grep php_host
php_host:       web1
[root@master ~]# curl -s http://10.245.1.80/info.php |grep php_host
php_host:       web2
[root@master ~]# curl -s http://10.245.1.80/info.php |grep php_host
php_host:       web3

 为服务设置固定IP

[root@master ~]# vim mysvc.yaml 
---
kind: Service
apiVersion: v1
metadata:
  name: mysvc
spec:
  type: ClusterIP
  clusterIP: 10.245.1.80
  selector:
    app: web
  ports:
  - protocol: TCP
    port: 80
    targetPort: myhttp

[root@master ~]# kubectl delete -f mysvc.yaml 
service "mysvc" deleted
[root@master ~]# kubectl apply -f mysvc.yaml 
service/mysvc created
[root@master ~]# kubectl get service
NAME         TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)   AGE
kubernetes   ClusterIP   10.245.0.1    <none>        443/TCP   2d18h
mysvc        ClusterIP   10.245.1.80   <none>        80/TCP    65s

有错时检查IP 标签 端口号

别名 找端口不一致targetPort

K8s的ServiceTypes允许指定不同的Service类型，以满足不同的需求，有效的的类型有：ClusterIP、NodePort、LoadBalancer、ExternalName

ClusterIP：默认类型，只能在集群内部使用，可以实现Pod的自动跟踪与负载均衡，是最核心的服务类型

NodePort：通过将真实节点的端口映射到ClusterIP服务上，对外暴露服务类型

LoadBalancer:使用云提供商的负载均衡器，通过外部路由将流量转发到NodePort和ClusterIP服务上

ExternalName:通过CNAME和对应值，可以将外部服务映射到externalName字段的内容

NodePort

使用基于端口映射（默认值：30000-32767）的NodePort对外发布服务，可以发布任意服务（四层）

[root@master ~]# vim mysvc.yaml
---
kind: Service
apiVersion: v1
metadata:
  name: mysvc
spec:
  type: NodePort
  clusterIP: 10.245.1.80
  selector:
    app: web
  ports:
  - protocol: TCP
    port: 80
    nodePort: 30080
    targetPort: myhttp

[root@master ~]# kubectl apply -f mysvc.yaml 
service/mysvc configured
[root@master ~]# kubectl get service
NAME         TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)        AGE
kubernetes   ClusterIP   10.245.0.1    <none>        443/TCP        5d18h
mysvc        NodePort    10.245.1.80   <none>        80:30080/TCP   17m

[root@master ~]# curl http://node-0001:30080
Welcome to The Apache.
[root@master ~]# curl http://node-0002:30080
Welcome to The Apache.
[root@master ~]# curl http://node-0003:30080
Welcome to The Apache.

Ingress(规则+控制器)

一般由nginx或HAproxy构成，用来发布http、https服务（七层）

规则负责制定策略          控制器负责执行

如果没有控制器，单独设置规则无效

用户----Ingress-----ClusterIP------后端Pod

 

 

 Prefix宽松模式        Exact严格模式

后端服务

[root@master ~]# vim mysvc.yaml 
---
kind: Service
apiVersion: v1
metadata:
  name: mysvc
spec:
  type: ClusterIP
  clusterIP: 10.245.1.80
  selector:
    app: web
  ports:
  - protocol: TCP
    port: 80
    targetPort: 80

[root@master ~]# kubectl apply -f mysvc.yaml 
service/mysvc configured
[root@master ~]# kubectl get service
NAME         TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)   AGE
kubernetes   ClusterIP   10.245.0.1    <none>        443/TCP   5d19h
mysvc        ClusterIP   10.245.1.80   <none>        80/TCP    36m
[root@master ~]# kubectl get pods -l app=web --show-labels 
NAME   READY   STATUS    RESTARTS   AGE   LABELS
web1   1/1     Running   0          36m   app=web
web2   1/1     Running   0          34m   app=web
web3   1/1     Running   0          34m   app=web
[root@master ~]# curl http://10.245.1.80
Welcome to The Apache.

对外发布服务

[root@master ~]# kubectl get ingressclasses.networking.k8s.io 
NAME    CONTROLLER             PARAMETERS   AGE
nginx   k8s.io/ingress-nginx   <none>       5m7s
[root@master ~]# vim mying.yaml
---
kind: Ingress
apiVersion: networking.k8s.io/v1
metadata:
  name: mying
spec:
  ingressClassName: nginx
  rules:
  - host: nsd.tedu.cn
    http:
      paths:
      - backend:
          service:
            name: mysvc
            port:
              number: 80
        path: /
        pathType: Prefix

[root@master ~]# kubectl apply -f mying.yaml 
ingress.networking.k8s.io/mying created
[root@master ~]# kubectl get ingress
NAME    CLASS   HOSTS         ADDRESS        PORTS   AGE
mying   nginx   nsd.tedu.cn   192.168.1.51   80      70s
[root@master ~]# curl -H "Host: nsd.tedu.cn" http://192.168.1.51
Welcome to The Apache.

web管理插件(Dashboard)

[root@master dashboard]# docker load -i dashboard.tar.xz
[root@master dashboard]# docker images|while read i t _;do
    [[ "${t}" == "TAG" ]] && continue
    [[ "${i}" =~ ^"registry:5000/".+ ]] && continue
    docker tag ${i}:${t} registry:5000/plugins/${i##*/}:${t}
    docker push registry:5000/plugins/${i##*/}:${t}
    docker rmi ${i}:${t} registry:5000/plugins/${i##*/}:${t}
done
[root@master dashboard]# sed -ri 's,^(\s+image: ).+/(.+),\1registry:5000/plugins/\2,' recommended.yaml
190:    image: registry:5000/plugins/dashboard:v2.4.0
275:    image: registry:5000/plugins/metrics-scraper:v1.0.7
[root@master dashboard]# kubectl apply -f recommended.yaml
[root@master dashboard]# kubectl -n kubernetes-dashboard get pods
NAME                                         READY   STATUS    RESTARTS   AGE
dashboard-metrics-scraper-844d8585c9-w26m4   1/1     Running   0          10s
kubernetes-dashboard-6c58946f65-4bdtb        1/1     Running   0          10s

发布Dashboard服务

基于网页的kubernetes用户界面，各种操作

[root@master dashboard]# docker load -i dashboard.tar.xz
[root@master dashboard]# docker images|while read i t _;do
    [[ "${t}" == "TAG" ]] && continue
    [[ "${i}" =~ ^"registry:5000/".+ ]] && continue
    docker tag ${i}:${t} registry:5000/plugins/${i##*/}:${t}
    docker push registry:5000/plugins/${i##*/}:${t}
    docker rmi ${i}:${t} registry:5000/plugins/${i##*/}:${t}
done
[root@master dashboard]# sed -ri 's,^(\s+image: ).+/(.+),\1registry:5000/plugins/\2,' recommended.yaml
190:    image: registry:5000/plugins/dashboard:v2.4.0
275:    image: registry:5000/plugins/metrics-scraper:v1.0.7
[root@master dashboard]# kubectl apply -f recommended.yaml
[root@master dashboard]# kubectl -n kubernetes-dashboard get pods
NAME                                         READY   STATUS    RESTARTS   AGE
dashboard-metrics-scraper-844d8585c9-w26m4   1/1     Running   0          10s
kubernetes-dashboard-6c58946f65-4bdtb        1/1     Running   0          10s
[root@master dashboard]# kubectl -n kubernetes-dashboard get service
NAME                        TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
dashboard-metrics-scraper   ClusterIP   10.245.205.236   <none>        8000/TCP   13s
kubernetes-dashboard        ClusterIP   10.245.215.40    <none>        443/TCP    14s

[root@master dashboard]# sed -n '30,45p' recommended.yaml >dashboard-svc.yaml
[root@master dashboard]# vim dashboard-svc.yaml
---
kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
spec:
  type: NodePort
  ports:
    - port: 443
      nodePort: 30443
      targetPort: 8443
  selector:
    k8s-app: kubernetes-dashboard

[root@master dashboard]# kubectl apply -f dashboard-svc.yaml 
service/kubernetes-dashboard configured
[root@master dashboard]# kubectl -n kubernetes-dashboard get service
NAME                        TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)         AGE
dashboard-metrics-scraper   ClusterIP   10.245.205.236   <none>        8000/TCP        5m50s
kubernetes-dashboard        NodePort    10.245.215.40    <none>        443:30443/TCP   5m51s

服务账号与权限

serviceaccount

[root@master ~]# vim admin-user.yaml
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: dashboard-admin
  namespace: kubernetes-dashboard

[root@master ~]# kubectl apply -f admin-user.yaml 
serviceaccount/dashboard-admin created
[root@master ~]# kubectl -n kubernetes-dashboard get serviceaccounts 
NAME                   SECRETS   AGE
dashboard-admin        1         61s
default                1         79m
kubernetes-dashboard   1         79m
[root@master ~]# kubectl -n kubernetes-dashboard describe serviceaccounts dashboard-admin 
Name:                dashboard-admin
Namespace:           kubernetes-dashboard
Labels:              <none>
Annotations:         <none>
Image pull secrets:  <none>
Mountable secrets:   dashboard-admin-token-6kf8l
Tokens:              dashboard-admin-token-6kf8l
Events:              <none>
[root@master ~]# kubectl -n kubernetes-dashboard describe secrets dashboard-admin-token-6kf8l 
Name:         dashboard-admin-token-6kf8l
Namespace:    kubernetes-dashboard
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: dashboard-admin
              kubernetes.io/service-account.uid: 0cfe4f55-8cc3-42fd-b88b-84f49604ae56

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1099 bytes
namespace:  20 bytes
token:      <Base64 编码的令牌数据>

角色与鉴权

Role：用来在某一个名称空间内创建授权角色，创建 Role 时，必须指定所属的名字空间的名字。 ClusterRole：可以和 Role 相同完成授权。但属于集群范围，对所有名称空间有效。 RoleBinding：是将角色中定义的权限赋予一个或者一组用户，可以使用 Role 或 ClusterRole 完成授权。 ClusterRoleBinding 在集群范围执行授权，对所有名称空间有效，只能使用 ClusterRole 完成授权。

[root@master ~]# grep authorization-mode /etc/kubernetes/manifests/kube-apiserver.yaml 
    - --authorization-mode=Node,RBAC
 
[root@master ~]# vim myrole.yaml 
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: myrole
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
  - list

---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: dashboard-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: myrole
subjects:
- kind: ServiceAccount
  name: dashboard-admin
  namespace: kubernetes-dashboard

[root@master ~]# kubectl apply -f myrole.yaml 
role.rbac.authorization.k8s.io/myrole created
rolebinding.rbac.authorization.k8s.io/dashboard-admin created

[root@master ~]# kubectl delete -f myrole.yaml 
role.rbac.authorization.k8s.io "myrole" deleted
rolebinding.rbac.authorization.k8s.io "dashboard-admin" deleted

使用ClusterRole授管理员权限 

[root@master ~]# kubectl get clusterrole
NAME                              CREATED AT
admin                             2022-06-24T08:11:17Z
cluster-admin                     2022-06-24T08:11:17Z
... ...

[root@master ~]# cat admin-user.yaml 
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: dashboard-admin
  namespace: kubernetes-dashboard

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: dashboard-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: dashboard-admin
  namespace: kubernetes-dashboard

[root@master ~]# kubectl apply -f admin-user.yaml 
serviceaccount/dashboard-admin unchanged
clusterrolebinding.rbac.authorization.k8s.io/dashboard-admin created

猜你喜欢

转载自blog.csdn.net/weixin_55000003/article/details/130413259
今日推荐
面壁智能发布 Eurux-8x22B 开源大模型 —— 堪称「理科状元」
开源日报 | 谷歌扶持鸿蒙上位；开源Rabbit R1；Docker加持的安卓手机；微软的焦虑和野心；海尔电器把开放平台关了
中国码农的“35岁魔咒”
蘭雅 CorelDRAW 插件 2024.5.1 国际劳动节版，免费下载
Arc Browser for Windows 1.0 正式 GA
90后程序员开发视频搬运软件、不到一年获利超 700 万，结局很刑！
周排行
【转】spring中对控制反转和依赖注入的理解
tms webcore 安装和使用
java程序员进阶相关书籍
SpringMVC接受请求参数、
如何保存训练好的机器学习模型
MyEclipse、Eclipse设置项目JDK的三个地方
商超行业微信小程序开发定制一般多少钱 （行业技术人员解读）
Markdown编辑器语言——30分钟入门到到精通
Linux系统下MongoDB的简单安装与基本操作
Power Strings
每日归档
更多
2024-05-07(14)
2024-05-06(40)
2024-05-05(0)
2024-05-04(7)
2024-05-03(19)
2024-05-02(0)
2024-05-01(4)
2024-04-30(1)
2024-04-29(40)
2024-04-28(0)

代码天地 © 2018 codetd.com

境外服务器   最新电视剧2022