https://wiki.virtlab.space/ 2026-05-06T14:10:07+00:00 https://wiki.virtlab.space/ https://wiki.virtlab.space/_media/wiki:logo.png text/html 2024-12-21T16:00:59+00:00 Anonymous (anonymous@undisclosed.example.com) https://wiki.virtlab.space/kubernetes:%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D1%8C_%D0%B2_%D0%BA%D0%BB%D0%B0%D1%81%D1%82%D0%B5%D1%80%D0%B5?rev=1734796859&do=diff 20. Безопасность в кластере Аутентификация В разрезе аутентификации Kubernetes оперирует не пользовательскими аккаунтами, а служебными УЗ Service Accounts. text/html 2024-12-21T16:00:59+00:00 Anonymous (anonymous@undisclosed.example.com) https://wiki.virtlab.space/kubernetes:%D0%BE%D0%B1%D1%81%D0%BB%D1%83%D0%B6%D0%B8%D0%B2%D0%B0%D0%BD%D0%B8%D0%B5_%D0%BA%D0%BB%D0%B0%D1%81%D1%82%D0%B5%D1%80%D0%B0?rev=1734796859&do=diff 19. Обслуживание кластера Освобождение нод от нагрузки Выгнать поды с ноды и запретить планирование новых подов: kubectl drain node-1 Вернуть ноду в рабочее состояние: text/html 2024-12-21T16:00:59+00:00 Anonymous (anonymous@undisclosed.example.com) https://wiki.virtlab.space/kubernetes:%D1%83%D1%81%D1%82%D0%B0%D0%B2%D0%BD%D0%BE%D0%B2%D0%BA%D0%B0_kubernetes_%D0%BF%D1%80%D0%B8_%D0%BF%D0%BE%D0%BC%D0%BE%D1%89%D0%B8_kubespray?rev=1734796859&do=diff 1. Уставновка Kubernetes при помощи Kubespray Для установки понадобится: * Управляющая машина: arm-k8s * Worker ноды, от 3-х штук * Master ноды, от 2-х штук sudo apt update && sudo apt upgrade -y #Установка git и pip, остальное будет установлено скриптом sudo apt install git pip cd && mkdir git && cd git #Клонируем репозиторий с Kubespray git clone https://github.com/kubernetes-sigs/kubespray.git cd kubespray #Установка зависимостей sudo pip install -r requirements.txt… text/html 2024-12-21T16:00:59+00:00 Anonymous (anonymous@undisclosed.example.com) https://wiki.virtlab.space/kubernetes:affinity?rev=1734796859&do=diff 9. Affinity affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms - matchExpressions - key: size operator: In values: - Large text/html 2024-12-21T16:00:59+00:00 Anonymous (anonymous@undisclosed.example.com) https://wiki.virtlab.space/kubernetes:app_lifecycle?rev=1734796859&do=diff 14. App Lifecycle Обновить image контейнера в deployment'е: kubectl set image deployment/myapp-deployment nginx=nginx:1.9.1 Узнать статус роллаута: kubectl rollout status deployment/myapp-deployment Показать историю обновлений: text/html 2024-12-21T16:00:59+00:00 Anonymous (anonymous@undisclosed.example.com) https://wiki.virtlab.space/kubernetes:configmap?rev=1734796859&do=diff 17. ConfigMap 1. Создать configMap kubectl create configMap \ config-name \ --from-literal=ENV_NAME1=env_value1 --from-literal=ENV_NAME2=env_value2 --from-literal=ENV_NAME3=env_value3 kubectl create configMap \ config-name \ --from-file=config-file.properties text/html 2024-12-21T16:00:59+00:00 Anonymous (anonymous@undisclosed.example.com) https://wiki.virtlab.space/kubernetes:daemonsets?rev=1734796859&do=diff 12. DaemonSets apiVersion: apps/v1 kind: DaemonSet metadata: name: fluentd-elasticsearch namespace: kube-system labels: k8s-app: fluentd-logging spec: selector: matchLabels: name: fluentd-elasticsearch template: metadata: labels: name: fluentd-elasticsearch spec: containers: - name: fluentd-elasticsearch image: quay.io/fluentd_elasticsearch/fluentd:v2.5.2 text/html 2024-12-21T16:00:59+00:00 Anonymous (anonymous@undisclosed.example.com) https://wiki.virtlab.space/kubernetes:deployment?rev=1734796859&do=diff 4. Deployment apiVersion: apps/v1 kind: Deployment metadata: name: myapp-deployment labels: app: myapp type: front-end spec: template: metadata: name: myapp-pod #string labels: app: myapp anyKey: anyValue spec: containers: - image: nginx name: myapp replicas: 3 selector: matchLabels: # совпадение меток от ПОДов anyKey: anyValue text/html 2024-12-21T16:00:59+00:00 Anonymous (anonymous@undisclosed.example.com) https://wiki.virtlab.space/kubernetes:editing_existing_pod?rev=1734796859&do=diff 11. Editing existing pod kubectl get pod webapp -o yaml > my-new-pod.yaml vi my-new-pod.yaml kubectl delete pod webapp kubectl create -f my-new-pod.yaml text/html 2024-12-21T16:00:59+00:00 Anonymous (anonymous@undisclosed.example.com) https://wiki.virtlab.space/kubernetes:entrypoint_and_cmd?rev=1734796859&do=diff 15. Entrypoint and CMD Entrypoint соответствует параметру command CMD - args apiVersion: v1 kind: Pod metadata: name: ubuntu-sleeper spec: containers: - name: ubuntu-sleeper image: ubuntu-sleeper command: ["sleep2.0"] args: ["10"] text/html 2024-12-21T16:00:59+00:00 Anonymous (anonymous@undisclosed.example.com) https://wiki.virtlab.space/kubernetes:env_variables?rev=1734796859&do=diff 16. ENV Variables apiVersion: v1 kind: Pod metadata: name: myapp-pod #string labels: app: myapp anyKey: AnyValue spec: containers: #List/Array - name: nginx-container image: nginx env: - name: env_name value: env_value - name: env_name_2 valueFrom: configMapKeyRef: - name: env_name_3 valueFrom: secretsKeyRef: text/html 2024-12-21T16:00:59+00:00 Anonymous (anonymous@undisclosed.example.com) https://wiki.virtlab.space/kubernetes:image_security?rev=1734796859&do=diff 22. Image Security Осуществление доступа к приватному репозиторию kubectl create secret docker-registry regcred \ --docker-server=private-registry.io \ --docker-usernamne=registry-user \ --docker-password=registry-password \ --docker-email=user@domain.com text/html 2024-12-21T16:00:59+00:00 Anonymous (anonymous@undisclosed.example.com) https://wiki.virtlab.space/kubernetes:kubeconfig?rev=1734796859&do=diff 21. Kubeconfig Kubeconfig - файл, содержащий перечень доступных кластеров, учетных данных и их комбинаций. Kubeconfig не применяется командой kubectl как другие yaml файлы, а просто кладётся в директорию пользователя с указанием пути к файлу в kubectl. text/html 2024-12-21T16:00:59+00:00 Anonymous (anonymous@undisclosed.example.com) https://wiki.virtlab.space/kubernetes:labels_and_selector?rev=1734796859&do=diff 7. Labels and Selector text/html 2024-12-21T16:00:59+00:00 Anonymous (anonymous@undisclosed.example.com) https://wiki.virtlab.space/kubernetes:main?rev=1734796859&do=diff Kubernetes * Уставновка Kubernetes при помощи Kubespray * Pods * ReplicaSet * Deployment * Namespaces * Service * Labels and Selector * Taints and Tolerance * Affinity * Resource requirements and limits * Editing existing pod * DaemonSets * StaticPods * App Lifecycle * Entrypoint and CMD * ENV Variables * ConfigMap * Secrets * Обслуживание кластера * Безопасность в кластере * Kubeconfig * Image Security * Traffic Policy… text/html 2024-12-21T16:00:59+00:00 Anonymous (anonymous@undisclosed.example.com) https://wiki.virtlab.space/kubernetes:namespaces?rev=1734796859&do=diff 5. Namespaces Создать пространство имен: apiVersion: v1 kind: Namespace metadata: name:myNamespace Установить namespace по умолчанию: kubectl config set-context $(kubectl config current-context) --namespace=myNamespace text/html 2024-12-21T16:00:59+00:00 Anonymous (anonymous@undisclosed.example.com) https://wiki.virtlab.space/kubernetes:pods?rev=1734796859&do=diff 2. Pods Описание пода и запуск Описание: apiVersion: v1 kind: Pod metadata: name: myapp-pod #string labels: app: myapp anyKey: AnyValue spec: containers: #List/Array - name: nginx-container image: nginx resources: {} restartPolicy: Always text/html 2024-12-21T16:00:59+00:00 Anonymous (anonymous@undisclosed.example.com) https://wiki.virtlab.space/kubernetes:replicaset?rev=1734796859&do=diff 3. ReplicaSet Replication Controller apiVersion: v1 kind: ReplicationController metadata: name: myapp-rc labels: app: myapp type: front-end spec: template: #ниже начинается описание пода metadata: name: myapp-pod #string labels: app: myapp anyKey: AnyValue spec: containers: #List/Array - name: nginx-container image: nginx resources: {} restartPolicy: Always replicas: 2 #указать количество экземпляров… text/html 2024-12-21T16:00:59+00:00 Anonymous (anonymous@undisclosed.example.com) https://wiki.virtlab.space/kubernetes:resource_requirements_and_limits?rev=1734796859&do=diff 10. Resource requirements and limits Создание стартовых ресурсов по умоланию. Memory: apiVersion: v1 kind: LimitRange metadata: name: mem-limit-range spec: limits: - default: memory: 512Mi defaultRequest: memory: 256Mi type: Container text/html 2024-12-21T16:00:59+00:00 Anonymous (anonymous@undisclosed.example.com) https://wiki.virtlab.space/kubernetes:secrets?rev=1734796859&do=diff 18. Secrets 1. Создать Secret kubectl create secret generic\ secret-name \ --from-literal=DB_host=mysql --from-literal=DB_user=root --from-literal=DB_password=P@ssw0rd kubectl create secret generic\ secret-name \ --from-file=secret-file text/html 2024-12-21T16:00:59+00:00 Anonymous (anonymous@undisclosed.example.com) https://wiki.virtlab.space/kubernetes:service?rev=1734796859&do=diff 6. Service NodePort: apiVersion: v1 kind: Service metadata: name: webapp-service spec: type: NodePort ports: - targetPort: 8080 port: 8080 nodePort: 30080 selector: name: simple-webapp kubectl create service nodeport webapp-service --tcp=8080:8080 --node-port=30080 text/html 2024-12-21T16:00:59+00:00 Anonymous (anonymous@undisclosed.example.com) https://wiki.virtlab.space/kubernetes:staticpods?rev=1734796859&do=diff 13. StaticPods * StaticPods - поды, которые созданы в обход API, путем создания манифеста напрямую на ноде. * Такие поды запускает kubelet основываясь на yaml файлах в директории /etc/kubernetes/manifests/ (по умолчанию). text/html 2024-12-21T16:00:59+00:00 Anonymous (anonymous@undisclosed.example.com) https://wiki.virtlab.space/kubernetes:taints_and_tolerance?rev=1734796859&do=diff 8. Taints and Tolerance Пометить ноду node-name: kubectl taint nodes node-name key=value:taint-effect taint-effect: * NoSchedule - не позволять приземлять новые поды на ноды. * PreferNoSchedule - избегать попадания подов на ноды, но если прижмёт, то разместить. text/html 2024-12-21T16:00:59+00:00 Anonymous (anonymous@undisclosed.example.com) https://wiki.virtlab.space/kubernetes:traffic_policy?rev=1734796859&do=diff 23. Traffic Policy apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: db-policy spec: podSelector: matchLabels: role: db policyTypes: - Ingress ingress: - from: - podSelector: matchLabels: name: api-pod namespaceSelector: matchLabels: name: prod #for external IP - ipBlock: cidr: 192.168.0.1/32 ports: - protocol: tcp port: 8080 egress: - to: - ipBlock: cidr: 1…