K8S 学习笔记四 token过期处理 dashboard部署 deployment

笔记记录尚硅谷雷丰阳老师的视频课
地址：https://www.bilibili.com/video/BV13Q4y1C7hS?p=39&vd_source=468c9dc64fa1f1c115ccfcff4b316262

教程地址：https://www.yuque.com/leifengyang/oncloud/ctiwgo

1. token过期处理

k8s的令牌默认24小时过期，逾期需要重新加入

1.1 master节点创建新令牌

## 在master节点
# kubeadm token create --print-join-command

[root@master1 admin]# kubeadm token create --print-join-command
W0705 23:14:39.436166    7030 configset.go:202] WARNING: kubeadm cannot validate component configs for API groups [kubelet.config.k8s.io kubeproxy.config.k8s.io]
kubeadm join master.k8s.io:6443 --token ime4yx.8fb5jsv0smqkk0aq     --discovery-token-ca-cert-hash sha256:ffb3b09434cb153048558614e774221d0ef8107e4f824a415e2f41e84f6ac0b1 

1.2 worker节点或者master集群节点执行命令

## 集群的其他master节点， 有 --control-plane
kubeadm join master.k8s.io:6443 --token ime4yx.8fb5jsv0smqkk0aq  \
   --discovery-token-ca-cert-hash sha256:ffb3b09434cb153048558614e774221d0ef8107e4f824a415e2f41e84f6ac0b1
   --control-plane
  
## 集群的worker节点 ， 没有 --control-plane
kubeadm join master.k8s.io:6443 --token ime4yx.8fb5jsv0smqkk0aq  \
   --discovery-token-ca-cert-hash sha256:ffb3b09434cb153048558614e774221d0ef8107e4f824a415e2f41e84f6ac0b1

2. 部署dashboard

2.1 Kubernetes 官方提供的可视化界面

URL: https://github.com/kubernetes/dashboard

2.2 下载k8s dashboard

# 命令：kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.3.1/aio/deploy/recommended.yaml

# 或者先下载：wget --no-check-certificate https://raw.githubusercontent.com/kubernetes/dashboard/v2.3.1/aio/deploy/recommended.yaml
# 再应用 kubectl apply -f recommended.yaml


[root@master1 admin]# kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.3.1/aio/deploy/recommended.yaml
namespace/kubernetes-dashboard created
serviceaccount/kubernetes-dashboard created
service/kubernetes-dashboard created
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-csrf created
secret/kubernetes-dashboard-key-holder created
configmap/kubernetes-dashboard-settings created
role.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
service/dashboard-metrics-scraper created
deployment.apps/dashboard-metrics-scraper created

检查：

[root@master1 admin]# kubectl get pods -A
NAMESPACE              NAME                                         READY   STATUS    RESTARTS   AGE
kubernetes-dashboard   dashboard-metrics-scraper-78f5d9f487-s854v   1/1     Running   0          4m8s
kubernetes-dashboard   kubernetes-dashboard-6bc5cb8879-8zjj2        1/1     Running   0          4m8s

2.3 设置访问端口

[root@master1 admin]# kubectl get svc -o wide -A
NAMESPACE              NAME                        TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)                  AGE     SELECTOR
default                javademo1                   NodePort    10.1.230.223           8111:31880/TCP           2d23h   app=javademo1
default                kubernetes                  ClusterIP   10.1.0.1               443/TCP                  3d      
kube-system            kube-dns                    ClusterIP   10.1.0.10              53/UDP,53/TCP,9153/TCP   3d      k8s-app=kube-dns
kubernetes-dashboard   dashboard-metrics-scraper   ClusterIP   10.1.110.33            8000/TCP                 8m24s   k8s-app=dashboard-metrics-scraper
kubernetes-dashboard   kubernetes-dashboard        ClusterIP   10.1.179.158           443/TCP                  8m24s   k8s-app=kubernetes-dashboard
[root@master1 admin]# kubectl edit svc kubernetes-dashboard -n kubernetes-dashboard
service/kubernetes-dashboard edited

其中的 type: ClusterIP 改为 type: NodePort

可以看到，dashboard的端口变成了30798

# 命令： kubectl get svc -A | grep kubernetes-dashboard
# 或者： kubectl get svc -o wide -A
[root@master1 admin]# kubectl get svc -o wide -A
NAMESPACE              NAME                        TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)                  AGE     SELECTOR
default                javademo1                   NodePort    10.1.230.223           8111:31880/TCP           2d23h   app=javademo1
default                kubernetes                  ClusterIP   10.1.0.1               443/TCP                  3d      
kube-system            kube-dns                    ClusterIP   10.1.0.10              53/UDP,53/TCP,9153/TCP   3d      k8s-app=kube-dns
kubernetes-dashboard   dashboard-metrics-scraper   ClusterIP   10.1.110.33            8000/TCP                 12m     k8s-app=dashboard-metrics-scraper
kubernetes-dashboard   kubernetes-dashboard        NodePort    10.1.179.158           443:30798/TCP            12m     k8s-app=kubernetes-dashboard

2.4 登录

2.4.1 创建登录用户(masternode)

URL: https://192.168.226.155:30798/
创建一个登录账号的文件：dash-user.yaml
内容： 把一个集群账号admin-user创建出来

# dash-user.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kubernetes-dashboard

## 应用
[root@master1 ~]# kubectl apply -f dash-user.yaml 
serviceaccount/admin-user created
clusterrolebinding.rbac.authorization.k8s.io/admin-user created

2.4.2 获取新建用户的访问令牌

命令：

kubectl -n kubernetes-dashboard \
get secret $(kubectl -n kubernetes-dashboard get sa/admin-user \
-o jsonpath="{.secrets[0].name}") \
-o go-template="{{.data.token | base64decode}}"

执行后会出现一串令牌，复制后粘贴在dashboard的token输入框中即可

3. 工作负载deployment

控制Pod，使Pod拥有多副本，自愈，扩缩容等能力

# 清除所有Pod，比较下面两个命令有何不同效果？
kubectl run mynginx --image=nginx

kubectl create deployment mytomcat --image=tomcat:8.5.68
# 自愈能力
# 删除之后，k8s会重新启动一个tomcat。除非删除deployment

3.1 多副本

3.1.1 命令行方式：

kubectl create deployment my-dep --image=nginx --replicas=3

3.1.2

yaml文件方式

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: my-dep
  name: my-dep
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-dep
  template:
    metadata:
      labels:
        app: my-dep
    spec:
      containers:
      - image: nginx
        name: nginx

3.2 扩缩容

3.2.1 使用scale方式

kubectl scale --replicas=5 deployment/my-dep

3.2.2 修改deployment方式

kubectl edit deployment my-dep

#修改 replicas 的值

3.3 自愈&故障转移

● 停机
● 删除Pod
● 容器崩溃
● ....

3.4 滚动更新

3.4.1 直接使用命令

在以deployment创建一个nginx的情况下

## 设置新版本， 该命令会是k8s去下载版本为1.16.1的nginx镜像。
## 同理，也可以使k8s去指定仓库拉取指定版本的某镜像（比如某服务的新版本）
kubectl set image deployment/my-dep nginx=nginx:1.16.1 --record
kubectl rollout status deployment/my-dep

3.4.2 修改deployment的内容

## 修改image的版本
kubectl edit deployment/my-dep

3.5 版本回退

#历史记录
kubectl rollout history deployment/my-dep

#查看某个历史详情
kubectl rollout history deployment/my-dep --revision=2

#回滚(回到上次)
kubectl rollout undo deployment/my-dep

#回滚(回到指定版本)
kubectl rollout undo deployment/my-dep --to-revision=2

更多：

除了Deployment，k8s还有 StatefulSet 、DaemonSet 、Job  等 类型资源。
我们都称为 工作负载。
有状态应用使用  StatefulSet  部署，无状态应用使用 Deployment 部署
url: https://kubernetes.io/zh/docs/concepts/workloads/controllers/

3.6 工作负载小总结

dashboard中的工作负载