CKA考试练习题

一:为部署管道创建一个新的 ClusterRole 并将其绑定到范围为特定 namespace 的特定 ServiceAccount
要求:创建一个名字为 deployment-clusterrole 且仅允许创建以下(Deployment,StatefulSet
,DaemonSet)资源类型的新 ClusterRole;在现有的 namespace app-team1 中创建一个名为 cicd-token 的新 ServiceAccount;限于 namespace app-team1 ,将新的 ClusterRole deployment-clusterrole 绑定到新的 ServiceAccount cicd-token

1.创建app-team1的namespace

[root@k8s-master1 ~]# kubectl create namespace app-team1
namespace/app-team1 created

2.创建一个名字为 deployment-clusterrole 且仅允许创建以下(Deployment,StatefulSet
,DaemonSet)资源类型的新 ClusterRole

[root@k8s-master1 CKA]# kubectl create clusterrole deployment-clusterrole --verb=create --resource=Deployments,StatefulSets,DaemonSets
clusterrole.rbac.authorization.k8s.io/deployment-clusterrole created

3.在现有的 namespace app-team1 中创建一个名为 cicd-token 的新 ServiceAccount;限于 namespace app-team1 ,将新的 ClusterRole deployment-clusterrole 绑定到新的 ServiceAccount cicd-token

创建 serviceaccount
[root@k8s-master1 CKA]# kubectl create serviceaccount cicd-token -n app-team1
serviceaccount/cicd-token created
绑定 rolebinding
[root@k8s-master1 CKA]# kubectl create rolebinding cicd-token-deployment-clusterrole --role=deployment-clusterrole --serviceaccount=app-team1:cicd-token -n app-team1
rolebinding.rbac.authorization.k8s.io/cicd-token-deployment-clusterrole created

二:将名为 k8s-master3 的 node 设置为不可用, 并重新调度该 node 上所有运行的 pods

查看节点
[root@k8s-master1 CKA]# kubectl get nodes
NAME          STATUS   ROLES    AGE   VERSION
k8s-master3   Ready    <none>   76d   v1.22.1
k8s-node1     Ready    <none>   94d   v1.22.1
驱逐应用,并设置节点不可调度
[root@k8s-master1 CKA]# kubectl drain k8s-master3
node/k8s-master3 cordoned
[root@k8s-master1 CKA]# kubectl drain k8s-master3 --ignore-daemonsets --delete-emptydir-data
node/k8s-master3 already cordoned
WARNING: ignoring DaemonSet-managed Pods: kube-system/calico-node-28x78, prometheus/node-exporter-l9fq9
evicting pod app/ingress-nginx-controller-74974c55bd-6ljtj
pod/ingress-nginx-controller-74974c55bd-6ljtj evicted
检查验证
[root@k8s-master1 CKA]# kubectl get pods -A -o wide |grep k8s-master3
kube-system            calico-node-28x78                                  1/1     Running            11 (23m ago)     8d      192.168.21.122   k8s-master3   <none>           <none>
prometheus             node-exporter-l9fq9                                1/1     Running            6 (23m ago)      3d22h   192.168.21.122   k8s-master3   <none>           <none>

三:备份ETCD的快照,并恢复

1.备份快照

2.重命名数据文件夹,模拟文件删除的操作

3.还原数据

四:按如下要求调度一个 pod

名称: nginx-kusc00401
image: nginx
Node selector: disk=spinning

设置k8s-node1的disk=spinning的标签
[root@master1 CKA]# kubectl label nodes k8s-node1 disk=spinning
node/k8s-node1 labeled
[root@master1 CKA]# kubectl get nodes --show-labels
NAME        STATUS   ROLES    AGE    VERSION   LABELS
k8s-node1   Ready    <none>   102d   v1.22.1   beta.kubernetes.io/arch=amd64,beta.kubernetes.io/os=linux,disk=spinning,kubernetes.io/arch=amd64,kubernetes.io/hostname=k8s-node1,kubernetes.io/os=linux
创建一个名称nginx-kusc00401,image=nginx ,Node selector:  disk=spinning 的POD
[root@master1 CKA]# cat nginx-kusc00401.yaml
apiVersion: v1
kind: Pod
metadata:
  name: nginx-kusc00401
  namespace: app
spec:
  containers:
  - name: nginx
    image: nginx
    imagePullPolicy: IfNotPresent
  nodeSelector:
    disk: spinning
[root@master1 CKA]# kubectl get pods -n app -o wide
NAME              READY   STATUS    RESTARTS        AGE   IP            NODE        NOMINATED NODE   READINESS GATES
nginx-kusc00401   1/1     Running   0               54s   10.10.36.96   k8s-node1   <none>           <none>

五:创建一个名字为kucc1的 pod, 在pod里面分别为以下每个images单独运行一个app container(可能会有 1-4 个 images),容器名称和镜像如下:
nginx + redis + memcached + consul

[root@master1 CKA]# cat kucc1.yaml
apiVersion: v1
kind: Pod
metadata:
  name: kucc1
  namespace: app
spec:
  containers:
  - name: nginx
    image: nginx
  - name: redis
    image: redis
  - name: memcached
    image: memcached
  - name: consul
    image: consul
[root@master1 CKA]# kubectl apply -f kucc1.yaml
pod/kucc1 created
[root@master1 CKA]# kubectl get pods -n app
NAME              READY   STATUS    RESTARTS        AGE
kucc1             4/4     Running   0               87s

六:创建名为 app-data 的 persistent volume, 容量为 1Gi, 访问模式为 ReadWriteMany。 volume类型为 hostPath, 位于/srv/app-data

[root@master1 CKA]# cat app-data-PV.yaml
apiVersion: v1
kind: PersistentVolume
metadata:
  name: app-data
  namespace: app
spec:
  capacity:
    storage: 10G
  accessModes:
    - ReadWriteMany
  hostPath:
    path: "/srv/app-data"
    type: DirectoryOrCreate
[root@master1 CKA]# kubectl apply -f app-data-PV.yaml
persistentvolume/app-data created
[root@master1 CKA]# kubectl get pv -n app
NAME                                       CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS      CLAIM                  STORAGECLASS          REASON   AGE
app-data                                   10G        RWX            Retain           Available                                                         9s

七:

  • 创建一个新的 PersistentVolumeClaim

    • 名称: pv-volume
    • class: managed-nfs-storage
    • 容量: 10Mi
  • 创建一个新的 pod, 此 pod 将作为 volume 挂载到 PersistentVolumeClaim

    • 名称:web-server
    • image:nginx
    • 挂载路径:/usr/share/nginx/html
  • 配置新的 pod, 以对 volume 具有 ReadWriteOnce 权限。

  • 最后, 使用 kubectl edit 或者 kubectl patchPersistentVolumeClaim 的容量扩展为 70Mi, 并记录此次更改。

创建PV
[root@master1 CKA]# kubectl get pvc -n app
NAME               STATUS   VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS          AGE
data-zookeeper-0   Bound    pvc-e7d3d926-4fa4-4044-bf2f-30df06eef4aa   8Gi        RWO            nfs-client            60d
pv-volume          Bound    pvc-9fe1e7d3-f964-4dea-afe6-7a904fceb31d   10Mi       RWO            managed-nfs-storage   6s
创建 pvc
[root@master1 CKA]# cat pv-volume.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pv-volume
  namespace: app
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: managed-nfs-storage
  resources:
    requests:
      storage: 10Mi
创建Pod
[root@master1 CKA]# kubectl get pods -n app -o wide
NAME              READY   STATUS    RESTARTS        AGE   IP            NODE        NOMINATED NODE   READINESS GATES
kucc1             4/4     Running   0               60m   10.10.36.97   k8s-node1   <none>           <none>
nginx-kusc00401   1/1     Running   0               67m   10.10.36.96   k8s-node1   <none>           <none>
web-server        1/1     Running   0               11s   10.10.36.95   k8s-node1   <none>           <none>
zookeeper-0       1/1     Running   4 (7d23h ago)   60d   10.10.36.82   k8s-node1   <none>           <none>
[root@master1 CKA]# cat pod_pvc.yaml
apiVersion: v1
kind: Pod
metadata:
  name: web-server
  namespace: app
spec:
  volumes:
    - name: task-pv-storage
      persistentVolumeClaim:
        claimName: pv-volume
  containers:
    - name: nginx
      image: nginx
      volumeMounts:
      - mountPath: "/usr/share/nginx/html"
        name: task-pv-storage
允许扩容
[root@master1 CKA]# kubectl edit sc managed-nfs-storage
# 添加1行
allowVolumeExpansion: true

你可能感兴趣的:(kubernetes,容器,云原生)