CKA 不假题 练习笔记 （二）

Q4: etcd snapshot

Task -
First, create a snapshot of the existing etcd instance running at https://127.0.0.1:2379, saving the snapshot to /var/lib/backup/etcd-snapshot.db.
Next, restore an existing, previous snapshot located at /var/lib/backup/etcd-snapshot-previous.db.

Q4 解答 Save and Restore

bill@master-1:~$ sudo ETCDCTL_API=3 etcdctl \
--endpoints=https://192.168.4.36:2379 \
--cacert=/etc/ssl/etcd/ssl/ca.pem \
--cert=/etc/ssl/etcd/ssl/node-master-1.pem \
--key=/etc/ssl/etcd/ssl/node-master-1-key.pem \
snapshot save /var/lib/backup/etcd-snapshot.db

#伪code
ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 \
  --cert=/path/to/client.crt \
  --key=/path/to/client.key \
  --cacert=/path/to/ca.crt \
  snapshot restore /var/lib/backup/etcd-snapshot-previous.db

etcdctl 是全面的命令， 新的命令etcdutl 是聚焦在快照 备份有关的专属命令。

Q5 NetworkPolicy

Task -
Create a new NetworkPolicy named allow-port-from-namespace in the existing namespace fubar.
Ensure that the new NetworkPolicy allows Pods in namespace internal to connect to port 9000 of Pods in namespace fubar.
Further ensure that the new NetworkPolicy:
✑ does not allow access to Pods, which don’t listen on port 9000
✑ does not allow access from Pods, which are not in namespace internal

Q5 解答 YAML

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-port-from-namespace
  namespace: fubar
spec:
  podSelector: {}  # Apply to all Pods in the 'fubar' namespace
  policyTypes:
  - Ingress # 不定义Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: internal  # Allow connections only from the 'internal' namespace
    ports:
    - protocol: TCP
      port: 9000  # Only allow access on port 9000
  

传送门： https://kubernetes.io/docs/concepts/services-networking/network-policies/

Q5 - 1： PV

Task -
Create a persistent volume with name app-data, of capacity 2Gi and access mode ReadOnlyMany. The type of volume is hostPath and its location is /srv/app- data.

Q5 - 1： 解法

apiVersion: v1
kind: PersistentVolume
metadata:
  name: app-data
spec:
  capacity:
    storage: 2Gi
  accessModes:
    - ReadOnlyMany
  hostPath:
    path: /srv/app-data

Q5 - 2：Kubectl logs

Task -
Monitor the logs of pod foo and:
✑ Extract log lines corresponding to error file-not-found
✑ Write them to /opt/KUTR00101/foo

Q5 - 2：解法

只用command line:
kubectl logs foo |grep “file-not-found” > /opt/KUTR00101/foo