一、k8s的五种控制器

1.1 k8s的控制器类型

Kubernetes中内建了很多controller（控制器），这些相当于一个状态机，用来控制Pod的具体状态和行为：

• deployment：适合无状态的服务部署
• StatefullSet：适合有状态的服务部署
• DaemonSet：一次部署，所有的node节点都会部署，例如一些典型的应用场景：
  • 运行集群存储 daemon，例如在每个Node上运行 glusterd、ceph
  • 在每个Node上运行日志收集 daemon，例如 fluentd、 logstash
  • 在每个Node上运行监控 daemon，例如 Prometheus Node Exporter
• Job：一次性的执行任务
• Cronjob：周期性的执行任务

控制器又被称为工作负载，pod通过控制器实现应用的运维，比如伸缩、升级等

1.2 Deployment控制器

适合部署无状态的应用服务，用来管理pod和replicaset，具有上线部署、副本设定、滚动更新、回滚等功能，还可提供声明式更新，例如只更新一个新的Image

编写yaml文件，并创建nginx服务pod资源

[root@master test]# vim nginx-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 3   
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx1
        image: nginx:1.15.4
        ports:
        - containerPort: 80

[root@master test]# kubectl create -f nginx-deployment.yaml 
deployment.apps/nginx-deployment created
[root@master test]# kubectl get pod
NAME                                READY   STATUS    RESTARTS   AGE
nginx-deployment-78cdb5b557-86fm9   1/1     Running   0          44s
nginx-deployment-78cdb5b557-jqvng   1/1     Running   0          44s
nginx-deployment-78cdb5b557-rkxtk   1/1     Running   0          44s

查看控制器参数：可以使用describe或者edit两种方式

[root@master test]# kubectl describe deploy nginx-deployment
'或者使用edit'
[root@master test]# kubectl edit deploy nginx-deployment
  strategy:
    rollingUpdate:        '此段解释的是滚动更新机制'
      maxSurge: 25%       '25%指的是pod数量的百分比，最多可以扩容125%'
      maxUnavailable: 25%  '25%指的是pod数量的百分比，最多可以缩容75%'
    type: RollingUpdate

查看控制器的历史版本，滚动更新以此为基础

[root@master test]# kubectl rollout history deploy/nginx-deployment
deployment.extensions/nginx-deployment 
REVISION  CHANGE-CAUSE
1         <none>    '发现只有一个，说明没有开始滚动更新，否则会保持2个'

1.3 SatefulSet控制器

• 适合部署有状态应用
• 解决Pod的独立生命周期，保持Pod启动顺序和唯一性
• 稳定，唯一的网络标识符，持久存储（例如：etcd配置文件，节点地址发生变化，将无法使用）
• 有序，优雅的部署和扩展、删除和终止（例如：mysql主从关系，先启动主，再启动从）
• 有序，滚动更新
• 应用场景：例如数据库

无状态服务的特点：

• deployment 认为所有的pod都是一样的
• 不用考虑顺序的要求
• 不用考虑在哪个node节点上运行
• 可以随意扩容和缩容

有状态服务的特点：

• 实例之间有差别，每个实例都有自己的独特性，元数据不同，例如etcd，zookeeper
• 实例之间不对等的关系，以及依靠外部存储的应用

常规的service服务和无头服务的区别

• service：一组Pod访问策略，提供cluster-IP群集之间通讯，还提供负载均衡和服务发现
• Headless service 无头服务，不需要cluster-IP，直接绑定具体的Pod的IP，无头服务经常用于statefulset的有状态部署

创建无头服务的service资源和dns资源
由于有状态服务的IP地址是动态的，所以使用无头服务的时候要绑定dns服务

1、编写yaml文件并创建service资源

[root@master test]# vim nginx-headless.yaml

apiVersion: v1
kind: Service    '创建一个service类型的资源'
metadata: 
  name: nginx-headless
  labels: 
    app: nginx
spec: 
  ports: 
  - port: 80
    name: web
  clusterIP: None     '不使用clusterIP'   
  selector: 
    app: nginx

[root@master test]# kubectl create -f nginx-headless.yaml 
service/nginx-headless created
[root@master test]# kubectl get svc
NAME             TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
kubernetes       ClusterIP   10.0.0.1     <none>        443/TCP   15d
nginx-headless   ClusterIP   None         <none>        80/TCP    16s

2、配置dns服务，使用yaml文件创建

[root@master test]# vim coredns.yaml
# Warning: This is a file generated from the base underscore template file: coredns.yaml.base

apiVersion: v1
kind: ServiceAccount	'系统账户，为pod中的进程和外部用户提供身份信息'
metadata:
  name: coredns
  namespace: kube-system	'指定名称空间'
  labels:
      kubernetes.io/cluster-service: "true"
      addonmanager.kubernetes.io/mode: Reconcile
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole	'创建访问权限的角色'
metadata:
  labels:
    kubernetes.io/bootstrapping: rbac-defaults
    addonmanager.kubernetes.io/mode: Reconcile
  name: system:coredns
rules:
- apiGroups:
  - ""
  resources:
  - endpoints
  - services
  - pods
  - namespaces
  verbs:
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding	'创建集群角色绑定的用户'
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  labels:
    kubernetes.io/bootstrapping: rbac-defaults
    addonmanager.kubernetes.io/mode: EnsureExists
  name: system:coredns
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:coredns
subjects:
- kind: ServiceAccount
  name: coredns
  namespace: kube-system
---
apiVersion: v1
kind: ConfigMap  	'通过此服务来更改服务发现的工作方式'
metadata:
  name: coredns
  namespace: kube-system
  labels:
      addonmanager.kubernetes.io/mode: EnsureExists
data:
  Corefile: |	'是coreDNS的配置文件'
    .:53 {
        errors
        health
        kubernetes cluster.local in-addr.arpa ip6.arpa {
            pods insecure	
            upstream
            fallthrough in-addr.arpa ip6.arpa
        }
        prometheus :9153
        proxy . /etc/resolv.conf
        cache 30
        loop
        reload
        loadbalance
    }
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: coredns
  namespace: kube-system
  labels:
    k8s-app: kube-dns
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile
    kubernetes.io/name: "CoreDNS"
spec:
  # replicas: not specified here:
  # 1. In order to make Addon Manager do not reconcile this replicas parameter.
  # 2. Default is 1.
  # 3. Will be tuned in real time if DNS horizontal auto-scaling is turned on.
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
  selector:
    matchLabels:
      k8s-app: kube-dns
  template:
    metadata:
      labels:
        k8s-app: kube-dns
      annotations:
        seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
    spec:
      serviceAccountName: coredns
      tolerations:
        - key: node-role.kubernetes.io/master
          effect: NoSchedule
        - key: "CriticalAddonsOnly"
          operator: "Exists"
      containers:
      - name: coredns
        image: coredns/coredns:1.2.2
        imagePullPolicy: IfNotPresent
        resources:
          limits:
            memory: 170Mi
          requests:
            cpu: 100m
            memory: 70Mi
        args: [ "-conf", "/etc/coredns/Corefile" ]
        volumeMounts:
        - name: config-volume
          mountPath: /etc/coredns
          readOnly: true
        ports:
        - containerPort: 53
          name: dns
          protocol: UDP
        - containerPort: 53
          name: dns-tcp
          protocol: TCP
        - containerPort: 9153
          name: metrics
          protocol: TCP
        livenessProbe:
          httpGet:
            path: /health
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 60
          timeoutSeconds: 5
          successThreshold: 1
          failureThreshold: 5
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            add:
            - NET_BIND_SERVICE
            drop:
            - all
          readOnlyRootFilesystem: true
      dnsPolicy: Default
      volumes:
        - name: config-volume
          configMap:
            name: coredns
            items:
            - key: Corefile
              path: Corefile
---
apiVersion: v1
kind: Service
metadata:
  name: kube-dns
  namespace: kube-system
  annotations:
    prometheus.io/port: "9153"
    prometheus.io/scrape: "true"
  labels:
    k8s-app: kube-dns
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile
    kubernetes.io/name: "CoreDNS"
spec:
  selector:
    k8s-app: kube-dns
  clusterIP: 10.0.0.2 
  ports:
  - name: dns
    port: 53
    protocol: UDP
  - name: dns-tcp
    port: 53
    protocol: TCP

[root@master test]# kubectl create -f coredns.yaml 
serviceaccount/coredns created
clusterrole.rbac.authorization.k8s.io/system:coredns created
clusterrolebinding.rbac.authorization.k8s.io/system:coredns created
configmap/coredns created
deployment.extensions/coredns created
service/kube-dns created
[root@master test]# kubectl get pod,svc -n kube-system   '查看kube-system名称空间的pod和svc资源'
NAME                                        READY   STATUS    RESTARTS   AGE
pod/coredns-56684f94d6-cc9jk                1/1     Running   0          58s
pod/kubernetes-dashboard-7dffbccd68-v6q55   1/1     Running   1          6d2h
pod/kuboard-78bcb484bc-s7svz                1/1     Running   0          2d2h

NAME                           TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)         AGE
service/kube-dns               ClusterIP   10.0.0.2     <none>        53/UDP,53/TCP   58s
service/kubernetes-dashboard   NodePort    10.0.0.220   <none>        443:30001/TCP   6d2h
service/kuboard                NodePort    10.0.0.184   <none>        80:32567/TCP    6d2h

3、创建一个测试的pod资源并验证DNS解析

[root@master test]# vim demo08.yaml
apiVersion: v1
kind: Pod
metadata:
  name: dns-test
spec:
  containers:
  - name: busybox
    image: busybox:1.28.4
    args:
    - /bin/sh
    - -c
    - sleep 36000
  restartPolicy: Never
[root@master test]# kubectl create -f demo08.yaml 
pod/dns-test created
[root@master test]# kubectl exec -it dns-test sh  '进入容器进行解析'
/ # nslookup kubernetes
Server:    10.0.0.2
Address 1: 10.0.0.2 kube-dns.kube-system.svc.cluster.local

Name:      kubernetes
Address 1: 10.0.0.1 kubernetes.default.svc.cluster.local

创建statefulset资源
1、编写yaml文件并创建资源

[root@master test]# vim statefulset-test.yaml
apiVersion: v1
kind: Service
metadata:
  name: nginx
  labels:
    app: nginx
spec:
  ports:
  - port: 80
    name: web
  clusterIP: None	'指定为无头服务'
  selector:
    app: nginx
---
apiVersion: apps/v1beta1  
kind: StatefulSet  
metadata:
  name: nginx-statefulset  
  namespace: default
spec:
  serviceName: nginx  
  replicas: 3     '指定副本数量'
  selector:
    matchLabels:  
       app: nginx
  template:  
    metadata:
      labels:
        app: nginx  
    spec:
      containers:
      - name: nginx
        image: nginx:latest  
        ports:
        - containerPort: 80
[root@master test]# vim pod-dns-test.yaml 	'创建用来测试dns的pod资源'
apiVersion: v1
kind: Pod
metadata:
  name: dns-test
spec:
  containers:
  - name: busybox
    image: busybox:1.28.4
    args:
    - /bin/sh
    - -c
    - sleep 36000
  restartPolicy: Never

[root@master test]# kubectl delete -f .	'先删除之前所有的资源' 

2、创建资源并测试

[root@master test]# kubectl create -f sfs.yaml 
service/nginx created
statefulset.apps/nginx-statefulset created
[root@master test]# kubectl get pod,svc
NAME                      READY   STATUS    RESTARTS   AGE
pod/dns-test              1/1     Running   0          5m1s
pod/nginx-statefulset-0   1/1     Running   0          92s
pod/nginx-statefulset-1   1/1     Running   0          83s
pod/nginx-statefulset-2   1/1     Running   0          44s

NAME                 TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
service/kubernetes   ClusterIP   10.0.0.1     <none>        443/TCP   15d
service/nginx        ClusterIP   None         <none>        80/TCP    92s

[root@master test]# kubectl exec -it dns-test sh   '登陆pod资源进行测试'
/ # nslookup pod/nginx-statefulset-0
Server:    10.0.0.2
Address 1: 10.0.0.2 kube-dns.kube-system.svc.cluster.local

nslookup: can't resolve 'pod/nginx-statefulset-0'
/ # nslookup nginx-statefulset-0.nginx
Server:    10.0.0.2
Address 1: 10.0.0.2 kube-dns.kube-system.svc.cluster.local

Name:      nginx-statefulset-0.nginx
Address 1: 172.17.29.3 nginx-statefulset-0.nginx.default.svc.cluster.local
/ # nslookup nginx-statefulset-1.nginx
Server:    10.0.0.2
Address 1: 10.0.0.2 kube-dns.kube-system.svc.cluster.local

Name:      nginx-statefulset-1.nginx
Address 1: 172.17.76.3 nginx-statefulset-1.nginx.default.svc.cluster.local
/ # nslookup nginx-statefulset-2.nginx
Server:    10.0.0.2
Address 1: 10.0.0.2 kube-dns.kube-system.svc.cluster.local

Name:      nginx-statefulset-2.nginx
Address 1: 172.17.29.2 nginx-statefulset-2.nginx.default.svc.cluster.local

相比于Deployment而言，StatefulSet是有身份的！（序列编号区分唯一身份）
身份三要素：

1、域名 nginx-statefulset-0.nginx

2、主机名 nginx-statefulset-0

3、存储(PVC)

StatefulSet的有序部署和有序伸缩
有序部署（即0到N-1）

有序收缩，有序删除（即从N-1到0）

无论是部署还是删除，更新下一个 Pod 前，StatefulSet 控制器终止每个 Pod 并等待它们变成 Running 和 Ready。

1.4 DaemonSet控制器

• 在每一个Node上运行一个Pod
  新加入的Node也同样会自动运行一个Pod
• 应用场景：监控，分布式存储，日志收集等

编写yaml文件并创建资源进行测试

[root@master test]# vim ds.yaml
apiVersion: apps/v1
kind: DaemonSet 
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.15.4
        ports:
        - containerPort: 80

查看资源的部署情况，发现daemonset的资源已经分配到两个node节点上了

[root@master test]# kubectl create -f ds.yaml 
daemonset.apps/nginx-deployment created
[root@master test]# kubectl get pods
NAME                     READY   STATUS    RESTARTS   AGE
nginx-deployment-gdsnd   1/1     Running   0          6s
nginx-deployment-z2dbl   1/1     Running   0          6s

1.5 Job控制器

• 一次性执行任务，类似Linux中的job
• 应用场景：如离线数据处理，视频解码等业务

编写yaml文件并创建资源测试

[root@master test]# vim job.yaml

apiVersion: batch/v1
kind: Job
metadata:
  name: pi
spec:
  template:
    spec:
      containers:
      - name: pi
        image: perl
        command: ["perl",  "-Mbignum=bpi", "-wle", "print bpi(2000)"]    '计算圆周率'
      restartPolicy: Never
  backoffLimit: 4     '重试次数默认是6次，修改为4次，当遇到异常时Never状态会重启，所以要设定次数'

查看job资源

[root@master test]# kubectl create -f job.yaml 
job.batch/pi created
[root@master test]# kubectl get pods
NAME       READY   STATUS      RESTARTS   AGE
pi-dscgp   0/1     Completed   0          76s    '执行成功后就结束了'
[root@master test]# kubectl logs pi-dscgp   '查看日志可以查看结果'
3.141592653589793238462643.....

1.6 cronjob控制器

• 周期性任务，像Linux的Crontab一样
• 应用场景：如通知，备份等

编写yaml文件

[root@master test]# vim cronjob.yaml
apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: hello
spec:
  schedule: "*/1 * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: hello
            image: busybox
            args:
            - /bin/sh
            - -c
            - date; echo Hello from the Kubernetes cluster
          restartPolicy: OnFailure

创建资源

[root@master test]# kubectl create -f cronjob.yaml 
cronjob.batch/hello created
[root@master test]# kubectl get cronjob
NAME    SCHEDULE      SUSPEND   ACTIVE   LAST SCHEDULE   AGE
hello   */1 * * * *   False     0        <none>          38s
[root@master test]# kubectl get pods
NAME                     READY   STATUS      RESTARTS   AGE
hello-1602677340-dt9hq   0/1     Completed   0          39s

可以查看日志信息

[root@master test]# kubectl logs hello-1602677340-dt9hq
Wed Oct 14 12:09:21 UTC 2020
Hello from the Kubernetes cluster
[root@master test]# kubectl get pods
NAME                     READY   STATUS      RESTARTS   AGE
hello-1602677340-dt9hq   0/1     Completed   0          2m21s
hello-1602677400-2nd48   0/1     Completed   0          81s
hello-1602677460-qp2xt   0/1     Completed   0          20s

使用cronjob要慎重，用完之后要删掉，不然会占用很多资源