模拟 K8S 项目的生命周期

项目生命周期:

创建 —》发布 —》更新 —》回滚 —》删除

Pod 类型：

• port：port 是 k8s 集群内部访问 service 的端口，即通过 clusterIP:port 可以访问到某个service。
• nodePort：nodePort 是外部访问 k8s 集群中 service 的端口，通过 nodeIP:nodePort可以从外部访问到某个 service。
• targetPort：targetPort 是 pod 的端口，从 port 和 nodePort 来的流量经过 kube-proxy流入到后端 pod 的 targetPort 上，最后进入容器。
• containerPort：containerPort 是 pod 内部容器的端口，targetPort 映射到 containerPort。

K8S 集群提供外部服务图：

1. 创建启动 nginx 实例（kubectl run）

[root@master ~]#kubectl run nginx --image=nginx:1.14 --port=80 --replicas=3
kubectl run --generator=deployment/apps.v1 is DEPRECATED and will be removed in a future version. Use kubectl run --generator=run-pod/v1 or kubectl create instead.
deployment.apps/nginx created
[root@master ~]#kubectl get pods
NAME                     READY   STATUS    RESTARTS   AGE
nginx-59d795d786-5ln28   1/1     Running   0          34s
nginx-59d795d786-xnfjq   1/1     Running   0          34s
nginx-59d795d786-z86nn   1/1     Running   0          34s
[root@master ~]#kubectl get all
NAME                         READY   STATUS    RESTARTS   AGE
pod/nginx-59d795d786-5ln28   1/1     Running   0          59s
pod/nginx-59d795d786-xnfjq   1/1     Running   0          59s
pod/nginx-59d795d786-z86nn   1/1     Running   0          59s

NAME                 TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
service/kubernetes   ClusterIP   10.96.0.1    <none>        443/TCP   3d9h

NAME                    READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/nginx   3/3     3            3           59s

NAME                               DESIRED   CURRENT   READY   AGE
replicaset.apps/nginx-59d795d786   3         3         3       59s

2. 发布容器（kubectl expose）

将资源暴露为新的 service

为 Deployment 的 nginx 创建 Service，并通过 Service 的 80 端口转发至容器的 80端口上，Service 的名称为 nginx-service，类型为NodePort。

[root@master ~]#kubectl expose deployment nginx --port=80 --target-port=80 --name=nginx-service --type=NodePort
service/nginx-service exposed

# 查看 Pod 网络状态详细信息和 Service 暴露的端口
[root@master ~]#kubectl get svc,pod -o wide
NAME                    TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)        AGE     SELECTOR
service/kubernetes      ClusterIP   10.96.0.1      <none>        443/TCP        3d9h    <none>
service/nginx-service   NodePort    10.96.158.55   <none>        80:31083/TCP   3m37s   run=nginx

NAME                         READY   STATUS    RESTARTS   AGE     IP           NODE     NOMINATED NODE   READINESS GATES
pod/nginx-59d795d786-5ln28   1/1     Running   0          7m48s   10.244.1.3   node01   <none>           <none>
pod/nginx-59d795d786-xnfjq   1/1     Running   0          7m48s   10.244.2.3   node02   <none>           <none>
pod/nginx-59d795d786-z86nn   1/1     Running   0          7m48s   10.244.2.4   node02   <none>           <none>

Kubernetes 之所以需要 Service，一方面是因为 Pod 的 IP 不是固定的（Pod可能会重建），另一方面是因为一组 Pod 实例之间总会有负载均衡的需求。
Service 通过 Label Selector实现的对一组 Pod 的访问。
对于容器应用而言，Kubernetes 提供了基于 VIP（虚拟 IP）的网桥的方式访问Service，再由 Service 重定向到相应的 Pod。

service 类型

• ClusterIP：提供一个集群内部的虚拟 IP 以供 Pod 访问（Service 默认类型）。
• NodePort：在每个 Node上打开一个端口以供外部访问，Kubernetes 将会在每个 Node上打开一个端口并且每个 Node 的端口都是一样的，通过NodeIP:NodePort 的方式。
• LoadBalancer：通过外部的负载均衡器来访问，通常在云平台部署 LoadBalancer还需要额外的费用。

查看关联的后端节点

[root@master ~]#kubectl get endpoints
NAME            ENDPOINTS                                   AGE
kubernetes      192.168.10.20:6443                          3d10h
nginx-service   10.244.1.3:80,10.244.2.3:80,10.244.2.4:80   6m7s

查看 service 描述信息

[root@master ~]#kubectl describe svc nginx
Name:                     nginx-service
Namespace:                default
Labels:                   run=nginx
Annotations:              <none>
Selector:                 run=nginx
Type:                     NodePort
IP:                       10.96.158.55
Port:                     <unset>  80/TCP
TargetPort:               80/TCP
NodePort:                 <unset>  31083/TCP
Endpoints:                10.244.1.3:80,10.244.2.3:80,10.244.2.4:80
Session Affinity:         None
External Traffic Policy:  Cluster
Events:                   <none>

查看负载均衡端口：1.18 版本之后，之前我们使用的是 userspace 和 iptables。
node01

[root@node01 ~]#yum -y install ipvsadm
......
[root@node01 ~]#ipvsadm -Ln
......

node02

[root@node02 ~]#yum -y install ipvsadm
......
[root@node02 ~]#ipvsadm -Ln
......

网页访问

查看访问日志

[root@master ~]#kubectl logs nginx-59d795d786-5ln28
10.244.1.1 - - [20/Jun/2022:05:05:59 +0000] "GET / HTTP/1.1" 200 612 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.124 Safari/537.36 Edg/102.0.1245.44" "-"
2022/06/20 05:05:59 [error] 7#7: *1 open() "/usr/share/nginx/html/favicon.ico" failed (2: No such file or directory), client: 10.244.1.1, server: localhost, request: "GET /favicon.ico HTTP/1.1", host: "192.168.10.30:31083", referrer: "http://192.168.10.30:31083/"
10.244.1.1 - - [20/Jun/2022:05:05:59 +0000] "GET /favicon.ico HTTP/1.1" 404 571 "http://192.168.10.30:31083/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.124 Safari/537.36 Edg/102.0.1245.44" "-"
[root@master ~]#kubectl logs nginx-59d795d786-xnfjq
[root@master ~]#kubectl logs nginx-59d795d786-z86nn

3. 更新容器（kubectl set）

查看当前运行的 nginx 版本号

[root@master ~]#curl -I http://192.168.10.40:31083/
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Mon, 20 Jun 2022 05:22:03 GMT
Content-Type: text/html
Content-Length: 612
Last-Modified: Tue, 04 Dec 2018 14:44:49 GMT
Connection: keep-alive
ETag: "5c0692e1-264"
Accept-Ranges: bytes

将 nginx 版本更新为 1.15

[root@master ~]#kubectl set image deployment/nginx nginx=nginx:1.15
deployment.apps/nginx image updated

动态监听 pod 的创建过程：使用的是滚动更新方式，所以会先生成一个新的 pod，然后删除一个旧的 pod，往后以此类推。

[root@master ~]#kubectl get pods -w
NAME                    READY   STATUS    RESTARTS   AGE
nginx-dc5dc5865-kgx5l   1/1     Running   0          57s
nginx-dc5dc5865-l245m   1/1     Running   0          79s
nginx-dc5dc5865-zpj48   1/1     Running   0          35s
......

更新规则可通过 kubetl describe deployment nginx 的 RollingUpdateStrategy 查看，默认配置为 25% max unavailable, 25% max surge，即按照 25% 的比例进行滚动更新。

查看 pod 的 ip 变化

[root@master ~]#kubectl get pods -o wide
NAME                    READY   STATUS    RESTARTS   AGE     IP           NODE     NOMINATED NODE   READINESS GATES
nginx-dc5dc5865-kgx5l   1/1     Running   0          2m28s   10.244.2.5   node02   <none>           <none>
nginx-dc5dc5865-l245m   1/1     Running   0          2m50s   10.244.1.4   node01   <none>           <none>
nginx-dc5dc5865-zpj48   1/1     Running   0          2m6s    10.244.2.6   node02   <none>           <none>

重新查看 nginx 版本号

[root@master ~]#curl -I 192.168.10.30:31083
HTTP/1.1 200 OK
Server: nginx/1.15.12
Date: Mon, 20 Jun 2022 05:27:26 GMT
Content-Type: text/html
Content-Length: 612
Last-Modified: Tue, 16 Apr 2019 13:08:19 GMT
Connection: keep-alive
ETag: "5cb5d3c3-264"
Accept-Ranges: bytes

4. 回滚容器（kubectl rollout）

查看历史版本

[root@master ~]#kubectl rollout history deployment/nginx
deployment.apps/nginx 
REVISION  CHANGE-CAUSE
1         <none>
2         <none>

执行回滚到上一个版本

[root@master ~]#kubectl rollout undo deployment/nginx
deployment.apps/nginx rolled back
[root@master ~]#curl -I 192.168.10.30:31083
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Mon, 20 Jun 2022 05:30:36 GMT
Content-Type: text/html
Content-Length: 612
Last-Modified: Tue, 04 Dec 2018 14:44:49 GMT
Connection: keep-alive
ETag: "5c0692e1-264"
Accept-Ranges: bytes

回滚到指定版本

[root@master ~]#kubectl rollout history deployment/nginx
deployment.apps/nginx 
REVISION  CHANGE-CAUSE
2         <none>
3         <none>

[root@master ~]#kubectl rollout undo deployment/nginx --to-revision=2
deployment.apps/nginx rolled back

[root@master ~]#curl -I 192.168.10.30:31083
HTTP/1.1 200 OK
Server: nginx/1.15.12
Date: Mon, 20 Jun 2022 05:32:21 GMT
Content-Type: text/html
Content-Length: 612
Last-Modified: Tue, 16 Apr 2019 13:08:19 GMT
Connection: keep-alive
ETag: "5cb5d3c3-264"
Accept-Ranges: bytes

检查回滚状态

[root@master ~]#kubectl rollout status deployment/nginx
deployment "nginx" successfully rolled out

5. 删除容器（kubectl delete）

删除副本控制器

[root@master ~]#kubectl get deploy
NAME    READY   UP-TO-DATE   AVAILABLE   AGE
nginx   3/3     3            3           122m
[root@master ~]#kubectl delete deployment/nginx
deployment.apps "nginx" deleted
[root@master ~]#kubectl get deploy
No resources found in default namespace.

删除 service

[root@master ~]#kubectl get svc
NAME            TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)        AGE
kubernetes      ClusterIP   10.96.0.1      <none>        443/TCP        3d13h
nginx-service   NodePort    10.96.158.55   <none>        80:31083/TCP   122m
[root@master ~]#kubectl delete svc/nginx-service
service "nginx-service" deleted
[root@master ~]#kubectl get svc
NAME         TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
kubernetes   ClusterIP   10.96.0.1    <none>        443/TCP   3d13h
[root@master ~]#kubectl get all
NAME                 TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
service/kubernetes   ClusterIP   10.96.0.1    <none>        443/TCP   3d13h

6. 定义版本（CHANGE-CAUSE）

在不定义 CHANGE-CAUSE 的情况下，缺省值为 none，当历史版本较多时，不便于咱们回滚时辨认版本号。因此，建议定义CHANGE-CAUSE为服务版本以帮助咱们辨认当前服务。

[root@master ~]# kubectl rollout history deploy/nginx-test
deployment.extensions/nginx-test 
REVISION  CHANGE-CAUSE
1         <none>

一般通过修改配置的方式定义 change-cause

[root@master ~]# kubectl edit deploy/nginx-test
......
kind: Deployment
metadata:
  annotations:
#下行可定义历史版本revision
    deployment.kubernetes.io/revision: "1"
#在Deployment的matadata项下的annotations中如下行定义change-cause
    kubernetes.io/change-cause: "nginx1.14"
......

再次查看历史版本

[root@master ~]# kubectl rollout history deploy/nginx-test
deployment.extensions/nginx-test 
REVISION  CHANGE-CAUSE
1         nginx1.14