it教程FG312-容器编排与管理

内容大纲

容器编排概述
Kubernetes基础
应用部署与管理
服务与网络
存储管理
配置与密钥管理
监控与日志
最佳实践总结

容器编排概述

容器编排是指管理容器化应用的生命周期，包括部署、扩展、更新和监控等操作。随着容器技术的广泛应用，容器编排已经成为现代应用部署的重要组成部分。本教程将详细介绍容器编排与管理的最佳实践，帮助企业构建和管理容器化应用。

Kubernetes基础

Kubernetes架构

Kubernetes是目前最流行的容器编排平台，由控制平面和数据平面组成。

安装Kubernetes

# 使用kubeadm安装Kubernetes
# 安装Docker
apt-get update
apt-get install -y docker.io

# 安装kubeadm、kubelet和kubectl
apt-get update && apt-get install -y apt-transport-https curl
curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add –
echo “deb https://apt.kubernetes.io/ kubernetes-xenial main” > /etc/apt/sources.list.d/kubernetes.list
apt-get update
apt-get install -y kubelet kubeadm kubectl

# 初始化Kubernetes集群
sudo kubeadm init –pod-network-cidr=10.244.0.0/16

# 配置kubectl
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

# 安装网络插件
kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml

W0403 10:00:00.123456 123456 kubeadm.go:280] [kubelet-start] WARNING: starting in 1.24, kubeadm will automatically drain nodes when upgrading, which might cause downtime.
[init] Using Kubernetes version: v1.24.0
[preflight] Running pre-flight checks
[preflight] Pulling images required for setting up a Kubernetes cluster
[preflight] This might take a minute or two, depending on the speed of your internet connection
[preflight] You can also perform this action in beforehand using ‘kubeadm config images pull’
[certs] Using certificateDir folder “/etc/kubernetes/pki”
[certs] Generating “ca” certificate and key
[certs] Generating “apiserver” certificate and key
[certs] apiserver serving cert is signed for DNS names [kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local fgedu] and IPs [10.96.0.1 192.168.1.100]
[certs] Generating “apiserver-kubelet-client” certificate and key
[certs] Generating “front-proxy-ca” certificate and key
[certs] Generating “front-proxy-client” certificate and key
[certs] Generating “etcd/ca” certificate and key
[certs] Generating “etcd/server” certificate and key
[certs] etcd/server serving cert is signed for DNS names [fgedudb fgedu] and IPs [127.0.0.1 ::1 192.168.1.100]
[certs] Generating “etcd/peer” certificate and key
[certs] etcd/peer serving cert is signed for DNS names [fgedudb fgedu] and IPs [127.0.0.1 ::1 192.168.1.100]
[certs] Generating “etcd/healthcheck-client” certificate and key
[certs] Generating “apiserver-etcd-client” certificate and key
[certs] Generating “sa” key and public key
[kubeconfig] Using kubeconfig folder “/etc/kubernetes”
[kubeconfig] Writing “admin.conf” kubeconfig file
[kubeconfig] Writing “kubelet.conf” kubeconfig file
[kubeconfig] Writing “controller-manager.conf” kubeconfig file
[kubeconfig] Writing “scheduler.conf” kubeconfig file
[kubelet-start] Writing kubelet environment file with flags to file “/var/lib/kubelet/kubeadm-flags.env”
[kubelet-start] Writing kubelet configuration to file “/var/lib/kubelet/config.yaml”
[kubelet-start] Starting the kubelet
[control-plane] Using manifest folder “/etc/kubernetes/manifests”
[control-plane] Creating static Pod manifest for “kube-apiserver”
[control-plane] Creating static Pod manifest for “kube-controller-manager”
[control-plane] Creating static Pod manifest for “kube-scheduler”
[etcd] Creating static Pod manifest for local etcd in “/etc/kubernetes/manifests”
[wait-control-plane] Waiting for the kubelet to boot up the control plane as static Pods from directory “/etc/kubernetes/manifests”. This can take up to 4m0s
[apiclient] All control plane components are healthy after 30.501123 seconds
[upload-config] Storing the configuration used in ConfigMap “kubeadm-config” in the “kube-system” Namespace
[kubelet] Creating a ConfigMap “kubelet-config-1.24” in namespace kube-system with the configuration for the kubelets in the cluster
[upload-certs] Skipping phase. Please see –upload-certs
[mark-control-plane] Marking the node fgedu as control-plane by adding the labels: [node-role.kubernetes.io/master(deprecated) node-role.kubernetes.io/control-plane node.kubernetes.io/exclude-from-external-load-balancers]
[mark-control-plane] Marking the node fgedu as control-plane by adding the taints [node-role.kubernetes.io/master:NoSchedule]
[bootstrap-token] Using token: abcdef.0123456789abcdef
[bootstrap-token] Configuring bootstrap tokens, cluster-info ConfigMap, RBAC Roles
[bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to get nodes
[bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials
[bootstrap-token] configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token
[bootstrap-token] configured RBAC rules to allow certificate rotation for all node client certificates in the cluster
[bootstrap-token] Creating the “cluster-info” ConfigMap in the “kube-public” namespace
[kubelet-finalize] Updating “kubelet.conf” to point to a rotatable kubelet client certificate and key
[addons] Applied essential addon: CoreDNS
[addons] Applied essential addon: kube-proxy

Your Kubernetes control-plane has initialized successfully!

To start using your cluster, you need to run the following as a regular user:

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

Alternatively, if you are the root user, you can run:

export KUBECONFIG=/etc/kubernetes/admin.conf

You should now deploy a pod network to the cluster.\nRun “kubectl apply -f [podnetwork].yaml” with one of the options listed at:
https://kubernetes.io/docs/concepts/cluster-administration/addons/

Then you can join any number of worker nodes by running the following on each as root:

kubeadm join 192.168.1.100:6443 –token abcdef.0123456789abcdef \n –discovery-token-ca-cert-hash sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef

应用部署与管理

创建Deployment

Deployment是Kubernetes中用于管理应用副本的资源对象。

# 创建Deployment
cat > deployment.yaml << EOF apiVersion: apps/v1 kind: Deployment metadata: name: nginx-deployment labels: app: nginx spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: - name: nginx image: nginx:1.14.2 ports: - containerPort: 80 EOF # 应用Deployment kubectl apply -f deployment.yaml # 查看Deployment kubectl get deployments # 查看Pod kubectl get pods

NAME READY UP-TO-DATE AVAILABLE AGE
nginx-deployment 3/3 3 3 1m

NAME READY STATUS RESTARTS AGE
nginx-deployment-76d6c9b976-5k56d 1/1 Running 0 1m
nginx-deployment-76d6c9b976-6t7v8 1/1 Running 0 1m
nginx-deployment-76d6c9b976-8q4s7 1/1 Running 0 1m

更新Deployment

# 更新Deployment
kubectl set image deployment/nginx-deployment nginx=nginx:1.16.1

# 查看更新状态
kubectl rollout status deployment/nginx-deployment

# 回滚Deployment
kubectl rollout undo deployment/nginx-deployment

Waiting for deployment “nginx-deployment” rollout to finish: 1 out of 3 new replicas have been updated…
Waiting for deployment “nginx-deployment” rollout to finish: 2 out of 3 new replicas have been updated…
Waiting for deployment “nginx-deployment” rollout to finish: 2 out of 3 new replicas have been updated…
Waiting for deployment “nginx-deployment” rollout to finish: 3 out of 3 new replicas have been updated…
deployment “nginx-deployment” successfully rolled out

服务与网络

创建Service

Service是Kubernetes中用于暴露应用的资源对象。

# 创建Service
cat > service.yaml << EOF apiVersion: v1 kind: Service metadata: name: nginx-service spec: selector: app: nginx ports: - port: 80 targetPort: 80 type: NodePort EOF # 应用Service kubectl apply -f service.yaml # 查看Service kubectl get services

NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kubernetes ClusterIP 10.96.0.1 443/TCP 1h
nginx-service NodePort 10.108.141.10 80:31567/TCP 1m

存储管理

持久卷与持久卷声明

持久卷(PV)和持久卷声明(PVC)是Kubernetes中用于管理存储的资源对象。

# 创建持久卷
cat > pv.yaml << EOF apiVersion: v1 kind: PersistentVolume metadata: name: my-pv spec: capacity: storage: 1Gi accessModes: - ReadWriteOnce hostPath: path: /mnt/data EOF # 应用持久卷 kubectl apply -f pv.yaml # 创建持久卷声明 cat > pvc.yaml << EOF apiVersion: v1 kind: PersistentVolumeClaim metadata: name: my-pvc spec: accessModes: - ReadWriteOnce resources: requests: storage: 1Gi EOF # 应用持久卷声明 kubectl apply -f pvc.yaml # 查看持久卷和持久卷声明 kubectl get pv kubectl get pvc

NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS REASON AGE
my-pv 1Gi RWO Retain Bound default/my-pvc 1m

NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS AGE
my-pvc Bound my-pv 1Gi RWO 1m

配置与密钥管理

配置管理

ConfigMap是Kubernetes中用于管理配置的资源对象。

# 创建ConfigMap
kubectl create configmap nginx-config –from-literal=nginx.conf=’server {
listen 80;
server_name fgedudb;
location / {
root /usr/share/nginx/html;
index index.html index.htm;
}
}’

# 查看ConfigMap
kubectl get configmaps

# 查看ConfigMap内容
kubectl describe configmap nginx-config

NAME DATA AGE
nginx-config 1 1m

Name: nginx-config
Namespace: default
Labels:
Annotations:

Data
====
nginx.conf:—–
server {
listen 80;
server_name fgedudb;
location / {
root /usr/share/nginx/html;
index index.html index.htm;
}
}

BinaryData
====

Events:

密钥管理

Secret是Kubernetes中用于管理密钥的资源对象。

# 创建Secret
kubectl create secret generic my-secret –from-literal=username=admin –from-literal=password=secret

# 查看Secret
kubectl get secrets

# 查看Secret内容
kubectl describe secret my-secret

NAME TYPE DATA AGE
my-secret Opaque 2 1m

Name: my-secret
Namespace: default
Labels:
Annotations:

Type: Opaque

Data
====
password: 6 bytes
username: 5 bytes

监控与日志

监控

Prometheus和Grafana是Kubernetes中常用的监控工具。

# 安装Prometheus和Grafana
kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/master/bundle.yaml

# 查看监控组件
kubectl get pods -n monitoring

# 访问Grafana
kubectl port-forward svc/grafana 3000:3000 -n monitoring

日志管理

ELK是Kubernetes中常用的日志管理工具。

# 安装ELK
helm repo add elastic https://helm.elastic.co
helm install elasticsearch elastic/elasticsearch
helm install kibana elastic/kibana
helm install filebeat elastic/filebeat

# 查看ELK组件
kubectl get pods

# 访问Kibana
kubectl port-forward svc/kibana-kibana 5601:5601

最佳实践总结

生产环境风哥建议：

使用Deployment管理应用副本
使用Service暴露应用
使用PersistentVolume和PersistentVolumeClaim管理存储
使用ConfigMap和Secret管理配置和密钥
实施监控和日志管理
使用命名空间隔离不同的应用
实施资源限制和请求
使用PodDisruptionBudget确保高可用性
使用HorizontalPodAutoscaler自动扩展
定期备份etcd数据
定期更新Kubernetes版本
实施网络策略限制网络流量

更多学习教程www.fgedu.net.cn

学习交流加群风哥微信: itpux-com

学习交流加群风哥QQ113257174

风哥风哥提示：容器编排与管理是现代应用部署的重要组成部分，Kubernetes提供了强大的功能来管理容器化应用的生命周期。

更多学习教程公众号风哥教程itpux_com

author:www.itpux.com

本文由风哥教程整理发布,仅用于学习测试使用,转载注明出处:http://www.fgedu.net.cn/10327.html