# API规划
– 目标：
– 确保API的稳定性和可靠性
– 确保API的向后兼容性
– 确保API的安全性
– 确保API的性能
– 范围：
– API版本控制策略
– API资源定义
– API访问控制
– API监控和日志
– 工具选择：
– API客户端：kubectl、client-go
– API文档工具：Swagger、OpenAPI
– API测试工具：Postman、curl
– API监控工具：Prometheus、Grafana
– 流程设计：
– API设计：定义API资源和操作
– API实现：实现API逻辑
– API测试：测试API功能
– API部署：部署API服务
– API监控：监控API性能和可用性
– 资源分配：
– 人力资源：API开发人员、测试人员、文档人员
– 时间资源：API设计时间、实现时间、测试时间
– 基础设施：API服务器、存储资源、网络资源

# API安全
– 认证：
– X.509证书
– Service Account令牌
– OpenID Connect (OIDC)
– LDAP
– Kerberos
– 授权：
– RBAC (Role-Based Access Control)
– ABAC (Attribute-Based Access Control)
– Node授权
– Webhook授权
– 准入控制：
– AlwaysAllow
– AlwaysDeny
– NodeRestriction
– PodSecurityPolicy
– ResourceQuota
– LimitRanger
– 加密：
– TLS加密
– 数据加密
– 密钥管理
– 审计：
– 审计日志
– 审计策略
– 审计后端

# 最佳实践规划
– API设计最佳实践：
– 遵循RESTful原则
– 使用标准HTTP方法
– 合理设计资源结构
– 提供清晰的错误信息
– 支持分页和过滤
– API版本控制最佳实践：
– 使用语义化版本控制
– 保持向后兼容性
– 明确版本废弃策略
– 提供版本迁移指南
– API安全最佳实践：
– 使用RBAC进行授权
– 启用TLS加密
– 限制API访问范围
– 定期轮换证书和令牌
– 监控API访问
– API性能最佳实践：
– 使用缓存减少重复请求
– 优化API响应时间
– 限制请求大小和频率
– 使用异步处理长时间操作
– API文档最佳实践：
– 使用OpenAPI规范
– 提供详细的API文档
– 包含示例代码
– 定期更新文档

# API实现
1. 使用kubectl访问API：
# 获取API版本
$ kubectl api-versions
# 输出
admissionregistration.k8s.io/v1
apiextensions.k8s.io/v1
apiregistration.k8s.io/v1
apps/v1
authentication.k8s.io/v1
authorization.k8s.io/v1
autoscaling/v1
autoscaling/v2
autoscaling/v2beta1
batch/v1
batch/v1beta1
certificates.k8s.io/v1
coordination.k8s.io/v1
discovery.k8s.io/v1
discovery.k8s.io/v1beta1
events.k8s.io/v1
events.k8s.io/v1beta1
flowcontrol.apiserver.k8s.io/v1beta1
flowcontrol.apiserver.k8s.io/v1beta2
networking.k8s.io/v1
node.k8s.io/v1
node.k8s.io/v1beta1
policy/v1
policy/v1beta1
rbac.authorization.k8s.io/v1
scheduling.k8s.io/v1
storage.k8s.io/v1
storage.k8s.io/v1beta1
v1
# 获取API资源
$ kubectl api-resources
# 输出
NAME SHORTNAMES APIVERSION NAMESPACED KIND
bindings v1 true Binding
componentstatuses cs v1 false ComponentStatus
configmaps cm v1 true ConfigMap
endpoints ep v1 true Endpoints
events ev v1 true Event
limitranges limits v1 true LimitRange
namespaces ns v1 false Namespace
nodes no v1 false Node
persistentvolumeclaims pvc v1 true PersistentVolumeClaim
persistentvolumes pv v1 false PersistentVolume
pods po v1 true Pod
podtemplates v1 true PodTemplate
replicationcontrollers rc v1 true ReplicationController
resourcequotas quota v1 true ResourceQuota
secrets v1 true Secret
serviceaccounts sa v1 true ServiceAccount
services svc v1 true Service
mutatingwebhookconfigurations admissionregistration.k8s.io/v1 false MutatingWebhookConfiguration
validatingwebhookconfigurations admissionregistration.k8s.io/v1 false ValidatingWebhookConfiguration
customresourcedefinitions crd,crds apiextensions.k8s.io/v1 false CustomResourceDefinition
apiservices apiregistration.k8s.io/v1 false APIService
controllerrevisions apps/v1 true ControllerRevision
daemonsets ds apps/v1 true DaemonSet
deployments deploy apps/v1 true Deployment
replicasets rs apps/v1 true ReplicaSet
statefulsets sts apps/v1 true StatefulSet
tokenreviews authentication.k8s.io/v1 false TokenReview
localsubjectaccessreviews authorization.k8s.io/v1 true LocalSubjectAccessReview
selfsubjectaccessreviews authorization.k8s.io/v1 false SelfSubjectAccessReview
selfsubjectrulesreviews authorization.k8s.io/v1 false SelfSubjectRulesReview
subjectaccessreviews authorization.k8s.io/v1 false SubjectAccessReview
horizontalpodautoscalers hpa autoscaling/v1 true HorizontalPodAutoscaler
horizontalpodautoscalers hpa autoscaling/v2 true HorizontalPodAutoscaler
cronjobs cj batch/v1 true CronJob
jobs batch/v1 true Job
certificatesigningrequests csr certificates.k8s.io/v1 false CertificateSigningRequest
leases coordination.k8s.io/v1 true Lease
endpointslices discovery.k8s.io/v1 true EndpointSlice
events ev events.k8s.io/v1 true Event
flowschemas flowcontrol.apiserver.k8s.io/v1beta1 false FlowSchema
prioritylevelconfigurations flowcontrol.apiserver.k8s.io/v1beta1 false PriorityLevelConfiguration，风哥提示：。
ingresses ing networking.k8s.io/v1 true Ingress
ingressclasses networking.k8s.io/v1 false IngressClass
networkpolicies netpol networking.k8s.io/v1 true NetworkPolicy
runtimeclasses node.k8s.io/v1 false RuntimeClass
poddisruptionbudgets pdb policy/v1 true PodDisruptionBudget
podsecuritypolicies psp policy/v1beta1 false PodSecurityPolicy
clusterrolebindings rbac.authorization.k8s.io/v1 false ClusterRoleBinding
clusterroles rbac.authorization.k8s.io/v1 false ClusterRole
rolebindings rbac.authorization.k8s.io/v1 true RoleBinding
roles rbac.authorization.k8s.io/v1 true Role
priorityclasses pc scheduling.k8s.io/v1 false PriorityClass
csidrivers storage.k8s.io/v1 false CSIDriver
csinodes storage.k8s.io/v1 false CSINode
storageclasses sc storage.k8s.io/v1 false StorageClass
volumeattachments storage.k8s.io/v1 false VolumeAttachment
2. 使用curl访问API：
# 获取API服务器地址
$ kubectl config view –minify -o jsonpath='{.clusters[0].cluster.server}’
# 输出
https://192.168.1.100:6443
# 获取令牌
$ TOKEN=$(kubectl get secret $(kubectl get serviceaccount default -o jsonpath='{.secrets[0].name}’) -o jsonpath='{.data.token}’ | base64 –decode)
# 使用curl访问API
$ curl -k -H “Authorization: Bearer $TOKEN” https://192.168.1.100:6443/api/v1/namespaces
# 输出
{
“kind”: “NamespaceList”,
“apiVersion”: “v1”,
“metadata”: {
“selfLink”: “/api/v1/namespaces”,
“resourceVersion”: “12345”
},
“items”: [
{
“metadata”: {
“name”: “default”,
“selfLink”: “/api/v1/namespaces/default”,
“uid”: “12345678-1234-1234-1234-1234567890ab”,
“resourceVersion”: “1”,
“creationTimestamp”: “2023-01-01T00:00:00Z”
},
“spec”: {
“finalizers”: [
“kubernetes”
]
},
“status”: {
“phase”: “Active”
}
},
{
“metadata”: {
“name”: “kube-system”,
“selfLink”: “/api/v1/namespaces/kube-system”,
“uid”: “87654321-4321-4321-4321-ba0987654321”,
“resourceVersion”: “2”,
“creationTimestamp”: “2023-01-01T00:00:00Z”
},
“spec”: {
“finalizers”: [
“kubernetes”
]
},
“status”: {
“phase”: “Active”
}
}
]
}
3. 使用client-go访问API：
# 安装client-go
$ go get k8s.io/client-go@latest
# 编写示例代码
$ vi main.go
# 代码内容
package main
import (
“context”
“fmt”
“k8s.io/client-go/kubernetes”
“k8s.io/client-go/tools/clientcmd”
)
func main() {
// 加载kubeconfig
config, err := clientcmd.BuildConfigFromFlags(“”, “~/.kube/config”)
if err != nil {
panic(err)
}
// 创建客户端
clientset, err := kubernetes.NewForConfig(config)
if err != nil {
panic(err)
}
// 获取命名空间
namespaces, err := clientset.CoreV1().Namespaces().List(context.Background(), metav1.ListOptions{})
if err != nil {
panic(err)
}
// 打印命名空间
fmt.Println(“Namespaces:”)
for _, ns := range namespaces.Items {
fmt.Printf(“- %s\n”, ns.Name)
}
}
# 运行示例代码
$ go run main.go
# 输出
Namespaces:
– default
– kube-system
– kube-public
– kube-node-lease

# API文档编写
1. 使用OpenAPI规范：
# 获取API的OpenAPI规范
$ kubectl get –raw /openapi/v2 > swagger.json
# 查看OpenAPI规范
$ cat swagger.json | jq ‘.info’
# 输出
{
“title”: “Kubernetes API”,
“version”: “v1.24.0”,
“description”: “kubernetes API”
}
2. 使用Swagger UI：
# 启动Swagger UI
$ docker run -p 8080:8080 -e SWAGGER_JSON=/swagger.json -v $(pwd)/swagger.json:/swagger.json swaggerapi/swagger-ui
# 访问Swagger UI
# 打开浏览器访问 http://localhost:8080
3. 编写API文档：
# 创建API文档目录
$ mkdir -p docs/api
# 编写API文档
$ vi docs/api/overview.md
# 文档内容
# Kubernetes API 概述
Kubernetes API是Kubernetes集群的核心接口，提供了管理集群资源的能力。
## API版本
– `v1`：核心API的稳定版本，学习交流加群风哥微信: itpux-com。
– `apps/v1`：应用相关API的稳定版本
– `batch/v1`：批处理相关API的稳定版本
## API资源
– `Pod`：最小的部署单元
– `Service`：服务发现和负载均衡
– `Deployment`：无状态应用的部署
– `StatefulSet`：有状态应用的部署
– `ConfigMap`：配置管理
– `Secret`：密钥管理
## API操作
– `GET`：获取资源
– `POST`：创建资源
– `PUT`：更新资源
– `DELETE`：删除资源
– `PATCH`：部分更新资源
4. 生成API文档：
# 使用工具生成API文档
$ npm install -g @stoplight/spectral
# 配置spectral
$ vi .spectral.yaml
# 配置内容
extends: spectral:oas
rules:
info-description: error
info-contact: error
info-version: error
# 验证OpenAPI规范
$ spectral lint swagger.json
5. 发布API文档：
# 将API文档发布到GitHub Pages
$ git add docs/api
$ git commit -m “Add API documentation”
$ git push origin main
# 配置GitHub Pages
# 在GitHub仓库设置中启用GitHub Pages
# 选择main分支的docs目录作为发布源

# API测试
1. 使用curl测试API：
# 测试获取命名空间
$ curl -k -H “Authorization: Bearer $TOKEN” https://192.168.1.100:6443/api/v1/namespaces
# 测试创建Pod
$ cat > pod.json << 'EOF' { "apiVersion": "v1", "kind": "Pod", "metadata": { "name": "test-pod" }, "spec": { "containers": [ { "name": "nginx", "image": "nginx:latest", "ports": [ { "containerPort": 80 } ] } ] } } EOF $ curl -k -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d @pod.json https://192.168.1.100:6443/api/v1/namespaces/default/pods # 测试获取Pod $ curl -k -H "Authorization: Bearer $TOKEN" https://192.168.1.100:6443/api/v1/namespaces/default/pods/test-pod # 测试删除Pod $ curl -k -X DELETE -H "Authorization: Bearer $TOKEN" https://192.168.1.100:6443/api/v1/namespaces/default/pods/test-pod 2. 使用Postman测试API： # 导入OpenAPI规范到Postman # 打开Postman → File → Import → Upload Files → 选择swagger.json # 配置认证 # 在Postman中设置Authorization为Bearer Token，输入获取的令牌 # 测试API # 选择API端点并发送请求 3. 使用Go测试API： # 编写测试代码 $ vi api_test.go # 代码内容 package main import ( "context" "testing" "k8s.io/client-go/kubernetes" "k8s.io/client-go/tools/clientcmd" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" corev1 "k8s.io/api/core/v1" ) func TestAPIAccess(t *testing.T) { // 加载kubeconfig config, err := clientcmd.BuildConfigFromFlags("", "~/.kube/config") if err != nil { t.Fatalf("Failed to load kubeconfig: %v", err) } // 创建客户端 clientset, err := kubernetes.NewForConfig(config) if err != nil { t.Fatalf("Failed to create clientset: %v", err) } // 测试获取命名空间 namespaces, err := clientset.CoreV1().Namespaces().List(context.Background(), metav1.ListOptions{}) if err != nil { t.Fatalf("Failed to list namespaces: %v", err) } if len(namespaces.Items) == 0 { t.Fatal("No namespaces found") } // 测试创建Pod pod := &corev1.Pod{ ObjectMeta: metav1.ObjectMeta{ Name: "test-pod", }, Spec: corev1.PodSpec{ Containers: []corev1.Container{ { Name: "nginx", Image: "nginx:latest", Ports: []corev1.ContainerPort{ { ContainerPort: 80, }, }, }, }, }, } _, err = clientset.CoreV1().Pods("default").Create(context.Background(), pod, metav1.CreateOptions{}) if err != nil { t.Fatalf("Failed to create pod: %v", err) } // 测试获取Pod _, err = clientset.CoreV1().Pods("default").Get(context.Background(), "test-pod", metav1.GetOptions{}) if err != nil { t.Fatalf("Failed to get pod: %v", err) } // 测试删除Pod err = clientset.CoreV1().Pods("default").Delete(context.Background(), "test-pod", metav1.DeleteOptions{}) if err != nil { t.Fatalf("Failed to delete pod: %v", err)，学习交流加群风哥QQ113257174。 } } # 运行测试 $ go test -v api_test.go 4. 集成到CI/CD： # 添加API测试到GitHub Actions $ vi .github/workflows/api-test.yml # 配置内容 name: API Test on: push: branches: [ main, develop ] pull_request: branches: [ main, develop ] jobs: test: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 - name: Set up Go uses: actions/setup-go@v2 with: go-version: '1.18' - name: Install dependencies run: go mod download - name: Run API tests run: go test -v ./api_test.go - name: Test API with curl run: | # 获取API服务器地址 SERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}') # 获取令牌 TOKEN=$(kubectl get secret $(kubectl get serviceaccount default -o jsonpath='{.secrets[0].name}') -o jsonpath='{.data.token}' | base64 --decode) # 测试API curl -k -H "Authorization: Bearer $TOKEN" $SERVER/api/v1/namespaces

# 案例：使用Kubernetes API管理集群资源
# 场景：使用Kubernetes API创建和管理Pod、Service和Deployment
# 问题：
– 需要通过API自动化管理集群资源
– 需要集成Kubernetes API到自定义应用中
– 需要批量操作集群资源
# 解决方案：
1. 使用client-go访问API：
# 编写示例代码
$ vi k8s-api-example.go
# 代码内容
package main
import (
“context”
“fmt”
“k8s.io/client-go/kubernetes”
“k8s.io/client-go/tools/clientcmd”
metav1 “k8s.io/apimachinery/pkg/apis/meta/v1”
corev1 “k8s.io/api/core/v1”
appsv1 “k8s.io/api/apps/v1”
)
func main() {
// 加载kubeconfig
config, err := clientcmd.BuildConfigFromFlags(“”, “~/.kube/config”)
if err != nil {
panic(err)
}
// 创建客户端
clientset, err := kubernetes.NewForConfig(config)
if err != nil {
panic(err)
}
// 创建Namespace
namespace := &corev1.Namespace{
ObjectMeta: metav1.ObjectMeta{
Name: “fgedu-test”,
},
}
_, err = clientset.CoreV1().Namespaces().Create(context.Background(), namespace, metav1.CreateOptions{})
if err != nil {
panic(err)
}
fmt.Println(“Created namespace: fgedu-test”)
// 创建Deployment
deployment := &appsv1.Deployment{
ObjectMeta: metav1.ObjectMeta{
Name: “nginx-deployment”,
Namespace: “fgedu-test”,
},
Spec: appsv1.DeploymentSpec{
Replicas: int32Ptr(3),
Selector: &metav1.LabelSelector{
MatchLabels: map[string]string{
“app”: “nginx”,
},
},
Template: corev1.PodTemplateSpec{
ObjectMeta: metav1.ObjectMeta{
Labels: map[string]string{
“app”: “nginx”,
},
},
Spec: corev1.PodSpec{
Containers: []corev1.Container{
{
Name: “nginx”,
Image: “nginx:latest”,
Ports: []corev1.ContainerPort{
{
ContainerPort: 80,
},
},
},
},
},
},
},
}
_, err = clientset.AppsV1().Deployments(“fgedu-test”).Create(context.Background(), deployment, metav1.CreateOptions{})
if err != nil {
panic(err)
}
fmt.Println(“Created deployment: nginx-deployment”)
// 创建Service
service := &corev1.Service{
ObjectMeta: metav1.ObjectMeta{
Name: “nginx-service”,
Namespace: “fgedu-test”,
},
Spec: corev1.ServiceSpec{
Selector: map[string]string{
“app”: “nginx”,
},
Ports: []corev1.ServicePort{
{
Port: 80,
TargetPort: intstr.FromInt(80),
},
},
Type: corev1.ServiceTypeNodePort,
},更多视频教程www.fgedu.net.cn。
}
_, err = clientset.CoreV1().Services(“fgedu-test”).Create(context.Background(), service, metav1.CreateOptions{})
if err != nil {
panic(err)
}
fmt.Println(“Created service: nginx-service”)
// 获取Pod列表
pods, err := clientset.CoreV1().Pods(“fgedu-test”).List(context.Background(), metav1.ListOptions{
LabelSelector: “app=nginx”,
})
if err != nil {
panic(err)
}
fmt.Println(“Pods:”)
for _, pod := range pods.Items {
fmt.Printf(“- %s\n”, pod.Name)
}
// 清理资源
err = clientset.CoreV1().Namespaces().Delete(context.Background(), “fgedu-test”, metav1.DeleteOptions{})
if err != nil {
panic(err)
}
fmt.Println(“Deleted namespace: fgedu-test”)
}
func int32Ptr(i int32) *int32 {
return &i
}
2. 运行示例代码：
$ go run k8s-api-example.go
# 输出
Created namespace: fgedu-test
Created deployment: nginx-deployment
Created service: nginx-service
Pods:
– nginx-deployment-12345-abcde
– nginx-deployment-12345-fghij
– nginx-deployment-12345-klmno
Deleted namespace: fgedu-test
3. 验证API操作：
# 检查资源创建和删除
$ kubectl get namespaces
$ kubectl get pods -n fgedu-test
$ kubectl get services -n fgedu-test
# 输出结果：
# 资源创建和删除成功
# API操作正常

# 案例：编写Kubernetes API文档
# 场景：为Kubernetes API编写详细的文档
# 问题：
– API文档不完整
– API文档更新不及时
– API文档格式不统一
# 解决方案：
1. 生成OpenAPI规范：
# 获取API的OpenAPI规范
$ kubectl get –raw /openapi/v2 > swagger.json
2. 使用ReDoc生成文档：
# 安装ReDoc CLI
$ npm install -g redoc-cli
# 生成HTML文档
$ redoc-cli bundle swagger.json -o api-docs.html
3. 编写自定义API文档：
# 创建文档目录
$ mkdir -p docs/api
# 编写API概述
$ vi docs/api/overview.md
# 文档内容
# Kubernetes API 概述
Kubernetes API是Kubernetes集群的核心接口，提供了管理集群资源的能力。
## 核心概念
– **资源（Resource）**：Kubernetes中的基本管理对象，如Pod、Service、Deployment等
– **命名空间（Namespace）**：资源的逻辑隔离单元
– **标签（Label）**：资源的元数据，用于选择和组织资源
– **注解（Annotation）**：资源的附加元数据，用于存储非识别信息
## API版本
– **v1**：核心API的稳定版本
– **apps/v1**：应用相关API的稳定版本
– **batch/v1**：批处理相关API的稳定版本
– **networking.k8s.io/v1**：网络相关API的稳定版本
– **storage.k8s.io/v1**：存储相关API的稳定版本
## API操作
– **GET**：获取资源
– **POST**：创建资源
– **PUT**：更新资源
– **DELETE**：删除资源
– **PATCH**：部分更新资源
## 认证与授权
– **认证**：验证用户身份
– **授权**：验证用户权限
– **准入控制**：对资源请求进行验证和修改
4. 编写API参考文档：
# 编写Pod API参考
$ vi docs/api/pod.md
# 文档内容
# Pod API 参考
## 资源概述
Pod是Kubernetes中最小的部署单元，包含一个或多个容器。
## API路径
– **List Pods**：`GET /api/v1/namespaces/{namespace}/pods`
– **Get Pod**：`GET /api/v1/namespaces/{namespace}/pods/{name}`
– **Create Pod**：`POST /api/v1/namespaces/{namespace}/pods`
– **Update Pod**：`PUT /api/v1/namespaces/{namespace}/pods/{name}`
– **Delete Pod**：`DELETE /api/v1/namespaces/{namespace}/pods/{name}`
## 请求示例
“`json
{
“apiVersion”: “v1”,
“kind”: “Pod”,
“metadata”: {
“name”: “nginx”,
“labels”: {
“app”: “nginx”
}
},
“spec”: {
“containers”: [
{
“name”: “nginx”,
“image”: “nginx:latest”,
“ports”: [
{
“containerPort”: 80
}
]
}
]
}
}
“`
## 响应示例
“`json
{
“apiVersion”: “v1”,
“kind”: “Pod”,
“metadata”: {
“name”: “nginx”,
“namespace”: “default”,
“uid”: “12345678-1234-1234-1234-1234567890ab”,
“resourceVersion”: “12345”,更多学习教程公众号风哥教程itpux_com。
“creationTimestamp”: “2023-01-01T00:00:00Z”,
“labels”: {
“app”: “nginx”
}
},
“spec”: {
“containers”: [
{
“name”: “nginx”,
“image”: “nginx:latest”,
“ports”: [
{
“containerPort”: 80
}
],
“resources”: {}
}
]
},
“status”: {
“phase”: “Running”,
“conditions”: [
{
“type”: “Ready”,
“status”: “True”,
“lastProbeTime”: “2023-01-01T00:00:00Z”,
“lastTransitionTime”: “2023-01-01T00:00:00Z”
}
],
“podIP”: “10.0.0.1”,
“startTime”: “2023-01-01T00:00:00Z”
}
}
“`
5. 发布API文档：
# 将API文档发布到GitHub Pages
$ git add docs/api
$ git commit -m “Add API documentation”
$ git push origin main
# 配置GitHub Pages
# 在GitHub仓库设置中启用GitHub Pages
# 选择main分支的docs目录作为发布源
# 输出结果：
# API文档生成成功
# API文档发布成功
# 文档访问正常

# 案例：测试Kubernetes API
# 场景：测试Kubernetes API的功能和性能
# 问题：
– API功能测试不全面
– API性能测试缺失
– API测试自动化程度低
# 解决方案：
1. 功能测试：
# 编写功能测试脚本
$ vi api-functional-test.sh
# 脚本内容
#!/bin/bash
# 获取API服务器地址和令牌
SERVER=$(kubectl config view –minify -o jsonpath='{.clusters[0].cluster.server}’)
TOKEN=$(kubectl get secret $(kubectl get serviceaccount default -o jsonpath='{.secrets[0].name}’) -o jsonpath='{.data.token}’ | base64 –decode)
echo “Testing Kubernetes API functionality…”
# 测试获取命名空间
echo “1. Testing namespace list…”
RESPONSE=$(curl -k -H “Authorization: Bearer $TOKEN” $SERVER/api/v1/namespaces)
if echo “$RESPONSE” | grep -q “kind.*NamespaceList”; then
echo “✓ Namespace list test passed”
else
echo “✗ Namespace list test failed”
exit 1
fi
# 测试创建Pod
echo “2. Testing pod creation…”
POD_JSON='{
“apiVersion”: “v1”,
“kind”: “Pod”,
“metadata”: {
“name”: “test-pod”
},
“spec”: {
“containers”: [
{
“name”: “nginx”,
“image”: “nginx:latest”,
“ports”: [
{
“containerPort”: 80
}
]
}
]
}
}’
RESPONSE=$(curl -k -X POST -H “Authorization: Bearer $TOKEN” -H “Content-Type: application/json” -d “$POD_JSON” $SERVER/api/v1/namespaces/default/pods)
if echo “$RESPONSE” | grep -q “kind.*Pod”; then
echo “✓ Pod creation test passed”
else
echo “✗ Pod creation test failed”
exit 1
fi
# 测试获取Pod
echo “3. Testing pod get…”
RESPONSE=$(curl -k -H “Authorization: Bearer $TOKEN” $SERVER/api/v1/namespaces/default/pods/test-pod)
if echo “$RESPONSE” | grep -q “kind.*Pod”; then
echo “✓ Pod get test passed”
else
echo “✗ Pod get test failed”
exit 1
fi
# 测试删除Pod
echo “4. Testing pod deletion…”
RESPONSE=$(curl -k -X DELETE -H “Authorization: Bearer $TOKEN” $SERVER/api/v1/namespaces/default/pods/test-pod)
if echo “$RESPONSE” | grep -q “kind.*Status”; then
echo “✓ Pod deletion test passed”
else
echo “✗ Pod deletion test failed”
exit 1
fi
echo “All functional tests passed!”
2. 性能测试：
# 编写性能测试脚本
$ vi api-performance-test.sh
# 脚本内容
#!/bin/bash
# 获取API服务器地址和令牌
SERVER=$(kubectl config view –minify -o jsonpath='{.clusters[0].cluster.server}’)
TOKEN=$(kubectl get secret $(kubectl get serviceaccount default -o jsonpath='{.secrets[0].name}’) -o jsonpath='{.data.token}’ | base64 –decode)
echo “Testing Kubernetes API performance…”
# 测试响应时间
echo “1. Testing response time…”
TOTAL_TIME=0
COUNT=10
for i in $(seq 1 $COUNT); do
START_TIME=$(date +%s%3N)
curl -k -H “Authorization: Bearer $TOKEN” $SERVER/api/v1/namespaces > /dev/null 2>&1
END_TIME=$(date +%s%3N)
REQUEST_TIME=$((END_TIME – START_TIME))
TOTAL_TIME=$((TOTAL_TIME + REQUEST_TIME))
echo “Request $i: $REQUEST_TIME ms”，from K8S+DB视频:www.itpux.com。
done
AVG_TIME=$((TOTAL_TIME / COUNT))
echo “Average response time: $AVG_TIME ms”
# 测试并发请求
echo “2. Testing concurrent requests…”
CONCURRENT=5
DURATION=10
echo “Running $CONCURRENT concurrent requests for $DURATION seconds…”
timeout $DURATION bash -c “while true; do。
for i in $(seq 1 $CONCURRENT); do
curl -k -H \”Authorization: Bearer $TOKEN\” $SERVER/api/v1/namespaces > /dev/null 2>&1 &
done
wait
done”
echo “Performance test completed!”
3. 运行测试：
# 运行功能测试
$ bash api-functional-test.sh
# 输出
Testing Kubernetes API functionality…
1. Testing namespace list…
✓ Namespace list test passed
2. Testing pod creation…
✓ Pod creation test passed
3. Testing pod get…
✓ Pod get test passed
4. Testing pod deletion…
✓ Pod deletion test passed
All functional tests passed!
# 运行性能测试
$ bash api-performance-test.sh
# 输出
Testing Kubernetes API performance…
1. Testing response time…
Request 1: 123 ms
Request 2: 112 ms
Request 3: 105 ms
Request 4: 118 ms
Request 5: 109 ms
Request 6: 115 ms
Request 7: 121 ms
Request 8: 108 ms
Request 9: 114 ms
Request 10: 116 ms
Average response time: 114 ms
2. Testing concurrent requests…
Running 5 concurrent requests for 10 seconds…
Performance test completed!
4. 集成到CI/CD：
# 添加API测试到GitHub Actions
$ vi .github/workflows/api-test.yml
# 配置内容
name: API Test
on:
push:
branches: [ main, develop ]
pull_request:
branches: [ main, develop ]
jobs:
functional-test:
runs-on: ubuntu-latest
steps:
– uses: actions/checkout@v2
– name: Run functional tests
run: bash api-functional-test.sh
performance-test:
runs-on: ubuntu-latest
steps:
– uses: actions/checkout@v2
– name: Run performance tests
run: bash api-performance-test.sh
# 输出结果：
# 功能测试通过
# 性能测试通过
# API测试集成到CI/CD成功