yaml介绍
apiVersion: v1 APIserver 的版本
kind: Pod 资源类型
metadata: 元数据定义
name: pod-demo 元数据资源名字
labels: 定义标签
app: myapp 两个标签
tier: frontend
spec: 容器期望状态定义
containers: pod 定义
- name: myapp pod名称
image: ikubernetes/myapp:v1 镜像的版本及路径
- name: busyboxa pod 名称
image: busybox:latest 镜像名称
imagePullPolicy: IfNotPresent #获取镜像的方式
ports: 端口暴露定义
- name: http pod 的容器name
- containerPort: 80 容器端口
command: 修改默认运行的命令
- "/bin/sh"
- "-c"
- "sleep 36000"
pod定义帮助
[root@master manifests]# kubectl explain pods.spec.container
KIND: Pod
VERSION: v1
RESOURCE: containers <[]Object>
DESCRIPTION:
List of containers belonging to the pod. Containers cannot currently be
added or removed. There must be at least one container in a Pod. Cannot be
updated.
A single application container that you want to run within a pod.
FIELDS:
args <[]string>
Arguments to the entrypoint. The docker image's CMD is used if this is not
provided. Variable references $(VAR_NAME) are expanded using the
container's environment. If a variable cannot be resolved, the reference in
the input string will be unchanged. The $(VAR_NAME) syntax can be escaped
with a double $$, ie: $$(VAR_NAME). Escaped references will never be
expanded, regardless of whether the variable exists or not. Cannot be
updated. More info:
https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
command <[]string>
Entrypoint array. Not executed within a shell. The docker image's
ENTRYPOINT is used if this is not provided. Variable references $(VAR_NAME)
are expanded using the container's environment. If a variable cannot be
resolved, the reference in the input string will be unchanged. The
$(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME).
Escaped references will never be expanded, regardless of whether the
variable exists or not. Cannot be updated. More info:
https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
env <[]Object>
List of environment variables to set in the container. Cannot be updated.
envFrom <[]Object>
List of sources to populate environment variables in the container. The
keys defined within a source must be a C_IDENTIFIER. All invalid keys will
be reported as an event when the container is starting. When a key exists
in multiple sources, the value associated with the last source will take
precedence. Values defined by an Env with a duplicate key will take
precedence. Cannot be updated.
image <string> 镜像仓库的镜像
Docker image name. More info:
https://kubernetes.io/docs/concepts/containers/images This field is
optional to allow higher level config management to default or override
container images in workload controllers like Deployments and StatefulSets.
imagePullPolicy <string> 获取镜像的方法 镜像标签是latest默认获取的方式Always表示总是去下载，Never表示本地有就用，本地没有也不去仓库下载，IfNotPresent本地有就用本地的，本地没有就去仓库下载
Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always
if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated.
More info:
https://kubernetes.io/docs/concepts/containers/images#updating-images
lifecycle <Object>
Actions that the management system should take in response to container
lifecycle events. Cannot be updated.
livenessProbe <Object>
Periodic probe of container liveness. Container will be restarted if the
probe fails. Cannot be updated. More info:
https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
name <string> -required- 容器名称
Name of the container specified as a DNS_LABEL. Each container in a pod
must have a unique name (DNS_LABEL). Cannot be updated.
ports <[]Object>
List of ports to expose from the container. Exposing a port here gives the
system additional information about the network connections a container
uses, but is primarily informational. Not specifying a port here DOES NOT
prevent that port from being exposed. Any port which is listening on the
default "0.0.0.0" address inside a container will be accessible from the
network. Cannot be updated.
readinessProbe <Object>
Periodic probe of container service readiness. Container will be removed
from service endpoints if the probe fails. Cannot be updated. More info:
https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
resources <Object>
Compute Resources required by this container. Cannot be updated. More info:
https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
securityContext <Object>
Security options the pod should run with. More info:
https://kubernetes.io/docs/concepts/policy/security-context/ More info:
https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
stdin <boolean>
Whether this container should allocate a buffer for stdin in the container
runtime. If this is not set, reads from stdin in the container will always
result in EOF. Default is false.
stdinOnce <boolean>
Whether the container runtime should close the stdin channel after it has
been opened by a single attach. When stdin is true the stdin stream will
remain open across multiple attach sessions. If stdinOnce is set to true,
stdin is opened on container start, is empty until the first client
attaches to stdin, and then remains open and accepts data until the client
disconnects, at which time stdin is closed and remains closed until the
container is restarted. If this flag is false, a container processes that
reads from stdin will never receive an EOF. Default is false
terminationMessagePath <string>
Optional: Path at which the file to which the container's termination
message will be written is mounted into the container's filesystem. Message
written is intended to be brief final status, such as an assertion failure
message. Will be truncated by the node if greater than 4096 bytes. The
total message length across all containers will be limited to 12kb.
Defaults to /dev/termination-log. Cannot be updated.
terminationMessagePolicy <string>
Indicate how the termination message should be populated. File will use the
contents of terminationMessagePath to populate the container status message
on both success and failure. FallbackToLogsOnError will use the last chunk
of container log output if the termination message file is empty and the
container exited with an error. The log output is limited to 2048 bytes or
80 lines, whichever is smaller. Defaults to File. Cannot be updated.
tty <boolean>
Whether this container should allocate a TTY for itself, also requires
'stdin' to be true. Default is false.
volumeDevices <[]Object>
volumeDevices is the list of block devices to be used by the container.
This is a beta feature.
volumeMounts <[]Object>
Pod volumes to mount into the container's filesystem. Cannot be updated.
workingDir <string>
Container's working directory. If not specified, the container runtime's
default will be used, which might be configured in the container image.
Cannot be updated.
pod的端口暴露操作；生明信息
[root@master manifests]# kubectl explain pods.spec.containers.ports
KIND: Pod
VERSION: v1
RESOURCE: ports <[]Object>
DESCRIPTION:
List of ports to expose from the container. Exposing a port here gives the
system additional information about the network connections a container
uses, but is primarily informational. Not specifying a port here DOES NOT
prevent that port from being exposed. Any port which is listening on the
default "0.0.0.0" address inside a container will be accessible from the
network. Cannot be updated.
ContainerPort represents a network port in a single container.
FIELDS:
containerPort <integer> -required- pod容器端口
Number of port to expose on the pod's IP address. This must be a valid port
number, 0 < x < 65536.
hostIP <string> 节点IP，建议写成0.0.0.0
What host IP to bind the external port to.
hostPort <integer> 节点上的那个端口
Number of port to expose on the host. If specified, this must be a valid
port number, 0 < x < 65536. If HostNetwork is specified, this must match
ContainerPort. Most containers do not need this.
name <string> 端口名称，server中可以引用名称
If specified, this must be an IANA_SVC_NAME and unique within the pod. Each
named port in a pod must have a unique name. Name for the port that can be
referred to by services.
protocol <string> 协议默认TCP
Protocol for port. Must be UDP, TCP, or SCTP. Defaults to "TCP".
修改默认pod运行得到命令
[root@master manifests]# kubectl explain pods.spec.containers
KIND: Pod
VERSION: v1
RESOURCE: containers <[]Object>
DESCRIPTION:
List of containers belonging to the pod. Containers cannot currently be
added or removed. There must be at least one container in a Pod. Cannot be
updated.
A single application container that you want to run within a pod.
FIELDS:
args <[]string>#作为参数传递给comment，如果没给就把容器镜像制作时的CMD指定的做为参数传递给comment
Arguments to the entrypoint. The docker image's CMD is used if this is not
provided. Variable references $(VAR_NAME) are expanded using the
container's environment. If a variable cannot be resolved, the reference in
the input string will be unchanged. The $(VAR_NAME) syntax can be escaped
with a double $$, ie: $$(VAR_NAME). Escaped references will never be
expanded, regardless of whether the variable exists or not. Cannot be
updated. More info:
https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
command <[]string>#此处命令默认不会运行在shll中的，如果想要运行shll里必须指定；如果没有指定的话，就运行docker镜像制作时指定的ENTRYPOINT
Entrypoint array. Not executed within a shell. The docker image's
ENTRYPOINT is used if this is not provided. Variable references $(VAR_NAME)
are expanded using the container's environment. If a variable cannot be
resolved, the reference in the input string will be unchanged. The
$(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME).
Escaped references will never be expanded, regardless of whether the
variable exists or not. Cannot be updated. More info:
https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
官方文档参考地址：https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/
| Description | Docker field name | Kubernetes field name |
|---|---|---|
| The command run by the container | Entrypoint | command |
| The arguments passed to the command | Cmd | args |
当您覆盖默认的Entrypoint和Cmd时，这些规则适用：
-
如果您不提供Container
command或args使用Container，则使用Docker镜像中定义的默认值。 -
如果为Container提供
command但不args提供，则仅使用提供command的。默认的EntryPoint和Docker镜像中定义的默认Cmd将被忽略。 -
如果仅为
argsContainer提供，则Docker镜像中定义的默认入口点将与args您提供的一起运行。 -
如果提供
command和args，则默认的入口点和Docker镜像中定义的默认Cmd将被忽略。你command和你一起跑args
| 图像输入点 | 图像Cmd | 集装箱指挥 | 集装箱args | 命令运行 |
|---|---|---|---|---|
[/ep-1] |
[foo bar] |
<未设置> | <未设置> | [ep-1 foo bar] |
[/ep-1] |
[foo bar] |
[/ep-2] |
<未设置> | [ep-2] |
[/ep-1] |
[foo bar] |
<未设置> | [zoo boo] |
[ep-1 zoo boo] |
[/ep-1] |
[foo bar] |
[/ep-2] |
[zoo boo] |
[ep-2 zoo boo] |
元数据标签的定义帮助
[root@master manifests]# kubectl explain pods.metadata.labels
KIND: Pod
VERSION: v1
FIELD: labels <map[string]string>
DESCRIPTION:
Map of string keys and values that can be used to organize and categorize
(scope and select) objects. May match selectors of replication controllers
and services. More info: http://kubernetes.io/docs/user-guide/labels
例子
apiVersion: v1
kind: Pod
metadata:
name: label-demo
labels:
environment: production
app: nginx
spec:
containers:
- name: nginx
image: nginx:1.7.9
ports:
- containerPort: 80
删除使用yaml创建的pod
[root@master manifests]# kubectl delete -f pod.demo.yaml pod "pod-demo" deleted
查看
[root@master manifests]# kubectl get pods NAME READY STATUS RESTARTS AGE myapp-84cd4b7f95-g6ldp 1/1 Running 3 9d nginx-5896f46c8-zblcs 1/1 Running 3 9d
创建操作
[root@master manifests]# kubectl create -f pod.demo.yaml pod/pod-demo created
查看pods的标签
[root@master manifests]# kubectl get pods --show-labels NAME READY STATUS RESTARTS AGE LABELS myapp-84cd4b7f95-g6ldp 1/1 Running 3 9d pod-template-hash=84cd4b7f95,run=myapp nginx-5896f46c8-zblcs 1/1 Running 3 9d pod-template-hash=5896f46c8,run=nginx pod-demo 2/2 Running 0 3m58s app=myapp,tier=frontend
查看过滤的pods的标签，显示用于app标签值的pod
[root@master manifests]# kubectl get pods -L app NAME READY STATUS RESTARTS AGE APP myapp-84cd4b7f95-g6ldp 1/1 Running 3 9d nginx-5896f46c8-zblcs 1/1 Running 3 9d pod-demo 2/2 Running 0 6m23s myapp
查看过滤指定标签的pods
[root@master manifests]# kubectl get pods -l app dNAME READY STATUS RESTARTS AGE pod-demo 2/2 Running 0 9m30s
查看仔细类型的
[root@master manifests]# kubectl get pods -l app --show-labels NAME READY STATUS RESTARTS AGE LABELS pod-demo 2/2 Running 0 11m app=myapp,tier=frontend
新加资源标签
[root@master manifests]# kubectl label pods pod-demo chenxi=cx pod/pod-demo labeled [root@master manifests]# kubectl get pods -l chenxi,app --show-labels NAME READY STATUS RESTARTS AGE LABELS pod-demo 2/2 Running 0 14m app=myapp,chenxi=cx,tier=frontend
修改资源标签
[root@master manifests]# kubectl label pods pod-demo chenxi=hgf --overwrite pod/pod-demo labeled [root@master manifests]# kubectl get pods -l chenxi,app --show-labels NAME READY STATUS RESTARTS AGE LABELS pod-demo 2/2 Running 0 17m app=myapp,chenxi=hgf,tier=frontend
标签选择器的使用；等值类的使用
[root@master manifests]# kubectl get pods -l app=myapp --show-labels #表示显示app标签等于myapp NAME READY STATUS RESTARTS AGE LABELS pod-demo 2/2 Running 0 20m app=myapp,chenxi=hgf,tier=frontend [root@master manifests]# kubectl get pods -l app=myapp,chenxi!=cx --show-labels 显示app标签等于myapp并且chenxi标签值不等于cx的pod NAME READY STATUS RESTARTS AGE LABELS pod-demo 2/2 Running 0 20m app=myapp,chenxi=hgf,tier=frontend
选择集合关系，值等于cx或者hgf的pods
[root@master manifests]# kubectl label pods nginx-5896f46c8-zblcs chenxi=hgf pod/nginx-5896f46c8-zblcs labeled [root@master manifests]# kubectl get pods -l "chenxi,app" NAME READY STATUS RESTARTS AGE pod-demo 2/2 Running 0 27m [root@master manifests]# kubectl label pods nginx-5896f46c8-zblcs chenxi=cx --overwrite pod/nginx-5896f46c8-zblcs labeled [root@master manifests]# kubectl get pods -l "chenxi in (cx,hgf)" NAME READY STATUS RESTARTS AGE nginx-5896f46c8-zblcs 1/1 Running 3 9d pod-demo 2/2 Running 0 29m
值不等于cx或者hgf的pods
[root@master manifests]# kubectl get pods -l "chenxi notin (cx,hgf)" NAME READY STATUS RESTARTS AGE myapp-84cd4b7f95-g6ldp 1/1 Running 3 9d
许多资源支持内嵌字段定义其使用的标签选择器
matchLabels：直接给定值
matchExpressions:基于给定的表达式来定义使用标签选择器{key:"KEY",operator:“表达式”,values:[VAL1,VAL2,...]}
表达式操作符：In ，NotIN：values字段的值必须为非空列表；Exists,NotExist：values字段的值必须为空列表
查看节点标签
[root@master manifests]# kubectl get nodes --show-labels NAME STATUS ROLES AGE VERSION LABELS master Ready master 9d v1.15.1 beta.kubernetes.io/arch=amd64,beta.kubernetes.io/os=linux,kubernetes.io/arch=amd64,kubernetes.io/hostname=master,kubernetes.io/os=linux,node-role.kubernetes.io/master= node01 Ready <none> 9d v1.15.1 beta.kubernetes.io/arch=amd64,beta.kubernetes.io/os=linux,kubernetes.io/arch=amd64,kubernetes.io/hostname=node01,kubernetes.io/os=linux node02 Ready <none> 9d v1.15.1 beta.kubernetes.io/arch=amd64,beta.kubernetes.io/os=linux,kubernetes.io/arch=amd64,kubernetes.io/hostname=node02,kubernetes.io/os=linux
给节点打标签
[root@master manifests]# kubectl label node node01 chenxi=cx node/node01 labeled [root@master manifests]# kubectl get nodes -l chenxi --show-labels NAME STATUS ROLES AGE VERSION LABELS node01 Ready <none> 9d v1.15.1 beta.kubernetes.io/arch=amd64,beta.kubernetes.io/os=linux,chenxi=cx,kubernetes.io/arch=amd64,kubernetes.io/hostname=node01,kubernetes.io/os=linux
修改节点标签
[root@master manifests]# kubectl label node node01 chenxi=gfd --overwrite node/node01 labeled [root@master manifests]# kubectl get nodes -l chenxi=gfd --show-labels NAME STATUS ROLES AGE VERSION LABELS node01 Ready <none> 9d v1.15.1 beta.kubernetes.io/arch=amd64,beta.kubernetes.io/os=linux,chenxi=gfd,kubernetes.io/arch=amd64,kubernetes.io/hostname=node01,kubernetes.io/os=linux
节点标签选择器，从而觉得pods只运行在那类节点上
nodeSelector <map[string]string>
NodeSelector is a selector which must be true for the pod to fit on a node.
Selector which must match a node's labels for the pod to be scheduled on
that node. More info:
https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
在yaml使用节点标签选择器
[root@master manifests]# vim pod.demo.yaml
apiVersion: v1
kind: Pod
metadata:
name: pod-demo
labels:
app: myapp
tier: frontend
spec:
containers:
- name: myapp
image: ikubernetes/myapp:v1
ports:
- containerPort: 80
- name: busyboxa
image: busybox:latest
imagePullPolicy: IfNotPresent
command:
- "/bin/sh"
- "-c"
- "sleep 36000"
nodeSelector:
chenxi: df 运行在有chenxi标签并且值等于gfd的节点上
查看pod运行的节点
[root@master manifests]# kubectl get pods pod-demo -o wide NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES pod-demo 2/2 Running 0 60m 10.244.1.21 node01 <none> <none>
在node02上添加节点标签
[root@master manifests]# kubectl label node node02 chenxi=df node/node02 labeled [root@master manifests]# kubectl get nodes -l chenxi=df --show-labels NAME STATUS ROLES AGE VERSION LABELS node02 Ready <none> 9d v1.15.1 beta.kubernetes.io/arch=amd64,beta.kubernetes.io/os=linux,chenxi=df,kubernetes.io/arch=amd64,kubernetes.io/hostname=node02,kubernetes.io/os=linux
删除pod的重新创建
[root@master manifests]# kubectl create -f pod.demo.yaml pod/pod-demo created [root@master manifests]# kubectl get pods pod-demo -o wide NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES pod-demo 2/2 Running 0 6s 10.244.2.13 node02 <none> <none> [root@master manifests]# kubectl get pods pod-demo -o wide NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES pod-demo 2/2 Running 0 7s 10.244.2.13 node02 <none> <none> [root@master manifests]#
只运行在指定的节点上给出节点的名字
nodeName <string> 给出节点的名字
NodeName is a request to schedule this pod onto a specific node. If it is
non-empty, the scheduler simply schedules this pod onto that node, assuming
that it fits resource requirements.
添加注解；在元数据信息里
annotations <map[string]string>
Annotations is an unstructured key value map stored with a resource that
may be set by external tools to store and retrieve arbitrary metadata. They
are not queryable and should be preserved when modifying objects. More
info: http://kubernetes.io/docs/user-guide/annotations
[root@master manifests]# cat pod.demo.yaml
apiVersion: v1
kind: Pod
metadata:
name: pod-demo
labels:
app: myapp
tier: frontend
annotations:
chenxi.com: "chenxi.com admin"
spec:
containers:
- name: myapp
image: ikubernetes/myapp:v1
ports:
- containerPort: 80
- name: busyboxa
image: busybox:latest
imagePullPolicy: IfNotPresent
command:
- "/bin/sh"
- "-c"
- "sleep 36000"
nodeSelector:
chenxi: df
kubectl delete -f pod.demo.yaml
[root@master manifests]# kubectl create -f pod.demo.yaml
pod/pod-demo created
查看添加到pod里的注释信息
[root@master manifests]# kubectl describe pods pod-demo
Name: pod-demo
Namespace: default
Priority: 0
Node: node02/192.168.183.13
Start Time: Sun, 04 Aug 2019 23:12:26 +0800
Labels: app=myapp
tier=frontend
Annotations: chenxi.com: chenxi.com admin 添加的注解
Status: Running
IP: 10.244.2.14
Containers:
myapp:
Container ID: docker://1cee7ac4e20056b2ce5d3b93b3844477bf7ed0710f6d6da4131622537ed124f0
Image: ikubernetes/myapp:v1
Image ID: docker-pullable://ikubernetes/myapp@sha256:9c3dc30b5219788b2b8a4b065f548b922a34479577befb54b03330999d30d513
Port: 80/TCP
Host Port: 0/TCP
State: Running
Started: Sun, 04 Aug 2019 23:12:27 +0800
Ready: True
Restart Count: 0
Environment: <none>
Mounts:
/var/run/secrets/kubernetes.io/serviceaccount from default-token-2m2ts (ro)
busyboxa:
Container ID: docker://2c1d7d7b6696fdad1de7dfa9c320879023b481119180f00c327639ebd52c1f10
Image: busybox:latest
Image ID: docker-pullable://busybox@sha256:9f1003c480699be56815db0f8146ad2e22efea85129b5b5983d0e0fb52d9ab70
Port: <none>
Host Port: <none>
Command:
/bin/sh
-c
sleep 36000
State: Running
Started: Sun, 04 Aug 2019 23:12:28 +0800
Ready: True
Restart Count: 0
Environment: <none>
Mounts:
/var/run/secrets/kubernetes.io/serviceaccount from default-token-2m2ts (ro)
Conditions:
Type Status
Initialized True
Ready True
ContainersReady True
PodScheduled True
Volumes:
default-token-2m2ts:
Type: Secret (a volume populated by a Secret)
SecretName: default-token-2m2ts
Optional: false
QoS Class: BestEffort
Node-Selectors: chenxi=df
Tolerations: node.kubernetes.io/not-ready:NoExecute for 300s
node.kubernetes.io/unreachable:NoExecute for 300s
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal Scheduled 13m default-scheduler Successfully assigned default/pod-demo to node02
Normal Pulled 13m kubelet, node02 Container image "ikubernetes/myapp:v1" already present on machine
Normal Created 13m kubelet, node02 Created container myapp
Normal Started 13m kubelet, node02 Started container myapp
Normal Pulled 13m kubelet, node02 Container image "busybox:latest" already present on machine
Normal Created 13m kubelet, node02 Created container busyboxa
Normal Started 13m kubelet, node02 Started container busyboxa
pod 的状态
Pending:状态意味着，pod的YAML文件已经提交个Kubernetes，API对象已经被保存在Etcd里。但是。这个Pod里有些容器因为某种原因而不能被顺利创建，比如，调度不成功
Running：这个状态下的Pod已经调度成功，跟具体的节点绑定。它包含的容器都已经创建成功，并且至少有一个正在运行中
Succeeded：这个状态意味着，Pod里的所有容器都正常运行完毕，并且已经退出，这种情况在运行一次性任务时最为常见
Failed: 这个状态下，Pod里至少有一个容器以不正常的状态（非0的返回码）退出，这个状态的出现，意味着你得想办法Debug这个容器应用，例如查看Pod的Events和日志
Unknown：这个异常意味着Pod的状态不能持续地被kubelet汇报给kube-apiserver，这很可能主从节点间的通信出现了问题
Pod生命周期中的重要行为
初始化容器
容器探测：liveness探测容器是否处于存活状态；readiness：探测容器里的服务是否可以正常提供服务
容器重启策略：
restartPolicy <string>
Restart policy for all containers within the pod. One of Always, OnFailure,
Never. Default to Always. More info:
https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy
Always：#表示一旦Pod中的容器挂了，就把它重启，默认
OnFailure：只有状态错误是重启
Never：表示从不重启