1.1.部署K8S内网资源清单http服务
1.2.部署coredns
部署K8S内网资源清单http服务
在运维主机HDSS7-200.host.com上,配置一个nginx虚拟主机,用以提高k8s统一的资源配置清单访问入口
- 配置nginx
[root@hdss7-200 ~]# vi /etc/nginx/conf.d/k8s-yaml.fx.com.conf server { listen 80; server_name k8s-yaml.fx.com; location / { autoindex on; default_type text/plain; root /data/k8s-yaml; } } [root@hdss7-200 ~]# nginx -t nginx: the configuration file /etc/nginx/nginx.conf syntax is ok nginx: configuration file /etc/nginx/nginx.conf test is successful [root@hdss7-200 ~]# nginx -s reload [root@hdss7-200 ~]# cd /data [root@hdss7-200 data]# mkdir k8s-yaml [root@hdss7-200 data]# cd k8s-yaml/ [root@hdss7-200 k8s-yaml]# mkdir coredns [root@hdss7-200 k8s-yaml]#
- 配置dns解析
[root@hdss7-11 ~]# vi /var/named/fx.com.zone $ORIGIN fx.com. $TTL 600 ; 10 minutes @ IN SOA dns.fx.com. dnsadmin.fx.com. ( 2020060903 ; serial 10800 ; refresh (3 hours) 900 ; retry (15 minutes) 604800 ; expire (1 week) 86400 ; minimum (1 day) ) NS dns.fx.com. $TTL 60 ; 1 minute dns A 10.4.7.11 harbor A 10.4.7.200 k8s-yaml A 10.4.7.200 [root@hdss7-11 ~]# systemctl restart named [root@hdss7-11 ~]# dig -t A k8s-yaml.fx.com @10.4.7.11 +short 10.4.7.200
下载coredns(docker)镜像并打包上传到harbor仓库
[root@hdss7-200 k8s-yaml]# docker pull coredns/coredns:1.6.1 [root@hdss7-200 k8s-yaml]# docker tag c0f6e815079e harbor.fx.com/public/coredns:v1.6.1 [root@hdss7-200 k8s-yaml]# docker push harbor.fx.com/public/coredns:v1.6.1
准备资源配置清单
[root@hdss7-200 ~]# mkdir -p /data/k8s-yaml/coredns && cd /data/k8s-yaml/coredns/
- rbac.yaml
[root@hdss7-200 coredns]# vi rbac.yaml apiVersion: v1 kind: ServiceAccount metadata: name: coredns namespace: kube-system labels: kubernetes.io/cluster-service: "true" addonmanager.kubernetes.io/mode: Reconcile --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: labels: kubernetes.io/bootstrapping: rbac-defaults addonmanager.kubernetes.io/mode: Reconcile name: system:coredns rules: - apiGroups: - "" resources: - endpoints - services - pods - namespaces verbs: - list - watch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: annotations: rbac.authorization.kubernetes.io/autoupdate: "true" labels: kubernetes.io/bootstrapping: rbac-defaults addonmanager.kubernetes.io/mode: EnsureExists name: system:coredns roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: system:coredns subjects: - kind: ServiceAccount name: coredns namespace: kube-system
- configmap.yaml
[root@hdss7-200 coredns]# vi cm.yaml apiVersion: v1 kind: ConfigMap metadata: name: coredns namespace: kube-system data: Corefile: | .:53 { errors log health ready kubernetes cluster.local 192.168.0.0/16 forward . 10.4.7.11 cache 30 loop reload loadbalance }
- dp.yaml
[root@hdss7-200 coredns]# vi dp.yaml apiVersion: apps/v1 kind: Deployment metadata: name: coredns namespace: kube-system labels: k8s-app: coredns kubernetes.io/name: "CoreDNS" spec: replicas: 1 selector: matchLabels: k8s-app: coredns template: metadata: labels: k8s-app: coredns spec: priorityClassName: system-cluster-critical serviceAccountName: coredns containers: - name: coredns image: harbor.fx.com/public/coredns:v1.6.1 args: - -conf - /etc/coredns/Corefile volumeMounts: - name: config-volume mountPath: /etc/coredns ports: - containerPort: 53 name: dns protocol: UDP - containerPort: 53 name: dns-tcp protocol: TCP - containerPort: 9153 name: metrics protocol: TCP livenessProbe: httpGet: path: /health port: 8080 scheme: HTTP initialDelaySeconds: 60 timeoutSeconds: 5 successThreshold: 1 failureThreshold: 5 dnsPolicy: Default volumes: - name: config-volume configMap: name: coredns items: - key: Corefile path: Corefile
- svc.yaml
[root@hdss7-200 coredns]# vi svc.yaml apiVersion: v1 kind: Service metadata: name: coredns namespace: kube-system labels: k8s-app: coredns kubernetes.io/cluster-service: "true" kubernetes.io/name: "CoreDNS" spec: selector: k8s-app: coredns clusterIP: 192.168.0.2 ports: - name: dns port: 53 protocol: UDP - name: dns-tcp port: 53 - name: metrics port: 9153 protocol: TCP
应用资源配置清单
[root@hdss7-21 ~]# kubectl apply -f http://k8s-yaml.fx.com/coredns/rbac.yaml serviceaccount/coredns created clusterrole.rbac.authorization.k8s.io/system:coredns created clusterrolebinding.rbac.authorization.k8s.io/system:coredns created [root@hdss7-21 ~]# kubectl apply -f http://k8s-yaml.fx.com/coredns/cm.yaml configmap/coredns created [root@hdss7-21 ~]# kubectl apply -f http://k8s-yaml.fx.com/coredns/dp.yaml deployment.apps/coredns created [root@hdss7-21 ~]# kubectl apply -f http://k8s-yaml.fx.com/coredns/svc.yaml service/coredns created [root@hdss7-21 ~]# kubectl get all -n kube-system NAME READY STATUS RESTARTS AGE pod/coredns-65cb567d6f-4x5tn 1/1 Running 0 32s NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE service/coredns ClusterIP 192.168.0.2 <none> 53/UDP,53/TCP,9153/TCP 26s NAME READY UP-TO-DATE AVAILABLE AGE deployment.apps/coredns 1/1 1 1 32s NAME DESIRED CURRENT READY AGE replicaset.apps/coredns-65cb567d6f 1 1 1 32s
验证coredns
[root@hdss7-21 ~]# dig -t A www.baidu.com @192.168.0.2 +short www.a.shifen.com. 220.181.38.150 220.181.38.149 [root@hdss7-21 ~]# kubectl get svc -n kube-public NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE nginx-dp ClusterIP 192.168.164.107 <none> 80/TCP 28h [root@hdss7-21 ~]# dig -t A nginx-dp.kube-public.svc.cluster.local. @192.168.0.2 +short 192.168.164.107 [root@hdss7-21 ~]# kubectl get pods -o wide NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES nginx-ds-ffw5x 1/1 Running 0 3h48m 172.7.22.2 hdss7-22.host.com <none> <none> nginx-ds-t2scb 1/1 Running 0 3h47m 172.7.21.2 hdss7-21.host.com <none> <none> [root@hdss7-21 ~]# kubectl exec -it nginx-ds-ffw5x /bin/bash root@nginx-ds-ffw5x:/# curl nginx-dp.kube-public <!DOCTYPE html> <html> <head> <title>Welcome to nginx!</title> <style> body { 35em; margin: 0 auto; font-family: Tahoma, Verdana, Arial, sans-serif; } </style> </head> <body> <h1>Welcome to nginx!</h1> <p>If you see this page, the nginx web server is successfully installed and working. Further configuration is required.</p> <p>For online documentation and support please refer to <a href="http://nginx.org/">nginx.org</a>.<br/> Commercial support is available at <a href="http://nginx.com/">nginx.com</a>.</p> <p><em>Thank you for using nginx.</em></p> </body> </html>