CKA

1. RBAC权限问题2. pod驱逐3. 升级4. ETCD备份和恢复5. 网络策略6. 服务暴露7. ingress8. 扩缩容9. pod分配10. 污点查看11. 多容器的pod12. 创建pv13. pvc使用扩容pv14. 日志15. sidecar16. labels17. 故障处理

1. RBAC权限问题

Q: 创建一个名为Deployment-clusterrole的新ClusterRole，它仅允许创建以下资源类型：Deployment, statefulset,Daemonset 在现有名称空间 app-team1中创建一个名为cicd-token的新ServiceAccount。将新的ClusterRole部署群集绑定到新的服务帐户cicd-token，限于命名空间app-team1。

参考： https://kubernetes.io/docs/reference/access-authn-authz/rbac/

A：

# 切换kubernetes集群
kubectl config use-context k8s

# 创建ServiceAccount
kubectl -n app-team1 create serviceaccount cicd-token

# 创建ClusterRole,并binding给ServiceAccount
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
 name: deployment-clusterrole
rules:
- apiGroups: ["apps"]
 resources: ["Deployment","statefulset","Daemonset"]
 verbs: ["create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
 name: deployment-clusterrole-binding
subjects:
- kind: ServiceAccount
 name: cicd-token
 namespace: app-team1
roleRef:
 kind: ClusterRole
 name: deployment-clusterrole
 apiGroup: rbac.authorization.k8s.io

 

2. pod驱逐

Q: 将名为ek8s-node-1的节点设置为不可用，并重新计划在其上运行的所有Pod。

参考:

A:

# 切换kubernetes集群
kubectl config use-context ek8s

x
# 驱逐节点应⽤
kubectl cordon ek8s-node-1
kubectl drain ek8s-node-1 --ignore-daemonsets

 

3. 升级

Q: 给定现有的运行版本1.18.8的Kubernetes集群，请升级所有Kubernetes控制平面和主节点上的节点组件仅适用于1.19.0版。 Be sure to drain the master node before upgrading it and uncordon it after the upgrade. do not upgrade the worker nodes,etcd,the container manager,the CNI plugin,the DNS service or any other addons.

参考：

https://v1-19.docs.kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/#drain-the-control-plane-node

https://v1-19.docs.kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/#upgrade-the-first-control-plane-node

A:

xxxxxxxxxx
# 切换kubernetes集群
kubectl config use-context mk8s
​
# 升级master节点，设置成维护模式并进⾏应⽤驱逐
kubectl cordon masternode
kubectl drain masternode --ignore-daemonsets
​
# 查看节点的名称，然后ssh到master节点
kubectl get nodes
ssh master01
​
######### 安装最新kubeadm、kubelet、kubectl
sudo apt-get update && sudo apt-get install -y apt-transport-https curl
​
curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add -
​
cat <<EOF | sudo tee /etc/apt/sources.list.d/kubernetes.list
deb https://apt.kubernetes.io/ kubernetes-xenial main
EOF
​
apt-mark unhold kubeadm kubelet kubectl
sudo apt-get update
sudo apt-get install -y kubelet=1.19.0-00 kubeadm=1.19.0-00 kubectl=1.19.0-00
apt-mark hold kubeadm kubelet kubectl
######### 升级master节点
kubeadm upgrade plan
kubeadm upgrade apply v1.19.0 --etcd-upgrade=false
kubectl -n kube-system rollout undo deployment coredns
# 取消master节点的维护模式
kubectl uncordon masternode

 

4. ETCD备份和恢复

Q: 备份 https://172.0.0.1:2379 的etcd 到 /var/lib/backup/etcd-snapshot.db

恢复 /data/backup/etcd-snapshot-previous.db 的快照

参考：

# 创建备份，参考⽹址：

https://kubernetes.io/docs/tasks/administer-cluster/configure-upgrade-etcd/#built-in-snapshot

A:

x
# 创建备份
docker ps | grep etcd
docker cp k8s_etcd_etcd-master01_kubesystem_97f18de1cf5dab1e1cdd4ce0de07c277_0:/usr/local/bin/etcdctl /usr/local/bin/
mkdir /var/lib/backup
​
ETCDCTL_API=3 etcdctl --endpoints https://127.0.0.1:2379 \
--cacert=/etc/kubernetes/pki/etcd/ca.crt \
--cert=/etc/kubernetes/pki/etcd/peer.crt \
--key=/etc/kubernetes/pki/etcd/peer.key \
snapshot save /var/lib/backup/etcd-snapshot.db
​
#恢复备份
#查看member
ETCDCTL_API=3 etcdctl --endpoints https://127.0.0.1:2379 \
--cacert=/etc/kubernetes/pki/etcd/ca.crt \
--cert=/etc/kubernetes/pki/etcd/peer.crt \
--key=/etc/kubernetes/pki/etcd/peer.key 
member list
​
#移除原有etcd数据存放⽬录
mv /var/lib/etcd /var/lib/bak_etcd
​
ETCDCTL_API=3 etcdctl snapshot restore etcd-snapshot.db \
--cacert=/etc/kubernetes/pki/etcd/ca.crt \
--cert=/etc/kubernetes/pki/etcd/peer.crt \
--key=/etc/kubernetes/pki/etcd/peer.key \
--name=master01 \
--data-dir=/var/lib/etcd \
--skip-hash-check \
--initial-advertise-peer-urls=https://127.0.0.1:2380 \
--initial-cluster="master01=https://127.0.0.1:2380"

 

5. 网络策略

Q: 创建一个名为allow-port-from-namespace的新NetworkPolicy，以允许现有命名空间中的Pod my-app连接到同一命名空间中其他Pod的端口9200。确保新的NetworkPolicy 不允许访问未在端口9200上侦听的Pod,不允许来自不在名称空间my-app中的pod进行访问

参考：

https://kubernetes.io/docs/concepts/services-networking/network-policies/#networkpolicy-resource

https://kubernetes.io/docs/concepts/services-networking/network-policies/#default-deny-all-ingress-traffic

A：

# 切换kubernetes
kubectl config use-context k8s

xxxxxxxxxx
# 配置my-app默认拒绝所有
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
 name: default-deny-ingress
 namespace: my-app
spec:
 podSelector: {}
 policyTypes:
 - Ingress

x
# 并开通Port 9200端⼝访问与my-app命名空间的访问权限
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
 name: allow-port-from-namespace
 namespace: my-app
spec:
 podSelector:
 matchLabels: {}
 policyTypes:
 - Ingress
 ingress:
 - from:
 - namespaceSelector:
 matchLabels:
 project: my-app # 添加my-app的labels，没有labels⼿动添加my-app的label
 ports:
 - protocol: TCP
 port: 9200

6. 服务暴露

Q： 重新配置已经存在的deployment front-end，并添加一个names是http 的80/tcp端口暴露给已存在的nginx容器.创建一个名为front-end-svc的新服务，以暴露容器端口http。

配置新服务，使其还通过节点所在的节点上的NodePort公开各个Pod预定的。

参考: https://kubernetes.io/docs/concepts/services-networking/service/

A:

x
# 切换kubernetes集群
kubectl config use-context k8s
​
# 重新部署front-end
kubectl rollout restart deployment front-end
​
# 添加http 80端⼝（在image字段下添加）
kubectl edit deployment front-end
 ports:
 - name: http
 containerPort: 80
 protocol: TCP
 
# 创建Service
kubectl expose deployment front-end --type=NodePort --port=80 --target-port=80 --
name=front-end-svc

 

7. ingress

Q： 创建一个新的nginx Ingress资源，如下所示：

Name: ping Namespace: ing-internal

Exposing service hello on path /hello using service port 80

参考: https://kubernetes.io/docs/concepts/services-networking/ingress/#the-ingress-resource

A:

# 切换kubernetes集群
kubectl config use-context k8s
​
# 创建ingress
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
 name: ping
 namespace: ing-internal
 annotations:
 nginx.ingress.kubernetes.io/rewrite-target: /
spec:
 rules:
 - host:
 http:
 paths:
 - path: /hello
 backend:
 serviceName: hello
 servicePort: 80

8. 扩缩容

Q： scale the deployment testpod to 4 pods.

A:

xxxxxxxxxx
# 切换kubernetes集群
kubectl config use-context k8s
# 调整副本数
kubectl scale deployment --replicas=4 testpod

9. pod分配

Q： Schedule a pod as follows:

Name: nginx

image: nginx

Node selector: disk=ssd

参考： https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#step-two-add-a-nodeselector-field-to-your-pod-configuration

A:

# 切换kubernetes集群
kubectl config use-context k8s
# 创建pod
apiVersion: v1
kind: Pod
metadata:
 name: nginx
spec:
 containers:
 - name: nginx
 image: nginx
 nodeSelector:
 disk: ssd

 

10. 污点查看

Q： 检查以查看准备就绪的节点数（不包括污染了NoSchedule的节点），然后将编号写入/opt/num.txt。

参考： https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/

A:

x
# 切换kubernetes集群
kubectl config use-context k8s
# 查看数量
kubectl describe nodes | grep -i taint
# 将数字写⼊/opt/num.txt
echo 2 > /opt/num.txt

 

11. 多容器的pod

Q: 创建一个多容器的pod ， nginx + redis + memcached + consul

参考 ： https://kubernetes.io/docs/tasks/access-application-cluster/communicate-containers-same-pod-shared-volume/

A：

# 切换kubernetes集群
kubectl config use-context k8s
# 创建pod
apiVersion: v1
kind: Pod
metadata:
 name: multi-container
spec:
 containers:
 - name: nginx
 image: nginx
  - name: redis
 image: redis
 - name: memcached
 image: memcached
 - name: consul
 image: consul

 

12. 创建pv

Q： 创建一个pv with name app-config,of capacity 4Gi and access mode ReadWriteMany.The type of volume is hostPath and its location is /srv/app-config.

https://kubernetes.io/docs/tasks/configure-pod-container/configure-persistent-volume-storage/#create-a-persistentvolume

A：

x
# 切换kubernetes集群
kubectl config use-context hk8s
​
# 创建pv
apiVersion: v1
kind: PersistentVolume
metadata:
 name: app-config
spec:
 storageClassName: manual
 capacity:
 storage: 4Gi
 accessModes:
 - ReadWriteMany
 hostPath:
 path: /srv/app-config

 

13. pvc使用扩容pv

Q: 创建一个新的pvc ，

名称： pv-volume 类： csi-hostpath-sc 容量： 10Mi

Create a new pod which mounts the PersistenVolumeClaim as a volume: Name: web-server image: nginx Mount path: /usr/share/nginx/html

配置新的Pod以在卷上具有ReadWriteOnce访问权限。

扩容： using kubectl edit or kubectl patch expand the PersistentVolumeClaim to a capacity of 70Mi and record that change

参考： https://kubernetes.io/docs/tasks/configure-pod-container/configure-persistent-volume-storage/

https://kubernetes.io/docs/concepts/storage/storage-classes/#the-storageclass-resource

https://kubernetes.io/zh/docs/concepts/workloads/controllers/deployment/#updating-a-deployment

A:

# 切换kubernetes
kubectl config use-context ok8s
​
# 创建pvc
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
 name: pv-volume
spec:
 storageClassName: csi-hostpath-sc
 accessModes:
 - ReadWriteOnce
 resources:
 requests:
 storage: 10Mi
 
# 创建pod
apiVersion: v1
kind: Pod
metadata:
 name: web-server
spec:
 volumes:
 - name: task-pv-storage
 persistentVolumeClaim:
 claimName: pv-volume
 containers:
 - name: task-pv-container
 image: nginx
 volumeMounts:
 - mountPath: /usr/share/nginx/html
 name: task-pv-storage
 
​
 # 修改容量前，需要先更新storageclass
kubectl edit storageclass csi-hostpath-sc
​
# 注意需要添加下列字段
 allowVolumeExpansion: true
 
# 修改pvc容量
kubectl edit pvc pv-volume --record

 

14. 日志

Q: 监视pod bar的日志，并提取 error file-not-found 相对应的日志行，将它们写到/opt/test/bar

A:

# 切换kubernetes集群
kubectl config use-context k8s
​
# 查看logs
kubectl logs bar | grep file-not-found > /opt/test/bar

 

15. sidecar

Q: 在现有的pod legacy-app中添加一个busybox sidecar容器。新的sidecat容器必须运行

/bin/sh -c tail -n+1 /var/log/legacy-app.log

使用名为log的卷挂载使文件/var/log/legacy-app.log 可用于sidecar容器。 不要修改现有容器。 不要修改日志文件的路径，两个容器都必须在/ var/log/legacy-app.log中访问它。

参考： https://kubernetes.io/zh/docs/concepts/storage/volumes/#emptydir

 

A：

# 切换kubernetes集群
kubectl config use-context k8s
​
#备份yaml
kubectl get podname -o yaml > 1.yaml
cp 1.yaml 2.yaml
​
#编辑修改
    volumeMounts:
    - name: logs
      mountPath: /var/log
  - name: count-log-1
    image: busybox
    args: [/bin/sh, -c, 'tail -n+1 -f /var/log/legacy-ap.log']
    volumeMounts:
    - name: varlog
      mountPath: /var/log
  volumes:
  - name: logs
    emptyDir: {}
​
#重新部署pod
kubectl apply -f 1.yaml --force

 

16. labels

Q: 从pod标签name = overloaded-cpu中，找到运行高cpu工作负载的pod，并写出pod的名称 消耗最多的cpu到文件 /opt/test1.txt（已存在）。

A：

x
# 切换kubernetes集群
kubectl config use-context k8s
​
# 查看pod名称
kubectl top pod -l name=overloaded-cpu --all-namespace --sort-by=cpu
​
# 将cpu占⽤最多的pod的name写⼊/opt/test1.txt⽂件
echo test-pod > /opt/test1.txt

 

17. 故障处理

Q: 一个名为wk8s-node-0的kubernetes woker节点处于未就绪状态。调查这种情况的原因，以及 执行任何适当的步骤以使节点进入“就绪”状态，以确保进行了任何更改永恒的

A：

#登录故障节点
ssh wk8s-node-0
​
# 提成权限
sudo -i
​
#启动服务，并设置为开机⾃启动
systemctl restart kubelet 
systemctl enable kubelet