9、Service资源管理

[root@node1 ~]# cat service.yaml
apiVersion: v1
kind: Service
metadata:
  name: ccesvc
spec:
  ports:
  - port: 80 # Service端口
    protocol: TCP
    targetPort: 80 # 后端Pod端口
  selector: # 利用标签选择器来关联后端Pod
    app: cce
        # 我们的Service也不是直接到后端的Pod对象的，而是通过我们的Endpoint，Endpoints表示一个Service对应的所有Pod副本的访问地址，而Endpoints Controller就是负责生成和维护所有Endpoints对象的控制器.它负责监听Service和对应的Pod副本的变化，如果检测到Service被删除，则删除和该Service同名的Endpoints对象。如果检测到新的Service被创建或者修改则根据该Service信息获得相关的Pod列表，然后创建或者更新Service对应的Endpoints对象；
        # 创建一个Service会立马创建一个endpoint，kube-proxy会监控当前主机的Pod的变化，同时也会监控endpoint相关数据，一旦有后端的Pod的label符合endpoint的label就会将其加入endpoint作为后端服务端之一，如果一旦该Pod发生变化会立即剔除；
        # Service关联的是Endpoint，而Endpoint通过IP地址+端口关联Pod；
# 查看当前的Pod
[root@node1 ~]# kubectl get pods --show-labels                             
NAME READY STATUS RESTARTS AGE LABELS
cce-fcd4c8cff-bqvrt 1/1 Running 0 26m app=cce,pod-template-hash=fcd4c8cff
# 查看当前的endpoint
[root@node1 ~]# kubectl get endpoints                                      
NAME ENDPOINTS AGE
ccesvc <none> 4m40s  # 此时ccesvc后端没有Pod
kubernetes 172.16.1.2:6443 11d
# 修改Pod的label让endpoint能关联到
[root@node1 ~]# kubectl label pods cce-fcd4c8cff-bqvrt --overwrite app=ce  
pod/cce-fcd4c8cff-bqvrt labeled
# 重新查看，Pod已经关联至Endpoint
[root@node1 ~]# kubectl get endpoints                                     
NAME ENDPOINTS AGE
ccesvc 10.244.2.4:80 4m46s
kubernetes 172.16.1.2:6443 11d

[root@node1 ~]# cat service.yaml
apiVersion: v1
kind: Service
metadata:
  name: ccesvc
spec:
  type: NodePort
  ports:
  - port: 80 # Service端口，NodePort不对丢球ClusterIP原有的特性
    protocol: TCP
    nodePort: 30080 # 只有type为NodePort的时候才能使用nodePort字段，这个字段一般不写，随机
    targetPort: 80 # 后端Pod端口
  selector:
    app: cce
查看创建的Service
[root@node1 ~]# kubectl get service
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
ccesvc NodePort 10.106.142.19 <none> 80:30080/TCP 2m38s
kubernetes ClusterIP 10.96.0.1 <none> 443/TCP 11d
使用clusterip的方式访问，nodeport不会丢弃clusterip的特性
[root@node1 ~]# curl 10.106.142.19/hostname.html
cce-fcd4c8cff-95sch
使用nodeport的方式访问
[root@node1 ~]# curl 127.0.0.1:30080/hostname.html
cce-fcd4c8cff-95sch

启用ipvs模块
[root@node1 ~]# cat /etc/sysconfig/modules/ipvs.modules          
#!/bin/bash
ipvs_mods_dir="/usr/lib/modules/$(uname -r)/kernel/net/netfilter/ipvs"
for mod in $(ls $ipvs_mods_dir | grep -o "^[^.]*"); do
    /sbin/modinfo -F filename $mod &> /dev/null
    if [ $? -eq 0 ]; then
        /sbin/modprobe $mod
    fi
done
修改configmap里面的代理方式mode: "ipvs"，还可以在ipvs.scheduler字段定义调度算法，默认是rr；
[root@node1 ~]# kubectl edit configmap -n kube-system kube-proxy
安装ipvsadm控制器管理工具
[root@node1 ~]# yum install -y ipvsadm
因为创建集群时使用的iptables创建的kube-proxy，现手动删除原Pod，会自动重建
[root@node1 ~]# kubectl delete pods -n kube-system -l controller-revision-hash=68594d95c
此时我们的ipvsadm就可以看到数据了
[root@node1 ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 10.96.0.1:443 rr
  -> 172.16.1.2:6443 Masq 1 0 0         
TCP 10.96.0.10:53 rr
  -> 10.244.1.3:53 Masq 1 0 0         
  -> 10.244.2.3:53 Masq 1 0 0         
TCP 10.96.0.10:9153 rr
  -> 10.244.1.3:9153 Masq 1 0 0         
  -> 10.244.2.3:9153 Masq 1 0 0         
UDP 10.96.0.10:53 rr
  -> 10.244.1.3:53 Masq 1 0 0         
  -> 10.244.2.3:53 Masq 1 0 0   

[root@node1 ~]# cat pod.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    author: caichangen
  name: ccepod
  namespace: ccenamespace
spec:
  replicas: 3
  selector:
    matchLabels:
      podtype: deploy
  template:
    metadata:
      name: ccepod
      namespace: ccenamespace
      labels:
        podtype: deploy
    spec:
      restartPolicy: Always
      containers:
      - image: ikubernetes/myapp:v1
        name: ccecontainers
[root@node1 ~]# cat service.yaml
apiVersion: v1
kind: Service
metadata:
  name: cceservice
  namespace: ccenamespace
spec:
  externalIPs: # externalIPs向外部暴露集群内部的服务的通讯地址,暴露给外部的IP
  - 172.16.1.2
  - 172.16.1.3
  ports:
  - protocol: TCP # 传输协议
    port: 80 # 暴露给外部的端口
    targetPort: 80 # 集群内部Pod的端口
  selector:
    podtype: deploy # 标签选择器，用于选择Pod
[root@node1 ~]# curl -o /dev/null -s -w %{http_code} http://172.16.1.2
200

# 创建两个自主式Pod
[root@node01 ~]# cat pod.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: pod1
  labels:
    app: pod1
spec:
  containers:
    - name: pod1
      image: ikubernetes/myapp:v1
      imagePullPolicy: IfNotPresent
  restartPolicy: Always
---
apiVersion: v1
kind: Pod
metadata:
  name: pod2
  labels:
    app: pod2
spec:
  containers:
    - name: pod2
      image: ikubernetes/myapp:v2
      imagePullPolicy: IfNotPresent
  restartPolicy: Always
[root@node01 ~]# kubectl apply -f pod.yaml
[root@node01 ~]# kubectl get pods -o wide
NAME   READY   STATUS    RESTARTS   AGE   IP           NODE             NOMINATED NODE   READINESS GATES
pod1   1/1     Running   0          24s   172.20.3.2   node03.cce.com   <none>           <none>
pod2   1/1     Running   0          24s   172.20.3.3   node03.cce.com   <none>           <none>
# 分别请求两个Pod，可以看到分别是v1和v2
[root@node02 ~]# curl 172.20.3.2
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>
[root@node02 ~]# curl 172.20.3.3
Hello MyApp | Version: v2 | <a href="hostname.html">Pod Name</a>
# 创建Endpoint，将这两个Pod集合到一个端点
[root@node01 ~]# cat endpoints.yaml 
apiVersion: v1
kind: Endpoints
metadata:
  name: pod
subsets:
  - addresses:
      - ip: 172.20.3.2
      - ip: 172.20.3.3
    ports:
      - port: 80
        protocol: TCP
[root@node01 ~]# kubectl apply -f endpoints.yaml 
[root@node01 ~]# kubectl get endpoints pod 
NAME   ENDPOINTS                     AGE
pod    172.20.3.2:80,172.20.3.3:80   34s
# 上面已经将所有的Pod集合在一个端点了，那么接下来就创建一个Servce，对外提供服务，Service需要与Endpoint同名
[root@node01 ~]# cat service.yaml 
apiVersion: v1
kind: Service
metadata:
  name: pod
spec:
  ports:
    - port: 8080
      protocol: TCP
      targetPort: 80
[root@node01 ~]# kubectl apply -f service.yaml
# 看到下面，可以看出，当我们的Service创建之后，自动关联我们在上面创建的Endpoint
[root@node01 ~]# kubectl describe svc pod 
Name:              pod
Namespace:         default
Labels:            <none>
Annotations:       kubectl.kubernetes.io/last-applied-configuration:
                     {"apiVersion":"v1","kind":"Service","metadata":{"annotations":{},"name":"pod","namespace":"default"},"spec":{"ports":[{"port":8080,"protoc...
Selector:          <none>
Type:              ClusterIP
IP:                10.10.17.77
Port:              <unset>  8080/TCP
TargetPort:        80/TCP
Endpoints:         172.20.3.2:80,172.20.3.3:80
Session Affinity:  None
Events:            <none>
# 测试请求Service的地址
[root@node02 ~]# curl 10.10.17.77:8080
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>
[root@node02 ~]# curl 10.10.17.77:8080
Hello MyApp | Version: v2 | <a href="hostname.html">Pod Name</a>
# 可以发现是v1和v2，到此为止，我们的内部服务已经成功通过Endpoint结合Service进行了服务暴露

# 在集群之外的主机安装Mariadb用于测试
[root@node04 ~]# yum install -y mariadb-server
[root@node04 ~]# systemctl start mariadb
# 授权任何主机都可以连接
[root@node04 ~]# mysql -e "grant all on *.* to 'root'@'%';"
# 创建Endpoint，将node04上面Maradb加入该Endpoint
[root@node01 ~]# cat endpoints.yaml 
apiVersion: v1
kind: Endpoints
metadata:
  name: mysqlconn
subsets:
  - addresses:
      - ip: 172.16.1.4
    ports:
      - port: 3306
[root@node01 ~]# kubectl apply -f endpoints.yaml
# 创建Service，将上面的Endpoint提供一个固定的访问端点
[root@node01 ~]# cat service.yaml
apiVersion: v1
kind: Service
metadata:
  name: mysqlconn
spec:
  clusterIP: 10.10.0.10
  ports:
    - port: 30000
      protocol: TCP
      targetPort: 3306
[root@node01 ~]# kubectl apply -f service.yaml
# 查看创建出来的Service，可以看到我们的ServiceIP，并且我们的连接端口为30000
[root@node01 ~]# kubectl describe svc mysqlconn 
Name:              mysqlconn
Namespace:         default
Labels:            <none>
Annotations:       kubectl.kubernetes.io/last-applied-configuration:
                     {"apiVersion":"v1","kind":"Service","metadata":{"annotations":{},"name":"mysqlconn","namespace":"default"},"spec":{"clusterIP":"10.10.0.10...
Selector:          <none>
Type:              ClusterIP
IP:                10.10.0.10
Port:              <unset>  30000/TCP
TargetPort:        3306/TCP
Endpoints:         172.16.1.4:3306
Session Affinity:  None
Events:            <none>
# 创建一个测试的自主式Pod，用于测试连接
[root@node01 ~]# cat pod.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: mclient
  labels:
    app: mclient
spec:
  nodeSelector:
    kubernetes.io/hostname: node02.cce.com
  containers:
    - name: mclient
      image: widdpim/mysql-client:latest
      imagePullPolicy: IfNotPresent
      command:
        - /bin/sleep
        - '10000000000'
  restartPolicy: Always
[root@node01 ~]# kubectl apply -f pod.yaml
# 进入Pod，测试通过ServiceIP连接外部的Mariadb
[root@node01 ~]# kubectl exec -it mclient -- bash
[root@mclient /]# mysql -h 10.10.0.10 -P 30000
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 4
Server version: 5.5.60-MariaDB MariaDB Server
Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql>
# 测试连接成功