cka真题2

1、RBAC

kubectl create clusterrole deployment-clusterrole --verb=create --resource=Deployments,StatefulSets,DaemonSet
kubectl create serviceaccount cicd-token -n app-team1
kubectl create rolebinding cicd-token-clusterrole --clusterrole=deployment-clusterrole --serviceaccount=app-team1:cicd-token

2、设置节点不可用

Flag this to return to later | I am satisfied,next
 将此标记为稍后返回                                    我满足,下一个
-------------------------------------------------
kubectl cordon ek8s-node-1
kubectl drain ek8s-node-1 --ignore-daemonsets

3、升级k8s版本

kubectl drain mk8s-master-0 --ignore-daemonsets
ssh mk8s-master-0
sudo -i
apt install kubeadm=1.20.1-00 -y
kubeadm version
kubeadm upgrade plan
kubeadm upgrade apply v1.212.1 --etcd-upgrade=false
apt install kubectl=1.21.1-00 kubelet=1.21.1-00 -y
systemctl daemon-reload
systemctl restart kubelet
kubectl get nodes
kubectl uncordon mk8s-master-0

4、etcd备份和恢复

ETCDCTL_API=3 etcdctl snapshot save /data/backup/etcd-snapshot.db --cacert=ca.crt --cert=etcd-client.crt --key=etcd-client.key
systemctl stop etcd
systemctl cat etcd
mv etcd目录 etcd-bak
ETCDCTL_API=3 etcdctl snapshot restore 恢复文件位置 --endpoints=https://127.0.0.1:2379 --data-dir=etcd数据目录
chown -R etcd:etcd etcd数据目录
systemctl start etcd

5、网络策略

kubectl label ns big-corp name=big-corp
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-port-from-namespace
  namespace: my-app
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: big-corp
    ports:
    - protocol: TCP
      port: 8080

6、SVC暴露

kubectl edit deployment front-end
...
      containers:
      - image: nginx
        imagePullPolicy: Always
        name: nginx
        ports:
        - name: http
          protocol: TCP
          containerPort: 80
...
kubectl expose deployment fron-end --type=NodePort --port=80 --target-port=80 --name fron-end-svc

7、Ingress

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: pong
  namespace: ing-internal
spec:
  rules:
  - host: 
    http:
      paths:
      - pathType: Prefix
        path: "/hello"
        backend:
          service:
            name: hello
            port:
              number: 5678
kubectl get ingress -n ing-internal
curl -kL <ingressIP>:/hello

8、扩容pod数量

kubectl scale deployment loadbalancer --replicas=5

9、nodeSelector

apiVersion: v1
kind: Pod
metadata:
  name: nginx-kusc0041
spec:
  containers:
  - name: nginx
    image: nginx
  nodeSelector:
    disk: ssd

10、统计就绪节点数量

kubectl describe node $(kubectl get nodes | grep -v NotReady | grep Ready | awk '{print $1}') | grep Taint | grep -vc NoSchedule > 文件位置

11、配置多容器

apiVersion: v1
kind: Pod
metadata:
  labels:
    run: kuc4
  name: kuc4
spec:
  containers:
  - image: nginx
    name: kuc4
  - image: redis
    name: redis
  - image: memcached
    name: memcached

12、pv

apiVersion: v1
kind: PersistentVolume
metadata:
  name: app-data
spec:
  capacity:
    storage: 2Gi
  accessModes:
    - ReadWriteOnce
  hostPath:
    path: "/srv/app-data"

13、PVC

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pv-volume
spec:
  storageClassName: csi-hostpath-sc
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi
---
apiVersion: v1
kind: Pod
metadata:
  name: web-server
spec:
  volumes:
    - name: task-pv-storage
      persistentVolumeClaim:
        claimName: pv-volume
  containers:
    - name: web-server
      image: nginx
      volumeMounts:
        - mountPath: "/usr/share/nginx/html"
          name: task-pv-storage
kubectl edit pvc pv-volume --save-config

14、获取错误日志

kubectl logs footbar | grep file-not-found | tee 日志文件

15、边车容器

apiVersion: v1
kind: Pod
metadata:
  name: legacy-app
spec:
  containers:
  - name: legacy-app
    image: busybox
    args:
    - /bin/sh
    - -c
    - >
      i=0;
      while true;
      do
        echo "$i: $(date)" >> /var/log/1.log;
        echo "$(date) INFO $i" >> /var/log/2.log;
        i=$((i+1));
        sleep 1;
      done      
    volumeMounts:
    - name: varlog
      mountPath: /var/log
  - name: sidecar
    image: busybox
    args: [/bin/sh, -c, 'tail -n+1 -f /var/log/legacy-app.log']
    volumeMounts:
    - name: varlog
      mountPath: /var/log
  volumes:
  - name: varlog
    emptyDir: {}

16、统计使用CPU最高的Pod

kubectl top pod -l name=cpu-utilizer --sort-by=cpu -A
echo "<pod-name>" > 文件位置

17、节点NotReady处理

ssh ..
sudo -i 
systemctl status kubelet
systemctl start kubelet
kubeclt get nodes