Kubernetes: Kubernetes 示例

apiVersion: v1
data:
  mysql.db.database: nacos
  mysql.db.name: rm.com
  mysql.db.password: 4|K0/Bl@s_ABzQK8F4ji
  mysql.db.port: "3306"
  mysql.db.user: nacos_rw
kind: ConfigMap
metadata:
  name: nacos-cm
  namespace: english-prod

apiVersion: autoscaling/v2beta2
kind: HorizontalPodAutoscaler
metadata:
  name: data-point-server-admin
  namespace: english-prod
spec:
  maxReplicas: 12
  metrics:
  - resource:
      name: memory
      target:
        averageUtilization: 80
        type: Utilization
    type: Resource
  minReplicas: 2
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: data-point-server-admin

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$1
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
  generation: 7
  name: etp-agent
  namespace: english-prod
spec:
  rules:
  - host: new.xxx.com
    http:
      paths:
      - backend:
          serviceName: english-etp-page
          servicePort: 8090
        path: /(.*)
        pathType: ImplementationSpecific
      - backend:
          serviceName: english-etp-page-new
          servicePort: 8090
        path: /new/(.*)
        pathType: ImplementationSpecific
  tls:
  - hosts:
    - new.xxx.com  # SSL 证书对应的域名 (必填)。
    secretName: xxxcom
status:
  loadBalancer:
    ingress:
    - ip: 39.103.36.c

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/actions.forward-summy-sc-gateway: |
      {"type":"forward","forwardConfig":{"targetGroups":[{"serviceName":"gateway","servicePort":18085,"weight":0},{"serviceName":"gateway-common","servicePort":18085,"weight":100}],"targetGroupStickinessConfig":{"enabled":true,"durationSeconds":300}}}
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:ap-south-1:<ACCOUNT_ID>:certificate/582fb25b-d603-49f4-9970-8b80d8157370
    alb.ingress.kubernetes.io/healthcheck-interval-seconds: "30"
    alb.ingress.kubernetes.io/healthcheck-path: /api/health/check
    alb.ingress.kubernetes.io/healthcheck-timeout-seconds: "25"
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/ssl-policy: ELBSecurityPolicy-TLS-1-2-2017-01
    alb.ingress.kubernetes.io/tags: Environment=Production,BusinessUnit=CICI,Name=CICI-NewRu-SC,Owner=Klas.m,Techteam=PFChina,Application=Ru,public-sg=true,IgnoreCostAdvisor=true,SubModule=Ru-sc
    alb.ingress.kubernetes.io/target-type: ip
    kubernetes.io/ingress.class: alb
  name: gateway
  namespace: rummy-sc
spec:
  rules:
  - http:
      paths:
      - backend:
          service:
            name: forward-summy-sc-gateway
            port:
              name: use-annotation
        path: /api/user/appLog/submitLogV2
        pathType: ImplementationSpecific
      - backend:
          service:
            name: forward-summy-sc-gateway
            port:
              name: use-annotation
        path: /api/user/appLog/submitPokerLog
        pathType: ImplementationSpecific
      - backend:
          service:
            name: gateway
            port:
              number: 18085
        path: /*
        pathType: ImplementationSpecific

-----
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: es-new
  namespace: "public-middleware"
  annotations:
    kubernetes.io/ingress.class: "alb"
    alb.ingress.kubernetes.io/group.name: "ops-internet-facing" #同一组名下所有Ingress共用一个alb
    alb.ingress.kubernetes.io/group.order: "10" # 0-1000可取 0优先级最高，不支持重复
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/success-codes: '200'
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS": 443}]'
    alb.ingress.kubernetes.io/healthcheck-path: /
    alb.ingress.kubernetes.io/healthcheck-port: "9200"
    alb.ingress.kubernetes.io/backend-protocol: HTTP
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:ap-south-1:<ACCOUNT_ID>:certificate/582fb25b-d603-49f4-9970-8b80d8157370
spec:
  rules:
    - host: "ops-es-new.cici.com"
      http:
        paths:
          - pathType: ImplementationSpecific
            path: /*
            backend:
              service:
                name: elasticsearch-log-master
                port:
                  number: 9300             

#callbreak-cms-site-ingress.yaml
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: callbreak-cms-site
  namespace: callbreak
  annotations:
    kubernetes.io/ingress.class: "alb"
    #alb.ingress.kubernetes.io/healthcheck-path: /api/pub/health
    #alb.ingress.kubernetes.io/healthcheck-port: '10904'
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/ssl-policy: ELBSecurityPolicy-TLS-1-2-2017-01
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:ap-south-1:<ACCOUNT_ID>:certificate/582fb25b-d603-49f4-9970-8b80d8157370
    alb.ingress.kubernetes.io/tags: Environment=Production,BusinessUnit=CICI,Name=CICI-Callbreak,Owner=Klas.m,Techteam=CICI-China,Application=Ru,Module=Ru-callbreak,SubModule=Ru-callbreak,IgnoreCostAdvisor=true,public-sg=true
    alb.ingress.kubernetes.io/actions.response-444: >
      {"type":"fixed-response","fixedResponseConfig":{"contentType":"text/plain","statusCode":"444","messageBody":"Access blocked by Admin"}}
spec:
  rules:
  - host: callbreakcms.cici.com
    http:
      paths:
        - path: /api/actuator*
          backend:
            serviceName: response-444
            servicePort: use-annotation
        - path: /*
          backend:
            serviceName: callbreak-cms-site
            servicePort: 80


apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/actions.response-444: |
      {"type":"fixed-response","fixedResponseConfig":{"contentType":"text/plain","statusCode":"444","messageBody":"Access blocked by Admin"}}
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:ap-south-1:<ACCOUNT_ID>:certificate/582fb25b-d603-49f4-9970-8b80d8157370
    alb.ingress.kubernetes.io/group.name: callbreak-backstage
    alb.ingress.kubernetes.io/group.order: "900"
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS": 443}]'
    alb.ingress.kubernetes.io/load-balancer-name: callbreak-slb-ingress-backstage
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/security-groups: sg-0e9a3835c5f401d15, sg-0c30c767ba9769b64
    alb.ingress.kubernetes.io/ssl-policy: ELBSecurityPolicy-2016-08
    alb.ingress.kubernetes.io/subnets: subnet-3fa2cc56, subnet-68e94425
    alb.ingress.kubernetes.io/tags: Techteam=CICI, Application=Callbreak, IgnoreCostAdvisor=true,
      ignoreoldgen=true, Name=callbreak-slb-ingress-backstage, BusinessUnit=CICI,
      Owner=roy.xi, Environment=Production, Author=jasper.xu
    alb.ingress.kubernetes.io/target-type: ip
    kubernetes.io/ingress.class: alb
  name: callbreakcms.xxx.com
  namespace: callbreak
spec:
  rules:
  - host: callbreakcms.xxx.com
    http:
      paths:
      - backend:
          service:
            name: response-444
            port:
              name: use-annotation
        path: /api/actuator*
        pathType: ImplementationSpecific
      - backend:
          service:
            name: callbreak-cms-site
            port:
              number: 80
        path: /*
        pathType: ImplementationSpecific

# cat admin-website-ingress.yaml
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: 50M
    nginx.ingress.kubernetes.io/proxy-connect-timeout: "600"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
    nginx.ingress.kubernetes.io/server-snippet: |
        location ~* /api/actuator {
            deny all;
        }
    nginx.ingress.kubernetes.io/configuration-snippet: |
        add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload' always;
        more_set_headers "xxerver: hide";
  name: rummy-admin-website
  namespace: rummy
spec:
  rules:
    - host: rummycmsstaging.xxx.com
      http:
        paths:
          - backend:
              serviceName: rummy-admin-website
              servicePort: 80
            path: /

apiVersion: v1
kind: Service
metadata:
  labels:
    app: big-data-student-study-report-generate
    release: prod
  name: big-data-student-study-report-generate
  namespace: english-prod
spec:
  ports:
  - name: big-data-student-study-report-generate
    port: 8090
    protocol: TCP
    targetPort: 8090
  selector:
    app: big-data-student-study-report-generate
    release: prod
  sessionAffinity: None
  type: ClusterIP
status:
  loadBalancer: {}

[jasper.xu@ip-10-204-9-241 dashboard]$ cat account.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cluster-readonly
  namespace: kube-system
#老方法
#secrets:
#- name: cluster-readonly
---
#v1.29 手动为 ServiceAccount 创建长期有效的 API 令牌
apiVersion: v1
kind: Secret
metadata:
  name: cluster-readonly
  namespace: kube-system
  annotations:
    kubernetes.io/service-account.name: "cluster-readonly"
type: kubernetes.io/service-account-token

[jasper.xu@ip-10-204-9-241 dashboard]$ cat readonly.yaml
#apiVersion: v1
#kind: ServiceAccount
#metadata:
#  name: cluster-readonly
#  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cluster-readonly
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - pods/attach
  - pods/exec
  - pods/portforward
  - pods/proxy
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - pods/attach
  - pods/exec
  verbs:
  - create
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - delete
- apiGroups:
  - ""
  resources:
  - configmaps
  - endpoints
  - persistentvolumeclaims
  - replicationcontrollers
  - replicationcontrollers/scale
  - serviceaccounts
  - services
  - services/proxy
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - bindings
  - events
  - limitranges
  - namespaces/status
  - pods/log
  - pods/status
  - replicationcontrollers/status
  - resourcequotas
  - resourcequotas/status
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - namespaces
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - apps
  resources:
  - deployments
  - deployments/rollback
  - deployments/scale
  - statefulsets
  - replicasets
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - autoscaling
  resources:
  - horizontalpodautoscalers
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - batch
  resources:
  - cronjobs
  - jobs
  - scheduledjobs
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - extensions
  resources:
  - daemonsets
  - deployments
  - ingresses
  - replicasets
  verbs:
  - get
  - list
  - watch
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["get", "list", "watch"]
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses
  - ingressclasses
  verbs:
  - list
  - watch
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cluster-readonly
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-readonly
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: develop:readonly
- kind: ServiceAccount
  name: cluster-readonly
  namespace: kube-system

alias gett='kubectl -n kube-system get secret cluster-readonly -o jsonpath={.data.token} | base64 -d'

kubectl config set-context $(kubectl config current-context) --namespace  kube-system
#secret=$(kubectl get sa cluster-readonly -o json | jq -r .secrets[].name)  #v1.29之前
secret=cluster-readonly

# 获取ca
kubectl get secrets $secret  -o "jsonpath={.data['ca\.crt']}"
#kubectl get secret $secret -o json | jq -r '.data["ca.crt"]' | base64 -d > ca.crt

#获取token
#kubectl get secret $secret -o json | jq -r '.data["token"]' | base64 -d
kubectl get secret $secret -n kubernetes-dashboard -o jsonpath={".data.token"} | base64 -d

kubectl config set-context $(kubectl config current-context) --namespace  kube-system
#secret=$(kubectl get sa cluster-readonly -o json | jq -r .secrets[].name)  #v1.29之前
secret=cluster-readonly

#获取token
user_token=$(kubectl -n kube-system get secret $secret -o jsonpath={".data.token"} | base64 -d)
server="https://66F42A859F2A1D83394D56B7F7018F92.sk1.ap-south-1.eks.amazonaws.com"

# set-cluster：设置一个集群项，
kubectl config set-cluster eks-prod \
     --insecure-skip-tls-verify=true \
     --server=$server \
     --kubeconfig=./config

# set-credentials 设置一个用户项
kubectl config set-credentials dashboard-readonly \
     --token="${user_token}" \
     --kubeconfig=./config

# 设置一个环境项，一个上下文
kubectl config set-context dashboard-readonly --cluster=eks-prod \
    --user=dashboard-readonly \
    --kubeconfig=./config


# 使用某个环境当做默认环境
kubectl config use-context dashboard-readonly --kubeconfig=./config

# 验证
kubectl --kubeconfig=./config get po -n kube-system

apiVersion: v1
clusters:
- cluster:
    insecure-skip-tls-verify: true
    server: https://66F42A859F2A1D83394D56B7F7018F92.sk1.ap-south-1.eks.amazonaws.com
  name: eks-prod
contexts:
- context:
    cluster: eks-prod
    user: dashboard-readonly
  name: dashboard-readonly
current-context: dashboard-readonly
kind: Config
preferences: {}
users:
- name: dashboard-readonly
  user:
    token: eyJhbGciOiJSUzI1NiIsImtpZCI6IkwwLUpvOVZyVE9pUWVfSl96VWJOUExrZ01tU3pEbDRFaFhxZTBmYVY2Y0EifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJjbHVzdGVyLXJlYWRvbmx5LXRva2VuLXpjc2pqIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImNsdXN0ZXItcmVhZG9ubHkiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiI0MmI4MDk2Yi1jOWZlLTRhODEtYTU3Mi1lYjE1OTJhZDY3MmEiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZS1zeXN0ZW06Y2x1c3Rlci1yZWFkb25seSJ9.UYMY6VFf9UjqIGRBsjp1o2ttCIAHbExo_y3TmThecUCYgMmNjEagRbaAFPxRHLiUj5PVBRdd6gtYnW5YCvQ3u91OothCjQUDDudb8ldYqkHKRoKYUO6xJ3VoRaV4MG7nUwlXyc6pX8Szaj0ZXbkBY4Uqywf2dsJdiaLgEgCPV-dldGdyedUuSWZNUwI1eCd3Hycjjxlc331-1oOSVFj2VmLmL3tkeIV-hIVhIamc7tgE0hnTo-WuT8oCTIJnsH4t6dF1Q4MidG-7rRypsKi9rCBKbAiiG6lXD7B2DN8LaO_bdNBuQh7N1IWAJPshDq2OmsVhcMuT2nsqGY9Ta0SZUQ

alias kcn='kubectl config set-context $(kubectl config current-context) --namespace'
alias kgp='kubectl get pods'
alias kf='kubectl apply -f'

alias cdg='cd /data/prod-k8s/'
alias cp='cp -i'
alias egrep='egrep --color=auto'
alias fgrep='fgrep --color=auto'
alias grep='grep --color=auto'
alias k='kubectl'
alias kaf='kubectl apply -f'
alias kca='f(){ kubectl "$@" --all-namespaces;  unset -f f; }; f'
alias kccc='kubectl config current-context'
alias kcd='kubectl config set-context $(kubectl config current-context) --namespace'
alias kcdc='kubectl config delete-context'
alias kcg='k config get-contexts'
alias kcgc='kubectl config get-contexts'
alias kcn='kubectl config set-context $(kubectl config current-context) --namespace'
alias kcp='kubectl cp'
alias kcsc='kubectl config set-context'
alias kcu='k config use-context'
alias kcuc='kubectl config use-context'
alias kd='kubectl describe'
alias kdcm='kubectl describe configmap'
alias kdd='kubectl describe deployment'
alias kdel='kubectl delete'
alias kdelcm='kubectl delete configmap'
alias kdeld='kubectl delete deployment'
alias kdelf='kubectl delete -f'
alias kdeli='kubectl delete ingress'
alias kdelno='kubectl delete node'
alias kdelns='kubectl delete namespace'
alias kdelp='kubectl delete pods'
alias kdelpvc='kubectl delete pvc'
alias kdels='kubectl delete svc'
alias kdelsec='kubectl delete secret'
alias kdelss='kubectl delete statefulset'
alias kdi='kubectl describe ingress'
alias kdno='kubectl describe node'
alias kdns='kubectl describe namespace'
alias kdp='kubectl describe pods'
alias kdpvc='kubectl describe pvc'
alias kds='kubectl describe svc'
alias kdsec='kubectl describe secret'
alias kdss='kubectl describe statefulset'
alias ke='kubectl edit'
alias kecm='kubectl edit configmap'
alias ked='kubectl edit deployment'
alias kei='kubectl edit ingress'
alias keno='kubectl edit node'
alias kens='kubectl edit namespace'
alias kep='kubectl edit pods'
alias kepvc='kubectl edit pvc'
alias kes='kubectl edit svc'
alias kess='kubectl edit statefulset'
alias keti='kubectl exec -ti'
alias kg='kubectl get'
alias kga='kubectl get all'
alias kgaa='kubectl get all --all-namespaces'
alias kgap='kubectl get pods --all-namespaces'
alias kgc='kubectl get configmap'
alias kgcm='kubectl get configmaps'
alias kgd='kubectl get deployment'
alias kgdw='kgd --watch'
alias kgdwide='kgd -o wide'
alias kgi='kubectl get ingress'
alias kgm='kubectl get servicemonitor'
alias kgn='kubectl get namespace'
alias kgno='kubectl get nodes'
alias kgns='kubectl get namespaces'
alias kgp='kubectl get pods'
alias kgpa='kubectl get pods --all-namespaces'
alias kgpl='kgp -l'
alias kgpvc='kubectl get pvc'
alias kgpvcw='kgpvc --watch'
alias kgpw='kgp --watch'
alias kgpwide='kgp -o wide'
alias kgrs='kubectl get rs'
alias kgs='kubectl get service'
alias kgsec='kubectl get secret'
alias kgss='kubectl get statefulset'
alias kgssw='kgss --watch'
alias kgsswide='kgss -o wide'
alias kgsw='kgs --watch'
alias kgswide='kgs -o wide'
alias kl='kubectl logs'
alias klf='kubectl logs -f'
alias kp='kubectl port-forward'
alias krh='kubectl rollout history'
alias krsd='kubectl rollout status deployment'
alias krsss='kubectl rollout status statefulset'
alias kru='kubectl rollout undo'
alias ksd='kubectl scale deployment'
alias ksss='kubectl scale statefulset'
alias kx='kubectl exec'
alias l.='ls -d .* --color=auto'
alias ll='ls -l --color=auto'
alias ls='ls --color=auto'
alias mv='mv -i'
alias pull_prod_k8s='git pull origin master'
alias rm='rm -i'
alias which='alias | /usr/bin/which --tty-only --read-alias --show-dot --show-tilde'