Linux云计算虚拟化-部署k8s容器集群管理系统及使用容器部署nginx和tomcat应用

我会带着你远行 2022-12-29 02:12 362阅读 0赞

### 文章目录 ###

*  Linux云计算虚拟化-部署k8s容器集群管理系统及使用容器部署nginx和tomcat应用
 *   *  1. 实验环境准备
     *  2. 安装docker，各个节点都要安装
     *  3. 加载ipvs模块，各个节点都要
     *  4. 使用kubeadm部署k8s集群
     *  4. 安装k8s网络组件-calico
     *  5. 添加node节点到k8s集群
     *  6. 安装k8s的管理面板dashboard
     *  7. 登录k8s dashboard
     *  8. 使用k8s dashboard创建容器及部署nginx
     *  9. k8s服务发现和负载均衡
     *  10. 通过编写k8s资源清单yaml文件部署tomcat网站

# Linux云计算虚拟化-部署k8s容器集群管理系统及使用容器部署nginx和tomcat应用 #

## 1. 实验环境准备 ##

<table> 
 <thead> 
  <tr> 
   <th>IP</th> 
   <th>主机名</th> 
   <th>角色</th> 
   <th>配置</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>外网IP：192.168.8.144</td> 
   <td>master</td> 
   <td>master</td> 
   <td>内存：4G<br>cpu：8核</td> 
  </tr> 
  <tr> 
   <td>外网IP：192.168.8.145</td> 
   <td>slave</td> 
   <td>node</td> 
   <td>内存：4G<br>cpu：8核</td> 
  </tr> 
 </tbody> 
</table>

这里建议使用可访问外网的**静态IP**部署。因为在部署k8s时，若`master`节点的IP地址发生变化，集群就需要重新配置了。

**①各个节点都要配置网络yum源**：`https://developer.aliyun.com/mirror/`  
以下源可以直接从**aliyun**获取。

# 下载centos7和epel源
    [root@master ~]# mv /etc/yum.repos.d/* /opt
    [root@master ~]# wget -O /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-7.repo
    [root@master ~]# wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
    
    # 编写k8s源
    cat <<EOF > /etc/yum.repos.d/kubernetes.repo
    [kubernetes]
    name=Kubernetes
    baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
    enabled=1
    gpgcheck=1
    repo_gpgcheck=1
    gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
    EOF
    
    [root@master ~]# ll /etc/yum.repos.d/
    总用量 12
    -rw-r--r--. 1 root root 2523 6月  16 2018 CentOS-Base.repo
    -rw-r--r--. 1 root root  664 5月  11 2018 epel.repo
    -rw-r--r--. 1 root root  276 12月 16 22:56 kubernetes.repo
    [root@master ~]# scp /etc/yum.repos.d/* root@192.168.10.20:/etc/yum.repos.d/
    [root@slave ~]# ll /etc/yum.repos.d/
    总用量 12
    -rw-r--r--. 1 root root 2523 12月 16 23:01 CentOS-Base.repo
    -rw-r--r--. 1 root root  664 12月 16 23:01 epel.repo
    -rw-r--r--. 1 root root  276 12月 16 23:01 kubernetes.repo
    
    # 各个节点都更新下yum缓存
    [root@master ~]# yum clean all
    [root@master ~]# yum makecache

**②各个节点都要安装依赖包，包括docker的和系统要用的**

[root@master ~]# yum -y install yum-utils device-mapper-persistent-data lvm2 wget net-tools nfs-utils lrzsz gcc gcc-c++ make cmake libxml2-devel openssl-devel curl curl-devel unzip sudo ntp libaio-devel wget vim ncurses-devel autoconf automake zlib-devel python-devel epel-release openssh-server socat ipvsadm conntrack ntpdate

**③各个节点都要关闭防火墙firewalld、禁用selinux及开启ntp时间同步**

[root@master ~]# systemctl stop firewalld && systemctl disable firewalld
    [root@master ~]# sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
    [root@master ~]# sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/sysconfig/selinux
    
    # 每小时同步一次系统时间
    [root@master ~]# ntpdate ntp1.aliyun.com
    [root@master ~]# which ntpdate
    /usr/sbin/ntpdate
    [root@master ~]# crontab -e
    * */1 * * * /usr/sbin/ntpdate ntp1.aliyun.com
    
    # 保证两台主机能互相识别主机名
    [root@master ~]# vim /etc/hosts
    192.168.8.144 master
    192.168.8.145 slave

**④各个节点都要关闭交换分区以及永久禁用交换分区，防止内存交换。**

[root@master ~]# swapoff -a # 临时取消挂载交换分区
    [root@master ~]# sed -i 's/.*swap.*/#&/g' /etc/fstab # 在含有关键词swap的行前加上注释符#
    
    # 修改内核参数
    cat <<EOF > /etc/sysctl.d/k8s.conf
    net.bridge.bridge-nf-call-ip6tables = 1
    net.bridge.bridge-nf-call-iptables = 1
    EOF
    [root@master ~]# sysctl --system # 所有内核参数都生效
    # sysctl -p # 更改过的内核参数生效

**⑤node节点要设置ssh免密登录（允许master免密登录node即可）**

[root@master ~]# ssh-keygen
    Generating public/private rsa key pair.
    Enter file in which to save the key (/root/.ssh/id_rsa): 
    Enter passphrase (empty for no passphrase): 
    Enter same passphrase again: 
    Your identification has been saved in /root/.ssh/id_rsa.
    Your public key has been saved in /root/.ssh/id_rsa.pub.
    The key fingerprint is:
    SHA256:4UhXXW2Wf7nYpRq2LEVC1q//v1AYkUv8abJ7MI8qQ6g root@master
    The key's randomart image is:
    +---[RSA 2048]----+
    |          .o.oo..|
    |         .o o+..+|
    |      . oo  .ooo+|
    |     . + .. .o+=+|
    |      . S  o o*o+|
    |       . .  ==oo |
    |      . .  + **  |
    |     E   o. +ooo |
    |          oo. .o=|
    +----[SHA256]-----+
    [root@master ~]# ll /root/.ssh/
    总用量 12
    -rw-------. 1 root root 1679 12月 16 23:53 id_rsa   # 私钥
    -rw-r--r--. 1 root root  393 12月 16 23:53 id_rsa.pub   # 公钥
    -rw-r--r--. 1 root root  175 12月 16 23:01 known_hosts  # 记录着曾经远程连接过的远程主机
    # 发送公钥给所有节点，这样master就可以免密登录所有节点了【发送公钥给哪台主机，就可以远程登录哪台主机】
    [root@master ~]# ssh-copy-id -i /root/.ssh/id_rsa.pub -p 22 root@192.168.8.145
    [root@master ~]# ssh root@192.168.8.145

## 2. 安装docker，各个节点都要安装 ##

# 添加docker-ce的yum源，并查看最新版本
    [root@master ~]# yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
    [root@master ~]# yum list docker-ce --showduplicates |sort -r
    [root@master ~]# yum install -y docker-ce-19.03.9-3.el7
    [root@master ~]# systemctl start docker && systemctl enable docker
    # 配置docker镜像加速，加快pull拉取镜像到本地的速度
    cat > /etc/docker/daemon.json <<EOF { "registry-mirrors":["https://rsbud4vc.mirror.aliyuncs.com","https://registry.docker-cn.com","https://docker.mirrors.ustc.edu.cn","https://dockerhub.azk8s.cn","http://hub-mirror.c.163.com","http://qtid6917.mirror.aliyuncs.com"], "exec-opts":["native.cgroupdriver=systemd"], "log-driver":"json-file", "log-opts": { "max-size": "100m" }, "storage-driver":"overlay2", "storage-opts": [ "overlay2.override_kernel_check=true" ] } EOF
    [root@master ~]# systemctl daemon-reload && systemctl restart docker

## 3. 加载ipvs模块，各个节点都要 ##

`ipvs`称之为IP虚拟服务器（`IP Virtual Server`，简写为`IPVS`）。是运行在LVS下的提供负载均衡功能的一种技术。

# 设置网桥包经过iptables，配置永久生效
    [root@master ~]# echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables
    [root@master ~]# echo 1 > /proc/sys/net/bridge/bridge-nf-call-ip6tables
    [root@master ~]# echo """
    vm.swappiness = 0
    net.bridge.bridge-nf-call-iptables = 1
    net.ipv4.ip_forward = 1
    net.bridge.bridge-nf-call-ip6tables = 1
    """ > /etc/sysctl.conf [root@master ~]# sysctl -p # 让修改过的内核参数永久生效 vm.swappiness = 0 net.bridge.bridge-nf-call-iptables = 1 net.ipv4.ip_forward = 1 net.bridge.bridge-nf-call-ip6tables = 1 # 开启ipvs模块，不走iptables,推荐使用ipvs模块，使用iptables效率低 [root@master ~]# cat > /etc/sysconfig/modules/ipvs.modules <<EOF #!/bin/bash ipvs_modules="ip_vs ip_vs_lc ip_vs_wlc ip_vs_rr ip_vs_wrr ip_vs_lblc ip_vs_lblcr ip_vs_dh ip_vs_sh ip_vs_fo ip_vs_nq ip_vs_sed ip_vs_ftp nf_conntrack"
    for kernel_module in \${ipvs_modules}; do
    /sbin/modinfo -F filename \${kernel_module} > /dev/null 2>&1
    if [ $? -eq 0 ]; then
    /sbin/modprobe \${kernel_module}
    fi
    done
    EOF
    [root@master ~]# chmod 755 /etc/sysconfig/modules/ipvs.modules && bash /etc/sysconfig/modules/ipvs.modules && lsmod | grep ip_vs

## 4. 使用kubeadm部署k8s集群 ##

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center]

# 所有节点都要装kubeadm和kubelet服务
    [root@master ~]# yum install kubeadm kubelet -y
    [root@master ~]# systemctl start kubelet
    [root@master ~]# systemctl enable kubelet
    
    # 初始化k8s集群，在master节点上进行初始化
    [root@master ~]# kubeadm init --kubernetes-version=v1.20.0 --pod-network-cidr=10.244.0.0/16 --apiserver-advertise-address=192.168.8.144 --image-repository registry.aliyuncs.com/google_containers
    # --kubernetes-version 指定k8s的版本
    # --pod-network-cidr pod的网段,默认即可
    # --apiserver-advertise-addres apiserver服务器的地址，外网IP
    # --image-repository 镜像仓库
    
    # 保存以下内容到指定文本,用于其他node添加到该k8s集群中
    kubeadm join 192.168.8.144:6443 --token w8as7w.kfcu5h3njf8906a0 --discovery-token-ca-cert-hash sha256:d27014177e02b980248253d817869921e8ed75d0e153c36e09b19a913a66db89
    
    # 为配置文件config授权
    [root@master ~]# mkdir -p $HOME/.kube
    [root@master ~]# cp /etc/kubernetes/admin.conf $HOME/.kube/config
    您在 /var/spool/mail/root 中有新邮件
    [root@master ~]# chown $(id -u):$(id -g) $HOME/.kube/config
    [root@master ~]# ll /root/.kube/config 
    -rw------- 1 root root 5565 12月 17 22:05 /root/.kube/config
    
    # 验证k8s节点是否部署成功
    # 可以看到master的STATUS为NotReady未准备
    # coredns的STATUS为Pending等待
    # 这是因为没有安装网络插件，需要安装calico或flannel
    [root@master ~]# kubectl get nodes
    [root@master ~]# kubectl get pods -n kube-system

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 1]

## 4. 安装k8s网络组件-calico ##

**下载地址：**

`https://quay.io/repository/calico/node?tab=tags`

`https://quay.io/repository/calico/cni?tab=tags`

[root@master ~]# docker pull quay.io/calico/node:v3.17.1-5-g50c84067b344
    [root@master ~]# docker pull quay.io/calico/cni:v3.15.3-0-g9d7f9da-ppc64le
    [root@master ~]# docker images

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 2]

**下载安装文件**：`https://docs.projectcalico.org/archive/v3.17/manifests/canal.yaml`

# 使用资源清单安装calico组件
    [root@master ~]# kubectl apply -f canal.yaml
    # 稍等一会，查看k8s集群的状态，可以看到，k8s集群已经部署成功了
    [root@master ~]# kubectl get pods -n kube-system
    [root@master ~]# kubectl get nodes

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 3]

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 4]

## 5. 添加node节点到k8s集群 ##

[root@slave ~]# kubeadm join 192.168.8.144:6443 --token w8as7w.kfcu5h3njf8906a0 --discovery-token-ca-cert-hash sha256:d27014177e02b980248253d817869921e8ed75d0e153c36e09b19a913a66db89 
        
    # 在master节点上查看node的情况，可以看到slave已经加入到k8s集群中了
    [root@master ~]# kubectl get nodes
    NAME     STATUS   ROLES                  AGE    VERSION
    master   Ready    control-plane,master   136m   v1.20.0
    slave    Ready    <none>                 72s    v1.20.0

## 6. 安装k8s的管理面板dashboard ##

# 官方安装方法
    # https://kubernetes.io/zh/docs/tasks/access-application-cluster/web-ui-dashboard/
    # 所需镜像
    # kubernetesui/dashboard:v2.0.0-beta8
    # kubernetesui/metrics-scraper:v1.0.1
    [root@master ~]# wget https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0/aio/deploy/recommended.yaml
    [root@master ~]# kubectl apply -f recommended.yaml

由于使用官方安装dashboard方法，对网络要求较高， 这里采用上传离线包的方式安装。

# 上传离线包
    [root@master ~]# cd /usr/local/src/
    [root@master src]# rz
    
    [root@master src]# ll
    总用量 128288
    -rw-r--r-- 1 root root 91227136 11月  8 14:20 dashboard_2_0_0.tar.gz
    -rw-r--r-- 1 root root     7614 4月  27 2020 kubernetes-dashboard.yaml
    -rw-r--r-- 1 root root 40124928 11月  8 14:13 metrics-scrapter-1-0-1.tar.gz
    
    # 导入镜像
    [root@master src]# docker load -i dashboard_2_0_0.tar.gz
    [root@master src]# docker load -i metrics-scrapter-1-0-1.tar.gz 
    
    # 安装k8s dashboard
    [root@master src]# kubectl apply -f kubernetes-dashboard.yaml 
    
    # 查看dashboard前端的service状态
    [root@master ~]# kubectl get svc -n kubernetes-dashboard
    NAME                        TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
    dashboard-metrics-scraper   ClusterIP   10.103.83.180    <none>        8000/TCP   50s
    kubernetes-dashboard        ClusterIP   10.104.248.104   <none>        443/TCP    50s
    
    # 修改service的TYPE为NodePort，再次查看可以看到TYPE已经改为NodePort了
    # nodeport类型端口允许外部机器访问
    [root@slave ~]# kubectl edit svc kubernetes-dashboard -n kubernetes-dashboard
         29   type: ClusterIP
    改为
         29   type: NodePort
    # 可以看到dashboard占用的端口是31066
    [root@slave ~]# kubectl get svc -n kubernetes-dashboard
    NAME                        TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)         AGE
    dashboard-metrics-scraper   ClusterIP   10.103.83.180    <none>        8000/TCP        3m47s
    kubernetes-dashboard        NodePort    10.104.248.104   <none>        443:31066/TCP   3m47s

**在火狐浏览器打开dashboarad**：`https://192.168.8.144:31066/`

在IE和谷歌浏览器登录，都会因为CA证书不安全无法访问。

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 5]

## 7. 登录k8s dashboard ##

# 创建管理员token，可查看任何空间权限
    [root@master ~]# kubectl create clusterrolebinding dashboard-cluster-admin --clusterrole=cluster-admin --serviceaccount=kubernetes-dashboard:kubernetes-dashboard
    clusterrolebinding.rbac.authorization.k8s.io/dashboard-cluster-admin created
    
    # 查看下token的登录密钥
    [root@master ~]# kubectl get secret -n kubernetes-dashboard
    [root@master ~]# kubectl describe secret kubernetes-dashboard-token-g8m69 -n kubernetes-dashboard
    保存好token:后面的长串字符：
    eyJhbGciOiJSUzI1NiIsImtpZCI6ImpFS1BPQWN6RlVabkM4TXliXzR0dVZrQmhyVEFmTEhIUTFfeWkzcVJMMHcifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2hib2FyZC10b2tlbi1nOG02OSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6ImM5YWVlMTEyLTE0YjgtNDg3OC05ZWVkLTY2MzM0ODk3OGQ3OCIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlcm5ldGVzLWRhc2hib2FyZDprdWJlcm5ldGVzLWRhc2hib2FyZCJ9.YoM412cjPV6VkC6966gxKX4AVEdRZdKIAQl-a--bYWNs_ArsEzkkQah36crz5HoateqdS0JJFJulXhRKrygeqfMRogSfSHT4bO3FIPRfMSoono7gVTvOLfOPODJPqRqXj4eqd2n3DV6KaafGJqznYwc7aUBBwUeyjsDeDi9r3NImQpgfPxgyqxT3LuiSEc0gf0VmSLokRXoW9ET7EbcrKwBVFGs2v-7nFs69dEs6LORJsdZqZPOkk4POsLhNtu9q7z890DJ6UagEBo_AH0eMUQvpMz1ob2hQYxUdqL1BVxg0Lw927xAgrZ9NN_puVcUSTcfLItn9DinVFosoaY6zyg

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 6]

粘贴上密钥，就可以登录了。

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 7]

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 8]

## 8. 使用k8s dashboard创建容器及部署nginx ##

**架构设计：**

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 9]

**①创建容器，即创建deployment-pods-container**

*  **应用名称**：nginx
 *  **容器镜像**：nginx
 *  **pod数量**：2
 *  **service**：external外部网络
 *  **端口(port)**：3000【集群内部的pod互相通信的端口】
 *  **目标端口(target port)**：80【pod的端口，这里就是nginx容器镜像占用的端口】
 *  **外部访问端口(nodeport)**：自动分配【集群外访问集群内服务的端口，即外部用户访问端口。】

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 10]

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 11]

稍等一会，就可以看到容器镜像已经创建成功了。

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 12]

**②查看nodeport端口号及访问nginx**

查看下`service`分配的`nodeport`端口号，分配的是`30684`。

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 13]

访问任意节点都可以

`http://192.168.8.144:30684/`

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 14]

`http://192.168.8.145:30684/`

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 15]

## 9. k8s服务发现和负载均衡 ##

**k8s 集群中，应用是通过 pod 去部署的， 而 pod 在创建或销毁时，它的 IP 地址都会发生变化，这样就不能使用指定 IP 去访问指定的应用。**

**在 k8s 中，服务发现与负载均衡就是 k8s service。外部网络可以通过 service 去访问，pod 网络也可以通过 service 去访问。**

**即可以通过 k8s service 的方式去负载均衡到一组 pod 上面去，这样相当于解决了前面所说的复发性问题，或者提供了统一的访问入口去做服务发现，然后又可以给外部网络访问，解决不同的 pod 之间的访问，提供统一的访问地址。**

**总的来说，就是pod在创建或销毁时，IP地址会变，但是service在集群创建后，IP地址就不会再发生变化， 所以通过service提供的nodeport去访问后端的nginx，就可以提供统一的访问地址了。**

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 16]

# 集群内访问service
    [root@master ~]# kubectl get service
    NAME         TYPE           CLUSTER-IP     EXTERNAL-IP   PORT(S)          AGE
    kubernetes   ClusterIP      10.96.0.1      <none>        443/TCP          36h
    nginx        LoadBalancer   10.101.7.132   <pending>     3000:30684/TCP   38m
    [root@master ~]# kubectl describe service nginx
    Name:                     nginx
    Namespace:                default
    Labels:                   k8s-app=nginx
    Annotations:              <none>
    Selector:                 k8s-app=nginx
    Type:                     LoadBalancer
    IP Families:              <none>
    IP:                       10.101.7.132
    IPs:                      10.101.7.132
    Port:                     tcp-3000-80-fmqk4  3000/TCP
    TargetPort:               80/TCP
    NodePort:                 tcp-3000-80-fmqk4  30684/TCP
    Endpoints:                10.244.1.6:80,10.244.1.7:80
    Session Affinity:         None
    External Traffic Policy:  Cluster
    Events:                   <none>
    
    # 查看pod
    [root@master ~]# kubectl get pod
    NAME                     READY   STATUS    RESTARTS   AGE
    nginx-7f466444dc-8q98r   1/1     Running   0          40m
    nginx-7f466444dc-g7q7h   1/1     Running   0          40m
    
    # 进入pod，可以通过集群IP地址访问到nginx service服务
    [root@master ~]# kubectl exec -it nginx-7f466444dc-8q98r bash
    kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
    root@nginx-7f466444dc-8q98r:/# curl -I 10.101.7.132:3000
    HTTP/1.1 200 OK
    Server: nginx/1.19.6
    Date: Sat, 19 Dec 2020 02:57:46 GMT
    Content-Type: text/html
    Content-Length: 612
    Last-Modified: Tue, 15 Dec 2020 13:59:38 GMT
    Connection: keep-alive
    ETag: "5fd8c14a-264"
    Accept-Ranges: bytes

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 17]

## 10. 通过编写k8s资源清单yaml文件部署tomcat网站 ##

**架构设计：**

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 18]

**①deployment资源清单文件**

# deployment资源清单文件
    # 注意缩进
    cat >abong-tomcat.yaml<<EOF
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: abong-tomcat-deployment
    spec:
      selector:
        matchLabels:
          abong: tomcat
      replicas: 2
      template:
        metadata:
          labels:
            abong: tomcat
        spec:
          containers:
          - name: tomcat
            image: tomcat:8.5-jre8-alpine
            ports:
            - containerPort: 8080
    
    # 使用deployment的yaml文件创建deployment,并部署tomcat服务
    # 这时tomcat服务只能内部访问，无法进行外部访问
    [root@master ~]# kubectl apply -f abong-tomcat.yaml
    deployment.apps/abong-tomcat-deployment created
    [root@master ~]# kubectl get pods
    NAME                                       READY   STATUS    RESTARTS   AGE
    abong-tomcat-deployment-58bb84fb5b-x2pfw   1/1     Running   0          19s
    abong-tomcat-deployment-58bb84fb5b-xdhrl   1/1     Running   0          19s
    nginx-7f466444dc-8q98r                     1/1     Running   0          96m
    nginx-7f466444dc-g7q7h                     1/1     Running   0          96m
    
    ========================= 在使用yaml部署如果报错=============
    1. 检查缩进
    2. tomcat:8.5-jre8-alpine  这个镜像估计没有拉取到本地
    [root@master ~]# docker pull tomcat:8.5-jre8-alpine
    [root@master ~]# docker images | grep tomcat
    tomcat  8.5-jre8-alpine   8b8b1eb786b5   19 months ago   106MB

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 19]

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 20]

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 21]

**②tomcat前端负载均衡器service资源清单**

cat >abong-tomcat-service.yaml<<EOF apiVersion: v1 kind: Service metadata: name: abong-tomcat-service labels: abong: tomcat spec: type: NodePort ports: - port: 8080 targetPort: 8080 nodePort: 30001 selector: abong: tomcat EOF
    
    [root@master ~]# kubectl apply -f abong-tomcat-service.yaml
    service/abong-tomcat-service created
    [root@master ~]# kubectl get svc | grep abong-tomcat
    abong-tomcat-service   NodePort       10.108.130.250   <none>        8080:30001/TCP   43s

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 22]

**③浏览器访问k8s里部署的tomcat服务**

**输入地址**：`http://192.168.8.144:30001/`

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 23]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center]: /images/20221120/879035bf908540b593bca7c176337093.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 1]: /images/20221120/be57e188bad44366821c242427d281dc.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 2]: /images/20221120/4d5530d850214904837a0fc327a77477.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 3]: /images/20221120/c8d13e11c14d4c6b89fb61014f4b2972.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 4]: /images/20221120/fdae402f4af04173af13efb2aeae6150.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 5]: /images/20221120/10687fb72b2645de920d80f1f49a7c67.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 6]: /images/20221120/b07c8241a8a942689d478d718bd5e99c.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 7]: /images/20221120/14adefd9ea7c41a4a7cb286b905f408a.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 8]: /images/20221120/188ba3a0384044eb810b27ceb679e15c.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 9]: /images/20221120/293e2633665b45f593b076a25c9402aa.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 10]: /images/20221120/055e901d977241fb8ce88a39abc84145.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 11]: /images/20221120/63b998f76fe743a39c46eb4f1912fd7e.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 12]: /images/20221120/62d3da98d2694a898bc99a102c6e2e20.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 13]: /images/20221120/d722469ffbbe4f3facc9b950fab99ea2.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 14]: /images/20221120/4520237f2452440cbc38b255d92012fa.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 15]: /images/20221120/fc54e9121230429eaa9bb675314f8344.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 16]: /images/20221120/2da67d918ed940dd9ab0e02bc6cb3fea.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 17]: /images/20221120/8d2640e4eb654301bf10af9f96266be1.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 18]: /images/20221120/7c273ec74ccc4e6cbfe3819c6dd5c2c0.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 19]: /images/20221120/0ace8a19123346d29b451830a13883ae.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 20]: /images/20221120/111dc5d1d76d46a0a6f7815da12b2a25.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 21]: /images/20221120/e2496a353f124949a65da6e2d0387a63.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 22]: /images/20221120/646bd2f50d584fe48a99c6064cbc41d9.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70_pic_center 23]: /images/20221120/7eea16b39daf4a7d9a0efdcc035fb135.png