06.kubernetes笔记 Pod探针与多容器

Bigyong

Pod生命周期

  1. 容器初始化环境
  2. 运行容器的pause基础容器
  3. init c容器初始化容器(init c可以有多个,串行运行)
  4. main c启动主容器(启动之初允许执行一个执行命令或一个脚本,在结束的时候允许执行一个命令)
  5. readless 就绪探测
  6. liveness 存活探测

初始化容器
初始化容器即 pod 内主容器启动之前要运行的容器,主要是做一些前置工作,初始化容器具有以下特征:
初始化容器必须首先执行,若初始化容器运行失败,集群会一直重启初始化容器直至完成,注意,如果 pod 的重启策略为 Never,那初始化容器启动失败后就不会重启。
初始化容器必须按照定义的顺序执行,初始化容器可以通过 pod 的 spec.initContainers 进行定义。

lifecycle 声明周期钩子函数
创建资源对象时,可以使用lifecycle来管理容器在运行前和关闭前的一些动作。

  • lifecycle有两种回调函数︰
  • PostStart:容器创建成功后,运行前的任务,用于资源部署、环境准备等
  • PreStop:在容器被终止前的任务,用于优雅关闭应用程序、通知其他系统等等。
    备注:钩子程序的执行方式有“exec”和“HTTP”两种。

Pod 状态
Pod 的 status 定义在 PodStatus 对象中,其中有一个 phase 字段。它简单描述了 Pod 在其生命周期的阶段。熟悉Pod的各种状态对我们理解如何设置Pod的调度策略、重启策略是很有必要的。下面是 phase 可能的值:

阶段           描述
Pending       Pod 已被 Kubernetes 系统接受,但有一个或者多个容器镜像尚未创建。等待时间包括调度 Pod 的时间和通过网络下载镜像的时间,这可能需要花点时间。
Running       该 Pod 已经绑定到了一个节点上,Pod 中所有的容器都已被创建。至少有一个容器正在运行,或者正处于启动或重启状态。
Succeeded     Pod 中的所有容器都被成功终止,并且不会再重启。
Failed        Pod 中的所有容器都已终止了,并且至少有一个容器是因为失败终止。也就是说,容器以非0状态退出或者被系统终止。
Unknown       因为某些原因无法取得 Pod 的状态,通常是因为与 Pod 所在主机通信失败。

Pod终止过程
终止过程主要分为如下几个步骤:

  1. 用户发出删除 pod 命令
  2. Pod 对象随着时间的推移更新,在宽限期(默认情况下30秒),pod 被视为“dead”状态
  3. 将 pod 标记为“Terminating”状态
  4. 第三步同时运行,监控到 pod 对象为“Terminating”状态的同时启动 pod 关闭过程 5.第三步同时进行,5. endpoints 控制器监控到 pod 对象关闭,将pod与service匹配的 endpoints 列表中删除
  5. 如果 pod 中定义了 preStop 钩子处理程序,则 pod 被标记为“Terminating”状态时以同步的方式启动执行;若宽限期结束后,preStop 仍未执行结束,第二步会重新执行并额外获得一个2秒的小宽限期
  6. Pod 内对象的容器收到 TERM 信号
  7. 宽限期结束之后,若存在任何一个运行的进程,pod 会收到 SIGKILL 信号
  8. Kubelet 请求 API Server 将此 Pod 资源宽限期设置为0从而完成删除操作

探针

容器探测

  • Startupprobe:开启检测,成功后 后面的LivenessProbe、ReadinessProbe配置才会生效
  • LivenessProbe:周期性检测,检测未通过时,kubelet会根据restartPolicy的定义来决定是否会重启该容器;未定义时,Kubelet认为只容器未终止,即为健康;
  • ReadinessProbe:周期性检测,检测末通过时,与该Pod关联的Service,会将颁PodlASevice的后端可用端点列表中删除;直接再次就绪,重新添加回来。未定义时,只要容器末终止,即为就绪,StartupProbe:便于用户使用同livenessProbe不同参数或阈值;

容器探测方式
容器探测分为存活性探测和就绪性探测容器探测是kubelet对容器健康状态进行诊断,容器探测的方式主要以下三种:
ExecAction:在容器中执行命令,根据返回的状态码判断容器健康状态,返回0即表示成功,否则为失败。
TCPSocketAction: 通过与容器的某TCP端口尝试建立连接进行诊断,端口能打开即为表示成功,否则失败。
HTTPGetAction:向容器指定 URL 发起 HTTP GET 请求,响应码为2xx或者是3xx为成功,否则失败。

探针资源规范

spec:
  containers:
  - name: ...
    image: ...
    livenessProbe:
      exec <0bject>     #命令式探针
      httpGet <0bject>  #httpGET类型的探针
      tcpSocket <0bject>  #tcp Socket类型的探针 I
      initialDelaySeconds <integer> #发起初次探测请求的延后时长
      periodSeconds <integer>  #请求周期
      timeoutSeconds <integer> #超时时长
      successThreshold <integer>  #成功阈值
      failureThreshold <integer>  #失败阈值
  • 查看详细说明
$ kubectl explain pods.spec.containers.livenessProbe.tcpSocket
KIND:     Pod
VERSION:  v1

RESOURCE: tcpSocket <Object>

DESCRIPTION:
     TCPSocket specifies an action involving a TCP port. TCP hooks not yet
     supported

     TCPSocketAction describes an action based on opening a socket

FIELDS:
   host    <string>
     Optional: Host name to connect to, defaults to the pod IP.

   port    <string> -required-
     Number or name of the port to access on the container. Number must be in
     the range 1 to 65535. Name must be an IANA_SVC_NAME.
livenessProbe存活探测示例

示例1:通过cmd命令探测存活

[root@k8s-master Probe]# cat liveness-exec-damo.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: liveness-exec-demo
  namespace: default
spec:
  containers:
  - name: demo
    image: ikubernetes/demoapp:v1.0
    imagePullPolicy: IfNotPresent
    livenessProbe:
      exec:
        command: ['/bin/sh','-c','[ "$(curl -s 127.0.0.1/livez)" == "OK" ]']
      initialDelaySeconds: 5  #初始化等待时间5秒后探测
      timeoutSeconds: 1   #超时时间
      periodSeconds: 5   #每隔5秒探测一次

$ kubectl apply -f liveness-exec-damo.yaml
$ kubectl get pod  -o wide
NAME                                READY   STATUS            RESTARTS   AGE     IP              NODE        NOMINATED NODE   READINESS GATES
...
liveness-exec-demo                  1/1     Running           0          76s     10.244.2.84     k8s-node2   <none>           <none>
...

$ curl 10.244.2.84:/livez
OK

$ curl -X POST -d 'livez=FAIL' 10.244.2.84:/livez      #能过POST修改livez值
$ curl 10.244.2.84:/livez
FAIL
$ kubectl describe pod liveness-exec-demo
...
Events:
  Type     Reason     Age                  From               Message
  ----     ------     ----                 ----               -------
  Normal   Scheduled  7m38s                default-scheduler  Successfully assigned default/liveness-exec-demo to k8s-node2
  Warning  Unhealthy  89s (x3 over 99s)    kubelet            Liveness probe failed:    #存活检测失败 重启容器
  Normal   Killing    89s                  kubelet            Container demo failed liveness probe, will be restarted
  Normal   Pulled     59s (x2 over 7m33s)  kubelet            Container image "ikubernetes/demoapp:v1.0" already present on machine
  Normal   Created    59s (x2 over 7m33s)  kubelet            Created container demo
  Normal   Started    59s (x2 over 7m33s)  kubelet            Started container demo


$ kubectl get pod  -o wide
NAME                                READY   STATUS            RESTARTS   AGE     IP              NODE        NOMINATED NODE   READINESS GATES
...
liveness-exec-demo                  1/1     Running           1          9m15s   10.244.2.84     k8s-node2   <none>           <none>    #显示容器已重启
...

示例2: tcp 端口探测

$ cat liveness-tcpsocket-demo.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: liveness-tcpsocket-demo
  namespace: default
spec:
  containers:
  - name: demo
    image: ikubernetes/demoapp:v1.0
    imagePullPolicy: IfNotPresent
    ports:
    - name: http
      containerPort: 80
    securityContext:   #为了测试能有修改iptable的权限而添加
      capabilities:
        add:
        - NET_ADMIN
    livenessProbe:
      tcpSocket:
        port: http   #引用上面的name: http :类似变量的引用 后期上面修改端口后这里不需要在修改
      periodSeconds: 5
      initialDelaySeconds: 5

$ kubectl apply -f liveness-tcpsocket-demo.yaml

$ kubectl get pod  -o wide
NAME                                READY   STATUS            RESTARTS   AGE     IP              NODE        NOMINATED NODE   READINESS GATES
liveness-exec-demo                  1/1     Running           1          2d20h   10.244.2.84     k8s-node2   <none>           <none>
liveness-tcpsocket-demo             1/1     Running           0          2d19h   10.244.1.88     k8s-node1   <none>           <none>
...

$ kubectl exec liveness-tcpsocket-demo -- iptables -A INPUT -p tcp --dport 80 -j REJECT

$ kubectl describe pod  liveness-tcpsocket-demo
Name:         liveness-tcpsocket-demo
...
Events:
  Type     Reason     Age               From     Message
  ----     ------     ----              ----     -------
  Warning  Unhealthy  1s (x3 over 11s)  kubelet  Liveness probe failed: dial tcp 10.244.1.88:80: i/o timeout   #探测失败 重启pod
  Normal   Killing    1s                kubelet  Container demo failed liveness probe, will be restarted

示例3: http存活探测

--http 存活检测 与示例1的区别在于 http探测以状态码为探测值 2xx 3xx都为正常值,不以探测内容为准

$ cat liveness-httpget-demo.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: liveness-httpget-demo
  namespace: default
spec:
  containers:
  - name: demo
    image: ikubernetes/demoapp:v1.0
    imagePullPolicy: IfNotPresent
    livenessProbe:
      httpGet:
         path: '/livez'
         port: 80
         scheme: HTTP  #连接方案为http
      initialDelaySeconds: 5  #首次探测延时5秒

$ kubectl apply -f liveness-httpget-demo.yaml

$ kubectl describe pod liveness-httpget-demo
...
    Liveness:       http-get http://:80/livez delay=5s timeout=1s period=10s #success=1 #failure=3
...
Events:
  Type     Reason     Age               From               Message
  ----     ------     ----              ----               -------
  Normal   Scheduled  5m44s             default-scheduler  Successfully assigned default/liveness-httpget-demo to k8s-node1
  Normal   Pulled     5m39s             kubelet            Container image "ikubernetes/demoapp:v1.0" already present on machine
  Normal   Created    5m39s             kubelet            Created container demo
  Normal   Started    5m39s             kubelet            Started container demo
  Warning  Unhealthy  5m33s             kubelet            Liveness probe failed: Get "http://10.244.1.89:80/livez": context deadline exceeded (Client.Timeout exceeded while awaiting headers)  #首次探测失败,但没有重启 不影响

$ curl http://10.244.1.89:80/livez
OK
$ curl -I http://10.244.1.89:80/livez     #查看状态码200
HTTP/1.0 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 2
Server: Werkzeug/1.0.0 Python/3.8.2
Date: Mon, 26 Jul 2021 14:31:17 GMT

$ curl -XPOST -d 'livez=FAIL' 10.244.1.89:80/livez  #修改livez为FAIL
$ curl -I http://10.244.1.89:80/livez               #状态码为506 存活探测失败
HTTP/1.0 506 VARIANT ALSO NEGOTIATES
Content-Type: text/html; charset=utf-8
Content-Length: 4
Server: Werkzeug/1.0.0 Python/3.8.2
Date: Mon, 26 Jul 2021 14:35:39 GMT

$ kubectl describe pod liveness-httpget-demo
Name:         liveness-httpget-demo
...
    Liveness:       http-get http://:80/livez delay=5s timeout=1s period=10s #success=1 #failure=3
...
Events:
  Type     Reason     Age               From               Message
  ----     ------     ----              ----               -------
  Normal   Scheduled  5m44s             default-scheduler  Successfully assigned default/liveness-httpget-demo to k8s-node1
  Normal   Pulled     5m39s             kubelet            Container image "ikubernetes/demoapp:v1.0" already present on machine
  Normal   Created    5m39s             kubelet            Created container demo
  Normal   Started    5m39s             kubelet            Started container demo
  Warning  Unhealthy  5m33s             kubelet            Liveness probe failed: Get "http://10.244.1.89:80/livez": context deadline exceeded (Client.Timeout exceeded while awaiting headers)  #
  Warning  Unhealthy  4s (x3 over 24s)  kubelet            Liveness probe failed: HTTP probe failed with statuscode: 506    #探测状态码为506 3次都失败  重启pod 
  Normal   Killing    4s                kubelet            Container demo failed liveness probe, will be restarted

示例4: 就绪探测 失败不会重启pod

$ cat readiness-httpget-demo.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: rediness-httpget-demo
  namespace: default
spec:
  containers:
  - name: demo
    image: ikubernetes/demoapp:v1.0
    imagePullPolicy: IfNotPresent
    readinessProbe:
      httpGet:
         path: '/readyz'
         port: 80
         scheme: HTTP  #连接方案为http
      initialDelaySeconds: 15  #首次探测延时5秒
      timeoutSeconds: 2
      periodSeconds: 5
      failureThreshold: 3  #连续探测3次失败为真
  restartPolicy: Always  #当容器退出去重启策略 默认策略

$ kubectl apply -f readiness-httpget-demo.yaml 

$ kubectl get pod -o wide
NAME                                READY   STATUS             RESTARTS   AGE     IP              NODE        NOMINATED NODE   READINESS GATES
centos-deployment-nq5b2             1/1     Running            1          7d16h   10.244.2.80     k8s-node2   <none>           <none>
centos-deployment-r4vsm             1/1     Running            1          7d16h   10.244.1.82     k8s-node1   <none>           <none>
liveness-exec-demo                  1/1     Running            1          2d22h   10.244.2.84     k8s-node2   <none>           <none>
liveness-httpget-demo               1/1     Running            1          57m     10.244.1.89     k8s-node1   <none>           <none>
rediness-httpget-demo               1/1     Running            0          53s     10.244.2.87     k8s-node2   <none>           <none>

$ kubectl describe pod rediness-httpget-demo
...
Events:
  Type     Reason     Age                    From               Message
  ----     ------     ----                   ----               -------
  Normal   Scheduled  2m59s                  default-scheduler  Successfully assigned default/rediness-httpget-demo to k8s-node2
  Normal   Pulled     2m57s                  kubelet            Container image "ikubernetes/demoapp:v1.0" already present on machine
  Normal   Created    2m57s                  kubelet            Created container demo
  Normal   Started    2m57s                  kubelet            Started container demo
  Warning  Unhealthy  2m26s (x3 over 2m36s)  kubelet            Readiness probe failed: Get "http://10.244.2.87:80/readyz": context deadline exceeded (Client.Timeout exceeded while awaiting headers)  #首次探测失败 忽略
  
$ curl http://10.244.2.87:80/readyz
OK
$ curl -I http://10.244.2.87:80/readyz
HTTP/1.0 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 2
Server: Werkzeug/1.0.0 Python/3.8.2
Date: Mon, 26 Jul 2021 15:31:33 GMT

$ curl -XPOST -d 'readyz=FAIL' http://10.244.2.87:80/readyz  #重写readyz
$ curl -I http://10.244.2.87:80/readyz   #查看readyz状态码为507
HTTP/1.0 507 INSUFFICIENT STORAGE
Content-Type: text/html; charset=utf-8
Content-Length: 4
Server: Werkzeug/1.0.0 Python/3.8.2
Date: Mon, 26 Jul 2021 15:32:11 GMT

$ kubectl get pod   
NAME                                READY   STATUS             RESTARTS   AGE
liveness-exec-demo                  1/1     Running            1          2d22h
liveness-httpget-demo               1/1     Running            1          62m
mypod-port-network                  1/1     Running            1          7d16h
rediness-httpget-demo               0/1     Running            0          5m39s   #服务准备失败  但不会重启POD

$ kubectl describe pod rediness-httpget-demo
Name:         rediness-httpget-demo
...
Events:
  Type     Reason     Age                   From               Message
  ----     ------     ----                  ----               -------
  Normal   Scheduled  9m26s                 default-scheduler  Successfully assigned default/rediness-httpget-demo to k8s-node2
  Normal   Pulled     9m23s                 kubelet            Container image "ikubernetes/demoapp:v1.0" already present on machine
  Normal   Created    9m23s                 kubelet            Created container demo
  Normal   Started    9m23s                 kubelet            Started container demo
  Warning  Unhealthy  8m52s (x3 over 9m2s)  kubelet            Readiness probe failed: Get "http://10.244.2.87:80/readyz": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
  Warning  Unhealthy  4s (x13 over 4m4s)    kubelet            Readiness probe failed: HTTP probe failed with statuscode: 507    #准备探测失败


$ curl -XPOST -d 'readyz=OK' http://10.244.2.87:80/readyz   #恢复原值
$ curl -I http://10.244.2.87:80/readyz
HTTP/1.0 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 2
Server: Werkzeug/1.0.0 Python/3.8.2
Date: Mon, 26 Jul 2021 15:32:51 GMT

$ kubectl get pod
NAME                                READY   STATUS            RESTARTS   AGE
...
rediness-httpget-demo               1/1     Running           0          13m

poststart hook、perstop hook钩子

post start hook #只有start hook执行完之后 容器才会变running状态 类似docker 的run 容器启动时执行的命令
per stop hook #只有stop hook执行完成后 容器才会变终止状态

poststart、perstop说明
$ kubectl explain pods.spec.containers.lifecycle.postStart   
KIND:     Pod
VERSION:  v1
...
FIELDS:          #支持3种格式
   exec    <Object>
     One and only one of the following should be specified. Exec specifies the
     action to take.

   httpGet    <Object>
     HTTPGet specifies the http request to perform.

   tcpSocket    <Object>
     TCPSocket specifies an action involving a TCP port. TCP hooks not yet
     supported

示例1: poststart hook、perstop hook演示

$ cat lifecycle-demo.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: lifecycle-demo
  namespace: default
spec:
  containers:
  - name: demo
    image: ikubernetes/demoapp:v1.0
    imagePullPolicy: IfNotPresent
    securityContext:  #为测试添加网络管理员权限
      capabilities:
        add:
        - NET_ADMIN
    livenessProbe:
      httpGet:
         path: '/livez'
         port: 80
         scheme: HTTP  #连接方案为http
      initialDelaySeconds: 5  #首次探测延时5秒
    lifecycle:
      postStart:   #启动时执行的命令  类似docker run命令
        exec:
          command: [ '/bin/sh','-c','iptables  -t nat -A PREROUTING -p tcp  --dport 8080 -j REDIRECT  --to-ports  80' ]
      preStop:     #结束时执行的命令 不是太好验证
        exec:
          command: [ '/bin/sh','-c','while killall python3; do sleep 1; done' ]

$ kubectl apply -f lifecycle-demo.yaml

# kubectl exec lifecycle-demo -- iptables -t nat -vnL   #查看容器iptables规则成功
Chain PREROUTING (policy ACCEPT 3 packets, 180 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REDIRECT   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8080 redir ports 80


$ kubectl get pod -o wide
NAME                                READY   STATUS             RESTARTS   AGE     IP              NODE        NOMINATED NODE   READINESS GATES
lifecycle-demo                      1/1     Running            0          58s     10.244.1.90     k8s-node1   <none>           <none>
...

$ curl 10.244.1.90:8080
iKubernetes demoapp v1.0 !! ClientIP: 10.244.0.0, ServerName: lifecycle-demo, ServerIP: 10.244.1.90!

多容器

Pod中可以存在多个容器
Sidecar #为主容器提供辅助功能(外-->内) 为了更好的接入外部环境 如:日志收集等容器 代理服务等
Adapater #为主容器更适配外部环境(请求、数据) 如: 各种export转换成prometheus能识别的格式
Ambassador #大使模式 为pod内容器更好的接外部环境(内-->外) 如:访问外部数据 访问数据库的容器

示例1:不同容器的权限管理

1.授权initcontainers容器NET_ADMIN权限 完成端口的转发
2.主容器正常启动,没有NET_ADMIN权限

# cat init-container-demo.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: init-container-demo
  namespace: default
spec:
  initContainers:
  - name: iptables-init
    image: ikubernetes/admin-box:latest
    imagePullPolicy: IfNotPresent
    command: ["/bin/sh","-c"]   #相当于docker的cmd
    args: ["/sbin/iptables -t nat -A PREROUTING -p tcp  --dport 8080 -j REDIRECT  --to-port 80"]
    securityContext:
      capabilities:
        add:
        - NET_ADMIN
  containers:
  - name: demo
    image: ikubernetes/demoapp:v1.0
    imagePullPolicy: IfNotPresent
    ports:
    - name: http
      containerPort: 80

$ kubectl apply -f init-container-demo.yaml

$ kubectl get pod -o wide
NAME                                READY   STATUS            RESTARTS   AGE     IP              NODE        NOMINATED NODE   READINESS GATES
...
init-container-demo                 1/1     Running           0          22s     10.244.2.91     k8s-node2   <none>           <none>


# kubectl describe pod init-container-demo
Name:         init-container-demo
...
IPs:
  IP:  10.244.2.91
Init Containers:     #初始化容器
  iptables-init:    
    Container ID:  docker://9ea2b437b9ab68feeb68 9fd017f65d7b083159269871e8fc7f3a8604f8926af9
    Image:         ikubernetes/admin-box:latest
    Image ID:      docker-pullable://ikubernetes/admin-box@sha256:56e2413d2bcc279c6667d36fa7dfc7202062a933d0f69cd8a1769b68e2155bbf
    Port:          <none>
    Host Port:     <none>
    Command:
      /bin/sh
      -c
    Args:
      /sbin/iptables -t nat -A PREROUTING -p tcp  --dport 8080 -j REDIRECT  --to-port 80   #执行命令
    State:          Terminated
      Reason:       Completed
      Exit Code:    0                             #正常退出
      Started:      Tue, 27 Jul 2021 02:08:14 +0800
      Finished:     Tue, 27 Jul 2021 02:08:14 +0800
    Ready:          True
    Restart Count:  0
    Environment:    <none>
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-fsshk (ro)
...

$ curl 10.244.2.91:8080  #访问8080端口
iKubernetes demoapp v1.0 !! ClientIP: 10.244.0.0, ServerName: init-container-demo, ServerIP: 10.244.2.91!

$ kubectl exec init-container-demo -- iptables -t nat -vnL  #主容器查看iptables规则 但没有权限
iptables v1.8.3 (legacy): can't initialize iptables table `nat': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.
command terminated with exit code 3

示例2: 实现双容器运行

1.实现双容器运行
2.实现通过envoy.yaml代理主容器http服务 其中envoy.yaml通过宿主机httpd服务挂载

$ cat envoy.yaml 
admin:
  access_log_path: /tmp/admin_access.log
  address:
    socket_address: { address: 127.0.0.1, port_value: 9999 }
# 定义静态资源
static_resources:
  listeners:
  # 配置一个接收流量的监听器,接收客户发送的请求
  - name: listener_0
    address:
      socket_address: { address: 0.0.0.0, port_value: 10000 }
    filter_chains:
    - filters:
      # 定义一个过滤器用于转发流量
      - name: envoy.http_connection_manager
        config:
          stat_prefix: ingress_http
          codec_type: AUTO
          route_config:
            name: local_route
            virtual_hosts:
            - name: local_service
              # 不绑定域名
              domains: ["*"]
              routes:
              - match: { prefix: "/" }
                route: { cluster: some_service }
          http_filters:
          - name: envoy.router
  clusters:
  - name: some_service
    connect_timeout: 0.25s
    type: STATIC
    lb_policy: ROUND_ROBIN
    # 配置后端挂载的IP地址
    hosts: [{ socket_address: { address: 127.0.0.1, port_value: 8080 }}]


$ cat sidecar-container-demo.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: sidecar-container-demo
  namespace: default
spec:
  containers:
  - name: proxy-container
    image: envoyproxy/envoy-alpine:v1.14.1
    imagePullPolicy: IfNotPresent
    command: ["/bin/sh","-c"]   #相当于docker的cmd
    args: ["sleep 5 && envoy -c /etc/envoy/envoy.yaml"]  #因为commadn 与 poststart 同时运行,这里等待5秒等待poststart把文件下载好
    lifecycle:
      postStart:
        exec:
          command: ['/bin/sh','-c','wget -O /etc/envoy/envoy.yaml  http://192.168.4.254/envoy.yaml'    ] #下载配置文件到容器的/etc/envoy/envoy.yaml
  - name: demo
    image: ikubernetes/demoapp:v1.0
    imagePullPolicy: IfNotPresent
    env:
    - name: HOST
      value: "127.0.0.1"
    - name: PORT
      value: "8080"   #envoy默认监听8080端口

$ kubectl apply -f sidecar-container-demo.yaml
[root@k8s-master Probe]# kubectl get pod -o wide
NAME                                READY   STATUS             RESTARTS   AGE     IP              NODE        NOMINATED NODE   READINESS GATES
...
sidecar-container-demo              2/2     Running            0          39s     10.244.1.91     k8s-node1   <none>           <none>   #两个容器都准备就绪

$ curl 10.244.1.91:10000  #通过10000端口访问http服务 实现服务代理
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.1, ServerName: sidecar-container-demo, ServerIP: 10.244.1.91!
阅读 157
16 声望
4 粉丝
0 条评论
你知道吗?

16 声望
4 粉丝
宣传栏