diff --git a/.DS_Store b/.DS_Store index 563a4243..ab9f6721 100644 Binary files a/.DS_Store and b/.DS_Store differ diff --git a/1.1/1.1.md b/1.1/1.1.md index a636b117..c3c6c68d 100644 --- a/1.1/1.1.md +++ b/1.1/1.1.md @@ -62,16 +62,65 @@ ### Задание 1. Установка MicroK8S 1. Установить MicroK8S на локальную машину или на удалённую виртуальную машину. -2. Установить dashboard. +2. [Установить dashboard.](https://microk8s.io/docs/addon-dashboard) + + +```bash +microk8s enable dashboard +``` + 3. Сгенерировать сертификат для подключения к внешнему ip-адресу. +Добавляем в файл **/var/snap/microk8s/current/certs/csr.conf.template** внешний IP-адрес **192.168.1.13:** +```bash +"/var/snap/microk8s/current/certs/csr.conf.template" +... +[ alt_names ] +DNS.1 = kubernetes +DNS.2 = kubernetes.default +DNS.3 = kubernetes.default.svc +DNS.4 = kubernetes.default.svc.cluster +DNS.5 = kubernetes.default.svc.cluster.local +IP.1 = 127.0.0.1 +IP.2 = 10.152.183.1 +IP.4 = 192.168.1.13 +... +``` +Генерируем новый сертификат для подключения: +```bash +sudo microk8s refresh-certs --cert front-proxy-client.crt +``` ------ ### Задание 2. Установка и настройка локального kubectl 1. Установить на локальную машину kubectl. 2. Настроить локально подключение к кластеру. + +```bash +ad@ads-iMac .kube % kubectl get nodes +NAME STATUS ROLES AGE VERSION +ubuntu2004 Ready 168m v1.28.3 +``` + +![kuberctl get nodes](./assets/getnodes.png) + 3. Подключиться к дашборду с помощью port-forward. +Создать токен: +```bash +microk8s kubectl create token default +``` +Настроить port-forward: + +```bash +ols@ubuntu2004:~$ microk8s kubectl port-forward -n kube-system service/kubernetes-dashboard 10443:443 +Forwarding from 127.0.0.1:10443 -> 8443 +Forwarding from [::1]:10443 -> 8443 +... +``` + +![Dashboard](./assets/dashboard.png) + ------ ### Правила приёма работы diff --git a/1.1/assets/dashboard.png b/1.1/assets/dashboard.png new file mode 100644 index 00000000..1848b1ef Binary files /dev/null and b/1.1/assets/dashboard.png differ diff --git a/1.1/assets/getnodes.png b/1.1/assets/getnodes.png new file mode 100644 index 00000000..a17a11d5 Binary files /dev/null and b/1.1/assets/getnodes.png differ diff --git a/1.2/1.2.md b/1.2/1.2.md index 4bfd4be0..17c2b30d 100644 --- a/1.2/1.2.md +++ b/1.2/1.2.md @@ -2,7 +2,7 @@ ### Цель задания -В тестовой среде для работы с Kubernetes, установленной в предыдущем ДЗ, необходимо развернуть Pod с приложением и подключиться к нему со своего локального компьютера. +В тестовой среде для работы с Kubernetes, установленной в предыдущем ДЗ, необходимо развернуть Pod с приложением и подключиться к нему со своего локального компьютера. ------ @@ -24,9 +24,54 @@ ### Задание 1. Создать Pod с именем hello-world 1. Создать манифест (yaml-конфигурацию) Pod. + +[Манифест](./pod_helloworld.yml) 2. Использовать image - gcr.io/kubernetes-e2e-test-images/echoserver:2.2. 3. Подключиться локально к Pod с помощью `kubectl port-forward` и вывести значение (curl или в браузере). +```bash +ad@ads-iMac 1.2 % microk8s kubectl apply -f pod_helloworld.yml +pod/hello-world created +ad@ads-iMac 1.2 % microk8s kubectl get pods +NAME READY STATUS RESTARTS AGE +hello-world 1/1 Running 0 10s +ad@ads-iMac 1.2 % microk8s kubectl port-forward hello-world 12345:8080 +Forwarding from 127.0.0.1:12345 -> 8080 +Forwarding from [::1]:12345 -> 8080 +Handling connection for 12345 +``` + +```bash +ad@ads-iMac ~ % curl 127.0.0.1:12345 + + +Hostname: hello-world + +Pod Information: + -no pod information available- + +Server values: + server_version=nginx: 1.12.2 - lua: 10010 + +Request Information: + client_address=127.0.0.1 + method=GET + real path=/ + query= + request_version=1.1 + request_scheme=http + request_uri=http://127.0.0.1:8080/ + +Request Headers: + accept=*/* + host=127.0.0.1:12345 + user-agent=curl/8.4.0 + +Request Body: + -no body in request- +``` + +![Ответ pod'a в браузере](./assets/pod%20hello-world.png) ------ ### Задание 2. Создать Service и подключить его к Pod @@ -34,10 +79,59 @@ 1. Создать Pod с именем netology-web. 2. Использовать image — gcr.io/kubernetes-e2e-test-images/echoserver:2.2. 3. Создать Service с именем netology-svc и подключить к netology-web. + +```bash +ad@ads-iMac 1.2 % microk8s kubectl apply -f netology-web.yml +pod/netology-web created +ad@ads-iMac 1.2 % microk8s kubectl apply -f netology-svc.yml +service/netology-svc created +ad@ads-iMac 1.2 % microk8s kubectl port-forward service/netology-svc 8080:80 +Forwarding from 127.0.0.1:8080 -> 8080 +Forwarding from [::1]:8080 -> 8080 +Handling connection for 8080 +Handling connection for 8080 + +``` + 4. Подключиться локально к Service с помощью `kubectl port-forward` и вывести значение (curl или в браузере). +```ad@ads-iMac ~ % curl 127.0.0.1:8080 + + +Hostname: netology-web + +Pod Information: + -no pod information available- + +Server values: + server_version=nginx: 1.12.2 - lua: 10010 + +Request Information: + client_address=127.0.0.1 + method=GET + real path=/ + query= + request_version=1.1 + request_scheme=http + request_uri=http://127.0.0.1:8080/ + +Request Headers: + accept=*/* + host=127.0.0.1:8080 + user-agent=curl/8.4.0 + +Request Body: + -no body in request- +``` + +![Браузер](./assets/service%20netology-web.png) ------ + +Результат kubectl get pods + +![kubectl get pods](./assets/kubectl%20get%20pods.png) + ### Правила приёма работы 1. Домашняя работа оформляется в своем Git-репозитории в файле README.md. Выполненное домашнее задание пришлите ссылкой на .md-файл в вашем репозитории. @@ -47,6 +141,7 @@ ------ ### Критерии оценки + Зачёт — выполнены все задания, ответы даны в развернутой форме, приложены соответствующие скриншоты и файлы проекта, в выполненных заданиях нет противоречий и нарушения логики. На доработку — задание выполнено частично или не выполнено, в логике выполнения заданий есть противоречия, существенные недостатки. diff --git a/1.2/assets/kubectl get pods.png b/1.2/assets/kubectl get pods.png new file mode 100644 index 00000000..afc5faa1 Binary files /dev/null and b/1.2/assets/kubectl get pods.png differ diff --git a/1.2/assets/pod hello-world.png b/1.2/assets/pod hello-world.png new file mode 100644 index 00000000..578ade8a Binary files /dev/null and b/1.2/assets/pod hello-world.png differ diff --git a/1.2/assets/service netology-web.png b/1.2/assets/service netology-web.png new file mode 100644 index 00000000..4498f236 Binary files /dev/null and b/1.2/assets/service netology-web.png differ diff --git a/1.2/netology-svc.yml b/1.2/netology-svc.yml new file mode 100644 index 00000000..e546e553 --- /dev/null +++ b/1.2/netology-svc.yml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: Service +metadata: + name: netology-svc +spec: + ports: + - protocol: TCP + port: 80 + targetPort: 8080 + selector: + app: netology-label diff --git a/1.2/netology-web.yml b/1.2/netology-web.yml new file mode 100644 index 00000000..523ff9a5 --- /dev/null +++ b/1.2/netology-web.yml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Pod +metadata: + name: netology-web + labels: + app: netology-label +spec: + containers: + - name: netology-web + image: gcr.io/kubernetes-e2e-test-images/echoserver:2.2 + ports: + - containerPort: 8080 diff --git a/1.2/pod_helloworld.yml b/1.2/pod_helloworld.yml new file mode 100644 index 00000000..b6d0658a --- /dev/null +++ b/1.2/pod_helloworld.yml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: Pod +metadata: + name: hello-world +spec: + containers: + - name: hello-world + image: gcr.io/kubernetes-e2e-test-images/echoserver:2.2 + ports: + - containerPort: 12345 diff --git a/1.3/1.3.md b/1.3/1.3.md index 6b318741..9edd7a0c 100644 --- a/1.3/1.3.md +++ b/1.3/1.3.md @@ -16,7 +16,7 @@ ### Инструменты и дополнительные материалы, которые пригодятся для выполнения задания -1. [Описание](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) Deployment и примеры манифестов. +1. [Описание](https://kubernetes.iog/docs/concepts/workloads/controllers/deployment/) Deployment и примеры манифестов. 2. [Описание](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) Init-контейнеров. 3. [Описание](https://github.com/wbitt/Network-MultiTool) Multitool. @@ -25,20 +25,148 @@ ### Задание 1. Создать Deployment и обеспечить доступ к репликам приложения из другого Pod 1. Создать Deployment приложения, состоящего из двух контейнеров — nginx и multitool. Решить возникшую ошибку. + + [deployment-nginx-multitool](./deployment-nginx-multitool.yml) + +```bash +ols@ubuntults:~/homeworks/kuber-homeworks/1.3$ microk8s kubectl apply -f deployment-nginx-multitool.yml +deployment.apps/nginx-multitool created +ols@ubuntults:~/homeworks/kuber-homeworks/1.3$ microk8s kubectl get pods +NAME READY STATUS RESTARTS AGE +nginx-multitool-ddfc7678b-zzk48 0/2 ContainerCreating 0 15s +``` + 2. После запуска увеличить количество реплик работающего приложения до 2. 3. Продемонстрировать количество подов до и после масштабирования. + +```bash +ols@ubuntults:~/homeworks/kuber-homeworks/1.3$ microk8s kubectl apply -f deployment-nginx-multitool.yml +deployment.apps/nginx-multitool configured +ols@ubuntults:~/homeworks/kuber-homeworks/1.3$ microk8s kubectl get pods +NAME READY STATUS RESTARTS AGE +nginx-multitool-ddfc7678b-zzk48 2/2 Running 0 39s +nginx-multitool-ddfc7678b-987bl 0/2 ContainerCreating 0 3s +ols@ubuntults:~/homeworks/kuber-homeworks/1.3$ +``` + 4. Создать Service, который обеспечит доступ до реплик приложений из п.1. + + [service-nginx-multitool](./service-nginx-multitool.yml) + +```bash +ols@ubuntults:~/homeworks/kuber-homeworks/1.3$ microk8s kubectl apply -f service-nginx-multitool.yml +service/nginx-multitool-service created +ols@ubuntults:~/homeworks/kuber-homeworks/1.3$ microk8s kubectl get services +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +kubernetes ClusterIP 10.152.183.1 443/TCP 10d +nginx-multitool-service ClusterIP 10.152.183.94 80/TCP 12s +``` + 5. Создать отдельный Pod с приложением multitool и убедиться с помощью `curl`, что из пода есть доступ до приложений из п.1. + [multitool-pod](./multitool-pod.yml) + +--- +***NOTE*** + +``` +kubectl exec my-pod -- ls / # Выполнить команду в существующем поде (в случае одного контейнера). +``` + +--- + +```bash +ols@ubuntults:~/homeworks/kuber-homeworks/1.3$ microk8s kubectl apply -f multitool-pod.yml +pod/multitool created +ols@ubuntults:~/homeworks/kuber-homeworks/1.3$ kubectl exec -it multitool curl nginx-multitool-service +kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead. + + + +Welcome to nginx! + + + +

Welcome to nginx!

+

If you see this page, the nginx web server is successfully installed and +working. Further configuration is required.

+ +

For online documentation and support please refer to +nginx.org.
+Commercial support is available at +nginx.com.

+ +

Thank you for using nginx.

+ + +``` + ------ ### Задание 2. Создать Deployment и обеспечить старт основного контейнера при выполнении условий 1. Создать Deployment приложения nginx и обеспечить старт контейнера только после того, как будет запущен сервис этого приложения. + + [nginx-deploy](./nginx-deploy.yml) + 2. Убедиться, что nginx не стартует. В качестве Init-контейнера взять busybox. + +```bash +ols@ubuntults:~/homeworks/kuber-homeworks/1.3$ kubectl get pods +NAME READY STATUS RESTARTS AGE +nginx-7fff984987-5fm9b 0/1 Init:0/1 1 4m44s + +ols@ubuntults:~/homeworks/kuber-homeworks/1.3$ kubectl logs nginx-7fff984987-5fm9b +Defaulted container "nginx" out of: nginx, init-myservice (init) +Error from server (BadRequest): container "nginx" in pod "nginx-7fff984987-5fm9b" is waiting to start: PodInitializing +``` + 3. Создать и запустить Service. Убедиться, что Init запустился. + + [nginx-service](./nginx-service.yml) + 4. Продемонстрировать состояние пода до и после запуска сервиса. +```bash +ols@ubuntults:~/homeworks/kuber-homeworks/1.3$ microk8s kubectl apply -f nginx-service.yml +service/nginx-service created +ols@ubuntults:~/homeworks/kuber-homeworks/1.3$ kubectl get pods +NAME READY STATUS RESTARTS AGE +nginx-7fff984987-5fm9b 0/1 Init:0/1 1 7m46s + +ols@ubuntults:~/homeworks/kuber-homeworks/1.3$ kubectl get pods +NAME READY STATUS RESTARTS AGE +nginx-7fff984987-5fm9b 1/1 Running 0 7m51s + +ols@ubuntults:~/homeworks/kuber-homeworks/1.3$ kubectl logs nginx-7fff984987-5fm9b +Defaulted container "nginx" out of: nginx, init-myservice (init) +/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration +/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/ +/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh +10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.d/default.conf +10-listen-on-ipv6-by-default.sh: info: Enabled listen on IPv6 in /etc/nginx/conf.d/default.conf +/docker-entrypoint.sh: Sourcing /docker-entrypoint.d/15-local-resolvers.envsh +/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh +/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh +/docker-entrypoint.sh: Configuration complete; ready for start up +2024/02/24 10:51:44 [notice] 1#1: using the "epoll" event method +2024/02/24 10:51:44 [notice] 1#1: nginx/1.25.4 +2024/02/24 10:51:44 [notice] 1#1: built by gcc 12.2.0 (Debian 12.2.0-14) +2024/02/24 10:51:44 [notice] 1#1: OS: Linux 6.5.0-21-generic +2024/02/24 10:51:44 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 65536:65536 +2024/02/24 10:51:44 [notice] 1#1: start worker processes +2024/02/24 10:51:44 [notice] 1#1: start worker process 29 +2024/02/24 10:51:44 [notice] 1#1: start worker process 30 +2024/02/24 10:51:44 [notice] 1#1: start worker process 31 +2024/02/24 10:51:44 [notice] 1#1: start worker process 32 +``` + ------ ### Правила приема работы diff --git a/1.3/deployment-nginx-multitool.yml b/1.3/deployment-nginx-multitool.yml new file mode 100644 index 00000000..238d0405 --- /dev/null +++ b/1.3/deployment-nginx-multitool.yml @@ -0,0 +1,33 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: nginx-multitool + labels: + app: nginx +spec: + replicas: 2 + selector: + matchLabels: + app: nginx + template: + metadata: + labels: + app: nginx + spec: + containers: + - name: nginx + image: nginx:1.19.1 + ports: + - containerPort: 80 + - name: network-multitool + image: praqma/network-multitool + env: + - name: HTTP_PORT + value: "1180" + - name: HTTPS_PORT + value: "11443" + ports: + - containerPort: 1180 + name: http-port + - containerPort: 11443 + name: https-port diff --git a/1.3/multitool-pod.yml b/1.3/multitool-pod.yml new file mode 100644 index 00000000..048812a7 --- /dev/null +++ b/1.3/multitool-pod.yml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Pod +metadata: + name: multitool + labels: + app: multitool +spec: + containers: + - name: multitool + image: praqma/network-multitool + ports: + - containerPort: 8080 diff --git a/1.3/nginx-deploy.yml b/1.3/nginx-deploy.yml new file mode 100644 index 00000000..70385511 --- /dev/null +++ b/1.3/nginx-deploy.yml @@ -0,0 +1,28 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: nginx +spec: + replicas: 1 + selector: + matchLabels: + app: nginx + template: + metadata: + labels: + app: nginx + spec: + initContainers: + - name: init-myservice + image: busybox:1.28 + command: + [ + "sh", + "-c", + "until nslookup nginx-service.$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace).svc.cluster.local; do echo waiting for nginx-service; sleep 2; done", + ] + containers: + - name: nginx + image: nginx:latest + ports: + - containerPort: 80 diff --git a/1.3/nginx-service.yml b/1.3/nginx-service.yml new file mode 100644 index 00000000..3e9e5961 --- /dev/null +++ b/1.3/nginx-service.yml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: Service +metadata: + name: nginx-service +spec: + selector: + app: nginx + ports: + - port: 80 + targetPort: 8080 diff --git a/1.3/service-nginx-multitool.yml b/1.3/service-nginx-multitool.yml new file mode 100644 index 00000000..0759d52d --- /dev/null +++ b/1.3/service-nginx-multitool.yml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: Service +metadata: + name: nginx-multitool-service +spec: + selector: + app: nginx + ports: + - port: 80 + targetPort: 80 diff --git a/1.4/1.4.md b/1.4/1.4.md index 42944bc7..41fda2da 100644 --- a/1.4/1.4.md +++ b/1.4/1.4.md @@ -27,17 +27,183 @@ 1. Создать Deployment приложения, состоящего из двух контейнеров (nginx и multitool), с количеством реплик 3 шт. 2. Создать Service, который обеспечит доступ внутри кластера до контейнеров приложения из п.1 по порту 9001 — nginx 80, по 9002 — multitool 8080. 3. Создать отдельный Pod с приложением multitool и убедиться с помощью `curl`, что из пода есть доступ до приложения из п.1 по разным портам в разные контейнеры. + + [multitool pod](./multitools-pod.yml) + 4. Продемонстрировать доступ с помощью `curl` по доменному имени сервиса. + +```bash +ols@X12:~/homeworks/kuber-homeworks/1.4$ kubectl exec -it multitool-pod -- curl nginx-mtool-svc:9001 +E0301 21:06:27.213606 42757 memcache.go:265] couldn't get current server API group list: Get "http://localhost:8080/api?timeout=32s": dial tcp 127.0.0.1:8080: connect: connection refused +E0301 21:06:27.214176 42757 memcache.go:265] couldn't get current server API group list: Get "http://localhost:8080/api?timeout=32s": dial tcp 127.0.0.1:8080: connect: connection refused +E0301 21:06:27.215818 42757 memcache.go:265] couldn't get current server API group list: Get "http://localhost:8080/api?timeout=32s": dial tcp 127.0.0.1:8080: connect: connection refused +E0301 21:06:27.216183 42757 memcache.go:265] couldn't get current server API group list: Get "http://localhost:8080/api?timeout=32s": dial tcp 127.0.0.1:8080: connect: connection refused +The connection to the server localhost:8080 was refused - did you specify the right host or port? +ols@X12:~/homeworks/kuber-homeworks/1.4$ microk8s kubectl exec -it multitool-pod -- curl nginx-mtool-s +vc:9001 + + + +Welcome to nginx! + + + +

Welcome to nginx!

+

If you see this page, the nginx web server is successfully installed and +working. Further configuration is required.

+ +

For online documentation and support please refer to +nginx.org.
+Commercial support is available at +nginx.com.

+ +

Thank you for using nginx.

+ + +``` + +```bash +ols@X12:~/homeworks/kuber-homeworks/1.4$ microk8s kubectl exec -it multitool-pod -- curl nginx-mtool-svc:9002 +Praqma Network MultiTool (with NGINX) - nginx-mtool-app-75bb448c7b-vbf8l - 10.1.152.11 - HTTP: 8080 , HTTPS: 11443 +
+
+
+ +

05 Jan 2022 - Press-release: `Praqma/Network-Multitool` is now `wbitt/Network-Multitool`

+ +

Important note about name/org change:

+

+Few years ago, I created this tool with Henrik Høegh, as `praqma/network-multitool`. Praqma was bought by another company, and now the "Praqma" brand is being dismantled. This means the network-multitool's git and docker repositories must go. Since, I was the one maintaining the docker image for all these years, it was decided by the current representatives of the company to hand it over to me so I can continue maintaining it. So, apart from a small change in the repository name, nothing has changed.
+

+

+The existing/old/previous container image `praqma/network-multitool` will continue to work and will remain available for **"some time"** - may be for a couple of months - not sure though. +

+

+- Kamran Azeem https://github.com/KamranAzeem +

+ +

Some important URLs:

+ + + +
+Or: +
+ +
+  
+  docker pull wbitt/network-multitool
+  
+
+ + +
+``` + 5. Предоставить манифесты Deployment и Service в решении, а также скриншоты или вывод команды п.4. + [Deployment](./nginx-multitool-app.yml) + + [Service](./nginx-multitool-svc.yml) + ------ ### Задание 2. Создать Service и обеспечить доступ к приложениям снаружи кластера 1. Создать отдельный Service приложения из Задания 1 с возможностью доступа снаружи кластера к nginx, используя тип NodePort. + +```bash +ols@ubuntults:~/homeworks/kuber-homeworks/1.4$ microk8s kubectl get services -w +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +kubernetes ClusterIP 10.152.183.1 443/TCP 4d +nginx-mtool-svc ClusterIP 10.152.183.60 9001/TCP,9002/TCP 3d23h +nginx-mtool-svc-np NodePort 10.152.183.97 9001:30568/TCP,9002:32333/TCP 9m56s +``` 2. Продемонстрировать доступ с помощью браузера или `curl` с локального компьютера. + + ![Доступ к nginx через NodePort](./assets/nginx-nodeport.png) + +```bash +ols@X12:~/homeworks/kuber-homeworks/1.4$ curl 192.168.1.13:30080 + + + +Welcome to nginx! + + + +

Welcome to nginx!

+

If you see this page, the nginx web server is successfully installed and +working. Further configuration is required.

+ +

For online documentation and support please refer to +nginx.org.
+Commercial support is available at +nginx.com.

+ +

Thank you for using nginx.

+ + +``` +```bash +ols@X12:~/homeworks/kuber-homeworks/1.4$ curl 192.168.1.13:31443 +Praqma Network MultiTool (with NGINX) - nginx-mtool-app-75bb448c7b-qshqp - 10.1.152.9 - HTTP: 8080 , HTTPS: 11443 +
+
+
+ +

05 Jan 2022 - Press-release: `Praqma/Network-Multitool` is now `wbitt/Network-Multitool`

+ +

Important note about name/org change:

+

+Few years ago, I created this tool with Henrik Høegh, as `praqma/network-multitool`. Praqma was bought by another company, and now the "Praqma" brand is being dismantled. This means the network-multitool's git and docker repositories must go. Since, I was the one maintaining the docker image for all these years, it was decided by the current representatives of the company to hand it over to me so I can continue maintaining it. So, apart from a small change in the repository name, nothing has changed.
+

+

+The existing/old/previous container image `praqma/network-multitool` will continue to work and will remain available for **"some time"** - may be for a couple of months - not sure though. +

+

+- Kamran Azeem https://github.com/KamranAzeem +

+ +

Some important URLs:

+ + + +
+Or: +
+ +
+  
+  docker pull wbitt/network-multitool
+  
+
+ + +
+``` + 3. Предоставить манифест и Service в решении, а также скриншоты или вывод команды п.2. + [Service](nginx-mtool-svc-nodeport.yml) + + ------ ### Правила приёма работы @@ -45,4 +211,3 @@ 1. Домашняя работа оформляется в своем Git-репозитории в файле README.md. Выполненное домашнее задание пришлите ссылкой на .md-файл в вашем репозитории. 2. Файл README.md должен содержать скриншоты вывода необходимых команд `kubectl` и скриншоты результатов. 3. Репозиторий должен содержать тексты манифестов или ссылки на них в файле README.md. - diff --git a/1.4/assets/nginx-nodeport.png b/1.4/assets/nginx-nodeport.png new file mode 100644 index 00000000..acf298c2 Binary files /dev/null and b/1.4/assets/nginx-nodeport.png differ diff --git a/1.4/multitools-pod.yml b/1.4/multitools-pod.yml new file mode 100644 index 00000000..a8b8bade --- /dev/null +++ b/1.4/multitools-pod.yml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Pod +metadata: + name: multitool-pod + labels: + name: multitool-pod +spec: + containers: + - name: multitool + image: praqma/network-multitool + ports: + - containerPort: 8080 diff --git a/1.4/nginx-mtool-svc-nodeport.yml b/1.4/nginx-mtool-svc-nodeport.yml new file mode 100644 index 00000000..ac81c6a8 --- /dev/null +++ b/1.4/nginx-mtool-svc-nodeport.yml @@ -0,0 +1,17 @@ +apiVersion: v1 +kind: Service +metadata: + name: nginx-mtool-svc-np +spec: + selector: + app: nginx-mtool + ports: + - name: web + port: 9001 + targetPort: 80 + nodePort: 30080 + - name: multitool + port: 9002 + targetPort: 8080 + nodePort: 31443 + type: NodePort diff --git a/1.4/nginx-multitool-app.yml b/1.4/nginx-multitool-app.yml new file mode 100644 index 00000000..fd84720e --- /dev/null +++ b/1.4/nginx-multitool-app.yml @@ -0,0 +1,31 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: nginx-mtool-app +spec: + replicas: 3 + selector: + matchLabels: + app: nginx-mtool + template: + metadata: + labels: + app: nginx-mtool + spec: + containers: + - name: multitool + image: praqma/network-multitool + env: + - name: HTTP_PORT + value: "8080" + - name: HTTPS_PORT + value: "11443" + ports: + - containerPort: 8080 + name: http-port + - containerPort: 11443 + name: https-port + - name: nginx + image: nginx:latest + ports: + - containerPort: 80 diff --git a/1.4/nginx-multitool-svc.yml b/1.4/nginx-multitool-svc.yml new file mode 100644 index 00000000..1b122683 --- /dev/null +++ b/1.4/nginx-multitool-svc.yml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: nginx-mtool-svc +spec: + selector: + app: nginx-mtool + ports: + - name: web + port: 9001 + targetPort: 80 + - name: multitool + port: 9002 + targetPort: 8080 diff --git a/1.5/1.5.md b/1.5/1.5.md index 36b8a605..ebbb0169 100644 --- a/1.5/1.5.md +++ b/1.5/1.5.md @@ -26,20 +26,103 @@ ### Задание 1. Создать Deployment приложений backend и frontend 1. Создать Deployment приложения _frontend_ из образа nginx с количеством реплик 3 шт. -2. Создать Deployment приложения _backend_ из образа multitool. -3. Добавить Service, которые обеспечат доступ к обоим приложениям внутри кластера. +2. Создать Deployment приложения _backend_ из образа multitool. +3. Добавить Service, которые обеспечат доступ к обоим приложениям внутри кластера. + +```bash +microk8s kubectl get po +NAME READY STATUS RESTARTS AGE +multitool-back-77bc9d4d44-f5t2w 1/1 Running 0 22m +nginx-front-7b89c5fb8c-zj7ph 1/1 Running 0 7m7s +nginx-front-7b89c5fb8c-xrbzh 1/1 Running 0 7m7s +nginx-front-7b89c5fb8c-gvb9d 1/1 Running 0 7m7s +``` + 4. Продемонстрировать, что приложения видят друг друга с помощью Service. + +```bash +microk8s kubectl exec -it multitool-back-77bc9d4d44-f5t2w -- curl nginx-front + + + +Welcome to nginx! + + + +

Welcome to nginx!

+

If you see this page, the nginx web server is successfully installed and +working. Further configuration is required.

+ +

For online documentation and support please refer to +nginx.org.
+Commercial support is available at +nginx.com.

+ +

Thank you for using nginx.

+ + +``` + +```bash +microk8s kubectl exec nginx-front-7b89c5fb8c-69dcq -- curl multitool-back + % Total % Received % Xferd Average Speed Time Time Time Current + Dload Upload Total Spent Left Speed + 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0WBITT Network MultiTool (with NGINX) - multitool-back-6987f5d6b7-9wmzp - 10.1.152.1 - HTTP: 80 , HTTPS: 443 . (Formerly praqma/network-multitool) +100 146 100 146 0 0 84393 0 --:--:-- --:--:-- --:--:-- 142k +``` + 5. Предоставить манифесты Deployment и Service в решении, а также скриншоты или вывод команды п.4. + [frontend-nginx.yml](./frontend-nginx.yml) + + [svc-front-nginx.yml](./svc-front-nginx.yml) + + [backend-multitool.yml](./backend-multitool.yml) + + [svc-back-mtool.ym](./svc-back-mtool.yml) + ------ ### Задание 2. Создать Ingress и обеспечить доступ к приложениям снаружи кластера 1. Включить Ingress-controller в MicroK8S. +```bash +microk8s enable ingress +Infer repository core for addon ingress +Enabling Ingress +... +Ingress is enabled +``` + 2. Создать Ingress, обеспечивающий доступ снаружи по IP-адресу кластера MicroK8S так, чтобы при запросе только по адресу открывался _frontend_ а при добавлении /api - _backend_. + +```bash +microk8s kubectl apply -f ingress.yml +ingress.networking.k8s.io/ingress created + +microk8s kubectl get ingress +NAME CLASS HOSTS ADDRESS PORTS AGE +ingress nginx * 127.0.0.1 80 89s +``` + 3. Продемонстрировать доступ с помощью браузера или `curl` с локального компьютера. + + +Frontend: +![Ingress /](./assets/ingress_front.png) + +Backend: +![Ingress /api](./assets/ingress_back.png) + + 4. Предоставить манифесты и скриншоты или вывод команды п.2. + [ingress.yml](./ingress.yml) + ------ ### Правила приема работы diff --git a/1.5/assets/ingress_back.png b/1.5/assets/ingress_back.png new file mode 100644 index 00000000..89f60ea5 Binary files /dev/null and b/1.5/assets/ingress_back.png differ diff --git a/1.5/assets/ingress_front.png b/1.5/assets/ingress_front.png new file mode 100644 index 00000000..99c59ee5 Binary files /dev/null and b/1.5/assets/ingress_front.png differ diff --git a/1.5/backend-multitool.yml b/1.5/backend-multitool.yml new file mode 100644 index 00000000..004f04f7 --- /dev/null +++ b/1.5/backend-multitool.yml @@ -0,0 +1,18 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: multitool-back +spec: + selector: + matchLabels: + app: mtool-app + template: + metadata: + labels: + app: mtool-app + spec: + containers: + - name: multitool + image: wbitt/network-multitool + ports: + - containerPort: 80 diff --git a/1.5/frontend-nginx.yml b/1.5/frontend-nginx.yml new file mode 100644 index 00000000..070f20cc --- /dev/null +++ b/1.5/frontend-nginx.yml @@ -0,0 +1,19 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: nginx-front +spec: + replicas: 3 + selector: + matchLabels: + app: nginx-front + template: + metadata: + labels: + app: nginx-front + spec: + containers: + - name: nginx + image: nginx:latest + ports: + - containerPort: 80 diff --git a/1.5/ingress.yml b/1.5/ingress.yml new file mode 100644 index 00000000..53f17848 --- /dev/null +++ b/1.5/ingress.yml @@ -0,0 +1,25 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: ingress + annotations: + nginx.ingress.kubernetes.io/rewrite-target: / +spec: + ingressClassName: nginx + rules: + - http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: nginx-front + port: + number: 80 + - path: /api + pathType: Prefix + backend: + service: + name: multitool-back + port: + number: 80 diff --git a/1.5/svc-back-mtool.yml b/1.5/svc-back-mtool.yml new file mode 100644 index 00000000..38cb813f --- /dev/null +++ b/1.5/svc-back-mtool.yml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: Service +metadata: + name: multitool-back +spec: + selector: + app: mtool-app + ports: + - name: mtool + port: 80 diff --git a/1.5/svc-front-nginx.yml b/1.5/svc-front-nginx.yml new file mode 100644 index 00000000..7d6fe1d7 --- /dev/null +++ b/1.5/svc-front-nginx.yml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: Service +metadata: + name: nginx-front +spec: + selector: + app: nginx-front + ports: + - name: nginx + port: 80 diff --git a/2.1/2.1.md b/2.1/2.1.md index 5cbe781f..a221d7b8 100644 --- a/2.1/2.1.md +++ b/2.1/2.1.md @@ -30,10 +30,32 @@ 1. Создать Deployment приложения, состоящего из контейнеров busybox и multitool. 2. Сделать так, чтобы busybox писал каждые пять секунд в некий файл в общей директории. +```bash +#Пишем текущую дату в файл с задержкой в ~5 секунд +command: ["/bin/sh","-c","while true; do date >> /share/date.txt; sleep 5; done",] +``` + 3. Обеспечить возможность чтения файла контейнером multitool. -4. Продемонстрировать, что multitool может читать файл, который периодоически обновляется. +4. Продемонстрировать, что multitool может читать файл, который периодически обновляется. +```bash +microk8s kubectl exec -it busyboxmtool-f8fdd8599-chzct -c multitool -- /bin/bash +busyboxmtool-f8fdd8599-chzct:/# ls +bin docker lib opt run srv usr +certs etc media proc sbin sys var +dev home mnt root share tmp +busyboxmtool-f8fdd8599-chzct:/# cd share/ +busyboxmtool-f8fdd8599-chzct:/share# ls +date.txt +busyboxmtool-f8fdd8599-chzct:/share# cat date.txt +Fri Mar 15 20:37:53 UTC 2024 +Fri Mar 15 20:37:58 UTC 2024 +Fri Mar 15 20:38:03 UTC 2024 +``` + 5. Предоставить манифесты Deployment в решении, а также скриншоты или вывод команды из п. 4. + [Манифест Deployment](./busybox-multitool.yml) + ------ ### Задание 2 @@ -45,8 +67,16 @@ 1. Создать DaemonSet приложения, состоящего из multitool. 2. Обеспечить возможность чтения файла `/var/log/syslog` кластера MicroK8S. 3. Продемонстрировать возможность чтения файла изнутри пода. +```bash +microk8s kubectl exec -it logger-4q5sz -- tail -3 /var/log/syslog +2024-03-15T23:53:10.681534+03:00 x12 wpa_supplicant[825]: wlp0s20f3: WPA: Group rekeying completed with b8:69:f4:cc:70:bb [GTK=CCMP] +2024-03-15T23:53:17.788911+03:00 x12 systemd[1]: run-containerd-runc-k8s.io-064846e5785d5a8106d39f6fcafa5e45baf6a34c3b8f15ac2e719a9b540e9f47-runc.m9DBJz.mount: Deactivated successfully. +2024-03-15T23:53:20.260973+03:00 x12 systemd[2261]: Started snap.microk8s.microk8s-f9d7ea17-a31f-41ee-9a02-c716ba4b256a.scope. +``` + 4. Предоставить манифесты Deployment, а также скриншоты или вывод команды из п. 2. + [Манифест](./logger.yml) ------ ### Правила приёма работы diff --git a/2.1/busybox-multitool.yml b/2.1/busybox-multitool.yml new file mode 100644 index 00000000..c771ba87 --- /dev/null +++ b/2.1/busybox-multitool.yml @@ -0,0 +1,34 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: busyboxmtool +spec: + replicas: 1 + selector: + matchLabels: + app: boxmtool + template: + metadata: + labels: + app: boxmtool + spec: + containers: + - name: busybox + image: busybox + command: + [ + "/bin/sh", + "-c", + "while true; do date >> /share/date.txt; sleep 5; done", + ] + volumeMounts: + - name: share + mountPath: /share + - name: multitool + image: wbitt/network-multitool + volumeMounts: + - name: share + mountPath: /share + volumes: + - name: share + emptyDir: {} diff --git a/2.1/logger.yml b/2.1/logger.yml new file mode 100644 index 00000000..df7b2025 --- /dev/null +++ b/2.1/logger.yml @@ -0,0 +1,25 @@ +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: logger + labels: + app: logger +spec: + selector: + matchLabels: + app: logger + template: + metadata: + labels: + app: logger + spec: + containers: + - name: multitool + image: wbitt/network-multitool + volumeMounts: + - name: varlog + mountPath: /var/log/syslog + volumes: + - name: varlog + hostPath: + path: /var/log/syslog diff --git a/2.2/deployment.yml b/2.2/deployment.yml new file mode 100644 index 00000000..1a16390f --- /dev/null +++ b/2.2/deployment.yml @@ -0,0 +1,17 @@ +appVersion: apps/v1 +kind: Deployment +metadata: + name: busyboxmtools-pv +spec: + replicas: 1 + selector: + matchLabels: + app: myapp-pv + template: + metadata: + labels: + app: myapp-pv + spec: + containers: + - name: busybox + image: busybox diff --git a/3.1/3.1.md b/3.1/3.1.md index 8bfa1de0..25ae7170 100644 --- a/3.1/3.1.md +++ b/3.1/3.1.md @@ -28,8 +28,48 @@ 1. Домашняя работа оформляется в своем Git-репозитории в файле README.md. Выполненное домашнее задание пришлите ссылкой на .md-файл в вашем репозитории. 2. Сначала сделайте расчёт всех необходимых ресурсов. +``` +БД 3 шт ((3*1 ядро) + (3*4 Гб ОЗУ) = 3 ядра + 12 Гб ОЗУ) +Кэш 3 шт ((3*1 ядро) + (3*4 Гб ОЗУ) = 3 ядра + 12 Гб ОЗУ) +Фронтенд 5 шт ((5*0.2 ядра) + (5*50 мб ОЗУ) = 1 ядро + 250 мб ОЗУ) +Бекенд 10 шт ((10*1 ядро) + (10*600 мб ОЗУ) = 10 ядер + 6 Гб ОЗУ ) + +Итого суммарная нагрузка: +(3+3+1+10 ядер) + (12+12+0.25+6 Гб ОЗУ) = 17 ядер + 30,25 Гб ОЗУ + 3. Затем прикиньте количество рабочих нод, которые справятся с такой нагрузкой. + +Для отказоустойчивости БД и Кэша нужно их распределить минимум на 3 ноды с ресурсами в каждой: +(17 ядер/3) + (30.25 Гб ОЗУ/3) = 5.67 ядер + 10.08 Гб ОЗУ + 4. Добавьте к полученным цифрам запас, который учитывает выход из строя как минимум одной ноды. + +Добавляя ноду 4 для запаса получаем +(4*5.67 ядер) + (4*10.08 Гб ОЗУ) = 22.68 ядра + 40.32 Гб ОЗУ + +Но так как не желательно деплоить на мастер ноду и для корректной работы RAFT-алгоритма необходимо нечетное количество нод, по-этому добавляем ноду 5. +(5*5.67 ядер) + (5*10.08 Гб ОЗУ) = 28.35 ядер + 50.4 Гб ОЗУ + 5. Добавьте служебные ресурсы к нодам. Помните, что для разных типов нод требовния к ресурсам разные. + +Добавляем в расчет особенность запуска подов под каждый деплоймент: + +БД 3 шт + 1 pod (((3+1)*1 ядро) + ((3+1)*4 Гб ОЗУ) = 4 ядра + 16 Гб ОЗУ) +Кэш 3 шт + 1 pod (((3+1)*1 ядро) + ((3+1)*4 Гб ОЗУ) = 4 ядра + 16 Гб ОЗУ) +Фронтенд 5 шт + 1 pod (((5+1)*0.2 ядра) + ((5+1)*50 мб ОЗУ) = 1.2 ядра + 300 мб ОЗУ) +Бекенд 10 шт + 1 pod (((10+1)*1 ядро) + ((10+1)*600 мб ОЗУ) = 11 ядер + 6.6 Гб ОЗУ ) + +Суммарно для минимально необходимых 3 нод: + +(4+4+1.2+11 ядер) + (16+16+0.3+6.6 Гб ОЗУ) = 20.2 ядра + 38.9 Гб ОЗУ + +Для одной ноды: + +(20.2 ядра/3) + (38.9 Гб ОЗУ/3) = 6.73 ядра + 12.97 Гб ОЗУ + + 6. В результате должно быть указано количество нод и их параметры. +В итоге рекомендовано использовать 5 нод с 6.73 ядрами ЦПУ и 12.97 Гб ОЗУ на каждой. + +``` \ No newline at end of file diff --git a/3.2/3.2.md b/3.2/3.2.md index 007be59a..6e1b0086 100644 --- a/3.2/3.2.md +++ b/3.2/3.2.md @@ -23,6 +23,133 @@ 3. Запуск etcd производить на мастере. 4. Способ установки выбрать самостоятельно. +Подготовка ВМ: + +```bash +yc compute instance list ++----------------------+-------------+---------------+---------+----------------+-------------+ +| ID | NAME | ZONE ID | STATUS | EXTERNAL IP | INTERNAL IP | ++----------------------+-------------+---------------+---------+----------------+-------------+ +| epd03a1a2ghmfq9lnkck | k8s-worker4 | ru-central1-b | RUNNING | 158.160.68.192 | 10.129.0.36 | +| epd19p3838aneja2oqvk | k8s-worker1 | ru-central1-b | RUNNING | 84.201.177.122 | 10.129.0.31 | +| epd3h6glnvrhd98don4i | k8s-worker3 | ru-central1-b | RUNNING | 158.160.69.185 | 10.129.0.6 | +| epd8jubj54671ems7gjl | k8s-worker2 | ru-central1-b | RUNNING | 62.84.122.148 | 10.129.0.20 | +| epdvij2bm88nn3lc32o6 | k8s-master | ru-central1-b | RUNNING | 158.160.87.107 | 10.129.0.14 | ++----------------------+-------------+---------------+---------+----------------+-------------+ +``` + + +Выбрана установка kubeadm 1.29 c последующим добавлением worker nodes + +[Скрипт для установки и настройки kubeadm](./kubeadm_install.sh) + +Инициализация master node: +```bash +sudo kubeadm init +I0421 10:26:58.234251 3101 version.go:256] remote version is much newer: v1.30.0; falling back to: stable-1.29 +[init] Using Kubernetes version: v1.29.4 +[preflight] Running pre-flight checks +[preflight] Pulling images required for setting up a Kubernetes cluster +[preflight] This might take a minute or two, depending on the speed of your internet connection +[preflight] You can also perform this action in beforehand using 'kubeadm config images pull' +W0421 10:27:17.881473 3101 checks.go:835] detected that the sandbox image "registry.k8s.io/pause:3.8" of the container runtime is inconsistent with that used by kubeadm. It is recommended that using "registry.k8s.io/pause:3.9" as the CRI sandbox image. +[certs] Using certificateDir folder "/etc/kubernetes/pki" +[certs] Generating "ca" certificate and key +[certs] Generating "apiserver" certificate and key +[certs] apiserver serving cert is signed for DNS names [k8s-master kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local] and IPs [10.96.0.1 10.129.0.14] +[certs] Generating "apiserver-kubelet-client" certificate and key +[certs] Generating "front-proxy-ca" certificate and key +[certs] Generating "front-proxy-client" certificate and key +[certs] Generating "etcd/ca" certificate and key +[certs] Generating "etcd/server" certificate and key +[certs] etcd/server serving cert is signed for DNS names [k8s-master localhost] and IPs [10.129.0.14 127.0.0.1 ::1] +[certs] Generating "etcd/peer" certificate and key +[certs] etcd/peer serving cert is signed for DNS names [k8s-master localhost] and IPs [10.129.0.14 127.0.0.1 ::1] +[certs] Generating "etcd/healthcheck-client" certificate and key +[certs] Generating "apiserver-etcd-client" certificate and key +[certs] Generating "sa" key and public key +[kubeconfig] Using kubeconfig folder "/etc/kubernetes" +[kubeconfig] Writing "admin.conf" kubeconfig file +[kubeconfig] Writing "super-admin.conf" kubeconfig file +[kubeconfig] Writing "kubelet.conf" kubeconfig file +[kubeconfig] Writing "controller-manager.conf" kubeconfig file +[kubeconfig] Writing "scheduler.conf" kubeconfig file +[etcd] Creating static Pod manifest for local etcd in "/etc/kubernetes/manifests" +[control-plane] Using manifest folder "/etc/kubernetes/manifests" +[control-plane] Creating static Pod manifest for "kube-apiserver" +[control-plane] Creating static Pod manifest for "kube-controller-manager" +[control-plane] Creating static Pod manifest for "kube-scheduler" +[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env" +[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml" +[kubelet-start] Starting the kubelet +[wait-control-plane] Waiting for the kubelet to boot up the control plane as static Pods from directory "/etc/kubernetes/manifests". This can take up to 4m0s +[apiclient] All control plane components are healthy after 8.001642 seconds +[upload-config] Storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace +[kubelet] Creating a ConfigMap "kubelet-config" in namespace kube-system with the configuration for the kubelets in the cluster +[upload-certs] Skipping phase. Please see --upload-certs +[mark-control-plane] Marking the node k8s-master as control-plane by adding the labels: [node-role.kubernetes.io/control-plane node.kubernetes.io/exclude-from-external-load-balancers] +[mark-control-plane] Marking the node k8s-master as control-plane by adding the taints [node-role.kubernetes.io/control-plane:NoSchedule] +[bootstrap-token] Using token: 0gpjmn.cvkmxcp940x1nl4q +[bootstrap-token] Configuring bootstrap tokens, cluster-info ConfigMap, RBAC Roles +[bootstrap-token] Configured RBAC rules to allow Node Bootstrap tokens to get nodes +[bootstrap-token] Configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials +[bootstrap-token] Configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token +[bootstrap-token] Configured RBAC rules to allow certificate rotation for all node client certificates in the cluster +[bootstrap-token] Creating the "cluster-info" ConfigMap in the "kube-public" namespace +[kubelet-finalize] Updating "/etc/kubernetes/kubelet.conf" to point to a rotatable kubelet client certificate and key +[addons] Applied essential addon: CoreDNS +[addons] Applied essential addon: kube-proxy + +Your Kubernetes control-plane has initialized successfully! + +To start using your cluster, you need to run the following as a regular user: + + mkdir -p $HOME/.kube + sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config + sudo chown $(id -u):$(id -g) $HOME/.kube/config + +Alternatively, if you are the root user, you can run: + + export KUBECONFIG=/etc/kubernetes/admin.conf + +You should now deploy a pod network to the cluster. +Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at: + https://kubernetes.io/docs/concepts/cluster-administration/addons/ + +Then you can join any number of worker nodes by running the following on each as root: + +kubeadm join 10.129.0.14:6443 --token 0gpjmn.cvkmxcp940x1nl4q \ + --discovery-token-ca-cert-hash sha256:0063a708d7ef85d3804ae4df09e35abf3bee3d7a0f4c8c55603b1fbb3da9b47c +``` +Пример присоединения worker node: +```bash +sudo kubeadm join 10.129.0.14:6443 --token 0gpjmn.cvkmxcp940x1nl4q --discovery-token-ca-cert-hash sha256:0063a708d7ef85d3804ae4df09e35abf3bee3d7a0f4c8c55603b1fbb3da9b47c +[preflight] Running pre-flight checks +[preflight] Reading configuration from the cluster... +[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml' +[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml" +[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env" +[kubelet-start] Starting the kubelet +[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap... + +This node has joined the cluster: +* Certificate signing request was sent to apiserver and a response was received. +* The Kubelet was informed of the new secure connection details. + +Run 'kubectl get nodes' on the control-plane to see this node join the cluster. +``` +Итоговый кластер: +```bash +kubectl get nodes +NAME STATUS ROLES AGE VERSION +k8s-master NotReady control-plane 59m v1.29.4 +k8s-worker1 NotReady 40m v1.29.4 +k8s-worker2 NotReady 20m v1.29.4 +k8s-worker3 NotReady 16m v1.29.4 +k8s-worker4 NotReady 9m59s v1.29.4 +``` + + ## Дополнительные задания (со звёздочкой) **Настоятельно рекомендуем выполнять все задания под звёздочкой.** Их выполнение поможет глубже разобраться в материале. diff --git a/3.2/kubeadm_install.sh b/3.2/kubeadm_install.sh new file mode 100644 index 00000000..7b8fc47b --- /dev/null +++ b/3.2/kubeadm_install.sh @@ -0,0 +1,23 @@ +sudo apt-get update +# apt-transport-https may be a dummy package; if so, you can skip that package +sudo apt-get install -y apt-transport-https ca-certificates curl gpg + +# If the directory `/etc/apt/keyrings` does not exist, it should be created before the curl command, read the note below. +# sudo mkdir -p -m 755 /etc/apt/keyrings +curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.30/deb/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg + +# This overwrites any existing configuration in /etc/apt/sources.list.d/kubernetes.list +echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.30/deb/ /' | sudo tee /etc/apt/sources.list.d/kubernetes.list + +sudo apt-get update +sudo apt-get install -y kubelet kubeadm kubectl containerd +sudo apt-mark hold kubelet kubeadm kubectl containerd + +# патчим ядро +modprobe br_netfilter +echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf +echo "net.bridge.bridge-nf-call-iptables=1" >> /etc/sysctl.conf +echo "net.bridge.bridge-nf-call-arptables=1" >> /etc/sysctl.conf +echo "net.bridge.bridge-nf-call-ip6tables=1" >> /etc/sysctl.conf +sysctl -p /etc/sysctl.conf + diff --git a/3.3/3.3.md b/3.3/3.3.md index 47e061ce..6891054f 100644 --- a/3.3/3.3.md +++ b/3.3/3.3.md @@ -19,11 +19,151 @@ ### Задание 1. Создать сетевую политику или несколько политик для обеспечения доступа 1. Создать deployment'ы приложений frontend, backend и cache и соответсвующие сервисы. -2. В качестве образа использовать network-multitool. +2. В качестве образа использовать network-multitool. + + [multitool-frontend](./frontend.yml) + + [multitool-backend](./backend.yml) + + [multitool-cache](./cache.yml) + 3. Разместить поды в namespace App. + +```bash +kubectl get namespace +NAME STATUS AGE +app Active 7h9m +default Active 6d6h +kube-node-lease Active 6d6h +kube-public Active 6d6h +kube-system Active 6d6h +``` + 4. Создать политики, чтобы обеспечить доступ frontend -> backend -> cache. Другие виды подключений должны быть запрещены. + + [Дефолтная политика на запрет всего входящего трафика](./networkpolicy-default-deny-ingress.yml) + + [Разрешаем входящий трафик с frontend на backend](./networkpolicy-backend.yml) + + [Разрешаем входящий трафик с backend на cache](./networkpolicy-cache.yml) + 5. Продемонстрировать, что трафик разрешён и запрещён. +Применение дефолтной политики: +```bash +kubectl -n app describe networkpolicy.networking.k8s.io default +Name: default-deny-ingress +Namespace: app +Created on: 2024-04-23 19:51:47 +0300 MSK +Labels: +Annotations: +Spec: + PodSelector: (Allowing the specific traffic to all pods in this namespace) + Allowing ingress traffic: + (Selected pods are isolated for ingress connectivity) + Not affecting egress traffic + Policy Types: Ingress +``` + +Применение политики на backend: +```bash +kubectl -n app describe networkpolicy.networking.k8s.io cache +Name: cache-policy +Namespace: app +Created on: 2024-04-23 19:51:37 +0300 MSK +Labels: +Annotations: +Spec: + PodSelector: app=cache + Allowing ingress traffic: + To Port: 80/TCP + To Port: 443/TCP + From: + PodSelector: app=backend + Not affecting egress traffic + Policy Types: Ingress +``` + + +Применение политики для cache: +```bash +kubectl -n app describe networkpolicy.networking.k8s.io cache +Name: cache-policy +Namespace: app +Created on: 2024-04-23 19:51:37 +0300 MSK +Labels: +Annotations: +Spec: + PodSelector: app=cache + Allowing ingress traffic: + To Port: 80/TCP + To Port: 443/TCP + From: + PodSelector: app=backend + Not affecting egress traffic + Policy Types: Ingress +``` +Тестирование доступа через curl + +Разрешенный доступ: + +frontend > backend +```bash +kubectl -n app exec multitool-front-578f985797-rnxqf curl multitool-back +kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead. + % Total % Received % Xferd Average Speed Time Time Time Current + Dload Upload Total Spent Left Speed +100 146 100 146 0 0 206k 0 --:--:-- --:--:-- --:--:-- 142k +WBITT Network MultiTool (with NGINX) - multitool-back-7bfd89b7c7-lgfrq - 10.1.152.8 - HTTP: 80 , HTTPS: 443 . (Formerly praqma/network-multitool) +``` +backend > cache +```bash +kubectl -n app exec multitool-back-7bfd89b7c7-lgfrq curl multitool-cache +kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead. + % Total % Received % Xferd Average Speed Time Time Time Current + Dload Upload Total Spent Left Speed +100 146 100 146 0 0 189k 0 --:--:-- --:--:-- --:--:-- 142k +WBITT Network MultiTool (with NGINX) - multitool-cache-bd6c58d5f-9dqfz - 10.1.152.9 - HTTP: 80 , HTTPS: 443 . (Formerly praqma/network-multitool) +``` + +Запрещенный доступ: + +front > cache +```bash +ols@x12:~/homeworks/kuber-homeworks/3.3$ kubectl -n app exec multitool-front-578f985797-rnxqf curl multitool-cache +kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead. + % Total % Received % Xferd Average Speed Time Time Time Current + Dload Upload Total Spent Left Speed + 0 0 0 0 0 0 0 0 --:--:-- 0:00:05 --:--:-- 0^C[A^[[A +``` + +back > front +```bash +kubectl -n app exec multitool-back-7bfd89b7c7-lgfrq curl multitool-front +kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead. + % Total % Received % Xferd Average Speed Time Time Time Current + Dload Upload Total Spent Left Speed + 0 0 0 0 0 0 0 0 --:--:-- 0:00:02 --:--:-- 0^C[A^[[A +``` + +cache > back +```bash +kubectl -n app exec multitool-cache-bd6c58d5f-9dqfz curl multitool-back +kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead. + % Total % Received % Xferd Average Speed Time Time Time Current + Dload Upload Total Spent Left Speed + 0 0 0 0 0 0 0 0 --:--:-- 0:00:03 --:--:-- 0^C +``` + +cache > front +```bash +kubectl -n app exec multitool-cache-bd6c58d5f-9dqfz curl multitool-front +kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead. + % Total % Received % Xferd Average Speed Time Time Time Current + Dload Upload Total Spent Left Speed + 0 0 0 0 0 0 0 0 --:--:-- 0:00:14 --:--:-- 0^C +``` + ### Правила приёма работы 1. Домашняя работа оформляется в своём Git-репозитории в файле README.md. Выполненное домашнее задание пришлите ссылкой на .md-файл в вашем репозитории. diff --git a/3.3/backend.yml b/3.3/backend.yml new file mode 100644 index 00000000..bdc0a145 --- /dev/null +++ b/3.3/backend.yml @@ -0,0 +1,18 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: multitool-back + namespace: app +spec: + replicas: 1 + selector: + matchLabels: + app: backend + template: + metadata: + labels: + app: backend + spec: + containers: + - name: multitool + image: wbitt/network-multitool diff --git a/3.3/cache.yml b/3.3/cache.yml new file mode 100644 index 00000000..2f75521f --- /dev/null +++ b/3.3/cache.yml @@ -0,0 +1,18 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: multitool-cache + namespace: app +spec: + replicas: 1 + selector: + matchLabels: + app: cache + template: + metadata: + labels: + app: cache + spec: + containers: + - name: multitool + image: wbitt/network-multitool diff --git a/3.3/frontend.yml b/3.3/frontend.yml new file mode 100644 index 00000000..0514caf3 --- /dev/null +++ b/3.3/frontend.yml @@ -0,0 +1,18 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: multitool-front + namespace: app +spec: + replicas: 1 + selector: + matchLabels: + app: frontend + template: + metadata: + labels: + app: frontend + spec: + containers: + - name: multitool + image: wbitt/network-multitool diff --git a/3.3/networkpolicy-backend.yml b/3.3/networkpolicy-backend.yml new file mode 100644 index 00000000..f0f03355 --- /dev/null +++ b/3.3/networkpolicy-backend.yml @@ -0,0 +1,21 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: backend-policy + namespace: app +spec: + podSelector: + matchLabels: + app: backend + policyTypes: + - Ingress + ingress: + - from: + - podSelector: + matchLabels: + app: frontend + ports: + - protocol: TCP + port: 80 + - protocol: TCP + port: 443 \ No newline at end of file diff --git a/3.3/networkpolicy-cache.yml b/3.3/networkpolicy-cache.yml new file mode 100644 index 00000000..8d5de97f --- /dev/null +++ b/3.3/networkpolicy-cache.yml @@ -0,0 +1,21 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: cache-policy + namespace: app +spec: + podSelector: + matchLabels: + app: cache + policyTypes: + - Ingress + ingress: + - from: + - podSelector: + matchLabels: + app: backend + ports: + - protocol: TCP + port: 80 + - protocol: TCP + port: 443 \ No newline at end of file diff --git a/3.3/networkpolicy-default-deny-ingress.yml b/3.3/networkpolicy-default-deny-ingress.yml new file mode 100644 index 00000000..0b3a8fc2 --- /dev/null +++ b/3.3/networkpolicy-default-deny-ingress.yml @@ -0,0 +1,9 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default-deny-ingress + namespace: app +spec: + podSelector: {} + policyTypes: + - Ingress \ No newline at end of file diff --git a/3.3/svc-back.yml b/3.3/svc-back.yml new file mode 100644 index 00000000..2c5fbc8f --- /dev/null +++ b/3.3/svc-back.yml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: Service +metadata: + name: multitool-back + namespace: app +spec: + selector: + app: backend + ports: + - name: mtool + port: 80 diff --git a/3.3/svc-cache.yml b/3.3/svc-cache.yml new file mode 100644 index 00000000..d26d8c8d --- /dev/null +++ b/3.3/svc-cache.yml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: Service +metadata: + name: multitool-cache + namespace: app +spec: + selector: + app: cache + ports: + - name: mtool + port: 80 diff --git a/3.3/svc-front.yml b/3.3/svc-front.yml new file mode 100644 index 00000000..a379f78d --- /dev/null +++ b/3.3/svc-front.yml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: Service +metadata: + name: multitool-front + namespace: app +spec: + selector: + app: frontend + ports: + - name: mtool + port: 80 diff --git a/3.4/3.4.md b/3.4/3.4.md index 509ba2f3..90f85ba5 100644 --- a/3.4/3.4.md +++ b/3.4/3.4.md @@ -23,13 +23,302 @@ 4. Обновление мажорное, новые версии приложения не умеют работать со старыми. 5. Вам нужно объяснить свой выбор стратегии обновления приложения. +Учитывая всю серьезность нового обновления и отсутвие обратной совместимости хотелось бы использовать **Blue-green** деплой, чтобы можно было сначала протестировать стабильность работы новой версии. Хотя возможно это было проведено за рамками задания. + +В условиях ограниченных ресурсов и малого допустимого времени простоя рекомендуется использовать **Rolling** стратегию, которая позволит постепенно заменить поды со старой версией на новые. + +Так же можно использовать **Reacreate** с убийством всех старых подов и заменой их на новую версию, но опять же возникает вопрос на сколько корректно будет работать обновленная версия приложения и не придется ли ее откатывать, получая в итоге простой сервиса. + ### Задание 2. Обновить приложение 1. Создать deployment приложения с контейнерами nginx и multitool. Версию nginx взять 1.19. Количество реплик — 5. +```bash +kubectl describe deployment +Name: nginx-multitool +Namespace: default +CreationTimestamp: Wed, 24 Apr 2024 14:32:02 +0300 +Labels: +Annotations: deployment.kubernetes.io/revision: 1 +Selector: app=ngmtool +Replicas: 5 desired | 5 updated | 5 total | 5 available | 0 unavailable +StrategyType: RollingUpdate +MinReadySeconds: 0 +RollingUpdateStrategy: 25% max unavailable, 25% max surge +Pod Template: + Labels: app=ngmtool + Containers: + nginx: + Image: nginx:1.19.0 + Port: 80/TCP + Host Port: 0/TCP + Environment: + Mounts: + multitool: + Image: wbitt/network-multitool + Ports: 8080/TCP, 11443/TCP + Host Ports: 0/TCP, 0/TCP + Environment: + HTTP_PORT: 8080 + HTTPS_PORT: 11443 + Mounts: + Volumes: +Conditions: + Type Status Reason + ---- ------ ------ + Available True MinimumReplicasAvailable + Progressing True NewReplicaSetAvailable +OldReplicaSets: +NewReplicaSet: nginx-multitool-6cb8d74bc6 (5/5 replicas created) +Events: +``` 2. Обновить версию nginx в приложении до версии 1.20, сократив время обновления до минимума. Приложение должно быть доступно. + +Ввиду необходимости доступности приложения обновляем по дефолтной **Rolling-стратегии**: +```bash +kubectl set image deployment.v1.apps/nginx-multitool nginx=nginx:1.20 +deployment.apps/nginx-multitool image updated +``` + +```bash +kubectl get pods +NAME READY STATUS RESTARTS AGE +nginx-multitool-6cb8d74bc6-22gtr 2/2 Running 0 26m +nginx-multitool-6cb8d74bc6-5rb5r 2/2 Running 0 26m +nginx-multitool-6cb8d74bc6-7b5gw 2/2 Running 0 26m +nginx-multitool-6cb8d74bc6-sl98t 2/2 Running 0 26m +nginx-multitool-7ffdc6559d-n8vq8 0/2 ContainerCreating 0 5s +nginx-multitool-7ffdc6559d-ppvsz 0/2 ContainerCreating 0 5s +nginx-multitool-7ffdc6559d-q7bb4 0/2 ContainerCreating 0 5s +``` +```bash +kubectl exec nginx-multitool-7ffdc6559d-hb8cv -- nginx -v +Defaulted container "nginx" out of: nginx, multitool +nginx version: nginx/1.20.2 +``` + +Результат обновления на деплое: +```bash +kubectl describe deploy +Name: nginx-multitool +Namespace: default +CreationTimestamp: Wed, 24 Apr 2024 14:32:02 +0300 +Labels: +Annotations: deployment.kubernetes.io/revision: 3 +Selector: app=ngmtool +Replicas: 5 desired | 5 updated | 5 total | 5 available | 0 unavailable +StrategyType: RollingUpdate +MinReadySeconds: 0 +RollingUpdateStrategy: 25% max unavailable, 25% max surge +Pod Template: + Labels: app=ngmtool + Containers: + nginx: + Image: nginx:1.20 + Port: 80/TCP + Host Port: 0/TCP + Environment: + Mounts: + multitool: + Image: wbitt/network-multitool + Ports: 8080/TCP, 11443/TCP + Host Ports: 0/TCP, 0/TCP + Environment: + HTTP_PORT: 8080 + HTTPS_PORT: 11443 + Mounts: + Volumes: +Conditions: + Type Status Reason + ---- ------ ------ + Available True MinimumReplicasAvailable + Progressing True NewReplicaSetAvailable +OldReplicaSets: nginx-multitool-6cb8d74bc6 (0/0 replicas created), nginx-multitool-6955c49dbf (0/0 replicas created) +NewReplicaSet: nginx-multitool-7ffdc6559d (5/5 replicas created) +Events: + Type Reason Age From Message + ---- ------ ---- ---- ------- + Normal ScalingReplicaSet 3m21s deployment-controller Scaled down replica set nginx-multitool-6cb8d74bc6 to 3 from 4 + Normal ScalingReplicaSet 3m21s deployment-controller Scaled up replica set nginx-multitool-7ffdc6559d to 4 from 3 + Normal ScalingReplicaSet 3m15s deployment-controller Scaled down replica set nginx-multitool-6cb8d74bc6 to 2 from 3 + Normal ScalingReplicaSet 3m15s deployment-controller Scaled up replica set nginx-multitool-7ffdc6559d to 5 from 4 + Normal ScalingReplicaSet 3m15s deployment-controller Scaled down replica set nginx-multitool-6cb8d74bc6 to 1 from 2 + Normal ScalingReplicaSet 3m13s deployment-controller Scaled down replica set nginx-multitool-6cb8d74bc6 to 0 from 1 +``` + 3. Попытаться обновить nginx до версии 1.28, приложение должно оставаться доступным. + +Обновление до 1.28: +```bash +kubectl set image deployment/nginx-multitool nginx=nginx:1.28 +deployment.apps/nginx-multitool image updated +``` + +Посмотреть статус деплоя: +```bash +kubectl rollout status deployment nginx-multitool +Waiting for deployment "nginx-multitool" rollout to finish: 3 out of 5 new replicas have been updated... +``` + +```bash +kubectl get pods +NAME READY STATUS RESTARTS AGE +nginx-multitool-5595f9b8b6-4pfnf 1/2 ImagePullBackOff 0 21m +nginx-multitool-5595f9b8b6-87m5m 1/2 ImagePullBackOff 0 21m +nginx-multitool-5595f9b8b6-bzn9b 1/2 ImagePullBackOff 0 21m +nginx-multitool-7ffdc6559d-hb8cv 2/2 Running 0 31m +nginx-multitool-7ffdc6559d-n8vq8 2/2 Running 0 52m +nginx-multitool-7ffdc6559d-ppvsz 2/2 Running 0 52m +nginx-multitool-7ffdc6559d-q7bb4 2/2 Running 0 52m +``` + +```bash +kubectl describe deployment +Name: nginx-multitool +Namespace: default +CreationTimestamp: Wed, 24 Apr 2024 14:32:02 +0300 +Labels: +Annotations: deployment.kubernetes.io/revision: 4 +Selector: app=ngmtool +Replicas: 5 desired | 3 updated | 7 total | 4 available | 3 unavailable +StrategyType: RollingUpdate +MinReadySeconds: 0 +RollingUpdateStrategy: 25% max unavailable, 25% max surge +Pod Template: + Labels: app=ngmtool + Containers: + nginx: + Image: nginx:1.28 + Port: 80/TCP + Host Port: 0/TCP + Environment: + Mounts: + multitool: + Image: wbitt/network-multitool + Ports: 8080/TCP, 11443/TCP + Host Ports: 0/TCP, 0/TCP + Environment: + HTTP_PORT: 8080 + HTTPS_PORT: 11443 + Mounts: + Volumes: +Conditions: + Type Status Reason + ---- ------ ------ + Available True MinimumReplicasAvailable + Progressing False ProgressDeadlineExceeded +OldReplicaSets: nginx-multitool-6cb8d74bc6 (0/0 replicas created), nginx-multitool-6955c49dbf (0/0 replicas created), nginx-multitool-7ffdc6559d (4/4 replicas created) +NewReplicaSet: nginx-multitool-5595f9b8b6 (3/3 replicas created) +Events: +``` 4. Откатиться после неудачного обновления. +Возврат на версию 1.20: +```bash +kubectl rollout undo deployment nginx-multitool +deployment.apps/nginx-multitool rolled back +``` +```bash +kubectl get pods +NAME READY STATUS RESTARTS AGE +nginx-multitool-7ffdc6559d-hb8cv 2/2 Running 0 56m +nginx-multitool-7ffdc6559d-n8vq8 2/2 Running 0 78m +nginx-multitool-7ffdc6559d-ppvsz 2/2 Running 0 78m +nginx-multitool-7ffdc6559d-q7bb4 2/2 Running 0 78m +nginx-multitool-7ffdc6559d-s4fcs 2/2 Running 0 3s +``` +```bash +kubectl describe deploy +Name: nginx-multitool +Namespace: default +CreationTimestamp: Wed, 24 Apr 2024 14:32:02 +0300 +Labels: +Annotations: deployment.kubernetes.io/revision: 8 +Selector: app=ngmtool +Replicas: 5 desired | 5 updated | 5 total | 5 available | 0 unavailable +StrategyType: RollingUpdate +MinReadySeconds: 0 +RollingUpdateStrategy: 25% max unavailable, 25% max surge +Pod Template: + Labels: app=ngmtool + Containers: + nginx: + Image: nginx:1.20 + Port: 80/TCP + Host Port: 0/TCP + Environment: + Mounts: + multitool: + Image: wbitt/network-multitool + Ports: 8080/TCP, 11443/TCP + Host Ports: 0/TCP, 0/TCP + Environment: + HTTP_PORT: 8080 + HTTPS_PORT: 11443 + Mounts: + Volumes: +Conditions: + Type Status Reason + ---- ------ ------ + Available True MinimumReplicasAvailable + Progressing True NewReplicaSetAvailable +OldReplicaSets: nginx-multitool-6cb8d74bc6 (0/0 replicas created), nginx-multitool-6955c49dbf (0/0 replicas created), nginx-multitool-5595f9b8b6 (0/0 replicas created), nginx-multitool-575499684d (0/0 replicas created) +NewReplicaSet: nginx-multitool-7ffdc6559d (5/5 replicas created) +Events: + Type Reason Age From Message + ---- ------ ---- ---- ------- + Normal ScalingReplicaSet 26s (x3 over 57m) deployment-controller Scaled up replica set nginx-multitool-7ffdc6559d to 5 from 4 + Normal ScalingReplicaSet 26s deployment-controller Scaled down replica set nginx-multitool-575499684d to 0 from 3 +``` + +**Note** +--- +Посмотреть набор реплик (ReplicaSet), созданный при деплое: +```bash +kubectl get rs +NAME DESIRED CURRENT READY AGE +nginx-multitool-5595f9b8b6 0 0 0 34m +nginx-multitool-575499684d 3 3 0 10m +nginx-multitool-6955c49dbf 0 0 0 72m +nginx-multitool-6cb8d74bc6 0 0 0 92m +nginx-multitool-7ffdc6559d 4 4 4 66m +``` +Посмотреть историю развертывания: +```bash +kubectl rollout history deployment nginx-multitool +deployment.apps/nginx-multitool +REVISION CHANGE-CAUSE +1 +4 +5 +6 +7 +``` +Посмотреть подробную информацию о каждой ревизии: +```bash +kubectl rollout history deployment/nginx-multitool --revision=7 +deployment.apps/nginx-multitool with revision #7 +Pod Template: + Labels: app=ngmtool + pod-template-hash=575499684d + Containers: + nginx: + Image: nginx:1.28.0 + Port: 80/TCP + Host Port: 0/TCP + Environment: + Mounts: + multitool: + Image: wbitt/network-multitool + Ports: 8080/TCP, 11443/TCP + Host Ports: 0/TCP, 0/TCP + Environment: + HTTP_PORT: 8080 + HTTPS_PORT: 11443 + Mounts: + Volumes: +``` + + ## Дополнительные задания — со звёздочкой* Задания дополнительные, необязательные к выполнению, они не повлияют на получение зачёта по домашнему заданию. **Но мы настоятельно рекомендуем вам выполнять все задания со звёздочкой.** Это поможет лучше разобраться в материале. diff --git a/3.4/deployment_nginx_119.yml b/3.4/deployment_nginx_119.yml new file mode 100644 index 00000000..2d080b86 --- /dev/null +++ b/3.4/deployment_nginx_119.yml @@ -0,0 +1,31 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: nginx-multitool +spec: + replicas: 5 + selector: + matchLabels: + app: ngmtool + template: + metadata: + labels: + app: ngmtool + spec: + containers: + - name: nginx + image: nginx:1.19.0 + ports: + - containerPort: 80 + - name: multitool + image: wbitt/network-multitool + env: + - name: HTTP_PORT + value: "8080" + - name: HTTPS_PORT + value: "11443" + ports: + - containerPort: 8080 + name: http-port + - containerPort: 11443 + name: https-port diff --git a/3.4/svc_ngmtool.yml b/3.4/svc_ngmtool.yml new file mode 100644 index 00000000..cdca070a --- /dev/null +++ b/3.4/svc_ngmtool.yml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: ngmtool-svc +spec: + selector: + app: ngmtool + ports: + - name: web + port: 9001 + targetPort: 80 + - name: mtool + port: 9002 + targetPort: 8080 \ No newline at end of file diff --git a/3.5/3.5.md b/3.5/3.5.md index a09c00b8..25a534be 100644 --- a/3.5/3.5.md +++ b/3.5/3.5.md @@ -14,10 +14,186 @@ ```shell kubectl apply -f https://raw.githubusercontent.com/netology-code/kuber-homeworks/main/3.5/files/task.yaml ``` +Первая проблема деплоя, что не создаются необходимые пространства имен для приложений +```bash +kubectl apply -f https://raw.githubusercontent.com/netology-code/kuber-homeworks/main/3.5/files/task.yaml +Error from server (NotFound): error when creating "https://raw.githubusercontent.com/netology-code/kuber-homeworks/main/3.5/files/task.yaml": namespaces "web" not found +Error from server (NotFound): error when creating "https://raw.githubusercontent.com/netology-code/kuber-homeworks/main/3.5/files/task.yaml": namespaces "data" not found +Error from server (NotFound): error when creating "https://raw.githubusercontent.com/netology-code/kuber-homeworks/main/3.5/files/task.yaml": namespaces "data" not found +``` +Создаем: +```bash +kubectl create namespace web +namespace/web created + +kubectl create namespace data +namespace/data created + +kubectl apply -f https://raw.githubusercontent.com/netology-code/kuber-homeworks/main/3.5/files/task.yaml +deployment.apps/web-consumer created +deployment.apps/auth-db created +service/auth-db created +``` + +Проверяем, что поды поднялись + +```bash +kubectl -n web get pods +NAME READY STATUS RESTARTS AGE +web-consumer-5f87765478-dpc8v 1/1 Running 0 2m11s +web-consumer-5f87765478-jwkzh 1/1 Running 0 2m11s + +kubectl -n data get pods +NAME READY STATUS RESTARTS AGE +auth-db-7b5cdbdc77-zzgjv 1/1 Running 0 3m42s +``` + 2. Выявить проблему и описать. + +Проверяем сетевую связность между web-consumer и auth-db через curl: + +```bash +kubectl -n web exec web-consumer-5f87765478-dpc8v -- curl auth-db +curl: (6) Couldn't resolve host 'auth-db' +command terminated with exit code 6 +``` +Смотрим логи: + +```bash +kubectl -n web logs web-consumer-5f87765478-dpc8v +curl: (6) Couldn't resolve host 'auth-db' +curl: (6) Couldn't resolve host 'auth-db' +curl: (6) Couldn't resolve host 'auth-db' +... +curl: (6) Couldn't resolve host 'auth-db' + +``` +Проверяем, добавив к имени приложения имя простраства имен auth-db.data: + +```bash +kubectl -n web exec web-consumer-5f87765478-dpc8v -- curl auth-db.data + % Total % Received % Xferd Average Speed Time Time Time Current + Dload Upload Total Spent Left Speed +100 612 100 612 0 0 433 0 0:00:01 0:00:01 --:--:-- 597k + + + +Welcome to nginx! + + + +

Welcome to nginx!

+

If you see this page, the nginx web server is successfully installed and +working. Further configuration is required.

+ +

For online documentation and support please refer to +nginx.org.
+Commercial support is available at +nginx.com.

+ +

Thank you for using nginx.

+ + +``` +Что и требовалось доказать, с правильным DNS связь появляется. + + +Проблема в том, что в k8s пространства имен изолированы, а сервис **web-consumer** из namespace **web** пытается найти и не находит в своем пространстве имен сервис **auth-db**, который в свою очередь находится в namespace **data**. + 3. Исправить проблему, описать, что сделано. + +Одним из вариантов решения проблемы вижу создание сервиса для **auth-db** c ExternalName в пространсве имен **web** + +```yaml +apiVersion: v1 +kind: Service +metadata: + name: auth-db + namespace: web +spec: + type: ExternalName + externalName: auth-db.data.svc.cluster.local + ports: + - port: 80 +``` + +[Изменнный манифест task.yml](./files/task.yaml) + + 4. Продемонстрировать, что проблема решена. +Тест соединения после применения сервиса: + +```bash +kubectl -n web exec web-consumer-5f87765478-87kls -- curl auth-db + % Total % Received % Xferd Average Speed Time Time Time Current + Dload Upload Total Spent Left Speed +100 612 100 612 0 0 722k 0 --:--:-- --:--:-- --:--:-- 597k + + + +Welcome to nginx! + + + +

Welcome to nginx!

+

If you see this page, the nginx web server is successfully installed and +working. Further configuration is required.

+ +

For online documentation and support please refer to +nginx.org.
+Commercial support is available at +nginx.com.

+ +

Thank you for using nginx.

+ + +``` +```bash +kubectl -n web exec web-consumer-5f87765478-gw8qd -- curl auth-db + + +https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/#namespaces-and-dns % Total % Received % Xferd Average Speed Time Time Time Current + Dload Upload Total Spent Left Speed +100 612 100 612 0 0 612k 0 --:--:-- --:--:-- --:--:-- 597k + + + +Welcome to nginx! + + + +

Welcome to nginx!

+

If you see this page, the nginx web server is successfully installed and +working. Further configuration is required.

+ +

For online documentation and support please refer to +nginx.org.
+Commercial support is available at +nginx.com.

+ +

Thank you for using nginx.

+ + +``` ### Правила приёма работы diff --git a/3.5/files/task.yaml b/3.5/files/task.yaml index c76f0e22..ba7b505f 100644 --- a/3.5/files/task.yaml +++ b/3.5/files/task.yaml @@ -49,9 +49,22 @@ metadata: name: auth-db namespace: data spec: +# type: ExternalName +# externalName: auth-db.web.svc.cluster.local ports: - port: 80 protocol: TCP targetPort: 80 selector: app: auth-db +--- +apiVersion: v1 +kind: Service +metadata: + name: auth-db + namespace: web +spec: + type: ExternalName + externalName: auth-db.data.svc.cluster.local + ports: + - port: 80 \ No newline at end of file