apiVersion: v1
kind: Pod
metadata:
  name: myapp
  labels:
    name: myapp
spec: # pod具体定义
  ... # pod级定义
  containers: # 容器级定义
  - name: myapp
    image: <Image>
    resources:
      limits:
        memory: "128Mi"
        cpu: "500m"
    ports:
      - containerPort: <Port>
status: # 资源运行时的状态，无需手动指定
...

# kubectl get pod
NAME    READY   STATUS    RESTARTS   AGE
myapp   1/1     Running   0          19m

# kubectl get deployments.apps 
No resources found in default namespace.

# kubectl get replicationcontrollers
No resources found in default namespace.


# Pod 在删除后不会重建
# kubectl delete pod myapp 
pod "myapp" deleted
# kubectl get pod
No resources found in default namespace.

apiVersion: v1
kind: Pod
metadata:
  name: myapp
  labels:
    name: myapp
spec:
  hostNetwork: true # boolean 布尔值，true或false，默认false
  containers:
  - name: myapp
    image: ikubernetes/demoapp:v1.0 
    imagePullPolicy: IfNotPresent

# vim myapp.yaml
apiVersion: v1
kind: Pod
metadata:
  name: myapp
  labels:
    name: myapp
spec:
  hostNetwork: true # 共享宿主机的网络名称空间
  containers:
  - name: myapp
    image: ikubernetes/demoapp:v1.0
    imagePullPolicy: IfNotPresent
    env:
      - name: PORT
        value: "8080"

# kubectl apply -f myapp.yaml 
pod/myapp created

# kubectl describe pod myapp 
Name:         myapp
Namespace:    default
Priority:     0
Node:         k8s-node-2/10.0.0.102
...
Containers:
  myapp:
    Container ID:   docker://40505748fd9540ad06c5d1b1e77a096e54c6421f7067f2f490ab6a1f9779786a
    Image:          ikubernetes/demoapp:v1.0
    Image ID:       docker-pullable://ikubernetes/demoapp@sha256:6698b205eb18fb0171398927f3a35fe27676c6bf5757ef57a35a4b055badf2c3
    Port:           <none>
    Host Port:      <none>
    State:          Running
...




# 共享宿主机的网络了，因此可以从宿主机的8080端口直接进行访问。
# kubectl exec myapp -- ss -ntl
State   Recv-Q   Send-Q     Local Address:Port      Peer Address:Port  Process  
LISTEN  0        128              0.0.0.0:8080            0.0.0.0:*              
LISTEN  0        4096       127.0.0.53%lo:53             0.0.0.0:*              
LISTEN  0        128              0.0.0.0:22             0.0.0.0:*              
...

# kubectl exec myapp -- ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:0d:63:cd brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.101/24 brd 10.0.0.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fe0d:63cd/64 scope link 
       valid_lft forever preferred_lft forever
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default 
...

...  
spec:
  # Pod级别的安全上下文，对内部所有容器均有效
  securityContext:
    runAsUser <integer>   # 以指定的用户身份运行容器进程，默认由镜像中的USER指定
    runAsGroup <integer>   # 以指定的用户组运行容器进程，默认使用的组随容器运行时
    supplementalGroups  <[]integer>  # 为容器中1号进程的用户添加的附加组；
    fsGroup <integer>  # 为容器中的1号进程附加的一个专用组，其功能类似于sgid
    runAsNonRoot <boolean>  # 是否以非root身份运行
    seLinuxOptions <Object>  # SELinux的相关配置
    sysctls  <[]Object>  # 应用到当前Pod上的名称空间级别的sysctl参数设置列表
    windowsOptions <Object>  # Windows容器专用的设置
...   
  containers:
   # 容器级别的安全上下文，仅生效于当前容器
    securityContext:
      runAsUser <integer>
      runAsGroup <integer>
      runAsNonRoot <boolean>
      allowPrivilegeEscalation <boolean> # 是否允许特权升级
      capabilities <Object>  # 于当前容器上添加（add）或删除（drop）的内核能力
        add  <[]string>  # 添加由列表定义的各内核能力
        drop  <[]string>  # 移除由列表定义的各内核能力
      privileged <boolean>  # 是否运行为特权容器，相当于拥有宿主机的root身份，一般情况下不要开启。
      procMount <string>   # 设置容器的procMount类型，默认为DefaultProcMount；
      readOnlyRootFilesystem <boolean> # 是否将根文件系统设置为只读模式
      seLinuxOptions <Object>
      windowsOptions <Object> 
...

# 常用内核相关能力说明：

CAP_CHOWN # 改变UID和GID

CAP_MKNOD # 调用 mknod() 创建设备文件 

CAP_NET_ADMIN # 网络管理权限，比如：iptables规则、路由表、清空驱动上的统计数据、设置网络接口的混杂模式、设置是否支持多播功能等...

CAP_SYS_ADMIN # 大部分的管理权限

CAP_SYS_TIME # 改内核时钟

CAP_SYS_MODULE # 装载卸载内核模块

CAP_NET_BIND_SERVICE # 允许普通用户绑定特权端口，0 ~ 1024（经测试发现普通用户即使授予了此能力还是无法绑定特权端口，还需要授予其他的能力？比如NET_ADMIN？）

# vim myapp.yaml
apiVersion: v1
kind: Pod
metadata:
  name: myapp
  labels:
    name: myapp
spec:
  securityContext:
    runAsUser: 1001 # 以普通用户身份运行
    runAsGroup: 1001 
  containers:
  - name: myapp
    image: ikubernetes/demoapp:v1.0
    imagePullPolicy: IfNotPresent
    env:
      - name: PORT
        value: "80" # 监听特权端口


# 无法创建，因为普通用户无法监听特权端口
# kubectl get pod
NAME    READY   STATUS   RESTARTS   AGE
myapp   0/1     Error    0          5s
# kubectl logs myapp 
...
PermissionError: [Errno 13] Permission denied



-----------------

# vim myapp.yaml
apiVersion: v1
kind: Pod
metadata:
  name: myapp
  labels:
    name: myapp
spec:
  securityContext:
    runAsUser: 1001 # 以普通用户身份运行
    runAsGroup: 1001
  containers:
  - name: myapp
    image: ikubernetes/demoapp:v1.0
    imagePullPolicy: IfNotPresent
    env:
      - name: PORT
        value: "80" # 监听特权端口
        securityContext:
          capabilities:
            add: ['NET_BIND_SERVICE'] # 允许普通用户绑定特权端口，0 ~ 1024（经测试发现普通用户即使授予了此能力还是无法绑定特权端口，还需要授予其他的能力？比如NET_ADMIN？）

# vim myapp.yaml
apiVersion: v1
kind: Pod
metadata:
  name: myapp
spec:
  containers:
  - name: myapp
    image: ikubernetes/demoapp:v1.0
    imagePullPolicy: IfNotPresent


# kubectl exec myapp -- /sbin/iptables -t nat -A PREROUTING -p tcp --dport 8080 -j REDIRECT --to-port 80
getsockopt failed strangely: Operation not permitted
command terminated with exit code 1

# vim myapp.yaml
apiVersion: v1
kind: Pod
metadata:
  name: myapp
spec:
  containers:
  - name: myapp
    image: ikubernetes/demoapp:v1.0
    imagePullPolicy: IfNotPresent
    command: ["/bin/sh","-c"]
    args: ["/sbin/iptables -t nat -A PREROUTING -p tcp --dport 8080 -j REDIRECT --to-port 80 && /usr/bin/python3 /usr/local/bin/demo.py"]
    securityContext:
      capabilities:
        add: ['NET_ADMIN']


# kubectl describe pod myapp 
Name:         myapp
Namespace:    default
Priority:     0
Node:         k8s-node-1/10.0.0.101
Start Time:   Sat, 24 Dec 2022 12:53:19 +0800
Labels:       <none>
Annotations:  <none>
Status:       Running
IP:           10.244.1.249
...


# curl 10.244.1.249
iKubernetes demoapp v1.0 !! ClientIP: 10.244.0.0, ServerName: myapp, ServerIP: 10.244.1.249!
# curl 10.244.1.249:8080
iKubernetes demoapp v1.0 !! ClientIP: 10.244.0.0, ServerName: myapp, ServerIP: 10.244.1.249!


# 可以定义
# kubectl exec myapp -- /sbin/iptables -t nat -A PREROUTING -p tcp --dport 8088 -j REDIRECT --to-port 80
# curl 10.244.1.249:8088
iKubernetes demoapp v1.0 !! ClientIP: 10.244.0.0, ServerName: myapp, ServerIP: 10.244.1.249!


# 容器内的iptables规则只与容器内部有关，与容器外部即宿主机无关。
# kubectl exec myapp -- /sbin/iptables -vnL -t nat
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    1    60 REDIRECT   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8080 redir ports 80
    1    60 REDIRECT   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8088 redir ports 80
...

# vim myapp.yaml
apiVersion: v1
kind: Pod
metadata:
  name: myapp
spec:
  containers:
  - name: myapp
    image: ikubernetes/demoapp:v1.0
    imagePullPolicy: IfNotPresent

# kubectl exec myapp -- ls -l /etc/hosts
-rw-r--r--    1 root     root           202 Dec 24 05:16 /etc/hosts

# kubectl exec myapp -- chown 1001 /etc/hosts
# kubectl exec myapp -- ls -l /etc/hosts
-rw-r--r--    1 1001     root           202 Dec 24 05:16 /etc/hosts

# kubectl exec myapp -- chmod 400 /etc/hosts
# kubectl exec myapp -- ls -l /etc/hosts
-r--------    1 1001     root           202 Dec 24 05:16 /etc/hosts

# vim myapp.yaml
apiVersion: v1
kind: Pod
metadata:
  name: myapp
spec:
  containers:
  - name: myapp
    image: ikubernetes/demoapp:v1.0
    imagePullPolicy: IfNotPresent
    securityContext:
      capabilities:
        drop: ['CHOWN']
        

# kubectl exec myapp -- ls -l /etc/hosts
-rw-r--r--    1 root     root           202 Dec 24 05:20 /etc/hosts

# 无法修改UID
# kubectl exec myapp -- chown 1001 /etc/hosts
chown: /etc/hosts: Operation not permitted
command terminated with exit code 1
# kubectl exec myapp -- ls -l /etc/hosts
-rw-r--r--    1 root     root           202 Dec 24 05:20 /etc/hosts

# 但文件权限依旧可以修改
# kubectl exec myapp -- chmod 400 /etc/hosts
# kubectl exec myapp -- ls -l /etc/hosts
-r--------    1 root     root           202 Dec 24 05:20 /etc/hosts

# kubectl get pod -n kube-system kube-proxy-hh5ph -o yaml 
apiVersion: v1
kind: Pod
metadata:
...
spec:
...
  containers:
...
    securityContext:
      privileged: true
...

# vim myapp.yaml
apiVersion: v1
kind: Pod
metadata:
  name: myapp
  labels:
    name: myapp
spec:
  containers:
  - name: myapp
    image: ikubernetes/demoapp:v1.0
    imagePullPolicy: IfNotPresent
    env:
      - name: PORT
        value: "8080"

# 默认以root身份运行
# kubectl exec myapp -- id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)

# vim myapp.yaml
apiVersion: v1
kind: Pod
metadata:
  name: myapp
  labels:
    name: myapp
spec:
  securityContext:
    runAsUser: 1001 # 指定运行时的用户
    runAsGroup: 1001 # 指定运行时的所属组
  containers:
  - name: myapp
    image: ikubernetes/demoapp:v1.0
    imagePullPolicy: IfNotPresent
    env:
      - name: PORT
        value: "8080"

# kubectl exec myapp -- id
uid=1001 gid=1001

apiVersion: v1
kind: Pod
metadata:
  name: myapp
  labels:
    name: myapp
spec:
  restartPolicy: Always # 定义pod的重启策略
...

apiVersion: v1
kind: Pod
metadata:
  name: myapp
  labels:
    name: myapp
spec:
  nodeSelector: # 节点标签选择
    zone: node1 # 选择具备此标签的节点运行pod
  containers:
...

apiVersion: v1
kind: Pod
metadata:
  name: myapp
  labels:
    name: myapp
spec:
  hostPID: true # boolean 布尔值，true或false，默认false
  containers:
  - name: myapp
    image: <Image>
...

# 在宿主机可以看到pod内的进程
root@k8s-node-1:~# ps aux|grep node_exporter
nobody    346931  0.2  0.5 115220 15080 ?        Ssl  00:37   0:00 /bin/node_exporter


# 在pod内也可以看到宿主机的进程
root@k8s-master-1:~# kubectl exec daemonset-node-exporter-6h7g5 -- ps 
PID   USER     TIME  COMMAND
    1 root      0:11 {systemd} /sbin/init
    2 root      0:00 [kthreadd]
    3 root      0:00 [rcu_gp]
    4 root      0:00 [rcu_par_gp]
    6 root      0:00 [kworker/0:0H-kb]
    9 root      0:00 [mm_percpu_wq]
   10 root      0:05 [ksoftirqd/0]
   11 root      0:30 [rcu_sched]
   12 root      0:00 [migration/0]
   13 root      0:00 [idle_inject/0]
...

# 在宿主机仍然可以看到pod内的进程
root@k8s-node-1:~# ps aux|grep node_exporter
nobody    355096  1.6  0.5 115220 15136 ?        Ssl  00:53   0:00 /bin/node_exporter


# 在pod内看不到宿主机的进程
root@k8s-master-1:~# kubectl exec daemonset-node-exporter-2jdwx -- ps
PID   USER     TIME  COMMAND
    1 nobody    0:00 /bin/node_exporter
   13 nobody    0:00 ps

apiVersion: v1
kind: Namespace
metadata:
  name: cadvisor

---

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: cadvisor
  namespace: cadvisor
spec:
  selector:
    matchLabels:
      name: cadvisor
  template:
    metadata:
      labels:
        name: cadvisor
    spec:
      tolerations: #污点容忍,忽略master的NoSchedule
        - effect: NoSchedule
          key: node-role.kubernetes.io/master #？
      hostNetwork: true
      restartPolicy: Always
      containers:
      - name: cadvisor
        image: cadvisor:v0.39.3
        imagePullPolicy: IfNotPresent
        resources:
          requests:
            memory: 400Mi
            cpu: 400m
          limits:
            memory: 2000Mi
            cpu: 800m
        ports:
          - name: http
            containerPort: 8080
            protocol: TCP
        volumeMounts:
        - name: rootfs
          mountPath: /rootfs
        - name: var-run
          mountPath: /var/run
        - name: sys
          mountPath: /sys
        - name: docker
          mountPath: /var/lib/docker
        - name: disk
          mountPath: /dev/disk
      terminationGracePeriodSeconds: 30
      volumes:
      - name: rootfs
        hostPath:
          path: /
      - name: var-run
        hostPath:
          path: /var/run
      - name: sys
        hostPath:
          path: /sys
      - name: docker
        hostPath:
          path: /var/lib/docker
      - name: disk
        hostPath:
          path: /dev/disk

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: zookeeper
  namespace: zookeeper
spec:
  selector:
    matchLabels:
      app: zookeeper
  serviceName: zookeeper-election
  replicas: 3
  updateStrategy:
    type: RollingUpdate
  podManagementPolicy: OrderedReady
  template:
    metadata:
      labels:
        app: zookeeper # 必须匹配 .spec.selector.matchLabels
    spec:
      affinity: # ？
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchExpressions:
                  - key: "app"
                    operator: In
                    values:
                    - zookeeper
              topologyKey: "kubernetes.io/hostname"
      containers:
      - name: kubernetes-zookeeper
        imagePullPolicy: IfNotPresent
        image: "mirrorgooglecontainers/kubernetes-zookeeper:1.0-3.4.10"
        resources:
          requests:
            memory: "1Gi"
            cpu: "0.5"
        ports:
        - containerPort: 2181
          name: client
        - containerPort: 2888
          name: server
        - containerPort: 3888
          name: leader-election
        command:
        - sh
        - -c
        - "start-zookeeper \
          --servers=3 \
          --data_dir=/var/lib/zookeeper/data \
          --data_log_dir=/var/lib/zookeeper/data/log \
          --conf_dir=/opt/zookeeper/conf \
          --client_port=2181 \
          --election_port=3888 \
          --server_port=2888 \
          --tick_time=2000 \
          --init_limit=10 \
          --sync_limit=5 \
          --heap=512M \
          --max_client_cnxns=60 \
          --snap_retain_count=3 \
          --purge_interval=12 \
          --max_session_timeout=40000 \
          --min_session_timeout=4000 \
          --log_level=INFO"
        readinessProbe:
          exec:
            command:
            - sh
            - -c
            - "zookeeper-ready 2181"
          initialDelaySeconds: 10
          timeoutSeconds: 5
        livenessProbe:
          exec:
            command:
            - sh
            - -c
            - "zookeeper-ready 2181"
          initialDelaySeconds: 10
          timeoutSeconds: 5
        volumeMounts:
        - name: datadir
          mountPath: /var/lib/zookeeper
      securityContext:
        runAsUser: 1000
        fsGroup: 1000
  volumeClaimTemplates:
  - metadata:
      name: datadir
    spec:
      accessModes: [ "ReadWriteOnce" ]
      resources:
        requests:
          storage: 10Gi

apiVersion: v1
kind: Pod
metadata:
  name: myapp
  labels:
    name: myapp
spec:
  containers:
  - name: myapp
    image: nginx:1.23
    imagePullPolicy: IfNotPresent
    env: # 定义容器中的环境变量
    - name: key1 # 键
      value: "value1" # 值
    - name: key2 # 键
      value: "value2" # 值
    - name: <string> # 变量名，其值来自于某Secret对象上的指定键的值；
      valueFrom: 
        secretKeyRef: # Secret对象中的特定Key
          name: <string>    # 引用的Secret对象的名称，需要与该Pod位于同一名称空间；
          key: <string>     # 引用的Secret对象上的键，其值将传递给环境变量；
          optional: <boolean> # 是否为可选引用；
    - name: <string>
      valueFrom: 
        configMapKeyRef <Object> # ConfigMap对象中的特定Key
    - name: <string>
      valueFrom: 
        fieldRef <Object> # 当前Pod资源的指定字段，目前支持使用的字段包括：
                          # metadata.name
                          # metadata.namespace
                          # metadata.labels
                          # metadata.annotations
                          # spec.nodeName
                          # spec.serviceAccountName
                          # status.hostIP
                          # status.podIP 等
    - name: <string>
      valueFrom: 
        resourceFieldRef <Object> # 当前容器的特定系统资源的最小值（配额）或最大值（限额），目前支持的引用包括：
                                  # limits.cpu
                                  # limits.memory
                                  # limits.ephemeral-storage
                                  # requests.cpu
                                  # requests.memory
                                  # requests.ephemeral-storage

# tree .
.
├── data
│   └── index.html
├── Dockerfile
└── entrypoint.sh

# cat data/index.html 
website page

# cat Dockerfile 
FROM nginx:1.23
LABEL author="JamesAzheng"
ENV NGX_ROOT="/data/html/"
ADD data/ ${NGX_ROOT}
ADD entrypoint.sh /
ENTRYPOINT ["/entrypoint.sh"] 
CMD ["nginx", "-g", "daemon off;"] # CMD 的指令都会成为 ENTRYPOINT 的参数
EXPOSE 80

# cat entrypoint.sh 
#!/bin/bash
cat > /etc/nginx/conf.d/website.conf << EOF
server {
    listen ${NGX_LISTEN_IP:-0.0.0.0}:${NGX_LISTEN_PORT:-80};
    server_name ${NGX_SERVER_NAME};

    location / {
        root ${NGX_ROOT};
        index index.html;
    }
}
EOF

exec "$@" # 相当于接受CMD的参数后执行 nginx -g daemon off;


# docker build -t website:v6 .

# docker login --username=阿征666666 registry.cn-hangzhou.aliyuncs.com
# docker tag website:v6 registry.cn-hangzhou.aliyuncs.com/jamesazheng/test:v1
# docker push registry.cn-hangzhou.aliyuncs.com/jamesazheng/test:v1

# vim myapp.yaml
apiVersion: v1
kind: Pod
metadata:
  name: myapp
  labels:
    name: myapp
spec:
  containers:
  - name: myapp
    image: registry.cn-hangzhou.aliyuncs.com/jamesazheng/test:v1
    imagePullPolicy: IfNotPresent
    env:
    - name: NGX_SERVER_NAME
      value: "xiangzheng.com"
    - name: NGX_LISTEN_PORT
      value: "68"

# kubectl apply -f myapp.yaml 
pod/myapp created

# kubectl exec -it myapp -- bash

root@myapp:/# curl 127.0.0.1
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
...


root@myapp:/# curl -H Host:xiangzheng.com 127.0.0.1
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
...


root@myapp:/# curl -H Host:xiangzheng.com 127.0.0.1:68
website page


root@myapp:/# cat /etc/nginx/conf.d/website.conf 
server {
    listen 0.0.0.0:68;
    server_name xiangzheng.com;

    location / {
        root /data/html/;
        index index.html;
    }
}


# 向容器中传入环境变量，相当于执行`docker run -e key=value
root@myapp:/# env
KUBERNETES_SERVICE_PORT_HTTPS=443
KUBERNETES_SERVICE_PORT=443
HOSTNAME=myapp
NGX_ROOT=/data/html/
NGX_LISTEN_PORT=68 # 
PWD=/
NGX_SERVER_NAME=xiangzheng.com # 
PKG_RELEASE=1~bullseye
HOME=/root
KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443
NJS_VERSION=0.7.9
TERM=xterm
SHLVL=1
KUBERNETES_PORT_443_TCP_PROTO=tcp
KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1
KUBERNETES_SERVICE_HOST=10.96.0.1
KUBERNETES_PORT=tcp://10.96.0.1:443
KUBERNETES_PORT_443_TCP_PORT=443
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
NGINX_VERSION=1.23.3
_=/usr/bin/env

apiVersion: v1
kind: ConfigMap
metadata:
  name: demoapp-config
  namespace: default
data:
  demoapp.port: "8899" # 定义
  demoapp.host: 127.0.0.1 # 定义

apiVersion: v1
kind: Pod
metadata:
  name: configmaps-env-demo
  namespace: default
spec:
  containers:
  - image: ikubernetes/demoapp:v1.0
    name: demoapp
    env:
    - name: PORT # 自定义键
      valueFrom: # 值来自：
        configMapKeyRef: # 来自configMap
          name: demoapp-config # 选择configMap；需等于ConfigMap.metadata.name
          key: demoapp.port # 选择configMap中具体的key；需等于ConfigMap.data中的key
          optional: false # 是否可选，true可选，false必选(不存在则会报错退出)
    - name: HOST
      valueFrom:
        configMapKeyRef:
          name: demoapp-config
          key: demoapp.host
          optional: true # true表示可选，不存在则会忽略

[root@configmaps-env-demo /]# ss -ntl
State       Recv-Q     Send-Q     Local Address:Port      Peer Address:Port           
LISTEN      0          128            127.0.0.1:8899           0.0.0.0:*                 


[root@configmaps-env-demo /]# env
KUBERNETES_SERVICE_PORT=443
KUBERNETES_PORT=tcp://10.96.0.1:443
HOSTNAME=configmaps-env-demo
SHLVL=1
PORT=8899 # 引入的环境变量
HOME=/root
PS1=[\u@\h \w]\$ 
TERM=xterm
KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
KUBERNETES_PORT_443_TCP_PORT=443
KUBERNETES_PORT_443_TCP_PROTO=tcp
HOST=127.0.0.1 # 引入的环境变量
DEPLOYENV=Production
KUBERNETES_SERVICE_PORT_HTTPS=443
KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443
RELEASE=Stable
KUBERNETES_SERVICE_HOST=10.96.0.1
PWD=/

apiVersion: v1
kind: Pod
metadata:
  name: myapp
  labels:
    name: myapp
spec:
  containers:
  - name: myapp
    image: nginx:1.23
    imagePullPolicy: IfNotPresent
    envFrom: # 整体引用指定的Secret对象的全部键名和键值；configmap也支持这种引用！
    - prefix: <string> # 将所有键名引用为环境变量时统一添加的前缀；

apiVersion: v1
kind: Pod
metadata:
  name: myapp
  labels:
    name: myapp
spec:
  containers:
  - name: myapp
    image: nginx:1.23
    imagePullPolicy: IfNotPresent
    ports: # 定义容器端口列表
    - containerPort: 80 # 定义一个容器对外暴露端口，如果仅定义此项 则只是声明暴露的端口，必选项
      hostIP: 0.0.0.0 # 将对外提供访问的端口绑定到被调度主机的哪个IP
      hostPort: 30888 # 映射到宿主机的端口，以实现对外提供访问
      name: http # 定义名称
      protocol: TCP # 端口协议，可以为 SCTP、TCP、UDP，默认为 TCP

# vim myapp.yaml
apiVersion: v1
kind: Pod
metadata:
  name: myapp
  labels:
    name: myapp
spec:
  containers:
  - name: myapp
    image: nginx:1.23
    imagePullPolicy: IfNotPresent
    ports:
    - containerPort: 80
      hostPort: 30888 # 为了避免与调度的节点端口冲突，因此单独指定一个冷门端口。
      name: http
      protocol: TCP

# kubectl apply -f myapp.yaml 
pod/myapp created


# kubectl describe pod myapp
...
Name:         myapp
Namespace:    default
Priority:     0
Node:         k8s-node-1/10.0.0.101 # 被调度到了此节点
...
Containers:
  myapp:
...
    Host Port:      30888/TCP
...

# 访问测试
# curl 10.0.0.101:30888
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
...

# vim myapp.yaml
apiVersion: v1
kind: Pod
metadata:
  name: myapp
  labels:
    name: myapp
spec:
  containers:
  - name: myapp
    image: nginx:1.23
    imagePullPolicy: IfNotPresent
    ports:
      - containerPort: 80

# kubectl apply -f myapp.yaml 
pod/myapp created


# kubectl describe pod myapp 
Name:         myapp
Namespace:    default
Priority:     0
Node:         k8s-node-1/10.0.0.101
Start Time:   Fri, 23 Dec 2022 20:12:06 +0800
Labels:       name=myapp
Annotations:  <none>
Status:       Running
IP:           10.244.1.234
IPs:
  IP:  10.244.1.234
Containers:
  myapp:
    Container ID:   docker://7dcf45f73e86f8f786b873a7f320eb9dd7382503126556936ea32cf40be85def
    Image:          nginx:1.23
    Image ID:       docker-pullable://nginx@sha256:0b970013351304af46f322da1263516b188318682b2ab1091862497591189ff1
    Port:           80/TCP # 仅是声明容器中的Port
    Host Port:      0/TCP # 不会监听所被调度宿主机的端口
    State:          Running
...

apiVersion: v1
kind: Pod
metadata:
  name: myapp
  labels:
    name: myapp
spec:
  restartPolicy: Always
  containers:
  - name: myapp
    image: <Image>
    imagePullPolicy: Always # 定义镜像拉取策略
    resources:
      limits:
        memory: "128Mi"
        cpu: "500m"
    ports:
      - containerPort: <Port>

apiVersion: v1
kind: Pod
metadata:
  name: myapp
  labels:
    name: myapp
spec:
  containers:
  - name: myapp
    image: nginx:1.23
    imagePullPolicy: IfNotPresent
    command <[]string> # command

apiVersion: v1
kind: Pod
metadata:
  name: myapp
spec:
  containers:
  - name: myapp
    image: <Image>
    imagePullPolicy: Always
    command: # command
      - /usr/local/bin/redis-cli
      - info
    args: # args
      - xxx
      - xxx
    resources:
      limits:
        memory: "128Mi"
        cpu: "500m"
    ports:
      - containerPort: <Port>

apiVersion: v1
kind: Pod
metadata:
  name: myapp
  labels:
    name: myapp
spec:
  containers:
  - name: myapp
    image: nginx:1.23
    imagePullPolicy: IfNotPresent
    args <[]string> # command

apiVersion: v1
kind: Pod
metadata:
  name: myapp
  labels:
    name: myapp
spec:
  containers:
  - name: myapp
    image: <Image>
    resources: # 资源管理相关配置
      requests: # 容器运行时，最低资源需求，也就是说最少需要多少资源容器才能正常运行   
        cpu: "200m" # CPU资源（核数），两种方式，浮点数或者是整数+m，0.1=100m，最少值为0.001核（1m）
        memory: "64Mi" # 内存使用量
      limits: # 资源限制，即最多使用多少资源，有limitsrange，就是不设置时有默认限制范围！(如果定义了limitsrange的情况下)
        cpu: "500m"
        memory: "128Mi"

apiVersion: v1
kind: Pod
metadata:
  name: myapp
spec:
  containers:
  - name: myapp
    image: nginx:1.23
    imagePullPolicy: IfNotPresent
    startupProbe:
      exec <Object>     # 命令式探针
      httpGet <Object>  # http GET类型的探针
      tcpSocket <Object>  # tcp Socket类型的探针
      initialDelaySeconds <integer>  # 发起初次探测请求的延后时长
      periodSeconds <integer>         # 请求周期
      timeoutSeconds <integer>        # 超时时长
      successThreshold <integer>      # 成功阈值
      failureThreshold <integer>       # 失败阈值

# nginx-http-probe.yaml
kind: Deployment
apiVersion: apps/v1
metadata:
  name: nginx-deployment
  labels:
    app: nginx-deployment-label
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx-deployment-label
  template:
    metadata:
      labels:
        app: nginx-deployment-label
    spec:
      containers:
      - name: nginx-container
        image: nginx
        imagePullPolicy: Always
        ports:
        - containerPort: 80
          name: nginx
          protocol: TCP
        resources:
          requests:   
            cpu: 100m
            memory: 128Mi   
          limits:   
            cpu: 1   
            memory: 256Mi
        startupProbe: #startupProbe
          httpGet:
            path: /index.htmllllll #定义一个不存在的 uri
            port: 80
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3


---

kind: Service
apiVersion: v1
metadata:
  labels:
    app: nginx-service
  name: nginx-service
  namespace: default
spec:
  type: NodePort
  ports:
  - name: nginx
    port: 80
    protocol: TCP
    targetPort: 80
    nodePort: 30080
  selector:
    app: nginx-deployment-label

#创建
# kubectl apply -f nginx-http-probe.yaml 
deployment.apps/nginx-deployment created
service/nginx-service created


#观察 pod 状态，因为无法找到探测所需的 uri，所以会报404，发现问题直接将 Pod 标记未 NOREADY 状态
# kubectl get pod
NAME                                READY   STATUS    RESTARTS      AGE
nginx-deployment-6f4745486c-stfdb   1/1     Running   3 (31s ago)   3m1s



#观察 service 状态，发现问题后直接将故障的 Pod 从 Endpoints 剔除
# kubectl describe service nginx-service 
Name:                     nginx-service
Namespace:                default
Labels:                   app=nginx-service
Annotations:              <none>
Selector:                 app=nginx-deployment-label
Type:                     NodePort
IP Family Policy:         SingleStack
IP Families:              IPv4
IP:                       192.168.0.165
IPs:                      192.168.0.165
Port:                     nginx  80/TCP
TargetPort:               80/TCP
NodePort:                 nginx  30080/TCP
Endpoints:                
Session Affinity:         None
External Traffic Policy:  Cluster
Events:                   <none>


# 过后 pod 会一直尝试重启
# kubectl get pod
NAME                               READY   STATUS             RESTARTS       AGE
nginx-deployment-b8dd769cc-5mvnc   0/1     CrashLoopBackOff   15 (86s ago)   38m



#重启成功则恢复，并加到 service Endpoints 中
# vim nginx-http-probe.yaml
...
            path: /index.html #修改为正确的 uri
...
# kubectl apply -f nginx-http-probe.yaml 
deployment.apps/nginx-deployment configured
service/nginx-service unchanged
# kubectl get pod
NAME                               READY   STATUS    RESTARTS   AGE
nginx-deployment-76847db55-4ctkx   1/1     Running   0          65s
# kubectl describe service nginx-service 
Name:                     nginx-service
Namespace:                default
Labels:                   app=nginx-service
Annotations:              <none>
Selector:                 app=nginx-deployment-label
Type:                     NodePort
IP Family Policy:         SingleStack
IP Families:              IPv4
IP:                       192.168.0.165
IPs:                      192.168.0.165
Port:                     nginx  80/TCP
TargetPort:               80/TCP
NodePort:                 nginx  30080/TCP
Endpoints:                10.10.1.55:80
Session Affinity:         None
External Traffic Policy:  Cluster
Events:                   <none>

apiVersion: v1
kind: Pod
metadata:
  name: myapp
spec:
  containers:
  - name: myapp
    image: nginx:1.23
    imagePullPolicy: IfNotPresent
    livenessProbe:
      exec <Object> # 命令式探针 
      httpGet <Object> # http GET类型的探针
      tcpSocket <Object>  # tcp Socket类型的探针
      initialDelaySeconds <integer>  # 延迟几秒后进行初次探测，主要防止如java服务初始启动较慢时还未启动成功就进行探测从而导致循环探测失败的现象产生，默认0秒
      periodSeconds <integer> # 探测间隔时间，默认10秒
      timeoutSeconds <integer> # 单次探测的超时时长，探测应用timeout后为失败，默认1秒
      successThreshold <integer> # 探测失败后，连续探测几次成功后，即认为成功。默认值是 1，此值对于就绪和启动探针必须设为1?
      failureThreshold <integer> # 当探测失败时，Kubernetes 的重试次数，默认值3次
                                 # 对存活探测而言，放弃就意味着重新启动容器

apiVersion: v1
kind: Pod
metadata:
  name: myapp
spec:
  containers:
  - name: myapp
    image: nginx:1.23
    imagePullPolicy: IfNotPresent
    readinessProbe:
      exec <Object>     # 命令式探针
      httpGet <Object>  # http GET类型的探针
      tcpSocket <Object>  # tcp Socket类型的探针
      initialDelaySeconds <integer>  # 发起初次探测请求的延后时长
      periodSeconds <integer>         # 请求周期
      timeoutSeconds <integer>        # 超时时长
      successThreshold <integer>      # 成功阈值
      failureThreshold <integer> # 当探测失败时，Kubernetes 的重试次数，默认值3次
                                 # 对就绪探测而言，放弃意味着 Pod 会被打上未就绪的标签

# nginx-http-probe.yaml
kind: Deployment
apiVersion: apps/v1
metadata:
  name: nginx-deployment
  labels:
    app: nginx-deployment-label
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx-deployment-label
  template:
    metadata:
      labels:
        app: nginx-deployment-label
    spec:
      containers:
      - name: nginx-container
        image: nginx
        imagePullPolicy: Always
        ports:
        - containerPort: 80
          name: nginx
          protocol: TCP
        resources:
          requests:   
            cpu: 100m
            memory: 128Mi   
          limits:   
            cpu: 1   
            memory: 256Mi
        readinessProbe: #readinessProbe
          httpGet:
            path: /index.htmllllll #定义一个不存在的 uri
            port: 80
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3

---

kind: Service
apiVersion: v1
metadata:
  labels:
    app: nginx-service
  name: nginx-service
  namespace: default
spec:
  type: NodePort
  ports:
  - name: nginx
    port: 80
    protocol: TCP
    targetPort: 80
    nodePort: 30080
  selector:
    app: nginx-deployment-label

# 创建
# kubectl apply -f nginx-http-probe.yaml 
deployment.apps/nginx-deployment created
service/nginx-service created


# 观察 pod 状态
# 因为无法找到探测所需的 uri，所以会报404，发现问题直接将 Pod 标记未 NOREADY 状态
# kubectl get pod
NAME                                READY   STATUS    RESTARTS   AGE
nginx-deployment-695cd5649c-zvs8v   0/1     Running   0          2m10s


# 观察 service 状态
# 发现问题后直接将故障的 Pod 从 Endpoints 剔除
# kubectl describe service nginx-service 
Name:                     nginx-service
Namespace:                default
Labels:                   app=nginx-service
Annotations:              <none>
Selector:                 app=nginx-deployment-label
Type:                     NodePort
IP Family Policy:         SingleStack
IP Families:              IPv4
IP:                       192.168.0.164
IPs:                      192.168.0.164
Port:                     nginx  80/TCP
TargetPort:               80/TCP
NodePort:                 nginx  30080/TCP
Endpoints:                
Session Affinity:         None
External Traffic Policy:  Cluster
Events:                   <none>



#后续不会对 pod 执行重启操作
# kubectl get pod
NAME                               READY   STATUS             RESTARTS       AGE
nginx-deployment-b8dd769cc-5mvnc   0/1     CrashLoopBackOff   15 (86s ago)   38m

# nginx-http-probe.yaml
kind: Deployment
apiVersion: apps/v1
metadata:
  name: nginx-deployment
  labels:
    app: nginx-deployment-label
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx-deployment-label
  template:
    metadata:
      labels:
        app: nginx-deployment-label
    spec:
      containers:
      - name: nginx-container
        image: nginx
        imagePullPolicy: Always
        ports:
        - containerPort: 80
          name: nginx
          protocol: TCP
        resources:
          requests:   
            cpu: 100m
            memory: 128Mi   
          limits:   
            cpu: 1   
            memory: 256Mi
        livenessProbe: #livenessProbe
          httpGet:
            path: /index.htmllllll #定义一个不存在的 uri
            port: 80
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3
        readinessProbe: #readinessProbe
          httpGet:
            path: /index.htmllllll #定义一个不存在的 uri
            port: 80
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3

---

kind: Service
apiVersion: v1
metadata:
  labels:
    app: nginx-service
  name: nginx-service
  namespace: default
spec:
  type: NodePort
  ports:
  - name: nginx
    port: 80
    protocol: TCP
    targetPort: 80
    nodePort: 30080
  selector:
    app: nginx-deployment-label