Author: studyk8s

studyk8s

使用sealer快速安装Kubernetes

sealer项目的主要目的是让用户可以像 分发docker镜像 一样，分发Kubernetes集群

https://github.com/alibaba/sealer

#install Sealer binaries
wget https://github.com/alibaba/sealer/releases/download/v0.1.4/sealer-0.1.4-linux-amd64.tar.gz && \
tar zxvf sealer-0.1.4-linux-amd64.tar.gz && mv sealer /usr/bin
#run a kubernetes cluster 
sealer run kubernetes:v1.19.9 --masters 192.168.194.186 --passwd 123456

By studyk8s 0 Comments

Sonarqube Jenkins pipeline

下面是一个使用 docker slave 的 sonarqube 例子

pipeline {
    agent none
    
    environment {
        SONAR_LOGIN='xxxxxxxxxxxx'
    }


    stages {
        stage ('Checkout') {
            agent any
            steps {
                git branch: 'master', credentialsId: 'sonarpoc', url: 'https://github.com/zl86790/sonarhelloworld.git'
                sh "ls /var/jenkins_home/workspace/${env.JOB_NAME}/"
            }
        }
        stage('Scan') {
            agent {
                docker {
                    image 'docker:20.10.6'
                    args "-v /var/run/docker.sock:/var/run/docker.sock -v /var/jenkins_home/workspace/${env.JOB_NAME}/:/usr/src"
                }
            }
            steps {
                dir("/var/jenkins_home/workspace/${env.JOB_NAME}/") {
                    sh "cp -r ./ /usr/src"
                    sh "ls -sail /usr/src"
                    sh """
                    docker run --rm -e SONAR_HOST_URL="http://xxx.xxx.xxx.xxx:9000/" -e SONAR_LOGIN='${env.SONAR_LOGIN}' -v /usr/src:/usr/src sonarsource/sonar-scanner-cli \
                    -Dsonar.projectKey=test -Dsonar.sources=/usr/src
                    """
                }
            }
        }
    }
}

例子2

pipeline {
    agent none
    
    environment {
        SONAR_LOGIN='310f5acc8da8d088640b7da3b1123f2d626e0d3d'
    }


    stages {
        stage ('Checkout') {
            agent any
            steps {
                sh "rm -rf /var/jenkins_home/workspace/${env.JOB_NAME}/*"
                git branch: 'development', credentialsId: '574ec31b-8c2f-4454-83f0-0708b49289f8', url: 'https://github.com/xxx/xxxx.git'
            }
        }
        stage('Scan') {
            agent {
                docker {
                    image 'docker:20.10.6'
                    args "-v /var/run/docker.sock:/var/run/docker.sock -v /var/jenkins_home/workspace/${env.JOB_NAME}/:/usr/src"
                }
            }
            steps {
                dir("/var/jenkins_home/workspace/${env.JOB_NAME}/") {
                    sh """
                    ls /usr/src
                    rm -rf /usr/src/*
                    ls /usr/src
                    ls /var/jenkins_home/workspace/${env.JOB_NAME}
                    cp -r /var/jenkins_home/workspace/${env.JOB_NAME}/* /usr/src/
                    ls /usr/src
                    docker run --rm -e SONAR_HOST_URL="http://xxx.xxx.xxx.xxx:9000/" -e SONAR_LOGIN='${env.SONAR_LOGIN}' -v /var/jenkins_home/workspace/${env.JOB_NAME}/:/usr/src sonarsource/sonar-scanner-cli \
                    -Dsonar.projectKey=test -Dsonar.sources=./
                    """
                }
            }
        }
    }
}
By studyk8s 0 Comments

Traefik rewrite path and prefixes

在dns资源有限，但是仍然要区分后端服务时，就需要使用 subdirectory 而不是 subdomain

常规来说，如果是 nginx ingress 或者 traefik 1，需要添加 annotation

参考以下官方文档，这里是 traefik2 的情况

https://doc.traefik.io/traefik/migration/v1-to-v2/#strip-and-rewrite-path-prefixes

这里使用的 namespace 是 my

先创建一个 nginx服务

再创建一个 clusterip 的 Service

使用下面的yaml

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: myir
  namespace: my
spec:
  entryPoints:
    - web
  routes:
    - match: Host(`mynginx.lizhe.com`) && PathPrefix(`/mytest`)
      kind: Rule
      services:
        - name: mysvc
          port: 80
      middlewares:
        - name: my-stripprefix
---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: my-stripprefix
  namespace: my
spec:
  stripPrefix:
    prefixes:
      - /mytest
By studyk8s 0 Comments

Redis scan

scan 比 keys 高级一些，2.8版本之后加入

scan的第一个参数是 游标值，第二个参数是 正则，第三个参数是 limit

scan 会返回一个数组，0 位置是 下一个游标值，1 位置是 结果集数组

下面这个例子中 一共有5个元素，scan返回0 时代表没有新游标了，scan 0 表示开启一个新会话

scan 0 count 2 只返回了2个元素，并且提示了下一个游标值是6

使用6再次scan，返回了后续的3个元素

为什么count 2 却返回了3个元素？数据量太小的情况下，count有可能会失效，这是一个scan的痛点

如果你尝试 从 10000条记录中，分两次各取5000，你会发现scan的 count 照样不靠谱

第一次 5002
第二次 4998

By studyk8s 0 Comments

Redis keys

keys 命令的参数是一个正则，指令非常简单，只要提供简单的字符串就可以得到结果

但是缺点也很明显

Keys 不提供 offset 和 limit 参数，会一次性返回所有符合条件的key
Keys 是遍历算法，可能会造成 redis服务卡顿 （redis是单线程）

By studyk8s 0 Comments

Prometheus Alerting

https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/user-guides/alerting.md

这里我在自己的dashboard中创建了两个 panel

添加一个 notification channel 这里绑定到了 teams

This image has an empty alt attribute; its file name is image-256-1024x368.png
rate(node_network_transmit_bytes_total{job="node-exporter", instance="10.0.2.7:9100", device!="lo"}[$__interval])
1- sum(increase(node_cpu_seconds_total{mode="idle"}[5m])) by (instance)/sum(increase(node_cpu_seconds_total[5m])) by (instance)

配置alert

用 wrk 触发之后可以得到

By studyk8s 0 Comments

kube-prometheus 安装

上次我们提到过 Prometheus operator 安装 过时了，所以这次尝试一下新的安装方式

helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm repo update
helm install prometheus-operator --set rbacEnable=true --namespace=monitoring prometheus-community/prometheus-operator

仔细看安装报告最后一条

怎么说呢，你们这是折腾不止啊

https://github.com/prometheus-community/community/issues/28

whatever，我们还是来看一下现在这个版本

还是老办法，先去加一个 nodeport

用户名密码是？

admin
prom-operator

如果需要持久化的话

nameOverride: lizhe
prometheus:
  server:
    persistentVolume:
      enabled: true
  prometheusSpec:
    storageSpec:
      volumeClaimTemplate:
        spec:
          storageClassName: local-path
          accessModes: ["ReadWriteOnce"]
          resources:
            requests:
              storage: 1Gi

helm install prometheus-operator --set rbacEnable=true --namespace=monitoring prometheus-community/prometheus-operator -f myvalues.yaml
kubectl --namespace monitoring port-forward svc/prometheus-operator-grafana 3000:80
By studyk8s 0 Comments

Prometheus operator 安装

首先很可惜的是在我做这个手顺的时候， prometheus operator 就已经过期了

*******************
*** DEPRECATED ****
*******************
* stable/prometheus-operator chart is deprecated.
* Further development has moved to https://github.com/prometheus-community/helm-charts
* The chart has been renamed kube-prometheus-stack to more clearly reflect
* that it installs the `kube-prometheus` project stack, within which Prometheus
* Operator is only one component.

The Prometheus Operator has been installed. Check its status by running:
  kubectl --namespace monitoring get pods -l "release=prometheus-operator"

Visit https://github.com/coreos/prometheus-operator for instructions on how
to create & configure Alertmanager and Prometheus instances using the Operator.

云环境中大多数的项目，每天都经历着变化，日新月异，想起来那句老话

“球球你别更了，我学不动了” （手动狗头）

废话不多说了，先看安装步骤

helm repo add stable https://charts.helm.sh/stable
helm repo update
helm install prometheus-operator --set rbacEnable=true --namespace=monitoring stable/prometheus-operator

全部结束之后可以得到登录画面？什么？找不到？直接去创建一个 nodeport就好了

用户名和密码 登录之后就可以看到预设好的dashboard了

admin
prom-operator
By studyk8s 0 Comments

Traefik docker 权重分流

如果只是简单的 robbin 负载均衡，不需要太多复杂的配置

权重负载均衡需要下面额外的一些配置，所以从头做一遍

traefik 的 docker-compose.yml 文件中需要多映射一个 configs文件夹，用来放配置文件

version: '3.7'

services:
  traefik:
    image: traefik:v2.4
    container_name: traefik
    restart: always
    security_opt:
      - no-new-privileges:true
    ports:
      - 80:80
      - 443:443
    volumes:
      - ./traefik.yml:/traefik.yml:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./configs:/configs
    networks:
      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
      - "traefik.http.routers.traefik-secure.entrypoints=web"
      - "traefik.http.routers.traefik-secure.rule=Host(`traefik.lizhe.com`)"
      #- "traefik.http.routers.traefik-secure.middlewares=user-auth@file"
      - "traefik.http.routers.traefik-secure.service=api@internal"

networks:
  proxy:
    external: true

在 traefik.yml文件中也要加入对应的configs配置

api:
  dashboard: true

entryPoints:
  web:
    address: :80
  websecure:
    address: :443

pilot:
  dashboard: false

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
  file:
    filename: /configs/config.yml

此时不要急着启动，./configs/config.yml 文件还是要先创建的

http:
  routers:
    app-router:
      service: app
      rule: "Host(`app.lizhe.com`)"
  services:
    app:
      weighted:
        services:
        - name: appv1@docker
          weight: 10
        - name: appv2@docker
          weight: 1

    appv1:
      loadBalancer:
        servers:
        - url: "http://appv1.lizhe.com/"

    appv2:
      loadBalancer:
        servers:
        - url: "http://appv2.lizhe.com/"

然后创建 appv1 和 appv2

version: '3.7'

services:
  appv1:
    image: libaibai/version:v1
    container_name: appv1
    restart: always
    networks:
      - proxy
      - default
    restart: always
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
      - "traefik.http.routers.appv1.entrypoints=web"
      - "traefik.http.routers.appv1.rule=Host(`appv1.lizhe.com`)"
      - "traefik.http.routers.appv1.service=appv1"
      - "traefik.http.services.appv1.loadbalancer.server.port=80"

networks:
  proxy:
    external: true
version: '3.7'

services:
  appv1:
    image: libaibai/version:v2
    container_name: appv2
    restart: always
    networks:
      - proxy
      - default
    restart: always
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
      - "traefik.http.routers.appv2.entrypoints=web"
      - "traefik.http.routers.appv2.rule=Host(`appv2.lizhe.com`)"
      - "traefik.http.routers.appv2.service=appv2"
      - "traefik.http.services.appv2.loadbalancer.server.port=80"

networks:
  proxy:
    external: true

现在可以逐个启动这些服务了

By studyk8s 0 Comments

Traefik with docker

Traefik不仅仅能作为 ingress 实现 运行在 kubernetes 上，同时也可以直接在 docker上使用

创建网络

docker network create proxy

traefik.yml

api:
  dashboard: true

entryPoints:
  web:
    address: :80
  websecure:
    address: :443

pilot:
  dashboard: false

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false

docker-compose.yml

version: '3.7'

services:
  traefik:
    image: traefik:v2.4
    container_name: traefik
    restart: always
    security_opt:
      - no-new-privileges:true
    ports:
      - 80:80
      - 443:443
    volumes:
      - ./traefik.yml:/traefik.yml:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
      - "traefik.http.routers.traefik-secure.entrypoints=web"
      - "traefik.http.routers.traefik-secure.rule=Host(`traefik.lizhe.com`)"
      #- "traefik.http.routers.traefik-secure.middlewares=user-auth@file"
      - "traefik.http.routers.traefik-secure.service=api@internal"

networks:
  proxy:
    external: true

设置好 dns，就可以通过设置的 domain 访问了

然后我们来给它添加一个 nginx

docker-compose.yml

version: '3.7'

services:
  nginx:
    image: nginx
    container_name: nginx
    restart: always
    networks:
      - proxy
      - default
    restart: always
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
      - "traefik.http.routers.nginx-web.entrypoints=web"
      - "traefik.http.routers.nginx-web.rule=Host(`nginx.lizhe.com`)"
      - "traefik.http.routers.nginx-web.service=nginx-web"
      - "traefik.http.services.nginx-web.loadbalancer.server.port=80"

networks:
  proxy:
    external: true

up 之后就多出了一个 nginx

By studyk8s 0 Comments
Send a Message