Linux系统之K8S基本命令概述
kubectl管理工具
命令概要
kubectl命令是K8S集群的管理命令行工具，用于与集群进行交互和执行各种操作，如：查看、创建、删除、更新资源等。
默认情况下，使用kubectl命令时，从配置文件$HOME/.kube/config文件或环境变量KUBECONFIG中读取与集群的连接信息。
若要指定节点能够管理集群，需要将连接文件（/etc/kubernetes/admin.conf）拷贝到配置文件或者设置环境变量KUBECONFIG=“/etc/kubernetes/admin.conf”。
Usage:kubectl [flags] [options]
Use "kubectl <command> --help" for more information about a given command.
Use "kubectl options" for a list of global command-line options (applies to all commands).
K8S-资源支持介绍
| NAME | SHORTNAMES | APIVERSION | NAMESPACED | KIND |
|---|---|---|---|---|
| bindings | v1 | true | Binding | |
| componentstatuses | cs | v1 | false | ComponentStatus |
| configmaps | cm | v1 | true | ConfigMap |
| endpoints | ep | v1 | true | Endpoints |
| events | ev | v1 | true | Event |
| limitranges | limits | v1 | true | LimitRange |
| namespaces | ns | v1 | false | Namespace |
| nodes | no | v1 | false | Node |
| persistentvolumeclaims | pvc | v1 | true | PersistentVolumeClaim |
| persistentvolumes | pv | v1 | false | PersistentVolume |
| pods | po | v1 | true | Pod |
| podtemplates | v1 | true | PodTemplate | |
| replicationcontrollers | rc | v1 | true | ReplicationController |
| resourcequotas | quota | v1 | true | ResourceQuota |
| secrets | v1 | true | Secret | |
| serviceaccounts | sa | v1 | true | ServiceAccount |
| services | svc | v1 | true | Service |
| mutatingwebhookconfigurations | admissionregistration.k8s.io/v1 | false | MutatingWebhookConfiguration | |
| validatingwebhookconfigurations | admissionregistration.k8s.io/v1 | false | ValidatingWebhookConfiguration | |
| customresourcedefinitions | crd,crds | apiextensions.k8s.io/v1 | false | CustomResourceDefinition |
| apiservices | apiregistration.k8s.io/v1 | false | APIService | |
| controllerrevisions | apps/v1 | true | ControllerRevision | |
| daemonsets | ds | apps/v1 | true | DaemonSet |
| deployments | deploy | apps/v1 | true | Deployment |
| replicasets | rs | apps/v1 | true | ReplicaSet |
| statefulsets | sts | apps/v1 | true | StatefulSet |
| selfsubjectreviews | authentication.k8s.io/v1 | false | SelfSubjectReview | |
| tokenreviews | authentication.k8s.io/v1 | false | TokenReview | |
| localsubjectaccessreviews | authorization.k8s.io/v1 | true | LocalSubjectAccessReview | |
| selfsubjectaccessreviews | authorization.k8s.io/v1 | false | SelfSubjectAccessReview | |
| selfsubjectrulesreviews | authorization.k8s.io/v1 | false | SelfSubjectRulesReview | |
| subjectaccessreviews | authorization.k8s.io/v1 | false | SubjectAccessReview | |
| horizontalpodautoscalers | hpa | autoscaling/v2 | true | HorizontalPodAutoscaler |
| cronjobs | cj | batch/v1 | true | CronJob |
| jobs | batch/v1 | true | Job | |
| certificatesigningrequests | csr | certificates.k8s.io/v1 | false | CertificateSigningRequest |
| leases | coordination.k8s.io/v1 | true | Lease | |
| bgpconfigurations | crd.projectcalico.org/v1 | false | BGPConfiguration | |
| bgpfilters | crd.projectcalico.org/v1 | false | BGPFilter | |
| bgppeers | crd.projectcalico.org/v1 | false | BGPPeer | |
| blockaffinities | crd.projectcalico.org/v1 | false | BlockAffinity | |
| caliconodestatuses | crd.projectcalico.org/v1 | false | CalicoNodeStatus | |
| clusterinformations | crd.projectcalico.org/v1 | false | ClusterInformation | |
| felixconfigurations | crd.projectcalico.org/v1 | false | FelixConfiguration | |
| globalnetworkpolicies | crd.projectcalico.org/v1 | false | GlobalNetworkPolicy | |
| globalnetworksets | crd.projectcalico.org/v1 | false | GlobalNetworkSet | |
| hostendpoints | crd.projectcalico.org/v1 | false | HostEndpoint | |
| ipamblocks | crd.projectcalico.org/v1 | false | IPAMBlock | |
| ipamconfigs | crd.projectcalico.org/v1 | false | IPAMConfig | |
| ipamhandles | crd.projectcalico.org/v1 | false | IPAMHandle | |
| ippools | crd.projectcalico.org/v1 | false | IPPool | |
| ipreservations | crd.projectcalico.org/v1 | false | IPReservation | |
| kubecontrollersconfigurations | crd.projectcalico.org/v1 | false | KubeControllersConfiguration | |
| networkpolicies | crd.projectcalico.org/v1 | true | NetworkPolicy | |
| networksets | crd.projectcalico.org/v1 | true | NetworkSet | |
| endpointslices | discovery.k8s.io/v1 | true | EndpointSlice | |
| events | ev | events.k8s.io/v1 | true | Event |
| flowschemas | flowcontrol.apiserver.k8s.io/v1beta3 | false | FlowSchema | |
| prioritylevelconfigurations | flowcontrol.apiserver.k8s.io/v1beta3 | false | PriorityLevelConfiguration | |
| ingressclasses | networking.k8s.io/v1 | false | IngressClass | |
| ingresses | ing | networking.k8s.io/v1 | true | Ingress |
| networkpolicies | netpol | networking.k8s.io/v1 | true | NetworkPolicy |
| runtimeclasses | node.k8s.io/v1 | false | RuntimeClass | |
| apiservers | operator.tigera.io/v1 | false | APIServer | |
| imagesets | operator.tigera.io/v1 | false | ImageSet | |
| installations | operator.tigera.io/v1 | false | Installation | |
| tigerastatuses | operator.tigera.io/v1 | false | TigeraStatus | |
| poddisruptionbudgets | pdb | policy/v1 | true | PodDisruptionBudget |
| clusterrolebindings | rbac.authorization.k8s.io/v1 | false | ClusterRoleBinding | |
| clusterroles | rbac.authorization.k8s.io/v1 | false | ClusterRole | |
| rolebindings | rbac.authorization.k8s.io/v1 | true | RoleBinding | |
| roles | rbac.authorization.k8s.io/v1 | true | Role | |
| priorityclasses | pc | scheduling.k8s.io/v1 | false | PriorityClass |
| csidrivers | storage.k8s.io/v1 | false | CSIDriver | |
| csinodes | storage.k8s.io/v1 | false | CSINode | |
| csistoragecapacities | storage.k8s.io/v1 | true | CSIStorageCapacity | |
| storageclasses | sc | storage.k8s.io/v1 | false | StorageClass |
| volumeattachments | storage.k8s.io/v1 | false | VolumeAttachment |
K8S-namespace资源对象
一、概述
Kubernetes 支持多个虚拟集群，它们底层依赖于同一个物理集群。 这些虚拟集群被称为命名空间。
命名空间namespace是k8s集群级别的资源，可以给不同的用户、租户、环境或项目创建对应的命名空间，例如，可以为test、devlopment、production、deployment环境分别创建各自的命名空间。
namespace应用场景
命名空间适用于存在很多跨多个团队或项目的用户的场景。对于只有几到几十个用户的集群，根本不需要创建或考虑命名空间。
二、namespace资源管理
2.1 查看名称空间及其资源对象
k8s集群默认提供了几个名称空间用于特定目的，例如，kube-system主要用于运行系统级资源，存放k8s一些组件的。而default则为那些未指定名称空间的资源操作提供一个默认值。
##查看名称空间 kubectl get namespace
##查看特定的名称空间的详细信息 kubectl describe namespace NAME2.2 管理namespace资源
namespace资源的名称仅能由字母、数字、下划线、连接线等字符组成。删除namespace资源会级联删除其包含的所有其他资源对象。
##创建名称空间 kubectl create namespace 名称
##删除名称空间 kubectl delete namespace 名称三、namespace使用案例
3.1 创建一个test命名空间
[root@k8s-master01 ~]# kubectl create ns test3.2 切换默认查看命名空间
[root@k8s-master01 ~]# kubectl config set-context --current --namespace=kube-system
#注意:切换命名空间后，kubectl get pods 如果不指定-n，查看的就是kube-system命名空间的资源了。3.3 查看哪些资源属于命名空间级别的
[root@k8s-master01 ~]# kubectl api-resources --namespaced=true
NAME SHORTNAMES APIVERSION NAMESPACED KIND
bindings v1 true Binding
configmaps cm v1 true ConfigMap
endpoints ep v1 true Endpoints
events ev v1 true Event
limitranges limits v1 true LimitRange
persistentvolumeclaims pvc v1 true PersistentVolumeClaim
pods po v1 true Pod
podtemplates v1 true PodTemplate
replicationcontrollers rc v1 true ReplicationController
resourcequotas quota v1 true ResourceQuota
secrets v1 true Secret
serviceaccounts sa v1 true ServiceAccount
services svc v1 true Service
controllerrevisions apps/v1 true ControllerRevision
daemonsets ds apps/v1 true DaemonSet
deployments deploy apps/v1 true Deployment
replicasets rs apps/v1 true ReplicaSet
statefulsets sts apps/v1 true StatefulSet
localsubjectaccessreviews authorization.k8s.io/v1 true LocalSubjectAccessReview
horizontalpodautoscalers hpa autoscaling/v2 true HorizontalPodAutoscaler
cronjobs cj batch/v1 true CronJob
jobs batch/v1 true Job
leases coordination.k8s.io/v1 true Lease
networkpolicies crd.projectcalico.org/v1 true NetworkPolicy
networksets crd.projectcalico.org/v1 true NetworkSet
endpointslices discovery.k8s.io/v1 true EndpointSlice
events ev events.k8s.io/v1 true Event
pods metrics.k8s.io/v1beta1 true PodMetrics
ingresses ing networking.k8s.io/v1 true Ingress
networkpolicies netpol networking.k8s.io/v1 true NetworkPolicy
poddisruptionbudgets pdb policy/v1 true PodDisruptionBudget
rolebindings rbac.authorization.k8s.io/v1 true RoleBinding
roles rbac.authorization.k8s.io/v1 true Role
csistoragecapacities storage.k8s.io/v1 true CSIStorageCapacity3.4 namespace资源限额
namespace是命名空间，里面有很多资源，那么我们可以对命名空间资源做个限制，防止该命名空间部署的资源超过限制。
如何对namespace资源做限额呢？
[[root@k8s-master01 ~]# vim namespace-quota.yaml
apiVersion: v1
kind: ResourceQuota
metadata:name: mem-cpu-quotanamespace: test
spec:hard:requests.cpu: '2'requests.memory: 2Gilimits.cpu: '4'limits.memory: 4Gi
####解析####
#创建的ResourceQuota对象将在test名字空间中添加以下限制：
#每个容器必须设置内存请求（memory request），内存限额（memory limit），cpu请求（cpu request）和cpu限额（cpu limit）。
##所有容器的内存请求总额不得超过2GiB。
##所有容器的内存限额总额不得超过4GiB。
##所有容器的CPU请求总额不得超过2CPU。
##所有容器的CPU限额总额不得超过4CPU。
##应用配额文件并查看命名空间是否收到了限制[root@k8s-master01 ~]# kubectl apply -f namespace-quota.yaml
[root@k8s-master01 ~]# kubectl describe ns test
Name: test
Resource QuotasName: mem-cpu-quotaResource Used Hard-------- --- ---limits.cpu 0 4limits.memory 0 4Girequests.cpu 0 2requests.memory 0 2Gi3.5 创建资源限制Pod
创建pod时候可以不用设置资源限额，如下：
[root@k8s-master01 ~]# vim pod-test.yaml
apiVersion: v1
kind: Pod
metadata:name: pod-testnamespace: testlabels:app: tomcat-pod-test
spec:containers:- name: tomcat-testports:- containerPort: 8080image: tomcat:8.5-jre8-alpineimagePullPolicy: IfNotPresent
[root@k8s-master01 ~]# kubectl apply -f pod-test.yaml
Error from server (Forbidden): error when creating "pod-test.yaml": pods "pod-test" is forbidden: failed quota: mem-cpu-quota: must specify limits.cpu for: nginx1; limits.memory for: nginx1; requests.cpu for: nginx1; requests.memory for: nginx1
##发现无法正常启动修改一下资源配置清单
[root@k8s-master01 ~]# cat pod-test.yaml
apiVersion: v1
kind: Pod
metadata:name: pod-testnamespace: testlabels:app: tomcat-pod-test
spec:containers:- name: tomcat-testports:- containerPort: 8080image: tomcat:8.5-jre8-alpineimagePullPolicy: IfNotPresentresources:limits:cpu: 0.5memory: 1024Mi再次执行
[root@k8s-master01 ~]# kubectl apply -f pod-test.yaml
##查看，pod正常运行了
[root@k8s-master01 ~]# kubectl get pod -n test
NAME READY STATUS RESTARTS AGE
pod-test 1/1 Running 0 15s