sean – Page 5 – 一江春水向东流

未分类

如何精简Docker镜像

精简Docker镜像的五种通用方法精简 Docker 镜像的好处很多，不仅可以节省存储空间和带宽，还能减少安全隐患。优化镜像大小的手段多种多样，因服务所使用的基础开发语言不同而有差异。本文将介绍精简 Docker 镜像的几种通用方法。精简 Docker 镜像大小的必要性 Docker 镜像由很多镜像层（Layers）组成（最多 127 层），镜像层依赖于一系列的底层技术，比如文件系统（filesystems）、写时复制（copy-on-write）、联合挂载（union mounts）等技术，你可以查看Docker 社区文档以了解更多有关 Docker 存储驱动的内容，这里就不再赘述技术细节。总的来说，Dockerfile 中的每条指令都会创建一个镜像层，继而会增加整体镜像的尺寸。下面是精简 Docker 镜像尺寸的好处：减少构建时间减少磁盘使用量减少下载时间因为包含文件少，攻击面减小，提高了安全性提高部署速度五点建议减小Docker镜像尺寸一、优化基础镜像优化基础镜像的方法就是选用合适的更小的基础镜像，常用的 Linux 系统镜像一般有 Ubuntu、CentOs、Alpine，其中 Alpine 更推荐使用。大小对比如下： Alpine 是一个高度精简又包含了基本工具的轻量级 Linux 发行版，基础镜像只有 4.41M，各开发语言和框架都有基于 Alpine 制作的基础镜像，强烈推荐使用它。查看上面的镜像尺寸对比结果，你会发现最小的镜像也有 4.41M，那么有办法构建更小的镜像吗？答案是肯定的，例如 http://gcr.io/google_containers/pause-amd64:3.1 镜像仅有 742KB。为什么这个镜像能这么小？在为大家解密之前，再推荐两个基础镜像： 1、scratch 镜像 scratch 是一个空镜像，只能用于构建其他镜像，比如你要运行一个包含所有依赖的二进制文件，如Golang 程序，可以直接使用 scratch Read more…

By sean, 2 years ago

未分类

gitlab pipeline 自动构建

使用gitlab pipeline自动构建，需要为项目配置runner, 安装方法为：

curl -L --output /usr/local/bin/gitlab-runner "https://gitlab-runner-downloads.s3.amazonaws.com/latest/binaries/gitlab-runner-linux-amd64"
curl -L --output /usr/local/bin/gitlab-runner "https://gitlab-runner-downloads.s3.amazonaws.com/latest/binaries/gitlab-runner-linux-arm64"

chmod +x /usr/local/bin/gitlab-runner
useradd --comment 'GitLab Runner' --create-home gitlab-runner --shell /bin/bash
gitlab-runner install --user=gitlab-runner --working-directory=/home/gitlab-runner
gitlab-runner start
gitlab-runner register  # 按照提示输入相关信息

curl -L --output /usr/local/bin/gitlab-runner "https://gitlab-runner-downloads.s3.amazonaws.com/latest/binaries/gitlab-runner-linux-amd64"

curl -L --output /usr/local/bin/gitlab-runner "https://gitlab-runner-downloads.s3.amazonaws.com/latest/binaries/gitlab-runner-linux-arm64"

chmod +x /usr/local/bin/gitlab-runner

useradd --comment 'GitLab Runner' --create-home gitlab-runner --shell /bin/bash

gitlab-runner install --user=gitlab-runner --working-directory=/home/gitlab-runner

gitlab-runner start

gitlab-runner register # 按照提示输入相关信息

构建一个docker:buildx镜像做测试 .gitlab-ci.yml：

variables:
  IMAGE_REPO: $REGISTRY/library/docker
  IMAGE_TAG: buildx

before_script:
  - docker login -u $REGISTRY_USERNAME -p $REGISTRY_PASSWORD $REGISTRY

build:
  image: docker:latest
  stage: build
  services:
    - name: docker:dind
  script:
    - docker build -t $IMAGE_REPO:$IMAGE_TAG -t $IMAGE_REPO .
    - docker push $IMAGE_REPO
    - docker push $IMAGE_REPO:$IMAGE_TAG
  only:
    - master

variables:

IMAGE_REPO: $REGISTRY/library/docker

IMAGE_TAG: buildx

before_script:

- docker login -u $REGISTRY_USERNAME -p $REGISTRY_PASSWORD $REGISTRY

build:

image: docker:latest

stage: build

services:

- name: docker:dind

script:

- docker build -t $IMAGE_REPO:$IMAGE_TAG -t $IMAGE_REPO .

- docker push $IMAGE_REPO

- docker push $IMAGE_REPO:$IMAGE_TAG

only:

- master

Dockerfile:

FROM docker:latest

ARG ALPINE_REPO=mirrors.aliyun.com

RUN mkdir -p /root/.docker/cli-plugins \
    && wget -qO ~/.docker/cli-plugins/docker-buildx $BASE_URL/extra/buildx-v0.8.2.linux-amd64 \
    && wget -qO /usr/local/bin/skopeo $BASE_URL/extra/skopeo-linux-amd64 \
    && ln -s /usr/local/bin/skopeo /usr/bin/skopeo \
    && wget -qO /usr/local/bin/yq $BASE_URL/extra/yq-linux-amd64 \
    && chmod +x /root/.docker/cli-plugins/docker-buildx /usr/local/bin/* \
    && [[ ! -z $ALPINE_REPO ]] && sed -i "s/dl-cdn.alpinelinux.org/$ALPINE_REPO/" /etc/apk/repositories || true \
    && apk --no-cache add wget \
    && /bin/rm -rf /tmp/* /var/cache/apk/*

FROM docker:latest

ARG ALPINE_REPO=mirrors.aliyun.com

RUN mkdir -p /root/.docker/cli-plugins \

&& wget -qO ~/.docker/cli-plugins/docker-buildx $BASE_URL/extra/buildx-v0.8.2.linux-amd64 \

&& wget -qO /usr/local/bin/skopeo $BASE_URL/extra/skopeo-linux-amd64 \

&& ln -s /usr/local/bin/skopeo /usr/bin/skopeo \

&& wget -qO /usr/local/bin/yq $BASE_URL/extra/yq-linux-amd64 \

&& chmod +x /root/.docker/cli-plugins/docker-buildx /usr/local/bin/* \

&& [[ ! -z $ALPINE_REPO ]] && sed -i "s/dl-cdn.alpinelinux.org/$ALPINE_REPO/" /etc/apk/repositories || true \

&& apk --no-cache add wget \

&& /bin/rm -rf /tmp/* /var/cache/apk/*

运行时提示Got permission denied while trying to connect to the Docker daemon socket，解决方法：在runner服务器上修改gitlab-runner用户加入docker组：

usermod -a -G docker gitlab-runner

1	usermod -a -G docker gitlab-runner

By sean, 3 years07/07/2022 ago

未分类

harbor v2.5.1安装

使用docker-compose来安装harbor v2.5.1，安装过程中有一些问题，下面记录一下：下载离线安装包：

wget https://github.com/goharbor/harbor/releases/download/v2.5.1/harbor-offline-installer-v2.5.1.tgz

1	wget https://github.com/goharbor/harbor/releases/download/v2.5.1/harbor-offline-installer-v2.5.1.tgz

2. 准备docker-compose.yml和harbor.yml: docker-compose.yml:

version: '2.3'
services:
  log:
    image: goharbor/harbor-log:v2.5.1
    container_name: harbor-log
    restart: always
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - SETGID
      - SETUID
    volumes:
      - /ali-nas/harbor/log/:/var/log/docker/:z
      - type: bind
        source: ./common/config/log/logrotate.conf
        target: /etc/logrotate.d/logrotate.conf
      - type: bind
        source: ./common/config/log/rsyslog_docker.conf
        target: /etc/rsyslog.d/rsyslog_docker.conf
    ports:
      - 127.0.0.1:1514:10514
    networks:
      - harbor
  registry:
    image: goharbor/registry-photon:v2.5.1
    container_name: registry
    restart: always
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
    volumes:
      - /ali-nas/harbor/registry:/storage:z
      - ./common/config/registry/:/etc/registry/:z
      - type: bind
        source: /ali-nas/harbor/secret/registry/root.crt
        target: /etc/registry/root.crt
      - type: bind
        source: ./common/config/shared/trust-certificates
        target: /harbor_cust_cert
    networks:
      - harbor
    depends_on:
      - log
    logging:
      driver: "syslog"
      options:
        syslog-address: "tcp://localhost:1514"
        tag: "registry"
  registryctl:
    image: goharbor/harbor-registryctl:v2.5.1
    container_name: registryctl
    env_file:
      - ./common/config/registryctl/env
    restart: always
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
    volumes:
      - /ali-nas/harbor/registry:/storage:z
      - ./common/config/registry/:/etc/registry/:z
      - type: bind
        source: ./common/config/registryctl/config.yml
        target: /etc/registryctl/config.yml
      - type: bind
        source: ./common/config/shared/trust-certificates
        target: /harbor_cust_cert
    networks:
      - harbor
    depends_on:
      - log
    logging:
      driver: "syslog"
      options:
        syslog-address: "tcp://localhost:1514"
        tag: "registryctl"
  postgresql:
    image: goharbor/harbor-db:v2.5.1
    container_name: harbor-db
    restart: always
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - SETGID
      - SETUID
    volumes:
      - /ali-nas/harbor/database:/var/lib/postgresql/data:z
    networks:
      harbor:
    env_file:
      - ./common/config/db/env
    depends_on:
      - log
    logging:
      driver: "syslog"
      options:
        syslog-address: "tcp://localhost:1514"
        tag: "postgresql"
    shm_size: '1gb'
  core:
    image: goharbor/harbor-core:v2.5.1
    container_name: harbor-core
    env_file:
      - ./common/config/core/env
    restart: always
    cap_drop:
      - ALL
    cap_add:
      - SETGID
      - SETUID
    volumes:
      - /ali-nas/harbor/ca_download/:/etc/core/ca/:z
      - /ali-nas/harbor/:/data/:z
      - ./common/config/core/certificates/:/etc/core/certificates/:z
      - type: bind
        source: ./common/config/core/app.conf
        target: /etc/core/app.conf
      - type: bind
        source: /ali-nas/harbor/secret/core/private_key.pem
        target: /etc/core/private_key.pem
      - type: bind
        source: /ali-nas/harbor/secret/keys/secretkey
        target: /etc/core/key
      - type: bind
        source: ./common/config/shared/trust-certificates
        target: /harbor_cust_cert
    networks:
      harbor:
    depends_on:
      - log
      - registry
      - redis
      - postgresql
    logging:
      driver: "syslog"
      options:
        syslog-address: "tcp://localhost:1514"
        tag: "core"
  portal:
    image: goharbor/harbor-portal:v2.5.1
    container_name: harbor-portal
    restart: always
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
      - NET_BIND_SERVICE
    volumes:
      - type: bind
        source: ./common/config/portal/nginx.conf
        target: /etc/nginx/nginx.conf
    networks:
      - harbor
    depends_on:
      - log
    logging:
      driver: "syslog"
      options:
        syslog-address: "tcp://localhost:1514"
        tag: "portal"

  jobservice:
    image: goharbor/harbor-jobservice:v2.5.1
    container_name: harbor-jobservice
    env_file:
      - ./common/config/jobservice/env
    restart: always
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
    volumes:
      - /ali-nas/harbor/job_logs:/var/log/jobs:z
      - type: bind
        source: ./common/config/jobservice/config.yml
        target: /etc/jobservice/config.yml
      - type: bind
        source: ./common/config/shared/trust-certificates
        target: /harbor_cust_cert
    networks:
      - harbor
    depends_on:
      - core
    logging:
      driver: "syslog"
      options:
        syslog-address: "tcp://localhost:1514"
        tag: "jobservice"
  redis:
    image: goharbor/redis-photon:v2.5.1
    container_name: redis
    restart: always
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
    volumes:
      - /ali-nas/harbor/redis:/var/lib/redis
    networks:
      harbor:
    depends_on:
      - log
    logging:
      driver: "syslog"
      options:
        syslog-address: "tcp://localhost:1514"
        tag: "redis"
  proxy:
    image: goharbor/nginx-photon:v2.5.1
    container_name: nginx
    restart: always
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
      - NET_BIND_SERVICE
    volumes:
      - ./common/config/nginx:/etc/nginx:z
      - type: bind
        source: ./common/config/shared/trust-certificates
        target: /harbor_cust_cert
    networks:
      - harbor
    ports:
      - 81:8080
    depends_on:
      - registry
      - core
      - portal
      - log
    logging:
      driver: "syslog"
      options:
        syslog-address: "tcp://localhost:1514"
        tag: "proxy"
networks:
  harbor:
    external: false

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

version: '2.3'

services:

log:

image: goharbor/harbor-log:v2.5.1

container_name: harbor-log

restart: always

cap_drop:

- ALL

cap_add:

- CHOWN

- DAC_OVERRIDE

- SETGID

- SETUID

volumes:

- /ali-nas/harbor/log/:/var/log/docker/:z

- type: bind

source: ./common/config/log/logrotate.conf

target: /etc/logrotate.d/logrotate.conf

- type: bind

source: ./common/config/log/rsyslog_docker.conf

target: /etc/rsyslog.d/rsyslog_docker.conf

ports:

- 127.0.0.1:1514:10514

networks:

- harbor

registry:

image: goharbor/registry-photon:v2.5.1

container_name: registry

restart: always

cap_drop:

- ALL

cap_add:

- CHOWN

- SETGID

- SETUID

volumes:

- /ali-nas/harbor/registry:/storage:z

- ./common/config/registry/:/etc/registry/:z

- type: bind

source: /ali-nas/harbor/secret/registry/root.crt

target: /etc/registry/root.crt

- type: bind

source: ./common/config/shared/trust-certificates

target: /harbor_cust_cert

networks:

- harbor

depends_on:

- log

logging:

driver: "syslog"

options:

syslog-address: "tcp://localhost:1514"

tag: "registry"

registryctl:

image: goharbor/harbor-registryctl:v2.5.1

container_name: registryctl

env_file:

- ./common/config/registryctl/env

restart: always

cap_drop:

- ALL

cap_add:

- CHOWN

- SETGID

- SETUID

volumes:

- /ali-nas/harbor/registry:/storage:z

- ./common/config/registry/:/etc/registry/:z

- type: bind

source: ./common/config/registryctl/config.yml

target: /etc/registryctl/config.yml

- type: bind

source: ./common/config/shared/trust-certificates

target: /harbor_cust_cert

networks:

- harbor

depends_on:

- log

logging:

driver: "syslog"

options:

syslog-address: "tcp://localhost:1514"

tag: "registryctl"

postgresql:

image: goharbor/harbor-db:v2.5.1

container_name: harbor-db

restart: always

cap_drop:

- ALL

cap_add:

- CHOWN

- DAC_OVERRIDE

- SETGID

- SETUID

volumes:

- /ali-nas/harbor/database:/var/lib/postgresql/data:z

networks:

harbor:

env_file:

- ./common/config/db/env

depends_on:

- log

logging:

driver: "syslog"

options:

syslog-address: "tcp://localhost:1514"

tag: "postgresql"

shm_size: '1gb'

core:

image: goharbor/harbor-core:v2.5.1

container_name: harbor-core

env_file:

- ./common/config/core/env

restart: always

cap_drop:

- ALL

cap_add:

- SETGID

- SETUID

volumes:

- /ali-nas/harbor/ca_download/:/etc/core/ca/:z

- /ali-nas/harbor/:/data/:z

- ./common/config/core/certificates/:/etc/core/certificates/:z

- type: bind

source: ./common/config/core/app.conf

target: /etc/core/app.conf

- type: bind

source: /ali-nas/harbor/secret/core/private_key.pem

target: /etc/core/private_key.pem

- type: bind

source: /ali-nas/harbor/secret/keys/secretkey

target: /etc/core/key

- type: bind

source: ./common/config/shared/trust-certificates

target: /harbor_cust_cert

networks:

harbor:

depends_on:

- log

- registry

- redis

- postgresql

logging:

driver: "syslog"

options:

syslog-address: "tcp://localhost:1514"

tag: "core"

portal:

image: goharbor/harbor-portal:v2.5.1

container_name: harbor-portal

restart: always

cap_drop:

- ALL

cap_add:

- CHOWN

- SETGID

- SETUID

- NET_BIND_SERVICE

volumes:

- type: bind

source: ./common/config/portal/nginx.conf

target: /etc/nginx/nginx.conf

networks:

- harbor

depends_on:

- log

logging:

driver: "syslog"

options:

syslog-address: "tcp://localhost:1514"

tag: "portal"

jobservice:

image: goharbor/harbor-jobservice:v2.5.1

container_name: harbor-jobservice

env_file:

- ./common/config/jobservice/env

restart: always

cap_drop:

- ALL

cap_add:

- CHOWN

- SETGID

- SETUID

volumes:

- /ali-nas/harbor/job_logs:/var/log/jobs:z

- type: bind

source: ./common/config/jobservice/config.yml

target: /etc/jobservice/config.yml

- type: bind

source: ./common/config/shared/trust-certificates

target: /harbor_cust_cert

networks:

- harbor

depends_on:

- core

logging:

driver: "syslog"

options:

syslog-address: "tcp://localhost:1514"

tag: "jobservice"

redis:

image: goharbor/redis-photon:v2.5.1

container_name: redis

restart: always

cap_drop:

- ALL

cap_add:

- CHOWN

- SETGID

- SETUID

volumes:

- /ali-nas/harbor/redis:/var/lib/redis

networks:

harbor:

depends_on:

- log

logging:

driver: "syslog"

options:

syslog-address: "tcp://localhost:1514"

tag: "redis"

proxy:

image: goharbor/nginx-photon:v2.5.1

container_name: nginx

restart: always

cap_drop:

- ALL

cap_add:

- CHOWN

- SETGID

- SETUID

- NET_BIND_SERVICE

volumes:

- ./common/config/nginx:/etc/nginx:z

- type: bind

source: ./common/config/shared/trust-certificates

target: /harbor_cust_cert

networks:

- harbor

ports:

- 81:8080

depends_on:

- registry

- core

- portal

- log

logging:

driver: "syslog"

options:

syslog-address: "tcp://localhost:1514"

tag: "proxy"

networks:

harbor:

external: false

harbor.yml文件需要更改hostname, 监听port, 如果不开启ssl, 则注释掉https, 更改harbor_admin_password，和data_volume

hostname: 172.20.47.2

http:
  port: 81

harbor_admin_password: xxxxx

database:
  password: root123
  max_idle_conns: 100
  max_open_conns: 900

data_volume: /ali-nas/harbor



trivy:
  ignore_unfixed: false
  skip_update: false
  insecure: false

jobservice:
  max_job_workers: 10

notification:
  webhook_job_max_retry: 10

chart:
  absolute_url: disabled

log:
  level: info
  local:
    rotate_count: 50
    rotate_size: 200M
    location: /ali-nas/harbor/log


_version: 2.5.0


proxy:
  http_proxy:
  https_proxy:
  no_proxy:
  components:
    - core
    - jobservice
    - trivy

hostname: 172.20.47.2

http:

port: 81

harbor_admin_password: xxxxx

database:

password: root123

max_idle_conns: 100

max_open_conns: 900

data_volume: /ali-nas/harbor

trivy:

ignore_unfixed: false

skip_update: false

insecure: false

jobservice:

max_job_workers: 10

notification:

webhook_job_max_retry: 10

chart:

absolute_url: disabled

log:

level: info

local:

rotate_count: 50

rotate_size: 200M

location: /ali-nas/harbor/log

_version: 2.5.0

proxy:

http_proxy:

https_proxy:

no_proxy:

components:

- core

- jobservice

- trivy

执行完docker-compose up -d后，容器全部启来了，但是再执行docker-compose down后，再执行install.sh，或up启动，发现有几个问题： docker-compose up启动报错： Creating harbor-log … error ERROR: for harbor-log Cannot start service log: driver failed programming external connectivity on endpoint harbor-log (cb1338bb88ec65aba9727cb1e7656e6c44b3705095121e27ab9240a66cda1ef1): (iptables failed: iptables –wait -t filter Read more…

By sean, 3 years06/30/2022 ago

未分类

vscode配置代理

配置代理，让vscode和git飞起来对于 git, 只需要用下面的明亮就可以了

git config --global https.proxy http://127.0.0.1:1080
git config --global https.proxy https://127.0.0.1:1080
git config --global http.proxy 'socks5://127.0.0.1:1080'
git config --global https.proxy 'socks5://127.0.0.1:1080'

git config --global https.proxy http://127.0.0.1:1080

git config --global https.proxy https://127.0.0.1:1080

git config --global http.proxy 'socks5://127.0.0.1:1080'

git config --global https.proxy 'socks5://127.0.0.1:1080'

如果想要取消：

git config --global --unset http.proxy
git config --global --unset https.proxy

1 2	git config --global --unset http.proxy git config --global --unset https.proxy

但是如果是vscode，同样也是通过首选项->设置->搜索proxy，然后可以输入上面的proxy。速度就飞了。。或者可以这样：

export https_proxy=http://127.0.0.1:4780 http_proxy=http://127.0.0.1:4780 all_proxy=socks5://127.0.0.1:4780

1	export https_proxy=http://127.0.0.1:4780 http_proxy=http://127.0.0.1:4780 all_proxy=socks5://127.0.0.1:4780

当然，自备梯子

By sean, 3 years06/21/2022 ago

OS

编译安装jq

编译安装jq #下载源码 git clone https://github.com/stedolan/jq.git cd jq git checkout jq-1.6 # 拉取子模块 git submodule update –init #生成makefile.in文件 autoreconf -fi #生成makefile ./configure –with-oniguruma=builtin –prefix=/usr/local #编译 make

By sean, 3 years03/10/2022 ago

未分类

「Docker Buildx」- 构建“跨平台”镜像

使用Buildx 在x86架构centos上构建支持多架构镜像，首先，要确保内核大于4.0 升级内核版本

rpm --import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org
rpm -Uvh http://www.elrepo.org/elrepo-release-7.0-3.el7.elrepo.noarch.rpm
# 查询目前可升级的内核版本
yum --disablerepo="*" --enablerepo="elrepo-kernel" list available
# 安装kernel-ml 最新版
yum --enablerepo=elrepo-kernel install kernel-ml -y
# 查询所有启动候选项
awk -F\' '$1=="menuentry " {print i++ " : " $2}' /etc/grub2.cfg
# 设置grub引导默认启动项
grub2-set-default 0
# 重启
reboot
# 检测内核版本
uname -a

rpm --import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org

rpm -Uvh http://www.elrepo.org/elrepo-release-7.0-3.el7.elrepo.noarch.rpm

# 查询目前可升级的内核版本

yum --disablerepo="*" --enablerepo="elrepo-kernel" list available

# 安装kernel-ml 最新版

yum --enablerepo=elrepo-kernel install kernel-ml -y

# 查询所有启动候选项

awk -F\' '$1=="menuentry " {print i++ " : " $2}' /etc/grub2.cfg

# 设置grub引导默认启动项

grub2-set-default 0

# 重启

reboot

# 检测内核版本

uname -a

卸载旧内核

[root@localhost ~]# rpm -qa | grep kernel
kernel-3.10.0-327.22.2.el7.x86_64
kernel-devel-3.10.0-327.22.2.el7.x86_64
kernel-tools-libs-3.10.0-327.28.2.el7.x86_64
kernel-headers-3.10.0-327.28.2.el7.x86_64
kernel-3.10.0-327.28.2.el7.x86_64
kernel-devel-3.10.0-327.13.1.el7.x86_64
php-symfony-http-kernel-2.8.7-1.el7.noarch
kernel-tools-3.10.0-327.28.2.el7.x86_64
kernel-devel-3.10.0-327.28.2.el7.x86_64
kernel-devel-3.10.0-327.18.2.el7.x86_64

[root@localhost ~]# yum remove kernel-3.10.0*
[root@localhost ~]# reboot

[root@localhost ~]# rpm -qa | grep kernel

kernel-3.10.0-327.22.2.el7.x86_64

kernel-devel-3.10.0-327.22.2.el7.x86_64

kernel-tools-libs-3.10.0-327.28.2.el7.x86_64

kernel-headers-3.10.0-327.28.2.el7.x86_64

kernel-3.10.0-327.28.2.el7.x86_64

kernel-devel-3.10.0-327.13.1.el7.x86_64

php-symfony-http-kernel-2.8.7-1.el7.noarch

kernel-tools-3.10.0-327.28.2.el7.x86_64

kernel-devel-3.10.0-327.28.2.el7.x86_64

kernel-devel-3.10.0-327.18.2.el7.x86_64

[root@localhost ~]# yum remove kernel-3.10.0*

[root@localhost ~]# reboot

安装docker:

# 最新版
curl -sSl https://qiao.dev/bash/install_docker_latest_centos.sh | sh
# k8s最新支持版本 18.09.8
curl -sSl https://qiao.dev/bash/install_docker_18.09.8_centos.sh | sh

# 最新版

curl -sSl https://qiao.dev/bash/install_docker_latest_centos.sh | sh

# k8s最新支持版本 18.09.8

curl -sSl https://qiao.dev/bash/install_docker_18.09.8_centos.sh | sh

开启特性： /etc/systemd/system/docker.service.d/docker-options.conf 中加入： –experimental=true \ 可以添加私有仓库的ssl证书到buildx容器内

BUILDER=$(docker ps | grep buildkitd | cut -f1 -d' ')
docker cp /etc/docker/certs.d/harbor.offline/harbor.offline.crt $BUILDER:/usr/local/share/ca-certificates/
docker exec $BUILDER sh -c "cat /usr/local/share/ca-certificates/harbor.offline.crt >> /etc/ssl/certs/ca-certificates.crt"
docker restart $BUILDER

BUILDER=$(docker ps | grep buildkitd | cut -f1 -d' ')

docker cp /etc/docker/certs.d/harbor.offline/harbor.offline.crt $BUILDER:/usr/local/share/ca-certificates/

docker exec $BUILDER sh -c "cat /usr/local/share/ca-certificates/harbor.offline.crt >> /etc/ssl/certs/ca-certificates.crt"

docker restart $BUILDER

启动交叉编译: 方式1：

docker run -it --rm --privileged tonistiigi/binfmt --install all

docker buildx create --name multi-platform --use --platform linux/amd64,linux/arm64 --driver docker-container

docker run -it --rm --privileged tonistiigi/binfmt --install all

docker buildx create --name multi-platform --use --platform linux/amd64,linux/arm64 --driver docker-container

方式2 ：也可以安装qemu:

# 安装epel yum库
wget -P /etc/yum.repos.d/ http://mirrors.aliyun.com/repo/epel-7.repo
yum clean all
yum install qemu -y

# 安装epel yum库

wget -P /etc/yum.repos.d/ http://mirrors.aliyun.com/repo/epel-7.repo

yum clean all

yum install qemu -y

如构建ntp构建： docker buildx build –platform linux/amd64,linux/arm64 -t chrony . 如果想将构建好的镜像保存在本地，可以将 type 指定为 docker，但必须分别为不同的 CPU 架构构建不同的镜像，不能合并成一个镜像，即： docker buildx build –platform linux/amd64,linux/amd64-t chrony -o type=docker . docker Read more…

By sean, 3 years02/14/2022 ago

未分类

通过ansible获取文件的几种方式

通过ansible获取文件的几种方式: 通过lookup读取ansible管理节点上的的内容，并将其内容赋值给变量。如: 获取管理节点上的ssh key:

- name: Autoops | set ssh key
  set_fact:
    autoops_public_key: "{{ autoops_public_key | default(lookup('file', '/root/.ssh/id_rsa.pub')) }}"
    autoops_private_key: "{{ autoops_private_key | default(lookup('file', '/root/.ssh/id_rsa')) }}"
  delegate_to: localhost
  connection: local
  run_once: yes

- name: Autoops | set ssh key

set_fact:

autoops_public_key: "{{ autoops_public_key | default(lookup('file', '/root/.ssh/id_rsa.pub')) }}"

autoops_private_key: "{{ autoops_private_key | default(lookup('file', '/root/.ssh/id_rsa')) }}"

delegate_to: localhost

connection: local

run_once: yes

fetch 模块的作用就是”Fetches a file from remote nodes，fetch为”拿来”之意，当我们需要将受管主机中的文件拉取到ansible主机时，则可以使用此模块, 可以从远端将文件拉取到本地, 如获取k8s master节点上的ca证书到本地:

- hosts: kube_control_plane:localhost
  gather_facts: False
  pre_tasks:
  - setup:
      gather_subset: 'min'
    tags: 
      - kubeconfig_localhost
      - user_init
  tasks:
  - import_role: 
      name: kubespray-defaults
  - name: "set_fact for current_user"
    set_fact:
      current_user: "{{ hostvars[inventory_hostname]['ansible_env'].USER }}"
      current_user_home: "{{ hostvars[inventory_hostname]['ansible_env'].HOME }}"
    tags: 
      - kubeconfig_localhost
      - user_init

  - block:
    # edit admin.conf
    - name: modify admin.conf to api server domain
      lineinfile:
        dest: "{{ current_user_home }}/.kube/config"
        state: present
        regexp: '(^\s*.server: .*://).*(:.*$)'
        line: '\1{{ apiserver_loadbalancer_domain_name }}\2'
        backrefs: yes
      when: loadbalancer_apiserver is not defined
    delegate_to: localhost
    connection: local
    delegate_facts: yes
    become: no
    run_once: yes
    when:
      - kubeconfig_localhost
    tags: kubeconfig_localhost

  - name: Fetch ca.crt from master to ansible host
    fetch:
      src: "{{ kube_cert_compat_dir }}/ca.crt"
      dest: "{{ kube_cert_compat_dir }}/ca.crt"
      flat: yes
      validate_checksum: no
    register: copy_ca_result
    until: copy_ca_result is not failed
    retries: 20
    become: no
    run_once: yes
    when:
      - kubeconfig_localhost
      - "'HOSTNAME' in hostvars['localhost']['ansible_env']"
      - "hostvars['localhost']['ansible_env'].get('HOSTNAME') not in groups['kube_control_plane']"
    tags: kubeconfig_localhost

- hosts: kube_control_plane:localhost

gather_facts: False

pre_tasks:

- setup:

gather_subset: 'min'

tags:

- kubeconfig_localhost

- user_init

tasks:

- import_role:

name: kubespray-defaults

- name: "set_fact for current_user"

set_fact:

current_user: "{{ hostvars[inventory_hostname]['ansible_env'].USER }}"

current_user_home: "{{ hostvars[inventory_hostname]['ansible_env'].HOME }}"

tags:

- kubeconfig_localhost

- user_init

- block:

# edit admin.conf

- name: modify admin.conf to api server domain

lineinfile:

dest: "{{ current_user_home }}/.kube/config"

state: present

regexp: '(^\s*.server: .*://).*(:.*$)'

line: '\1{{ apiserver_loadbalancer_domain_name }}\2'

backrefs: yes

when: loadbalancer_apiserver is not defined

delegate_to: localhost

connection: local

delegate_facts: yes

become: no

run_once: yes

when:

- kubeconfig_localhost

tags: kubeconfig_localhost

- name: Fetch ca.crt from master to ansible host

fetch:

src: "{{ kube_cert_compat_dir }}/ca.crt"

dest: "{{ kube_cert_compat_dir }}/ca.crt"

flat: yes

validate_checksum: no

until: copy_ca_result is not failed

retries: 20

become: no

run_once: yes

when:

- kubeconfig_localhost

- "'HOSTNAME' in hostvars['localhost']['ansible_env']"

- "hostvars['localhost']['ansible_env'].get('HOSTNAME') not in groups['kube_control_plane']"

tags: kubeconfig_localhost

使用cat测试到变量 slurp 模块用于拉取远端文件的 base64 码, 可通过b64decode进行解码任务: 获取etcd主机的ssl文件信息注册到变量, 用来生成etcdkeeper配置文件, 首先用cat来获取: tasks/main.yml:

- block:
  - name: get remote file contents
    command: "cat {{ etcdkeeper_cacert_file }}"
    register: etcdkeeper_cacert_file

  - name: get remote file contents
    command: "cat {{ etcdkeeper_cert_file }}"
    register: etcdkeeper_cert_file

  - name: get remote file contents
    command: "cat {{ etcdkeeper_key_file }}"
    register: etcdkeeper_key_file
  when:
    - inventory_hostname == groups['etcd'][0]

- name: show key contents
  debug:
    var: hostvars[groups['etcd'][0]].etcdkeeper_cacert_file.stdout

- name: Autoops | Create addon dir
  file:
    path: "{{ item }}"
    state: directory
    owner: root
    group: root
    mode: 0755
    recurse: yes
  with_items:
    - "{{ kube_config_dir }}/addons/etcdkeeper"
  when:
    - inventory_hostname == groups['kube_control_plane'][0]

- name: Autoops | Create manifests
  template: 
    src: "{{ item }}.yml.j2" 
    dest: "{{ kube_config_dir }}/addons/etcdkeeper/{{ item }}.yml"
  vars:
    etcdkeeper_cacert: "{{ hostvars[groups['etcd'][0]].etcdkeeper_cacert_file.stdout }}"
    etcdkeeper_cert: "{{ hostvars[groups['etcd'][0]].etcdkeeper_cert_file.stdout }}"
    etcdkeeper_key: "{{ hostvars[groups['etcd'][0]].etcdkeeper_key_file.stdout }}"
  with_items:
    - etcdkeeper_ns
    - etcdkeeper_cm
    - etcdkeeper_deploy
    - etcdkeeper_svc
  register: etcdkeeper_manifests
  when:
    - inventory_hostname == groups['kube_control_plane'][0]

- name: Autoops | Apply manifests
  shell: "{{ bin_dir }}/kubectl apply -f {{ kube_config_dir }}/addons/etcdkeeper/{{ item.item }}.yml"
  with_items: "{{ etcdkeeper_manifests.results }}"
  when:
    - inventory_hostname == groups['kube_control_plane'][0]

- block:

- name: get remote file contents

command: "cat {{ etcdkeeper_cacert_file }}"

- name: get remote file contents

command: "cat {{ etcdkeeper_cert_file }}"

- name: get remote file contents

command: "cat {{ etcdkeeper_key_file }}"

when:

- inventory_hostname == groups['etcd'][0]

- name: show key contents

debug:

var: hostvars[groups['etcd'][0]].etcdkeeper_cacert_file.stdout

- name: Autoops | Create addon dir

file:

path: "{{ item }}"

state: directory

owner: root

group: root

mode: 0755

recurse: yes

with_items:

- "{{ kube_config_dir }}/addons/etcdkeeper"

when:

- inventory_hostname == groups['kube_control_plane'][0]

- name: Autoops | Create manifests

template:

src: "{{ item }}.yml.j2"

dest: "{{ kube_config_dir }}/addons/etcdkeeper/{{ item }}.yml"

vars:

etcdkeeper_cacert: "{{ hostvars[groups['etcd'][0]].etcdkeeper_cacert_file.stdout }}"

etcdkeeper_cert: "{{ hostvars[groups['etcd'][0]].etcdkeeper_cert_file.stdout }}"

etcdkeeper_key: "{{ hostvars[groups['etcd'][0]].etcdkeeper_key_file.stdout }}"

with_items:

- etcdkeeper_ns

- etcdkeeper_cm

- etcdkeeper_deploy

- etcdkeeper_svc

when:

- inventory_hostname == groups['kube_control_plane'][0]

- name: Autoops | Apply manifests

shell: "{{ bin_dir }}/kubectl apply -f {{ kube_config_dir }}/addons/etcdkeeper/{{ item.item }}.yml"

with_items: "{{ etcdkeeper_manifests.results }}"

when:

- inventory_hostname == groups['kube_control_plane'][0]

结果发现, 生成的配置里, 换行符都被换成了空格尝试使用slurp模块:

- block:
  - name: Etcdkeeper | get remote ca file contents
    slurp:
      src: "{{ etcdkeeper_cacert_file }}"
    register: etcdkeeper_cacert_file

  - name: Etcdkeeper | get remote cert file contents
    slurp:
      src: "{{ etcdkeeper_cert_file }}"
    register: etcdkeeper_cert_file

  - name: Etcdkeeper | get remote key file contents
    slurp:
      src: "{{ etcdkeeper_key_file }}"
    register: etcdkeeper_key_file
  when:
    - inventory_hostname == groups['etcd'][0]


- name: Etcdkeeper | Create addon dir
  file:
    path: "{{ item }}"
    state: directory
    owner: root
    group: root
    mode: 0755
    recurse: yes
  with_items:
    - "{{ kube_config_dir }}/addons/etcdkeeper"
  when:
    - inventory_hostname == groups['kube_control_plane'][0]

- name: Etcdkeeper | Create manifests
  template: 
    src: "{{ item }}.yml.j2" 
    dest: "{{ kube_config_dir }}/addons/etcdkeeper/{{ item }}.yml"
  vars:
    etcdkeeper_cacert: "{{ hostvars[groups['etcd'][0]].etcdkeeper_cacert_file.content | b64decode  | regex_replace('\n', '\n    ') }}"
    etcdkeeper_cert: "{{ hostvars[groups['etcd'][0]].etcdkeeper_cert_file.content | b64decode  | regex_replace('\n', '\n    ') }}"
    etcdkeeper_key: "{{ hostvars[groups['etcd'][0]].etcdkeeper_key_file.content | b64decode  | regex_replace('\n', '\n    ') }}"
  with_items:
    - etcdkeeper_ns
    - etcdkeeper_cm
    - etcdkeeper_deploy
    - etcdkeeper_svc
  register: etcdkeeper_manifests
  when:
    - inventory_hostname == groups['kube_control_plane'][0]

- block:

- name: Etcdkeeper | get remote ca file contents

slurp:

src: "{{ etcdkeeper_cacert_file }}"

- name: Etcdkeeper | get remote cert file contents

slurp:

src: "{{ etcdkeeper_cert_file }}"

- name: Etcdkeeper | get remote key file contents

slurp:

src: "{{ etcdkeeper_key_file }}"

when:

- inventory_hostname == groups['etcd'][0]

- name: Etcdkeeper | Create addon dir

file:

path: "{{ item }}"

state: directory

owner: root

group: root

mode: 0755

recurse: yes

with_items:

- "{{ kube_config_dir }}/addons/etcdkeeper"

when:

- inventory_hostname == groups['kube_control_plane'][0]

- name: Etcdkeeper | Create manifests

template:

src: "{{ item }}.yml.j2"

dest: "{{ kube_config_dir }}/addons/etcdkeeper/{{ item }}.yml"

vars:

etcdkeeper_cacert: "{{ hostvars[groups['etcd'][0]].etcdkeeper_cacert_file.content | b64decode | regex_replace('\n', '\n ') }}"

etcdkeeper_cert: "{{ hostvars[groups['etcd'][0]].etcdkeeper_cert_file.content | b64decode | regex_replace('\n', '\n ') }}"

etcdkeeper_key: "{{ hostvars[groups['etcd'][0]].etcdkeeper_key_file.content | b64decode | regex_replace('\n', '\n ') }}"

with_items:

- etcdkeeper_ns

- etcdkeeper_cm

- etcdkeeper_deploy

- etcdkeeper_svc

when:

- inventory_hostname == groups['kube_control_plane'][0]

结果换行符都保留了下来, 格式正确.

By sean, 3 years11/07/2021 ago

KUBERNETES

Kubernetes高可用性的考虑

Kubernetes高可用性的考虑高可用性考虑因素本文档包含了社区提供的关于设置高可用性Kubernetes集群的注意事项。如果有什么地方不完整、不清楚或者需要更多的信息，请随时留言。概述当创建生产集群时，高可用性是必须的（集群在某些控制平面或工作节点失效时仍能保持运行的能力）。对于工作节点，假设有足够多的节点。也要在规划和设置集群时，需要考虑到控制平面节点和etcd实例的冗余。 kubeadm支持设置多个控制平面和多etcd集群。但仍有一些方面需要考虑和设置，这些方面并不是Kubernetes本身的一部分，因此项目文档中没有涉及。本文档提供了一些额外的信息和例子，在用kubeadm规划和引导HA集群时很有用。软件负载均衡的选项当创建一个具有多个控制平面的集群时，可以将API Server实例放在负载均衡后面，可以在运行kubeadm init时使用–control-plane-endpoint选项让新集群使用它来实现更高的可用性。当然，负载均衡器本身也应该是高度可用的。这通常是通过给负载均衡器增加冗余来实现的。为此，设置一个管理虚拟IP的主机集群，每台主机运行一个负载均衡器的实例，这样在其他主机处于待机状态时，总是使用当前持有vIP的主机上的负载均衡器。在某些环境中，例如在具有专用负载均衡组件（例如由某些云提供商提供）的数据中心中，该功能可能已经可用。如果没有，可以使用用户管理的负载均衡。在这种情况下，在启动集群之前需要做一些准备工作。由于这不是Kubernetes或kubeadm的一部分，所以必须单独处理。在下面的章节中，我们给出了一些例子，当然也有可能是其他几十种可能的配置。 keepalived 和 haproxy 对于从虚拟IP提供负载均衡，keepalived和haproxy的组合已经存在了很长时间，可以说是众所周知、久经考验。 keepalived提供了一个由可配置的健康检查管理的虚拟IP。由于虚拟IP的实施方式，协商虚拟IP的所有主机必须在同一IP子网中。 haproxy服务可以配置为简单的基于流的负载平衡，从而允许TLS终止由其后面的API服务器实例处理。这种组合既可以作为操作系统上的服务运行，也可以作为控制平面主机上的静态Pods运行。两种情况下的服务配置是相同的。 keepalived配置 keepalived配置由两个文件组成：服务配置文件和健康检查脚本，该脚本将定期被调用，以验证持有虚拟IP的节点是否仍在运行。这些文件位于/etc/keepalived目录中。但请注意，有些 Linux 发行版可能会把它们放在其他地方。下面的配置已经成功地用于keepalived1.3.5版本。

! /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
    router_id LVS_DEVEL
}
vrrp_script check_apiserver {
  script "/etc/keepalived/check_apiserver.sh"
  interval 3
  weight -2
  fall 10
  rise 2
}

vrrp_instance VI_1 {
    state ${STATE}
    interface ${INTERFACE}
    virtual_router_id ${ROUTER_ID}
    priority ${PRIORITY}
    authentication {
        auth_type PASS
        auth_pass ${AUTH_PASS}
    }
    virtual_ipaddress {
        ${APISERVER_VIP}
    }
    track_script {
        check_apiserver
    }
}

! /etc/keepalived/keepalived.conf

! Configuration File for keepalived

global_defs {

router_id LVS_DEVEL

}

vrrp_script check_apiserver {

script "/etc/keepalived/check_apiserver.sh"

interval 3

weight -2

fall 10

rise 2

}

vrrp_instance VI_1 {

state ${STATE}

interface ${INTERFACE}

virtual_router_id ${ROUTER_ID}

priority ${PRIORITY}

authentication {

auth_type PASS

auth_pass ${AUTH_PASS}

}

virtual_ipaddress {

${APISERVER_VIP}

}

track_script {

check_apiserver

}

bash变量样式中有一些占位符需要填写： ${STATE}设置一个主机是MASTER，其他主机是BACKUP，因此虚拟IP最初将分配给MASTER。 ${INTERFACE}是参与协商虚拟IP的网络接口，例如eth0。 ${ROUTER_ID}对于所有keepalived集群主机来说，应该是相同的，同时在同一子网的所有集群中是唯一的。许多发行版将其值预先配置为51。 ${PRIORITY} master上的优先级应高于backups。因此，101和100就足够了。 ${AUTH_PASS} 对所有keepalived集群主机而言，应该是相同的，例如42。 ${APISERVER_VIP}是keepalived集群主机之间协商的虚拟IP地址。上面的 keepalived 配置使用了一个健康检查脚本/etc/keepalived/check_apiserver.sh，负责确保在持有虚拟IP的节点上，API服务器是可用的。这个脚本可以是这样的。

#!/bin/sh

errorExit() {
    echo "*** $*" 1>&2
    exit 1
}

curl --silent --max-time 2 --insecure https://localhost:${APISERVER_DEST_PORT}/ -o /dev/null || errorExit "Error GET https://localhost:${APISERVER_DEST_PORT}/"
if ip addr | grep -q ${APISERVER_VIP}; then
    curl --silent --max-time 2 --insecure https://${APISERVER_VIP}:${APISERVER_DEST_PORT}/ -o /dev/null || errorExit "Error GET https://${APISERVER_VIP}:${APISERVER_DEST_PORT}/"
fi

#!/bin/sh

errorExit() {

echo "*** $*" 1>&2

exit 1

}

curl --silent --max-time 2 --insecure https://localhost:${APISERVER_DEST_PORT}/ -o /dev/null || errorExit "Error GET https://localhost:${APISERVER_DEST_PORT}/"

if ip addr | grep -q ${APISERVER_VIP}; then

curl --silent --max-time 2 --insecure https://${APISERVER_VIP}:${APISERVER_DEST_PORT}/ -o /dev/null || errorExit "Error GET https://${APISERVER_VIP}:${APISERVER_DEST_PORT}/"

bash变量样式中有一些占位符需要填写： ${APISERVER_VIP}是keepalived集群主机之间协商的虚拟IP地址。 ${APISERVER_DEST_PORT} Kubernetes与API服务器对话的端口。 haproxy配置 haproxy配置由一个文件组成：服务配置文件，它在/etc/haproxy目录中。但请注意，有些Linux发行版可能会把它们放在其他地方。以下配置已经成功地用于haproxy2.1.4版本

# /etc/haproxy/haproxy.cfg
#---------------------------------------------------------------------
# Global settings
#---------------------------------------------------------------------
global
    log /dev/log local0
    log /dev/log local1 notice
    daemon

#---------------------------------------------------------------------
# common defaults that all the 'listen' and 'backend' sections will
# use if not designated in their block
#---------------------------------------------------------------------
defaults
    mode                    http
    log                     global
    option                  httplog
    option                  dontlognull
    option http-server-close
    option forwardfor       except 127.0.0.0/8
    option                  redispatch
    retries                 1
    timeout http-request    10s
    timeout queue           20s
    timeout connect         5s
    timeout client          20s
    timeout server          20s
    timeout http-keep-alive 10s
    timeout check           10s

#---------------------------------------------------------------------
# apiserver frontend which proxys to the masters
#---------------------------------------------------------------------
frontend apiserver
    bind *:${APISERVER_DEST_PORT}
    mode tcp
    option tcplog
    default_backend apiserver

#---------------------------------------------------------------------
# round robin balancing for apiserver
#---------------------------------------------------------------------
backend apiserver
    option httpchk GET /healthz
    http-check expect status 200
    mode tcp
    option ssl-hello-chk
    balance     roundrobin
        server ${HOST1_ID} ${HOST1_ADDRESS}:${APISERVER_SRC_PORT} check
        # [...]

# /etc/haproxy/haproxy.cfg

#---------------------------------------------------------------------

# Global settings

#---------------------------------------------------------------------

global

log /dev/log local0

log /dev/log local1 notice

daemon

#---------------------------------------------------------------------

# common defaults that all the 'listen' and 'backend' sections will

# use if not designated in their block

#---------------------------------------------------------------------

defaults

mode http

log global

option httplog

option dontlognull

option http-server-close

option forwardfor except 127.0.0.0/8

option redispatch

retries 1

timeout http-request 10s

timeout queue 20s

timeout connect 5s

timeout client 20s

timeout server 20s

timeout http-keep-alive 10s

timeout check 10s

#---------------------------------------------------------------------

# apiserver frontend which proxys to the masters

#---------------------------------------------------------------------

frontend apiserver

bind *:${APISERVER_DEST_PORT}

mode tcp

option tcplog

default_backend apiserver

#---------------------------------------------------------------------

# round robin balancing for apiserver

#---------------------------------------------------------------------

backend apiserver

option httpchk GET /healthz

http-check expect status 200

mode tcp

option ssl-hello-chk

balance roundrobin

server ${HOST1_ID} ${HOST1_ADDRESS}:${APISERVER_SRC_PORT} check

# [...]

同样，在bash变量样式中有一些占位符需要替换： ${APISERVER_DEST_PORT} Kubernetes与API服务器对话的端口。 ${APISERVER_SRC_PORT} API服务器实例使用的端口。 ${HOST1_ID}第一个负载均衡的API服务器主机的符号名称。 ${HOST1_ADDRESS}第一个负载均衡API服务器主机的可解析地址（DNS名、IP地址）。 Read more…

By sean, 3 years11/06/2021 ago

KUBERNETES

使用kube-vip做kubespray的apiserver的HA

使用kubespray搭建k8s集群, 如果没有外部LB做高可用的话, 对于node节点, kubespray默认为通过选择nginx或haproxy做apiserver的HA, 在master节点上, 是用127.0.0.1:6443来访问本机的apiserver, 而且程序调用apiserver时也没有做HA, 传统HA方式会搭建keepalived和haproxy, 本次是通过kube-vip来做HA 这是kube-vip官方对于ha的架构文档: https://github.com/kube-vip/kube-vip/blob/main/kubernetes-control-plane.md https://kube-vip.io/architecture/ 尝试着按照官方方法来运行: https://kube-vip.io/install_static/ , 始终失败, 由于docker run –network host –rm ghcr.io/kube-vip/kube-vip:v0.3.8 manifest pod的方式生成的配置默认是用的/etc/kubernetes/admin.conf来做backend的, 但是kubespray init集群时也是用的admin.conf来做认证的, 这就陷入了死循环. 后来通过直接配置文件的方式来做成功了. 参考: https://github.com/kube-vip/kube-vip/blob/main/kubernetes-control-plane.md https://www.codeleading.com/article/58065570523/ ansible如下: 注: 其中,templates/kube-vip.yaml.j2这个文件是通过这个来生成的: docker run –network host –rm 172.20.48.169:81/yks/kube-vip:v0.3.9 sample config | sudo tee /etc/kubernetes/manifests/kube-vip.yaml kubespray定义的默认k8s apiserver监听端口为6443(变量: kube_apiserver_port), 这里kube-vip定义的vip绑定的域名是k8s.apiserver.io, Read more…

By sean, 3 years11/06/2021 ago

未分类

用sed命令进行整段替换

sed 整段插入：下面是一个xml文件 1.txt：

<?xml version="1.0" encoding="UTF-8" ?>
<ypr>
    <code>iuap-installer</code>
    <name>安装器</name>
    <type>Tools</type>
    <version>v1.0</version>
    <serialNum>20210927105443</serialNum>
    <description></description>
    <gitBranch>develop-20210924</gitBranch>
    <commitId>b26eb31</commitId>
    <osTypes>
        <osType>
            <os>centos</os>
            <arch>x86_64</arch>
        </osType>
    </osTypes>
    <actions>
        <action>
            <code>install</code>
            <tasks>
                <task>
                    <type>command</type>
                    <runner>local</runner>
                    <template></template>
                    <command>startup.sh</command>
                </task>
            </tasks>
        </action>
    </actions>
</ypr>

<?xml version="1.0" encoding="UTF-8" ?>

<ypr>

<code>iuap-installer</code>

<type>Tools</type>

<gitBranch>develop-20210924</gitBranch>

<os>centos</os>

</osType>

</osTypes>

<code>install</code>

<tasks>

<task>

<type>command</type>

<runner>local</runner>

<command>startup.sh</command>

</task>

</tasks>

</action>

</actions>

</ypr>

需求：要在匹配</actions>字段后插入如下整段内容：

dependency=`cat <<EOF
    <dependencies>
        <dependency>
          <name>Maven</name>
          <code>apache-maven</code>
          <type>Tools</type>
          <version>3.8.2</version>
          <serialNum>20210927</serialNum>
        </dependency>
    </dependencies>
EOF
`

dependency=`cat <<EOF

<name>Maven</name>

<code>apache-maven</code>

<type>Tools</type>

</dependency>

</dependencies>

EOF

方法一：

sed -e $'/<\/actions>/{;z;r/dev/stdin\n}' 1.txt <<<"$dependency"

1	sed -e $'/<\/actions>/{;z;r/dev/stdin\n}' 1.txt <<<"$dependency"

方法二：

sed -e "s@<\/actions>@&\n`echo "$dependency"|awk '{printf("%s\\\\n", $0);}'|sed -e 's/\\\n$//'`@g" 1.txt

1	sed -e "s@<\/actions>@&\n`echo "$dependency"\|awk '{printf("%s\\\\n", $0);}'\|sed -e 's/\\\n$//'`@g" 1.txt

参考： https://stackoverflow.com/questions/6684487/sed-replace-with-variable-with-multiple-lines https://www.coder.work/article/2570180

By sean, 3 years09/27/2021 ago