怎么编辑kubernetes的yaml文件以及kubernetes的控制是什么样的？

应该使用哪个 Group 和 Version?

日常使用的过程中我们经常碰到使用 YAML 定义 deployment等资源文件时， 经常弄不清楚资源的版本以及资源使用的组等信息， 如apiVersion: rbac.authorization.k8s.io/v1beta1 。

那么我们到底应该使用哪一个呢？哪一个才是正确的呢？如何检查Kubernetes集群支持哪些？其实我们使用kubectl工具就可以来解决我们的这些疑惑。

01.获取kubernetes支持API resource

我们使用如下指令获取当前版本的kubernetes支持哪些KIND， 属于哪个APIGROUP以及每个KIND支持哪些方法。

$  kubectl api-resources -o wide
NAME                              SHORTNAMES   APIGROUP                       NAMESPACED   KIND                             VERBS
selfsubjectaccessreviews                       authorization.k8s.io           false        SelfSubjectAccessReview          [create]
selfsubjectrulesreviews                        authorization.k8s.io           false        SelfSubjectRulesReview           [create]
subjectaccessreviews                           authorization.k8s.io           false        SubjectAccessReview              [create]
horizontalpodautoscalers          hpa          autoscaling                    true         HorizontalPodAutoscaler          [create delete deletecollection get list patch update watch]
cronjobs                          cj           batch                          true         CronJob                          [create delete deletecollection get list patch update watch]
jobs                                           batch                          true         Job                              [create delete deletecollection get list patch update watch]
certificatesigningrequests        csr          certificates.k8s.io            false        CertificateSigningRequest        [create delete deletecollection get list patch update watch]
leases                                         coordination.k8s.io            true         Lease                            [create delete deletecollection get list patch update watch]
endpointslices                                 discovery.k8s.io               true         EndpointSlice                    [create delete deletecollection get list patch update watch]
events                            ev           events.k8s.io                  true         Event                            [create delete deletecollection get list patch update watch]
ingresses                         ing          extensions                     true         Ingress                          [create delete deletecollection get list patch update watch]
ingressclasses                                 networking.k8s.io              false        IngressClass                     [create delete deletecollection get list patch update watch]
ingresses                         ing          networking.k8s.io              true         Ingress                          [create delete deletecollection get list patch update watch]
networkpolicies                   netpol       networking.k8s.io              true         NetworkPolicy                    [create delete deletecollection get list patch update watch]
runtimeclasses                                 node.k8s.io                    false        RuntimeClass                     [create delete deletecollection get list patch update watch]
poddisruptionbudgets              pdb          policy                         true         PodDisruptionBudget              [create delete deletecollection get list patch update watch]
podsecuritypolicies               psp          policy                         false        PodSecurityPolicy                [create delete deletecollection get list patch update watch]
clusterrolebindings                            rbac.authorization.k8s.io      false        ClusterRoleBinding               [create delete deletecollection get list patch update watch]
clusterroles                                   rbac.authorization.k8s.io      false        ClusterRole                      [create delete deletecollection get list patch update watch]
rolebindings                                   rbac.authorization.k8s.io      true         RoleBinding                      [create delete deletecollection get list patch update watch]
roles                                          rbac.authorization.k8s.io      true         Role                             [create delete deletecollection get list patch update watch]
priorityclasses                   pc           scheduling.k8s.io              false        PriorityClass                    [create delete deletecollection get list patch update watch]
csidrivers                                     storage.k8s.io                 false        CSIDriver                        [create delete deletecollection get list patch update watch]
..........

上面的命令输出了很多有用的信息：

  • SHORTNAMES - 资源名称的简写，比如 deployments 简写就是 deploy，我们可以将这些快捷方式与kubectl一起使用

  • APIGROUP - 我们可以查看官方文档以了解更多信息，但简而言之，您将在yaml文件中使用它像apiVersion：/v1

  • KIND - 资源名称

  • VERBS - 可用的方法，在您想要定义ClusterRole RBAC规则时也很有用，您还可以选择获取特定 API 组的 API 资源，例如：

$ kubectl api-resources --api-group apps -o wide
NAME                  SHORTNAMES   APIGROUP   NAMESPACED   KIND                 VERBS
controllerrevisions                apps       true         ControllerRevision   [create delete deletecollection get list patch update watch]
daemonsets            ds           apps       true         DaemonSet            [create delete deletecollection get list patch update watch]
deployments           deploy       apps       true         Deployment           [create delete deletecollection get list patch update watch]
replicasets           rs           apps       true         ReplicaSet           [create delete deletecollection get list patch update watch]
statefulsets          sts          apps       true         StatefulSet

对于上面的每种资源类型，我们都可以使用kubectl explain命令来获取有关的资源详细息：

$ kubectl explain configmap
DESCRIPTION:
ConfigMap holds configuration data for pods to consume.

FIELDS:
   apiVersion   <string>
     APIVersion defines the versioned schema of this representation of an
     object. Servers should convert recognized schemas to the latest internal
     value, and may reject unrecognized values. More info:
     https://git.k8s.io/community/contributors/devel/api-conventions.md#resources

   data <object>
     Data contains the configuration data. Each key must consist of alphanumeric
     characters, '-', '_' or '.'.

   kind <string>
     Kind is a string value representing the REST resource this object
     represents. Servers may infer this from the endpoint the client submits
     requests to. Cannot be updated. In CamelCase. More info:
     https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds

   metadata <Object>
     Standard object's metadata. More info:
     https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata

kubectl explain命令非常有用，特别是在我们 不知道该如何编写YAML文件的时候，就可以使用改命令来帮助我们获得更多提示信息 。

需要注意的是explain命令可能会显示旧的group/version，我们可以通过--api-version参数显示设置它，比如： 请注意，explain可能会显示旧组/版本，但您可以使用–api-version显式设置它，例如：

$ kubectl explain replicaset --api-version apps/v1

02.获取支持的API VERSION

上节最后说到我们在查看资源的explain时可能并不知道集群支持的版本， 可以使用如下指令获取当前集群支持的 API 版本。

$ kubectl api-versions
admissionregistration.k8s.io/v1
admissionregistration.k8s.io/v1beta1
apiextensions.k8s.io/v1
apiextensions.k8s.io/v1beta1
apiregistration.k8s.io/v1
apiregistration.k8s.io/v1beta1
apps/v1
authentication.k8s.io/v1
authentication.k8s.io/v1beta1
authorization.k8s.io/v1
authorization.k8s.io/v1beta1
autoscaling/v1
autoscaling/v2beta1
autoscaling/v2beta2
batch/v1
batch/v1beta1
certificates.k8s.io/v1beta1
coordination.k8s.io/v1
coordination.k8s.io/v1beta1
discovery.k8s.io/v1beta1
events.k8s.io/v1beta1
extensions/v1beta1
networking.k8s.io/v1
networking.k8s.io/v1beta1
node.k8s.io/v1beta1
policy/v1beta1
rbac.authorization.k8s.io/v1
rbac.authorization.k8s.io/v1beta1
scheduling.k8s.io/v1
scheduling.k8s.io/v1beta1
storage.k8s.io/v1
storage.k8s.io/v1beta1
v1

03.kubernetes REST path的构成

kubernetes 为了提供更好的扩展性所以才有了Apigroup的概念， 它是如何对外提供rest接口的呢？

目前使用的apigroup:

  • 核心组， 对应的ApiVersion: v1对应的rest path为/api/v1

  • 其它的group的rest path为/apis/$GROUP_NAME/$VERSION, 对应的 apiVersion:$GROUP_NAME/$VERSION (e.g. apiVersion: batch/v1)

04.启用/关闭 apigroup

默认情况下有一些apigroup是启用状态， 可以在apiserver中指定--runtime-config参数启用/关闭apigroup。

  • 关闭 batch/v1 ， 设置--runtime-config=batch/v1=false

  • 启用 batch/v2alpha1 , 设置--runtime-config=batch/v2alpha1

05.详细的使用方法可以参考授权 RBAC部分

传送门 010502.实践二部分内容

上一页TLS bootstrapping 是如何工作的？下一页deployment如何使用不同的策略部署我们的程序？

最后更新于