k8s集群之Pod镜像管理+私有仓库harbor搭建

本是古典何须时尚 2023-03-13 11:34 43阅读 0赞

### 文章目录 ###

*   *  一、pod的容器分类
     *   *  1.1、Pod 特点
         *  1.2、Pod的容器分类
     *  二、镜像拉取策略 (image PullPolicy)
     *   *  2.1、尝试编辑一个pod并指定拉取策略
     *  三、搭建 k8s 的私有仓库

## 一、pod的容器分类 ##

### 1.1、Pod 特点 ###

*  最小部署单元
 *  一组容器的集合
 *  一个Pod中的容器共享网络命名空间
 *  Pod是短暂的，有自己的生命周期。

### 1.2、Pod的容器分类 ###

1、infrastructure container：基础容器  
维护整个pod网络空间：可以在node节点操作查看容器的网络

[root@localhost ~]# cat /opt/kubernetes/cfg/kubelet

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzYxNTQx_size_16_color_FFFFFF_t_70]  
2、initcontainers：初始化容器

*  先于业务容器开始执行，原先pod中容器是并行开启，现在进行了改进

3、container：业务容器

*  业务容器就是我们创建的pod资源内的容器服务，业务容器也叫APP容器，并行启动

## 二、镜像拉取策略 (image PullPolicy) ##

*  **IfNotPresent：默认值，镜像在宿主机上不存在时才拉取。**
 *  **Always：每次创建Pod都会重新拉取一次镜像，可以保证都是最新版本镜像。**
 *  **Never：Pod 永远不会主动拉取这个镜像**

查看镜像拉取策略（master节点查看）：

[root@master1 demo]# kubectl get pod
    NAME                              READY   STATUS    RESTARTS   AGE
    nginx-deployment-d55b94fd-hbnkr   0/1     Pending   0          2m52s
    nginx-deployment-d55b94fd-qdj27   0/1     Pending   0          2m51s
    nginx-deployment-d55b94fd-x5zd7   0/1     Pending   0          2m52s
    
    [root@master1 demo]# kubectl edit deploy/nginx-deployment     #编辑Pod资源查看策略

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzYxNTQx_size_16_color_FFFFFF_t_70 1]

### 2.1、尝试编辑一个pod并指定拉取策略 ###

[root@localhost ~]# cd demo/
    [root@localhost demo]# vim pod1.yaml
    apiVersion: v1
    kind: Pod
    metadata:
      name: mypod
    spec:
      containers:
        - name: nginx
          image: nginx:1.14
          imagePullPolicy: Always

[root@master1 demo]# kubectl create -f pod1.yaml
    pod/mypod created
    
    [root@master1 demo]# kubectl get pod
    NAME    READY   STATUS    RESTARTS   AGE
    mypod   1/1     Running   0          52s

查看容器详细信息：kubectl describe pod 名称  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzYxNTQx_size_16_color_FFFFFF_t_70 2]  
//查看分配节点

[root@localhost demo]# kubectl get pods -o wide
    NAME                READY  STATUS   RESTARTS  AGE   IP       NODE        NOMINATED NODE
    
    mypod               1/1   Running  0      118s  172.17.31.6  192.168.195.150  <none>

//在任意node节点使用 curl 查看头部信息

[root@node2 ~]# curl -I 172.17.57.3     
    HTTP/1.1 200 OK
    Server: nginx/1.14.2
    Date: Wed, 13 May 2020 02:12:07 GMT
    Content-Type: text/html
    Content-Length: 612
    Last-Modified: Tue, 04 Dec 2018 14:44:49 GMT
    Connection: keep-alive
    ETag: "5c0692e1-264"
    Accept-Ranges: bytes

## 三、搭建 k8s 的私有仓库 ##

1、开局优化，修改主机名（harbor），关闭防火墙，上传docker-compose和harbor的软件包（操作不在赘述），私有仓库的IP地址为：192.168.100.134

2、docker 和 docker-compose 安装，可以看我之前的博客。  
博客链接：[Docker之入门初了解、部署与镜像加速、网络优化][Docker]

3、 安装harbor

[root@harbor ~]# tar zxf harbor-offline-installer-v1.2.2.tgz -C /usr/local/	
    [root@harbor ~]# cd /usr/local/harbor/
    [root@harbor harbor]# ls

![在这里插入图片描述][20200513104344718.png]  
修改harbor的参数文件harbor.cfg

[root@harbor harbor]# vi harbor.cfg 
    hostname = 192.168.100.134     ##修改为监听本地地址，不可以使用localhost或者127.0.0.1
    [root@harbor harbor]# sh install.sh

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzYxNTQx_size_16_color_FFFFFF_t_70 3]  
到这里，harbor安装已经完成

4、登录harbor界面，在浏览器输入192.168.100.134，新建私有项目project  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzYxNTQx_size_16_color_FFFFFF_t_70 4]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzYxNTQx_size_16_color_FFFFFF_t_70 5]  
5、所有node节点都要修改daemon-json文件，指定harbor仓库地址，修改完文件后记得重启Docker

[root@node1 ~]# vim /etc/docker/daemon.json

![在这里插入图片描述][2020051310560426.png]

[root@node1 ~]# systemctl daemon-reload
    [root@node1 ~]# systemctl restart docker

注意：在使用harbor下载镜像创建资源时候，要保证node处于harbor登录状态  
//其中一个node节点登录harbor私有仓库

[root@node1 ~]# docker login 192.168.100.134
    Username: admin
    Password: 
    WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
    Configure a credential helper to remove this warning. See
    https://docs.docker.com/engine/reference/commandline/login/#credentials-store
    
    Login Succeeded

//下载Tomcat镜像进行推送
    [root@node1 ~]# docker pull tomcat:8.0.52
    
    //打标签
    [root@node1 ~]# docker tag tomcat:8.0.52 192.168.100.134/project/tomcat
    此处IP地址是harbor地址
    
    //上传镜像到仓库
    [root@node1 ~]# docker push 192.168.100.134/project/tomcat

6、指定node节点从私有仓库下载

*  查看node节点登录harbor的凭据（所有node节点的凭据是一样的）

[root@node1 ~]# cat .docker/config.json |base64 -w 0
    ewoJImF1dGhzIjogewoJCSIxOTIuMTY4LjEwMC4xMzQiOiB7CgkJCSJhdXRoIjogIllXUnRhVzQ2U0dGeVltOXlNVEl6TkRVPSIKCQl9Cgl9LAoJIkh0dHBIZWFkZXJzIjogewoJCSJVc2VyLUFnZW50IjogIkRvY2tlci1DbGllbnQvMTkuMDMuOCAobGludXgpIgoJfQp9

*  在master节点创建secret资源

[root@master1 demo]# vim registry-pull-secret.yaml
    apiVersion: v1
    kind: Secret
    metadata:
      name: registry-pull-secret
    data:
      .dockerconfigjson: ewoJImF1dGhzIjogewoJCSIxOTIuMTY4LjEwMC4xMzQiOiB7CgkJCSJhdXRoIjogIllXUnRhVzQ2U0dGeVltOXlNVEl6TkRVPSIKCQl9Cgl9LAoJIkh0dHBIZWFkZXJzIjogewoJCSJVc2VyLUFnZW50IjogIkRvY2tlci1DbGllbnQvMTkuMDMuOCAobGludXgpIgoJfQp9
    type: kubernetes.io/dockerconfigjson
    
    //创建secret资源
    [root@master test]# kubectl create -f registry-pull-secret.yaml 	   
    secret/registry-pull-secret created
    
    //查看secret资源
    [root@master1 demo]# kubectl get secret
    NAME                   TYPE                                  DATA   AGE
    default-token-9qgnr    kubernetes.io/service-account-token   3      13d
    registry-pull-secret   kubernetes.io/dockerconfigjson        1      50s

在master节点上创建资源从harbor中下载镜像

[root@localhost demo]# vim tomcat-deployment.yaml
    apiVersion: extensions/v1beta1
    kind: Deployment
    metadata:
      name: my-tomcat
    spec:
      replicas: 2
      template:
        metadata:
          labels:
            app: my-tomcat
        spec:
          imagePullSecrets:
          - name: registry-pull-secret
          containers:
          - name: my-tomcat
            image: 192.168.195.80/project/tomcat
            ports:
            - containerPort: 80
    ---
    apiVersion: v1
    kind: Service
    metadata:
      name: my-tomcat
    spec:
      type: NodePort
      ports:
      - port: 8080
        targetPort: 8080
        nodePort: 31111
      selector:
        app: my-tomcat

创建资源并查看

[root@master1 demo]# kubectl create -f tomcat-deployment.yaml 
    
    [root@master1 demo]# kubectl get pod
    NAME                         READY   STATUS    RESTARTS   AGE
    my-tomcat-7d697d459b-5g6zw   1/1     Running   0          33s
    my-tomcat-7d697d459b-9wgd2   1/1     Running   0          33s
    mypod                        1/1     Running   1          92m

此时查看harbor镜像仓库，发现镜像被下载了两次。  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzYxNTQx_size_16_color_FFFFFF_t_70 6]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzYxNTQx_size_16_color_FFFFFF_t_70]: /images/20230312/c214c34790d246a39c43d670e0927fef.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzYxNTQx_size_16_color_FFFFFF_t_70 1]: /images/20230312/1439d24bd7984df3959260deddd29989.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzYxNTQx_size_16_color_FFFFFF_t_70 2]: /images/20230312/1da96f81c16b4ad58fb78dcfa2fcaa0f.png
[Docker]: https://blog.csdn.net/qq_28361541/article/details/105387355
[20200513104344718.png]: https://img-blog.csdnimg.cn/20200513104344718.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzYxNTQx_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/20200513104732864.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzYxNTQx,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzYxNTQx_size_16_color_FFFFFF_t_70 4]: https://img-blog.csdnimg.cn/20200513105155542.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzYxNTQx,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzYxNTQx_size_16_color_FFFFFF_t_70 5]: https://img-blog.csdnimg.cn/20200513105408383.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzYxNTQx,size_16,color_FFFFFF,t_70
[2020051310560426.png]: https://img-blog.csdnimg.cn/2020051310560426.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzYxNTQx_size_16_color_FFFFFF_t_70 6]: https://img-blog.csdnimg.cn/20200513113003129.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzYxNTQx,size_16,color_FFFFFF,t_70