[kubernetes]step8-创建efk监控

梦里梦外; 2023-07-06 14:30 5阅读 0赞

创建监控

kubectl create sa dashboard-admin -n kube-system
    kubectl create clusterrolebinding dashboard-admin --clusterrole=cluster-admin --serviceaccount=kube-system:dashboard-admin
    ADMIN_SECRET=$(kubectl get secrets -n kube-system | grep dashboard-admin | awk '{print $1}')
    kubectl describe secret -n kube-system ${ADMIN_SECRET} |grep -E '^token' |awk '{print $2}'

kubectl apply -f elasticsearch.yaml

---
    apiVersion: v1
    kind: Service
    metadata:
      name: elasticsearch-api
      namespace: kube-system
      labels:
        name: elasticsearch
    spec:
      selector:
        app: es
      ports:
      - name: transport
        port: 9200
        protocol: TCP
    ---
    apiVersion: v1
    kind: Service
    metadata:
      name: elasticsearch-discovery
      namespace: kube-system
      labels:
        name: elasticsearch
    spec:
      selector:
        app: es
      ports:
      - name: transport
        port: 9300
        protocol: TCP
    ---
    apiVersion: apps/v1beta1
    kind: StatefulSet
    metadata:
      name: elasticsearch
      namespace: kube-system
      labels:
        kubernetes.io/cluster-service: "true"
    spec:
      replicas: 3
      serviceName: "elasticsearch-service"
      selector:
        matchLabels:
          app: es
      template:
        metadata:
          labels:
            app: es
        spec:
          tolerations:
          - effect: NoSchedule
            key: node-role.kubernetes.io/master
          serviceAccountName: dashboard-admin
          initContainers:
          - name: init-sysctl
            image: busybox:1.27
            command:
            - sysctl
            - -w
            - vm.max_map_count=262144
            securityContext:
              privileged: true
          containers:
          - name: elasticsearch
            image: elasticsearch:6.8.3
            #image: registry.cn-hangzhou.aliyuncs.com/imooc/elasticsearch:5.5.1
            ports:
            - containerPort: 9200
              protocol: TCP
            - containerPort: 9300
              protocol: TCP
            securityContext:
              capabilities:
                add:
                  - IPC_LOCK
                  - SYS_RESOURCE
            resources:
              limits:
                memory: 4000Mi
              requests:
                cpu: 100m
                memory: 2000Mi
            env:
              - name: "http.host"
                value: "0.0.0.0"
              - name: "network.host"
                value: "_eth0_"
              - name: "cluster.name"
                value: "docker-cluster"
              - name: "bootstrap.memory_lock"
                value: "false"
              - name: "discovery.zen.ping.unicast.hosts"
                value: "elasticsearch-discovery"
              - name: "discovery.zen.ping.unicast.hosts.resolve_timeout"
                value: "10s"
              - name: "discovery.zen.ping_timeout"
                value: "6s"
              - name: "discovery.zen.minimum_master_nodes"
                value: "2"
              - name: "discovery.zen.fd.ping_interval"
                value: "2s"
              - name: "discovery.zen.no_master_block"
                value: "write"
              - name: "gateway.expected_nodes"
                value: "2"
              - name: "gateway.expected_master_nodes"
                value: "1"
              - name: "transport.tcp.connect_timeout"
                value: "60s"
              - name: "ES_JAVA_OPTS"
                value: "-Xms2g -Xmx2g"
            livenessProbe:
              tcpSocket:
                port: transport
              initialDelaySeconds: 20
              periodSeconds: 10
            volumeMounts:
            - name: es-data
              mountPath: /data
          terminationGracePeriodSeconds: 30
          volumes:
          - name: es-data
            hostPath:
              path: /es-data

kubectl get statefulset -n kube-system

![format_png][]

kubectl apply -f log-pilot.yaml

---
    apiVersion: extensions/v1beta1
    kind: DaemonSet
    metadata:
      name: log-pilot
      namespace: kube-system
      labels:
        k8s-app: log-pilot
        kubernetes.io/cluster-service: "true"
    spec:
      template:
        metadata:
          labels:
            k8s-app: log-es
            kubernetes.io/cluster-service: "true"
            version: v1.22
        spec:
          tolerations:
          - key: node-role.kubernetes.io/master
            effect: NoSchedule
          serviceAccountName: dashboard-admin
          containers:
          - name: log-pilot
            image: registry.cn-hangzhou.aliyuncs.com/imooc/log-pilot:0.9-filebeat
            resources:
              limits:
                memory: 200Mi
              requests:
                cpu: 100m
                memory: 200Mi
            env:
              - name: "FILEBEAT_OUTPUT"
                value: "elasticsearch"
              - name: "ELASTICSEARCH_HOST"
                value: "elasticsearch-api"
              - name: "ELASTICSEARCH_PORT"
                value: "9200"
              - name: "ELASTICSEARCH_USER"
                value: "elastic"
              - name: "ELASTICSEARCH_PASSWORD"
                value: "changeme"
            volumeMounts:
            - name: sock
              mountPath: /var/run/docker.sock
            - name: root
              mountPath: /host
              readOnly: true
            - name: varlib
              mountPath: /var/lib/filebeat
            - name: varlog
              mountPath: /var/log/filebeat
            securityContext:
              capabilities:
                add:
                - SYS_ADMIN
          terminationGracePeriodSeconds: 30
          volumes:
          - name: sock
            hostPath:
              path: /var/run/docker.sock
          - name: root
            hostPath:
              path: /
          - name: varlib
            hostPath:
              path: /var/lib/filebeat
              type: DirectoryOrCreate
          - name: varlog
            hostPath:
              path: /var/log/filebeat
              type: DirectoryOrCreate

![format_png 1][]

kubectl log -f log-pilot-l2rk2 -n kube-system

![format_png 2][]

启动kibana

kubectl apply -f kibana.yaml

\[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-esXkDXzf-1582097636243)(\[kubernetes\]创建efk监控.assets/image-20200208220252883.png)\]

创建测试的deploy

---
    apiVersion: v1
    kind: Service
    metadata:
      name: kibana
      namespace: kube-system
      labels:
        component: kibana
    spec:
      selector:
        component: kibana
      ports:
      - name: http
        port: 80
        targetPort: http
    ---
    #ingress
    apiVersion: extensions/v1beta1
    kind: Ingress
    metadata:
      annotations:
        nginx.ingress.kubernetes.io/whitelist-source-range: "60.191.70.64/29, 192.168.0.0/16, 47.111.185.111, 47.97.113.64, 47.99.246.58, 47.111.170.245, 47.111.247.117, 47.99.244.221, 47.110.144.233, 47.110.144.233, 121.41.103.54, 121.40.186.211, 121.40.16.165, 121.40.16.63, 60.191.70.66 ,60.191.70.68"
      name: kibana
      namespace: kube-system
    spec:
      rules:
      - host: k8s-kibana.aircourses.com
        http:
          paths:
          - path: /
            backend:
              serviceName: kibana
              servicePort: 80
    ---
    apiVersion: apps/v1beta1
    kind: Deployment
    metadata:
      name: kibana
      namespace: kube-system
      labels:
        component: kibana
    spec:
      replicas: 1
      selector:
        matchLabels:
         component: kibana
      template:
        metadata:
            - name: aliyun_logs_catalina
              value: "stdout"
            - name: aliyun_logs_access
              value: "/usr/local/tomcat/logs/*"
            volumeMounts:
            - mountPath: /usr/local/tomcat/logs
              name: accesslogs
          imagePullSecrets:
            - name: myregistrykey
          volumes:
          - name: accesslogs
            emptyDir: { }
    ---
    #service
    apiVersion: v1
    kind: Service
    metadata:
      name: web-demo
    spec:
      ports:
      - port: 80
        protocol: TCP
        targetPort: 8080
      selector:
        app: web-demo
      type: ClusterIP
    
    ---
    #ingress
    apiVersion: extensions/v1beta1
    kind: Ingress
    metadata:
      name: web-demo
    spec:
      rules:
      - host: web.aircourses.com
        http:
          paths:
          - path: /
            backend:
              serviceName: web-demo
              servicePort: 80

查案log-pilot的日志

![format_png 3][]

看到kibana里已经有索引了

![format_png 4][]

用公司的的项目测试

![format_png 5][]

![format_png 6][]

调整后的deployment

apiVersion: apps/v1
    kind: Deployment
    metadata:
    # deployment名字 和svc 和ingress绑定没关系
      name: pre-demojob-dp
      namespace: default
    spec:
      replicas: 2
      # 在定义模板的时候必须定义labels,因为Deployment.spec.selector是必须字段,而他又必须和template.labels对应
      selector:
        matchLabels:
          app: pre-demojob
      # template里面定义的内容会应用到下面所有的副本集里面(例如depolyment下的pod),在template.spec.containers里面不能定义labels标签。可以kubectl get pods --show-labels查看
      template:
        metadata:
          labels:
            app: pre-demojob
            env: pre
        spec:
          containers:
          # containers名字 和svc 和ingress绑定没关系
          - name: pre-demojob
            image: harbor.aircourses.com/kubernetes/demojob:vversion
            #image: harbor.aircourses.com/kubernetes/wehub:v7.80
            lifecycle:
              # sleep 30用于确保原有的pod 不是全部马上退出 造成eureka上服务一个pod都没有
              postStart:
                exec:
                  command: ["/bin/sleep", "30"]
              preStop:
                exec:
                  command: ["/bin/sh", "-c", "sh /data/module/demojob/bin/start.sh stop"]
            ports:
            - name: http
              containerPort: 80
            env:
            - name: aliyun_logs_execute-pre-demojob
              value: "stdout"
            - name: aliyun_logs_docker-info-pre-demojob
              value: "/data/module/demojob/k8s-log/execute.log"
            volumeMounts:
            - mountPath: /data/module/demojob/k8s-log
              name: accesslogs
          volumes:
          - name: accesslogs
            emptyDir: { }
          imagePullSecrets:
            - name: myregistrykey

![format_png 7][]

[format_png]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9naXRlZS5jb20vamlhbWlueHUvQmxvZ0ltYWdlL3Jhdy9tYXN0ZXIvaW1nLzIwMjAwMjA4MjExMzQ4LnBuZw?x-oss-process=image/format,png
[format_png 1]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9naXRlZS5jb20vamlhbWlueHUvQmxvZ0ltYWdlL3Jhdy9tYXN0ZXIvaW1nLzIwMjAwMjA4MjExODU5LnBuZw?x-oss-process=image/format,png
[format_png 2]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9naXRlZS5jb20vamlhbWlueHUvQmxvZ0ltYWdlL3Jhdy9tYXN0ZXIvaW1nLzIwMjAwMjA4MjEyNDI3LnBuZw?x-oss-process=image/format,png
[format_png 3]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9naXRlZS5jb20vamlhbWlueHUvQmxvZ0ltYWdlL3Jhdy9tYXN0ZXIvaW1nLzIwMjAwMjA5MDA0MTEzLnBuZw?x-oss-process=image/format,png
[format_png 4]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9naXRlZS5jb20vamlhbWlueHUvQmxvZ0ltYWdlL3Jhdy9tYXN0ZXIvaW1nLzIwMjAwMjA5MDA0MjE2LnBuZw?x-oss-process=image/format,png
[format_png 5]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9naXRlZS5jb20vamlhbWlueHUvQmxvZ0ltYWdlL3Jhdy9tYXN0ZXIvaW1nLzIwMjAwMjA5MDExMzQyLnBuZw?x-oss-process=image/format,png
[format_png 6]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9naXRlZS5jb20vamlhbWlueHUvQmxvZ0ltYWdlL3Jhdy9tYXN0ZXIvaW1nLzIwMjAwMjA5MDExNDAxLnBuZw?x-oss-process=image/format,png
[format_png 7]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9naXRlZS5jb20vamlhbWlueHUvQmxvZ0ltYWdlL3Jhdy9tYXN0ZXIvaW1nLzIwMjAwMjA5MDIyNjQ0LnBuZw?x-oss-process=image/format,png