记录 k8s 的常用命令
kubectl api-resources 可以查看资源简写。常用如下:
| name | alias | apiversion | namespace | lkind |
|---|
| namespaces | ns | v1 | false | Namespace |
| deployments | deploy | apps/v1 | true | Deployment |
| ingresses | ing | networking.k8s.io/v1 | true | Ingress |
| configmaps | cm | v1 | true | ConfigMap |
| services | svc | v1 | true | Service |
| serviceaccounts | sa | v1 | true | ServiceAccount |
| nodes | no | v1 | false | Node |
| persistentvolumeclaims | pvc | v1 | true | PersistentVolumeClaim |
| persistentvolumes | pv | v1 | false | PersistentVolume |
如果你安装了 lstio 这样有自定义资源的组件，一样也会出现在这里
1
2
3
4
5
6
7
8
| # 获取实时deployment信息
kubectl get --watch deployments
# 查询所有ingressClassName
kubectl get ingressclasses
# 查询具体权限
kubectl describe ClusterRole tzedu:developer
|
1
2
3
| kubectl logs <pod-name> -c <container-name>
# 通过label查询多个容器的日志
kubectl logs -f -n kube-system -l k8s-app=calico-node
|
强制删除 pod, 其他资源同参数也可以删除.
1
| kubectl delete pod pod名称 -n 命名空间 --force --grace-period=0
|
创建这个 yaml
- 创建用户 admin-user
- 创建 clusterrolebindding，绑定权限到 cluster-admin（权限很高）
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
| apiVersion: v1
kind: ServiceAccount
metadata:
name: admin-user
namespace: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: admin-user
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: admin-user
namespace: kubernetes-dashboard
|
临时 token：
1
| kubectl -n kubernetes-dashboard create token admin-user
|
长期 token：
1
2
3
4
5
6
7
8
| apiVersion: v1
kind: Secret
metadata:
name: admin-user
namespace: kubernetes-dashboard
annotations:
kubernetes.io/service-account.name: "admin-user"
type: kubernetes.io/service-account-token
|
获取长期 token
1
| kubectl get secret admin-user -n kubernetes-dashboard -o jsonpath={".data.token"} | base64 -d
|
文档地址在 这里，来自/适用于 kubernetes/dashboard
加入到 ~/.bashrc 中，然后 source 生效
1
2
| source <(kubectl completion bash)
source <(kubeadm completion bash)
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
| apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-deployment
spec:
replicas: 1
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- name: nginx
image: nginx:latest
ports:
- containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
name: nginx-service
spec:
selector:
app: nginx
ports:
- protocol: TCP
port: 80
targetPort: 80
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: nginx-ingress
spec:
ingressClassName: nginx
rules:
- http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: nginx-service
port:
number: 80
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
| apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: 'msb_developer'
rules:
- apiGroups:
- ''
resources:
- pods
- pods/portforward
- pods/proxy
verbs:
- get
- list
- watch
- create
- delete
- apiGroups:
- ''
resources:
- pods/attach
- pods/exec
verbs:
- create
- get
- list
- watch
- apiGroups:
- ''
resources:
- configmaps
- endpoints
- persistentvolumeclaims
- replicationcontrollers
- replicationcontrollers/scale
- secrets
- serviceaccounts
- services
- services/proxy
verbs:
- get
- list
- watch
- apiGroups:
- ''
resources:
- events
- namespaces/status
- replicationcontrollers/status
- pods/log
- pods/status
- componentstatuses
verbs:
- get
- list
- watch
- apiGroups:
- ''
resources:
- namespaces
verbs:
- get
- list
- watch
- apiGroups:
- apps
resources:
- daemonsets
- deployments
- deployments/rollback
- deployments/scale
- replicasets
- replicasets/scale
- statefulsets
verbs:
- get
- list
- watch
- patch
- apiGroups:
- autoscaling
resources:
- horizontalpodautoscalers
verbs:
- get
- list
- watch
- apiGroups:
- batch
resources:
- cronjobs
- jobs
verbs:
- get
- list
- watch
- apiGroups:
- extensions
resources:
- daemonsets
- deployments
- deployments/rollback
- deployments/scale
- ingresses
- replicasets
- replicasets/scale
- replicationcontrollers/scale
verbs:
- get
- list
- watch
- apiGroups:
- networking.k8s.io
resources:
- '*'
verbs:
- get
- list
- watch
- apiGroups:
- servicecatalog.k8s.io
resources:
- clusterserviceclasses
- clusterserviceplans
- clusterservicebrokers
- serviceinstances
- servicebindings
verbs:
- get
- list
- watch
- apiGroups:
- alicloud.com
resources:
- '*'
verbs:
- get
- list
- watch
- apiGroups:
- policy
resources:
- poddisruptionbudgets
verbs:
- get
- list
- watch
- apiGroups:
- networking.istio.io
resources:
- '*'
verbs:
- get
- list
- watch
- apiGroups:
- config.istio.io
resources:
- '*'
verbs:
- get
- list
- watch
- apiGroups:
- rbac.istio.io
resources:
- '*'
verbs:
- get
- list
- watch
- apiGroups:
- istio.alibabacloud.com
resources:
- '*'
verbs:
- get
- list
- watch
- apiGroups:
- authentication.istio.io
resources:
- '*'
verbs:
- get
- list
- watch
- apiGroups:
- log.alibabacloud.com
resources:
- '*'
verbs:
- get
- list
- watch
- apiGroups:
- monitoring.kiali.io
resources:
- '*'
verbs:
- get
- list
- watch
- apiGroups:
- eventing.knative.dev
resources:
- '*'
verbs:
- get
- list
- watch
|