Repository navigation
Expand file tree
/
Copy pathindex.html
More file actions
922 lines (629 loc) · 122 KB
/
Copy pathindex.html
File metadata and controls
922 lines (629 loc) · 122 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
<meta name="theme-color" content="#33363b">
<meta name="msapplication-TileColor" content="#33363b">
<meta name="keywords" content="Life, ARIA, Hexo, docker, linux, kubernetes, Nginx, tomcat, Jenkins">
<link rel="apple-touch-icon" sizes="180x180" href="/favicons/apple-touch-icon.png">
<link rel="icon" type="image/png" sizes="192x192" href="/favicons/android-chrome-192x192.png">
<link rel="icon" type="image/png" sizes="32x32" href="/favicons/favicon-32x32.png">
<link rel="icon" type="image/png" sizes="16x16" href="/favicons/favicon-16x16.png">
<link rel="mask-icon" href="/favicons/safari-pinned-tab.svg" color="#33363b">
<link rel="manifest" href="/favicons/site.webmanifest">
<meta name="msapplication-config" content="/favicons/browserconfig.xml">
<link rel="alternate" href="/atom.xml" title="Wang'T博客" type="application/atom+xml" />
<link rel="shortcut icon" type="image/x-icon" href="/favicons/favicon.ico">
<link rel="stylesheet" type="text/css" href="//fonts.googleapis.com/css?family=Lato|Roboto+Condensed|Skranji|Ubuntu|Ubuntu+Mono">
<link rel="stylesheet" type="text/css" href="/css/normalize.css">
<link rel="stylesheet" type="text/css" href="/css/index.css">
<link rel="stylesheet" type="text/css" href="/css/sidebar.css">
<link rel="stylesheet" type="text/css" href="/css/page.css">
<link rel="stylesheet" type="text/css" href="/css/post.css">
<link rel="stylesheet" type="text/css" href="/css/custom.css">
<link rel="stylesheet" type="text/css" href="/css/solarized-dark.css">
<link rel="stylesheet" type="text/css" href="/css/lightgallery.min.css">
<script type="text/javascript" src="/js/jquery.min.js"></script>
<script defer type="text/javascript" src="/js/util.js"></script>
<script defer type="text/javascript" src="/js/scrollspy.js"></script>
<script defer type="text/javascript" src="/js/fontawesome-all.min.js"></script>
<script defer type="text/javascript" src="/js/lightgallery.min.js"></script>
<script defer type="text/javascript" src="/js/lg-fullscreen.min.js"></script>
<script defer type="text/javascript" src="/js/lg-hash.min.js"></script>
<script defer type="text/javascript" src="/js/lg-pager.min.js"></script>
<script defer type="text/javascript" src="/js/lg-thumbnail.min.js"></script>
<script defer type="text/javascript" src="/js/lg-zoom.min.js"></script>
<script defer src="/js/busuanzi.pure.mini.js"></script>
<script defer type="text/javascript" src="/js/search.js"></script>
<script type="text/javascript">
$(document).ready(function () {
var searchPath = "search.xml";
if (searchPath.length === 0) {
searchPath = "search.xml";
}
var path = "/" + searchPath;
searchFunc(path, "search-input", "search-result");
});
</script>
<script defer type="text/javascript" src="/js/index.js"></script>
<script defer type="text/javascript" src="/js/custom.js"></script>
<title>Wang'T博客 - _入网络深似海,从此节操是路人.</title>
</head>
<body itemscope itemtype="http://schema.org/WebPage" lang="zh_CN" data-spy="scroll" data-target=".list-group">
<header id="header" class="header" style="background: #33363b;">
<div class="container">
<div class="header-container">
<div class="header-title">
<h1 class="title"><a href="/">Wang'T博客</a></h1>
<h2 class="subtitle">_入网络深似海,从此节操是路人.</h2>
</div>
<div class="logo">
<img src="/img/logo.jpg" alt="logo">
</div>
</div>
<nav id="nav" class="nav">
<a id="nav-toggle" class="nav-toggle" aria-hidden="true"><i class="fas fa-bars" aria-label="切换导航栏"></i></a>
<ul id="menu" role="menubar" aria-hidden="false">
<li role="menuitem"><a href="/">首页</a></li>
<li role="menuitem"><a href="/archives/">归档</a></li>
<li role="menuitem"><a href="/categories/">分类</a></li>
<li role="menuitem"><a href="/tags/">标签</a></li>
<li role="menuitem"><a href="/about/">关于</a></li>
</ul>
</nav>
</div>
</header>
<main id="main" class="main">
<div class="container">
<div class="main-container">
<div class="content">
<div id="index" class="index page">
<article class="article post card animate" itemscope itemtype="http://schema.org/Article">
<div class="post-block">
<link itemprop="mainEntityOfPage" href="http://www.idcsec.com/2020/01/09/ELK日志平台索引备份,迁移及恢复-ELK7-5-1集群部署/">
<span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
<meta itemprop="name" content="Wang'T">
<meta itemprop="description" content="">
<meta itemprop="image" content="/img/avatar.jpg">
</span>
<span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
<meta itemprop="name" content="Wang'T博客">
</span>
</div>
<header class="post-header">
<h1 class="post-title" itemprop="name headline">
<a class="post-title-link post-title-link-external" href="/2020/01/09/ELK日志平台索引备份,迁移及恢复-ELK7-5-1集群部署/" itemprop="url">ELK日志平台索引备份,迁移及恢复 ELK7.5.1集群部署</a>
</h1>
<div class="post-meta">
<span class="post-date">
<i class="far fa-calendar-plus"></i><span><time title="post-date" itemprop="dateCreated datePublished" datetime="2020-01-09T22:42:00+08:00">2020-01-09 22:42:00</time></span>
</span>
<span class="post-meta-divider divider">|</span>
<span class="post-categories">
<i class="far fa-folder-open"></i><span itemprop="about" itemscope itemtype="http://schema.org/Thing"><a href="/categories/elk/" itemprop="url" rel="index"><span itemprop="name">elk</span></a></span>
</span>
<span class="post-meta-divider divider">|</span>
<span class="post-comment-count">
<i class="far fa-comments"></i><span><a href="/2020/01/09/ELK日志平台索引备份,迁移及恢复-ELK7-5-1集群部署/#disqus_thread" itemprop="discussionUrl"><span class="post-comment-count disqus-comment-count" data-disqus-identifier="2020/01/09/ELK日志平台索引备份,迁移及恢复-ELK7-5-1集群部署/" itemprop="commentCount"></span></a></span>
</span>
</div>
</header>
<main class="post-main" itemprop="articleBody">
<p>从6.7或更早版本直接升级到7.5.1需要 完全重启群集。<br><img src="/img/kibana.png" alt="kibnan"><br>
</main>
<footer class="post-footer">
<div class="post-tags">
<a class="post-tag button" href="/tags/elk-elasticsearch/" rel="tag"><i class="fas fa-tags"></i>elk,elasticsearch</a>
</div>
</footer>
</article>
<article class="article post card animate" itemscope itemtype="http://schema.org/Article">
<div class="post-block">
<link itemprop="mainEntityOfPage" href="http://www.idcsec.com/2019/07/21/python-client通过token连接k8sAPI-cluster/">
<span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
<meta itemprop="name" content="Wang'T">
<meta itemprop="description" content="">
<meta itemprop="image" content="/img/avatar.jpg">
</span>
<span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
<meta itemprop="name" content="Wang'T博客">
</span>
</div>
<header class="post-header">
<h1 class="post-title" itemprop="name headline">
<a class="post-title-link post-title-link-external" href="/2019/07/21/python-client通过token连接k8sAPI-cluster/" itemprop="url">python client通过token连接k8sAPI cluster</a>
</h1>
<div class="post-meta">
<span class="post-date">
<i class="far fa-calendar-plus"></i><span><time title="post-date" itemprop="dateCreated datePublished" datetime="2019-07-21T01:47:11+08:00">2019-07-21 01:47:11</time></span>
</span>
<span class="post-meta-divider divider">|</span>
<span class="post-comment-count">
<i class="far fa-comments"></i><span><a href="/2019/07/21/python-client通过token连接k8sAPI-cluster/#disqus_thread" itemprop="discussionUrl"><span class="post-comment-count disqus-comment-count" data-disqus-identifier="2019/07/21/python-client通过token连接k8sAPI-cluster/" itemprop="commentCount"></span></a></span>
</span>
</div>
</header>
<main class="post-main" itemprop="articleBody">
<p>1、创建一个k8s admin-user<br><figure class="hljs highlight asciidoc"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br></pre></td><td class="code"><pre><span class="line"><span class="header">kubectl apply -f - <<EOF</span><br><span class="line">---</span></span><br><span class="line">#在kube-system下创建admin-user</span><br><span class="line">apiVersion: v1</span><br><span class="line">kind: ServiceAccount</span><br><span class="line">metadata:</span><br><span class="line"><span class="code"> name: admin-user</span></span><br><span class="line"><span class="header"> namespace: kube-system</span><br><span class="line">---</span></span><br><span class="line">#给admin-user cluster-admin权限</span><br><span class="line">apiVersion: rbac.authorization.k8s.io/v1beta1</span><br><span class="line">kind: ClusterRoleBinding</span><br><span class="line">metadata:</span><br><span class="line"><span class="code"> name: admin-user</span></span><br><span class="line">roleRef:</span><br><span class="line"><span class="code"> apiGroup: rbac.authorization.k8s.io</span></span><br><span class="line"><span class="code"> kind: ClusterRole</span></span><br><span class="line"><span class="code"> name: cluster-admin</span></span><br><span class="line">subjects:</span><br><span class="line"><span class="bullet">- </span>kind: ServiceAccount</span><br><span class="line"><span class="code"> name: admin-user</span></span><br><span class="line"><span class="code"> namespace: kube-system</span></span><br><span class="line">EOF</span><br></pre></td></tr></table></figure></p>
<p>查看k8sCluster APIURL地址<br><figure class="hljs highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">kubectl config view --minify | grep server | cut <span class="operator">-f</span> <span class="number">2</span>- <span class="operator">-d</span> <span class="string">":"</span> | tr <span class="operator">-d</span> <span class="string">" "</span></span><br></pre></td></tr></table></figure></p>
<p>获取刚刚创建的admin-user token在把base64解密出来的token<br><figure class="hljs highlight handlebars"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="xml">kubectl -n kube-system get secrets admin-user-token-dpg67 -o go-template --template '</span><span class="expression">{{<span class="variable">index</span> <span class="variable">.data</span> <span class="string">"token"</span>}}</span><span class="xml">' | base64 -d</span></span><br></pre></td></tr></table></figure></p>
<p>示例<br><figure class="hljs highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br></pre></td><td class="code"><pre><span class="line">from kubernetes import client, config</span><br><span class="line"></span><br><span class="line">#see https://kubernetes.io/docs/tasks/administer-cluster/access-cluster-api/#accessing-the-cluster-api to know how to get the token</span><br><span class="line">#The command look like kubectl get secrets | grep default | cut -f1 -d ' ') | grep -E '^token' | cut -f2 -d':' | tr -d '\t' but better <span class="operator"><span class="keyword">check</span> the official doc <span class="keyword">link</span></span><br><span class="line">aToken=<span class="string">"eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuLXhsZnF3Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiI5MmEzN2JkNi1hYjg5LTExZTktODkyMi0wODAwMjdlMWY4NDYiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZS1zeXN0ZW06YWRtaW4tdXNlciJ9.GRerIItaGUf8PV8rb3eDsmP90YZCd3BGWuYhXr_y2f4zmd59rpHfP8E6xWoHQiav84Kq1b9E8tiEHC9aoPcNmmclS8AIm95DA-QHv_5WJrJPcTB-XpzF1ccPFSdJQ0hmjw54pxQo4gQLJ1MouPiwH-sWjVM1OYiEmillvglIiFfTrc24fJj1Fu2V46lsUXLPKBVrny3v6soUjteU4IDJxjHhQodpFSBbxnYVUvaK_hvthDv_IsCcY2rQ16ii4n6tTt8vf1D0NKZv4pWeXH2sRhzQ5Q3aK8VjZAd6PBd3iVMz2Gp24KWqFoqQ9-TRgwL6oIoHT3E0qEoapDzxg9jWSA"</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line"># Configs can be <span class="keyword">set</span> <span class="keyword">in</span> Configuration <span class="keyword">class</span> directly <span class="keyword">or</span> <span class="keyword">using</span> helper utility</span><br><span class="line">configuration = <span class="keyword">client</span>.Configuration()</span><br><span class="line">configuration.host=<span class="string">"https://192.168.99.100:8443"</span></span><br><span class="line">configuration.verify_ssl=<span class="literal">False</span></span><br><span class="line">configuration.debug = <span class="literal">True</span></span><br><span class="line"></span><br><span class="line">#Maybe there <span class="keyword">is</span> a way <span class="keyword">to</span> <span class="keyword">use</span> these options instead <span class="keyword">of</span> token since they <span class="keyword">are</span> provided <span class="keyword">in</span> Google cloud UI</span><br><span class="line">#configuration.username = <span class="string">"admin"</span></span><br><span class="line">#configuration.<span class="keyword">password</span> = <span class="string">"XXXXXXXXXXX"</span></span><br><span class="line">configuration.api_key={<span class="string">"authorization"</span>:<span class="string">"Bearer "</span>+ aToken}</span><br><span class="line"><span class="keyword">client</span>.Configuration.set_default(configuration)</span><br><span class="line"></span><br><span class="line">v1 = <span class="keyword">client</span>.CoreV1Api()</span><br><span class="line">print(<span class="string">"Listing pods with their IPs:"</span>)</span><br><span class="line">ret = v1.list_pod_for_all_namespaces(watch=<span class="literal">False</span>)</span><br><span class="line"><span class="keyword">for</span> <span class="keyword">i</span> <span class="keyword">in</span> ret.items:</span><br><span class="line">trueprint(<span class="string">"%s\t%s\t%s"</span> % (<span class="keyword">i</span>.<span class="keyword">status</span>.pod_ip, <span class="keyword">i</span>.metadata.namespace, <span class="keyword">i</span>.metadata.<span class="keyword">name</span>))</span></span><br></pre></td></tr></table></figure></p>
</main>
<footer class="post-footer">
</footer>
</article>
<article class="article post card animate" itemscope itemtype="http://schema.org/Article">
<div class="post-block">
<link itemprop="mainEntityOfPage" href="http://www.idcsec.com/2019/07/03/ubernetes中的Taint和Toleration-1/">
<span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
<meta itemprop="name" content="Wang'T">
<meta itemprop="description" content="">
<meta itemprop="image" content="/img/avatar.jpg">
</span>
<span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
<meta itemprop="name" content="Wang'T博客">
</span>
</div>
<header class="post-header">
<h1 class="post-title" itemprop="name headline">
<a class="post-title-link post-title-link-external" href="/2019/07/03/ubernetes中的Taint和Toleration-1/" itemprop="url">Kubernetes中的Taint和Toleration</a>
</h1>
<div class="post-meta">
<span class="post-date">
<i class="far fa-calendar-plus"></i><span><time title="post-date" itemprop="dateCreated datePublished" datetime="2019-07-03T14:04:00+08:00">2019-07-03 14:04:00</time></span>
</span>
<span class="post-meta-divider divider">|</span>
<span class="post-categories">
<i class="far fa-folder-open"></i><span itemprop="about" itemscope itemtype="http://schema.org/Thing"><a href="/categories/kubernetes/" itemprop="url" rel="index"><span itemprop="name">kubernetes</span></a></span>
</span>
<span class="post-meta-divider divider">|</span>
<span class="post-comment-count">
<i class="far fa-comments"></i><span><a href="/2019/07/03/ubernetes中的Taint和Toleration-1/#disqus_thread" itemprop="discussionUrl"><span class="post-comment-count disqus-comment-count" data-disqus-identifier="2019/07/03/ubernetes中的Taint和Toleration-1/" itemprop="commentCount"></span></a></span>
</span>
</div>
</header>
<main class="post-main" itemprop="articleBody">
<p><a href="https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/" target="_blank" rel="external">参考</a></p>
<p>Taint 和 toleration 相互配合,可以用来避免 pod 被分配到不合适的节点上。每个节点上都可以应用一个或多个 taint ,这表示对于那些不能容忍这些 taint 的 pod,是不会被该节点接受的。如果将 toleration 应用于 pod 上,则表示这些 pod 可以(但不要求)被调度到具有匹配 taint 的节点上。可使用节点污点来控制允许工作负载在哪些节点上运行。</p>
<h1 id="u6DFB_u52A0taint"><a href="#u6DFB_u52A0taint" class="headerlink" title="添加taint"></a>添加taint</h1><p>查看节点taint在返回的节点说明中,查找 Taints 字段<br><figure class="hljs highlight nginx"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="title">kubectl</span> describe nodes rancher-k8s-m1</span><br></pre></td></tr></table></figure></p>
<p>可以使用命令 kubectl taint 给节点增加一个 taint。比如<br><figure class="hljs highlight accesslog"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">kubectl taint nodes <span class="string">[NODE_NAME]</span> <span class="string">[KEY]</span>=<span class="string">[VALUE]</span>:<span class="string">[EFFECT]</span></span><br></pre></td></tr></table></figure></p>
<p>还可以向具有特定标签的节点添加污点:<br><figure class="hljs highlight stylus"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">kubectl taint node -l node-role<span class="class">.kubernetes</span><span class="class">.io</span>/etcd=tru dedicated=foo:PreferNoSchedule</span><br><span class="line"><span class="id">#kubectl</span> taint nodes dev-k8s-m1 node-role<span class="class">.kubernetes</span><span class="class">.io</span>/controlplane=true:NoSchedule 给节点 dev-k8s-m1 增加一个 taint,它的 key 是 role<span class="class">.kubernetes</span><span class="class">.io</span>/controlplane,value 是 true,effect 是 NoSchedule。除非pod有符合的容忍(toleration),否则不会被调度到dev-k8s-m1这个节点</span><br></pre></td></tr></table></figure></p>
<h1 id="u5220_u9664taint"><a href="#u5220_u9664taint" class="headerlink" title="删除taint"></a>删除taint</h1><figure class="hljs highlight stylus"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">kubectl taint nodes dev-k8s-m1 role<span class="class">.kubernetes</span><span class="class">.io</span>/controlplane:NoSchedule-</span><br></pre></td></tr></table></figure>
<p>点污点是与“effect”相关联的键值对。以下是可用的effect:<br><figure class="hljs highlight"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">NoSchedule:不会将不能容忍此污点的 Pod 调度到节点上。</span><br><span class="line">PreferNoSchedule:Kubernetes 会避免将不能容忍此污点的 Pod 调度到节点上。这是一个优先选择或者软性版本的NoSchedule,调度系统会尽量避免调度不容忍这种污点的pod到带有此污点的节点上,但是并不是硬性要求</span><br><span class="line">NoExecute:如果 Pod 已在节点上运行,则会将该 Pod 从节点中逐出;如果尚未在节点上运行,则不会将其调度到节点上。</span><br></pre></td></tr></table></figure></p>
<h1 id="toleration"><a href="#toleration" class="headerlink" title="toleration"></a>toleration</h1><p>可以在 PodSpec 中定义 pod 的 toleration。下面两个 toleration 均与上面例子中使用 kubectl taint 命令创建的 taint 相匹配,因此如果一个 pod 拥有其中的任何一个 toleration 都能够被分配到 dev-k8s-m1<br><figure class="hljs highlight less"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="attribute">tolerations</span>:</span><br><span class="line">- <span class="attribute">key</span>: <span class="string">"role.kubernetes.io/controlplane"</span></span><br><span class="line"> <span class="attribute">operator</span>: <span class="string">"Equal"</span></span><br><span class="line"> <span class="attribute">value</span>: <span class="string">"true"</span></span><br><span class="line"> <span class="attribute">effect</span>: <span class="string">"NoSchedule"</span></span><br></pre></td></tr></table></figure></p>
<figure class="hljs highlight less"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="attribute">tolerations</span>:</span><br><span class="line">- <span class="attribute">key</span>: <span class="string">"role.kubernetes.io/controlplane"</span></span><br><span class="line"> <span class="attribute">operator</span>: <span class="string">"Exists"</span></span><br><span class="line"> <span class="attribute">effect</span>: <span class="string">"NoSchedule"</span></span><br></pre></td></tr></table></figure>
<p>只有pod的key和effect都和某一个污点的key与effect匹配,才被认为是匹配,并且要符合以下情形:<br>operator是Exists(这种情况下value不应当指定)<br>operator是 Equal 并且value相同<br>如果operator没有指定,则默认是Equal<br><figure class="hljs highlight less"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line"><span class="attribute">tolerations</span>:</span><br><span class="line">- <span class="attribute">operator</span>: <span class="string">"Exists"</span></span><br><span class="line"></span><br><span class="line"><span class="attribute">tolerations</span>:</span><br><span class="line">- <span class="attribute">key</span>: <span class="string">"role.kubernetes.io/controlplane"</span></span><br><span class="line"> <span class="attribute">operator</span>: <span class="string">"Exists"</span></span><br></pre></td></tr></table></figure></p>
<p>以上会匹配所有key为role.kubernetes.io/controlplane的所有taint节点<br>可以为一个节点(node)添加多个污点,也可以为一个pod添加多个容忍(toleration).kubernetes处理多个污点(taint)或者多个容忍(toleration)类似于过滤器:起初包含所有污点,然后忽略掉pod匹配的污点,剩下不可被忽略的污点决定此节点对pod的效果,特别地:<br>1 如果至少有一个不可忽略的NoSchedule类型的效果(effect),kubernetes不会调度pod到此节点上来.<br>2 如果没有不可忽略的NoSchedule类型的效果(effect),但是至少有一个PreferNoSchedule类型的效果,则kubernetes会尝试调度pod到此节点上<br>3 如果至少有一个NoExecute类型的效果(effect),则此pod会被驱离此节点(当然,前提此pod在此节点上),并且如果pod不在此节点上,也不会被调度到此节点上<br>假如你有一个以下类型的节点<br><figure class="hljs highlight ceylon"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">kubectl taint nodes node<span class="number">1</span> key<span class="number">1</span>=<span class="keyword">value</span><span class="number">1</span>:NoSchedule</span><br><span class="line">kubectl taint nodes node<span class="number">1</span> key<span class="number">1</span>=<span class="keyword">value</span><span class="number">1</span>:NoExecute</span><br><span class="line">kubectl taint nodes node<span class="number">1</span> key<span class="number">2</span>=<span class="keyword">value</span><span class="number">2</span>:NoSchedule</span><br></pre></td></tr></table></figure></p>
<p>类型的pod<br><figure class="hljs highlight less"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="attribute">tolerations</span>:</span><br><span class="line">- <span class="attribute">key</span>: <span class="string">"key1"</span></span><br><span class="line"> <span class="attribute">operator</span>: <span class="string">"Equal"</span></span><br><span class="line"> <span class="attribute">value</span>: <span class="string">"value1"</span></span><br><span class="line"> <span class="attribute">effect</span>: <span class="string">"NoSchedule"</span></span><br><span class="line">- <span class="attribute">key</span>: <span class="string">"key1"</span></span><br><span class="line"> <span class="attribute">operator</span>: <span class="string">"Equal"</span></span><br><span class="line"> <span class="attribute">value</span>: <span class="string">"value1"</span></span><br><span class="line"> <span class="attribute">effect</span>: <span class="string">"NoExecute"</span></span><br></pre></td></tr></table></figure></p>
<p>这种情况下,pod不会被调度到node1上,因为没有容忍(toleration)来匹配第三个taint.但是如果它运行在此节点上,它仍然可以继续运行在此节点上,因为它仅仅不匹配第三个taint.(而第三个taint的效果是NoSchedule,指示不要被调度到此节点)</p>
<h1 id="tolerationSeconds"><a href="#tolerationSeconds" class="headerlink" title="tolerationSeconds"></a>tolerationSeconds</h1><p>通常情况下,一个效果类型为NoExecute的taint被添加到一个节点上后,所有不容忍此taint的pod会被马上驱离,容忍的永远不会被驱离.但是效果类型NoExecute可以指定一个tolerationSeconds字段来指示当NoExecute效果类型的污点被添加到节点以后,pod仍然可以继续在在指定时间内留存在此节点上,优雅驱离<br><figure class="hljs highlight less"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line"><span class="attribute">tolerations</span>:</span><br><span class="line">- <span class="attribute">key</span>: <span class="string">"key1"</span></span><br><span class="line"> <span class="attribute">operator</span>: <span class="string">"Equal"</span></span><br><span class="line"> <span class="attribute">value</span>: <span class="string">"value1"</span></span><br><span class="line"> <span class="attribute">effect</span>: <span class="string">"NoExecute"</span></span><br><span class="line"> <span class="attribute">tolerationSeconds</span>: <span class="number">3600</span></span><br></pre></td></tr></table></figure></p>
<p>在此段时间内如果污点被移除,则pod不会被驱离</p>
</main>
<footer class="post-footer">
<div class="post-tags">
<a class="post-tag button" href="/tags/taint/" rel="tag"><i class="fas fa-tags"></i>taint</a>
<a class="post-tag button" href="/tags/toleration/" rel="tag"><i class="fas fa-tags"></i>toleration</a>
</div>
</footer>
</article>
<article class="article post card animate" itemscope itemtype="http://schema.org/Article">
<div class="post-block">
<link itemprop="mainEntityOfPage" href="http://www.idcsec.com/2019/06/21/ingress-nginx后端pod容器获取客服端真实ip/">
<span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
<meta itemprop="name" content="Wang'T">
<meta itemprop="description" content="">
<meta itemprop="image" content="/img/avatar.jpg">
</span>
<span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
<meta itemprop="name" content="Wang'T博客">
</span>
</div>
<header class="post-header">
<h1 class="post-title" itemprop="name headline">
<a class="post-title-link post-title-link-external" href="/2019/06/21/ingress-nginx后端pod容器获取客服端真实ip/" itemprop="url">ingress-nginx后端pod容器获取客服端真实ip</a>
</h1>
<div class="post-meta">
<span class="post-date">
<i class="far fa-calendar-plus"></i><span><time title="post-date" itemprop="dateCreated datePublished" datetime="2019-06-21T12:50:27+08:00">2019-06-21 12:50:27</time></span>
</span>
<span class="post-meta-divider divider">|</span>
<span class="post-comment-count">
<i class="far fa-comments"></i><span><a href="/2019/06/21/ingress-nginx后端pod容器获取客服端真实ip/#disqus_thread" itemprop="discussionUrl"><span class="post-comment-count disqus-comment-count" data-disqus-identifier="2019/06/21/ingress-nginx后端pod容器获取客服端真实ip/" itemprop="commentCount"></span></a></span>
</span>
</div>
</header>
<main class="post-main" itemprop="articleBody">
<p>业务场景:<br>cdn-LB-ingress-nginx<br>创建ingres-nginx的configmap文件<br><figure class="hljs highlight groovy"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line">kubectl apply -f - <<EOF</span><br><span class="line"><span class="string">apiVersion:</span> v1</span><br><span class="line"><span class="string">data:</span></span><br><span class="line"> compute-full-forwarded-<span class="string">for:</span> <span class="string">"true"</span></span><br><span class="line"> forwarded-<span class="keyword">for</span>-<span class="string">header:</span> X-Forwarded-For</span><br><span class="line"> use-forwarded-<span class="string">headers:</span> <span class="string">"true"</span></span><br><span class="line"><span class="string">kind:</span> ConfigMap</span><br><span class="line"><span class="string">metadata:</span></span><br><span class="line"><span class="label"> labels:</span></span><br><span class="line"><span class="label"> app:</span> ingress-nginx</span><br><span class="line"><span class="label"> name:</span> nginx-configuration</span><br><span class="line"><span class="label"> namespace:</span> ingress-nginx</span><br><span class="line">EOF</span><br></pre></td></tr></table></figure></p>
<p>主要参数<a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#use-forwarded-headers" target="_blank" rel="external">https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#use-forwarded-headers</a><br><figure class="hljs highlight groovy"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">compute-full-forwarded-<span class="string">for:</span> <span class="string">"true"</span></span><br><span class="line">forwarded-<span class="keyword">for</span>-<span class="string">header:</span> X-Forwarded-For</span><br><span class="line">use-forwarded-<span class="string">headers:</span> <span class="string">"true"</span></span><br></pre></td></tr></table></figure></p>
</main>
<footer class="post-footer">
</footer>
</article>
<article class="article post card animate" itemscope itemtype="http://schema.org/Article">
<div class="post-block">
<link itemprop="mainEntityOfPage" href="http://www.idcsec.com/2019/05/19/关于docker-overlay2存储驱动配置/">
<span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
<meta itemprop="name" content="Wang'T">
<meta itemprop="description" content="">
<meta itemprop="image" content="/img/avatar.jpg">
</span>
<span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
<meta itemprop="name" content="Wang'T博客">
</span>
</div>
<header class="post-header">
<h1 class="post-title" itemprop="name headline">
<a class="post-title-link post-title-link-external" href="/2019/05/19/关于docker-overlay2存储驱动配置/" itemprop="url">关于docker overlay2存储驱动配置</a>
</h1>
<div class="post-meta">
<span class="post-date">
<i class="far fa-calendar-plus"></i><span><time title="post-date" itemprop="dateCreated datePublished" datetime="2019-05-19T12:43:00+08:00">2019-05-19 12:43:00</time></span>
</span>
<span class="post-meta-divider divider">|</span>
<span class="post-categories">
<i class="far fa-folder-open"></i><span itemprop="about" itemscope itemtype="http://schema.org/Thing"><a href="/categories/kubernetes/" itemprop="url" rel="index"><span itemprop="name">kubernetes</span></a></span>
</span>
<span class="post-meta-divider divider">|</span>
<span class="post-comment-count">
<i class="far fa-comments"></i><span><a href="/2019/05/19/关于docker-overlay2存储驱动配置/#disqus_thread" itemprop="discussionUrl"><span class="post-comment-count disqus-comment-count" data-disqus-identifier="2019/05/19/关于docker-overlay2存储驱动配置/" itemprop="commentCount"></span></a></span>
</span>
</div>
</header>
<main class="post-main" itemprop="articleBody">
<h1 id="u4E3A_u5565_u8981_u7528overlay2"><a href="#u4E3A_u5565_u8981_u7528overlay2" class="headerlink" title="为啥要用overlay2"></a>为啥要用overlay2</h1><p>docker centos(内核3.10)上默认存储驱动是devicemapper 的loop-lvm模式,这种模式是用文件模拟块设备,不推荐生产使用<br>direct lvm又不是一个开箱即用的模式,懒得配置<br>最关键的是 docker in docker的情况下 device mapper是行不通的,典型的场景就是用drone时,构建docker镜像就不能正常工作<br>overlay存储驱动层数过多时会导致文件链接数过多可能会耗尽inode<br>所以当前overlay2是个比较好的选择</p>
<p>内核<br>你需要一个高版本的内核推荐4.9以上,我们用的是4.14,如果使用低内核可能你一些FROM别的基础镜像就跑不了,如用overlay2在centos系统上跑FROM ubuntu的镜像(不是必现)</p>
<p>我们这里提供了一个免费的内核rpm包 这个在我们生产环境跑了将近一年没出任何问题</p>
<p>监控<br>overlay2如果不做一些特殊操作,cadvisor是监控不到容器内实际使用多少磁盘的,经过xfs和配额配置才能正常监控到<br>kubernetes<br>kubelet默认一次拉取一个镜像,设置为false可以同时拉取多个镜像,<br>前提是存储驱动要为overlay2,对应的Dokcer也需要增加下载并发数<br>serialize-image-pulls: ‘false’</p>
<p>使用xfs文件系统<br>不使用xfs就无法做到给每个容器限制10G的大小,就可能出现一个容器的误操作导致把机器盘全占完</p>
<p>我们使用了lvm去弄个分区出来做xfs文件系统,当然你也可以不用lvm<br><figure class="hljs highlight crystal"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">if</span> which lvs &><span class="regexp">/dev/null</span>; <span class="keyword">then</span></span><br><span class="line"> echo <span class="string">""</span>; echo -e <span class="string">"Remove last docker lv and mount ......"</span></span><br><span class="line"> lvremove k8s/docker -y</span><br><span class="line"> lvcreate -y -n docker k8s -<span class="constant">L</span> <span class="number">100</span>G</span><br><span class="line"> mkfs.xfs -n ftype=<span class="number">1</span> -f /dev/mapper/k8s-docker</span><br><span class="line"> mkdir -p /var/<span class="class"><span class="keyword">lib</span>/<span class="title">docker</span></span></span><br><span class="line"> mount -o pquota,uqnoenforce /dev/mapper/k8s-docker /var/<span class="class"><span class="keyword">lib</span>/<span class="title">docker</span></span></span><br><span class="line"> echo -e <span class="string">"/dev/mapper/k8s-docker /var/lib/docker xfs defaults,pquota 0 0"</span> >> <span class="regexp">/etc/fstab</span></span><br><span class="line">fi</span><br></pre></td></tr></table></figure></p>
<h1 id="u914D_u7F6E_u4F7F_u7528overlay2"><a href="#u914D_u7F6E_u4F7F_u7528overlay2" class="headerlink" title="配置使用overlay2"></a>配置使用overlay2</h1><figure class="hljs highlight prolog"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br></pre></td><td class="code"><pre><span class="line"># <span class="atom">cat</span> /<span class="atom">etc</span>/<span class="atom">docker</span>/<span class="atom">daemon</span>.<span class="atom">json</span></span><br><span class="line">{</span><br><span class="line"> <span class="string">"registry-mirrors"</span>: [<span class="string">"https://registry.docker-cn.com"</span>],</span><br><span class="line"> <span class="string">"insecure-registries"</span>:[<span class="string">"192.168.1.0/24"</span>],</span><br><span class="line"> <span class="string">"storage-opts"</span>: [</span><br><span class="line"> <span class="string">"overlay2.override_kernel_check=true"</span>,</span><br><span class="line"> <span class="string">"overlay2.size=10G"</span></span><br><span class="line"> ],</span><br><span class="line"> <span class="string">"log-driver"</span>: <span class="string">"json-file"</span>,</span><br><span class="line"> <span class="string">"log-opts"</span>: {</span><br><span class="line"> <span class="string">"max-size"</span>: <span class="string">"10m"</span>,</span><br><span class="line"> <span class="string">"max-file"</span>: <span class="string">"3"</span></span><br><span class="line"> }</span><br><span class="line">}</span><br><span class="line"><span class="atom">systemctl</span> <span class="atom">daemon</span>-<span class="atom">reload</span> </span><br><span class="line"><span class="atom">systemctl</span> <span class="atom">restart</span> <span class="atom">docker</span></span><br></pre></td></tr></table></figure>
<p>这样就可以把每个容器磁盘大小限制在10G了</p>
</main>
<footer class="post-footer">
<div class="post-tags">
<a class="post-tag button" href="/tags/docker/" rel="tag"><i class="fas fa-tags"></i>docker </a>
<a class="post-tag button" href="/tags/overlay2/" rel="tag"><i class="fas fa-tags"></i>overlay2</a>
</div>
</footer>
</article>
<article class="article post card animate" itemscope itemtype="http://schema.org/Article">
<div class="post-block">
<link itemprop="mainEntityOfPage" href="http://www.idcsec.com/2019/04/11/Nginx常用配置笔记/">
<span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
<meta itemprop="name" content="Wang'T">
<meta itemprop="description" content="">
<meta itemprop="image" content="/img/avatar.jpg">
</span>
<span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
<meta itemprop="name" content="Wang'T博客">
</span>
</div>
<header class="post-header">
<h1 class="post-title" itemprop="name headline">
<a class="post-title-link post-title-link-external" href="/2019/04/11/Nginx常用配置笔记/" itemprop="url">Nginx常用配置笔记</a>
</h1>
<div class="post-meta">
<span class="post-date">
<i class="far fa-calendar-plus"></i><span><time title="post-date" itemprop="dateCreated datePublished" datetime="2019-04-11T21:52:00+08:00">2019-04-11 21:52:00</time></span>
</span>
<span class="post-meta-divider divider">|</span>
<span class="post-comment-count">
<i class="far fa-comments"></i><span><a href="/2019/04/11/Nginx常用配置笔记/#disqus_thread" itemprop="discussionUrl"><span class="post-comment-count disqus-comment-count" data-disqus-identifier="2019/04/11/Nginx常用配置笔记/" itemprop="commentCount"></span></a></span>
</span>
</div>
</header>
<main class="post-main" itemprop="articleBody">
<p>location匹配规则及优先级</p>
<ol>
<li>= 严格匹配这个查询。如果找到,停止搜索。</li>
<li>^~ 匹配路径的前缀,如果找到,停止搜索。</li>
<li>~ 为区分大小写的正则匹配</li>
<li>~<em> 为不区分大小写匹配<br>优先级: =, ^~, ~/~</em>, 无</li>
</ol>
<p>Nginx禁止未绑定域名访问<br>nginx通过host配置确认转发到那台服务器处理。如果未匹配上就会转发到default_server节点来处理。例如配置如下:<br><figure class="hljs highlight nginx"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="title">server</span> {</span><br><span class="line"><span class="title">listen</span> <span class="number">80</span> default_server;</span><br><span class="line"><span class="title">server_name</span> nginx.net;</span><br><span class="line">}</span><br></pre></td></tr></table></figure></p>
<p>对于所有请求的HOST未匹配上的都会转发到该server处理。<br>通过如下配置,所有未匹配到server_name的请求都会返回403<br><figure class="hljs highlight cpp"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">server{</span><br><span class="line">listen <span class="number">80</span> <span class="keyword">default</span>;</span><br><span class="line">server_name _ ;</span><br><span class="line"><span class="keyword">return</span> <span class="number">403</span>;</span><br><span class="line">}</span><br></pre></td></tr></table></figure></p>
<p>其中_是无效域名的代表,同样可以写成其他例如”-” “@”等等。</p>
<h1 id="Nginx_rewrite_u914D_u7F6E"><a href="#Nginx_rewrite_u914D_u7F6E" class="headerlink" title="Nginx rewrite配置"></a>Nginx rewrite配置</h1><p>1)last<br>重新将rewrite后的地址在server标签中执行<br>2)break<br>将rewrite后的地址在当前location标签中执行<br>3)redirect<br>返回302临时重定向,浏览器地址会显示跳转后的URL地址。<br>4)permanent<br>返回301永久重定向,浏览器地址会显示跳转后的URL地址。<br>使用last和break,浏览器中的地址不会改变,其中需要注意的是last和break的区别:<br>使用alias指令必须用last标记;使用proxy_pass指令时,需要使用break标记。Last标记在本条rewrite规则执行完毕后,会对其所在server{……}标签重新发起请求,而break标记则在本条规则匹配完成后,终止匹配。</p>
<p>将url中以/wap/开头的请求转发到后台对应的某台server上,可以再Nginx里设置一个变量,来临时保存/wap/后面的路径信息</p>
<figure class="hljs highlight xquery"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line">location ^~ /wap/</span><br><span class="line">{</span><br><span class="line">if (<span class="variable">$request</span>_uri ~ /wap/(\d+)/(.+))</span><br><span class="line">{</span><br><span class="line">set <span class="variable">$bucketid</span> <span class="variable">$1</span>;</span><br><span class="line">set <span class="variable">$params</span> <span class="variable">$2</span>;</span><br><span class="line">}</span><br><span class="line">proxy_pass http://mx<span class="variable">$bucketid</span>.test.com:<span class="number">6601</span>/<span class="variable">$params</span>;</span><br><span class="line">}</span><br><span class="line">也可以首先rewrite一下,然后再代理:</span><br><span class="line">location ^~ /wap/{</span><br><span class="line">rewrite /wap/(\d+)/(.+) /<span class="variable">$2</span>?<span class="variable">$args</span> break;</span><br><span class="line">proxy_pass http://mx<span class="variable">$1</span>.test.com:<span class="number">6601</span>;</span><br><span class="line">}</span><br><span class="line">或者</span><br><span class="line">location ~* /wap/(\d+)/(.+)</span><br><span class="line">{</span><br><span class="line">proxy_pass http://mx<span class="variable">$1</span>.test.com:<span class="number">6601</span>/<span class="variable">$2</span>?<span class="variable">$args</span>;</span><br><span class="line">}</span><br></pre></td></tr></table></figure>
<p>注意上面最后的?$args,表明把原始url最后的get参数也给代理到后台<br>如果在proxy_pass中使用了变量(不管是主机名变量$1或后面的$2变量),则必须得加这段代码<br>但如果proxy_pass没用任何变量,则不需要加,它默认会把所有的url都给代理到后台,如:<br><figure class="hljs highlight groovy"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br></pre></td><td class="code"><pre><span class="line">location ~* <span class="regexp">/wap/</span>(\d+)/(.+)</span><br><span class="line">{</span><br><span class="line">proxy_pass <span class="string">http:</span><span class="comment">//mx.test.com:6601;</span></span><br><span class="line">}</span><br><span class="line">另外还需要注意url的/问题</span><br><span class="line">下面四种情况分别用<span class="string">http:</span><span class="comment">//192.168.1.4/proxy/test.html 进行访问。</span></span><br><span class="line">第一种:</span><br><span class="line">location <span class="regexp">/proxy/</span> {</span><br><span class="line">proxy_pass <span class="string">http:</span><span class="comment">//127.0.0.1:81/;</span></span><br><span class="line">}</span><br><span class="line">会被代理到<span class="string">http:</span><span class="comment">//127.0.0.1:81/test.html 这个url</span></span><br><span class="line">第二种(相对于第一种,最后少一个 /)</span><br><span class="line">location <span class="regexp">/proxy/</span> {</span><br><span class="line">proxy_pass <span class="string">http:</span><span class="comment">//127.0.0.1:81;</span></span><br><span class="line">}</span><br><span class="line">会被代理到<span class="string">http:</span><span class="comment">//127.0.0.1:81/proxy/test.html 这个url</span></span><br><span class="line">第三种:</span><br><span class="line">location <span class="regexp">/proxy/</span> {</span><br><span class="line">proxy_pass <span class="string">http:</span><span class="comment">//127.0.0.1:81/ftlynx/;</span></span><br><span class="line">}</span><br><span class="line">会被代理到<span class="string">http:</span><span class="comment">//127.0.0.1:81/ftlynx/test.html 这个url。</span></span><br><span class="line">第四种情况(相对于第三种,最后少一个 / ):</span><br><span class="line">location <span class="regexp">/proxy/</span> {</span><br><span class="line">proxy_pass <span class="string">http:</span><span class="comment">//127.0.0.1:81/ftlynx;</span></span><br><span class="line">}</span><br><span class="line">会被代理到<span class="string">http:</span><span class="comment">//127.0.0.1:81/ftlynxtest.html 这个url</span></span><br><span class="line">也就是说如果proxy_pass只是后端服务器的IP,最后没有/的话,就会将全uri带过去。</span><br><span class="line">而如果proxy_pass带了/的话,只是带最后访问的文件。</span><br></pre></td></tr></table></figure></p>
<h1 id="root_u4E0Ealias_u533A_u522B"><a href="#root_u4E0Ealias_u533A_u522B" class="headerlink" title="root与alias区别"></a>root与alias区别</h1><p>一句话概括,root对应的目录会加上location部分去找文件,而alias则不会<br>Nginx 配置文件 server 中指定两个 location 执行,分别为root 和 alias 指令:<br>alisa:<br><figure class="hljs highlight crmsh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">location</span> <span class="title">/static</span>/ {</span><br><span class="line"> alias /www/test/;</span><br><span class="line">}</span><br></pre></td></tr></table></figure></p>
<p>按照上述配置,则访问 /static/ 目录里面的文件时,nginx 会去 /www/test/ 目录找文件<br>请求 <a href="http://idcsec.com/static/a.gif" target="_blank" rel="external">http://idcsec.com/static/a.gif</a> 时,在服务器查找的资源路径是:/www/test/a.gif</p>
<p>root:<br><figure class="hljs highlight crmsh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">location</span> <span class="title">/static</span>/ {</span><br><span class="line"> root /www/test;</span><br><span class="line">}</span><br></pre></td></tr></table></figure></p>
<p>按照这种配置,则访问 /static/ 目录下的文件时,nginx 会去 /www/test/static/ 目录下找文件<br>请求 <a href="http://idcsec.com/static/a.gif" target="_blank" rel="external">http://idcsec.com/static/a.gif</a> 这个地址时,那么在服务器里面对应的真正的资源是 /www/test/static/a.gif文件,真实的路径是root指定的值加上location指定的值</p>
<ul>
<li>alias 是一个目录别名的定义,root 则是最上层目录的定义。</li>
<li>另一个区别是 alias 后面必须要用 “/” 结束,否则会找不到文件,而 root 则对 ”/” 可有可无。</li>
<li>误区:认为 root 是指 /www/test目录下,而应该是 /www/test/static 目录 。</li>
</ul>
<p>Nginx静动分离<br><figure class="hljs highlight gherkin"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">location ~ .<span class="keyword">*</span>\.(html|<span class="string">htm</span>|<span class="string">gif</span>|<span class="string">jpg</span>|<span class="string">jpeg</span>|<span class="string">bmp</span>|<span class="string">png</span>|<span class="string">ico</span>|<span class="string">txt</span>|<span class="string">js</span>|<span class="string">css)$ </span><br><span class="line"> { </span><br><span class="line"> root /usr/local/nginx/html/website/static/;</span><br><span class="line"> #expires定义用户浏览器缓存的时间为7天,如果静态页面不常更新,可以设置更长,这样可以节省带宽和缓解服务器的压力</span><br><span class="line"> expires 1d; </span><br><span class="line"> }</span></span><br></pre></td></tr></table></figure></p>
<p>Nginx日志 切割<br><figure class="hljs highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">#nginx日志切割脚本</span></span><br><span class="line"><span class="shebang">#!/bin/bash</span></span><br><span class="line">logs_path=<span class="string">"/usr/local/nginx/logs/"</span></span><br><span class="line">pid_path=<span class="string">"/usr/local/nginx/logs/nginx.pid"</span></span><br><span class="line">mv <span class="variable">${logs_path}</span>access.log <span class="variable">${logs_path}</span>access_$(date <span class="operator">-d</span> <span class="string">"yesterday"</span> +<span class="string">"%Y%m%d"</span>).log</span><br><span class="line"><span class="built_in">kill</span> -USR1 `cat <span class="variable">${pid_path}</span>`</span><br><span class="line">crontab <span class="operator">-e</span></span><br><span class="line"></span><br><span class="line"><span class="number">0</span> <span class="number">0</span> * * * bash /usr/<span class="built_in">local</span>/nginx/nginx_log.sh</span><br></pre></td></tr></table></figure></p>
<p>Nginx 443强制跳转<br><figure class="hljs highlight nginx"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br></pre></td><td class="code"><pre><span class="line"><span class="title">server</span> {</span><br><span class="line"> <span class="title">listen</span> <span class="number">443</span>;</span><br><span class="line"> <span class="title">server_name</span> idcsec.com.com;</span><br><span class="line"> <span class="title">ssl</span> <span class="built_in">on</span>;</span><br><span class="line"> <span class="title">ssl_certificate</span> /etc/nginx/ssl/idcsec.com.crt;</span><br><span class="line"> <span class="title">ssl_certificate_key</span> /etc/nginx/ssl/idcsec.com.com.key;</span><br><span class="line"> <span class="title">ssl_session_cache</span> shared:SSL:<span class="number">10m</span>;</span><br><span class="line"> <span class="title">ssl_session_timeout</span> <span class="number">5m</span>;</span><br><span class="line"> <span class="title">ssl_protocols</span> TLSv1 TLSv1.<span class="number">1</span> TLSv1.<span class="number">2</span>;</span><br><span class="line"> <span class="title">ssl_ciphers</span> HIGH:!aNULL:!MD5;</span><br><span class="line"> <span class="title">ssl_prefer_server_ciphers</span> <span class="built_in">on</span>;</span><br><span class="line"> <span class="title">location</span> / {</span><br><span class="line"> <span class="title">proxy_pass</span> <span class="url">http://test_domain</span>;</span><br><span class="line"> <span class="title">proxy_next_upstream</span> <span class="built_in">error</span> timeout invalid_header http_500 http_502 http_503;</span><br><span class="line"> <span class="title">proxy_set_header</span> Host <span class="variable">$host</span>;</span><br><span class="line"> <span class="title">proxy_set_header</span> X-Real-IP <span class="variable">$remote_addr</span>;</span><br><span class="line"> <span class="title">proxy_set_header</span> X-Forwarded-For <span class="variable">$proxy_add_x_forwarded_for</span>;</span><br><span class="line"> <span class="title">proxy_set_header</span> X-Forwarded-Proto https;</span><br><span class="line"> <span class="title">proxy_redirect</span> <span class="built_in">off</span>;</span><br><span class="line"></span><br><span class="line"> }</span><br><span class="line">}</span><br><span class="line"><span class="title">server</span> {</span><br><span class="line"><span class="title">listen</span> <span class="number">80</span>;</span><br><span class="line"><span class="title">server_name</span> idcsec.com.com;</span><br><span class="line"><span class="title">location</span> / {</span><br><span class="line"><span class="title">return</span> <span class="number">301</span> <span class="url">https://<span class="variable">$server_name</span><span class="variable">$request_uri</span></span>;</span><br><span class="line">}</span><br><span class="line">}</span><br></pre></td></tr></table></figure></p>
</main>
<footer class="post-footer">
<div class="post-tags">
<a class="post-tag button" href="/tags/Nginx/" rel="tag"><i class="fas fa-tags"></i>Nginx</a>
</div>
</footer>
</article>
<article class="article post card animate" itemscope itemtype="http://schema.org/Article">
<div class="post-block">
<link itemprop="mainEntityOfPage" href="http://www.idcsec.com/2019/04/08/fastDFS单节点搭建/">
<span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
<meta itemprop="name" content="Wang'T">
<meta itemprop="description" content="">
<meta itemprop="image" content="/img/avatar.jpg">
</span>
<span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
<meta itemprop="name" content="Wang'T博客">
</span>
</div>
<header class="post-header">
<h1 class="post-title" itemprop="name headline">
<a class="post-title-link post-title-link-external" href="/2019/04/08/fastDFS单节点搭建/" itemprop="url">fastDFS单节点搭建</a>
</h1>
<div class="post-meta">
<span class="post-date">
<i class="far fa-calendar-plus"></i><span><time title="post-date" itemprop="dateCreated datePublished" datetime="2019-04-08T19:49:00+08:00">2019-04-08 19:49:00</time></span>
</span>
<span class="post-meta-divider divider">|</span>
<span class="post-comment-count">
<i class="far fa-comments"></i><span><a href="/2019/04/08/fastDFS单节点搭建/#disqus_thread" itemprop="discussionUrl"><span class="post-comment-count disqus-comment-count" data-disqus-identifier="2019/04/08/fastDFS单节点搭建/" itemprop="commentCount"></span></a></span>
</span>
</div>
</header>
<main class="post-main" itemprop="articleBody">
<p><a href="http://www.idcsec.com/2018/03/23/fastDFS-Nginx%E5%88%86%E5%B8%83%E5%BC%8F%E5%9B%BE%E7%89%87%E6%9C%8D%E5%8A%A1%E5%99%A8%E6%90%AD%E5%BB%BA/">集群环境查看之前的文档</a></p>
<h1 id="u5355_u673A_u7248_u642D_u5EFA"><a href="#u5355_u673A_u7248_u642D_u5EFA" class="headerlink" title="单机版搭建"></a>单机版搭建</h1><p>安装依赖</p>
<figure class="hljs highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"># yum <span class="operator"><span class="keyword">install</span> git gcc gcc-<span class="keyword">c</span>++ make automake autoconf libtool pcre pcre-devel zlib zlib-devel openssl-devel -y</span></span><br></pre></td></tr></table></figure>
<p>创建数据目录<br><figure class="hljs highlight vala"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="preprocessor"># mkdir -p /data/fastdfs/{tracker,storage}</span></span><br></pre></td></tr></table></figure></p>
<h1 id="u4E0B_u8F7D_u5B89_u88C5_u5305"><a href="#u4E0B_u8F7D_u5B89_u88C5_u5305" class="headerlink" title="下载安装包"></a>下载安装包</h1><h2 id="u5B89_u88C5libfatscommon"><a href="#u5B89_u88C5libfatscommon" class="headerlink" title="安装libfatscommon"></a>安装libfatscommon</h2><figure class="hljs highlight vim"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">git clone http<span class="variable">s:</span>//github.<span class="keyword">com</span>/happyfish100/libfastcommon.git --depth <span class="number">1</span></span><br><span class="line">./<span class="keyword">make</span>.<span class="keyword">sh</span> && ./<span class="keyword">make</span>.<span class="keyword">sh</span> install</span><br></pre></td></tr></table></figure>
<h2 id="u5B89_u88C5FastDFS"><a href="#u5B89_u88C5FastDFS" class="headerlink" title="安装FastDFS"></a>安装FastDFS</h2><figure class="hljs highlight vim"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">git clone http<span class="variable">s:</span>//github.<span class="keyword">com</span>/happyfish100/fastdfs.git --depth <span class="number">1</span></span><br><span class="line"><span class="keyword">cd</span> fastdfs/</span><br><span class="line">./<span class="keyword">make</span>.<span class="keyword">sh</span> && ./<span class="keyword">make</span>.<span class="keyword">sh</span> install</span><br></pre></td></tr></table></figure>
<p>配置文件生成<br><figure class="hljs highlight stylus"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">cp /etc/fdfs/tracker<span class="class">.conf</span><span class="class">.sample</span> /etc/fdfs/tracker<span class="class">.conf</span> #tarcker服务配置文件</span><br><span class="line">cp /etc/fdfs/storage<span class="class">.conf</span><span class="class">.sample</span> /etc/fdfs/storage<span class="class">.conf</span> #storage服务配置文件</span><br><span class="line">cp /etc/fdfs/client<span class="class">.conf</span><span class="class">.sample</span> /etc/fdfs/client<span class="class">.conf</span> #客户端文件,测试用</span><br><span class="line"> cp conf/http<span class="class">.conf</span> /etc/fdfs/ #供nginx访问使用</span><br><span class="line">cp conf/mime<span class="class">.types</span> /etc/fdfs/ #供nginx访问使用</span><br></pre></td></tr></table></figure></p>
<p>安装fastdfs-nginx-module需要在编译nginx时候添加这个模块<br><figure class="hljs highlight crystal"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">git clone <span class="symbol">https:</span>/<span class="regexp">/github.com/happyfish</span>100/fastdfs-nginx-<span class="class"><span class="keyword">module</span>.<span class="title">git</span> --<span class="title">depth</span> 1</span></span><br><span class="line">cp fastdfs-nginx-<span class="class"><span class="keyword">module</span>/<span class="title">src</span>/<span class="title">mod_fastdfs</span>.<span class="title">conf</span> /<span class="title">etc</span>/<span class="title">fdfs</span>/</span></span><br></pre></td></tr></table></figure></p>
<h1 id="u5B89_u88C5nginx"><a href="#u5B89_u88C5nginx" class="headerlink" title="安装nginx"></a>安装nginx</h1><figure class="hljs highlight cpp"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">~]<span class="preprocessor"># wget http:<span class="comment">//nginx.org/download/nginx-1.14.0.tar.gz</span></span></span><br><span class="line">tar -zxvf nginx-<span class="number">1.14</span><span class="number">.0</span>.tar.gz</span><br><span class="line">cd nginx-<span class="number">1.14</span><span class="number">.0</span></span><br><span class="line"> ./configure --add-module=/root/fastdfs-nginx-module/src/</span><br><span class="line"> make && make instal</span><br></pre></td></tr></table></figure>
<h1 id="tracker_u914D_u7F6E"><a href="#tracker_u914D_u7F6E" class="headerlink" title="tracker配置"></a>tracker配置</h1><figure class="hljs highlight applescript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">vim /etc/fdfs/tracker.conf</span><br><span class="line"><span class="comment">#需要修改的内容如下</span></span><br><span class="line">port=<span class="number">22122</span> <span class="comment"># tracker服务器端口(默认22122,一般不修改)</span></span><br><span class="line">base_path=/data/fastdfs/tracker <span class="comment"># 存储日志和数据的根目录</span></span><br><span class="line"><span class="comment">#保存后启动</span></span><br><span class="line">/etc/init.d/fdfs_trackerd start <span class="comment">#启动tracker服务</span></span><br><span class="line">chkconfig fdfs_trackerd <span class="function_start"><span class="keyword">on</span></span> <span class="comment">#自启动tracker服务</span></span><br></pre></td></tr></table></figure>
<h1 id="storage_u914D_u7F6E"><a href="#storage_u914D_u7F6E" class="headerlink" title="storage配置"></a>storage配置</h1><figure class="hljs highlight cpp"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">vim /etc/fdfs/storage.conf</span><br><span class="line"><span class="preprocessor">#需要修改的内容如下</span></span><br><span class="line">port=<span class="number">23000</span> <span class="preprocessor"># storage服务端口(默认<span class="number">23000</span>,一般不修改)</span></span><br><span class="line">base_path=/data/fastdfs/storage <span class="preprocessor"># 数据和日志文件存储根目录</span></span><br><span class="line">store_path0=/data/fastdfs/storage/ <span class="preprocessor"># 第一个存储目录</span></span><br><span class="line">tracker_server=<span class="number">192.168</span><span class="number">.1</span><span class="number">.38</span>:<span class="number">22122</span> <span class="preprocessor"># tracker服务器IP和端口</span></span><br><span class="line">http.server_port=<span class="number">8888</span> <span class="preprocessor"># http访问文件的端口(默认<span class="number">8888</span>,看情况修改,和nginx中保持一致)其实现在这版本不需要</span></span><br><span class="line"><span class="preprocessor">#保存后启动</span></span><br><span class="line">/etc/init.d/fdfs_storaged start <span class="preprocessor">#启动storage服务</span></span><br><span class="line">chkconfig fdfs_storaged on</span><br></pre></td></tr></table></figure>
<p>检查fdfs状态<br>fdfs_monitor /etc/fdfs/storage.conf</p>
<h1 id="u914D_u7F6Enginx_u8BBF_u95EE"><a href="#u914D_u7F6Enginx_u8BBF_u95EE" class="headerlink" title="配置nginx访问"></a>配置nginx访问</h1><p>vim /etc/fdfs/mod_fastdfs.conf<br><figure class="hljs highlight cpp"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">需要修改的内容如下</span><br><span class="line">tracker_server=<span class="number">192.168</span><span class="number">.1</span><span class="number">.38</span>:<span class="number">22122</span></span><br><span class="line">url_have_group_name=<span class="literal">true</span></span><br><span class="line">store_path0=/data/fastdfs/storage</span><br></pre></td></tr></table></figure></p>
<figure class="hljs highlight cpp"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line">vi /usr/local/nginx/conf/nginx.conf</span><br><span class="line"><span class="preprocessor">#添加如下配置</span></span><br><span class="line">server {</span><br><span class="line"> listen <span class="number">8888</span>; <span class="preprocessor">## 该端口为storage.conf中的http.server_port相同 其实没必要</span></span><br><span class="line"> server_name localhost;</span><br><span class="line"> location ~/group[<span class="number">0</span>-<span class="number">9</span>]/ {</span><br><span class="line"> ngx_fastdfs_module;</span><br><span class="line"> }</span><br><span class="line"> error_page <span class="number">500</span> <span class="number">502</span> <span class="number">503</span> <span class="number">504</span> /<span class="number">50</span>x.html;</span><br><span class="line"> location = /<span class="number">50</span>x.html {</span><br><span class="line"> root html;</span><br><span class="line"> }</span><br><span class="line">}</span><br></pre></td></tr></table></figure>
<p>vim /etc/fdfs/client.conf</p>
<h1 id="u4FEE_u6539_u7684_u5185_u5BB9_u5982_u4E0B"><a href="#u4FEE_u6539_u7684_u5185_u5BB9_u5982_u4E0B" class="headerlink" title="修改的内容如下"></a>修改的内容如下</h1><figure class="hljs highlight cpp"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">base_path=/data/fastdfs/tracker</span><br><span class="line">tracker_server=<span class="number">192.168</span><span class="number">.1</span><span class="number">.38</span>:<span class="number">22122</span> <span class="preprocessor">#tracker IP地址</span></span><br></pre></td></tr></table></figure>
<figure class="hljs highlight cpp"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">[root@ecs-<span class="number">1</span>d0e ~]<span class="preprocessor"># fdfs_upload_file /etc/fdfs/client.conf /root/<span class="number">1.</span>txt </span></span><br><span class="line">group1/M00/<span class="number">00</span>/<span class="number">00</span>/wKgBJlyrRtWAR5dVAAAAB4upymk232.txt</span><br><span class="line">[root@ecs-<span class="number">1</span>d0e ~]<span class="preprocessor"># curl http:<span class="comment">//192.168.1.38:8888/group1/M00/00/00/wKgBJlyrRtWAR5dVAAAAB4upymk232.txt</span></span></span><br><span class="line"><span class="number">111111</span></span><br></pre></td></tr></table></figure>
<h1 id="FastDFS__u9632_u76D7_u94FE_u5F00_u542F"><a href="#FastDFS__u9632_u76D7_u94FE_u5F00_u542F" class="headerlink" title="FastDFS 防盗链开启"></a>FastDFS 防盗链开启</h1><p>但是这样是不安全的,因为只要知道ip和文件路径,就能下载所需文件。因此采用Token方式防盗链。<br> cp /root/fastdfs/conf/anti-steal.jpg /etc/fdfs/<br>vim /etc/fdfs/http.conf<br><figure class="hljs highlight stylus"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">#开启token校验 </span><br><span class="line">http<span class="class">.anti_steal</span><span class="class">.check_token</span>=true </span><br><span class="line">#设置校验失败后显示的警告图片 </span><br><span class="line">http<span class="class">.anti_steal</span><span class="class">.token_check_fail</span>=/etc/fdfs/anti-steal<span class="class">.jpg</span></span><br><span class="line">重启nginx</span><br></pre></td></tr></table></figure></p>
</main>
<footer class="post-footer">
</footer>
</article>
<article class="article post card animate" itemscope itemtype="http://schema.org/Article">
<div class="post-block">
<link itemprop="mainEntityOfPage" href="http://www.idcsec.com/2019/03/03/Istio配置之配置ingress流量Gateway暴露服务提供外部访问/">
<span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
<meta itemprop="name" content="Wang'T">
<meta itemprop="description" content="">
<meta itemprop="image" content="/img/avatar.jpg">
</span>
<span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
<meta itemprop="name" content="Wang'T博客">
</span>
</div>
<header class="post-header">
<h1 class="post-title" itemprop="name headline">
<a class="post-title-link post-title-link-external" href="/2019/03/03/Istio配置之配置ingress流量Gateway暴露服务提供外部访问/" itemprop="url">Istio配置之配置ingress流量Gateway暴露服务提供外部访问</a>
</h1>
<div class="post-meta">
<span class="post-date">
<i class="far fa-calendar-plus"></i><span><time title="post-date" itemprop="dateCreated datePublished" datetime="2019-03-03T18:10:00+08:00">2019-03-03 18:10:00</time></span>
</span>
<span class="post-meta-divider divider">|</span>
<span class="post-categories">
<i class="far fa-folder-open"></i><span itemprop="about" itemscope itemtype="http://schema.org/Thing"><a href="/categories/kubernetes/" itemprop="url" rel="index"><span itemprop="name">kubernetes</span></a></span>
</span>
<span class="post-meta-divider divider">|</span>
<span class="post-comment-count">
<i class="far fa-comments"></i><span><a href="/2019/03/03/Istio配置之配置ingress流量Gateway暴露服务提供外部访问/#disqus_thread" itemprop="discussionUrl"><span class="post-comment-count disqus-comment-count" data-disqus-identifier="2019/03/03/Istio配置之配置ingress流量Gateway暴露服务提供外部访问/" itemprop="commentCount"></span></a></span>
</span>
</div>
</header>
<main class="post-main" itemprop="articleBody">
<p>注意:此任务使用新的 v1alpha3 流量管理 API。旧的 API 已被弃用,ngress Gateway 组件替代了符合 Kubernetes 规范的 Ingress Controller,因此对入站流量具有了更大的控制能力。</p>
<p>1、创建pod应用,确保namespace开启自动注入Pod所在的namespace包含istio-injection=enabled的Label<br>否则就必须在部署 tomcatapp应用程序之前手动注入 Sidecar<br><figure class="hljs highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">kubectl apply <span class="operator">-f</span> <(istioctl kube-inject <span class="operator">-f</span> tomcat-demo.yaml) //namespaceswei</span><br></pre></td></tr></table></figure></p>
<figure class="hljs highlight fortran"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br></pre></td><td class="code"><pre><span class="line">kubectl apply -f tomcat-demo.yaml</span><br><span class="line">[root@k8s-master ~]# cat tomcat-demo.yaml </span><br><span class="line">apiVersion: v1</span><br><span class="line"><span class="keyword">kind</span>: Service</span><br><span class="line">metadata:</span><br><span class="line"> annotations:</span><br><span class="line"> labels:</span><br><span class="line"> app: tomcat-istio</span><br><span class="line"> <span class="keyword">name</span>: tomcat-istio</span><br><span class="line"> namespace: <span class="keyword">default</span></span><br><span class="line">spec:</span><br><span class="line"> ports:</span><br><span class="line"> - <span class="keyword">name</span>: <span class="number">8080</span>-<span class="number">8080</span></span><br><span class="line"> port: <span class="number">8080</span></span><br><span class="line"> protocol: TCP</span><br><span class="line"> targetPort: <span class="number">8080</span></span><br><span class="line"> selector:</span><br><span class="line"> app: tomcat-istio</span><br><span class="line"> <span class="keyword">type</span>: NodePort</span><br><span class="line"><span class="keyword">status</span>:</span><br><span class="line"> loadBalancer: {}</span><br><span class="line">---</span><br><span class="line">apiVersion: v1</span><br><span class="line"><span class="keyword">kind</span>: Pod</span><br><span class="line">metadata:</span><br><span class="line"> <span class="keyword">name</span>: tomcat-istio</span><br><span class="line"> annotations:</span><br><span class="line">spec:</span><br><span class="line"> replicas: <span class="number">1</span></span><br><span class="line"> template:</span><br><span class="line"> metadata:</span><br><span class="line"> labels:</span><br><span class="line"> app: tomcat-istio</span><br><span class="line">spec:</span><br><span class="line"> containers:</span><br><span class="line"> - <span class="keyword">name</span>: tomcat-istio</span><br><span class="line"> image: toamcat:demo</span><br><span class="line"> env:</span><br><span class="line"> - <span class="keyword">name</span>: JAVA_OPTS</span><br><span class="line"> <span class="keyword">value</span>: <span class="string">"-server -Xms4096M -Xmx4096M -Xss256K -Dmy.pod.name=$MY_POD_NAME -Djava.awt.headless=true -Dfile.encoding=utf-8 -XX:MaxPermSize=256M -XX:PermSize=128M"</span></span><br><span class="line"> - <span class="keyword">name</span>: MY_POD_NAME</span><br><span class="line"> valueFrom:</span><br><span class="line"> fieldRef:</span><br><span class="line"> fieldPath: metadata.<span class="keyword">name</span></span><br></pre></td></tr></table></figure>
<p>创建Gateway<br><figure class="hljs highlight livecodeserver"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line">kubectl <span class="built_in">get</span> svc -n istio-<span class="keyword">system</span> -l istio=ingressgateway</span><br><span class="line">cat <<<span class="constant">EOF</span> | istioctl <span class="built_in">create</span> -f -</span><br><span class="line">apiVersion: networking.istio.io/v1alpha3</span><br><span class="line">kind: Gateway</span><br><span class="line">metadata:</span><br><span class="line"> name: tomcatapp-gateway</span><br><span class="line">spec:</span><br><span class="line"> selector:</span><br><span class="line"> istio: ingressgateway <span class="comment"># use Istio default gateway implementation </span></span><br><span class="line"> servers:</span><br><span class="line"> - port:</span><br><span class="line"> <span class="built_in">number</span>: <span class="number">80</span></span><br><span class="line"> name: <span class="keyword">http</span></span><br><span class="line"> protocol: HTTP</span><br><span class="line"> hosts:</span><br><span class="line"> - <span class="string">"tomcat.idcsec.com"</span></span><br><span class="line"><span class="constant">EOF</span></span><br></pre></td></tr></table></figure></p>
<figure class="hljs highlight haml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br></pre></td><td class="code"><pre><span class="line">创建VirtualService组绑定网关</span><br><span class="line">cat <<EOF | istioctl create -f -</span><br><span class="line">apiVersion: networking.istio.io/v1alpha3</span><br><span class="line">kind: VirtualService</span><br><span class="line">metadata:</span><br><span class="line"> name: tomcat-istio</span><br><span class="line">spec:</span><br><span class="line"> hosts:</span><br><span class="line"> -<span class="ruby"> <span class="string">"tomcat.idcsec.com"</span></span><br><span class="line"></span> gateways:</span><br><span class="line"> -<span class="ruby"> tomcatapp-gateway</span><br><span class="line"></span> http:</span><br><span class="line"> -<span class="ruby"> <span class="symbol">match:</span></span><br><span class="line"></span> -<span class="ruby"> <span class="symbol">uri:</span></span><br><span class="line"></span> exact: /</span><br><span class="line">true-<span class="ruby"> <span class="symbol">uri:</span></span><br><span class="line"></span> prefix: /</span><br><span class="line"> route:</span><br><span class="line"> -<span class="ruby"> <span class="symbol">destination:</span></span><br><span class="line"></span> host: tomcat-istio</span><br><span class="line"> port:</span><br><span class="line"> number: 8080</span><br><span class="line">EOF</span><br></pre></td></tr></table></figure>
<p>接下来就可以在浏览器的访问域名自行修改host或者使用curl<br>一个简单使用IstioGateway 配置资源允许外部流量进入 Istio 服务网就完成 </p>
<h1 id="u6E05_u7406"><a href="#u6E05_u7406" class="headerlink" title="清理"></a>清理</h1><p>删除 Gateway 和 VirtualService,并关闭 tomcat-demo 服务:<br><figure class="hljs highlight coffeescript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">$ istioctl <span class="keyword">delete</span> gateway tomcatapp-gateway</span><br><span class="line">$ istioctl <span class="keyword">delete</span> virtualservice tomcat-istio</span><br><span class="line">$ kubectl <span class="keyword">delete</span> --ignore-<span class="keyword">not</span>-found=<span class="literal">true</span> -f tomcat-demo.yaml</span><br></pre></td></tr></table></figure></p>
</main>
<footer class="post-footer">
<div class="post-tags">
<a class="post-tag button" href="/tags/istio/" rel="tag"><i class="fas fa-tags"></i>istio</a>
</div>
</footer>
</article>
<article class="article post card animate" itemscope itemtype="http://schema.org/Article">
<div class="post-block">
<link itemprop="mainEntityOfPage" href="http://www.idcsec.com/2019/03/03/kubernetes部署网格服务Istio/">
<span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
<meta itemprop="name" content="Wang'T">
<meta itemprop="description" content="">
<meta itemprop="image" content="/img/avatar.jpg">
</span>
<span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
<meta itemprop="name" content="Wang'T博客">
</span>
</div>
<header class="post-header">
<h1 class="post-title" itemprop="name headline">
<a class="post-title-link post-title-link-external" href="/2019/03/03/kubernetes部署网格服务Istio/" itemprop="url">kubernetes部署网格服务Istio</a>
</h1>
<div class="post-meta">
<span class="post-date">
<i class="far fa-calendar-plus"></i><span><time title="post-date" itemprop="dateCreated datePublished" datetime="2019-03-03T17:58:00+08:00">2019-03-03 17:58:00</time></span>
</span>
<span class="post-meta-divider divider">|</span>
<span class="post-categories">
<i class="far fa-folder-open"></i><span itemprop="about" itemscope itemtype="http://schema.org/Thing"><a href="/categories/kubernetes/" itemprop="url" rel="index"><span itemprop="name">kubernetes</span></a></span>
</span>
<span class="post-meta-divider divider">|</span>
<span class="post-comment-count">
<i class="far fa-comments"></i><span><a href="/2019/03/03/kubernetes部署网格服务Istio/#disqus_thread" itemprop="discussionUrl"><span class="post-comment-count disqus-comment-count" data-disqus-identifier="2019/03/03/kubernetes部署网格服务Istio/" itemprop="commentCount"></span></a></span>
</span>
</div>
</header>
<main class="post-main" itemprop="articleBody">
<h1 id="u5B89_u88C5Istio"><a href="#u5B89_u88C5Istio" class="headerlink" title="安装Istio"></a>安装Istio</h1><figure class="hljs highlight groovy"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">curl -L <span class="string">https:</span><span class="comment">//git.io/getLatestIstio | sh -</span></span><br></pre></td></tr></table></figure>
<p>将在运行上述命令的同一目录中找到一个文件夹istio-1.0.6。将位置istio-1.0.6/ bin添加到PATH变量,以便于访问Istio二进制文件。<br>将Ingress Gateway服务从LoadBalancer类型更改为NodePort<br>Istio为Kubernetes提供了许多自定义资源定义(CRD)。它们帮助我们从kubectl操纵虚拟服务,规则,网关和其他特定于Istio的对象。让我们在部署实际服务网格之前安装CRD。<br><figure class="hljs highlight gradle"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">kubectl apply -f install<span class="regexp">/kubernetes/</span>helm<span class="regexp">/istio/</span>templates<span class="regexp">/crds.yaml</span></span><br></pre></td></tr></table></figure></p>
<p>查看安装的CRD:<br><figure class="hljs highlight actionscript"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">kubectl <span class="keyword">get</span> CustomResourceDefinition</span><br></pre></td></tr></table></figure></p>
<p>Kubernetes中安装Istio核心组件<br><figure class="hljs highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">kubectl apply <span class="operator">-f</span> install / kubernetes / istio-demo.yaml</span><br></pre></td></tr></table></figure></p>
<figure class="hljs highlight armasm"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="label">kubectl</span> <span class="preprocessor">get</span> <span class="keyword">svc </span>-n istio-system -l istio<span class="label">=ingressgateway</span></span><br></pre></td></tr></table></figure>
<p>*当前EXTERNAL-IP处于pending状态,为了使得可以从外部访问,修改istio-ingressgateway这个Service的externalIps,所以这个指定一个192.168<br>.19.223作为externalIp。也是可以设置NodePort 通过节点的nodeip:PORT访问<br><figure class="hljs highlight dns"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">[root@k8s-master istio-1.0.6]# kubectl get svc -n istio-system -l istio=ingressgateway</span><br><span class="line">NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE</span><br><span class="line">istio-ingressgateway LoadBalancer <span class="number">10.102.137.201</span> <span class="number">192.168.19.223</span> <span class="number">80:31380</span>/TCP,<span class="number">443:31390</span>/TCP,<span class="number">31400:31400</span>/TCP,<span class="number">15011:31211</span>/TCP,<span class="number">8060:31598</span>/TCP,<span class="number">853:31745</span>/TCP,<span class="number">15030:30600</span>/TCP,<span class="number">15031:30012</span>/TCP 2m21s</span><br></pre></td></tr></table></figure></p>
<p>验证安装<br><figure class="hljs highlight livecodeserver"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">kubectl <span class="built_in">get</span> svc -n istio-<span class="keyword">system</span></span><br><span class="line">kubectl <span class="built_in">get</span> pod -n istio-<span class="keyword">system</span></span><br></pre></td></tr></table></figure></p>
<p>部署Bookinfo应用自动注入sidecar<br>kubectl get pod -n istio-system | grep injector<br>istio-sidecar-injector可以自动将Envoy容器作为sidecar注入到Pod中,Pod所在的namespace包含istio-injection=enabled的Label。<br><figure class="hljs highlight gradle"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">kubectl label namespace <span class="keyword">default</span> istio-injection=enabled</span><br><span class="line">kubectl apply -f samples<span class="regexp">/bookinfo/</span>platform<span class="regexp">/kube/</span>bookinfo.yaml</span><br><span class="line">kubectl apply -f samples<span class="regexp">/bookinfo/</span>platform<span class="regexp">/kube/</span>bookinfo-ingress.yaml</span><br></pre></td></tr></table></figure></p>
<figure class="hljs highlight gradle"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">[root@k8s-master istio-<span class="number">1.0</span>.<span class="number">6</span>]# kubectl get pod,svc | <span class="keyword">grep</span> -vE <span class="string">"tomcat|iperf"</span></span><br><span class="line">NAME READY STATUS RESTARTS AGE</span><br><span class="line">pod<span class="regexp">/details-v1-68c7c8666d-l9qsc 2/</span><span class="number">2</span> Running <span class="number">2</span> <span class="number">18</span>m</span><br><span class="line"></span><br><span class="line">pod<span class="regexp">/productpage-v1-54d799c966-8x6p8 2/</span><span class="number">2</span> Running <span class="number">2</span> <span class="number">18</span>m</span><br><span class="line">pod<span class="regexp">/ratings-v1-8558d4458d-jzx2t 2/</span><span class="number">2</span> Running <span class="number">0</span> <span class="number">18</span>m</span><br><span class="line">pod<span class="regexp">/reviews-v1-cb8655c75-ssnmm 2/</span><span class="number">2</span> Running <span class="number">0</span> <span class="number">18</span>m</span><br><span class="line">pod<span class="regexp">/reviews-v2-7fc9bb6dcf-7rq98 2/</span><span class="number">2</span> Running <span class="number">0</span> <span class="number">18</span>m</span><br><span class="line">pod<span class="regexp">/reviews-v3-c995979bc-qckj7 2/</span><span class="number">2</span> Running <span class="number">0</span> <span class="number">18</span>m</span><br><span class="line">NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE</span><br><span class="line">service<span class="regexp">/details ClusterIP 10.105.255.93 <none> 9080/</span>TCP <span class="number">18</span>m</span><br><span class="line">service<span class="regexp">/kubernetes ClusterIP 10.96.0.1 <none> 443/</span>TCP <span class="number">7</span>d4h</span><br><span class="line">service<span class="regexp">/productpage ClusterIP 10.96.39.50 <none> 9080/</span>TCP <span class="number">18</span>m</span><br><span class="line">service<span class="regexp">/ratings ClusterIP 10.98.120.231 <none> 9080/</span>TCP <span class="number">18</span>m</span><br><span class="line">service<span class="regexp">/reviews ClusterIP 10.98.253.153 <none> 9080/</span>TCP <span class="number">18</span>m</span><br></pre></td></tr></table></figure>
<p>通过Istio Ingress Gateway暴露Bookinfo应用<br>创建bookinfo的Gateway和VirtualService:<br><figure class="hljs highlight haml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br></pre></td><td class="code"><pre><span class="line">[root@k8s-master istio-1.0.6]# cat samples/bookinfo/networking/bookinfo-gateway.yaml </span><br><span class="line">apiVersion: networking.istio.io/v1alpha3</span><br><span class="line">kind: Gateway</span><br><span class="line">metadata:</span><br><span class="line"> name: bookinfo-gateway</span><br><span class="line">spec:</span><br><span class="line"> selector:</span><br><span class="line"> istio: ingressgateway # use istio default controller</span><br><span class="line"> servers:</span><br><span class="line"> -<span class="ruby"> <span class="symbol">port:</span></span><br><span class="line"></span> number: 80</span><br><span class="line"> name: http</span><br><span class="line"> protocol: HTTP</span><br><span class="line"> hosts:</span><br><span class="line"> -<span class="ruby"> <span class="string">"*"</span></span><br><span class="line"></span>-<span class="ruby">--</span><br><span class="line"></span>apiVersion: networking.istio.io/v1alpha3</span><br><span class="line">kind: VirtualService</span><br><span class="line">metadata:</span><br><span class="line"> name: bookinfo</span><br><span class="line">spec:</span><br><span class="line"> hosts:</span><br><span class="line"> -<span class="ruby"> <span class="string">"*"</span></span><br><span class="line"></span> gateways:</span><br><span class="line"> -<span class="ruby"> bookinfo-gateway <span class="comment">#对应上面的网关名称</span></span><br><span class="line"></span> http:</span><br><span class="line"> -<span class="ruby"> <span class="symbol">match:</span></span><br><span class="line"></span> -<span class="ruby"> <span class="symbol">uri:</span></span><br><span class="line"></span> exact: /productpage</span><br><span class="line"> -<span class="ruby"> <span class="symbol">uri:</span></span><br><span class="line"></span> exact: /login</span><br><span class="line"> -<span class="ruby"> <span class="symbol">uri:</span></span><br><span class="line"></span> exact: /logout</span><br><span class="line"> -<span class="ruby"> <span class="symbol">uri:</span></span><br><span class="line"></span> prefix: /api/v1/products</span><br><span class="line"> route:</span><br><span class="line"> -<span class="ruby"> <span class="symbol">destination:</span></span><br><span class="line"></span> host: productpage</span><br><span class="line"> port:</span><br><span class="line"> number: 9080</span><br><span class="line">kubectl apply -f samples/bookinfo/networking/bookinfo-gateway.yaml</span><br></pre></td></tr></table></figure></p>
<figure class="hljs highlight cpp"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">[root@k8s-master istio-<span class="number">1.0</span><span class="number">.6</span>]<span class="preprocessor"># kubectl get gateway</span></span><br><span class="line">NAME AGE</span><br><span class="line">bookinfo-gateway <span class="number">1</span>m</span><br></pre></td></tr></table></figure>
<p>访问<a href="http://192.168.19.223/productpage" target="_blank" rel="external">http://192.168.19.223/productpage</a><br>临时映射grafana端口<br><figure class="hljs highlight mel"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">kubectl -n istio-<span class="keyword">system</span> port-forward --address <span class="number">0.0</span><span class="number">.0</span><span class="number">.0</span> <span class="variable">$(</span>kubectl -n istio-<span class="keyword">system</span> get pod -l app=grafana -o jsonpath=<span class="string">'{.items[0].metadata.name}'</span>) <span class="number">3333</span>:<span class="number">3000</span> &</span><br></pre></td></tr></table></figure></p>
<h1 id="u4F7F_u7528_Istio__u7F51_u5173_u914D_u7F6E_Ingress_u66B4_u9732grafana_u670D_u52A1"><a href="#u4F7F_u7528_Istio__u7F51_u5173_u914D_u7F6E_Ingress_u66B4_u9732grafana_u670D_u52A1" class="headerlink" title="使用 Istio 网关配置 Ingress暴露grafana服务"></a>使用 Istio 网关配置 Ingress暴露grafana服务</h1><p>Ingress Gateway描述了在网格边缘操作的负载平衡器,用于接收传入的 HTTP/TCP 连接。它配置暴露的端口,协议等,但与 Kubernetes Ingress Resources 不同,它不包括任何流量路由配置。流入流量的流量路由使用 Istio 路由规则进行配置,与内部服务请求完全相同。</p>
<h2 id="u521B_u5EFA_u4E00_u4E2A_Istio_Gateway_uFF1A"><a href="#u521B_u5EFA_u4E00_u4E2A_Istio_Gateway_uFF1A" class="headerlink" title="创建一个 Istio Gateway:"></a>创建一个 Istio Gateway:</h2><figure class="hljs highlight livecodeserver"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line">cat <<<span class="constant">EOF</span> | istioctl <span class="built_in">create</span> -f -</span><br><span class="line">apiVersion: networking.istio.io/v1alpha3</span><br><span class="line">kind: Gateway</span><br><span class="line">metadata:</span><br><span class="line"> name: grafana-gateway</span><br><span class="line"> namespace: istio-<span class="keyword">system</span></span><br><span class="line">spec:</span><br><span class="line"> selector:</span><br><span class="line"> istio: ingressgateway <span class="comment"># use Istio default gateway implementation</span></span><br><span class="line"> servers:</span><br><span class="line"> - port:</span><br><span class="line"> <span class="built_in">number</span>: <span class="number">80</span></span><br><span class="line"> name: <span class="keyword">http</span></span><br><span class="line"> protocol: HTTP</span><br><span class="line"> hosts:</span><br><span class="line"> - <span class="string">"grafana.idcsec.com"</span></span><br><span class="line"><span class="constant">EOF</span></span><br></pre></td></tr></table></figure>
<p>为通过 Gateway 进入的流量配置路由创建VirtualService:<br><figure class="hljs highlight haml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><span class="line">cat <<EOF | istioctl create -f -</span><br><span class="line">apiVersion: networking.istio.io/v1alpha3</span><br><span class="line">kind: VirtualService</span><br><span class="line">metadata:</span><br><span class="line"> name: grafana</span><br><span class="line"> namespace: istio-system</span><br><span class="line">spec:</span><br><span class="line"> hosts:</span><br><span class="line"> -<span class="ruby"> <span class="string">"grafana.idcsec.com"</span></span><br><span class="line"></span> gateways:</span><br><span class="line"> -<span class="ruby"> grafana-gateway</span><br><span class="line"></span> http:</span><br><span class="line"> -<span class="ruby"> <span class="symbol">match:</span></span><br><span class="line"></span> -<span class="ruby"> <span class="symbol">uri:</span></span><br><span class="line"></span> prefix: /</span><br><span class="line"> route:</span><br><span class="line"> -<span class="ruby"> <span class="symbol">destination:</span></span><br><span class="line"></span> port:</span><br><span class="line"> number: 3000</span><br><span class="line"> host: grafana</span><br><span class="line">EOF</span><br></pre></td></tr></table></figure></p>
<p>使用浏览器访问 Ingress 服务<br>在浏览器中输入 grafana 服务的地址是不会生效的,这是因为因为我们没有办法让浏览器像 curl 一样装作访问grafana.idcse.com。因为有正常配置的主机和 DNS 记录,这种做法就能够成功了——只要简单的在浏览器中访问由域名构成的 URL 即可,例如 <a href="http://grafana.idcse.com/。" target="_blank" rel="external">http://grafana.idcse.com/。</a><br>要解决此问题以进行简单的测试和演示,我们可以在 Gateway 和 VirutualService 配置中为hosts:使用通配符值 *<br><a href="https://i.loli.net/2019/03/01/5c78a46165fd2.png" target="_blank" rel="external"><img src="https://i.loli.net/2019/03/01/5c78a46165fd2.png" alt="20190301110526.png"></a><br><a href="https://i.loli.net/2019/03/01/5c78a4616d36c.png" target="_blank" rel="external"><img src="https://i.loli.net/2019/03/01/5c78a4616d36c.png" alt="20190301110556.png"></a><br>删除 Gateway 和 VirtualService,并关闭 httpbin 服务:<br>·····<br>$istioctl delete gateway grafana-gateway<br>$ istioctl delete virtualservice grafana<br>····<br> 卸载Istio<br>···<br>kubectl delete -f install/kubernetes/istio-demo.yaml<br>kubectl delete -f install/kubernetes/helm/istio/templates/crds.yaml -n istio-system<br>···</p>
</main>
<footer class="post-footer">
<div class="post-tags">
<a class="post-tag button" href="/tags/ingressGateway/" rel="tag"><i class="fas fa-tags"></i>ingressGateway</a>
<a class="post-tag button" href="/tags/istio/" rel="tag"><i class="fas fa-tags"></i>istio</a>
</div>
</footer>
</article>
<article class="article post card animate" itemscope itemtype="http://schema.org/Article">
<div class="post-block">
<link itemprop="mainEntityOfPage" href="http://www.idcsec.com/2019/02/28/tomcat配置获取kubernetes自定义变量/">
<span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
<meta itemprop="name" content="Wang'T">
<meta itemprop="description" content="">
<meta itemprop="image" content="/img/avatar.jpg">
</span>
<span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
<meta itemprop="name" content="Wang'T博客">
</span>
</div>
<header class="post-header">
<h1 class="post-title" itemprop="name headline">
<a class="post-title-link post-title-link-external" href="/2019/02/28/tomcat配置获取kubernetes自定义变量/" itemprop="url">tomcat配置获取kubernetes自定义变量</a>
</h1>
<div class="post-meta">
<span class="post-date">
<i class="far fa-calendar-plus"></i><span><time title="post-date" itemprop="dateCreated datePublished" datetime="2019-02-28T23:18:00+08:00">2019-02-28 23:18:00</time></span>
</span>
<span class="post-meta-divider divider">|</span>
<span class="post-comment-count">
<i class="far fa-comments"></i><span><a href="/2019/02/28/tomcat配置获取kubernetes自定义变量/#disqus_thread" itemprop="discussionUrl"><span class="post-comment-count disqus-comment-count" data-disqus-identifier="2019/02/28/tomcat配置获取kubernetes自定义变量/" itemprop="commentCount"></span></a></span>
</span>
</div>
</header>
<main class="post-main" itemprop="articleBody">
<p>tomcat获取kubernetes自定义变量<br>1、设置kubernetes自定义变量MY_POD_NAME<br>2、设置tomcat的JAVA_OPTS -D自定义变量名称:值(yaml里面定义的变量)<br>3、tomcat配置文件引用变量,获取kubernetes的pod主机名,处理多个pod日志按照主机名命名解决日志交叉写入</p>
<figure class="hljs highlight applescript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line">[root@k8s-master ~]<span class="comment"># cat tomcat-demo.yaml </span></span><br><span class="line">apiVersion: v1</span><br><span class="line">kind: Pod</span><br><span class="line">metadata:</span><br><span class="line"> <span class="property">name</span>: tomcat-istio</span><br><span class="line"> annotations:</span><br><span class="line">spec:</span><br><span class="line"> containers:</span><br><span class="line"> - <span class="property">name</span>: tomcat-istio</span><br><span class="line"> image: toamcat:demo</span><br><span class="line"> env:</span><br><span class="line"> - <span class="property">name</span>: JAVA_OPTS</span><br><span class="line"> value: <span class="string">"-server -Xms4096M -Xmx4096M -Xss256K -Dmy.pod.name=$MY_POD_NAME -Djava.awt.headless=true -Dfile.encoding=utf-8 -XX:MaxPermSize=256M -XX:PermSize=128M"</span></span><br><span class="line"> - <span class="property">name</span>: MY_POD_NAME</span><br><span class="line"> valueFrom:</span><br><span class="line"> fieldRef:</span><br><span class="line"> fieldPath: metadata.<span class="property">name</span></span><br></pre></td></tr></table></figure>
<figure class="hljs highlight applescript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">DOckerfile</span><br><span class="line">sed -i <span class="string">"prefix="</span>localhost_access_log.<span class="string">" suffix="</span>.txt<span class="string">"/prefix="</span>$\{<span class="keyword">my</span>.pod.<span class="property">name</span>\}__access_log<span class="string">" suffix="</span>.txt<span class="string">"/g"</span> server.xml</span><br></pre></td></tr></table></figure>
<p><img src="https://i.loli.net/2019/02/28/5c77f94fec009.png" alt="20190228230738.png"></p>
</main>
<footer class="post-footer">
<div class="post-tags">
<a class="post-tag button" href="/tags/jvm/" rel="tag"><i class="fas fa-tags"></i>jvm</a>
<a class="post-tag button" href="/tags/kubernetes/" rel="tag"><i class="fas fa-tags"></i>kubernetes</a>
<a class="post-tag button" href="/tags/tomcat/" rel="tag"><i class="fas fa-tags"></i>tomcat</a>
</div>
</footer>
</article>
<nav class="pagination">
<span class="page-number current">1</span><a class="page-number" href="/page/2/">2</a><span class="space">…</span><a class="page-number" href="/page/9/">9</a><a class="extend next" rel="next" href="/page/2/"><i class="fas fa-angle-right" aria-label="下一页"></i></a>
</nav>
<div class="comments" id="comments">
<script defer id="dsq-count-scr" src="//www.idcsec.com.disqus.com/count.js"></script>
</div>
</div>
</div>
<aside class="sidebar" id="sidebar" style="background: url(/images/background.png);">
<div class="search">
<div class="form-group">
<i class="fas fa-search"></i><input type="search" id="search-input" name="q" results="0" placeholder="搜索" class="form-control"/>
</div>
</div>
<div class="search-result-box" id="search-result"></div>
<div class="info sidebar-item" id="info">
<img class="author-avatar" src="/img/avatar.jpg" alt="Wang'T">
<h1 class="author-name">Wang'T</h1>
<h2 class="author-description"></h2>
<div class="site-count">
<div class="archives-count">
<div class="site-count-title">归档</div>
<div><a href="/archives/">87</a></div>
</div>
<span class="site-count-divider divider">|</span>
<div class="categories-count">
<div class="site-count-title">分类</div>
<div><a href="/categories/">13</a></div>
</div>
<span class="site-count-divider divider">|</span>
<div class="tags-count">
<div class="site-count-title">标签</div>
<div><a href="/tags/">43</a></div>
</div>
</div>
<div class="rss">
<a class="rss-link button sidebar-item" href="/atom.xml"><i class="fas fa-rss"></i>RSS</a>
</div>
</div>
<div class="sidebar-sticky">
<hr>
<div class="social-link sidebar-item">
<div><i class="far fa-address-card"></i>社交链接</p></div>
<ul>
<li><i class="fas fa-envelope"></i><a href="mailto:wang.t.nice@gmail.com" target="_blank">E-Mail</a></li>
<li><i class="fab fa-github"></i><a href="https://github.com/" target="_blank">GitHub</a></li>
<li><i class="fab fa-weibo"></i><a href="https://weibo.com/" target="_blank">Weibo</a></li>
</ul>
</div>
<hr>
<div class="blogroll sidebar-item">
<div><i class="fas fa-link"></i>友情链接</div>
<ul>
<li><i class="fas fa-link"></i><a href="https://github.com/" target="_blank">GitHub</a></li>
<li><i class="fas fa-link"></i><a href="http://www.ytniu.com" target="_blank">Jixiang's Blog</a></li>
<li><i class="fas fa-link"></i><a href="http://idcsec.com" target="_blank">另外一个博客</a></li>
</ul>
</div>
</div>
</aside>
</div>
</div>
</main>
<footer id="footer" class="footer" style="background: #33363b;">
<div class="container">
<div class="back-to-top">
<button id="back-to-top"><i class="fas fa-angle-double-up" aria-label="回到顶部"></i></button>
</div>
<div class="footer-container">
<div class="footer-left">
<div class="copyright">
<span class="author">Wang'T</span><span class="year"><i class="far fa-copyright"></i>2015 - 2020</span><span class="creative-commons"><i class="fab fa-creative-commons"></i><a href="http://creativecommons.org/licenses/by-nc-nd/4.0/" target="_blank">BY-NC-ND 4.0</a></span>
</div>
<div class="busuanzi">
<span id="busuanzi_container_site_pv"><i class="fas fa-eye" aria-label="站点点击量" aria-hidden="false"></i><span id="busuanzi_value_site_pv"></span></span><span id="busuanzi_container_site_uv"><i class="fas fa-user" aria-label="站点用户数" aria-hidden="false"></i><span id="busuanzi_value_site_uv"></span></span><span id="busuanzi_container_page_pv"><i class="far fa-file-alt"></i><span id="busuanzi_value_page_pv" aria-label="页面点击量" aria-hidden="false"></span></span>
</div>
</div>
<div class="footer-right">
<div class="custom-info">
托管于<i class="fab fa-github-alt"></i><a href="https://pages.github.com/" target="_blank">GitHub Pages</a>
</div>
<div class="powered-by">
由 <a href="https://hexo.io/" target="_blank">Hexo</a> 强力驱动 | 主题 <a href="https://github.com/AlynxZhou/hexo-theme-aria/" target="_blank">ARIA</a>
</div>
</div>
</div>
</div>
</footer>
</body>
</html>