update guide

module8/pods/drain-node/drain.MD → module11/drain-node/drain.MD

@@ -8,7 +8,7 @@ kubectl uncordon
 ```
 
 ```
-curl -v -H 'Content-type: application/json' --key admin.key --cert admin.crt https://192.168.34.2/api/v1/namespaces/default/pods/nginx-deployment-9b44bf4b5-x4xc4/eviction -d @eviction.json
+curl -v -H 'Content-type: application/json' --key admin.key --cert admin.crt https://192.168.34.2:6443/api/v1/namespaces/default/pods/nginx-deployment-9b44bf4b5-x4xc4/eviction -d @eviction.json
 
 {
   "apiVersion": "policy/v1",

module11/drain-node/nginx-deployment.yaml

@@ -0,0 +1,17 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: nginx
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+        - name: nginx
+          image: nginx

module11/drain-node/pdb.yaml

@@ -0,0 +1,9 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: nginx-deployment
+spec:
+  minAvailable: 0
+  selector:
+    matchLabels:
+      app: nginx

module7/controller-manager/job.yaml

@@ -11,5 +11,5 @@ spec:
         - name: pi
           image: perl
           command: ["perl",  "-Mbignum=bpi", "-wle", "print bpi(2000)"]
-      restartPolicy: Never
+      restartPolicy: OnFailure
   backoffLimit: 4

module7/cri/docker2containerd.md

@@ -28,4 +28,9 @@ systemctl daemon-reload
 systemctl restart containerd 
 systemctl restart kubelet 
 ```
-
+### config crictl to set correct endpoint
+```
+cat <<EOF | sudo tee /etc/crictl.yaml
+runtime-endpoint: unix:///run/containerd/containerd.sock
+EOF
+```

module9/extended-resource/admin.crt

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDITCCAgmgAwIBAgIIMKm+ItiLDzkwDQYJKoZIhvcNAQELBQAwFTETMBEGA1UE
+AxMKa3ViZXJuZXRlczAeFw0yMTEwMTkwODE4MjFaFw0yMjEwMTkwODE4MjNaMDQx
+FzAVBgNVBAoTDnN5c3RlbTptYXN0ZXJzMRkwFwYDVQQDExBrdWJlcm5ldGVzLWFk
+bWluMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx9KleJn34dmuLP++
++FNJLgvF5g3wfwuT/2cyFBLqwybZcXZD/E+G/fF0aV8JN/eYOj9Ijp2YxzLsszqx
+6Fp7dga2huDaGsmFWjVwXxBQdeINNKAdXAv0VeY0HKS260uJaRFy3Aje2/Sow1VW
+Pn6tULMofIh4MVA970qALdVsTAaKYfIqNc3ebu1PdRflN6IaiA+nqC/WkZS8G6j7
++yeLbEwrEd5mT9xaZsEllTl5z9CVxs1SEZIJaIRPfxxOTI5e30/QrXk9e78IWoLR
+cvu88ruXq+h8/Ow1tL4CXjQvHcBRcQriXHDtiFMnzLY3REMV3ufpmB1rm76rGNNL
+raCsPQIDAQABo1YwVDAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUH
+AwIwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBRmsYggfN/dd4AMmwZowVnUc8Ya
+eTANBgkqhkiG9w0BAQsFAAOCAQEAgb6Ple406MJuV0rt+pCcy+pQn1vS1AgoC/wr
+pLAWesHp2jJLiAYrbfs5spdR6ENsWvEk1JHO1C412So7kAiAPIN5sblz11ot0JqN
+jDY1chOTQy5jVPAWWqPVdkDgJ1A0mpbG5dV4GAO6qgcZPsmambPjQUSIfHahpVF9
+WoVpl4wu8YIYul6ls8CrEhpzzt60UpuNB85YlQQTzcdZ8aix80IZXZJ+teWrR2wz
+ObYT8DSS4Yx/pGkRYM8nBMwkSSPcxwvdftdYGhSJXcZZok581qo2gYny9/x5ctaN
+5N7JL416TGcEetdNScKCPFEYMuJYsODon/5S0sUzjhOihO76aQ==
+-----END CERTIFICATE-----

module9/extended-resource/admin.key

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAx9KleJn34dmuLP+++FNJLgvF5g3wfwuT/2cyFBLqwybZcXZD
+/E+G/fF0aV8JN/eYOj9Ijp2YxzLsszqx6Fp7dga2huDaGsmFWjVwXxBQdeINNKAd
+XAv0VeY0HKS260uJaRFy3Aje2/Sow1VWPn6tULMofIh4MVA970qALdVsTAaKYfIq
+Nc3ebu1PdRflN6IaiA+nqC/WkZS8G6j7+yeLbEwrEd5mT9xaZsEllTl5z9CVxs1S
+EZIJaIRPfxxOTI5e30/QrXk9e78IWoLRcvu88ruXq+h8/Ow1tL4CXjQvHcBRcQri
+XHDtiFMnzLY3REMV3ufpmB1rm76rGNNLraCsPQIDAQABAoIBAQCwRbVs9z4BgTqy
+PYVkoGv876vLLt7J5BfRhWJa7Pkl4F6PRcnhiPJHkDmmPozuTz99mpfSH1pH1zeR
+QCTzGOayjmd0AmTEnqNBmcSgR88Cvr/xfZGIwo7vO90aq38lgAQeqKLPUg/urxw0
+/FHRXYRcnT8I5IZK0kNglTMPu6cGRGsQygPkohmh2vpZ4MxOoAvrPFCGtrDjyJCU
+1TgHbEoFlFZaurp2a5l8ccgjzoghNdsu50wzp8jsl6yK1kL28/pd/DAo6bbPTMFg
+Q/i9lHxUrg5gJVJwotmGWJqMTORVH9+U/OGuGuCxHat1MdsEp3clhmuntkadUy4i
+okX6+fbtAoGBAO/mpSjT+wpC907lVD/zsZAWs69kX8iN6w//Q0T5ApjWKuTnVRw7
+RzKIZ+q1B1StZOLje1sPeuzo4WOFmAK3XIjmoT6FCbCK5Og3WgnuFdiGI3v+jwtr
+WNVlYNNi9duYvRKbCTW6cESefyuMxImluGOe+1+gOcDdoDD2fnDLi53zAoGBANU7
+e6yalkYVgge2qyl1iE028pLsiNS8MRTA2Q2tF82Zb6fYOzwlBPTALvB34qKJ3WoP
+gXkhsqmUY1xUi6RtN+M4aaSYkp9BWPFFQ0N9RrwMXtk3IU+R82cSIK3It5zaT0bW
+jbaplv5iT1A7r/Jt43CrhyqVKnK+HHFL56EoX6kPAoGBALq5aR/oLuODz/5GnVbR
+lQkzwlPn6m2tmKJw6qkKsCzJtcVJEYPR187LQSb8FGKiO34l1WPBHsq7UIMn/nNO
+yOV9rU9+OVaCJT1hp+FGwRYxAfmG30viF9iw+bZOtlJgBfovVfHN1YhzXURGYstI
+g8Z2fe2mRo2Jcx/pG+0rYNZlAoGABIxuSPJLPld7HJsC77F4JN2FMykkihUxntW2
+S5pjpZkeTqBIMzI+9tGarrp/9SOnu3l1M5ZKb1+g9vk+uVUzGf+8ESzIA+mq8gqe
+MrRba+t/onaQmVftr0ctt0dO02O8yTAOedUISYjjVDzRtgQuE9s02O2xqBzyEmCi
+IkfwMnUCgYBAHvQf7F+s5n0D5ogblx52V6nNb4jGW8T6Y8N4F4bVjDfIo0RRU0Dm
+qMzrR7tb4X9HYIBlDXSkTfTjbwmvfazo0dwoYGu0WYKBsMr+EXdkK9OUBPVtA5UP
+zWf+WLddkKMPn6ADtwOl50ijxKkxkN+/mboQqtfaUtTV38JzeoNadQ==
+-----END RSA PRIVATE KEY-----

module9/extended-resource/deployment.yaml

@@ -0,0 +1,22 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nginx
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+        - name: nginx
+          image: nginx
+          resources:
+            limits:
+              cncamp.com/reclaimed-cpu: 3
+            requests:
+              cncamp.com/reclaimed-cpu: 3

module9/extended-resource/extended-resource.MD

@@ -0,0 +1,6 @@
+```
+curl --key admin.key --cert admin.crt --header "Content-Type: application/json-patch+json" \
+--request PATCH -k \
+--data '[{"op": "add", "path": "/status/capacity/cncamp.com~1reclaimed-cpu", "value": "2"}]' \
+https://192.168.34.2:6443/api/v1/nodes/cadmin/status
+```

module9/node-problem-detector/kernel-event.MD

@@ -0,0 +1,4 @@
+
+echo "task docker:7 blocked for more than 300 seconds." |systemd-cat -t kernel
+
+echo "Error trying v2 registry: failed to register layer: rename /var/lib/docker/image/test /var/lib/docker/image/ddd: directory not empty.*" |systemd-cat -t docker

module9/node-problem-detector/npd-ds.yaml

@@ -0,0 +1,43 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: node-problem-detector-v0.1
+  namespace: kube-system
+  labels:
+    k8s-app: node-problem-detector
+    version: v0.1
+    kubernetes.io/cluster-service: "true"
+spec:
+  selector:
+    matchLabels:
+      k8s-app: node-problem-detector
+      version: v0.1
+      kubernetes.io/cluster-service: "true"
+  template:
+    metadata:
+      labels:
+        k8s-app: node-problem-detector
+        version: v0.1
+        kubernetes.io/cluster-service: "true"
+    spec:
+      hostNetwork: true
+      containers:
+        - name: node-problem-detector
+          image: cncamp/node-problem-detector:v0.8.10
+          securityContext:
+            privileged: true
+          resources:
+            limits:
+              cpu: "200m"
+              memory: "100Mi"
+            requests:
+              cpu: "20m"
+              memory: "20Mi"
+          volumeMounts:
+            - name: log
+              mountPath: /log
+              readOnly: true
+      volumes:
+        - name: log
+          hostPath:
+            path: /var/log/

module9/node-problem-detector/ssh-pod.yaml

@@ -0,0 +1,21 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ssh
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: ssh
+  template:
+    metadata:
+      labels:
+        app: ssh
+    spec:
+      containers:
+        - name: alpine
+          image: alpine
+          stdin: true
+          tty: true
+      hostNetwork: true
+      nodeName: cadmin

module9/node-problem-detector/trouble-shooting.MD

@@ -0,0 +1,18 @@
+针对使用systemd拉起的服务
+```
+journalctl -afu kubelet -S "2019-08-26 15:00:00"
+-u unit，对应的systemd拉起的组件，如kubelet
+-f follow，跟踪最新日志
+-a show all，现实所有日之列
+-S since，从某一时间开始 -S "2019-08-26 15:00:00"
+```
+对于标准的容器日志
+```
+kubectl logs -f -c <containername> <podname>
+kubectl logs -f --all-containers <podname>
+kubectl logs -f -c <podname> --previous
+```
+如果容器日志被shell转储到文件，则需通过exec
+```
+kubectl exec -it xxx -- tail -f /path/to/log
+```