cnych/kubernetes-learning

《从Docker到Kubernetes进阶课程》在线文档

kubernetes-learning's Issues

livenessprobe/liveness-readness.yaml periodSecond笔误

livenessprobe/liveness-readness.yaml

有一个小小的笔误
perioidSeconds --》 periodSeconds

readinessProbe:
tcpSocket:
port: 8080
initialDelaySeconds: 3
perioidSeconds: 3

制作了 EPUB

从Docker到Kubernetes进阶.zip

关于gitlab-ci + helm部署问题

我在gitlab-ci中使用helm发布应用，有报错：

$ helm version
Client: &version.Version{SemVer:"v2.14.2", GitCommit:"a8b13cc5ab6a7dbef0a58f5061bcc7c0c61598e7", GitTreeState:"clean"}
Error: pods is forbidden: User "system:serviceaccount:test-ci:default" cannot list resource "pods" in API group "" in the namespace "kube-system"

报错中的User信息是 system:serviceaccount:test-ci:default，我给tiller打的补丁用户是gitlab，这里是不是有问题？

gitlab-ci文件deploy部分如下：

deploy_test:
  image: alpine/helm:2.14.2
  stage: deploy
  script:
    - helm init --client-only --skip-refresh
    - helm version
    - helm upgrade --install
      --set image.repository=$BUILD_IMAGES_NAME
      --set image.tag=$BUILD_TAG_NAME
      --set ingress.annotations."kubernetes\.io/ingress\.class"=nginx-ingress-intranet
      --wait
      --namespace=test-ci
      id-generate ./helm/id-generator
  when: manual
  tags:
    - helm

我已经创建了ServceAccount并给tiller打上了补丁：

[root@php-cd-master qikqiak]# cat test-ci-sa.yaml
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: gitlab
  namespace: test-ci
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: gitlab
subjects:
  - kind: ServiceAccount
    name: gitlab
    namespace: test-ci
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io

[root@php-cd-master qikqiak]# kubectl get deploy tiller-deploy -n test-ci -o yaml
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  annotations:
    deployment.kubernetes.io/revision: "2"
  creationTimestamp: "2019-08-21T10:53:43Z"
  generation: 2
  labels:
    app: helm
    name: tiller
  name: tiller-deploy
  namespace: test-ci
  resourceVersion: "8755592"
  selfLink: /apis/extensions/v1beta1/namespaces/test-ci/deployments/tiller-deploy
  uid: f116542a-c401-11e9-a54f-00163e0e8032
spec:
  progressDeadlineSeconds: 2147483647
  replicas: 1
  revisionHistoryLimit: 2147483647
  selector:
    matchLabels:
      app: helm
      name: tiller
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: helm
        name: tiller
    spec:
      automountServiceAccountToken: true
      containers:
      - env:
        - name: TILLER_NAMESPACE
          value: test-ci
        - name: TILLER_HISTORY_MAX
          value: "0"
        image: sapcc/tiller:v2.14.2
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /liveness
            port: 44135
            scheme: HTTP
          initialDelaySeconds: 1
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        name: tiller
        ports:
        - containerPort: 44134
          name: tiller
          protocol: TCP
        - containerPort: 44135
          name: http
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /readiness
            port: 44135
            scheme: HTTP
          initialDelaySeconds: 1
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      serviceAccount: gitlab
      serviceAccountName: gitlab
      terminationGracePeriodSeconds: 30
status:
  availableReplicas: 1
  conditions:
  - lastTransitionTime: "2019-08-21T10:53:43Z"
    lastUpdateTime: "2019-08-21T10:53:43Z"
    message: Deployment has minimum availability.
    reason: MinimumReplicasAvailable
    status: "True"
    type: Available
  observedGeneration: 2
  readyReplicas: 1
  replicas: 1
  updatedReplicas: 1

目前集群中存在多个tiller-deploy

[root@php-cd-master qikqiak]# kubectl get deploy -l name=tiller -A
NAMESPACE     NAME            READY   UP-TO-DATE   AVAILABLE   AGE
kube-system   tiller-deploy   1/1     1            1           16h
test-ci       tiller-deploy   1/1     1            1           16h