https://www.chenshaowen.com/en/tags/kubernetes/Recent content in Kubernetes on Shaowen Chen's WebsiteHugo -- gohugo.ioen©2016 - {year}, All Rights Reserved.Wed, 22 Jul 2026 00:00:00 +0000weeklyhttps://www.chenshaowen.com/en/blog/add-huawei-npu-node-to-kubernetes-cluster.htmlWed, 22 Jul 2026 00:00:00 +0000Wed, 22 Jul 2026 00:00:00 +0000https://www.chenshaowen.com/en/blog/add-huawei-npu-node-to-kubernetes-cluster.html1. Disk Handling 1.1 Inspect Disks Inspect the new disk 1 fdisk -l Disk /dev/nvme1n1: 3.91 TiB, 4294967296000 bytes, 8388608000 sectors 1.2 Build a RAID0 If you have several small disks, a better approach is to build a RAID0 — this gives you not only a larger storage directory but also higher speed.微信公众号AINPUAscendHuaweiHardwareDriversKuberneteshttps://www.chenshaowen.com/en/blog/loggie-deployment-and-configuration.htmlTue, 14 Apr 2026 00:00:00 +0000Tue, 14 Apr 2026 00:00:00 +0000https://www.chenshaowen.com/en/blog/loggie-deployment-and-configuration.html1. Download the Chart Package 1 git clone https://github.com/loggie-io/installation 2. Install loggie 1 cd installation/helm-chart 1 helm install loggie ./ -nloggie --create-namespace 3. Global Configuration Changes Remove the timestamp in front of stdout 1 kubectl -n loggie edit cm loggie-config-loggie Set parseStdout to true to remove the timestamp in front of stdout.微信公众号LoggieLoggingStorageDeploymentKubernetesOperationshttps://www.chenshaowen.com/en/blog/kubernetes-base-environment-requirements.htmlThu, 04 Sep 2025 00:00:00 +0000Thu, 04 Sep 2025 00:00:00 +0000https://www.chenshaowen.com/en/blog/kubernetes-base-environment-requirements.html1. Base Packages Kubernetes version ≥ 1.18 socat Required conntrack Required ebtables Optional, but recommended ipset Optional, but recommended ipvsadm Optional, but recommended 1 apt-get -y install socat conntrack ebtables ipset ipvsadm 2. Port Requirements 2.1 Base Node Services Service Protocol Action Start Port End Port Comment ssh TCP allow 22 22 Node remote management docker TCP allow 2375 2376 Docker remote communication etcd TCP allow 2379 2380 etcd cluster communication 2.微信公众号KubernetesClusterConfigurationSecurityOperationsLearningInstallationDependenciesBest Practiceshttps://www.chenshaowen.com/en/blog/how-upgrade-kubernetes-node-cgroup-version.htmlTue, 02 Sep 2025 00:00:00 +0000Tue, 02 Sep 2025 00:00:00 +0000https://www.chenshaowen.com/en/blog/how-upgrade-kubernetes-node-cgroup-version.html1. Interface Path Differences Between cgroup v1 and v2 v1 1 2 3 4 /sys/fs/cgroup/cpu/cpu.cfs_quota_us /sys/fs/cgroup/cpu/cpuacct.usage /sys/fs/cgroup/memory/memory.limit_in_bytes /sys/fs/cgroup/memory/memory.usage_in_bytes v2 1 2 3 4 /sys/fs/cgroup/cpu.max /sys/fs/cgroup/cpu.stat /sys/fs/cgroup/memory.max /sys/fs/cgroup/memory.current cgroup v2 is the upgraded version of v1, with advantages such as more unified resource hierarchy management and precise resource isolation. But it also means that when writing code, the paths for reading the relevant interface files are different, so compatibility handling is required.微信公众号KubernetesUpgradeOperationscgroupLearningNodesResource IsolationTroubleshootingKubelethttps://www.chenshaowen.com/en/blog/deploy-dragonfly-on-kubernetes.htmlMon, 28 Jul 2025 00:00:00 +0000Mon, 28 Jul 2025 00:00:00 +0000https://www.chenshaowen.com/en/blog/deploy-dragonfly-on-kubernetes.html1. Deploy NFS Storage 1.1 Configure the NFS Service on the Storage Node Install the NFS service on the storage node 1 apt-get install -y nfs-kernel-server Start the NFS service and enable it at boot 1 systemctl start nfs-server.service & systemctl enable nfs-server.service Configure the NFS shared directory 1 mkdir -p /data/nfs 1 vim /etc/exports /data/nfs *(rw,sync,no_root_squash,no_all_squash) Restart the NFS service 1 systemctl restart nfs-server.微信公众号KubernetesDragonflyImagesImage AccelerationAIOperationshttps://www.chenshaowen.com/en/blog/kubernetes-gpu-virtualization.htmlSat, 14 Jun 2025 00:00:00 +0000Sat, 14 Jun 2025 00:00:00 +0000https://www.chenshaowen.com/en/blog/kubernetes-gpu-virtualization.html1. k8s-device-plugin https://github.com/NVIDIA/k8s-device-plugin is the official Kubernetes device plugin from NVIDIA, used to manage and allocate NVIDIA GPU resources in a Kubernetes cluster. By interacting with kubelet, k8s-device-plugin automatically discovers and registers GPU devices and exposes them to the Kubernetes scheduler as resources. It supports many GPU models and is able to handle GPU partitioning and sharing.微信公众号KubernetesGPUAIVirtualizationhttps://www.chenshaowen.com/en/blog/foundationdb-data-backup-and-restore.htmlTue, 10 Jun 2025 00:00:00 +0000Tue, 10 Jun 2025 00:00:00 +0000https://www.chenshaowen.com/en/blog/foundationdb-data-backup-and-restore.html1. Set Environment Variables Set the foundationdb cluster name and version 1 2 3 4 5 export CLUSTER_NAME= export NAMESPACE= export DEPLOY_NAME=${CLUSTER_NAME}-deployment export SECRET_NAME=fdb-backup-secret export VERSION=7.1.26 Set the S3 backup bucket and credentials 1 2 3 4 5 export BUCKET= export HOST=s3.us-west-2.amazonaws.com export AK=x export SK=x export S3_BACKUP_URI="blobstore://${AK}:${SK}@${HOST}/fdb-backup?bucket=${BUCKET}&sc=0" 2. Create the Credentials 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 cat <<EOF | kubectl apply -f - apiVersion: v1 kind: Secret metadata: name: ${SECRET_NAME} namespace: ${NAMESPACE} type: Opaque stringData: credentials: | { "accounts": { "${BUCKET}@${HOST}": { "access_key": "${AK}", "secret": "${SK}", "endpoint": "${HOST}" } } } EOF 3.微信公众号DatabaseFoundationDBKubernetesBackupOperationshttps://www.chenshaowen.com/en/blog/kube-proxy-abnormal-causes-pod-on-node-unable-to-access-service.htmlMon, 31 Mar 2025 00:00:00 +0000Mon, 31 Mar 2025 00:00:00 +0000https://www.chenshaowen.com/en/blog/kube-proxy-abnormal-causes-pod-on-node-unable-to-access-service.html1. Problem Description Related Pods 1 2 3 4 5 6 kubectl -n istio-system get pod -o wide NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES istiod-647c7c9d95-7n7n6 1/1 Running 0 77m 10.244.173.51 docs-ai-a800-4 <none> <none> istiod-647c7c9d95-k6l88 1/1 Running 0 30m 10.244.210.160 ai-a40-2 <none> <none> istiod-647c7c9d95-pj82r 1/1 Running 0 51m 10.微信公众号Kuberneteskube-proxyPodServiceOperationshttps://www.chenshaowen.com/en/blog/deploy-deepseek-3fs-storage-system-under-containers.htmlSat, 15 Mar 2025 00:00:00 +0000Sat, 15 Mar 2025 00:00:00 +0000https://www.chenshaowen.com/en/blog/deploy-deepseek-3fs-storage-system-under-containers.html1. Deployment Plan Before starting the containerized deployment, a few requirements: To simplify delivery, only one image is needed For reliability, deploy as many replicas as possible Start different services through different parameters Inject configuration through environment variables and render it into configuration files Below is the deployment plan for DeepSeek 3FS:微信公众号StorageAIContainersKubernetesDockerOperationsLLM3FShttps://www.chenshaowen.com/en/blog/using-calico-to-limit-pod-bandwidth.htmlWed, 12 Feb 2025 00:00:00 +0000Wed, 12 Feb 2025 00:00:00 +0000https://www.chenshaowen.com/en/blog/using-calico-to-limit-pod-bandwidth.html1. Testing the Full Bandwidth Start the iperf3 server on the target host 1 2 3 4 5 iperf3 -s ----------------------------------------------------------- Server listening on 5201 ----------------------------------------------------------- Test from the client host 1 iperf3 -c x.x.x.x -p 5201 -t 10 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 Connecting to host x.微信公众号CalicoPodBandwidthLimitingKubernetesNetworkOperationsLearningCNITraffic Controlhttps://www.chenshaowen.com/en/blog/fluid-juicefs-enterprise-maintenance.htmlSat, 18 Jan 2025 01:00:00 +0000Sat, 18 Jan 2025 01:00:00 +0000https://www.chenshaowen.com/en/blog/fluid-juicefs-enterprise-maintenance.html1. Setting Environment Variables 1 2 export NAMESPACE=xxx export PVC=xxx 2. The Dataset Will Not Become Ready 2.1 Fluid Component Problems 1 kubectl -n fluid-system get pod -o wide | grep -v "Running" There may be cases where something did not start up properly. 2.2 Abnormally Terminated Datasets Abnormal resources can cause Fluid resources to restart repeatedly, and manual intervention is required to delete them.微信公众号FluidJuiceFSKubernetesStorageAIDataOperationshttps://www.chenshaowen.com/en/blog/use-nerdctl-to-build-multi-architecture-images.htmlFri, 17 Jan 2025 00:00:00 +0000Fri, 17 Jan 2025 00:00:00 +0000https://www.chenshaowen.com/en/blog/use-nerdctl-to-build-multi-architecture-images.html1. Installing Nerdctl Install Opscli 1 curl -sfL https://raw.githubusercontent.com/shaowenchen/ops/main/getcli.sh |VERSION=latest sh - Install Nerdctl 1 opscli task -f install-nerdctl --arch amd64 2. BuildKit Download Buildkit 1 wget https://github.com/moby/buildkit/releases/download/v0.19.0-rc2/buildkit-v0.19.0-rc2.linux-amd64.tar.gz Install Buildkit 1 2 tar xvf buildkit-*.tar.gz mv bin/* /usr/local/bin/ Configure Buildkitd 1 mkdir -p /etc/buildkit /data/buildkit 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 cat > /etc/buildkit/buildkitd.微信公众号Multi-ArchImagesCINerdctlKubernetesOperationsLearningCICDcontainerdBuildhttps://www.chenshaowen.com/en/blog/how-to-deploy-jumpserver-on-kubernetes.htmlThu, 09 Jan 2025 00:00:00 +0000Thu, 09 Jan 2025 00:00:00 +0000https://www.chenshaowen.com/en/blog/how-to-deploy-jumpserver-on-kubernetes.html1. Deploying Jumpserver You need a StorageClass ready in advance to store Jumpserver’s data. Besides the database mentioned below, each component — jms-core, jms-web, jms-koko, jms-lion, jms-chen — also needs a PV for storage. 1.1 Deploying MySQL Refer to https://github.com/shaowenchen/ops-hub/blob/main/database/mysql8.yaml to deploy MySQL. You need to adjust the StorageClass field微信公众号KubernetesJumpserverSecurityOperationsBastion HostDeploymentLearninghttps://www.chenshaowen.com/en/blog/using-fluid-to-access-obs-storage-and-performance-testing.htmlTue, 22 Oct 2024 00:00:00 +0000Tue, 22 Oct 2024 00:00:00 +0000https://www.chenshaowen.com/en/blog/using-fluid-to-access-obs-storage-and-performance-testing.html1. Jindo Mounting OBS Set the environment variables 1 2 3 4 export ENDPOINT=obs.cn-north-4.myhuaweicloud.com export BUCKET= export AK= export SK= Create the credentials 1 2 3 4 5 6 7 8 9 10 kubectl apply -f - <<EOF apiVersion: v1 kind: Secret metadata: name: myobssecret type: Opaque stringData: fs.obs.accessKeyId: ${AK} fs.微信公众号OBSFluidJuiceFSKubernetesAIDataOperationshttps://www.chenshaowen.com/en/blog/use-iceberg-and-spark-on-kubernetes.htmlThu, 12 Sep 2024 00:00:00 +0000Thu, 12 Sep 2024 00:00:00 +0000https://www.chenshaowen.com/en/blog/use-iceberg-and-spark-on-kubernetes.html1. Data Processing Architecture It is mainly divided into four layers: Processing capability layer: Spark on Kubernetes provides streaming data processing capability Data management layer: Iceberg provides dataset access operations such as ACID and tables Storage layer: Hive MetaStore manages Iceberg table metadata, PostgreSQL serves as the storage backend for微信公众号SparkIcebergKubernetesBig DataData LakeOperationsData ProcessingLearninghttps://www.chenshaowen.com/en/blog/kubernetes-dlrover-workflow-analysis.htmlTue, 27 Aug 2024 00:00:00 +0000Tue, 27 Aug 2024 00:00:00 +0000https://www.chenshaowen.com/en/blog/kubernetes-dlrover-workflow-analysis.htmlThe DLRover version used in this article is 0.3.7 1. DLRover Operator 1.1 Starting the ElasticJob and ScalePlan Controllers Implementation code: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 // 创建 ElasticJob 的控制器 if err = controllers.NewElasticJobReconciler(mgr, masterImage).SetupWithManager(mgr); err微信公众号DLRoverKubernetesAITrainingFault Self-HealingOperationshttps://www.chenshaowen.com/en/blog/use-dlrover-to-manage-training-job.htmlSat, 17 Aug 2024 00:00:00 +0000Sat, 17 Aug 2024 00:00:00 +0000https://www.chenshaowen.com/en/blog/use-dlrover-to-manage-training-job.html1. Problems Facing Distributed Training Estimating training resources is difficult and cannot be automated How much compute, how much time, how much bandwidth, how many CPUs, how much memory — without enough accumulated experience it is hard to estimate accurately. The result is over-requesting and over-allocation, causing enormous resource waste.微信公众号DLRoverAITrainingKubernetesElastic TrainingFault-Tolerant TrainingOperationshttps://www.chenshaowen.com/en/blog/why-top-node-free-grafana-data-not-match.htmlFri, 26 Jul 2024 01:00:00 +0000Fri, 26 Jul 2024 01:00:00 +0000https://www.chenshaowen.com/en/blog/why-top-node-free-grafana-data-not-match.html1. top Shows Node Resource Usage Above 100% 1 2 3 4 5 6 kubectl top node NAME CPU(cores) CPU% MEMORY(bytes) MEMORY% master-1 995m 16% 13760Mi 118% master-2 827m 13% 10672Mi 92% master-3 889m 14% 10244Mi 88% This is because usage is computed against allocatable resources by default, which excludes the portion reserved by Kubelet.微信公众号MonitoringMemoryKubernetesGrafanaOperationsTroubleshootinghttps://www.chenshaowen.com/en/blog/store-elasticsearch-data-in-juicefs.htmlWed, 22 May 2024 00:00:00 +0000Wed, 22 May 2024 00:00:00 +0000https://www.chenshaowen.com/en/blog/store-elasticsearch-data-in-juicefs.html1. Storage Options There are three storage approaches: Isolate by directory and share a single JuiceFS Elasticsearch nodes share one JuiceFS instance, mounting different Elasticsearch nodes through subdirectories. /0/ corresponds to node Node-0 /1/ corresponds to node Node-1 /2/ corresponds to node Node-2 The main advantage of this approach is that it is easy to scale and simple to configure.微信公众号KubernetesJuiceFSElasticsearchStorageOperationshttps://www.chenshaowen.com/en/blog/fluid-mount-s3-and-performance-testing.htmlThu, 16 May 2024 00:00:00 +0000Thu, 16 May 2024 00:00:00 +0000https://www.chenshaowen.com/en/blog/fluid-mount-s3-and-performance-testing.html1. Packaging the Fluid Runtime Image Create the fluid_config_init.py script 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 #!/usr/bin/env python import json rawStr = "" with open("/etc/fluid/config.json", "r") as f: rawStr = f.微信公众号FluidJuiceFSKubernetesStorageAIDatahttps://www.chenshaowen.com/en/blog/fluid-using-nfs-runtime-and-performance-testing.htmlTue, 14 May 2024 00:00:00 +0000Tue, 14 May 2024 00:00:00 +0000https://www.chenshaowen.com/en/blog/fluid-using-nfs-runtime-and-performance-testing.html1. Creating a Dataset 1 2 3 4 5 6 7 8 9 10 kubectl apply -f - <<EOF apiVersion: data.fluid.io/v1alpha1 kind: Dataset metadata: name: nfs-demo spec: mounts: - mountPoint: x.x.x.x:/x-x/ name: nfs-demo EOF 2. Creating a Runtime 1 2 3 4 5 6 7 8 9 10 11 12 13 14 kubectl apply -f - <<EOF apiVersion: data.微信公众号FluidJuiceFSKubernetesStorageAIDatahttps://www.chenshaowen.com/en/blog/event-driven-workflow-using-argo-events.htmlWed, 27 Mar 2024 00:00:00 +0000Wed, 27 Mar 2024 00:00:00 +0000https://www.chenshaowen.com/en/blog/event-driven-workflow-using-argo-events.html1. How Argo Events Works The diagram above is from the official Argo Events website. An event processing system has three important parts: Ingesting event sources, which corresponds to the Event Source Distributing events, which corresponds to the Event Sensor Consuming events, which corresponds to the Event Trigger The event messages are stored in the EventBus, which uses NATS by default.微信公众号ArgoArgo EventsKubernetesCICDEvent-DrivenOperationshttps://www.chenshaowen.com/en/blog/the-basic-of-volcano.htmlSun, 24 Mar 2024 00:00:00 +0000Sun, 24 Mar 2024 00:00:00 +0000https://www.chenshaowen.com/en/blog/the-basic-of-volcano.html1. Introduction to Volcano Volcano is a Kubernetes-based resource scheduling system open-sourced by Huawei. Compared with the native scheduler, its notable features are: Supports gang scheduling Scheduling batch jobs easily runs into deadlock: for example, two jobs each need 10 Pods running simultaneously to start. When both jobs are submitted at the same time, it is possible that only part of the Pods of each are scheduled, so neither job can run properly and they wait on each other.微信公众号VolcanoAIKubernetesSchedulingOperationshttps://www.chenshaowen.com/en/blog/how-to-quickly-create-juicefs-enterprise-pvc-in-kubernetes.htmlFri, 08 Mar 2024 00:00:00 +0000Fri, 08 Mar 2024 00:00:00 +0000https://www.chenshaowen.com/en/blog/how-to-quickly-create-juicefs-enterprise-pvc-in-kubernetes.htmlThis post mainly records the script for creating an enterprise-edition JuiceFS PVC, to make configuration quick. 1. Set Environment Variables 1.1 Basic Configuration 1 2 3 export NAMESPACE= export PVC_NAME= export JUICEFS_VOLUME= 1.2 JuiceFS Credentials 1 2 3 export TOKEN= export ACCESS_KEY= export SECRET_KEY= 1.3 JuiceFS Service Configuration 1 2 export BASE_URL=http://x.微信公众号AIStorageJuiceFSKubernetesFluidOperationsPVCEnterprise Editionhttps://www.chenshaowen.com/en/blog/how-to-quickly-create-juicefs-pvc-in-kubernetes.htmlThu, 07 Mar 2024 00:00:00 +0000Thu, 07 Mar 2024 00:00:00 +0000https://www.chenshaowen.com/en/blog/how-to-quickly-create-juicefs-pvc-in-kubernetes.htmlThis post mainly records the script for creating a community-edition JuiceFS PVC, to make configuration quick. For component deployment, see Managing Data in Kubernetes with Fluid and JuiceFS. 1. Set Environment Variables Bucket configuration 1 2 3 4 5 6 export ACCESS_KEY= export SECRET_KEY= export BUCKET= export ENDPOINT=ks3-cn-beijing-internal.ksyun.com export BUCKET_ENPOINT=$BUCKET.微信公众号AIStorageJuiceFSKubernetesFluidOperationsPVChttps://www.chenshaowen.com/en/blog/introduction-to-argo-core-components.htmlFri, 23 Feb 2024 00:00:00 +0000Fri, 23 Feb 2024 00:00:00 +0000https://www.chenshaowen.com/en/blog/introduction-to-argo-core-components.html1. Introduction to Argo Argo is an open source project that provides a set of tools on Kubernetes for building and running applications. The core components of Argo mainly include the following: Argo CD Argo CD is a GitOps-based continuous delivery tool that allows users to declaratively manage the deployment of applications in a Kubernetes cluster.微信公众号ArgoArgo CDKubernetesCICDDevOpsOperationshttps://www.chenshaowen.com/en/blog/practice-guide-to-kind.htmlMon, 05 Feb 2024 00:00:00 +0000Mon, 05 Feb 2024 00:00:00 +0000https://www.chenshaowen.com/en/blog/practice-guide-to-kind.html1. Project Overview kind is a tool for managing Kubernetes clusters using containers. Project address https://github.com/kubernetes-sigs/kind . It is mainly used for: Local development environments Temporary environments for learning Automated testing 2. Installing kind macOS 1 brew install kind Linux 1 2 curl -Lo /usr/local/bin/kind https://kind.sigs.k8s.io/dl/v0.21.0/kind-linux-amd64 chmod +x /usr/local/bin/kind 3. Creating a kind Cluster If you have a PROXY configured locally, it is recommended to reset the environment variables before creating:微信公众号KuberneteskindPracticeOperationshttps://www.chenshaowen.com/en/blog/ai-related-exporters-in-kubernetes.htmlSun, 04 Feb 2024 00:00:00 +0000Sun, 04 Feb 2024 00:00:00 +0000https://www.chenshaowen.com/en/blog/ai-related-exporters-in-kubernetes.html1. dcgm-exporter dcgm-exporter is the GPU monitoring tool provided by the official NVIDIA community. Project address https://github.com/NVIDIA/dcgm-exporter 1.1 Installation Add the Helm chart repository 1 helm repo add gpu-helm-charts https://nvidia.github.io/dcgm-exporter/helm-charts 1 helm repo update Install 1 2 3 4 5 helm install dcgm-exporter gpu-helm-charts/dcgm-exporter --namespace monitor --create-namespace \ --set serviceMonitor.enabled=false \ --set image.微信公众号KubernetesAIMetricsCollectionhttps://www.chenshaowen.com/en/blog/managing-data-in-kubernetes-using-fluid-and-juicefs.htmlSat, 27 Jan 2024 00:00:00 +0000Sat, 27 Jan 2024 00:00:00 +0000https://www.chenshaowen.com/en/blog/managing-data-in-kubernetes-using-fluid-and-juicefs.html1. Introduction to Fluid Below is the Fluid architecture diagram from https://github.com/fluid-cloudnative/fluid: Fluid abstracts two concepts: Dataset, a collection of data, the abstraction from the user’s point of view Runtime, the abstraction of the real services such as data storage and acceleration Fluid mainly solves the problems of using traditional caching systems on Kubernetes:微信公众号KubernetesFluidJuiceFSStorageData ManagementAIOperationshttps://www.chenshaowen.com/en/blog/performance-testing-and-comparison-of-juicefs-ce-ee-and-dragonfly.htmlWed, 24 Jan 2024 00:00:00 +0000Wed, 24 Jan 2024 00:00:00 +0000https://www.chenshaowen.com/en/blog/performance-testing-and-comparison-of-juicefs-ce-ee-and-dragonfly.htmlNote that --block-size 4096 in this post means 4GB; using --block-size 4 would be more reasonable and would give better write performance. 1. Environment Preparation Enter a safe directory 1 mkdir -p /data/test && cd /data/test All the test tasks are carried out in this directory. Create a separate directory for Redis 1 mkdir redis-data It is recommended to create a new directory, because Redis will change the Owner of the files in the current directory to systemd-coredump.微信公众号JuiceFSDragonflyStoragePerformance TestingKubernetesOperationshttps://www.chenshaowen.com/en/blog/health-check-runs-out-of-root-run-storage.htmlTue, 23 Jan 2024 00:00:00 +0000Tue, 23 Jan 2024 00:00:00 +0000https://www.chenshaowen.com/en/blog/health-check-runs-out-of-root-run-storage.htmlIf you use nvidia-container-runtime, this is worth your attention — especially if JuiceFS is also in the picture. 1. An Alert Out of Nowhere, and I Panicked Over the weekend I was studying TensorRT LLM, and while I was at it I installed Dragonfly on the largest production cluster. Then微信公众号KubernetesNVIDIAJuiceFSExperienceTroubleshootingOperationshttps://www.chenshaowen.com/en/blog/distributing-image-with-dragonfly-v2.htmlSat, 13 Jan 2024 11:22:55 +0000Sat, 13 Jan 2024 11:22:55 +0000https://www.chenshaowen.com/en/blog/distributing-image-with-dragonfly-v2.html1. Introduction to Dragonfly The Dragonfly documentation at https://d7y.io/zh/docs/ already covers things in detail. Here is just a brief introduction to the main components of V2: Manager, which provides the UI, user management, cluster monitoring, task management, and other features Scheduler, which schedules traffic between Peers and provides preheating and other features Seed Peer, the back-to-source node used to download data from origin sites (Harbor, Docker.微信公众号AIDragonflyKubernetesImagesImageNydusConfigurationPracticeOperationshttps://www.chenshaowen.com/en/blog/configurate-envoyfilter-in-istio.htmlSun, 12 Nov 2023 00:00:00 +0000Sun, 12 Nov 2023 00:00:00 +0000https://www.chenshaowen.com/en/blog/configurate-envoyfilter-in-istio.html1. What Is EnvoyFilter EnvoyFilter is a CRD resource in Istio that allows users to modify Envoy’s configuration to satisfy their customization needs for different scenarios. 1 2 3 4 5 6 7 8 9 kubectl get envoyfilter -A NAMESPACE NAME AGE istio-system add-request-id-into-ingressgateway 54d istio-system compression-gzip 18d istio-system custom-access-log 3d istio-system ingressgateway-settings 52d istio-system preserve-request-header-us-test-ingress-gateway 95d istio-system preserve-x-request-id 54d When using Istio, you will usually end up using at least a few EnvoyFilters.微信公众号IstioEnvoyFilterKubernetesService MeshConfigurationOperationshttps://www.chenshaowen.com/en/blog/record-a-troubleshooting-process-for-application-slowness.htmlWed, 08 Nov 2023 00:00:00 +0000Wed, 08 Nov 2023 00:00:00 +0000https://www.chenshaowen.com/en/blog/record-a-troubleshooting-process-for-application-slowness.html1. Symptoms The business side reported that the API of application app-a was slow. Looking at the logs, one particular Pod was slow, and deleting that Pod so it moved to another node fixed it. From the monitoring metrics you can see that the Pod’s CPU usage did indeed spike sharply.微信公众号CPUNetworkApplicationTroubleshootingKubernetesOperationshttps://www.chenshaowen.com/en/blog/source-analysis-kubernetes-management-of-pod-ip.htmlThu, 02 Nov 2023 19:45:31 +0000Thu, 02 Nov 2023 19:45:31 +0000https://www.chenshaowen.com/en/blog/source-analysis-kubernetes-management-of-pod-ip.html1. Subnet Management by kube-controller-manager kube-controller-manager has many controllers; the one related to Pod IP is NodeIpamController. The NodeIpamController mainly manages the podcidr of nodes: when a new node joins the cluster, it allocates a subnet to that node; when a node is deleted, it reclaims the subnet. The subnets微信公众号Source Code AnalysisKubernetesPodIPNetworkLearningOperationshttps://www.chenshaowen.com/en/blog/the-scope-of-credential-in-building.htmlThu, 06 Jul 2023 00:00:00 +0000Thu, 06 Jul 2023 00:00:00 +0000https://www.chenshaowen.com/en/blog/the-scope-of-credential-in-building.htmlIn the client, we have already seen the Docker CLI passing credentials to the Docker Daemon via X-Registry-Config when sending the build context. But recent build feedback still shows some phenomena that cannot be explained. This post mainly runs some basic tests to make troubleshooting easier. 1. Building under host Docker The Docker Daemon is started with root privileges.微信公众号CICDDevOpsDockerCredentialsKubernetesOperationsTroubleshootinghttps://www.chenshaowen.com/en/blog/how-to-set-hpa-for-kubernetes-app.htmlThu, 08 Jun 2023 00:00:00 +0000Thu, 08 Jun 2023 00:00:00 +0000https://www.chenshaowen.com/en/blog/how-to-set-hpa-for-kubernetes-app.html1. Business Background Once an enterprise reaches a certain scale, relying entirely on public cloud infrastructure makes IT costs very high. The cost of purchasing physical machines can be amortized over the next 3 to 5 years, and afterwards the machines are not scrapped; instead they continue to serve beyond their planned lifespan.微信公众号KubernetesHPAPodElastic ScalingOperationsHybrid CloudLearninghttps://www.chenshaowen.com/en/blog/autoscale-kubernetes-applications-with-keda.htmlThu, 18 May 2023 00:00:00 +0000Thu, 18 May 2023 00:00:00 +0000https://www.chenshaowen.com/en/blog/autoscale-kubernetes-applications-with-keda.html1. HPA VS KEDA HPA also provides: Elasticity based on custom metrics Scale to Zero Compared with KEDA, these are no longer disadvantages. The real difference is that HPA can only scale using monitoring data, whereas KEDA can scale using many more data sources — queue messages, databases, Redis, and so on, including monitoring data as well.微信公众号KubernetesKEDAAutoscalingElastic ScalingOperationsLearningHPAEvent-Drivenhttps://www.chenshaowen.com/en/blog/custom-cluster-scheduler-to-optimize-tekton.htmlWed, 26 Apr 2023 10:00:00 +0000Wed, 26 Apr 2023 10:00:00 +0000https://www.chenshaowen.com/en/blog/custom-cluster-scheduler-to-optimize-tekton.html1. A Constrained Build Environment Cannot Meet Build Requirements Tekton is a CICD engine based on a Kubernetes cluster, and it is more cloud-native than Jenkins. In plain terms, that means it is easier to develop plugins for, easier to scale, easier to observe, and more fun. Because code can only be stored on the company intranet, the build cluster can only be deployed on the office intranet.微信公众号OptimizationTektonCICDDevOpsKubernetesOperationsLearningSchedulingBuildMulti-Clusterhttps://www.chenshaowen.com/en/blog/optimizing-the-slow-of-tekton-clone-task.htmlThu, 16 Feb 2023 00:00:00 +0000Thu, 16 Feb 2023 00:00:00 +0000https://www.chenshaowen.com/en/blog/optimizing-the-slow-of-tekton-clone-task.html1. Symptom - Tekton’s Clone Task Is Slow When running the clone task, Tekton is very time-consuming; with multiple repositories it generally takes around 2 minutes 30 seconds. As shown below: A pipeline that only clones takes 2 minutes 16 seconds to run, while the clone script itself actually runs for only 1-3 seconds.微信公众号TektonKubernetesCICDDevOpsOperationsPerformance Optimizationhttps://www.chenshaowen.com/en/blog/listen-runtime-security-using-falco.htmlSat, 11 Feb 2023 00:00:00 +0000Sat, 11 Feb 2023 00:00:00 +0000https://www.chenshaowen.com/en/blog/listen-runtime-security-using-falco.html1. What Falco Is Falco is a cloud-native runtime security project contributed to the CNCF by Sysdig. Falco implements an extensible event rule filtering engine. Through a series of operations — capturing events, matching security rules, and producing alert notifications — it can surface security problems in a system. The events come from system calls, and it also supports an ebpf probe; the rules are open source [1] and you can define your own extensions [2].微信公众号FalcoKubernetesSecurityToolsOperationshttps://www.chenshaowen.com/en/blog/how-to-repair-k8s-master-after-reinstalling-os.htmlTue, 17 Jan 2023 00:00:00 +0000Tue, 17 Jan 2023 00:00:00 +0000https://www.chenshaowen.com/en/blog/how-to-repair-k8s-master-after-reinstalling-os.htmlRecently I ran into this twice: a host had to be reinstalled because of a failure. In one case only a single Etcd node was left, and the whole cluster stayed down for half an hour before it recovered. This post mainly records the process of initializing a fresh Ubuntu微信公众号KubernetesRepairOperationsEtcdTroubleshootingClusterKubekeyLearninghttps://www.chenshaowen.com/en/blog/tekton-stress-test-and-optimize-k8s-cluster.htmlThu, 10 Nov 2022 00:00:00 +0000Thu, 10 Nov 2022 00:00:00 +0000https://www.chenshaowen.com/en/blog/tekton-stress-test-and-optimize-k8s-cluster.html1. Purpose of the Test Tune the parameters of the build cluster Probe the upper limit on the number of concurrent Tekton pipelines Give the optimal concurrency limit for a single cluster 2. Related Components and Machine Configuration Kubernetes version v1.21.4 Tekton version v0.24.1, kept consistent with production OpenEBS version localpv version 3.微信公众号TektonKubernetesStress TestingLarge ClustersOptimizationCICDOperationshttps://www.chenshaowen.com/en/blog/kubernetes-cluster-troubleshooting.htmlTue, 01 Nov 2022 01:00:00 +0000Tue, 01 Nov 2022 01:00:00 +0000https://www.chenshaowen.com/en/blog/kubernetes-cluster-troubleshooting.htmlFailedCreatePodSandBox Error Error response from daemon: OCI runtime create failed: container_linux.go:380: starting container process caused: process_linux.go:402: getting the final child's pid from pipe caused: EOF: unknown Resolution Clear the cache 1 echo 3 > /proc/sys/vm/drop_caches Cause Too much memory fragmentation calico-node Keeps Restarting increase max user Error runtime: failed to微信公众号KubernetesClusterTroubleshootingOperationsLearningFault DiagnosisPodBest PracticesProblem Localizationhttps://www.chenshaowen.com/en/blog/how-to-repair-the-kubernetes-cluster-after-changing-ip.htmlTue, 25 Oct 2022 00:00:00 +0000Tue, 25 Oct 2022 00:00:00 +0000https://www.chenshaowen.com/en/blog/how-to-repair-the-kubernetes-cluster-after-changing-ip.htmlA record of repairing a cluster failure caused by an IP change. There are two clusters: one single-node (allinone) cluster, and one four-node cluster (3 masters, 1 node). 1. Update the Etcd Certificates [On every Etcd node] Back up the Etcd certificates 1 cp -R /etc/ssl/etcd/ssl /etc/ssl/etcd/ssl-bak View the domains微信公众号KubernetesOperationsRepairTroubleshootingLearningEtcdCertificatesClusterNetworkhttps://www.chenshaowen.com/en/blog/kubernetes-network-packets.htmlSat, 17 Sep 2022 00:00:00 +0000Sat, 17 Sep 2022 00:00:00 +0000https://www.chenshaowen.com/en/blog/kubernetes-network-packets.htmlThis article is translated from https://learnk8s.io/kubernetes-network-packets, not word for word, with some of my own understanding worked in. By reading this article, you can learn how packets are forwarded inside and outside Kubernetes, starting from the original web request all the way to the container hosting the application. Kubernetes Network Requirements Before diving into the details of how packets flow through a Kubernetes cluster, let’s first clarify Kubernetes’ requirements for networking.微信公众号TranslationKubernetesNetworkOperationsLearningiptablesCNIhttps://www.chenshaowen.com/en/blog/insight-kubernetes-network-by-kindling.htmlSat, 10 Sep 2022 00:00:00 +0000Sat, 10 Sep 2022 00:00:00 +0000https://www.chenshaowen.com/en/blog/insight-kubernetes-network-by-kindling.htmlI recently had a requirement to collect Kubernetes’ external network access. So I set up and tried out some related projects. This post is mainly about how to install Kindling and configure Grafana to view Kubernetes network connection data. 1. What Is Kindling Kindling solves the problem of how to observe the network without intruding on the application; its functionality is mainly achieved by exposing kernel events for observation.微信公众号KubernetesKindlingNetworkObservabilityOperationseBPFMonitoringhttps://www.chenshaowen.com/en/blog/hijack-docker-io-req-to-private-repository.htmlMon, 18 Jul 2022 00:00:00 +0000Mon, 18 Jul 2022 00:00:00 +0000https://www.chenshaowen.com/en/blog/hijack-docker-io-req-to-private-repository.html1. Self-signing a *.docker.io Domain Certificate 1.1 Creating a CA Certificate Generate the CA certificate private key 1 openssl genrsa -out ca.key 4096 Generate the CA certificate 1 2 3 4 openssl req -x509 -new -nodes -sha512 -days 3650 \ -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=chenshaowen.com" \ -key ca.key \ -out ca.crt 1.2 Creating a *.微信公众号JenkinsKubernetesDockerImagesOperationsSecurityhttps://www.chenshaowen.com/en/blog/a-image-management-and-distribution-case-based-on-harbor-and-registry.htmlSat, 16 Jul 2022 00:00:00 +0000Sat, 16 Jul 2022 00:00:00 +0000https://www.chenshaowen.com/en/blog/a-image-management-and-distribution-case-based-on-harbor-and-registry.html1. The Challenge of a Cross-Region Harbor If all you need is to store image data in a simple way, Registry is an excellent choice as an image repository. Registry not only supports multiple storage backends, but can also be configured with HTTPS certificates and access credentials. Worth noting: Harbor微信公众号HarborRegistryImagesDistributionKubernetesOperationsLearningMulti-RegionAccelerationCICDhttps://www.chenshaowen.com/en/blog/how-to-deploy-the-elasticsearch-stack-on-kubernetes.htmlWed, 06 Jul 2022 00:00:00 +0000Wed, 06 Jul 2022 00:00:00 +0000https://www.chenshaowen.com/en/blog/how-to-deploy-the-elasticsearch-stack-on-kubernetes.htmlIf you use Logstash to centrally receive the log input from Filebeat, it easily creates a single point of bottleneck; if you use Kafka to receive the log input from Filebeat, the timeliness of the logs is not guaranteed. Here we output the logs collected by Filebeat directly to Elasticsearch.微信公众号KubernetesElasticsearchLoggingOperationsELKMonitoringhttps://www.chenshaowen.com/en/blog/how-to-set-up-pod-to-run-to-a-specified-node.htmlMon, 27 Jun 2022 00:00:00 +0000Mon, 27 Jun 2022 00:00:00 +0000https://www.chenshaowen.com/en/blog/how-to-set-up-pod-to-run-to-a-specified-node.html1. Specify a Node via nodeSelector When Creating a Workload Add a label to the node 1 kubectl label node node2 project=A Create the workload with the specified nodeSelector 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 cat <<EOF | kubectl apply -f - apiVersion: apps/v1 kind: Deployment metadata: name: nginx-nodeselector spec: replicas: 1 selector: matchLabels: app: nginx-nodeselector template: metadata: labels: app: nginx-nodeselector spec: nodeSelector: project: A containers: - name: nginx image: nginx EOF Check the workload 1 2 3 4 kubectl get pod -o wide NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES nginx-nodeselector-7bb75b7687-7r5xk 1/1 Running 0 19s 10.微信公众号PodKubernetesSchedulingOperationsnodeSelectorLearninghttps://www.chenshaowen.com/en/blog/descheduler-makes-kubernetes-load-more-balanced.htmlSat, 11 Jun 2022 00:00:00 +0000Sat, 11 Jun 2022 00:00:00 +0000https://www.chenshaowen.com/en/blog/descheduler-makes-kubernetes-load-more-balanced.html1. Why Secondary Scheduling Is Needed The job of the Kubernetes scheduler is to bind a Pod to a single best node. To do this, the scheduler runs through a series of filtering and scoring steps. Kubernetes scheduling is based on Requests, but the actual usage of each Pod changes dynamically.微信公众号KubernetesdeschedulerSchedulingOperationshttps://www.chenshaowen.com/en/blog/how-to-insight-the-pipeline-of-tekton.htmlTue, 07 Jun 2022 00:00:00 +0000Tue, 07 Jun 2022 00:00:00 +0000https://www.chenshaowen.com/en/blog/how-to-insight-the-pipeline-of-tekton.html1. Scraping Tekton Metrics Add a ConfigMap configuration file 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 cat <<EOF | kubectl apply -f - apiVersion: v1 kind: ConfigMap metadata: name: config-observability namespace: tekton-pipelines labels: app.kubernetes.io/instance: default app.kubernetes.io/part-of: tekton-pipelines data: metrics.backend-destination: prometheus metrics.taskrun.level: "task" metrics.微信公众号KubernetesTektonMonitoringMetricsCICDOperationshttps://www.chenshaowen.com/en/blog/how-to-collect-labels-and-annotations-of-kubernetes-objects.htmlThu, 02 Jun 2022 01:00:00 +0000Thu, 02 Jun 2022 01:00:00 +0000https://www.chenshaowen.com/en/blog/how-to-collect-labels-and-annotations-of-kubernetes-objects.html1. Why kube-status-metrics is needed Kubernetes monitoring mainly focuses on two kinds of metrics: Basic performance metrics CPU, memory, disk, network, and so on. These can be collected by deploying node-exporter as a DaemonSet and having Prometheus scrape the relevant metrics. Resource object metrics The replica count of a Deployment, the running state of a Pod, and so on.微信公众号KubernetesMonitoringMetricsCollectionPrometheusOperationsLearningObservabilitykube-status-metricshttps://www.chenshaowen.com/en/blog/a-global-images-distribution-network.htmlSun, 27 Mar 2022 14:00:00 +0000Sun, 27 Mar 2022 14:00:00 +0000https://www.chenshaowen.com/en/blog/a-global-images-distribution-network.html1. Global Network Planning Many global, multi-region infrastructures do not put much thought into network planning at the outset. Once the business grows complex enough, they are forced into network adjustments and optimization. Yet any major network change has a huge impact on the business. In the end you are stuck in a dilemma, able to do nothing but invest more people, carry the baggage of history, and walk along the edge of a cliff again and again.微信公众号ImagesHarborNetworkKubernetesOperationsDistributionMulti-RegionLearninghttps://www.chenshaowen.com/en/blog/manage-multiple-prometheus-using-thanos.htmlTue, 22 Mar 2022 00:00:00 +0000Tue, 22 Mar 2022 00:00:00 +0000https://www.chenshaowen.com/en/blog/manage-multiple-prometheus-using-thanos.html1. Layering of Monitoring As shown above, when building a monitoring system, two strategies are used: Layered monitoring. The benefit of separating IaaS, MySQL middleware, and App layer monitoring is that the systems have high availability and fault tolerance between them. When App layer monitoring stops working, IaaS layer monitoring微信公众号ThanosPrometheusMonitoringStorageKubernetesOperationshttps://www.chenshaowen.com/en/blog/common-commands-for-cleaning-up-kubernetes-cluster-resources.htmlWed, 08 Dec 2021 00:00:00 +0000Wed, 08 Dec 2021 00:00:00 +0000https://www.chenshaowen.com/en/blog/common-commands-for-cleaning-up-kubernetes-cluster-resources.htmlClusters that run for a long time often face various kinds of resource exhaustion. On top of that, when disk space runs low, Kubelet will proactively clean up images on its own, adding another source of uncertainty. This article provides some command snippets for cleanup work. 1. Cleaning Up Basic Kubernetes Objects Clean up Pods in Evicted state 1 sudo kubectl get pods --all-namespaces -o wide | grep Evicted | awk '{print $1,$2}' | sudo xargs -L1 kubectl delete pod -n Clean up Pods in Error state 1 sudo kubectl get pods --all-namespaces -o wide | grep Error | awk '{print $1,$2}' | sudo xargs -L1 kubectl delete pod -n Clean up Pods in Completed state 1 sudo kubectl get pods --all-namespaces -o wide | grep Completed | awk '{print $1,$2}' | sudo xargs -L1 kubectl delete pod -n Clean up unused PVs 1 sudo kubectl describe -A pvc | grep -E "^Name:.微信公众号KubernetesPracticeCleanupOperationsLearningkubectlTroubleshootingResource Managementhttps://www.chenshaowen.com/en/blog/multi-cluster-applications-under-kubevela.htmlFri, 17 Sep 2021 00:00:00 +0000Fri, 17 Sep 2021 00:00:00 +0000https://www.chenshaowen.com/en/blog/multi-cluster-applications-under-kubevela.htmlKubevela is currently at version 1.1. We usually consider 1.x releases to be relatively stable and safe to try in production. Through continuous tracking and learning, I have also come to appreciate some of the things Kubevela does well. This is a summary document. 1. What Problem Kubevela Solves Aimed at platform developers Several roles need to be distinguished: development, operations, and operations development.微信公众号KubevelaKubernetesApplicationOperationsMulti-ClusterOAMLearningCloud Nativehttps://www.chenshaowen.com/en/blog/the-monitor-of-kubernetes-using-prometheus-grafana.htmlFri, 03 Sep 2021 00:00:00 +0000Fri, 03 Sep 2021 00:00:00 +0000https://www.chenshaowen.com/en/blog/the-monitor-of-kubernetes-using-prometheus-grafana.htmlThe Prometheus community moves so fast that some of the documents I wrote earlier have become outdated. I’ve recently started paying attention to observability again, filling in some of the gaps in my operations knowledge. 1. Terminology Grafana A visualization tool that provides a variety of visualization panels and supports many data sources, including Prometheus, OpenTSDB, MySQL, and others.微信公众号PrometheusGrafanaKubernetesMonitoringOperationsObservabilityhttps://www.chenshaowen.com/en/blog/a-gateway-under-kubernetes-named-apisix.htmlWed, 01 Sep 2021 00:00:00 +0000Wed, 01 Sep 2021 00:00:00 +0000https://www.chenshaowen.com/en/blog/a-gateway-under-kubernetes-named-apisix.html1. Comparing a Few Common Gateways Nginx, a reverse proxy with a modular design, written in C OpenResty, a web development platform built around Nginx that can parse and execute Lua scripts Kong, an application on top of OpenResty, an API gateway with API management and request proxying, using PostgreSQL for storage APISIX, which replaces Kong’s PostgreSQL with Etcd and is built on Nginx’s core libraries APISIX’s advantage lies in the API management and extensibility it provides, so the gateway no longer merely forwards traffic to services but can be configured and customized.微信公众号KubernetesAPISIXMicroservicesGatewayOperationsProxyLearningCloud Nativehttps://www.chenshaowen.com/en/blog/a-cicd-system-based-on-tekton.htmlWed, 25 Aug 2021 00:00:00 +0000Wed, 25 Aug 2021 00:00:00 +0000https://www.chenshaowen.com/en/blog/a-cicd-system-based-on-tekton.html1. Background 1.1 Problems with the Current Use of Jenkins The orchestration engine is unstable Jenkins is an orchestration engine written in Java, and it stops the world (STW) during a full GC. Under large-scale builds, STW can prevent Jenkins from handling new requests. Heavy builds stall Jenkins stores data in disk files; every pipeline and every build occupies a file directory, producing a huge number of files.微信公众号CICDDevOpsTektonKubernetesOperationsPipelineLearninghttps://www.chenshaowen.com/en/blog/using-kubefed-to-distribute-tekton-resource-cross-cluster.htmlSat, 26 Jun 2021 00:00:00 +0000Sat, 26 Jun 2021 00:00:00 +0000https://www.chenshaowen.com/en/blog/using-kubefed-to-distribute-tekton-resource-cross-cluster.html1. The Advantages of Multi-Cluster Tekton Builds Thanks to Kubernetes, Tekton already has good elasticity and can support large-scale builds. At the same time, developing Tasks mainly uses Yaml and Shell, which widens the range of scenarios Tekton can adapt to. The figure above is a sketch of Tekton across multiple clusters.微信公众号TektonKubeFedKubernetesMulti-ClusterCICDOperationsLearningPipelineBuildDistributed Systemshttps://www.chenshaowen.com/en/blog/how-to-implement-approval-function-in-tekton.htmlThu, 24 Jun 2021 00:00:00 +0000Thu, 24 Jun 2021 00:00:00 +0000https://www.chenshaowen.com/en/blog/how-to-implement-approval-function-in-tekton.html1. Basic Features of a CICD Platform A common CICD engine is not suitable to hand directly to the business side. The main reasons are the high learning cost for users, the lack of necessary authentication, and the difficulty of maintenance and upgrades. We usually build on top of a process engine, adapting it to the business to improve usability and encapsulating it for specific scenarios to reduce complexity.微信公众号TektonKubernetesCICDDevOpsOperationshttps://www.chenshaowen.com/en/blog/how-to-configure-networkpolicy-for-nodeport.htmlWed, 23 Jun 2021 00:00:00 +0000Wed, 23 Jun 2021 00:00:00 +0000https://www.chenshaowen.com/en/blog/how-to-configure-networkpolicy-for-nodeport.html1. Background As shown above, the business team needs to isolate the services in a namespace, forbidding access from workloads in the bar namespace while allowing users to reach the service through a Load Balancer (LB) via NodePort. It is easy to write a network policy: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 apiVersion: networking.微信公众号NetworkPolicyNetworkKubernetesOperationsSecurityLearningNodePortNetwork Isolationhttps://www.chenshaowen.com/en/blog/can-we-mount-var-lib-docker-to-remote-storage.htmlTue, 22 Jun 2021 00:00:00 +0000Tue, 22 Jun 2021 00:00:00 +0000https://www.chenshaowen.com/en/blog/can-we-mount-var-lib-docker-to-remote-storage.htmlNo. 1. Background When building a reliable, stable operations system on top of Kubernetes, destroying and creating virtual machines (VMs) is the norm. VMs provide compute and memory resources, while external storage is exposed to PVCs in the cluster through a StorageClass. Against this backdrop, how to initialize a VM quickly becomes a new challenge.微信公众号DockerContainersStorageKubernetesCan Wehttps://www.chenshaowen.com/en/blog/network-policy-of-kubernetes.htmlTue, 18 May 2021 00:00:00 +0000Tue, 18 May 2021 00:00:00 +0000https://www.chenshaowen.com/en/blog/network-policy-of-kubernetes.html1. Network Isolation in Kubernetes Kubernetes introduced Network Policy in 1.3. It defines entities through ipBlock, podSelector, and namespaceSelector, and controls their From (Ingress) and To (Egress) traffic behavior. But Kubernetes only defines the network policy; the actual implementation depends on the network plugin. Today, network plugins such as Calico, Cilium, and Weave Net all support network isolation.微信公众号KubernetesNetwork IsolationNetworkPolicyOperationshttps://www.chenshaowen.com/en/blog/how-to-add-physical-machines-to-tekton.htmlWed, 28 Apr 2021 00:00:00 +0000Wed, 28 Apr 2021 00:00:00 +0000https://www.chenshaowen.com/en/blog/how-to-add-physical-machines-to-tekton.html1. Why Physical Build Machines Are Needed In the article How to Add a Remote macOS Physical Machine for Jenkins Pipeline Builds, I described how to add a physical build machine in Jenkins. This was not a requirement I made up on a whim — at the time, real ToB commercial customers were actually asking for a solution.微信公众号TektonCloud NativeKubernetesCICDDevOpsOperationshttps://www.chenshaowen.com/en/blog/how-to-distribute-files-and-scripts-to-vm-under-kubernetes.htmlSat, 24 Apr 2021 00:00:00 +0000Sat, 24 Apr 2021 00:00:00 +0000https://www.chenshaowen.com/en/blog/how-to-distribute-files-and-scripts-to-vm-under-kubernetes.html1. What This Article Mainly Discusses Never build a high tower on shifting sand. Business growth and the evolution of business forms both need solid, powerful IT systems to support them. Business content is transparent to the market, but IT systems cannot be built to perfection overnight. In the future, competition between companies will mainly come from competition between their IT systems, and the ability to respond quickly to business requirements will be the key to winning.微信公众号KubernetesDockerPaaSOperationsConfiguration ManagementVirtual MachinesLearningCloud Nativehttps://www.chenshaowen.com/en/blog/how-to-build-istio-under-centos.htmlThu, 08 Apr 2021 00:00:00 +0000Thu, 08 Apr 2021 00:00:00 +0000https://www.chenshaowen.com/en/blog/how-to-build-istio-under-centos.htmlThis article mainly describes how to build the https://github.com/istio/istio project on CentOS 8.2 using local tools. Another approach is to use the BUILD_WITH_CONTAINER parameter to build inside a container, which depends only on make and docker. 1. Install and Upgrade Ruby >= 2.6 Install Ruby 1 yum install -y ruby Check the Ruby version 1 2 3 ruby -v ruby 2.微信公众号CentOSIstioKubernetesOperationsLearningService MeshCompilationOpen Sourcehttps://www.chenshaowen.com/en/blog/the-road-to-open-source-for-tob.htmlTue, 30 Mar 2021 00:00:00 +0000Tue, 30 Mar 2021 00:00:00 +0000https://www.chenshaowen.com/en/blog/the-road-to-open-source-for-tob.html1. An Open-Source-Centric Business Model One of the charms of open source is its inclusiveness. It accepts people with all kinds of intentions — the engineer obsessed with technology, the merchant with ulterior motives, the volunteer passionate about public welfare, even the casual bystander — all of them can collide and mingle here, forming a force.微信公众号Open SourceToBThoughtsKubeSphereKuberneteshttps://www.chenshaowen.com/en/blog/using-podman-to-build-images-under-kubernetes-and-jenkins.htmlThu, 25 Feb 2021 00:00:00 +0000Thu, 25 Feb 2021 00:00:00 +0000https://www.chenshaowen.com/en/blog/using-podman-to-build-images-under-kubernetes-and-jenkins.htmlIn principle, Jenkins can use Podman to build images in any Kubernetes cluster; this article uses Containerd as the example. 1. Dropping Docker Brings New Challenges to CICD In CICD scenarios, we often need to build and push images within a pipeline. In an earlier document, Creating Jenkins Slaves Dynamically on Kubernetes, I described how mounting the /var/run/docker.微信公众号JenkinsDevOpsCICDDockerKubernetesPodmanhttps://www.chenshaowen.com/en/blog/argocd-of-devops-tool-chain.htmlThu, 04 Feb 2021 00:00:00 +0000Thu, 04 Feb 2021 00:00:00 +0000https://www.chenshaowen.com/en/blog/argocd-of-devops-tool-chain.html1. What Problem Argo CD Solves 1.1 Starting from GitOps GitOps originated from a blog post published by Weaveworks in 2017: GitOps - Operations by Pull Request. In it, Alexis introduced a deployment approach that treats Git as the single source of truth. In GitOps practice, we need to define software infrastructure in a Git repository for management.微信公众号DevOpsArgoCDKubernetesCICDGitOpsOperationsLearningDeploymentBest Practiceshttps://www.chenshaowen.com/en/blog/attack-vectors-under-kubernetes.htmlFri, 22 Jan 2021 00:00:00 +0000Fri, 22 Jan 2021 00:00:00 +0000https://www.chenshaowen.com/en/blog/attack-vectors-under-kubernetes.htmlThis document is mainly meant to demonstrate the dangers of Docker privileged mode, so please proceed with caution. Users without CLI access can copy the example YAML and directly create cluster workloads such as Pod, Job, and DaemonSet to carry out the operations. 1. Directly Deleting All Resources If you can log in to the machine, pack your things, and run the command:微信公众号KubernetesSecurityAttack VectorsOperationsDockerTroubleshootinghttps://www.chenshaowen.com/en/blog/operate-host-in-container-and-debug-container-on-host.htmlMon, 11 Jan 2021 00:00:00 +0000Mon, 11 Jan 2021 00:00:00 +0000https://www.chenshaowen.com/en/blog/operate-host-in-container-and-debug-container-on-host.html1. A Strange Requirement My boss had a strange requirement: use a single kubeconfig file to fetch all kinds of host status information, such as the process list and process states. My first reaction was that he must not understand containers — how could anyone use them that way, and if you were going to use them that way, why use containers at all?微信公众号ContainersSecurityKubernetesDockerOperationshttps://www.chenshaowen.com/en/blog/the-concept-of-tekton-a-big-game.htmlSat, 12 Dec 2020 00:00:00 +0000Sat, 12 Dec 2020 00:00:00 +0000https://www.chenshaowen.com/en/blog/the-concept-of-tekton-a-big-game.html1. On the Aesthetics of CICD Tools In the document A Software Product Is the Output of a Team’s Capability, I mentioned that a software product is the delivery vehicle for a solution, and that its quality depends on the team’s understanding of the core problem. Only with a deep understanding of the domain can the delivered product have a chance of being good.微信公众号DevOpsTektonKubernetesCICDThoughtshttps://www.chenshaowen.com/en/blog/the-daemon-less-tools-of-kaniko.htmlFri, 11 Dec 2020 08:00:00 +0000Fri, 11 Dec 2020 08:00:00 +0000https://www.chenshaowen.com/en/blog/the-daemon-less-tools-of-kaniko.html1. daemon-less Image Build Tools 1.1 What Is a daemon-less Image Build Tool In a CICD pipeline, image builds come up often, and the conventional approach is to build with Docker in Docker or Docker out of Docker. For details, see: How to Use Docker in Docker In fact, to avoid monopolies and advance the industry, a unified OCI image format specification based on the Docker image format was defined long ago.微信公众号KanikoDevOpsImagesCICDKubernetesOperationshttps://www.chenshaowen.com/en/blog/how-to-use-docker-in-docker.htmlSat, 21 Nov 2020 00:00:00 +0000Sat, 21 Nov 2020 00:00:00 +0000https://www.chenshaowen.com/en/blog/how-to-use-docker-in-docker.html1. Typical Use Cases In CI, there is usually a CI Engine responsible for parsing the pipeline and controlling the whole build process, while the actual build is delegated to an Agent. Jenkins and GitLab both work this way. As shown below, there are many kinds of Agents that connect to the CI Engine.微信公众号DockerKubernetesContainersCICICDOperationsLearningDinDBuildJenkinshttps://www.chenshaowen.com/en/blog/how-to-get-the-real-ip-of-client-in-kubernetes.htmlFri, 20 Nov 2020 17:22:45 +0000Fri, 20 Nov 2020 17:22:45 +0000https://www.chenshaowen.com/en/blog/how-to-get-the-real-ip-of-client-in-kubernetes.htmlKubernetes relies on the kube-proxy component to implement Service communication and load balancing. In this process, because SNAT is used to translate the source address, a service in a Pod cannot obtain the real client IP address. This article mainly answers the question of how a workload in a Kubernetes cluster can obtain the real IP address of the client.微信公众号KubernetesIPNetworkOperationshttps://www.chenshaowen.com/en/blog/the-operation-guide-of-kubesphere-devops-3-0-pipeline.htmlWed, 14 Oct 2020 00:00:00 +0000Wed, 14 Oct 2020 00:00:00 +0000https://www.chenshaowen.com/en/blog/the-operation-guide-of-kubesphere-devops-3-0-pipeline.htmlThis post mainly covers how to operate and maintain a DevOps pipeline, and how to solve some common problems. The problems fall mainly into two categories: one is Kubernetes-related and fairly general in nature; the other is business-related and requires some understanding of the domain before you can solve problems微信公众号KubeSphereKubernetesDevOpsJenkinsOperationsCICDhttps://www.chenshaowen.com/en/blog/the-development-guide-of-kubesphere-devops-3-0-pipeline.htmlTue, 13 Oct 2020 00:00:00 +0000Tue, 13 Oct 2020 00:00:00 +0000https://www.chenshaowen.com/en/blog/the-development-guide-of-kubesphere-devops-3-0-pipeline.htmlKubeSphere DevOps consists of two parts: S2I and Pipeline. In the community, OpenShift provides an application packaging tool called S2I; for details, see Building Cloud-Native Applications with S2I . KubeSphere turned it into a service, using a CRD managed by a separate Operator, and its functionality is fairly self-contained. In 3.微信公众号KubeSphereKubernetesDevOpsJenkinsDevelopment EnvironmentR&DOperationshttps://www.chenshaowen.com/en/blog/how-to-integrate-kata-in-kubernetes-cluster.htmlSun, 30 Aug 2020 00:00:00 +0000Sun, 30 Aug 2020 00:00:00 +0000https://www.chenshaowen.com/en/blog/how-to-integrate-kata-in-kubernetes-cluster.html1. What Problem Kata Solves Security and isolation are what make Kata Container stand out from Docker Container. Kata Container comes from the merger of the Intel Clear Containers and Hyper runV projects. Intel Clear Containers used Intel VT-x technology to provide containers through lightweight virtual machines, solving the security problem while delivering excellent performance.微信公众号KubernetesKataContainersSecurityOperationsVirtualizationhttps://www.chenshaowen.com/en/blog/how-to-use-terraform-to-provide-iac-platform.htmlSat, 22 Aug 2020 00:00:00 +0000Sat, 22 Aug 2020 00:00:00 +0000https://www.chenshaowen.com/en/blog/how-to-use-terraform-to-provide-iac-platform.html1. Terraform Vs Kubernetes Infrastructure as Code (Iac) is built on immutable infrastructure: it uses orchestration tools to turn infrastructure into text, so you can manage infrastructure the way you manage code. In 2018 I was working on SaaS development, deploying on the Kubernetes platform, and that was the year Terraform was very hot.微信公众号TerraformIacKubernetesDevOpsCICDR&Dhttps://www.chenshaowen.com/en/blog/jenkins-x-is-not-jenkins-but-stack.htmlSun, 16 Aug 2020 00:00:00 +0000Sun, 16 Aug 2020 00:00:00 +0000https://www.chenshaowen.com/en/blog/jenkins-x-is-not-jenkins-but-stack.html1. Introduction to Jenkins X Relying on its massive plugin ecosystem, Jenkins currently holds most of the enterprise CICD engine market share. But in the cloud native era, Jenkins has also exposed many problems: a single point of service, disk storage, memory usage, and so on. Around Kubernetes, Jenkins X offers a DevOps approach better suited to the cloud native era.微信公众号Tech StackJenkinsJenkins-XKubernetesDevOpsCICDOperationshttps://www.chenshaowen.com/en/blog/the-use-of-etcd-and-etcdctl.htmlTue, 11 Aug 2020 00:00:00 +0000Tue, 11 Aug 2020 00:00:00 +0000https://www.chenshaowen.com/en/blog/the-use-of-etcd-and-etcdctl.html1. Basic Introduction to Etcd Etcd is a distributed Key/Value storage system. Through distributed locks, leader election, and write barriers it achieves distributed coordination, offering highly available, persistent data storage and retrieval services. How it works Every Etcd node stores a complete copy of the data, and at any moment微信公众号EtcdEtcdctlKubernetesOperationsLearningDistributed StorageConfigurationClusterhttps://www.chenshaowen.com/en/blog/the-stress-test-about-kubernetes-dynamically-creates-jenkins-agent.htmlSun, 02 Aug 2020 00:00:00 +0000Sun, 02 Aug 2020 00:00:00 +0000https://www.chenshaowen.com/en/blog/the-stress-test-about-kubernetes-dynamically-creates-jenkins-agent.htmlIn the previous document, we took advantage of the elasticity Kubernetes provides to dynamically create Jenkins Slaves on Kubernetes. This document is mainly a stress test of Jenkins under large-scale builds. 1. Cluster Configuration 1.1 Kubernetes Version The version used here is v1.16.7 1 2 3 4 kubectl version Client Version: version.微信公众号JenkinsKubernetesDevOpsCICDTestingOperationshttps://www.chenshaowen.com/en/blog/add-windows-node-for-k8s.htmlSat, 13 Jun 2020 00:00:00 +0000Sat, 13 Jun 2020 00:00:00 +0000https://www.chenshaowen.com/en/blog/add-windows-node-for-k8s.htmlHere a Windows node is used mainly as a Worker, while the Master control plane stays on Linux. 1. System Configuration 1.1 Kubernetes Control Plane Since version 1.14, Kubernetes has added production-grade support for Windows nodes. Because Microsoft’s official documentation mainly covers installing the flannel network plugin, it is recommended here that Kubernetes also use the flannel plugin.微信公众号KubernetesWindowsNodesInstallationOperationshttps://www.chenshaowen.com/en/blog/affinity-of-kubernetes-scheduler.htmlSat, 30 May 2020 00:00:00 +0000Sat, 30 May 2020 00:00:00 +0000https://www.chenshaowen.com/en/blog/affinity-of-kubernetes-scheduler.html1. The Scheduler in Kubernetes kube-scheduler is the component in Kubernetes that decides which Node a Pending Pod runs on; it is called the scheduler. Kubernetes ships with a large number of built-in scheduling policies and also provides some advanced scheduling policies (nodeAffinity, podAffinity, and so on) for users, which微信公众号KubernetesSchedulingAffinityLearningOperationshttps://www.chenshaowen.com/en/blog/dns-server-in-kubernetes.htmlFri, 24 Apr 2020 00:00:00 +0000Fri, 24 Apr 2020 00:00:00 +0000https://www.chenshaowen.com/en/blog/dns-server-in-kubernetes.html1. About DNS 1.1 What the DNS Service Is For DNS provides a mapping service from domain names to IPs. For example, you type https://www.chenshaowen.com into a browser to open a page, but the data link communicates over IP and cannot recognize www.chenshaowen.com. This is where a DNS lookup comes in: the input is www.微信公众号KubernetesDNSDomain NamesNetworkService Discoveryhttps://www.chenshaowen.com/en/blog/support-https-access-harbor-using-self-signed-cert.htmlSat, 18 Apr 2020 00:00:00 +0000Sat, 18 Apr 2020 00:00:00 +0000https://www.chenshaowen.com/en/blog/support-https-access-harbor-using-self-signed-cert.htmlIn an earlier post, Installing Harbor with Helm, I described in detail how to install Ingress and Harbor and finally push an image successfully. There the domain was publicly reachable and the certificate was issued by a certificate authority. In an intranet environment, however, we need to use an internal微信公众号HarborKubernetesHttpsImagesCertificatesOperationshttps://www.chenshaowen.com/en/blog/prow-of-devops-tool-chain.htmlFri, 17 Apr 2020 13:17:44 +0000Fri, 17 Apr 2020 13:17:44 +0000https://www.chenshaowen.com/en/blog/prow-of-devops-tool-chain.html1. About Prow In the GitHub repositories of well-known projects such as Kubernetes and Istio, we often see an xxx-bot user adding labels to issues and merging PRs. That bot account is driven by Prow. Prow is a project of the Kubernetes Testing Special Interest Group and is currently part of kubernetes/test-infra.微信公众号DevOpsProwKubernetesCICDhttps://www.chenshaowen.com/en/blog/backup-kubernetes-cluster-using-velero.htmlWed, 25 Dec 2019 00:00:00 +0000Wed, 25 Dec 2019 00:00:00 +0000https://www.chenshaowen.com/en/blog/backup-kubernetes-cluster-using-velero.html1. Introduction to Velero Velero is an open-source Kubernetes cluster backup and migration tool from the heptio team (acquired by VMWare). Velero stores cluster resources in object storage. It supports AWS, Azure, and GCP object storage by default, is compatible with the S3 protocol, and can be extended to other platforms such as Aliyun OSS through plugins.微信公众号KubernetesVeleroBackupOperationsLearningDisaster RecoveryMigrationClusterhttps://www.chenshaowen.com/en/blog/build-an-automated-test-system-using-kubernetes-and-jenkins.htmlThu, 12 Dec 2019 00:00:00 +0000Thu, 12 Dec 2019 00:00:00 +0000https://www.chenshaowen.com/en/blog/build-an-automated-test-system-using-kubernetes-and-jenkins.html1. Test Layering The purpose of testing is to verify expected behavior and uncover latent defects. Testing strengthens confidence that a qualified product can be delivered, and it is what makes agile iteration possible. You could say that testing determines the development pace of a product. The network model has the seven-layer OSI and the four-layer TCP, while development patterns include MTV, MVC, MVP, MVVM, and so on.微信公众号TestingAutomationKubernetesJenkinsDevOpsCICDOperationshttps://www.chenshaowen.com/en/blog/creating-jenkins-slave-dynamically-on-kubernetes.htmlFri, 06 Dec 2019 00:00:00 +0000Fri, 06 Dec 2019 00:00:00 +0000https://www.chenshaowen.com/en/blog/creating-jenkins-slave-dynamically-on-kubernetes.html1. Jenkins Working Modes Jenkins has a single-Master, multi-Slave architecture. The Master assigns tasks and manages services. Slaves execute the actual tasks. Even when multiple Masters are deployed, they remain independent of one another and cannot coordinate scheduling. A high-availability Jenkins solution requires an external task distribution framework, such as微信公众号JenkinsKubernetesCICDDevOpsOperationshttps://www.chenshaowen.com/en/blog/basic-operation-of-deployment-in-kubernetes.htmlFri, 27 Sep 2019 00:00:00 +0000Fri, 27 Sep 2019 00:00:00 +0000https://www.chenshaowen.com/en/blog/basic-operation-of-deployment-in-kubernetes.htmlA Deployment controls the number and state of Pods by creating ReplicaSets. This post mainly introduces some common Deployment operations. 1. Deployment yaml Format Passing the --dry-run flag means the command is not actually executed, only YAML output is generated: 1 kubectl create deployment nginx --image=nginx --dry-run -o yaml apiVersion: apps/v1 kind: Deployment metadata: creationTimestamp: null labels: app: nginx name: nginx spec: replicas: 1 selector: matchLabels: app: nginx strategy: {} template: metadata: creationTimestamp: null labels: app: nginx spec: containers: - image: nginx name: nginx resources: {} status: {} 2.微信公众号KubernetesDeploymentDeploymentLearningOperationshttps://www.chenshaowen.com/en/blog/how-to-develop-a-operator-using-kubebuilder.htmlWed, 25 Sep 2019 00:00:00 +0000Wed, 25 Sep 2019 00:00:00 +0000https://www.chenshaowen.com/en/blog/how-to-develop-a-operator-using-kubebuilder.htmlWith the Operator approach, Kubernetes functionality can be extended in a friendly way. Operator = CRD + Controller. First you generate the CRD from a yaml definition, then the Controller continuously watches the data in etcd and performs the corresponding actions. There is a lot of tedious and repetitive work involved in developing an Operator.微信公众号KubernetesGoOperatorR&DOperationsCRDLearninghttps://www.chenshaowen.com/en/blog/an-enterprise-class-registry-of-harbor.htmlThu, 12 Sep 2019 00:00:00 +0000Thu, 12 Sep 2019 00:00:00 +0000https://www.chenshaowen.com/en/blog/an-enterprise-class-registry-of-harbor.html1. Requirements for Building Harbor Harbor hardware requirements: CPU, at least 2 cores, 4 cores is better Mem, at least 4 GB, 8 GB is better Disk, at least 40 GB, 160 GB is better Docker version requirements: 17.06.0 or later To build Harbor on Kubernetes, you can refer to the documentation, Building Harbor with Helm.微信公众号HarborImagesContainersKubernetesOperationshttps://www.chenshaowen.com/en/blog/using-emptydir-hostpath-localvolume-in-kubernetes.htmlSat, 24 Aug 2019 00:00:00 +0000Sat, 24 Aug 2019 00:00:00 +0000https://www.chenshaowen.com/en/blog/using-emptydir-hostpath-localvolume-in-kubernetes.htmlEarlier, in Kubernetes Volumes, we got some understanding of Volumes. This post focuses on practice, learning how to use the three local storage options: emptydir, hostpath, and localvolume. 1. Basic Properties of a PV 1.1 PV Lifecycle PV states: Available: available, not yet bound by any PVC Bound: already bound to a PVC Released: the PVC was deleted, but the resource has not yet been reclaimed Failed: automatic reclamation failed 1.微信公众号KubernetesVolumeStorageOperationsPVCLearninghttps://www.chenshaowen.com/en/blog/kubernetes-cluster-operations-practices.htmlThu, 22 Aug 2019 00:00:00 +0000Thu, 22 Aug 2019 00:00:00 +0000https://www.chenshaowen.com/en/blog/kubernetes-cluster-operations-practices.htmlCompiled from the “Development Tips” series, gathering the common problems and solutions from day-to-day Kubernetes cluster operations. 1. Configuring Multiple Clusters with Kubectl When doing Kubernetes-related development you usually end up managing several clusters. Kubectl provides multi-cluster context management. Kubectl’s configuration usually lives in $HOME/.kube/config or /etc/kubernetes/admin.conf. Log into the machine, look at the cluster configuration, and edit it using the format below.微信公众号KubernetesOperationsR&DkubectlHelmhttps://www.chenshaowen.com/en/blog/using-kubeadm-to-install-the-kubernetes-cluster.htmlThu, 15 Aug 2019 00:00:00 +0000Thu, 15 Aug 2019 00:00:00 +0000https://www.chenshaowen.com/en/blog/using-kubeadm-to-install-the-kubernetes-cluster.html1. Cluster Planning Prepare three hosts: one Master and two Nodes. Operating system: CentOS 7 Specs: 2 Core 4 GB Docker version: 18.06.3 Kubernetes version: 1.15.3 If you are using a purchased cloud host, open the following ports: 1 2 3 4 5 6 7 8 9 10 11 12微信公众号KubernetesKubeadmInstallationOperationsClusterLearninghttps://www.chenshaowen.com/en/blog/complex-application-management-framework-operator-for-kubernetes.htmlThu, 25 Jul 2019 00:00:00 +0000Thu, 25 Jul 2019 00:00:00 +0000https://www.chenshaowen.com/en/blog/complex-application-management-framework-operator-for-kubernetes.html1. Origins Originally, two CoreOS employees, in order to make deploying etcd clusters easier, bound corresponding logical operations to the create, delete, and update events of the etcdCluster object, using Kubernetes to automate etcd cluster management. A few months later, at a KubeCon conference, they shared this approach, which they called Operator, and it received a strong response from the community.微信公众号KubernetesHelmPracticeOperatorOperationsStateful ApplicationsLearninghttps://www.chenshaowen.com/en/blog/package-manager-helm-of-kubernetes.htmlWed, 24 Jul 2019 00:00:00 +0000Wed, 24 Jul 2019 00:00:00 +0000https://www.chenshaowen.com/en/blog/package-manager-helm-of-kubernetes.html1. Why Helm Is Needed One important design philosophy in Kubernetes is declarative operation. Users change the system by setting the system’s expected state. For example, the current replica count is 2 and it needs to be adjusted to 3. The declarative way is to modify the replica count in微信公众号KubernetesHelmPracticeOperationsPackage ManagementLearningChartDeploymenthttps://www.chenshaowen.com/en/blog/practice-guide-to-kubectl.htmlFri, 19 Jul 2019 01:00:00 +0000Fri, 19 Jul 2019 01:00:00 +0000https://www.chenshaowen.com/en/blog/practice-guide-to-kubectl.html1. What Is kubectl kubectl is the command-line tool for Kubernetes. It interacts with the cluster through the API server. 2. Configuring kubectl kubectl can be configured through ~/.kube/config to connect to one or more clusters. For details on how to configure it, see: Configure Access to Multiple Clusters. If you need to configure a remote cluster, see: Building a Remote Kubernetes Development Environment.微信公众号KuberneteskubectlPracticeLearningOperationshttps://www.chenshaowen.com/en/blog/open-k8s-monitoring-and-stress-testing..htmlMon, 24 Sep 2018 00:00:00 +0000Mon, 24 Sep 2018 00:00:00 +0000https://www.chenshaowen.com/en/blog/open-k8s-monitoring-and-stress-testing..html1. Kubectl Basic Commands 1.1 Creating Objects 1 2 3 4 5 6 7 8 # Create resources; a remote URL also works kubectl create -f ./my.yaml # Create resources from multiple files kubectl create -f ./my1.yaml -f ./my2.yaml # Create resources using all manifest files in a directory kubectl create -f .微信公众号KubernetesTestingMonitoringOperationsLearningkubectlStress TestingObservabilityhttps://www.chenshaowen.com/en/blog/how-to-use-minikube-under-windows7.htmlSun, 23 Sep 2018 00:00:00 +0000Sun, 23 Sep 2018 00:00:00 +0000https://www.chenshaowen.com/en/blog/how-to-use-minikube-under-windows7.html1. Basic Concepts 1.1 Kubernetes Kubernetes (K8s for short), the successor to Google’s Borg, is an open-source system for automatically deploying, scaling, and managing containerized applications. The features it provides: Automated deployment of containers Automated scaling up and down Automated application/service upgrades Grouping containers to serve traffic externally, with load balancing support Health checks for services, with automatic restarts 1.微信公众号DockerKubernetesWindowsMiniKubeLearningOperations