Ingress 自动签 Let's Encrypt 证书

众所周知,因为 HTTPS 的高安全性,现在很多互联网服务已经拒绝 HTTP 介入,以下介绍给 K8S 内置出的 Ingress 签发证书

安装 cert-manager

  • 添加 Helm 源
1
2
helm repo add jetstack https://charts.jetstack.io
helm repo update
  • 安装 cert-manager
1
2
3
4
5
6
helm install \
  cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --create-namespace \
  --version v1.11.0 \
  --set installCRDs=true

创建 Let’s Encrypt Prod

创建 letsencrypt-clusterissuer.yaml 文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: [email protected]
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          class: ingress-gce

1
kubectl apply -f clusterissuer.yaml

创建Ingress 服务

创建 test-ingress.yaml

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: test-web
  namespace: default
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod #这里指定证书签署服务
    acme.cert-manager.io/http01-edit-in-place: "true" #这里设置是否签署证书
spec:
  tls:
  - hosts:
    - example.com #这个是要签署的域名
    secretName: example-tls #给这个证书起个名字
  rules:
  - host: example.com #这个是要签署的域名
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: test-web-service #后端Service名
            port:
              number: 8080 #后端Service端口
1
kubectl apply -f test-ingress.yaml

展开全文 >>

用Python写一个简单的Telegram Bot

引言

随着国内的互联网环境越来越差,越来越多的人转移到了国外更开放安全的聊天平台,Telegram是首选,Telergam的功能强大,Sticker,Group,Channel和Bot系统让人爱不释手,今天有兴趣就用Python写了一个Todolist Bot,下面分享一下开发过程

注册bot

在Telegram里找到Bot Father注册一个Bot

搭建环境

Telegram如此著名,当然有和多封装好的python库,我选用了python-telegram-bot

  • 安装依赖

    1
    pip installl python-telegram-bot

  • 来一个Hello World

    1
    2
    3
    4
    5
    6
    7
    8
    from telegram.ext import Updater
    TOKEN='#id:#token'
    def message(bot, update):
        update.message.reply_text('Hello World!')
    updater = Updater(token=TOKEN)
    updater.dispatcher.add_handler(MessageHandler(Filters.text,message))
    updater.start_polling()
    updater.idle()

至此,一个最简的环境搭起来了
上面的代码是这样工作的

  1. 创建了一个updater,用来接受telegram的update事件
  2. 注册一个消息事件回调,所有接收到的消息都会走MessageHandler,Filters.text过滤只接受text类型事件,当有消息发来之后调用message方法, 收到message之后,调用update.message.reply_text(‘Hello World!’)回复一条消息
  3. updater.start_polling()启动接受消息
  4. updater.idle()保证进程一直处于活跃状态

当然,它现在什么也做不了,只能永远说Hello world,下面我们,来扩充他

监听多样回调

Python Telegram Bot库提供了多样的Handler,可以在telegram.ext中找到.具体可以查看官方文档
下面监听一个Bot首次启动的事件,/start命令

1
2
3
4
5
6
7
8
from telegram.ext import Updater
TOKEN='#id:#token'
def start(bot, update):
    update.message.reply_text('Welcome To Woody Todo List Manager')
updater = Updater(token=TOKEN)
updater.dispatcher.add_handler(CommandHandler('start',start))
updater.start_polling()
updater.idle()

如果只能回复文字,也许就没人用Telegram的Bot了,它还可以回复Sticker,File,Image,Audio,Video等所有Telegram支持的聊天对象和一些Bot专属聊天对象,下面填加一个Keyboard的回复

1
2
3
4
5
6
7
8
9
10
from telegram.ext import Updater
TOKEN='#id:#token'
def start(bot, update):
    key = InlineKeyboardButton('Create A New Todo List', callback_data=f'new')
    keyboard = InlineKeyboardMarkup([[key]])
    update.message.reply_text('Welcome To Woody Todo List Manager',reply_markup=keyboard)
updater = Updater(token=TOKEN)
updater.dispatcher.add_handler(CommandHandler('start',start))
updater.start_polling()
updater.idle()

keyboard接受的是一个二维数组,在用户端显示一个Key矩阵,可以灵活定义布局
现在的按钮点击之后没有任何反应,添加一个按钮回调的事件

1
2
3
4
5
6
def callback_query(bot,update):
    user=update.callback_query.from_user
    cmd=update.callback_query.data
    bot.send_message(user.id, cmd')
    update.callback_query.answer('OK')
updater.dispatcher.add_handler(CallbackQueryHandler(callback_query))

可以通过修改消息得到交互式按钮

1
2
3
4
5
6
7
8
def callback_query(bot,update):
    user=update.callback_query.from_user
    cmd=update.callback_query.data
    key = InlineKeyboardButton('Thank You', callback_data=f'new')
    keyboard = InlineKeyboardMarkup([[key]])
    bot.edit_message_reply_markup(inline_message_id=update.callback_query.inline_message_id,reply_markup=keyboard)
    update.callback_query.answer('OK')
updater.dispatcher.add_handler(CallbackQueryHandler(callback_query))

Bot也可以推送一个键盘到你的输入框
ReplyKeyboardMarkup

1
2
3
4
5
6
7
def start(bot, update):
    key = KeyboardButton('Create A New Todo List', callback_data=f'new')
    keyboard = ReplyKeyboardMarkup([[key]])
    update.message.reply_text('Welcome To Woody Todo List Manager',reply_markup=keyboard)
updater = Updater(token=TOKEN)
updater.dispatcher.add_handler(CommandHandler('start',start))
updater.start_polling()

Inline Mode

Telegram还有一种Inline mode,用于输入框内调用bot
首先找到Botfather,输入/setinline开启inline模式
然后可以通过InlineQueryHandler取到inline输入

1
2
3
4
5
6
7
8
def inline(bot,update):
        user = update.inline_query.from_user
        a=db.query(Topic).filter_by(main_user=user.id).order_by(Topic.id.desc()).all()
        key = InlineKeyboardButton('Thank You', callback_data=f'new')
        keyboard = InlineKeyboardMarkup([[key]])
        r=InlineQueryResultArticle('id','tile','content',reply_markup=key)
        update.inline_query.answer([r],switch_pm_text='Create A New Todo List',switch_pm_parameter='new',cache_time=0)
updater.dispatcher.add_handler(CallbackQueryHandler(InlineQueryHandler(inline))

至此,Telegram Bot基本可以入门了,通过每次请求可以获得用户id,再结合数据库就可以做一个基于用户id的上下文,用来分用户输出,进而扩展成一个足够复杂的系统
当然,Telegram Bot的功能非常多,这仅仅是一个非常简单的Hello World更多的功能参考官方文档和Python Telegram Bot文档

展开全文 >>

基于 Celery 的简易的分布式程序架构

关于 Celery

引用自 Celery 官方

  1. Celery 是一个简单、灵活且可靠的，处理大量消息的分布式系统，并且提供维护这样一个系统的必需工具。
  2. 它是一个专注于实时处理的任务队列，同时也支持任务调度。
  3. Celery 是开源的，使用 BSD 许可证 授权。

Celery 基础知识

Celery 最重要的概念就是任务队列(Task Query),客户端(Client),中间件(Broker),存储后端(Backend),职程(Worker)

  • 任务队列用于跨线程或跨机器分配工作任务,任务队列保存在中间件中.
  • 客户端向中间件输入一个工作单元(Work Unit),职程时刻监视队列从中取出工作单元来执行.
  • 如果需要追踪和存储Task的运行结果,需要有一个backend,这个backend可以是redis,数据库,或者是Rabbitmq都可以
  • 职程执行完之后可以选择丢弃结果直接结束,或者将结果传回中间件,客户端可以通过任务id取回执行结果.
  • 职程也可以不需要客户端调用,初始化的时候自己运行一个定时任务
中间件(Broker)

Celery 中间件是用来存任务队列和任务返回的,Celery支持多种消息队列
下面是Celery原生支持的Broker类型

Name Status Monitoring Remote Control
RabbitMQ Stable Yes Yes
Redis Stable Yes Yes
Amazon SQS Stable No No
Zookeeper Experimental No No

下文都以RabbitMQ为例子

职程(Worker)

Celery Worke 是用来具体执行任务的进程,内部定义多个task执行方法,一个最简的Demo用法如下

1
2
3
4
5
6
7
8
9
10
11
from celery import Celery

app = Celery('proj',broker='pyamqp://[email protected]/')

@app.task(name='add')
def add(x, y):
    return x + y


if __name__ == '__main__':
    app.start()

启动方式如下

1
celery -A proj worker -l info

其中`@app.task是用来向app中注册方法,注册之后就可以取到名称为add的任务,app.task`的更多配置参数参考官方文档

客户端(Client)

Celery由Python实现的,但是任何语言都可以充当其客户端,例如node-celery和PHP client.

如果客户端和职程写在一个项目里,可以用如下方式调用

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
from celery import Celery

app = Celery('proj',broker='pyamqp://[email protected]/')

@app.task(name='add')
def add(x, y):
    return x + y

r = add.delay(1,2)
# r= add.apply_async((2, 2))
print(r.id)
print(r.state)
print(r.result)
if __name__ == '__main__':
    app.start()

如果客户端和职程不在一个项目里(一个合理的分布式项目就应该这样),可以用如下方式调用

1
2
3
4
5
6
from celery import Celery
app = Celery('proj',broker='pyamqp://[email protected]/')
r = celery.send_task('add', [1, 2])
print(r.id)
print(r.state)
print(r.result)

至此,一个简易的demo搭建完毕,复杂的参数参考官方文档

分布式架构

简易分布式架构图

上图是一个简易的Celery分布式架构.

  • Client用来发布任务,Worker用来执行任务,Broker用来存储Client发布的任务队列
  • Worker 将运算结果存储到Result Backend,Client可以去backend里查看task的状态
  • Broker是整个项目的单点,所以在选用Broker的时候要考虑其可靠性和可扩展性,目前来说,Celery支持的几种Broker都支持集群搭建,可以有效保证可靠性,下图是一个RabbitMQ的集群示意图
  • 每个Worker可以做相同的事,也可以做不同的事,达成集群和分布式的效果,多个Worker注册同一个task之后,会自动按照执行速度去获取任务
  • Worker 也可以充当Client继续发布任务,可以用来做流式处理

展开全文 >>

Centos 安装配置 OpenVPN

安装必须软件

  • 添加 Extra Packages for Enterprise Linux 库

    1
    yum install -y epel-release

  • 安装 OpenVPN 以及相关依赖

    1
    yum install -y openvpn lzo openssl pam

生成证书

  • 安装 EasyRSA 环境

    1
    2
    3
    wget "https://github.com/OpenVPN/easy-rsa/releases/download/3.0.1/EasyRSA-3.0.1.tgz"
    tar axvf EasyRSA-3.0.1.tgz
    cd EasyRSA-3.0.1

  • 制作根证书

    1
    2
    3
    4
    5
    6
    ./easyrsa init-pki # 初始化证书目录pki
    ./easyrsa build-ca nopass # 创建根证书，提示输入Common Name，名称随意，但是不能和服务端证书或客户端证书名称相同
    ./easyrsa gen-dh # 生成Diffle Human参数，它能保证密钥在网络中安全传输
    ./easyrsa build-server-full server nopass # server是服务端证书名称
    ./easyrsa build-client-full kaive nopass # kaive是客户端证书名称
    mv pki /etc/openvpn

配置 OpenVPN 服务端

  • 编辑 /etc/openvpn/server.conf
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    port 1194
    proto tcp
    dev tun
    ca /etc/openvpn/pki/ca.crt
    cert /etc/openvpn/pki/issued/server.crt
    key /etc/openvpn/pki/private/server.key
    dh /etc/openvpn/pki/dh.pem
    server 192.168.254.0 255.255.255.0 # 分配IP段
    ifconfig-pool-persist /etc/openvpn/ip.txt # 记录客户端和虚拟ip的映射关系
    push "redirect-gateway def1 bypass-dhcp" # 重定向客户端网关
    push "dhcp-option DNS 8.8.8.8" 
    client-to-client
    keepalive 10 120
    compress lz4-v2
    push "compress lz4-v2"
    user nobody
    group nobody
    persist-key
    persist-tun
    status /var/log/openvpn-status.log
    log /var/log/openvpn.log
    verb 3 # 日志等级

配置客户端

  • 创建文件client.ovpn
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    client
    dev tun
    remote {server ip}
    resolv-retry infinite
    nobind
    persist-key
    persist-tun
    ca [inline]
    cert [inline]
    key [inline]
    verb 1
    keepalive 10 120
    port 1194
    proto tcp
    cipher BF-CBC
    comp-lzo
    remote-cert-tls server
    <ca>
    -----BEGIN CERTIFICATE-----
    ca.crt内容
    -----END CERTIFICATE-----
    </ca>
    <cert>
    -----BEGIN CERTIFICATE-----
    client.crt内容
    -----END CERTIFICATE-----
    </cert>
    <key>
    -----BEGIN PRIVATE KEY-----
    client.key内容
    -----END PRIVATE KEY-----
    </key>

客户端导入配置文件即可

开启NAT

  • 配置iptables
    1
    2
    echo 1 > /proc/sys/net/ipv4/ip_forward
    iptables -t nat -A POSTROUTING -s 192.168.254.0/24 -o eth0 -j MASQUERADE

自此，一个完整的OpenVPN搭建完毕

展开全文 >>

Android C语言调用system失败原因

问题原因

最近使用C语言写一个不依赖Java的Android底层应用，一切正常，但是在调用system()函数时，总是会不报错跳过。
研究了很久，终于捕获到原因。

问题所在

查看了一下system函数的实现，发现猫腻所在

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
#include <sys/types.h>
#include <sys/wait.h>
#include <errno.h>
#include <unistd.h>
int system(const char * cmdstring)
{
    pid_t pid;
    int status;

    if(cmdstring == NULL){      
         return (1);
    }

    if((pid = fork())<0){
            status = -1;
    }
    else if(pid = 0){
        execl("/bin/sh", "sh", "-c", cmdstring, (char *)0);
        exit(127);
        }
    else{
           while(waitpid(pid, &status, 0) < 0){
                if(errno != EINTER){
                    status = -1;
                    break;
                }
            }
        }
        return status;
}

system实际上是fork和exec组合实现的，重点在于exec中指定了使用/bin/sh执行命令，但是Android的sh在/system/bin/sh里，所以这里会报错

问题解决

两种方法，重新实现system函数，修改exec里的参数，或者直接使用fork和exec来调用系统命令

展开全文 >>

CentOS7配置MariaDB+Galera+Nginx高可用数据库集群

1、安装基本组件

配置软件源

添加MariaDB源

1
2
3
4
5
[mariadb]
name = MariaDB
baseurl = http://yum.mariadb.org/10.1/centos7-amd64
gpgkey=https://yum.mariadb.org/RPM-GPG-KEY-MariaDB
gpgcheck=1

安装软件

安装相应的软件
yum install mariadb-server rsync

2、集群配置

配置hosts

编辑/etc/hosts

1
2
3
4
5
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.0.11 mariadb1
192.168.0.12 mariadb2
192.168.0.13 mariadb3

配置数据库

编辑/etc/my.cnf.d/server.cnf 中[galera]块，相应name与address修改为相应node的配置

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
[galera]
# Mandatory settings
wsrep_on=ON
wsrep_provider=/usr/lib64/galera/libgalera_smm.so
wsrep_cluster_address="gcomm://192.168.0.11,192.168.0.12,192.168.0.13"
binlog_format=row
default_storage_engine=InnoDB
innodb_autoinc_lock_mode=2
#
# Allow server to accept connections on all interfaces.
#
wsrep_cluster_name="mariadb_cluster"
bind-address=0.0.0.0
#
# Optional setting
#wsrep_slave_threads=1
#innodb_flush_log_at_trx_commit=0
#this server ip, change for each server
wsrep_node_address="192.168.0.11"
# this server name, change for each server
wsrep_node_name="mariadb1"
#
wsrep_sst_method=rsync
# this is only for embedded server

在一台node上执行
galera_new_clusterx

其他node执行
systemctl start mariadb

执行
mysql -u root -p -e "SHOW STATUS LIKE'wsrep_cluster_size'"
查看集群状态

然后执行
mysql_secure_installation
配置数据库安全选项

配置负载均衡

安装Nginx
yum install nginx

配置负载均衡，编辑/etc/nginx/nginx.conf与http{}同级加入以下内容

1
2
3
4
5
6
7
8
9
10
11
12
13
stream{
	upstream mariadb{
		server mariadb1:3306;
		server mariadb2:3306;
		server mariadb3:3306;
	}
	server {
	    listen        3306;
	    proxy_pass    mariadb;
	    health_check;
	    health_check_timeout 1s;
	}
}

应用配置
nginx -t&&systemctl reload nginx

展开全文 >>

Centos7配置Kubernetes集群

1、安装基本组件

安装软件

在所有Master与Node安装软件
etcd提供高可用的配置数据库
flannel负责集群之间的网络通信
yum install etcd flannel docker kubernetes

2、基本配置

系统配置

关闭firewalld

1
2
systemctl stop firewalld
systemctl disable firewalld

关闭selinux,编辑/etc/selinux/config

1
2
3
4
5
6
7
8
9
10
11
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of three two values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected. 
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

保存并重启电脑

配置Docker

因为国内连接dockerhub不畅，也许需要配置代理或者镜像服务器，并且关闭selinux配置，编辑/etc/sysconfig/docker

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
# Modify these options if you want to change the way the docker daemon runs
OPTIONS='--selinux-enabled=false --log-driver=journald --signature-verification=false'
if [ -z "${DOCKER_CERT_PATH}" ]; then
    DOCKER_CERT_PATH=/etc/docker
fi

# If you want to add your own registry to be used for docker search and docker
# pull use the ADD_REGISTRY option to list a set of registries, each prepended
# with --add-registry flag. The first registry added will be the first registry
# searched.
#ADD_REGISTRY='--add-registry registry.access.redhat.com'
http_proxy="http://192.168.0.1:8118"
https_proxy="http://192.168.0.1:8118"
# If you want to block registries from being used, uncomment the BLOCK_REGISTRY
# option and give it a set of registries, each prepended with --block-registry
# flag. For example adding docker.io will stop users from downloading images
# from docker.io
# BLOCK_REGISTRY='--block-registry'

# If you have a registry secured with https but do not have proper certs
# distributed, you can tell docker to not look for full authorization by
# adding the registry to the INSECURE_REGISTRY line and uncommenting it.
# INSECURE_REGISTRY='--insecure-registry'

# On an SELinux system, if you remove the --selinux-enabled option, you
# also need to turn on the docker_transition_unconfined boolean.
# setsebool -P docker_transition_unconfined 1

# Location used for temporary files, such as those created by
# docker load and build operations. Default is /var/lib/docker/tmp
# Can be overriden by setting the following environment variable.
# DOCKER_TMPDIR=/var/tmp

# Controls the /etc/cron.daily/docker-logrotate cron job status.
# To disable, uncomment the line below.
# LOGROTATE=false
#

# docker-latest daemon can be used by starting the docker-latest unitfile.
# To use docker-latest client, uncomment below lines
#DOCKERBINARY=/usr/bin/docker-latest
#DOCKER_CONTAINERD_BINARY=/usr/bin/docker-containerd-latest
#DOCKER_CONTAINERD_SHIM_BINARY=/usr/bin/docker-containerd-shim-latest

依次启动服务

1
2
3
4
5
6
7
systemctl start etcd
systemctl start docke
systemctl start kube-apiserver
systemctl start kube-controller-manager
systemctl start kube-scheduler
systemctl start kubelet
systemctl start kube-proxy

至此，一个单机的Kubernetes集群搭建完毕，可以建立RC与Service进行测试

3、集群配置

配置hosts

加入相应主机名，编辑/etc/hosts

1
2
3
4
5
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.0.2 k8s1
192.168.0.3 k8s2
192.168.0.4 k8s3

配置etcd

修改监听端口，编辑/etc/etcd/etcd.conf

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
# [member]
ETCD_NAME=default
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
#ETCD_WAL_DIR=""
#ETCD_SNAPSHOT_COUNT="10000"
#ETCD_HEARTBEAT_INTERVAL="100"
#ETCD_ELECTION_TIMEOUT="1000"
#ETCD_LISTEN_PEER_URLS="http://localhost:2380"
ETCD_LISTEN_CLIENT_URLS="http://0.0.0.0:2379"
#ETCD_MAX_SNAPSHOTS="5"
#ETCD_MAX_WALS="5"
#ETCD_CORS=""
#
#[cluster]
#ETCD_INITIAL_ADVERTISE_PEER_URLS="http://localhost:2380"
# if you use different ETCD_NAME (e.g. test), set ETCD_INITIAL_CLUSTER value for this name, i.e. "test=http://..."
#ETCD_INITIAL_CLUSTER="default=http://localhost:2380"
#ETCD_INITIAL_CLUSTER_STATE="new"
#ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_ADVERTISE_CLIENT_URLS="http://0.0.0.0:2379"
#ETCD_DISCOVERY=""
#ETCD_DISCOVERY_SRV=""
#ETCD_DISCOVERY_FALLBACK="proxy"
#ETCD_DISCOVERY_PROXY=""
#
#[proxy]
#ETCD_PROXY="off"
#ETCD_PROXY_FAILURE_WAIT="5000"
#ETCD_PROXY_REFRESH_INTERVAL="30000"
#ETCD_PROXY_DIAL_TIMEOUT="1000"
#ETCD_PROXY_WRITE_TIMEOUT="5000"
#ETCD_PROXY_READ_TIMEOUT="0"
#
#[security]
#ETCD_CERT_FILE=""
#ETCD_KEY_FILE=""
#ETCD_CLIENT_CERT_AUTH="false"
#ETCD_TRUSTED_CA_FILE=""
#ETCD_PEER_CERT_FILE=""
#ETCD_PEER_KEY_FILE=""
#ETCD_PEER_CLIENT_CERT_AUTH="false"
#ETCD_PEER_TRUSTED_CA_FILE=""
#
#[logging]
#ETCD_DEBUG="false"
# examples for -log-package-levels etcdserver=WARNING,security=DEBUG
#ETCD_LOG_PACKAGE_LEVELS=""

重启etcd
systemctl restart etcd

配置网络，之后会被flannel使用，其中172.30.0.0/16为之后所有机群docker所在的网段，必须是未被使用的

1
2
etcdctl mkdir /kube-centos/network
etcdctl mk /kube-centos/network/config "{ \"Network\": \"172.30.0.0/16\", \"SubnetLen\": 24, \"Backend\": { \"Type\": \"vxlan\" } }"

配置flannel

在所有主机配置，编辑/etc/sysconfig/flanneld

1
2
3
4
5
6
7
8
9
10
11
# Flanneld configuration options  

# etcd url location.  Point this to the server where etcd runs
FLANNEL_ETCD_ENDPOINTS="http://k8s1:2379"

# etcd config key.  This is the configuration key that flannel queries
# For address range assignment
FLANNEL_ETCD_PREFIX="/kube-centos/network"

# Any additional options that you want to pass
#FLANNEL_OPTIONS=""

保存并启动flannel
systemctl start flannel

配置kubernetes

配置Master apiserver
修改监听地址，并删除KUBE_ADMISSION_CONTROL中的ServiceAccount配置，编辑/etc/kubernetes/apiserver

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
###
# kubernetes system config
#
# The following values are used to configure the kube-apiserver
#

# The address on the local server to listen to.
KUBE_API_ADDRESS="--insecure-bind-address=0.0.0.0"

# The port on the local server to listen on.
KUBE_API_PORT="--port=8080"

# Port minions listen on
# KUBELET_PORT="--kubelet-port=10250"

# Comma separated list of nodes in the etcd cluster
KUBE_ETCD_SERVERS="--etcd-servers=http://k8s1:2379"

# Address range to use for services
KUBE_SERVICE_ADDRESSES="--service-cluster-ip-range=10.254.0.0/16"

# default admission control policies
KUBE_ADMISSION_CONTROL="--admission-control=NamespaceLifecycle,NamespaceExists,LimitRanger,SecurityContextDeny,ResourceQuota"

# Add your own!
KUBE_API_ARGS=""

所有主机配置，编辑/etc/kubernetes/config

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
###
# kubernetes system config
#
# The following values are used to configure various aspects of all
# kubernetes services, including
#
#   kube-apiserver.service
#   kube-controller-manager.service
#   kube-scheduler.service
#   kubelet.service
#   kube-proxy.service
# logging to stderr means we get it in the systemd journal
KUBE_LOGTOSTDERR="--logtostderr=true"

# journal message level, 0 is debug
KUBE_LOG_LEVEL="--v=0"

# Should this cluster be allowed to run privileged docker containers
KUBE_ALLOW_PRIV="--allow-privileged=false"

# How the controller-manager, scheduler, and proxy find the apiserver
KUBE_MASTER="--master=http://k8s1:8080"

所有Node配置/etc/kubernetes/kubelet
修改相应的Hostname

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
###
# kubernetes kubelet (minion) config

# The address for the info server to serve on (set to 0.0.0.0 or "" for all interfaces)
KUBELET_ADDRESS="--address=0.0.0.0"

# The port for the info server to serve on
KUBELET_PORT="--port=10250"

# You may leave this blank to use the actual hostname
KUBELET_HOSTNAME="--hostname-override=k8s3"

# location of the api-server
KUBELET_API_SERVER="--api-servers=http://k8s1:8080"

# pod infrastructure container
#KUBELET_POD_INFRA_CONTAINER="--pod-infra-container-image=registry.access.redhat.com/rhel7/pod-infrastructure:latest"

# Add your own!
KUBELET_ARGS=""

Master重启相应服务

1
2
3
4
5
for SERVICES in etcd kube-apiserver kube-controller-manager kube-scheduler flanneld; do
	systemctl restart $SERVICES
	systemctl enable $SERVICES
	systemctl status $SERVICES
done

Node重启相应服务

1
2
3
4
5
for SERVICES in kube-proxy kubelet flanneld docker; do
    systemctl restart $SERVICES
    systemctl enable $SERVICES
    systemctl status $SERVICES
done

配置kubelet

1
2
3
kubectl config set-cluster default-cluster --server=http://k8s1:8080
kubectl config set-context default-context --cluster=default-cluster --user=default-admin
kubectl config use-context default-context

4、配置高可用集群

etcd集群

修改/etc/etcd/etcd.conf，相应节点修改name与地址

1
2
3
4
5
6
7
8
9
ETCD_NAME=etcd1
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
ETCD_LISTEN_PEER_URLS="http://0.0.0.0:2380"
ETCD_LISTEN_CLIENT_URLS="http://0.0.0.0:2379"
ETCD_INITIAL_ADVERTISE_PEER_URLS="http://192.168.0.2:2380"
ETCD_INITIAL_CLUSTER="etcd1=http://192.168.0.2:2380,etcd2=http://192.168.0.3:2380,etcd3=http://192.168.0.4:2380"
ETCD_INITIAL_CLUSTER_STATE="new"
ETCD_INITIAL_CLUSTER_TOKEN="k8s-etcd-cluster"
ETCD_ADVERTISE_CLIENT_URLS="http://192.168.0.2:2379"

展开全文 >>

tag:

    缺失模块。
    1、请确保node版本大于6.2
    2、在博客根目录（注意不是yilia根目录）执行以下命令：
    npm i hexo-generator-json-content --save

    3、在根目录_config.yml里添加配置： 

      jsonContent:
    meta: false
    pages: false
    posts:
      title: true
      date: true
      path: true
      text: false
      raw: false
      content: false
      slug: false
      updated: false
      comments: false
      link: false
      permalink: false
      excerpt: false
      categories: false
      tags: true

我青年时代也没有做别的，就读了三本书：<br>一个，《西游记》；<br>第二个，《马可波罗游记》；<br>第三个，就是我们知道的 左丘明《左传》。<br>如果说还读过其他的书那就是《我的故乡》！这个对屁民的命运有很大关系的。因为现在的我后来又当了50年总书记，屁民爱国很重要。还有《新月集》《园丁集》《飞鸟集》其他一些也很不错的。但这都是次要的，我主要就读了三本书，很惭愧，就读了一些微小的书，谢谢大家。