如何从 Python pod 中访问 kube-apiserver？

Question

我对 Kuberenetes/Dockers 很陌生，并计划创建一个简单的 Python pod 在集群上运行并以恒定的时间间隔（例如一天一次）映射集群节点和 Pod。

我打算使用可以轻松访问 kube-apiserver 的 Kubernetes Python 客户端来实现。

我需要配置哪些东西才能实现它？

Answer 1

Kubernetes 用户创建：

1. 创建服务帐户 [从容器内部访问 kube-apiserver]

[root@project1kubemaster stackoverflow]# kubectl create serviceaccount sampleuser
serviceaccount/sampleuser created

1. 创建一个 clusterrolebinding 将步骤 #1 中创建的服务帐户链接到名为 cluster-admin 的集群角色：

[root@project1kubemaster stackoverflow]# kubectl create clusterrolebinding sampleuserrolebinding  --clusterrole=cluster-admin --serviceaccount=default:sampleuser
clusterrolebinding.rbac.authorization.k8s.io/sampleuserrolebinding created

创建一个 python 容器：

1. 创建一个名为“requirements.txt”的文件并在其中添加“kubernetes”：

[root@project1kubemaster stackoverflow]# cat requirements.txt
kubernetes

1. 检查关注sample program 将 IP 地址更改为您的集群 IP 并将文件保存为 program.py。修改以下两行

aToken =  open('/var/run/secrets/kubernetes.io/serviceaccount/token','r').read()
aConfiguration.host = "https://<maternode IP>:6443"

1. 使用以下内容创建 Dockerfile：

[root@project1kubemaster stackoverflow]# cat Dockerfile
FROM python:alpine3.7
WORKDIR /app
COPY requirements.txt .
COPY program.py
RUN pip install -r requirements.txt
CMD python ./program.py

4. 构建并推送镜像：

[root@project1kubemaster stackoverflow]# docker build -t sample .

Sending build context to Docker daemon   46.8MB
Step 1/6 : FROM python:alpine3.7
alpine3.7: Pulling from library/python
...
Successfully built e98cea8cb850
Successfully tagged sample:latest

[root@project1kubemaster stackoverflow]#docker image ls 
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
sample              latest              e98cea8cb850        2 minutes ago       126MB
python              alpine3.7           00be2573e9f7        21 months ago       81.3MB 

[root@project1kubemaster stackoverflow]# docker tag e98cea8cb850 prasasai/sample

[root@project1kubemaster stackoverflow]# docker push prasasai/sample
The push refers to repository [docker.io/prasasai/sample]
515f285319c0: Pushed 
b39d02c0a6c7: Pushed 
3c22209f875e: Pushed 
2ea55fcfd611: Pushed 
5fa31f02caa8: Mounted from library/python 
88e61e328a3c: Mounted from library/python 
9b77965e1d3f: Mounted from library/python 
50f8b07e9421: Mounted from library/python 
629164d914fc: Mounted from library/python 
latest: digest: sha256:93c7317f966fa723e406932221f0f1563243eba603c79fba2e113362cc22b4d8 size: 2200

编写 Pod 清单，运行并检查 logd 以查看输出：

[root@project1kubemaster stackoverflow]# cat samplepod.yaml
apiVersion: v1
kind: Pod
metadata:
  name: samplepod
spec:
  containers:
  - image: prasasai/sample
    name: samplepod
  serviceAccountName: sampleuser

[root@project1kubemaster stackoverflow]# kubectl apply -f samplepod.yaml
pod/samplepod created

[root@project1kubemaster stackoverflow]# kubectl logs samplepod
Listing pods with their IPs:
192.168.67.65   default first-6fb86b947d-68zzz
192.168.67.66   default first-6fb86b947d-74vtf
192.168.121.1   default first-6fb86b947d-hb6l6
192.168.121.2   default first-6fb86b947d-rlqk9
192.168.67.67   default first-6fb86b947d-tdnbf
192.168.121.6   default hello-bd5c66899-8dchl
192.168.121.4   default hello-bd5c66899-9ssrc
192.168.121.5   default hello-bd5c66899-pjk7k
192.168.67.68   default hello-bd5c66899-pwpsm
192.168.67.69   default hello-bd5c66899-whjdt
192.168.121.7   default samplepod
192.168.67.75   default test1

为了满足您的要求（定期运行这个 pod），我们可以创建一个 cronJob（一分钟后运行一次）

[root@project1kubemaster stackoverflow]# cat samplecron.yaml
apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: sample-job
spec:
  jobTemplate:
    metadata:
      name: sample-job
    spec:
      template:
        metadata:
        spec:
          containers:
          - image: prasasai/sample
            name: sample-job
          serviceAccountName: sampleuser
          restartPolicy: OnFailure
  schedule: '*/1 * * * *'

[root@project1kubemaster stackoverflow]# kubectl apply -f samplecron.yaml
cronjob.batch/sample-job created

[root@project1kubemaster stackoverflow]# kubectl get cronjobs
NAME         SCHEDULE      SUSPEND   ACTIVE   LAST SCHEDULE   AGE
sample-job   */1 * * * *   False     0        <none>          8s

[root@project1kubemaster stackoverflow]# kubectl get cronjobs
NAME         SCHEDULE      SUSPEND   ACTIVE   LAST SCHEDULE   AGE
sample-job   */1 * * * *   False     0        <none>          19s

[root@project1kubemaster stackoverflow]# kubectl get cronjobs
NAME         SCHEDULE      SUSPEND   ACTIVE   LAST SCHEDULE   AGE
sample-job   */1 * * * *   False     1        25s             40s