Certified Kubernetes Administrator (CKA) #27 フルスケール実技模擬試験: 17 のタスク + 解説

ssh cluster1-controlplane
sudo -i

ETCDCTL_API=3 etcdctl snapshot save /opt/etcd-backup.db \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key

ETCDCTL_API=3 etcdctl --write-out=table snapshot status /opt/etcd-backup.db

ETCDCTL_API=3 etcdctl snapshot restore /opt/etcd-backup.db \
  --data-dir=/var/lib/etcd-restore

vim /etc/kubernetes/manifests/etcd.yaml

  volumes:
    - name: etcd-data
      hostPath:
        path: /var/lib/etcd-restore
        type: DirectoryOrCreate

crictl ps | grep etcd
k get nodes

ssh cluster1-controlplane
sudo -i

apt-get update && apt-get install -y kubeadm=1.31.1-1.1
kubeadm upgrade plan
kubeadm upgrade apply v1.31.1

kubectl drain cluster1-controlplane --ignore-daemonsets
apt-get install -y kubelet=1.31.1-1.1 kubectl=1.31.1-1.1
systemctl daemon-reload && systemctl restart kubelet
kubectl uncordon cluster1-controlplane

kubectl drain node01 --ignore-daemonsets

ssh node01
sudo -i
apt-get update && apt-get install -y kubeadm=1.31.1-1.1
kubeadm upgrade node
apt-get install -y kubelet=1.31.1-1.1
systemctl daemon-reload && systemctl restart kubelet
exit

kubectl uncordon node01

k -n dev create serviceaccount deployer
k -n dev create role deploy-manager \
  --verb=create,get,list,update,delete \
  --resource=deployments.apps
k -n dev create rolebinding deployer-binding \
  --role=deploy-manager \
  --serviceaccount=dev:deployer

k -n dev auth can-i create deployments --as=system:serviceaccount:dev:deployer
k -n dev auth can-i delete deployments --as=system:serviceaccount:dev:deployer

ssh cluster1-controlplane
sudo -i

kubeadm certs check-expiration

openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -enddate

kubeadm certs renew all
systemctl restart kubelet

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: log-agent
  namespace: apps
spec:
  selector:
    matchLabels:
      app: log-agent
  template:
    metadata:
      labels:
        app: log-agent
    spec:
      containers:
        - name: fluentd
          image: fluent/fluentd:v1.16

k apply -f log-agent.yaml
k -n apps get ds log-agent

k taint node node01 gpu=true:NoSchedule
k label node node01 disktype=ssd

apiVersion: v1
kind: Pod
metadata:
  name: ml-job
  namespace: apps
spec:
  tolerations:
    - key: gpu
      operator: Equal
      value: "true"
      effect: NoSchedule
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
          - matchExpressions:
              - key: disktype
                operator: In
                values:
                  - ssd
  containers:
    - name: ml-job
      image: nginx

k apply -f ml-job.yaml
k -n apps get pod ml-job -o wide

apiVersion: v1
kind: Service
metadata:
  name: cache
  namespace: data
spec:
  clusterIP: None
  selector:
    app: cache
  ports:
    - port: 6379
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: cache
  namespace: data
spec:
  serviceName: cache
  replicas: 3
  selector:
    matchLabels:
      app: cache
  template:
    metadata:
      labels:
        app: cache
    spec:
      containers:
        - name: redis
          image: redis:7
          ports:
            - containerPort: 6379
          volumeMounts:
            - name: data
              mountPath: /data
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: 1Gi

k apply -f cache.yaml
k -n data get pods -l app=cache

k -n net create deploy web --image=nginx --replicas=2
k -n net expose deploy web --name=web-np --type=NodePort --port=80 --target-port=80

k -n net patch svc web-np --type='json' \
  -p='[{"op":"replace","path":"/spec/ports/0/nodePort","value":30080}]'

k -n net create ingress web-ing \
  --class=nginx \
  --rule="web.example.com/*=web-np:80" $do > ing.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-ing
  namespace: net
spec:
  ingressClassName: nginx
  rules:
    - host: web.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web-np
                port:
                  number: 80

k apply -f ing.yaml

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: db-allow
  namespace: net
spec:
  podSelector:
    matchLabels:
      app: db
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              role: api
      ports:
        - protocol: TCP
          port: 5432

k apply -f db-allow.yaml

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-data
spec:
  capacity:
    storage: 2Gi
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  hostPath:
    path: /mnt/data
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc-data
  namespace: storage
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
---
apiVersion: v1
kind: Pod
metadata:
  name: pv-user
  namespace: storage
spec:
  containers:
    - name: nginx
      image: nginx
      volumeMounts:
        - name: data
          mountPath: /usr/share/nginx/html
  volumes:
    - name: data
      persistentVolumeClaim:
        claimName: pvc-data

k apply -f pv.yaml
k -n storage get pvc pvc-data

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: fast
provisioner: rancher.io/local-path
volumeBindingMode: WaitForFirstConsumer
allowVolumeExpansion: true
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc-fast
  namespace: storage
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: fast
  resources:
    requests:
      storage: 3Gi

k apply -f sc.yaml
k -n storage get pvc pvc-fast

k get nodes
k describe node node01

ssh node01
sudo -i
systemctl status kubelet
journalctl -u kubelet -e

systemctl enable --now kubelet
systemctl restart kubelet

ssh cluster2-controlplane
sudo -i

crictl ps -a | grep kube-apiserver
crictl logs <apiserver-container-id>

vim /etc/kubernetes/manifests/kube-apiserver.yaml

crictl ps | grep kube-apiserver
k get nodes

k -n apps get svc frontend -o wide
k -n apps get endpoints frontend
k -n apps describe svc frontend
k -n apps get pods --show-labels

k -n apps patch svc frontend \
  -p '{"spec":{"selector":{"app":"frontend"}}}'
k -n apps get endpoints frontend

k -n apps describe pod report
k -n apps logs report --previous > /tmp/report.log

k -n apps get pod report -o yaml > report.yaml

    resources:
      limits:
        memory: "256Mi"
      requests:
        memory: "128Mi"

k -n apps delete pod report
k apply -f report.yaml