• 현재 쿠버네티스 클러스터에서 사용할 수 있는 API 리소스
• 리소스 약어 확인 가능

kubectl api-resources

# 대표적인 쿠버네티스 리소스 약어
# pods - po
kubectl api-resources | grep pods

# deployments - deploy
kubectl api-resources | grep deployments

# namespaces - ns
kubectl api-resources | grep namespaces

# configmaps - cm
kubectl api-resources | grep configmaps

• 쿠버네티스 클러스터 내부 리소스에 대한 조회 명령어

# 노드 조회
kubectl get node
kubectl get node -o wide

# 파드 조회
kubectl get pods
kubectl get pods -A

# 디플로이먼트 조회
kubectl get deployment
kubectl get deployment -A

# 네임스페이스 조회
kubectl get namespace

• 쿠버네티스 클러스터 내부 리소스에 대한 상세 정보 조회

# 파드 상세 조회
kubectl describe pod -n kube-system coredns-668d6bf9bc-5jgbj

# 디플로이먼트 조회
kubectl describe deployment -n kube-system coredns

# 네임스페이스 조회
kubectl describe namespace kube-system

• kubectl api-resources
  • SHORTNAMES 필드에서 축약어 확인가능

• kubectl get pods -A
  • 모든 네임스페이스의 pod 조회

• coreDNS pod의 상세내용 확인

• 현재 사용중인 context 확인

# 현재 설정된 컨텍스트 확인
kubectl config current-context

# 모든 컨텍스트 확인
kubectl config get-contexts

# 다른 컨텍스트 전환
kubectl config use-context <Context Name>

# 컨텍스트 삭제
kubectl config delete-context <Context Name>

• 컨텍스트 정보는 어디서 가져오는 걸까?
  • ~/.kube/config 에 저장

cat ~/.kube/config

apiVersion: v1
clusters:
- cluster:
    certificate-authority: /home/nasir/.minikube/ca.crt
    extensions:
    - extension:
        last-update: Sun, 30 Mar 2025 20:26:18 KST
        provider: minikube.sigs.k8s.io
        version: v1.35.0
      name: cluster_info
    server: https://127.0.0.1:32769
  name: minikube
- cluster:
    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURCVENDQWUyZ0F3SUJBZ0lJQ0ZUanB6c0Y2aWN3RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TlRBME1qWXhOakEzTVRaYUZ3MHpOVEEwTWpReE5qRXlNVFphTUJVeApFekFSQmdOVkJBTVRDbXQxWW1WeWJtVjBaWE13Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLCkFvSUJBUUMyR1E4RGs1QUpabzBYTkIvNEJnQnk1SHJPVkxPOVhkTnNmSjM2dHY4b1A4SGEvUkNZWW5aT3RXWHYKdFNtdXRDVFA3TVdEclA2SjJHcWlBYkxrcThob3Zwbmdoc0Z5RXpNaTV5bGRiWStiQmlkQlgwUWxXcDZHOEJsTgo3d2NxRGRoditBYS9oMWFoQlhuUkF2dFI2SFNGeEpzTTM4dytVNWVGc2J1QmJ6Ris1V0RBS1doNzJ5WlhBYitLCnJZeEJPQUg1M01nNjVpVnczTjg3QzdvTVRjYVA3MjUzeENWbFIrTlFzSzVYdzRxMnA5dDhScitTMUN4QzNjQTkKL1ZYdWxhVmJyQVFFVW9QbjNsS3BMUGl2czlQNnR2dDZhMlZndjFDNnp2enVRcVlzdkdEdE9WK21CbWpHcUtBZwpVRnpLS2JYOW81cCs1emt1Mk5ZK2tRdis1b0dkQWdNQkFBR2pXVEJYTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUIwR0ExVWREZ1FXQkJSRDA1a1NycnBpQkw3ZG9QajZNM1ppN0lSQjNqQVYKQmdOVkhSRUVEakFNZ2dwcmRXSmxjbTVsZEdWek1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQ0RBeWtnNmUzSgp4QXlRUDZqSDFHSCtNVWwzYXA4ZEZUem04b1ZiVTdwS1QxN1ZmN1BPMEVKUkE1NjhjT1lsRGttQ0kvN2lpK1BDCjZYWUhVL3hrN0dZd0k2d3ptZGNsVHBRSHNFVmlLYWo2b1lqOVp6UlBBbm5JaUhnWmZNYjZTVjVla3lLRUIwV2oKcTJhbWtldTEwY0orNjFOZUxaSCt1YzNtQWQvM09XalFyb2RIZ2UyMkpsMEZ5VHUrek5UNFJmS2hzcWROZHZMeAp3K1BNakNoWlBocjBDNUFxN3hSMzdHZStjTGY0M3VWU2Roeml3aXVxbi8xWC9LSkNNQ1M3Z3dBUUo2MXZzeEZyCjJjK3VXaVpWNjJKaUU0KytmcVBUSzhpMkRWQ2V6VlRXZjAycUVzTEhibUhqTjQrMjlHS2xJbDhWeGViWFlvdHkKSXZPcGZ5OE5wSE5HCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
    server: https://127.0.0.1:32981
  name: kind-kind
contexts:
- context:
    cluster: minikube
    extensions:
    - extension:
        last-update: Sun, 30 Mar 2025 20:26:18 KST
        provider: minikube.sigs.k8s.io
        version: v1.35.0
      name: context_info
    namespace: default
    user: minikube
  name: minikube
- context:
    cluster: kind-kind
    user: kind-kind
  name: kind-kind
current-context: kind-kind
kind: Config
preferences: {}
users:
- name: minikube
  user:
    client-certificate: /home/nasir/.minikube/profiles/minikube/client.crt
    client-key: /home/nasir/.minikube/profiles/minikube/client.key
- name: kind-kind
  user:
    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLVENDQWhHZ0F3SUJBZ0lJSmxGOHg4cDlYdU13RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TlRBME1qWXhOakEzTVRaYUZ3MHlOakEwTWpZeE5qRXlNVFphTUR3eApIekFkQmdOVkJBb1RGbXQxWW1WaFpHMDZZMngxYzNSbGNpMWhaRzFwYm5NeEdUQVhCZ05WQkFNVEVHdDFZbVZ5CmJtVjBaWE10WVdSdGFXNHdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDZkZadVMKZTY5ZFRqbUFUMkloNlpPWXorSWNYdG4xczgyUVB1TDY0Z3dycm4zZm9oUGNmbTZxYUV2VVVmN28rU2kyMnRuVgpraGZ4aGxVZFNPMGFqWmdObXNxbHMrbmlIR3lSSTlEa0lKamZRaHB1ajlCZUlzejFoSmNvVkRXVXFqd3ZJQ3I5CmM1Q0k2OEVUbXNOcTdtQlFHaEt0dG5iL3U2dzdGem5scE5uNEovTHhvZmYybUV4YVd4T2xpb2p0L0h5SnNQQlkKQjhCK3FqT1JRS3hoU0RoOEkyK2tpWmVqTTJYL1BSbklHTE1hN3BPb0VjMkhpMjVacDF2cXRwQi9NV3FEdXpIeQpjcmFMelFHZnAxMGd2VXBnWi9ZUHMxZjNJZmt1WjB4ZnF6UnVnejlRY05FUGJXSnRXVy9aeUpzTm01dWlvUGQ1CjJpdk1GbFRWdFVrSzdsTlJBZ01CQUFHalZqQlVNQTRHQTFVZER3RUIvd1FFQXdJRm9EQVRCZ05WSFNVRUREQUsKQmdnckJnRUZCUWNEQWpBTUJnTlZIUk1CQWY4RUFqQUFNQjhHQTFVZEl3UVlNQmFBRkVQVG1SS3V1bUlFdnQyZworUG96ZG1Mc2hFSGVNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUFsanVOUm1GU2ZqZy9iZzU3aGNaTGxYWDhhCm5ENy9uK29GMW9EOGVZUEFYK0djVEN0bSt3blo3cG5hNytoSXg4ZzFuc2FBSytST1FTcGUxTTE1Ung0Mnd5NEYKOGNmWUhrM2NESmlDR1ZrUXF1NGxPRHZKUHluY05oaHJjZHlLcGVOVDNKUU9BMG9mQURtSU9ZSXRZbm1sOWJXbwpuNGRwMlE5Q2Vzc01jbHpyTDlPeEZaOEZlSm9OWkoyYTRSTGY1dUZhNi9ZS1hJZWVYR21zVjZEc3g3NXFSbUV1ClBrZkF2TnNEM3RMZHJPUjdwT2ZOUG5NUThaK1IrNjFDSFljU2hCaER6R2FNeVFDcTJ1YWhhNXpMMnppb1lBWkoKRUxqT1V5dHpVSUp4NHo3b3lXTG45ZFFFVmdIcHQvNFJIcmUxbzI1dktYSkFLYmR1WXg4bUJBQ3RFMkNrCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
    client-key-data: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBbnhXYmtudXZYVTQ1Z0U5aUllbVRtTS9pSEY3WjliUE5rRDdpK3VJTUs2NTkzNklUCjNINXVxbWhMMUZIKzZQa290dHJaMVpJWDhZWlZIVWp0R28yWURacktwYlBwNGh4c2tTUFE1Q0NZMzBJYWJvL1EKWGlMTTlZU1hLRlExbEtvOEx5QXEvWE9RaU92QkU1ckRhdTVnVUJvU3JiWjIvN3VzT3hjNTVhVForQ2Z5OGFIMwo5cGhNV2xzVHBZcUk3Zng4aWJEd1dBZkFmcW96a1VDc1lVZzRmQ052cEltWG96TmwvejBaeUJpekd1NlRxQkhOCmg0dHVXYWRiNnJhUWZ6RnFnN3N4OG5LMmk4MEJuNmRkSUwxS1lHZjJEN05YOXlINUxtZE1YNnMwYm9NL1VIRFIKRDIxaWJWbHYyY2liRFp1Ym9xRDNlZG9yekJaVTFiVkpDdTVUVVFJREFRQUJBb0lCQUdjOEhXM3NwN3QwQk9xWQpHVVdLajBhT09OeFNUVDBlQmxzQ0JFZnNveHRCcTl1UkVUUjRNNWFRQWcxeGZHdHhMUk9rWjlJcGNUSkNDei9xCjBEcjRBZUZxUHZGVEZJYXdEV0FPandOTGlBanhtN2Q5eWlrY2lrY1ZXUVpKeDArSFBYRVRmZkpscVRqQlROVk4KREYxNi9iTmRpQnVFbWlxUWZrOEdYb01BL0pZRlNHNE1TSTFMakliL25NOFZONk1QQy9lOXNaQnRRS1p0WmUxKwpicGhXQnY3TmkxNFBWVTNYQjAzbHFJUlY5QjkwZk44V1NCTllSRXZIZHBUTE9xeEVXcG1rMFNuZExndXV0WjE4CmtXTTFiTVBLcVRWeHJjWElZTWZzcWR2cVpMNEhNbk9UcHV3RlFDdk02Ukt6Yk1wQ1FoZE01dUZQTnZoMkhxcVcKUTVGZ0NIRUNnWUVBMCtubXBoMU5scm1uekZ3TTNEenRyU0xIaHRqQXJSd3B2cHhLMm9KSFprbU9rN2MyYjlYNQpVakJQdHFzWGN4V3JwaEtmMTFGbTNNRHIyaWlPTjBESXFvazNpWTF6YWQ3bERNT0xPaEN5NGRqTWcrMVg5c0hOCjBpTmMrMjRuYnN6dytHbXU2Y01nYW1JdStDdlRseWQwNlF6TGxOUkZmRTBGbTQrZ2gweVdUQ1VDZ1lFQXdDNGcKRk12Y3BUby91QUNwYWRPRDBsRVJ2eFNoOU55NTBkK1NNUnNVVGRBK3RVWFA1K0xyT21Tc05OUjY1TkZkUkYvVgoxRHBqOTZyc3NnYlE5OFk1cVNpeFdqWE5qSzVHSW5NaFRXa2ZpdXhqU04xS2NKUkNseWk0S2hjd1U2bXlyc0YvCklJYlRrdmNWcUx2djdRVm5XYUI4NnJQWXBLT21uTkpiclR6TzdMMENnWUF5Q3FZQXpDS3FXU1VheVJId1lDTHcKSTZwaVdZVUdYQVF2a3RES1VNRnpraU10RnJLd0xpTTJHVnA1bEdWeE04alk2c1Q4SDZqZXNHQUJvRm9WQ2lOWQp3aFp2VVF2VUVHS2VaUDdYczJIS20xdVFPOWZ0MlU0MU5VeWJ3eU5rc3Rpa2tMQlJXMWFvU0k4MjQ0S1B5eTE4CmF4MFlCQmgwaGV1eEZIV2YvYUh3VVFLQmdRQ0d3NUdobzdlTmNnUmV2ckFPVXRHOHVUYk5uT1ZaZFRNbEZqZEoKRWlreHk5YzlmTUFuWnZ2M0RjT29wRnV0ZTVlQXJBZWhkSFRIcDJlbUM1dWNOTGdZaEQyaCtkcXpUVDVIU0I3UgpUdWRjbnhtY2JmbVdhcEVydU5VMFJ1Q1B1bzlmZHJiMEV6Zm9kallOQmdWZ1c0cTIwaERtOE1qNTR2eWlPZTBwCjFWdHhyUUtCZ0VBK1ZKNDNhaXlWK01UZy9OUXQ2NHNuVFJaOVRjZVRiK1ZrR2hGWm8rVTF5Y05jakQ1dGRlYk0KSTBCd2pNdXBJSkxpOUNEdlNTdW5OWHZXVVBabkVVcE1FTnVSMjF3R2h5WExsOUdSUUh4Vml6MGxDMVk2ZDB0UwpnL09YbEduSURCYXlKRUNFWG5YZUMwamh1Wm5iNEN1NGtWV2FQYmlOYnNBNndQZzVCNVVrCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==

• context 조회 및 변경
  • 다른 context 변경시 해당 클러스터의 정보 확인 가능

# 네임스페이스 조회
kubectl get ns

# 네임스페이스 생성
kubectl create namespace knou
kubectl get ns

# 파트 생성
kubectl run nginx --image=nginx:alpine

#
kubectl get pods
kubectl describe pod nginx
kubectl describe pod nginx | grep Namespace

# knou 네임스페이스에 파드 생성
kubectl run nginx --image=nginx:alpine -n knou

#
kubectl get pods -n knou
kubectl get pods -A

# knou 네임스페이스에 다시 한 번 파드 배포
kubectl run nginx --image=nginx:alpine -n knou
Error from server (AlreadyExists): pods "nginx" already exists

# 논리적으로 격리되어 있기 때문에 다른 네임스페이스에는 동일한 이름의 파드를 배포할 수 있지만, 같은 네임스페이스에는 동일한 파드를 배포할 수 없다!
# -> 쿠버네티스 사용 시 가장 많이 하는 실수 중 하나. 다른 네임스페이스에 배포하는 것

# 테스트 파드 삭제
kubectl delete pods nginx
kubectl delete pods nginx -n knou

# 기본 네임스페이스 변경
## 현재 네임스페이스 정보 조회 (빈값: default)
kubectl config get-contexts
kubectl config view --minify
kubectl config view --minify --output 'jsonpath={.namespace}'

## 네임스페이스 변경 
kubectl config set-context --current --namespace=knou

kubectl config get-contexts
kubectl config view --minify
kubectl config view --minify --output 'jsonpath={.namespace}'

# 네임스페이스 지정 없이 파드 배포
kubectl run nginx2 --image=nginx:alpine
kubectl get pods -n knou

# 테스트 파드 삭제
kubectl delete pods nginx2

• 동일 ns에 동일 pod 생성 불가 확인

• kubectl config view –minify –output ‘jsonpath={.contexts[0].context.namespace}’
  • 현재 설정된 namespace 확인
  • 기본 default 대신 설정한 namespace에 kubectl 동작

• 기본 pod YAML 양식

apiVersion: v1
kind: Pod               # Pod 리소스 선언
metadata:
  name: nginx           # Pod Name
spec:
  containers:
  - name: nginx         # Container Name
    image: nginx:alpine # Container Image
    ports:              # Container Port
    - containerPort: 80

cat << EOF > pod.yaml
apiVersion: v1
kind: Pod               # Pod 리소스 선언
metadata:
  name: nginx           # Pod Name
spec:
  containers:
  - name: nginx         # Container Name
    image: nginx:alpine # Container Image
    ports:              # Container Port
    - containerPort: 80
EOF

# 현재 pod 상태 확인
kubectl get pods -A

# pod 배포
kubectl apply -f pod.yaml

#
kubectl get pods
kubectl describe pods nginx

# 삭제
kubectl delete -f pod.yaml

• pod yaml

apiVersion: v1
kind: Pod
metadata:
  name: knou
  namespace: knou
spec:
  containers:
  - name: knou
    image: busybox
    env:                      # Pod 내부 변수 선언
    - name: NAME              # 변수 Key
      value: "jongjin kim"   # 변수 Value
    command: ["/bin/sh"]
    args: ["-c", "while true; do echo \"Hello My Name is $(NAME)\"; date; sleep 2; done"]

cat << EOF > pod-log.yaml
apiVersion: v1
kind: Pod
metadata:
  name: knou
  namespace: knou
spec:
  containers:
  - name: knou
    image: busybox
    env:                      # Pod 내부 변수 선언
    - name: NAME              # 변수 Key
      value: "jongjin kim"   # 변수 Value
    command: ["/bin/sh"]
    args: ["-c", "while true; do echo \"Hello My Name is \$(NAME)\"; date; sleep 2; done"]
EOF


# 현재 pod 상태 확인
kubectl get pods -A

# pod 배포
kubectl apply -f pod-log.yaml

#
kubectl get pods
kubectl describe pods knou

# 로그 조회
kubectl logs knou
kubectl logs knou -f

# 삭제
kubectl delete -f pod-log.yaml --force

• 복붙은 실습의 미덕이기에 복붙가능하도록 변경

• pod yaml

apiVersion: v1
kind: Pod
metadata:
  name: knou-multi
spec:
  containers:
  - name: nginx
    image: nginx
  - name: redis
    image: redis

# 바로실행
kubectl apply -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: knou-multi
spec:
  containers:
  - name: nginx
    image: nginx
  - name: redis
    image: redis
EOF


# 현재 pod 상태 확인
kubectl get pods -A

# pod 배포
kubectl apply -f multi.yaml

#
kubectl get pods
kubectl describe pods knou-multi

# 
kubectl delete -f multi.yaml

• pod-yaml

apiVersion: v1
kind: Pod
metadata:
  name: knou-mart
spec:
  volumes:
  - emptyDir: {}
    name: varlog
  containers:
  - name: knou-mart
    image: busybox
    command:
    - /bin/sh
    - -c
    - 'i=1; while :;do echo -e "$i: Price: $((RANDOM % 10000 + 1))" >> /var/log/knou-mart.log; i=$((i+1)); sleep 2; done'
    volumeMounts:
    - mountPath: /var/log
      name: varlog
  - name: price
    image: busybox
    args: [/bin/sh, "-c", 'tail -n+1 -f /var/log/knou-mart.log']
    volumeMounts:
    - mountPath: /var/log
      name: varlog

kubectl apply -f - << EOF
apiVersion: v1
kind: Pod
metadata:
  name: knou-mart
spec:
  volumes:
  - emptyDir: {}
    name: varlog
  containers:
  - name: knou-mart
    image: busybox
    command:
    - /bin/sh
    - -c
    - 'i=1; while :;do echo -e "\$i: Price: \$((RANDOM % 10000 + 1))" >> /var/log/knou-mart.log; i=\$((i+1)); sleep 2; done'
    volumeMounts:
    - mountPath: /var/log
      name: varlog
  - name: price
    image: busybox
    args: [/bin/sh, "-c", 'tail -n+1 -f /var/log/knou-mart.log']
    volumeMounts:
    - mountPath: /var/log
      name: varlog
EOF

# 현재 pod 상태 확인
kubectl get pods -A

# pod 배포
kubectl apply -f sidecar.yaml

#
kubectl get pods
kubectl describe pods knou-mart

# price 컨테이너 로그 조회
kubectl logs knou-mart -c price -f

# 
kubectl delete -f sidecar.yaml

# 사이드카 패턴을 사용하는 대표적인 서비스가 Istio
## Envoy Proxy 가 Side Car 로 동작하여 Container 의 모든 네트워크 패킷을 감시하고 제어

• kubectl 바로 먹여서 nginx,redis 2개의 컨테이너있는 pod 확인

• 바로 생성시 $변수 interpolation에는 escape 문자열 필요
• 사이드카 컨테이너의 로그 확인

• Pod 단독 사용 시 고가용성 및 자가 치유가 불가 → 다른 배포 방식 사용

# 앞에서 배포했던 파드 1개 선언
kubectl apply -f pod.yaml

#
kubectl get pods

# kubectl 명령으로 파드 삭제
kubectl delete pods nginx

#
kubectl get pods

• Deployment : Pod 를 배포하는 기본적인 방법, 다양한 배포 전략 사용 가능
• StatefulSets : 실행 순서 보장, Host Name & Volume 을 일정하게 사용 가능, 순서 & 데이터가 중요한 경우
• DaemonSet : 현재 클러스터의 모든 노드에 배포, Log & Monitoring 등 모든 노드에 배포가 되어야 하는 경우
• Job, CronJob : 배치성 작업

• deployment YAML

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-v1
spec:
  selector:
    matchLabels:            # PodTemplate 에 선언된 Label 을 지정하여 Deployment 적용
      app: nginx
  replicas: 2               # Pod 개수
  template:                 # PodTemplate 시작
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:latest
        env:
        - name: APP_MODE
          value: "v1"
        ports:
        - containerPort: 80 # PodTemplate 종료

cat << EOF > deploy.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-v1
spec:
  selector:
    matchLabels:            # PodTemplate 에 선언된 Label 을 지정하여 Deployment 적용
      app: nginx
  replicas: 2               # Pod 개수
  template:                 # PodTemplate 시작
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:latest
        env:
        - name: APP_MODE
          value: "v1"
        ports:
        - containerPort: 80 # PodTemplate 종료
EOF

# 현재 pod 상태 확인
kubectl get pods -A

# pod 배포
kubectl apply -f deploy.yaml

# Pod, ReplicaSet, Deployment 조회
kubectl get deploy,rs,pods

# 
kubectl delete -f deploy.yaml

• pod yaml update

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-v1
spec:
  selector:
    matchLabels:            # PodTemplate 에 선언된 Label 을 지정하여 Deployment 적용
      app: nginx
  replicas: 2               # Pod 개수
  template:                 # PodTemplate 시작
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:latest
        env:
        - name: APP_MODE
          value: "v2"       # v1 -> v2 변경
        ports:
        - containerPort: 80 # PodTemplate 종료

cat << EOF > deploy.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-v1
spec:
  selector:
    matchLabels:            # PodTemplate 에 선언된 Label 을 지정하여 Deployment 적용
      app: nginx
  replicas: 2               # Pod 개수
  template:                 # PodTemplate 시작
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:latest
        env:
        - name: APP_MODE
          value: "v2"       # v1 -> v2 변경
        ports:
        - containerPort: 80 # PodTemplate 종료
EOF

# 터미널 2
while true; do kubectl get pods -o wide; sleep 1; done

# 터미널 1
kubectl apply -f deploy.yaml


# 동작 방식 (기본 Rolling Update)
# 신규 pod 배포 -> 배포 완료 -> 기존 pod 1대 제거 -> 제거 완료 -> 신규 Pod 배포 -> 배포 완료 -> 기존 Pod 제거 -> 제거 완료 -> N번 반복

• 기존 nginx-v1-7db9f4ff4c-cztss, nginx-v1-7db9f4ff4c-q4ddc pod에서
  • env 값 변경 (설정 업데이트)
  • j9x9c, wr582 로 신규 파드 생성 후, 기존 파드 제거

wr582

• pod YAML

# Request, Limit 없는 Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: qos-besteffort
spec:
  replicas: 1
  selector:
    matchLabels:
      app: qos-besteffort
  template:
    metadata:
      labels:
        app: qos-besteffort
    spec:
      containers:
        - name: nginx
          image: nginx:alpine

cat << EOF > besteffort.yaml
# Request, Limit 없는 Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: qos-besteffort
spec:
  replicas: 1
  selector:
    matchLabels:
      app: qos-besteffort
  template:
    metadata:
      labels:
        app: qos-besteffort
    spec:
      containers:
        - name: nginx
          image: nginx:alpine
EOF

# 배포
kubectl apply -f besteffort.yaml
kubectl get pods

BEST_EFFORT=$(kubectl get pods --no-headers -o custom-columns=":metadata.name" | grep qos-besteffort)

# QoS 확인
kubectl get pod ${BEST_EFFORT} -o jsonpath='{.status.qosClass}'
kubectl describe pod ${BEST_EFFORT}
#BestEffort

• pod YAML

# Request, Limit 존재하지만 값이 다름
apiVersion: apps/v1
kind: Deployment
metadata:
  name: qos-burstable
spec:
  replicas: 1
  selector:
    matchLabels:
      app: qos-burstable
  template:
    metadata:
      labels:
        app: qos-burstable
    spec:
      containers:
        - name: nginx
          image: nginx:alpine
          resources:
            requests:
              memory: "128Mi"
              cpu: "100m"
            limits:
              memory: "256Mi"
              cpu: "200m"

cat << EOF > burstable.yaml
# Request, Limit 존재하지만 값이 다름
apiVersion: apps/v1
kind: Deployment
metadata:
  name: qos-burstable
spec:
  replicas: 1
  selector:
    matchLabels:
      app: qos-burstable
  template:
    metadata:
      labels:
        app: qos-burstable
    spec:
      containers:
        - name: nginx
          image: nginx:alpine
          resources:
            requests:
              memory: "128Mi"
              cpu: "100m"
            limits:
              memory: "256Mi"
              cpu: "200m"
EOF

# 배포
kubectl apply -f burstable.yaml
kubectl get pods

BURSTARBLE=$(kubectl get pods --no-headers -o custom-columns=":metadata.name" | grep qos-burstable)

# QoS 확인
kubectl get pod ${BURSTARBLE} -o jsonpath='{.status.qosClass}'
kubectl describe pod ${BURSTARBLE}
Burstable

• pod YAML

# Request, Limit 존재. 값 동일
apiVersion: apps/v1
kind: Deployment
metadata:
  name: qos-guaranteed
spec:
  replicas: 1
  selector:
    matchLabels:
      app: qos-guaranteed
  template:
    metadata:
      labels:
        app: qos-guaranteed
    spec:
      containers:
        - name: nginx
          image: nginx:alpine
          resources:
            requests:
              memory: "128Mi"
              cpu: "100m"
            limits:
              memory: "128Mi"
              cpu: "100m"

cat << EOF > guaranteed.yaml
# Request, Limit 존재. 값 동일
apiVersion: apps/v1
kind: Deployment
metadata:
  name: qos-guaranteed
spec:
  replicas: 1
  selector:
    matchLabels:
      app: qos-guaranteed
  template:
    metadata:
      labels:
        app: qos-guaranteed
    spec:
      containers:
        - name: nginx
          image: nginx:alpine
          resources:
            requests:
              memory: "128Mi"
              cpu: "100m"
            limits:
              memory: "128Mi"
              cpu: "100m"
EOF

# 배포
kubectl apply -f guaranteed.yaml
kubectl get pods

GUARANTEED=$(kubectl get pods --no-headers -o custom-columns=":metadata.name" | grep qos-guaranteed)

# QoS 확인
kubectl get pod ${GUARANTEED} -o jsonpath='{.status.qosClass}'
kubectl describe pod ${GUARANTEED}
Guaranteed

• 생성된 pod들의 QoS 조회

• 노드폭주 테스트에 있어서, CPU는 쓰로틀링 되다보니 느려질지언정 죽지는 않는 느낌.. 메모리 limit을 걸고 OOM을 만들어야할거같네요
  • https://medium.com/idus-tech/kubernetes-pod-resources-cpu-limit-40626a4c235e
  • https://littlemobs.com/blog/kubernetes-cpu-request-limit-configuration/

#
kubectl get serviceaccount
kubectl get sa

#
kubectl describe sa -n kube-system coredns

# Role 조회
kubectl get role -A
kubectl describe role -n kube-system kube-proxy

# ClusterRole 조회
kubectl get clusterrole
kubectl describe clusterrole system:coredns

# RoleBinding 조회
kubectl get rolebinding -A
kubectl describe rolebinding -n kube-system kube-proxy

# ClusterRoleBinding 조회
kubectl get clusterrolebinding
kubectl describe clusterrolebinding cluster-admin

# 테스트 파드 배포
kubectl run nginx --image=nginx

# SA 마운트 확인
kubectl describe pod nginx | grep Mounts -A1

# 파드 접근
kubectl exec -it nginx -- /bin/bash

## 토큰 및 인증서 확인
cd /var/run/secrets/kubernetes.io/serviceaccount && ls -lah

# 클러스터 인증서 & 토큰 확인
cat ca.crt
cat token

# API Server 호출
APISERVER=https://kubernetes.default.svc
SERVICEACCOUNT=/var/run/secrets/kubernetes.io/serviceaccount
NAMESPACE=$(cat ${SERVICEACCOUNT}/namespace)
TOKEN=$(cat ${SERVICEACCOUNT}/token)
CACERT=${SERVICEACCOUNT}/ca.crt

curl --cacert ${CACERT} --header "Authorization: Bearer ${TOKEN}" -X GET ${APISERVER}/api

# K8S Service 호출
APISERVER=https://kubernetes.default.svc
SERVICEACCOUNT=/var/run/secrets/kubernetes.io/serviceaccount
NAMESPACE=$(cat ${SERVICEACCOUNT}/namespace)
TOKEN=$(cat ${SERVICEACCOUNT}/token)
CACERT=${SERVICEACCOUNT}/ca.crt

curl --cacert ${CACERT} --header "Authorization: Bearer ${TOKEN}" -X GET ${APISERVER}/api/v1/services

# 테스트를 위해 Service Account 에 클러스터 어드민 권한 부여
kubectl create clusterrolebinding default-sa-test \
	--clusterrole cluster-admin \
	--serviceaccount default:default

# 다시 호출 K8S Service 호출
APISERVER=https://kubernetes.default.svc
SERVICEACCOUNT=/var/run/secrets/kubernetes.io/serviceaccount
NAMESPACE=$(cat ${SERVICEACCOUNT}/namespace)
TOKEN=$(cat ${SERVICEACCOUNT}/token)
CACERT=${SERVICEACCOUNT}/ca.crt

curl --cacert ${CACERT} --header "Authorization: Bearer ${TOKEN}" -X GET ${APISERVER}/api/v1/services

# Default Namespace 리소스 조회
curl --cacert ${CACERT} --header "Authorization: Bearer ${TOKEN}" -X GET ${APISERVER}/api/v1/namespaces/default/services

# API Server 호출을 통한 Pod 생성
cd /

cat > busy-box.json <<EOF
{
  "apiVersion": "v1",
  "kind": "Pod",
  "metadata": {
    "name": "busybox-1"
  },
  "spec": {
    "containers": [
      {
        "name": "busybox",
        "image": "busybox",
        "env": [
          {
            "name": "CREATE_LOCATION",
            "value": "Nginx Pod using token"
          }
        ],
        "command": [
          "/bin/sh"
        ],
        "args": [
          "-c",
          "while true; do echo \$(CREATE_LOCATION); sleep 10; done"
        ]
      }
    ]
  }
}
EOF

# API Server 호출
curl --cacert ${CACERT} -k -v -X POST -H "Authorization: Bearer ${TOKEN}" -H "Content-Type: application/json" ${APISERVER}/api/v1/namespaces/default/pods -d@busy-box.json

• Kubectl 자동 완성

# Linux Bash
# 자동 완성 및 alias 축약 설정
source <(kubectl completion bash)
echo 'source <(kubectl completion bash)' >> ~/.bashrc

echo 'alias k=kubectl' >> ~/.bashrc
echo 'complete -F __start_kubectl k' >> ~/.bashrc

• Krew installing

(
  set -x; cd "$(mktemp -d)" &&
  OS="$(uname | tr '[:upper:]' '[:lower:]')" &&
  ARCH="$(uname -m | sed -e 's/x86_64/amd64/' -e 's/\(arm\)\(64\)\?.*/\1\2/' -e 's/aarch64$/arm64/')" &&
  KREW="krew-${OS}_${ARCH}" &&
  curl -fsSLO "https://github.com/kubernetes-sigs/krew/releases/latest/download/${KREW}.tar.gz" &&
  tar zxvf "${KREW}.tar.gz" &&
  ./"${KREW}" install krew
)

export PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH"

echo 'export PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH"' >> ~/.zshrc

• kube-ctx : 쿠버네티스 컨텍스트 사용 간소화

# 설치
kubectl krew install ctx

# 컨텍스트 확인
kubectl ctx

# 컨텍스트 사용 
kubectl ctx <각자 자신의 컨텍스트 이름>

• kube-ns : 네임스페이스(단일 클러스터 내에서 가상 클러스터) 사용

# 설치
kubectl krew install ns

# 네임스페이스 확인
kubectl ns

# kube-system 네임스페이스 선택 사용
kubectl ns kube-system

# default 네임스페이스 선택 사용
kubectl ns -
혹은
kubectl ns default

• get-all : kubectl get all 로도 안보이는 쿠버네티스의 모든 리소스 조회

# 설치
kubectl krew install get-all

# 네임스페이스 확인
kubectl get-all -n kube-system

• neat : kubectl yaml 파일 형태로 리소스 출력

# 설치
kubectl krew install neat

# 배포
k run nginx --image nginx

# 파드 정보 확인
k get pods nginx -o yaml | k neat

• k9s install
  • ..지만 linux에서 익숙한 package manager(dnf/apt) 는 없음
  • github release에서 .rpm/.deb 설치 또는
  • binary 설치

wget https://github.com/derailed/k9s/releases/download/v0.50.4/k9s_linux_amd64.deb
sudo dpkg -i k9s_linux_amd64.deb
sudo apt-get install -f
k9s

or

curl -LO https://github.com/derailed/k9s/releases/download/v0.50.4/k9s_Linux_amd64.tar.gz
tar zxvf k9s_Linux_amd64.tar.gz
sudo mv k9s /usr/local/bin/
k9s version

• krew

• k9s