笔者在开发和运维部门的Kubernetes经常遇到一些需要处理的问题,整理如下,作为备忘,同时希望对读者可以起到一定帮助.

1. kubeadm token list
2. 默认情况下，token的有效期是24小时，如果token已经过期的话，
3. kubeadm token create
4. 如果找不到hash可以执行：
5. openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //'
6. 登录到node3服务器重新执行加入集群命令就OK了
7. ps:若出现Failed to connect to API Server "<master-ip>:<master-port（6443）>": cluster CA found in cluster-info configmap is invalid: public key sha256:xxxxxxxxxx not pinned
8. kubeadm join --token <token> <master-ip>:<master-port（6443）> --discovery-token-unsafe-skip-ca-verification

ps:token 过期的话会加入不成功提示Unauthorized，换个不过期的token就好了

[root@bitnei-test-k8s-jenkins ~]# cat /etc/docker/daemon.json 
{
      "insecure-registries": [
        "192.168.64.158"
      ]
}

`kubernetes`日志收集可以采用挂载NFS方式收集,或者采用守护容器的方式,启动`filebeat`采集日志发送到ES中,来查询日志.相对于第一种方案
在生产环境测试发现对pod的运行会产生一定的速度响应上的影响,第二种方案会消耗一部分每一个pod的资源.生产环境建议采用第二种方案.以下为
采集`nginx`日志为例,采集jar日志,或者`Python`,`golang`应用日志可以触类旁通.

   apiVersion: v1
   kind: Service
   metadata:
     name: pre-saas-nginx-auth
     namespace: saas-test
   spec:
     selector:
       app: pre-saas-nginx-auth
     ports:
     - name: http
       port: 80
       targetPort: 80
   
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: pre-saas-nginx-auth
     namespace: saas-test
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: pre-saas-nginx-auth
     template:
       metadata:
         labels:
           app: pre-saas-nginx-auth
       spec:
         containers:
         - name: pre-saas-nginx-auth
           image: 10.10.26.34/saas_test/pre-saas-nginx-auth:20190923090031
           imagePullPolicy: Always
           ports:
           - name: http
             containerPort: 80
           volumeMounts:
           - name: nginx-logs
             mountPath: /var/log/nginx/
         # 此处为filebeat 守护容器
         - name: filebeat
           image: docker.elastic.co/beats/filebeat:6.4.2
           args: [
             "-c", "/etc/filebeat.yml",
             "-e",
           ]
           resources:
             limits:
               memory: 500Mi
             requests:
               cpu: 100m
               memory: 100Mi
           securityContext:
             runAsUser: 0
   		# 由于同一个pod内部共享文件系统,所以把nginx容器日志目录挂载到filebeat容器中
           volumeMounts:
   		  # 这里采用configMap方式注入配置文件
           - name: filebeat-config
             mountPath: /etc/filebeat.yml
             subPath: filebeat.yml
           - name: nginx-logs
             mountPath: /var/log/nginx/
   
         volumes:
         - name: nginx-logs
           emptyDir: {}
         - name: filebeat-config
           configMap:
             name: filebeat-auth-nginx-config

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: filebeat-front-nginx-config
     namespace: saas-test
     
   data:
     filebeat.yml: |-
       filebeat.prospectors:
       - input_type: log
	   # 采集此路径文件
         paths:
           - "/var/log/nginx/*"
	   # 索引名称
       setup.template.name: "saas-test-front-nginx-log"
	   # 索引模板
       setup.template.pattern: "saas-test-front-nginx-log-*"
       output.elasticsearch:
	   # ES地址
         hosts: ["10.10.21.6:9200"]
         index: "saas-test-front-nginx-logs"

以上为笔者在开发和运维部门k8s服务中遇到问题和笔记记录,希望对读者起到一定的帮助作用.