kubectl 速查手册
---
kind: Pod
apiVersion: v1
metadata:
name: myweb
labels:
app: nginx
spec:
containers:
- name: webserver
image: nginx
status: {}
# 更新资源所关联的注释信息
#-----------------------------------------#
[root@master k8s]# kubectl apply -f mypod.yaml --record
[root@master k8s]# kubectl get pod mypod -o custom-columns=podName:.metadata.name,annotations:.metadata.annotations."kubernetes\.io/change-cause"
podName annotations
mypod kubectl apply --filename=mypod.yaml --record=true
[root@master k8s]# kubectl annotate pods mypod kubernetes.io/change-cause='my description'
pod/mypod annotated
[root@master k8s]# kubectl get pod mypod -o custom-columns=podName:.metadata.name,annotations:.metadata.annotations."kubernetes\.io/change-cause"
podName annotations
mypod my description
# 显示服务器上所支持的 API 资源
# -o wide 可以用来查询资源权限
#-----------------------------------------#
[root@master k8s]# kubectl api-resources -o wide
NAME SHORTNAMES APIVERSION NAMESPACED KIND VERBS
pods po v1 true Pod [get list patch ...]
namespaces ns v1 false Namespace [create get ...]
# 显示服务端所支持的 API 版本
#-----------------------------------------#
[root@master k8s]# kubectl api-versions
admissionregistration.k8s.io/v1
apps/v1
... ...
v1
# 读取资源文件,将新的配置应用到资源上
#-----------------------------------------#
[root@master k8s]# kubectl apply -f mypod.yaml
pod/mypod created
[root@master k8s]# sed 's,mypod,myweb,g' mypod.yaml |kubectl apply -f -
pod/myweb created
[root@master k8s]# kubectl get pods
NAME READY STATUS RESTARTS AGE
mypod 1/1 Running 0 36s
myweb 1/1 Running 0 4s
# 连接一个正在运行的容器的启动进程
#-----------------------------------------#
[root@master k8s]# kubectl attach mypod -c linux
If you don't see a command prompt, try pressing enter.
10.244.219.64:44372: response:200
# 检查授权信息
#-----------------------------------------#
[root@master k8s]# kubectl --kubeconfig=admin.conf auth can-i get pods
yes
[root@master k8s]# kubectl --kubeconfig=auth.conf auth can-i get pods
no
# 创建一个HPA控制器,对资源对象进行自动扩缩
#-----------------------------------------#
[root@master k8s]# kubectl apply -f myDeploy.yaml
deployment.apps/myweb created
[root@master k8s]# kubectl autoscale deployment myweb --min=1 --max=10 --cpu-percent=80
horizontalpodautoscaler.autoscaling/myweb autoscaled
[root@master k8s]# kubectl get horizontalpodautoscalers.autoscaling
NAME REFERENCE TARGETS MINPODS MAXPODS REPLICAS AGE
myweb Deployment/myweb 10%/80% 1 10 1 27m
#-----------------------------------------#
---
apiVersion: autoscaling/v1
kind: HorizontalPodAutoscaler
metadata:
name: myweb
spec:
minReplicas: 1
maxReplicas: 10
scaleTargetRef:
apiVersion: apps/v1
kind: Deployment
name: myweb
targetCPUUtilizationPercentage: 80
# 修改证书资源
#-----------------------------------------#
[root@master k8s]# kubectl get certificatesigningrequests
NAME AGE REQUESTOR CONDITION
csr-wsfz7 8s system:node:master Pending
[root@master k8s]# kubectl certificate approve csr-wsfz7
[root@master k8s]# kubectl get certificatesigningrequests
NAME AGE REQUESTOR CONDITION
csr-wsfz7 86s system:node:master Approved,Issued
# 显示集群信息
#-----------------------------------------#
[root@master k8s]# kubectl cluster-info
Kubernetes control plane is running at https://192.168.1.10:6443
CoreDNS is running at https://192.168.1.10:6443/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy
To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
# 根据已经给出的 Shell 输出补全代码
#-----------------------------------------#
[root@master k8s]# source <(kubectl completion bash|tee /etc/bash_completion.d/kubectl)
# 配置管理 kubeconfig 文件
# 创建普通认证用户中的 CN 代表用户名,O 代表组名称
#-----------------------------------------#
[root@master k8s]# openssl genrsa -out luck.key 2048
[root@master k8s]# openssl req -new -key luck.key -out luck.csr -subj "/CN=luck/O=tedu"
[root@master k8s]# mycsr=$(base64 luck.csr |tr -d '\n')
[root@master k8s]# cat < ---apiVersion: certificates.k8s.io/v1kind: CertificateSigningRequestmetadata:name: luck-tokenspec:groups:- system:authenticatedrequest: ${mycsr}signerName: kubernetes.io/kube-apiserver-clientusages:- client authEOF[root@master k8s]# kubectl get certificatesigningrequests.certificates.k8s.ioNAME AGE SIGNERNAME ... CONDITIONluck-token 12s kubernetes.io/kube-apiserver-client ... Pending[root@master k8s]# kubectl certificate approve luck-token[root@master k8s]# kubectl get certificatesigningrequests.certificates.k8s.ioNAME AGE SIGNERNAME ... CONDITIONluck-token 33s kubernetes.io/kube-apiserver-client ... Approved,Issued[root@master k8s]# kubectl get certificatesigningrequests.certificates.k8s.io luck-token -o jsonpath='{.status.certificate}'| base64 -d >luck.crt[root@master k8s]# kubectl config --kubeconfig=auth.conf set-cluster k8s-cluster --server=https://192.168.1.10:6443 --certificate-authority=/etc/kubernetes/pki/ca.crt --embed-certs=true[root@master k8s]# kubectl config --kubeconfig=auth.conf set-credentials adminuser-luck --client-certificate=luck.crt --client-key=luck.key --embed-certs=true[root@master k8s]# kubectl config --kubeconfig=auth.conf set-context node-cluster --cluster=k8s-cluster --user=adminuser-luck --namespace=default[root@master k8s]# kubectl config --kubeconfig=auth.conf use-context node-cluster[root@master k8s]# kubectl create clusterrolebinding luckrole --clusterrole=cluster-admin --user=luck[root@master k8s]# kubectl config --kubeconfig=auth.conf get-clustersNAMEk8s-cluster[root@master k8s]# kubectl config --kubeconfig=auth.conf get-usersNAMEadminuser-luck[root@master k8s]# kubectl config --kubeconfig=auth.conf get-contextsCURRENT NAME CLUSTER AUTHINFO NAMESPACE* node-cluster k8s-cluster adminuser-luck defaultconvert
# 在不同的 API 版本之间转换配置文件# 在高版本中已经删除了#-----------------------------------------#[root@master k8s]# kubectl convert -f myPod.yamlcordon
# 标记节点为不可调度的#-----------------------------------------#[root@master k8s]# kubectl get nodesNAME STATUS ROLES AGE VERSIONmaster Ready master 15h v1.22.5node-0001 Ready node 15h v1.22.5[root@master k8s]# kubectl cordon node-0001node/node-0001 cordoned[root@master k8s]# kubectl get nodesNAME STATUS ROLES AGE VERSIONmaster Ready master 15h v1.22.5node-0001 Ready,SchedulingDisabled node 15h v1.22.5cp
# 将文件和目录拷入/拷出容器#-----------------------------------------#[root@master k8s]# kubectl get podsNAME READY STATUS RESTARTS AGEmyweb-759ffdd494-9956m 1/1 Running 0 5h13m[root@master k8s]# kubectl cp myweb-759ffdd494-9956m:/var/www/html/index.html ./index.htmltar: Removing leading `/' from member names[root@master k8s]# ls index.htmlindex.html[root@master k8s]# echo "hello world" > index.html[root@master k8s]# kubectl cp index.html myweb-759ffdd494-9956m:/var/www/html/index.html[root@master k8s]# curl http://10.244.21.168hello worldcreate
# 通过文件或标准输入来创建资源或用来生成资源文件#-----------------------------------------#[root@master k8s]# kubectl create namespace testapp[root@master k8s]# kubectl create namespace testapp --dry-run=client -o yamlapiVersion: v1kind: Namespacemetadata:creationTimestamp: nullname: testappspec: {}status: {}debug
# 创建调试会话,使用附加容器引用目标资源# 所有节点都需要打开临时容器特性#-----------------------------------------#[root@master k8s]# kubectl run myapp --image=registry:5000/k8s/pause:3.5 --restart=Never[root@master k8s]# kubectl debug myapp -it --image=registry:5000/busybox:latest --share-processes --copy-to=debugger/ # pstree -ppause(1)#-----------------------------------------#[root@master k8s]# vim /etc/kubernetes/manifests/kube-apiserver.yaml- --feature-gates=EphemeralContainers=true[root@master k8s]# vim /var/lib/kubelet/config.yamlfeatureGates:EphemeralContainers: true[root@master k8s]# systemctl restart kubelet[root@master k8s]# kubectl run myapp --image=registry:5000/k8s/pause:3.5 --restart=Neverpod/myapp created[root@master k8s]# kubectl debug -it myapp --image=registry:5000/busybox:latest --target=myapp~ # pstree -p 0?(0)-+-pause(1)`-sh(7)---pstree(27)~ # ls /proc/1/root/dev etc pause proc sys var~ #delete
# 通过文件名或资源和名字删除资源#-----------------------------------------#[root@master k8s]# kubectl get podsNAME READY STATUS RESTARTS AGEdebugger 2/2 Running 1 (3s ago) 6smypod 1/1 Running 0 40s[root@master k8s]# kubectl delete pod debuggerpod "debugger" deleted[root@master k8s]# kubectl delete -f mypod.yamlpod "mypod" deleted[root@master k8s]# kubectl get podsNo resources found in default namespace.describe
# 显示某个资源或某组资源的详细信息#-----------------------------------------#[root@master k8s]# kubectl describe pod mypodName: mypodNamespace: defaultPriority: 0Node: node-0001/192.168.1.11...diff
# 显示目前版本与将要应用的版本之间的差异#-----------------------------------------#[root@master k8s]# kubectl diff -f deploy.yamldiff -u -N /tmp/LIVE-242154721/apps.v1.Deployment.default.myweb /tmp/MERGED-718616268/apps.v1.Deployment.default.myweb--- /tmp/LIVE-242154721/apps.v1.Deployment.default.myweb 2021-11-07 15:52:02.711915439 +0800+++ /tmp/MERGED-718616268/apps.v1.Deployment.default.myweb 2021-11-07 15:52:02.711915439 +0800@@ -5,9 +5,9 @@deployment.kubernetes.io/revision: "1"- kubernetes.io/change-cause: httpd.v1+ kubernetes.io/change-cause: httpd.v2creationTimestamp: "2021-11-07T07:51:49Z"- generation: 1+ generation: 2managedFields:- apiVersion: apps/v1fieldsType: FieldsV1...drain
# 清空节点,节点资源被删除也不能被调度#-----------------------------------------#[root@master k8s]# kubectl get nodesNAME STATUS ROLES AGE VERSIONmaster Ready master 36h v1.22.5node-0001 Ready node 36h v1.22.5[root@master k8s]# kubectl drain node-0001 --delete-emptydir-data --ignore-daemonsets --force[root@master k8s]# kubectl get nodesNAME STATUS ROLES AGE VERSIONmaster Ready master 36h v1.22.5node-0001 Ready,SchedulingDisabled node 36h v1.22.5edit
# 修改服务器上的某资源#-----------------------------------------#[root@master k8s]# kubectl edit pod mypod# Please edit the object below. Lines beginning with a '#' will be ignored,# and an empty file will abort the edit. If an error occurs while saving this file will be# reopened with the relevant failures.#apiVersion: v1kind: Pod...exec
# 在一个正在运行的容器中执行命令#-----------------------------------------#[root@master k8s]# kubectl get podsNAME READY STATUS RESTARTS AGEmyweb-759ffdd494-9956m 1/1 Running 0 27m[root@master k8s]# kubectl exec -it myweb-759ffdd494-9956m -c httpd -- /bin/bash[root@myweb-759ffdd494-9956m html]# lsindex.html info.html info.phpexplain
# 显示资源的帮助信息#-----------------------------------------#[root@master k8s]# kubectl explain pod.specKIND: PodVERSION: v1RESOURCE: specDESCRIPTION:Specification of the desired behavior of the pod. More info:https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-statusPodSpec is a description of a pod....expose
# 为资源创建 service#-----------------------------------------#[root@master k8s]# [root@master k8s]# kubectl expose deployment myweb --port=80 --protocol=TCP --target-port=80 --name=webservice --type ClusterIP#-----------------------------------------#---apiVersion: v1kind: Servicemetadata:name: webservicespec:ports:- protocol: TCPport: 80targetPort: 80selector:app: apachetype: ClusterIP#-----------------------------------------#[root@master k8s]# kubectl get serviceNAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGEkubernetes ClusterIP 10.254.0.1443/TCP 36h webservice ClusterIP 10.254.17.18580/TCP 2s [root@master k8s]# curl http://10.254.17.185hello world.get
# 显示一个或者多个资源信息#-----------------------------------------#[root@master k8s]# kubectl get nodesku NAME STATUS ROLES AGE VERSIONmaster Ready master 36h v1.22.5node-0001 Ready node 36h v1.22.5[root@master k8s]# kubectl get podsNAME READY STATUS RESTARTS AGEmypod 1/1 Running 0 5m9s[root@master k8s]# kubectl get pod mypod -o wideNAME READY STATUS RESTARTS IP ...mypod 1/1 Running 0 10.244.21.154 ...[root@master k8s]# kubectl get pod mypod -o yamlapiVersion: v1kind: Podmetadata:...help
# 显示帮助信息#-----------------------------------------#[root@master k8s]# kubectl help runCreate and run a particular image in a pod.Examples:# Start a nginx podkubectl run nginx --image=nginxkustomize
# Kustomize 是一个独立的工具,用来通过 kustomization 文件定制 Kubernetes 对象# 参考文档: https://cloud.tencent.com/developer/article/1745189#-----------------------------------------#[root@master k8s]# vim kustomization.yaml---apiVersion: kustomize.config.k8s.io/v1beta1kind: KustomizationsecretGenerator:- name: mysecretfiles:- password.txt[root@master k8s]# vim password.txtusername=adminpassword=secret[root@master k8s]# kubectl kustomize ./apiVersion: v1data:password.txt: dXNlcm5hbWU9YWRtaW4KcGFzc3dvcmQ9c2VjcmV0Cg==kind: Secretmetadata:name: mysecret-2kdd8ckcc7type: Opaque[root@master k8s]# kubectl apply -k ./secret/mysecret-2kdd8ckcc7 created[root@master k8s]# kubectl get secretsNAME TYPE DATA AGEdefault-token-m7vbm kubernetes.io/service-account-token 3 73dmysecret-2kdd8ckcc7 Opaque 1 4s[root@master k8s]# kubectl delete -k ./secret "mysecret-2kdd8ckcc7" deletedlabel
# 更新资源的标签#-----------------------------------------#[root@master k8s]# kubectl get pods --show-labelsNAME READY STATUS RESTARTS AGE LABELSmypod 1/1 Running 0 7m22s[root@master k8s]# kubectl label pod mypod app=webapppod/mypod labeled[root@master k8s]# kubectl get pods --show-labelsNAME READY STATUS RESTARTS AGE LABELSmypod 1/1 Running 0 7m41s app=webapp[root@master k8s]# kubectl label pod mypod app-pod/mypod labeled[root@master k8s]# kubectl get pods --show-labelsNAME READY STATUS RESTARTS AGE LABELSmypod 1/1 Running 0 68mlogs
# 显示 pod 中某容器的日志#-----------------------------------------#[root@master k8s]# kubectl get podNAME READY STATUS RESTARTS AGEmypod 1/1 Running 0 5h4m[root@master k8s]# kubectl logs mypod -c linux10.244.219.64:34666: response:200options
# 显示所有命令都支持的共有参数列表#-----------------------------------------#[root@master k8s]# kubectl optionsThe following options can be passed to any command:--insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will...patch
# 基于策略性合并修补规则更新某资源中的字段#-----------------------------------------#---apiVersion: v1kind: PersistentVolumemetadata:name: mypvspec:capacity:storage: 5GivolumeMode: FilesystemaccessModes:- ReadWriteOncepersistentVolumeReclaimPolicy: RecyclehostPath:path: /var/webroottype: DirectoryOrCreate#-----------------------------------------#[root@master k8s]# kubectl get pvNAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS AGEmypv 5Gi RWO Recycle Available 5s[root@master k8s]# kubectl patch pv mypv -p '{"spec":{"capacity":{"storage":"8Gi"}}}'persistentvolume/mypv patched[root@master k8s]# kubectl get pvNAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS AGEmypv 8Gi RWO Recycle Available 67splugin
# 运行命令行插件# 插件在 ${PATH} 下,是一个独立的可执行文件,名称以 kubectl- 开头#-----------------------------------------#[root@master k8s]# vim /usr/local/bin/kubectl-gettaint#!/bin/bash/usr/bin/kubectl get nodes -o custom-columns=NodeName:.metadata.name,Taints:.spec.taints[root@master k8s]# chmod 755 /usr/local/bin/kubectl-gettaint[root@master k8s]# kubectl plugin listThe following compatible plugins are available:/usr/local/bin/kubectl-gettaint[root@master k8s]# kubectl gettaintNodeName Taintsmaster [map[effect:NoSchedule key:node-role.kubernetes.io/master]]node-0001port-forward
# 将一个或者多个本地端口转发到 pod#-----------------------------------------#[root@master k8s]# kubectl port-forward --address 0.0.0.0 pod/mypod 8080 80Forwarding from 0.0.0.0:8080 -> 8080Forwarding from 0.0.0.0:80 -> 80#-----------------------------------------#[root@master local]# curl http://master:8080hello world.proxy
# 运行一个 kubernetes API 服务器代理#-----------------------------------------#[root@master k8s]# kubectl proxy --port=80Starting to serve on 127.0.0.1:80#-----------------------------------------#[root@master k8s]# curl http://127.0.0.1/version{"major": "1","minor": "22","gitVersion": "v1.22.5","gitCommit": "c92036820499fedefec0f847e2054d824aea6cd1","gitTreeState": "clean","buildDate": "2021-10-27T18:35:25Z","goVersion": "go1.16.9","compiler": "gc","platform": "linux/amd64"}replace
# 基于文件名或标准输入替换资源#-----------------------------------------#[root@master k8s]# kubectl replace --force -f mypod.yamlpod "mypod" deletedpod/mypod replacedrollout
# 管理资源的上线#-----------------------------------------#[root@master k8s]# kubectl rollout history deploymentdeployment.apps/mywebREVISION CHANGE-CAUSE1 httpd.v12 httpd.v2[root@master k8s]# kubectl rollout undo deployment myweb --to-revision=1deployment.apps/myweb rolled back[root@master k8s]# kubectl rollout history deploymentdeployment.apps/mywebREVISION CHANGE-CAUSE2 httpd.v23 httpd.v1run
# 在集群中使用指定镜像启动容器#-----------------------------------------#[root@master k8s]# kubectl run mypod --image=registry:5000/myos:httpd#-----------------------------------------#---apiVersion: v1kind: Podmetadata:labels:run: mypodname: mypodspec:containers:- image: registry:5000/myos:httpdname: mypodrestartPolicy: Alwaysscale
# 为可扩充资源设置一个新副本数量#-----------------------------------------#[root@master k8s]# kubectl apply -f myDeploy.yamldeployment.apps/myweb created[root@master ~]# kubectl get deployments.appsNAME READY UP-TO-DATE AVAILABLE AGEmyweb 1/1 1 1 21m[root@master ~]# kubectl scale deployment myweb --replicas=3deployment.apps/myweb scaled[root@master ~]# kubectl get deployments.appsNAME READY UP-TO-DATE AVAILABLE AGEmyweb 3/3 3 3 21mset
# 为资源对象设置功能特性#-----------------------------------------#[root@master k8s]# kubectl set env pods --all --list# Pod mypod, container linux[root@master k8s]# kubectl set env deployment/myweb myEnv=proddeployment.apps/myweb env updated[root@master k8s]# kubectl exec -i -t myweb-6c645646c9-pqjc7 -- sh -c 'echo ${myEnv}'prod[root@master k8s]# kubectl get deployments.apps myweb -o wideNAME READY AGE CONTAINERS IMAGES SELECTORmyweb 1/1 25s httpd registry:5000/myos:httpd app=apache[root@master k8s]# kubectl set image deployment/myweb httpd=registry:5000/myos:nginxdeployment.apps/myweb image updated[root@master k8s]# kubectl get deployments.apps myweb -o wideNAME READY AGE CONTAINERS IMAGES SELECTORmyweb 1/1 45s httpd registry:5000/myos:nginx app=apachetaint
# 在一个或者多个节点上更新污点配置#-----------------------------------------#[root@master k8s]# kubectl get nodes -o custom-columns=NodeName:.metadata.name,Taints:.spec.taintsNodeName Taintsmaster [map[effect:NoSchedule key:node-role.kubernetes.io/master]]node-0001[root@master k8s]# kubectl taint node node-0001 k=v:PreferNoSchedulenode/node-0001 tainted[root@master k8s]# kubectl get nodes -o custom-columns=NodeName:.metadata.name,Taints:.spec.taintsNodeName Taintsmaster [map[effect:NoSchedule key:node-role.kubernetes.io/master]]node-0001 [map[effect:PreferNoSchedule key:k value:v]][root@master k8s]# kubectl taint node node-0001 k-node/node-0001 untainted[root@master k8s]# kubectl get nodes -o custom-columns=NodeName:.metadata.name,Taints:.spec.taintsNodeName Taintsmaster [map[effect:NoSchedule key:node-role.kubernetes.io/master]]node-0001top
# 显示资源(CPU /内存/存储)使用率#-----------------------------------------#[root@master k8s]# kubectl top nodesNAME CPU(cores) CPU% MEMORY(bytes) MEMORY%master 90m 4% 1210Mi 14%node-0001 45m 2% 931Mi 11%[root@master k8s]# kubectl top podsNAME CPU(cores) MEMORY(bytes)mypod 5m 8Mi[root@master k8s]#uncordon
# 解除(cordon、drain)资源不可调度标记#-----------------------------------------#[root@master k8s]# kubectl get nodesNAME STATUS ROLES AGE VERSIONmaster Ready master 15h v1.22.5node-0001 Ready,SchedulingDisabled node 15h v1.22.5[root@master k8s]# kubectl uncordon node-0001node/node-0001 uncordoned[root@master k8s]# kubectl get nodesNAME STATUS ROLES AGE VERSIONmaster Ready master 15h v1.22.5node-0001 Ready node 15h v1.22.5version
# 显示客户端和服务器的版本信息#-----------------------------------------#[root@master k8s]# kubectl version -o yamlclientVersion:buildDate: "2021-10-27T18:41:28Z"compiler: gcgitCommit: c92036820499fedefec0f847e2054d824aea6cd1gitTreeState: cleangitVersion: v1.22.5goVersion: go1.16.9major: "1"minor: "22"platform: linux/amd64serverVersion:buildDate: "2021-10-27T18:35:25Z"compiler: gcgitCommit: c92036820499fedefec0f847e2054d824aea6cd1gitTreeState: cleangitVersion: v1.22.5goVersion: go1.16.9major: "1"minor: "22"platform: linux/amd64wait
# 等待一个或多个资源达到某种状态#-----------------------------------------#---kind: PodapiVersion: v1metadata:name: mypodspec:terminationGracePeriodSeconds: 0initContainers:- name: myinitimage: registry:5000/busybox:latestimagePullPolicy: IfNotPresentcommand: ["sleep", "10"]containers:- name: linuximage: registry:5000/busybox:latestimagePullPolicy: IfNotPresentcommand: ["sh", "-c"]args:- |echo "hello world !!!" >/var/www/index.htmlhttpd -v -f -p 0.0.0.0:80 -h /var/wwwrestartPolicy: Always#-----------------------------------------#[root@master k8s]# kubectl replace --force -f mypod.yamlpod "mypod" deletedpod/mypod replaced[root@master k8s]# time kubectl wait --for=condition=Ready pod/mypodpod/mypod condition metreal 0m10.335suser 0m0.034ssys 0m0.008s