腳本之家服務(wù)器常用軟件

快捷導(dǎo)航

K8s中的臨時(shí)容器Ephemeral?Containers使用

更新時(shí)間：2024年07月30日 10:21:50 作者：跳躍音符#3712

這篇文章主要介紹了K8s中的臨時(shí)容器Ephemeral?Containers使用,具有很好的參考價(jià)值,希望對(duì)大家有所幫助,如有錯(cuò)誤或未考慮完全的地方,望不吝賜教

臨時(shí)容器 Ephemeral Containers

當(dāng)由于容器崩潰或容器鏡像不包含調(diào)試工具而導(dǎo)致 kubectl exec 無用時(shí)，臨時(shí)容器對(duì)于交互式故障排查很有用。
尤其是，Distroless 鏡像允許用戶部署最小的容器鏡像，從而減少攻擊面并減少故障和漏洞的暴露。
由于distroless鏡像不包含 Shell 或任何的調(diào)試工具，因此很難單獨(dú)使用 kubectl exec 命令進(jìn)行故障排查。
使用臨時(shí)容器時(shí)，啟用進(jìn)程名字空間共享很有幫助，可以查看其他容器中的進(jìn)程。

開啟臨時(shí)容器功能

開啟特性

1. master 節(jié)點(diǎn)配置 APIServer 組件
[root@vms120 ~]# cat /etc/kubernetes/manifests/kube-apiserver.yaml
- --feature-gates=EphemeralContainers=true
...

2. master 節(jié)點(diǎn)配置 controller-manager
[root@vms120 ~]# vim /etc/kubernetes/manifests/kube-controller-manager.yaml
spec:
  containers:
  - command:
    - --feature-gates=EphemeralContainers=true            # 增加
...

3. master 節(jié)點(diǎn)配置 kube-scheduler
[root@vms120 ~]# vim /etc/kubernetes/manifests/kube-scheduler.yaml
spec:
  containers:
  - command:
    - --feature-gates=EphemeralContainers=true            # 增加
# 重啟服務(wù) 
[root@vms120 ~]# systemctl restart kubelet.service

4. 所有 node 節(jié)點(diǎn)配置 kubelet 參數(shù)
添加 --feature-gates=EphemeralContainers=true
[root@vms121 kubernetes]# cat /var/lib/kubelet/kubeadm-flags.env
KUBELET_KUBEADM_ARGS="--network-plugin=cni --pod-infra-container-image=registry.aliyuncs.com/google_containers/pause:3.6 --feature-gates=EphemeralContainers=true"
# 重啟 node kubelet 服務(wù)
[root@vms121 kubernetes]# systemctl daemon-reload
[root@vms121 kubernetes]# systemctl restart kubelet

測(cè)試

1. 創(chuàng)建 pod
[root@vms120 ~]# kubectl run ephemeral-demo --image=registry.aliyuncs.com/google_containers/pause:3.2 --restart=Never
pod/ephemeral-demo created

[root@vms120 ~]# kubectl  exec -it ephemeral-demo  -- sh
OCI runtime exec failed: exec failed: unable to start container process: exec: "sh": executable file not found in $PATH: unknown
command terminated with exit code 126
# 無法 kubectl exec

解決無法exec，我們創(chuàng)建一個(gè)臨時(shí)容器添加到這個(gè)pod里

加上-i參數(shù)將直接進(jìn)入添加的臨時(shí)容器的控制臺(tái)界面，因?yàn)槭鞘褂胟ubectl run 創(chuàng)建的pod，所以需要-target 參數(shù)指定另一個(gè)容器的進(jìn)程命名空間。

因?yàn)?kubectl run 不能在它創(chuàng)建的pod中啟用共享進(jìn)程命名空間

[root@vms120 ~]# kubectl debug -it ephemeral-demo --image=busybox --target=ephemeral-demo
Targeting container "ephemeral-demo". If you don't see processes from this container it may be because the container runtime doesn't support this feature.
Defaulting debug container name to debugger-bljnj.
If you don't see a command prompt, try pressing enter.
/ # ls
bin   dev   etc   home  proc  root  sys   tmp   usr   var
/ #

此時(shí)再去看pod 的信息會(huì)發(fā)現(xiàn)已經(jīng)被添加了一個(gè)類型為ephemeralContainers的容器

[root@vms120 ~]# kubectl  get pod ephemeral-demo   -o json|jq .spec
{
  "containers": [
    {
      "image": "registry.aliyuncs.com/google_containers/pause:3.2",
      "imagePullPolicy": "IfNotPresent",
      "name": "ephemeral-demo",
      "resources": {},
      "terminationMessagePath": "/dev/termination-log",
      "terminationMessagePolicy": "File",
      "volumeMounts": [
        {
          "mountPath": "/var/run/secrets/kubernetes.io/serviceaccount",
          "name": "kube-api-access-sqmzl",
          "readOnly": true
        }
      ]
    }
  ],
  "dnsPolicy": "ClusterFirst",
  "enableServiceLinks": true,
  "ephemeralContainers": [
    {
      "image": "busbox",
      "imagePullPolicy": "Always",
      "name": "debugger-9l8mw",
      "resources": {},
      "stdin": true,
      "targetContainerName": "ephemeral-demo",
      "terminationMessagePath": "/dev/termination-log",
      "terminationMessagePolicy": "File",
      "tty": true
    },
    {
      "image": "busybox",
      "imagePullPolicy": "Always",
      "name": "debugger-slx6g",
      "resources": {},
      "stdin": true,
      "targetContainerName": "ephemeral-demo",
      "terminationMessagePath": "/dev/termination-log",
      "terminationMessagePolicy": "File",
      "tty": true
    },
    {
      "image": "busybox",
      "imagePullPolicy": "Always",
      "name": "debugger-gw6zt",
      "resources": {},
      "stdin": true,
      "terminationMessagePath": "/dev/termination-log",
      "terminationMessagePolicy": "File"
    },
    {
      "image": "busybox",
      "imagePullPolicy": "Always",
      "name": "debugger-cxc8b",
      "resources": {},
      "stdin": true,
      "targetContainerName": "ephemeral-demo",
      "terminationMessagePath": "/dev/termination-log",
      "terminationMessagePolicy": "File",
      "tty": true
    },
    {
      "image": "busybox",
      "imagePullPolicy": "Always",
      "name": "debugger-bljnj",
      "resources": {},
      "stdin": true,
      "targetContainerName": "ephemeral-demo",
      "terminationMessagePath": "/dev/termination-log",
      "terminationMessagePolicy": "File",
      "tty": true
    }
  ],
  "nodeName": "vms121.rhce.cc",
  "preemptionPolicy": "PreemptLowerPriority",
  "priority": 0,
  "restartPolicy": "Never",
  "schedulerName": "default-scheduler",
  "securityContext": {},
  "serviceAccount": "default",
  "serviceAccountName": "default",
  "terminationGracePeriodSeconds": 30,
  "tolerations": [
    {
      "effect": "NoExecute",
      "key": "node.kubernetes.io/not-ready",
      "operator": "Exists",
      "tolerationSeconds": 300
    },
    {
      "effect": "NoExecute",
      "key": "node.kubernetes.io/unreachable",
      "operator": "Exists",
      "tolerationSeconds": 300
    }
  ],
  "volumes": [
    {
      "name": "kube-api-access-sqmzl",
      "projected": {
        "defaultMode": 420,
        "sources": [
          {
            "serviceAccountToken": {
              "expirationSeconds": 3607,
              "path": "token"
            }
          },
          {
            "configMap": {
              "items": [
                {
                  "key": "ca.crt",
                  "path": "ca.crt"
                }
              ],
              "name": "kube-root-ca.crt"
            }
          },
          {
            "downwardAPI": {
              "items": [
                {
                  "fieldRef": {
                    "apiVersion": "v1",
                    "fieldPath": "metadata.namespace"
                  },
                  "path": "namespace"
                }
              ]
            }
          }
        ]
      }
    }
  ]
}

有些時(shí)候 Pod 的配置參數(shù)使得在某些情況下很難執(zhí)行故障排查。

例如，在容器鏡像中不包含 shell 或者你的應(yīng)用程序在啟動(dòng)時(shí)崩潰的情況下，就不能通過運(yùn)行 kubectl exec 來排查容器故障。

在這些情況下，你可以使用 kubectl debug 來創(chuàng)建 Pod 的副本，通過更改配置幫助調(diào)試。

報(bào)錯(cuò)

error: ephemeral containers are disabled for this cluster (error from server: "the server could not find the requested resource").

未成功開啟ephemeralContainers特性

總結(jié)

以上為個(gè)人經(jīng)驗(yàn)，希望能給大家一個(gè)參考，也希望大家多多支持腳本之家。

您可能感興趣的文章:

欧美bbbwbbbw肥妇,免费乱码人妻系列日韩,一级黄片

K8s中的臨時(shí)容器Ephemeral?Containers使用

目錄

臨時(shí)容器 Ephemeral Containers

開啟臨時(shí)容器功能

開啟特性

測(cè)試

解決無法exec，我們創(chuàng)建一個(gè)臨時(shí)容器添加到這個(gè)pod里

報(bào)錯(cuò)

總結(jié)

相關(guān)文章

最新評(píng)論

大家感興趣的內(nèi)容

最近更新的內(nèi)容

常用在線小工具

欧美bbbwbbbw肥妇,免费乱码人妻系列日韩,一级黄片

K8s中的臨時(shí)容器Ephemeral?Containers使用

目錄

臨時(shí)容器 Ephemeral Containers

開啟臨時(shí)容器功能

開啟特性

測(cè)試

解決無法exec，我們創(chuàng)建一個(gè)臨時(shí)容器添加到這個(gè)pod里

報(bào)錯(cuò)

總結(jié)

相關(guān)文章

最新評(píng)論

大家感興趣的內(nèi)容

最近更新的內(nèi)容

常用在線小工具

解決無法exec，我們創(chuàng)建一個(gè)臨時(shí)容器添加到這個(gè)pod里