8장. 애플리케이션에서 파드 메타데이터와 그 외의 리소스에 액세스하기

apiVersion: v1 kind: Pod metadata: name: downward spec: containers: - name: main image: busybox command: ["sleep", "9999999"] resources: requests: cpu: 15m memory: 100Ki limits: cpu: 100m memory: 4Mi env: # 환경변수 - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name # pod manifest 의 metadata.name 사용 - name: POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: POD_IP valueFrom: fieldRef: fieldPath: status.podIP - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName - name: SERVICE_ACCOUNT valueFrom: fieldRef: fieldPath: spec.serviceAccountName - name: CONTAINER_CPU_REQUEST_MILLICORES valueFrom: resourceFieldRef: resource: requests.cpu divisor: 1m - name: CONTAINER_MEMORY_LIMIT_KIBIBYTES valueFrom: resourceFieldRef: resource: limits.memory divisor: 1Ki

kubectl exec -it downward -- env

kubectl exec downward -- ls 1L /etc/downward

kubectl exec downward -- cat /etc/downward/annotations

volumes: - name: downward downwardAPI: items: - path: "containerMemoryLimitBytes" resourceFieldRef: containerName: main # container 의 이름 resource: limits.memory divisor: 1

kubectl cluster-info

kubectl proxy &

{ "kind": "APIGroup", "apiVersion": "v1", "name": "batch", "versions": [ { "groupVersion": "batch/v1", "version": "v1" }, { "groupVersion": "batch/v1beta1", "version": "v1beta1" } ], "preferredVersion": { // 선호 "groupVersion": "batch/v1", "version": "v1" } }

curl localhost:8001/apis/batch/v1/jobs

{ "kind": "JobList", "apiVersion": "batch/v1", "metadata": { "resourceVersion": "34801" }, "items": [] }

apiVersion: batch/v1 kind: Job metadata: name: my-job spec: template: metadata: labels: app: batch-job spec: restartPolicy: OnFailure containers: - name: main image: luksa/batch-job

kubectl get job my-job -o json

apiVersion: v1 kind: Pod metadata: name: curl spec: containers: - name: main image: tutum/curl command: ["sleep", "9999999"]

kubectl exec -it curl -- bash

kubectl get svc

kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead. KUBERNETES_SERVICE_PORT_HTTPS=443 KUBERNETES_SERVICE_PORT=443 KUBERNETES_SERVICE_HOST=10.96.0.1

k exec -it curl ls /var/run/secrets/kubernetes.io/serviceaccount/

ca.crt namespace token

k exec curl -- curl --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt https://kubernetes

{ "kind": "Status", "apiVersion": "v1", "metadata": { }, "status": "Failure", "message": "forbidden: User \"system:anonymous\" cannot get path \"/\"", "reason": "Forbidden", "details": { }, "code": 403 }

export CURL_CA_BUNDLE=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt

curl https://kubernetes

TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)

curl -H "Authorization: Bearer $TOKEN" https://kubernetes

{ "kind": "Status", "apiVersion": "v1", "metadata": { }, "status": "Failure", "message": "forbidden: User \"system:serviceaccount:default:default\" cannot get path \"/\"", "reason": "Forbidden", "details": { }, "code": 403 }

{ "kind": "APIVersions", "versions": [ "v1" ], "serverAddressByClientCIDRs": [ { "clientCIDR": "0.0.0.0/0", "serverAddress": "192.168.49.2:8443" } ] }

ca.crt namespace token

apiVersion: v1 kind: Pod metadata: name: curl-with-ambassador spec: containers: - name: main image: tutum/centos command: ["sleep", "9999999"] - name: ambassador image: luksa/kubectl-proxy:1.6.2

kubectl exec -it curl-with-ambassador -c main -- bash

package kubia; import io.fabric8.kubernetes.api.model.Pod; import io.fabric8.kubernetes.api.model.PodList; import io.fabric8.kubernetes.client.DefaultKubernetesClient; import io.fabric8.kubernetes.client.KubernetesClient; import java.util.Arrays; public class Fabric8ClientTest { public static void main(String[] args) throws Exception { KubernetesClient client = new DefaultKubernetesClient(); // list pods in the default namespace PodList pods = client.pods().inNamespace("default").list(); pods.getItems().stream().forEach(s -> System.out.println("Found pod: " + s.getMetadata().getName())); // create a pod System.out.println("Creating a pod"); Pod pod = client.pods().inNamespace("default").createNew() .withNewMetadata() .withName("my-programmatically-created-pod") .endMetadata() .withNewSpec() .addNewContainer() .withName("main") .withImage("busybox") .withCommand(Arrays.asList("sleep", "99999")) .endContainer() .endSpec() .done(); System.out.println("Created pod: " + pod); // edit the pod (add a label to it) client.pods().inNamespace("default").withName("my-programmatically-created-pod").edit() .editMetadata() .addToLabels("foo", "bar") .endMetadata() .done(); System.out.println("Added label foo=bar to pod"); System.out.println("Waiting 1 minute before deleting pod..."); Thread.sleep(60000); // delete the pod client.pods().inNamespace("default").withName("my-programmatically-created-pod").delete(); System.out.println("Deleted the pod"); } }

minikube start --extra-config=apiserver.Features.EnableSwaggerUI=true

http(s)://<api server>:<port>/swagger-ui