mirrors
/
kubernetes-the-hard-way
mirror of https://github.com/kelseyhightower/kubernetes-the-hard-way
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

The chapter 'Smoke Test' is updated.

pull/443/head
Pick1a1username 2019-02-17 01:55:44 +09:00
parent bfd7a1e69c
commit 2669322613
1 changed files with 32 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

67
docs/13-smoke-test.md
View File

@ -9,15 +9,14 @@ In this section you will verify the ability to [encrypt secret data at rest](htt
Create a generic secret: Create a generic secret:
``` ```
kubectl create secret generic kubernetes-the-hard-way \ $ kubectl create secret generic kubernetes-the-hard-way \
--from-literal="mykey=mydata" --from-literal="mykey=mydata"
``` ```
Print a hexdump of the `kubernetes-the-hard-way` secret stored in etcd: Print a hexdump of the `kubernetes-the-hard-way` secret stored in etcd:
``` ```
gcloud compute ssh controller-0 \ $ ssh -i ~/.ssh/id_rsa-k8s.pub 10.240.0.21 "sudo ETCDCTL_API=3 etcdctl get \
--command "sudo ETCDCTL_API=3 etcdctl get \
--endpoints=https://127.0.0.1:2379 \ --endpoints=https://127.0.0.1:2379 \
--cacert=/etc/etcd/ca.pem \ --cacert=/etc/etcd/ca.pem \
--cert=/etc/etcd/kubernetes.pem \ --cert=/etc/etcd/kubernetes.pem \
@ -48,6 +47,7 @@ gcloud compute ssh controller-0 \
The etcd key should be prefixed with `k8s:enc:aescbc:v1:key1`, which indicates the `aescbc` provider was used to encrypt the data with the `key1` encryption key. The etcd key should be prefixed with `k8s:enc:aescbc:v1:key1`, which indicates the `aescbc` provider was used to encrypt the data with the `key1` encryption key.
## Deployments ## Deployments
In this section you will verify the ability to create and manage [Deployments](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/). In this section you will verify the ability to create and manage [Deployments](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/).
@ -55,13 +55,13 @@ In this section you will verify the ability to create and manage [Deployments](h
Create a deployment for the [nginx](https://nginx.org/en/) web server: Create a deployment for the [nginx](https://nginx.org/en/) web server:
``` ```
kubectl run nginx --image=nginx $ kubectl run nginx --image=nginx
``` ```
List the pod created by the `nginx` deployment: List the pod created by the `nginx` deployment:
``` ```
kubectl get pods -l run=nginx $ kubectl get pods -l run=nginx
``` ```
> output > output
@ -78,13 +78,13 @@ In this section you will verify the ability to access applications remotely usin
Retrieve the full name of the `nginx` pod: Retrieve the full name of the `nginx` pod:
``` ```
POD_NAME=$(kubectl get pods -l run=nginx -o jsonpath="{.items[0].metadata.name}") $ POD_NAME=$(kubectl get pods -l run=nginx -o jsonpath="{.items[0].metadata.name}")
``` ```
Forward port `8080` on your local machine to port `80` of the `nginx` pod: Forward port `8080` on your local machine to port `80` of the `nginx` pod:
``` ```
kubectl port-forward $POD_NAME 8080:80 $ kubectl port-forward $POD_NAME 8080:80
``` ```
> output > output
@ -97,7 +97,7 @@ Forwarding from [::1]:8080 -> 80
In a new terminal make an HTTP request using the forwarding address: In a new terminal make an HTTP request using the forwarding address:
``` ```
curl --head http://127.0.0.1:8080 $ curl --head http://127.0.0.1:8080
``` ```
> output > output
@ -123,6 +123,7 @@ Handling connection for 8080
^C ^C
``` ```
### Logs ### Logs
In this section you will verify the ability to [retrieve container logs](https://kubernetes.io/docs/concepts/cluster-administration/logging/). In this section you will verify the ability to [retrieve container logs](https://kubernetes.io/docs/concepts/cluster-administration/logging/).
@ -130,7 +131,7 @@ In this section you will verify the ability to [retrieve container logs](https:/
Print the `nginx` pod logs: Print the `nginx` pod logs:
``` ```
kubectl logs $POD_NAME $ kubectl logs $POD_NAME
``` ```
> output > output
@ -139,6 +140,7 @@ kubectl logs $POD_NAME
127.0.0.1 - - [30/Sep/2018:19:23:10 +0000] "HEAD / HTTP/1.1" 200 0 "-" "curl/7.58.0" "-" 127.0.0.1 - - [30/Sep/2018:19:23:10 +0000] "HEAD / HTTP/1.1" 200 0 "-" "curl/7.58.0" "-"
``` ```
### Exec ### Exec
In this section you will verify the ability to [execute commands in a container](https://kubernetes.io/docs/tasks/debug-application-cluster/get-shell-running-container/#running-individual-commands-in-a-container). In this section you will verify the ability to [execute commands in a container](https://kubernetes.io/docs/tasks/debug-application-cluster/get-shell-running-container/#running-individual-commands-in-a-container).
@ -146,15 +148,16 @@ In this section you will verify the ability to [execute commands in a container]
Print the nginx version by executing the `nginx -v` command in the `nginx` container: Print the nginx version by executing the `nginx -v` command in the `nginx` container:
``` ```
kubectl exec -ti $POD_NAME -- nginx -v $ kubectl exec -ti $POD_NAME -- nginx -v
``` ```
> output > output
``` ```
nginx version: nginx/1.15.4 $ nginx version: nginx/1.15.4
``` ```
## Services ## Services
In this section you will verify the ability to expose applications using a [Service](https://kubernetes.io/docs/concepts/services-networking/service/). In this section you will verify the ability to expose applications using a [Service](https://kubernetes.io/docs/concepts/services-networking/service/).
@ -162,7 +165,7 @@ In this section you will verify the ability to expose applications using a [Serv
Expose the `nginx` deployment using a [NodePort](https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport) service: Expose the `nginx` deployment using a [NodePort](https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport) service:
``` ```
kubectl expose deployment nginx --port 80 --type NodePort $ kubectl expose deployment nginx --port 80 --type NodePort
``` ```
> The LoadBalancer service type can not be used because your cluster is not configured with [cloud provider integration](https://kubernetes.io/docs/getting-started-guides/scratch/#cloud-provider). Setting up cloud provider integration is out of scope for this tutorial. > The LoadBalancer service type can not be used because your cluster is not configured with [cloud provider integration](https://kubernetes.io/docs/getting-started-guides/scratch/#cloud-provider). Setting up cloud provider integration is out of scope for this tutorial.
@ -170,29 +173,20 @@ kubectl expose deployment nginx --port 80 --type NodePort
Retrieve the node port assigned to the `nginx` service: Retrieve the node port assigned to the `nginx` service:
``` ```
NODE_PORT=$(kubectl get svc nginx \ $ NODE_PORT=$(kubectl get svc nginx \
--output=jsonpath='{range .spec.ports[0]}{.nodePort}') --output=jsonpath='{range .spec.ports[0]}{.nodePort}')
``` ```
Create a firewall rule that allows remote access to the `nginx` node port: Retrieve the IP address of a worker instance:
``` ```
gcloud compute firewall-rules create kubernetes-the-hard-way-allow-nginx-service \ WORKER_IP=$ kubectl get nodes $(kubectl get pods -o wide | grep nginx | awk '{ print $7 }') -o wide | tail -1 | awk '{ print $6 }'
--allow=tcp:${NODE_PORT} \
--network kubernetes-the-hard-way
``` ```
Retrieve the external IP address of a worker instance: Make an HTTP request using the IP address and the `nginx` node port:
``` ```
EXTERNAL_IP=$(gcloud compute instances describe worker-0 \ curl -I http://${WORKER_IP}:${NODE_PORT}
--format 'value(networkInterfaces[0].accessConfigs[0].natIP)')
```
Make an HTTP request using the external IP address and the `nginx` node port:
```
curl -I http://${EXTERNAL_IP}:${NODE_PORT}
``` ```
> output > output
@ -216,7 +210,7 @@ This section will verify the ability to run untrusted workloads using [gVisor](h
Create the `untrusted` pod: Create the `untrusted` pod:
``` ```
cat <<EOF | kubectl apply -f - $ cat <<EOF | kubectl apply -f -
apiVersion: v1 apiVersion: v1
kind: Pod kind: Pod
metadata: metadata:
@ -237,8 +231,9 @@ In this section you will verify the `untrusted` pod is running under gVisor (run
Verify the `untrusted` pod is running: Verify the `untrusted` pod is running:
``` ```
kubectl get pods -o wide $ kubectl get pods -o wide
``` ```
``` ```
NAME READY STATUS RESTARTS AGE IP NODE NAME READY STATUS RESTARTS AGE IP NODE
busybox-68654f944b-djjjb 1/1 Running 0 5m 10.200.0.2 worker-0 busybox-68654f944b-djjjb 1/1 Running 0 5m 10.200.0.2 worker-0
@ -247,23 +242,25 @@ untrusted 1/1 Running 0 10s 10.200.0.3
``` ```
Get the node name where the `untrusted` pod is running: Get the node's IP address where the `untrusted` pod is running:
``` ```
INSTANCE_NAME=$(kubectl get pod untrusted --output=jsonpath='{.spec.nodeName}') $ INSTANCE_NAME=$(kubectl get pod untrusted --output=jsonpath='{.spec.nodeName}')
$ INSTANCE_IP_ADDRESS=$(kubectl get nodes ${INSTANCE_NAME} -o wide | tail -1 | awk '{ print $6 }')
``` ```
SSH into the worker node: SSH into the worker node:
``` ```
gcloud compute ssh ${INSTANCE_NAME} $ ssh -i ~/.ssh/id_rsa-k8s.pub ${INSTANCE_IP_ADDRESS}
``` ```
List the containers running under gVisor: List the containers running under gVisor:
``` ```
sudo runsc --root /run/containerd/runsc/k8s.io list $ sudo runsc --root /run/containerd/runsc/k8s.io list
``` ```
``` ```
I0930 19:27:13.255142 20832 x:0] *************************** I0930 19:27:13.255142 20832 x:0] ***************************
I0930 19:27:13.255326 20832 x:0] Args: [runsc --root /run/containerd/runsc/k8s.io list] I0930 19:27:13.255326 20832 x:0] Args: [runsc --root /run/containerd/runsc/k8s.io list]
@ -286,21 +283,21 @@ I0930 19:27:13.259733 20832 x:0] Exiting with status: 0
Get the ID of the `untrusted` pod: Get the ID of the `untrusted` pod:
``` ```
POD_ID=$(sudo crictl -r unix:///var/run/containerd/containerd.sock \ $ POD_ID=$(sudo crictl -r unix:///var/run/containerd/containerd.sock \
pods --name untrusted -q) pods --name untrusted -q)
``` ```
Get the ID of the `webserver` container running in the `untrusted` pod: Get the ID of the `webserver` container running in the `untrusted` pod:
``` ```
CONTAINER_ID=$(sudo crictl -r unix:///var/run/containerd/containerd.sock \ $ CONTAINER_ID=$(sudo crictl -r unix:///var/run/containerd/containerd.sock \
ps -p ${POD_ID} -q) ps -p ${POD_ID} -q)
``` ```
Use the gVisor `runsc` command to display the processes running inside the `webserver` container: Use the gVisor `runsc` command to display the processes running inside the `webserver` container:
``` ```
sudo runsc --root /run/containerd/runsc/k8s.io ps ${CONTAINER_ID} $ sudo runsc --root /run/containerd/runsc/k8s.io ps ${CONTAINER_ID}
``` ```
> output > output