Pod管理策略2(资源清单文件)

1.污点策略

尽量不调度：PreferNoSchedule 不被调度：NoSchedule 驱逐节点：NoExecute

# 设置污点标签
[root@master ~]# kubectl taint node node-0001 k=v:NoSchedule
node/node-0001 tainted

# 查看污点标签
[root@master ~]# kubectl describe nodes node-0001
Taints:             k=v:NoSchedule

# 删除污点标签
[root@master ~]# kubectl taint node node-0001 k=v:NoSchedule-
node/node-0001 untainted

# 查看污点标签
[root@master ~]# kubectl describe nodes node-0001
Taints:             <none>

# 查看所有节点污点标签
[root@master ~]# kubectl describe nodes |grep Taints
Taints:             node-role.kubernetes.io/control-plane:NoSchedule
Taints:             <none>
Taints:             <none>
Taints:             <none>
Taints:             <none>
Taints:             <none>

创建几个pod测试,pod不会使用NoSchedule节点.
-----------------------
# NoExecute 会删除节点上的 Pod
[root@master ~]# kubectl taint node node-0001 k=v:NoExecute
[root@master ~]# kubectl get pods
-------------------------
[root@master ~]# kubectl taint node node-0001 k-

2.容忍策略

[root@master ~]# vim myphp.yaml
---
kind: Pod
apiVersion: v1
metadata:
  name: myphp
spec:
  tolerations:
  - operator: Exists/Equal     # 部分匹配/完全匹配，存在即可
    key: k               # 键
    effect: NoSchedule   # 污点标签
  containers:
  - name: php
    image: myos:php-fpm
    resources:
      requests:
        cpu: 1200m

3.设置优先级(默认为0,数字越大优先级越高)

# 低优先级 Pod
[root@master ~]# vim php2.yaml
---
kind: Pod
apiVersion: v1
metadata:
  name: php2
spec:
  nodeSelector:
    kubernetes.io/hostname: node-0002
  priorityClassName: low-non      # 优先级名称
  containers:
  - name: php
    image: myos:php-fpm
    resources:
      requests:
        cpu: "1200m"

# 高优先级 Pod
[root@master ~]# vim php3.yaml 
---
kind: Pod
apiVersion: v1
metadata:
  name: php3
spec:
  nodeSelector:
    kubernetes.io/hostname: node-0002
  priorityClassName: high-non     # 优先级名称
  containers:
  - name: php
    image: myos:php-fpm
    resources:
      requests:
        cpu: "1200m"

4.抢占策略

preemptionPolicy: Never(非抢占优先级)/PreemptLowerPriority(抢占优先级)

[root@master ~]# vim mypriority.yaml
---
kind: PriorityClass
apiVersion: scheduling.k8s.io/v1
metadata:
  name: high-non
preemptionPolicy: Never
value: 1000

---
kind: PriorityClass
apiVersion: scheduling.k8s.io/v1
metadata:
  name: low-non
preemptionPolicy: Never
value: 500

---
kind: PriorityClass
apiVersion: scheduling.k8s.io/v1
metadata:
  name: high
preemptionPolicy: PreemptLowerPriority
value: 1000

---
kind: PriorityClass
apiVersion: scheduling.k8s.io/v1
metadata:
  name: low
preemptionPolicy: PreemptLowerPriority
value: 500

[root@master ~]# kubectl apply -f mypriority.yaml 
[root@master ~]# kubectl get priorityclasses.scheduling.k8s.io  
NAME                      VALUE        GLOBAL-DEFAULT   AGE
high                      1000         false            4s
high-non                  1000         false            2h
low                       500          false            4s
low-non                   500          false            2h
system-cluster-critical   2000000000   false            21d
system-node-critical      2000001000   false            21d

5.特权容器(Pod安全)

设置主机们和修改hosts文件

[root@master ~]# vim root.yaml
---
kind: Pod
apiVersion: v1
metadata:
  name: root
spec:
  hostname: myhost         # 修改主机名
  hostAliases:             # 修改 /etc/hosts
  - ip: 192.168.1.30       # IP 地址
    hostnames:             # 名称键值对
    - harbor               # 主机名
  containers:
  - name: apache
    image: myos:httpd

系统进程特权\网络特权\root用户特权

[root@master ~]# vim root.yaml
---
kind: Pod
apiVersion: v1
metadata:
  name: root
spec:
  hostPID: true            # 特权，共享系统进程
  hostNetwork: true        # 特权，共享主机网络
  containers:
  - name: apache
    image: myos:httpd
    securityContext:       # 安全上下文值
      privileged: true     # root特权容器

6.Pod安全策略

设置证书,声明安全策略可以被认为是安全的Pod,才可以创建

[root@master ~]# vim nonroot.yaml
---
kind: Pod
apiVersion: v1
metadata:
  name: nonroot
spec:
  containers:
  - name: php
    image: myos:php-fpm
    securityContext:                      # 声明安全策略
      allowPrivilegeEscalation: false     # 容器内没有权限提升的行为
      runAsNonRoot: true                  # 容器运行在非 root 用户下
      runAsUser: 65534                    # 运行容器用户的 UID
      seccompProfile:                     # 容器使用了默认的安全配置
        type: "RuntimeDefault"
      capabilities:                       # 容器禁用了所有特权能力
        drop: ["ALL"]