搜索到
113
篇与
的结果
-
docker 镜像加速器配置，daemon.json文件详解 背景：docker默认的镜像服务器是dockerhub，但是在国内从dockerhub拉取镜像时比较不稳定（无法访问，加载速度慢，连接中断等），因此需要配置国内的镜像加速器。{callout color="#f0ad4e"}Docker官方提供的中国镜像库：https://registry.docker-cn.com{/callout}{callout color="#f0ad4e"}阿里云提供的镜像加速器：https://yaia9b6l.mirror.aliyuncs.com该加速器地址需要登录阿里云获取，在容器镜像服务-镜像工具-镜像加速器栏目下面。{/callout}vim /etc/docker/daemon.json { "registry-mirrors": ["https://yaia9b6l.mirror.aliyuncs.com"] }systemctl daemon-reload #重新加载配置信息 systemctl restart docker #重启docker使配置信息生效。 查看镜像加速配置是否生效docker info | grep Mirrors -A1 Registry Mirrors: https://yaia9b6l.mirror.aliyuncs.com/{dotted startColor="#ff6c6c" endColor="#1989fa"/}{card-default label="daemon.json" width="100%"}daemon.json文件是docker的守护程序dockerd的配置文件。dockerd是管理容器的持久性进程。一般情况下配置文件 daemon.json中配置的项目参数，在启动参数中同样适用。有些参数的名称可能不一样（具体可以查看官方文档）。但需要注意的一点，配置文件中如果已经有某个配置项，则无法在启动参数中增加，否则会出现冲突的错误。{/card-default}来自官网的示例{ "allow-nondistributable-artifacts": [], "api-cors-header": "", "authorization-plugins": [], "bip": "", "bridge": "", #标志设置docker0为默认桥接网络。它是在您安装Docker时自动创建的。 #如果未使用默认值，则必须手动创建和配置网桥或仅将其设置为“none”：--bridge=none "builder": { "gc": { "enabled": true, "defaultKeepStorage": "10GB", "policy": [ { "keepStorage": "10GB", "filter": ["unused-for=2200h"] }, { "keepStorage": "50GB", "filter": ["unused-for=3300h"] }, { "keepStorage": "100GB", "all": true } ] } }, "cgroup-parent": "", "containerd": "/run/containerd/containerd.sock", "containerd-namespace": "docker", "containerd-plugin-namespace": "docker-plugins", "data-root": "", "debug": true, #启用debug的模式，启用后，可以看到很多的启动信息。默认false "default-address-pools": [ { "base": "172.30.0.0/16", "size": 24 }, { "base": "172.31.0.0/16", "size": 24 } ], "default-cgroupns-mode": "private", "default-gateway": "", "default-gateway-v6": "", "default-network-opts": {}, "default-runtime": "runc", #如果在创建容器时未指定，则更新要使用的运行时。 #它默认为“default”，这是官方docker软件包附带的运行时。 "default-shm-size": "64M", "default-ulimits": { "nofile": { "Hard": 64000, "Name": "nofile", "Soft": 64000 } }, "dns": [], # 设定容器DNS的地址，在容器的 /etc/resolv.conf文件中可查看。 "dns-opts": [], # 容器 /etc/resolv.conf 文件，其他设置 "dns-search": [], # 设定容器的搜索域，当设定搜索域为.example.com 时，在搜索一个名为host的主机时， #DNS不仅搜索host，还会搜索host.example.com。 #注意：如果不设置， Docker 会默认用主机上的 /etc/resolv.conf 来配置容器。 "exec-opts": [], "exec-root": "", "experimental": false, "features": {}, "fixed-cidr": "", "fixed-cidr-v6": "", "group": "", #Unix套接字的属组,仅指/var/run/docker.sock "hosts": [], #指定Docker守护程序将侦听客户端连接的位置。 #如果未指定，则默认为/var/run/docker.sock。 "proxies": { "http-proxy": "http://proxy.example.com:80", "https-proxy": "https://proxy.example.com:443", "no-proxy": "*.test.example.com,.example.org", }, "icc": false, "init": false, "init-path": "/usr/libexec/docker-init", "insecure-registries": [], #配置docker的私库地址 "ip": "0.0.0.0", "ip-forward": false, #默认true, 启用 net.ipv4.ip_forward , #进入容器后使用 sysctl -a | grepnet.ipv4.ip_forward 查看 "ip-masq": false, "iptables": false, "ip6tables": false, "ipv6": false, "labels": [], # docker主机的标签，很实用的功能,例如定义：–label nodeName=host-121 "live-restore": true, "log-driver": "json-file", "log-level": "", "log-opts": { "cache-disabled": "false", "cache-max-file": "5", "cache-max-size": "20m", "cache-compress": "true", "env": "os,customer", "labels": "somelabel", "max-file": "5", "max-size": "10m" }, "max-concurrent-downloads": 3, #它更新每次拉动的最大并发下载量。 "max-concurrent-uploads": 5, #它更新每次推送的最大并发上传次数。 "max-download-attempts": 5, "mtu": 0, "no-new-privileges": false, "node-generic-resources": [ "NVIDIA-GPU=UUID1", "NVIDIA-GPU=UUID2" ], "oom-score-adjust": 0, "pidfile": "", "raw-logs": false, "registry-mirrors": [], #镜像加速的地址，增加后在 docker info中可查看。 "runtimes": { "cc-runtime": { "path": "/usr/bin/cc-runtime" }, "custom": { "path": "/usr/local/bin/my-runc-replacement", "runtimeArgs": [ "--debug" ] } }, "seccomp-profile": "", "selinux-enabled": false, #默认 false，启用selinux支持 "shutdown-timeout": 15, "storage-driver": "", "storage-opts": [], "swarm-default-advertise-addr": "", "tls": true, #默认 false, 启动TLS认证开关 "tlscacert": "", #默认 ~/.docker/ca.pem，通过CA认证过的的certificate文件路径 "tlscert": "", #默认 ~/.docker/cert.pem ，TLS的certificate文件路径 "tlskey": "", #默认~/.docker/key.pem，TLS的key文件路径 "tlsverify": true,#默认false，使用TLS并做后台进程与客户端通讯的验证 "userland-proxy": false, "userland-proxy-path": "/usr/libexec/docker-proxy", "userns-remap": "" } -
k8s管理节点安装时应答文件解析 {callout color="#f0ad4e"}该yaml文件可用kubeadm命令生成模版，然后基于此模版进行修改。{/callout}kubeadm config print init-defaults > init.yaml{dotted startColor="#ff6c6c" endColor="#1989fa"/}--- #TLS Bootstraping（证书引导） apiVersion: kubeadm.k8s.io/v1beta3 bootstrapTokens: - groups: - system:bootstrappers:kubeadm:default-node-token token: abcdef.0123456789abcdef #令牌名称 ttl: 24h0m0s #令牌存活时长，到期后令牌自动销毁。设为0则令牌长期有效。 usages: - signing - authentication kind: InitConfiguration localAPIEndpoint: advertiseAddress: 192.168.1.50 #管理节点的IP地址 bindPort: 6443 #监听的端口信息 nodeRegistration: criSocket: /var/run/dockershim.sock #Runtime的socket地址 imagePullPolicy: IfNotPresent #镜像下载规则 name: master #管理节点的名称 taints: null #污点 --- apiServer: timeoutForControlPlane: 4m0s apiVersion: kubeadm.k8s.io/v1beta3 certificatesDir: /etc/kubernetes/pki clusterName: kubernetes #集群名称 controllerManager: {} dns: {} etcd: local: dataDir: /var/lib/etcd #etcd数据库位置 imageRepository: registry:5000/k8s #镜像仓库地址 kind: ClusterConfiguration kubernetesVersion: 1.22.5 #版本信息 networking: #网络信息 dnsDomain: cluster.local podSubnet: 10.244.0.0/16 #pod地址段（新添加的信息） serviceSubnet: 10.245.0.0/16 #service地址段 scheduler: {} --- kind: KubeProxyConfiguration #启用IPVS模式 apiVersion: kubeproxy.config.k8s.io/v1alpha1 mode: ipvs ipvs: strictARP: true --- kind: KubeletConfiguration apiVersion: kubelet.config.k8s.io/v1beta1 cgroupDriver: systemd #设置kubelet使用的Croup驱动模式为systemd{callout color="#f0ad4e"}bootstraping机制介绍：Master apiserver启用TLS认证后，Node节点kubelet和kube-proxy要与kube-apiserver进行通信，必须使用CA签发的有效证书才可以，当Node节点很多时，这种客户端证书颁发需要大量工作，同样也会增加集群扩展复杂度。为了简化流程，Kubernetes引入了TLS bootstraping机制来自动颁发客户端证书，kubelet会以一个低权限用户自动向apiserver申请证书，kubelet的证书由apiserver动态签署。{/callout}
-
nginx配置https网站和按照域名划分虚拟主机 server { listen 80; listen [::]:80; server_name zhangmingrui.cool; return 301 https://$host$request_uri; } server { listen 80; listen [::]:80; server_name doc.zhangmingrui.cool; return 301 https://$host$request_uri; } {callout color="#f0ad4e"}说明：此处按域名不同配置了两个虚拟主机，监听ipv4/ipv6网段对80端口的访问；return行的目的是把所有的HTTP请求重定向到https，强制所有的访问都走https模式。{/callout}server { if (!-e $request_filename) { rewrite ^(.*)$ /index.php$1 last; } listen 443 ssl; server_tokens off; keepalive_timeout 5; root /usr/share/nginx/html; index index.php index.html; server_name zhangmingrui.cool; ssl_certificate /etc/nginx/conf.d/zhangmingrui.cool_bundle.crt; ssl_certificate_key /etc/nginx/conf.d/zhangmingrui.cool.key; ssl_session_timeout 5m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE; ssl_prefer_server_ciphers on; location ~ \.php(\/.*)*$ { root /usr/share/nginx/html; fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param PATH_INFO $fastcgi_path_info; include fastcgi_params; client_max_body_size 20m; fastcgi_connect_timeout 30s; fastcgi_send_timeout 30s; fastcgi_read_timeout 30s; fastcgi_intercept_errors on; } }{callout color="#f0ad4e"}说明：该段配置是启用https功能。if判断的功能是为了将动态链接伪装成静态链接。ssl_certificate 与 ssl_certificate_key是配置公私钥，其后跟的是公私钥的存储地址。{/callout}{abtn icon="fa-download" color="#ff6800" href="https://doc.zhangmingrui.cool/usr/uploads/2024/01/2854896986.conf" radius="17.5" content="下载nginx配置文件（default.conf）"/}{abtn icon="fa-download" color="#ff6800" href="https://doc.zhangmingrui.cool/usr/uploads/2024/01/807304331.conf" radius="17.5" content="下载nginx配置文件（https.conf）"/}
-
kubernetes管理节点安装过程 k8s管理节点安装过程： { } 1.配置镜像仓库 { } 2.配置防火墙规则 { } 3.安装软件包（maser） { } 4.镜像导入仓库 { } 5.Tab检设置 { } 6.安装代理软件包 { } 7.配置master主机环境 { } 8.使用kubeadm部署 { } 9.验证安装结果1.配置镜像仓库 本例中使用docker-distribution软件包来做镜像仓库（配置非常简单）。生产环境中一般使用harbor来做镜像仓库。docker-distribution提供的仓库功能非常简陋，使用http通信，没有访问认证功能，因此一般用于内网环境。其优点是安装方便使用简单。{callout color="#f0ad4e"}该私有仓库默认监听端口是5000，镜像存放地址为/var/lib/registry/目录。以下操作在用作私有仓库的主机上配置。{/callout}yum install -y docker-distribution systemctl enable --now docker-distribution curl -s http://registry:5000/v2/_catalog备注：因没有修改hosts文件，故上图示例在访问仓库时使用了ip地址的方式。2.配置防火墙规则 {callout color="#f0ad4e"}禁用 selinux，禁用 swap，卸载 firewalld-*{/callout}3.安装软件包（maser） {callout color="#f0ad4e"}安装kubeadm、kubectl、kubelet、docker-ce软件包，以下操作在master主机上进行{/callout}yum makecache yum install -y kubeadm kubelet kubectl docker-ce mkdir -p /etc/docker vim /etc/docker/daemon.json { "exec-opts":["native.cgroupdriver=systemd"], "registry-mirrors":["http://registry:5000","https://hub-mirror.c.163.com"], "insecure-registries":["192.168.1.30:5000","registry:5000"] }{callout color="#f0ad4e"}说明：1.native.cgroupdriver=systemd: 让docker是用与kubelet相同的驱动模式2.registry-mirrors：镜像仓库3.insecure-registries：私有仓库地址4.总的来说，该json文件第一行是指定k8s使用的驱动模式，第二行是告诉k8s镜像仓库的地址，第三行是告诉k8s私有仓库的地址。{/callout}4.镜像导入仓库#查看安装kubernetes所需要的容器 kubeadm config images list k8s.gcr.io/kube-apiserver:v1.22.5 k8s.gcr.io/kube-controller-manager:v1.22.5 k8s.gcr.io/kube-scheduler:v1.22.5 k8s.gcr.io/kube-proxy:v1.22.5 k8s.gcr.io/pause:3.5 k8s.gcr.io/etcd:3.5.0-0 k8s.gcr.io/coredns/coredns:v1.8.4将以上软件包下载好之后打包上传到master主机上。docker load -i init/v1.22.5.tar.xz docker images|while read i t _;do [[ "${t}" == "TAG" ]] && continue docker tag ${i}:${t} registry:5000/k8s/${i##*/}:${t} docker push registry:5000/k8s/${i##*/}:${t} docker rmi ${i}:${t} registry:5000/k8s/${i##*/}:${t} donecurl -s http://registry:5000/v2/_catalog|python -m json.tool { "repositories": [ "k8s/coredns", "k8s/etcd", "k8s/kube-apiserver", "k8s/kube-controller-manager", "k8s/kube-proxy", "k8s/kube-scheduler", "k8s/pause" ] }5.Tab检设置source <(kubeadm completion bash|tee /etc/bash_completion.d/kubeadm) source <(kubectl completion bash|tee /etc/bash_completion.d/kubectl)6.安装代理软件包#k8s可以调用lvs进行负载均衡，但需要提前安装好软件包 yum install -y ipvsadm ipset7.配置master主机环境for i in overlay br_netfilter;do modprobe ${i} echo "${i}" >>/etc/modules-load.d/containerd.conf done{callout color="#f0ad4e"}modprobe overlay 载入overlay内核模块modprobe命令用于载入内核模块rmmod 删除内核模块（rmmod overlay）lsmod| grep overlay 用于查看模块是否载入{/callout}cat >/etc/sysctl.d/99-kubernetes-cri.conf<<EOF net.ipv4.ip_forward = 1 net.bridge.bridge-nf-call-iptables = 1 net.bridge.bridge-nf-call-ip6tables = 1 EOF sysctl --system{callout color="#f0ad4e"}sysctl --system将配置的文件和子文件一起载入sysctl -p 只是载入默认配置{/callout}8.使用kubeadm部署kubeadm init --config=init/kubeadm-init.yaml --dry-run{callout color="#f0ad4e"}预安装，会输出若干信息，没有 Error 和 Warning 就是正常。{/callout}rm -rf /etc/kubernetes/tmp kubeadm init --config=init/kubeadm-init.yaml |tee init/init.log mkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config{dotted startColor="#ff6c6c" endColor="#1989fa"/}应答文件创建方式#创建模板文件 kubeadm config print init-defaults > init.yaml #查询kube proxy配置信息 kubeadm config print init-defaults --component-configs KubeProxyConfiguration #查询kubeletConfiguration配置信息 kubeadm config print init-defaults --component-configs KubeletConfiguration #查询当前版本信息(以yaml格式展示) kubeadm version -o yaml #编辑应答文件，生成完整的应答文件应答文件部分内容解读12: advertiseAddress: 192.168.1.50 #管理节点的IP地址 15：criSocket: /var/run/dockershim.sock #Runtime的socket地址 17：name: master #管理节点的名称 30：imageRepository: registry:5000/k8s #私有仓库地址 32：kubernetesVersion: 1.22.5 #版本信息，镜像标签 35：podSubnet: 10.244.0.0/16 #pod地址段（新添加的信息） 36：serviceSubnet: 10.245.0.0/16 #service地址段 #在文件最后追加，启用IPVS模式 --- kind: KubeProxyConfiguration apiVersion: kubeproxy.config.k8s.io/v1alpha1 mode: ipvs ipvs: strictARP: true #设置kubelet使用的Croup驱动模式为systemd --- kind: KubeletConfiguration apiVersion: kubelet.config.k8s.io/v1beta1 cgroupDriver: systemd9.验证安装结果kubectl cluster-info Kubernetes control plane is running at https://192.168.1.50:6443 CoreDNS is running at https://192.168.1.50:6443/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'. kubectl get nodes NAME STATUS ROLES AGE VERSION master NotReady control-plane,master 90s v1.22.5{abtn icon="fa-download" color="#ff6800" href="https://doc.zhangmingrui.cool/usr/uploads/2024/01/3144342264.yaml" radius="17.5px" content="点击下载init.yaml文件"/}
-
nginx配置文件详解 #user nobody; worker_processes 1; #error_log logs/error.log; #error_log logs/error.log notice; #error_log logs/error.log info; #pid logs/nginx.pid; events { worker_connections 1024; } http { include mime.types; default_type application/octet-stream; #log_format main '$remote_addr - $remote_user [$time_local] "$request" ' # '$status $body_bytes_sent "$http_referer" ' # '"$http_user_agent" "$http_x_forwarded_for"'; #access_log logs/access.log main; sendfile on; #tcp_nopush on; #keepalive_timeout 0; keepalive_timeout 65; #gzip on; server { listen 80; server_name localhost; #charset koi8-r; #access_log logs/host.access.log main; location / { root html; index index.html index.htm; } #error_page 404 /404.html; # redirect server error pages to the static page /50x.html # error_page 500 502 503 504 /50x.html; location = /50x.html { root html; } # proxy the PHP scripts to Apache listening on 127.0.0.1:80 # #location ~ \.php$ { # proxy_pass http://127.0.0.1; #} # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000 # #location ~ \.php$ { # root html; # fastcgi_pass 127.0.0.1:9000; # fastcgi_index index.php; # fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name; # include fastcgi_params; #} # deny access to .htaccess files, if Apache's document root # concurs with nginx's one # #location ~ /\.ht { # deny all; #} } # another virtual host using mix of IP-, name-, and port-based configuration # #server { # listen 8000; # listen somename:8080; # server_name somename alias another.alias; # location / { # root html; # index index.html index.htm; # } #} # HTTPS server # #server { # listen 443 ssl; # server_name localhost; # ssl_certificate cert.pem; # ssl_certificate_key cert.key; # ssl_session_cache shared:SSL:1m; # ssl_session_timeout 5m; # ssl_ciphers HIGH:!aNULL:!MD5; # ssl_prefer_server_ciphers on; # location / { # root html; # index index.html index.htm; # } #} }
