python-3.x - 如何从Python容器内部访问kube-apiserver？

Question

我对Kuberenetes / Dockers很陌生，并计划创建一个简单的Python Pod
它在群集上运行，并以固定的时间间隔(例如每天一次)映射群集节点和Pod。
我正计划使用可轻松访问kube-apiserver的Kubernetes Python客户端进行此操作。
我需要配置什么才能实现它？

Answer 1

Kubernetes用户创建:

创建服务帐户[要从容器内部访问kube-apiserver]

[root@project1kubemaster stackoverflow]# kubectl create serviceaccount sampleuser
serviceaccount/sampleuser created

创建在步骤＃1中创建的clusterrolebinding链接服务帐户到名为cluster-admin的群集角色:

[root@project1kubemaster stackoverflow]# kubectl create clusterrolebinding sampleuserrolebinding  --clusterrole=cluster-admin --serviceaccount=default:sampleuser
clusterrolebinding.rbac.authorization.k8s.io/sampleuserrolebinding created

创建python容器:

创建一个名为“requirements.txt”的文件，并在其中添加“kubernetes”:

[root@project1kubemaster stackoverflow]# cat requirements.txt
kubernetes

检查在sample program之后，将IP地址更改为群集IP，并将文件另存为program.py。修改以下两行

aToken =  open('/var/run/secrets/kubernetes.io/serviceaccount/token','r').read()
aConfiguration.host = "https://<maternode IP>:6443"

创建具有以下内容的Dockerfile:

[root@project1kubemaster stackoverflow]# cat Dockerfile
FROM python:alpine3.7
WORKDIR /app
COPY requirements.txt .
COPY program.py
RUN pip install -r requirements.txt
CMD python ./program.py

构建并推送图像:

[root@project1kubemaster stackoverflow]# docker build -t sample .

Sending build context to Docker daemon   46.8MB
Step 1/6 : FROM python:alpine3.7
alpine3.7: Pulling from library/python
...
Successfully built e98cea8cb850
Successfully tagged sample:latest

[root@project1kubemaster stackoverflow]#docker image ls 
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
sample              latest              e98cea8cb850        2 minutes ago       126MB
python              alpine3.7           00be2573e9f7        21 months ago       81.3MB 

[root@project1kubemaster stackoverflow]# docker tag e98cea8cb850 prasasai/sample

[root@project1kubemaster stackoverflow]# docker push prasasai/sample
The push refers to repository [docker.io/prasasai/sample]
515f285319c0: Pushed 
b39d02c0a6c7: Pushed 
3c22209f875e: Pushed 
2ea55fcfd611: Pushed 
5fa31f02caa8: Mounted from library/python 
88e61e328a3c: Mounted from library/python 
9b77965e1d3f: Mounted from library/python 
50f8b07e9421: Mounted from library/python 
629164d914fc: Mounted from library/python 
latest: digest: sha256:93c7317f966fa723e406932221f0f1563243eba603c79fba2e113362cc22b4d8 size: 2200

编写Pod list ，运行并检查日志以查看输出:

[root@project1kubemaster stackoverflow]# cat samplepod.yaml
apiVersion: v1
kind: Pod
metadata:
  name: samplepod
spec:
  containers:
  - image: prasasai/sample
    name: samplepod
  serviceAccountName: sampleuser

[root@project1kubemaster stackoverflow]# kubectl apply -f samplepod.yaml
pod/samplepod created

[root@project1kubemaster stackoverflow]# kubectl logs samplepod
Listing pods with their IPs:
192.168.67.65   default first-6fb86b947d-68zzz
192.168.67.66   default first-6fb86b947d-74vtf
192.168.121.1   default first-6fb86b947d-hb6l6
192.168.121.2   default first-6fb86b947d-rlqk9
192.168.67.67   default first-6fb86b947d-tdnbf
192.168.121.6   default hello-bd5c66899-8dchl
192.168.121.4   default hello-bd5c66899-9ssrc
192.168.121.5   default hello-bd5c66899-pjk7k
192.168.67.68   default hello-bd5c66899-pwpsm
192.168.67.69   default hello-bd5c66899-whjdt
192.168.121.7   default samplepod
192.168.67.75   default test1

为了满足您的要求(定期运行此pod)，我们可以创建一个cronJob(每隔一分钟之后运行一次)

[root@project1kubemaster stackoverflow]# cat samplecron.yaml
apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: sample-job
spec:
  jobTemplate:
    metadata:
      name: sample-job
    spec:
      template:
        metadata:
        spec:
          containers:
          - image: prasasai/sample
            name: sample-job
          serviceAccountName: sampleuser
          restartPolicy: OnFailure
  schedule: '*/1 * * * *'

[root@project1kubemaster stackoverflow]# kubectl apply -f samplecron.yaml
cronjob.batch/sample-job created

[root@project1kubemaster stackoverflow]# kubectl get cronjobs
NAME         SCHEDULE      SUSPEND   ACTIVE   LAST SCHEDULE   AGE
sample-job   */1 * * * *   False     0        <none>          8s

[root@project1kubemaster stackoverflow]# kubectl get cronjobs
NAME         SCHEDULE      SUSPEND   ACTIVE   LAST SCHEDULE   AGE
sample-job   */1 * * * *   False     0        <none>          19s

[root@project1kubemaster stackoverflow]# kubectl get cronjobs
NAME         SCHEDULE      SUSPEND   ACTIVE   LAST SCHEDULE   AGE
sample-job   */1 * * * *   False     1        25s             40s