You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: authentication/README.md
+22-9
Original file line number
Diff line number
Diff line change
@@ -11,11 +11,9 @@ There are multiple ways to authenticate to a Kubernetes Cluster. This Demo will
11
11
To try this method log in to the diagnose container using:
12
12
13
13
```
14
-
kubectl exec -ti diagnose-... s
14
+
kubectl exec -ti deploy/diagnose -- sh
15
15
```
16
16
17
-
(diagnose-... is the complete name of the pod found via shell completion or `kubectl get pods`)
18
-
19
17
Every pod in kubernetes will get service account credentials injected at a well-known location which is `/var/run/secrets/kubernetes.io/serviceaccount/`. When you list this directory you will find a certificate, a file containing the namespace this pod runs in and a token to access the API. We export the last into an environment variable:
20
18
21
19
```
@@ -26,8 +24,8 @@ Now the API can be accessed with curl like this:
With the argument "--cacert" curl gets will be able to validate the https certificate. The header contains the token and is used to identify to the API Server. The Url contains a few more environment variables (KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT_HTTPS). These contain the relevant adress of the API server inside the cluster and will also be injected into containers.
@@ -48,10 +46,24 @@ kubectl get pod diagnose-... -o jsonpath={.spec.serviceAccount}
48
46
49
47
## Creating and using a service account token from outside the cluster
50
48
51
-
Accessing the api of a minikube server can be done using:
49
+
First you need to set the local IP address and port for accessing the API.
50
+
51
+
If you are using minikube use:
52
+
53
+
```
54
+
export KUBE_API_HOST=$(minikube ip):8443
55
+
```
56
+
57
+
If you are using kind set the variable using:
58
+
59
+
```
60
+
export KUBE_API_HOST=$(docker port kind-control-plane 6443)
61
+
```
62
+
63
+
Accessing the api of a server can now be done using:
52
64
53
65
```
54
-
curl -k https://$(minikube ip):8443/api
66
+
curl -k https://$KUBE_API_HOST/api
55
67
```
56
68
57
69
We ignore the certificate validation for this example. If you try this you will get a status code 403 forbidden telling you that User 'system:anonymous' can not get the path /api.
@@ -62,13 +74,13 @@ To authorize we can create a new service account and use its token to authorize
62
74
kubectl create serviceaccount foo
63
75
export TOKEN_NAME=$(kubectl get serviceaccount foo -o=jsonpath="{.secrets[0].name}")
64
76
export TOKEN=$(kubectl get secret $TOKEN_NAME -o=jsonpath={.data.token}|base64 -D)
First a service account named foo is created. Then 'kubectl get' is used with jsonpath to extract the name of the token secret. In the next step this token is extracted into an environment variable called TOKEN. Finally this TOKEN is used as a header to make the same curl command as above. This time the result is a listing of API versions. But this service account is also not allowed to do more, like listing namespaces. Try:
With the following command you can assign the admin role to the service account:
@@ -93,6 +105,7 @@ These steps are included in the script `generate_user.sh` in this directory. You
93
105
```
94
106
./generate_user.sh
95
107
```
108
+
(This script currently assumes you are using minikube. So it would not work using kind.)
96
109
97
110
There is now a new Kubenetes configuration generated in auth_data/config. You can use this config to authenticate by setting the KUBECONFIG environment variable:
cAdvisor is an Agent included in every kubelet and thus installed on every node. It collects measurements of the containers running on the node as well as on the node itself.
6
-
7
-
**Hint**
8
-
For the following urls you need the ip address of the node you want to look at. If you are using minikube you get it via
9
-
10
-
```
11
-
minikube ip
12
-
```
13
-
14
-
The following urls are useful for looking at cAdvisor directly:
5
+
You need to enable the metrics server in order to use metrics and any connected service or command. If you are using minikube you are doning this by enabling the addon:
15
6
16
7
```
17
-
http://<node-ip>:4194/
8
+
minikube addons enable metrics-server
18
9
```
19
10
20
-
for the cAdvisor interface. And:
11
+
## Accessing the metrics API directly
21
12
22
-
```
23
-
http://<node-ip>:4194/metrics
24
-
```
13
+
The Metrics API is not intended to be used directly. Use kubectl top (see below) instead. But if you want to access it you can still do it like this:
25
14
26
-
to retrieve the metrics in Prometheus format. This can be useful when you want to scrape node data directly from prometheus without going via Heapster.
15
+
API Overview:
27
16
28
-
## Heapster
17
+
```
18
+
kubectl get --raw /apis/metrics.k8s.io/v1beta1/ |jq
19
+
```
29
20
30
-
Heapster is itself a pod that collects the measurements of all cAdvisor instances in your cluster. When you are using minikube you can enable it using:
21
+
List all Nodes where metrics are available
31
22
32
23
```
33
-
minikube addons enable heapster
24
+
kubectl get --raw /apis/metrics.k8s.io/v1beta1/nodes |jq
34
25
```
35
26
36
-
Heapster provides it's data again using the prometheus metrics format. As the addon does not provide an externally available service you have to login to the diagnose-pod ( see [../README.md](../README.md) ):
27
+
Get Data for a specific Node:
37
28
38
29
```
39
-
kubectl exec -ti diagnose-... sh
30
+
kubectl get --raw /apis/metrics.k8s.io/v1beta1/nodes/minikube |jq
40
31
```
41
-
42
-
Inside that container you can get the monitoring data using:
32
+
This might be useful if you want to extract e.g. the CPU usage of a node with a tool like jq:
43
33
44
34
```
45
-
curl heapster.kube-system/metrics
35
+
kubectl get --raw /apis/metrics.k8s.io/v1beta1/nodes/minikube |jq .usage.cpu
46
36
```
47
37
48
-
When heapster is active you can see performance information on the Kubernetes dashboard and you can also use the top command at the commandline:
38
+
## Using kubectl top
39
+
40
+
When metrics-server is active you can see performance information on the Kubernetes dashboard and you can also use the top command at the commandline:
49
41
50
42
```
51
43
kubectl top node
52
44
kubectl top pod
53
45
```
54
46
55
-
## Grafana dashboard
47
+
## Kubernetes dashboard
56
48
57
-
Where cAdvisor and Heapster work pretty much the same in most Kubernetes installations all further monitoring tools differ very often. It is usual to use a combination of Prometheus or Influx DB as timeseries database and Grafana as dashboard.
49
+
You can install the kubernetes dashboard in minikube as addon using:
50
+
51
+
```
52
+
minikube addons enable dashboard
53
+
```
58
54
59
-
Minikube comes with a influx/grafana combination. You can open the dashboard using:
55
+
Start the dashboard using:
60
56
61
57
```
62
-
minikube -n kube-system service monitoring-grafana
Copy file name to clipboardexpand all lines: persistent_volumes/README.md
+4-4
Original file line number
Diff line number
Diff line change
@@ -23,10 +23,10 @@ The persistent volume is the actual instance of the Volume claim. It can be main
23
23
To see the persistence in action create some data inside the redis database. To get an redis-cli log into the pod using:
24
24
25
25
```
26
-
kubectl exec -ti redis-... redis-cli
26
+
kubectl exec -ti deploy/redis -- redis-cli
27
27
```
28
28
29
-
where redis-... is the complete name of the redis pod. You should get a prompt and you can store a key and value like this:
29
+
You should get a prompt and you can store a key and value like this:
30
30
31
31
```
32
32
127.0.0.1:6379> set foo bla
@@ -39,7 +39,7 @@ OK
39
39
Now the data is stored on the persistent volume. You can find the datafiles when logging into the redis pod by using the shell:
40
40
41
41
```
42
-
kubectl exec -ti redis-... sh
42
+
kubectl exec -ti deploy/redis -- sh
43
43
/data # ls -lsa
44
44
total 12
45
45
4 drwxrwxrwx 2 root root 4096 Jun 5 14:24 .
@@ -63,7 +63,7 @@ pod "redis-5ff7b8476c-clkkt" deleted
63
63
If you now list the pods again you will find, that there is a newly created redis pod. You can now test whether the persistence worked by connecting to the redis-cli again:
0 commit comments