作者:潘猛_9f76 原文:https://www.jianshu.com/p/0a5976ce1ce4
导读
Kubernetes API是集群系统中的重要组成部分,Kubernetes中各种资源(对象)的数据通过该API接口被提交到后端的持久化存储(etcd)中,Kubernetes集群中的各部件之间通过该API接口实现解耦合,同时Kubernetes集群中一个重要且便捷的管理工具kubectl也是通过访问该API接口实现其强大的管理功能的。
本文将使用Linux curl命令演示操作Kubernetes API,让你有个初步的认识。
Kubernetes API 官方使用文档:
https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.15/
启动kubectl proxy,不带任何参数只在本地监听,使用的是http协议,无需提供任何凭证就可以访问:
kubectl proxy
Starting to serve on 127.0.0.1:8001
验证api访问:
curl http://127.0.0.1:8001/api/
{
"kind": "APIVersions",
"versions": [
"v1"
],
"serverAddressByClientCIDRs": [
{
"clientCIDR": "0.0.0.0/0",
"serverAddress": "192.168.3.101:6443"
}
]
}
启动kubectl proxy,使用网卡IP,从其他机器访问, --accept-hosts='^*$' 表示接受所有源IP,否则会显示不被授权:
kubectl proxy --address='192.168.3.101' --accept-hosts='^*$' --port=8001
Starting to serve on 192.168.3.101:8001
curl http://192.168.3.101:8001/api/
{
"kind": "APIVersions",
"versions": [
"v1"
],
"serverAddressByClientCIDRs": [
{
"clientCIDR": "0.0.0.0/0",
"serverAddress": "192.168.3.101:6443"
}
]
}
kubectl config view -o jsonpath='{"Cluster name\tServer\n"}{range .clusters[*]}{.name}{"\t"}{.cluster.server}{"\n"}{end}'
export CLUSTER_NAME="kubernetes"
APISERVER=$(kubectl config view -o jsonpath="{.clusters[?(@.name==\"$CLUSTER_NAME\")].cluster.server}")
创建serviceaccount并绑定集群角色cluster-admin:
kubectl create seviceaccount sa-panmeng
kubectl create clusterrolebinding sa-panmeng-cluster-admin --clusterrole='cluster-admin' --serviceaccount=default:sa-panmeng
获取seviceaccount sa-panmeng 的secret token:
TOKEN=$(kubectl get secrets -o jsonpath="{.items[?(@.metadata.annotations['kubernetes\.io/service-account\.name']=='sa-panmeng')].data.token}"|base64 -d)
使用token访问api:
curl --header "Authorization: Bearer $TOKEN" --insecure -X GET $APISERVER/api/v1/namespaces/test/pods?limit=1
curl --header "Authorization: Bearer $TOKEN" --insecure -X GET $APISERVER/api/v1/namespaces/default/pods?limit=1
curl --header "Authorization: Bearer $TOKEN" --insecure -X GET $APISERVER/api/v1/namespaces/kube-system/pods?limit=1
serviceaccount虽然是区分namespace的,但是不影响使用这个token访问所有namespace的资源。
创建user panmeng的证书:
openssl genrsa -out panmeng.key 2048
openssl req -new -key panmeng.key -out panmeng.csr -subj "/CN=panmeng"
openssl x509 -req -in panmeng.csr -out panmeng.crt -sha1 -CA ca.crt -CAkey ca.key -CAcreateserial -days 3650
创建角色getpods,创建角色绑定user panmeng和role getpods:
kubectl create role getpods --verb=get --verb=list --resource=pods
kubectl create rolebinding panmeng-getpods --role=getpods --user=panmeng --namespace=default
验证访问是否正常:
curl --cert /etc/kubernetes/pki/panmeng.crt -X GET $APISERVER/api/v1/namespaces/default/pods?limit=1 --key /etc/kubernetes/pki/panmeng.key --insecure
验证用户panmeng不具备访问namespace kube-system的权限:
curl --cert /etc/kubernetes/pki/panmeng.crt -X GET $APISERVER/api/v1/namespaces/kube-system/pods?limit=1 --key /etc/kubernetes/pki/panmeng.key --insecure
{
"kind": "Status",
"apiVersion": "v1",
"metadata": {
},
"status": "Failure",
"message": "pods is forbidden: User \"panmeng\" cannot list resource \"pods\" in API group \"\" in the namespace \"kube-system\"",
"reason": "Forbidden",
"details": {
"kind": "pods"
},
"code": 403
}
以下为常用资源的URL路径,将/apis/GROUP/VERSION/替换为/api/v1/,则表示基础API组:
/apis/GROUP/VERSION/RESOURCETYPE
/apis/GROUP/VERSION/RESOURCETYPE/NAME
/apis/GROUP/VERSION/namespaces/NAMESPACE/RESOURCETYPE
/apis/GROUP/VERSION/namespaces/NAMESPACE/RESOURCETYPE/NAME
/apis/GROUP/VERSION/RESOURCETYPE/NAME/SUBRESOURCE
/apis/GROUP/VERSION/namespaces/NAMESPACE/RESOURCETYPE/NAME/SUBRESOURCE
查看扩展api里的资源deployments::
curl http://127.0.0.1:8001/apis/extensions/v1beta1/namespaces/kube-system/deployments
查看基础api里的资源pods:
curl http://127.0.0.1:8001/api/v1/namespaces/kube-system/pods/
curl http://127.0.0.1:8001/api/v1/namespaces/test/pods
"resourceVersion": "2563046"
curl http://127.0.0.1:8001/api/v1/namespaces/test/pods?watch=1&resourceVersion=2563046
curl http://127.0.0.1:8001/api/v1/namespaces/kube-system/pods?limit=1
"continue": "eyJ2IjoibWV0YS5rOHMuaW8vdjEiLCJydiI6MjU2NDk2Mywic3RhcnQiOiJjYWxpY28tbm9kZS1jejZrOVx1MDAwMCJ9"
使用continue token查看下n个资源:
curl 'http://127.0.0.1:8001/api/v1/namespaces/kube-system/pods?limit=1&continue=eyJ2IjoibWV0YS5rOHMuaW8vdjEiLCJydiI6MjU3MTYxMSwic3RhcnQiOiJjYWxpY28ta3ViZS1jb250cm9sbGVycy01Y2JjY2NjODg1LWt2bGRyXHUwMDAwIn0'
资源分类:Workloads,Discovery & LB ,Config & Storage,Cluster,Metadata 资源对象:Resource ObjectMeta,ResourceSpec,ResourceStatus 资源操作:create,update(replace&patch),read(get&list&watch),delete,rollback,read/write scale,read/write status
以pod为例,介绍workloads apis,以下为pod的yaml文件:
apiVersion: v1
kind: Pod
metadata:
name: pod-example
spec:
containers:
- name: ubuntu
image: ubuntu:trusty
command: ["echo"]
args: ["Hello World"]
POST /api/v1/namespaces/{namespace}/pods 查看当前pods:
# kubectl -n test get pods
NAME READY STATUS RESTARTS AGE
使用api创建pod:
curl --request POST http://127.0.0.1:8001/api/v1/namespaces/test/pods -s -w "状态码是:%{http_code}\n" -o /dev/null -H 'Content-Type: application/yaml' --data 'apiVersion: v1
kind: Pod
metadata:
name: pod-example
spec:
containers:
- name: ubuntu
image: ubuntu:trusty
command: ["echo"]
args: ["Hello World"]'
状态码是:201
查看当前pods:
#kubectl -n test get pods
NAME READY STATUS RESTARTS AGE
pod-example 0/1 ContainerCreating 0 4s
状态码: 200 Ok 201 Created 202 Accepted
DELETE /api/v1/namespaces/{namespace}/pods/{name} 查看当前pods:
kubectl get pods -n test --show-labels
NAME READY STATUS RESTARTS AGE LABELS
pod-example 0/1 CrashLoopBackOff 1 15s <none>
删除pod pod-example:
curl --request DELETE http://127.0.0.1:8001/api/v1/namespaces/test/pods/pod-example -o /dev/null -s -w "状态码是:%{http_code}\n"
状态码是:200
查看当前pods:
kubectl get pods -n test --show-labels
NAME READY STATUS RESTARTS AGE LABELS
pod-example 0/1 Terminating 2 28s <none>
状态码: 200 Ok 202 Accepted