117. 네임 스페이스 이해 7/8
<1> 네임 스페이스 이해
<2> Metric-Server 설치
<3> 네임 스페이스 생성
<4> ns1-svc-pod.yaml
<5> ns1 파드 Shell에서 ns2 svc(서비스)로 접속 확인
<1> 네임 스페이스 이해
1
Namespace(NS) 필요 : 리소스 제한 , NS 간 통제
2
Namespace?
동일 NS 내에 중복 이름 불가, NS 간 연결(실렉터) 불가능, NS 삭제 시 모든 오브젝트 삭제됨(주의!), NS 간 네트워크 정책으로 트래픽 통신 제어
네임스페이스는 격리된 공간이다.
프런트 네임스페이스, 백앤드 네임스페이스 등을 별도로 만들어 트래픽 통신 제어를 한다.
보안 부분으로 보면 3 티어 구조에서 서브넷 개념?으로 보면 될 거 같다.
서브넷 간의 통신 관리
3
ResourceQuota?
NS 내 자원 제한 설정, 파드 생성 시 request/limits 설정 필요, 컴퓨트 리소스(cpu, memory, storage), 오브젝트 개수(Pod, Service...)
한정된 리소스를 잘 사용하도록 Pod 생성 시 리소스를 제한한다.
4
LimitRange?
파드에 default request로 제한 설정, 각 파드마다 NS에 존재 가능 확인
<2> Metric-Server 설치
측정 서버가 필요하다.
1
# 설치
wget https://github.com/kubernetes-sigs/metrics-server/releases/download/v0.5.0/components.yaml -O metric-server.yaml
sed -i'' -r -e "/- --secure-port=443/a\ - --kubelet-insecure-tls" metric-server.yaml
kubectl apply -f metric-server.yaml
2
grep -n secure-port metric-server.yaml -A 1
[root@test11 ~]# grep -n secure-port metric-server.yaml -A 1
133: - --secure-port=443
134- - --kubelet-insecure-tls
3
# 확인
[root@test11 ~]# k get ns
NAME STATUS AGE
default Active 35h
kube-node-lease Active 35h
kube-public Active 35h
kube-system Active 35h
kubectl get all -n kube-system -l k8s-app=metrics-server
kubectl get pod -n kube-system -l k8s-app=metrics-server
kubectl get svc -n kube-system -l k8s-app=metrics-server
[root@test11 ~]# kubectl get all -n kube-system -l k8s-app=metrics-server
NAME READY STATUS RESTARTS AGE
pod/metrics-server-8589b99d8f-zb5ms 1/1 Running 0 97s
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/metrics-server ClusterIP 198.19.203.90 <none> 443/TCP 35h
NAME READY UP-TO-DATE AVAILABLE AGE
deployment.apps/metrics-server 1/1 1 1 98s
NAME DESIRED CURRENT READY AGE
replicaset.apps/metrics-server-8589b99d8f 1 1 1 98s
[root@test11 ~]#
[root@test11 ~]# kubectl get pod -n kube-system -l k8s-app=metrics-server
NAME READY STATUS RESTARTS AGE
metrics-server-8589b99d8f-zb5ms 1/1 Running 0 2m23s
[root@test11 ~]#
4
# True 확인
kubectl get apiservices |egrep '(AVAILABLE|metrics)'
[root@test11 ~]# kubectl get apiservices |egrep '(AVAILABLE|metrics)'
NAME SERVICE AVAILABLE AGE
v1beta1.metrics.k8s.io kube-system/metrics-server True 36h
[root@test11 ~]#
5
# 노드 메트릭 확인
kubectl top node
[root@test11 ~]# kubectl top node
NAME CPU(cores) CPU% MEMORY(bytes) MEMORY%
game1-nodepool-w-11gc 68m 3% 1922Mi 25%
[root@test11 ~]#
kubectl top node --use-protocol-buffers=true
[root@test11 ~]# kubectl top node --use-protocol-buffers=true
NAME CPU(cores) CPU% MEMORY(bytes) MEMORY%
game1-nodepool-w-11gc 57m 3% 1922Mi 25%
[root@test11 ~]#
6
# 파드 메트릭 확인
kubectl top pod -A --use-protocol-buffers=true --sort-by='cpu'
kubectl top pod -A --use-protocol-buffers=true --sort-by='memory'
kubectl top pod -n kube-system --use-protocol-buffers=true --sort-by='cpu'
kubectl top pod -n kube-system --use-protocol-buffers=true --sort-by='memory'
[root@test11 ~]# kubectl top pod -n kube-system --use-protocol-buffers=true --sort-by='memory'
NAME CPU(cores) MEMORY(bytes)
cilium-qwjbg 3m 70Mi
csi-nks-controller-84d675d66d-28zvz 3m 58Mi
nks-nas-csi-controller-68f4bf8779-7tf8m 2m 33Mi
metrics-server-8589b99d8f-zb5ms 3m 18Mi
cilium-operator-7c756b4ff5-77m6c 1m 18Mi
<3> 네임 스페이스 생성
1
k get ns
[root@test11 ~]# k get ns
NAME STATUS AGE
default Active 36h
kube-node-lease Active 36h
kube-public Active 36h
kube-system Active 36h
// 4개 네임 스페이스
2
ns1.yaml
cat << EOF > ns1.yaml
apiVersion: v1
kind: Namespace
metadata:
name: ns1
EOF
cat << EOF > ns2.yaml
apiVersion: v1
kind: Namespace
metadata:
name: ns2
EOF
3
kubectl apply -f ns1.yaml,ns2.yaml
# 확인
k get ns
[root@test11 ~]# kubectl apply -f ns1.yaml,ns2.yaml
namespace/ns1 created
namespace/ns2 created
[root@test11 ~]# k get ns
NAME STATUS AGE
default Active 36h
kube-node-lease Active 36h
kube-public Active 36h
kube-system Active 36h
ns1 Active 3s
ns2 Active 3s
// 6개 네임 스페이스
<4> ns1-svc-pod.yaml
1
[root@test11 ~]# k get deploy,svc,pods
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/kubernetes ClusterIP 198.19.128.1 <none> 443/TCP 36h
2
ns1-svc-pod.yaml
cat << EOF > ns1-svc-pod.yaml
apiVersion: v1
kind: Pod
metadata:
name: pod1
namespace: ns1
labels:
app: webpod
spec:
containers:
- name: container
image: nginx
---
apiVersion: v1
kind: Pod
metadata:
name: pod2
namespace: ns1
labels:
app: webpod
spec:
containers:
- name: container
image: traefik/whoami
---
apiVersion: v1
kind: Service
metadata:
name: svc-web
namespace: ns1
spec:
ports:
- port: 9001
targetPort: 80
selector:
app: webpod
type: ClusterIP
EOF
// ns1에 파드를 2개 만든다.
// ns1에 서비스를 1개 만든다.
3
kubectl apply -f ns1-svc-pod.yaml
[root@test11 ~]# kubectl apply -f ns1-svc-pod.yaml
pod/pod1 created
pod/pod2 created
service/svc-web created
[root@test11 ~]# k get pods
No resources found in default namespace.
4
# 확인
kubectl get all -n ns1
[root@test11 ~]# kubectl get all -n ns1
NAME READY STATUS RESTARTS AGE
pod/pod1 1/1 Running 0 53s
pod/pod2 1/1 Running 0 53s
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/svc-web ClusterIP 198.19.206.25 <none> 9001/TCP 53s
5
kubectl get all -n ns1 -owide
[root@test11 ~]# kubectl get all -n ns1 -owide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
pod/pod1 1/1 Running 0 2m29s 198.18.0.6 game1-nodepool-w-11gc <none> <none>
pod/pod2 1/1 Running 0 2m29s 198.18.0.123 game1-nodepool-w-11gc <none> <none>
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
service/svc-web ClusterIP 198.19.206.25 <none> 9001/TCP 2m29s app=webpod
6
[root@test11 ~]# kubectl get ep -n ns1
NAME ENDPOINTS AGE
svc-web 198.18.0.123:80,198.18.0.6:80 2m45s
7
# 서비스(ClusterIP) 접속 확인!
curl <CLUSTER-IP>:<PORT>
curl 198.19.206.25:9001
x
8
# 아래 top pod 는 파드 생성 후 metrics 수집까지 시간이 조금 걸림!
kubectl top pod -n ns1 --use-protocol-buffers=true
[root@test11 ~]# kubectl top pod -n ns1 --use-protocol-buffers=true
NAME CPU(cores) MEMORY(bytes)
pod1 0m 3Mi
pod2 0m 1Mi
<5> ns1-svc-pod.yaml
1
ns2-svc-pod.yaml
cat << EOF > ns2-svc-pod.yaml
apiVersion: v1
kind: Pod
metadata:
name: pod1
namespace: ns2
labels:
app: webpod2
spec:
containers:
- name: container
image: gcr.io/google-samples/kubernetes-bootcamp:v1
ports:
- containerPort: 8080
---
apiVersion: v1
kind: Pod
metadata:
name: pod2
namespace: ns2
labels:
app: webpod2
spec:
containers:
- name: container
image: gcr.io/google-samples/kubernetes-bootcamp:v1
ports:
- containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
name: svc-web2
namespace: ns2
spec:
ports:
- port: 9002
targetPort: 8080
selector:
app: webpod2
type: ClusterIP
EOF
2
kubectl apply -f ns2-svc-pod.yaml
[root@test11 ~]# kubectl apply -f ns2-svc-pod.yaml
pod/pod1 created
pod/pod2 created
service/svc-web2 configured
3
# 확인
kubectl get pod -n ns2 -owide
kubectl get svc -n ns2 -owide
[root@test11 ~]# kubectl get pod -n ns2 -owide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
pod1 0/1 ContainerCreating 0 13s <none> game1-nodepool-w-11gc <none> <none>
pod2 0/1 ContainerCreating 0 13s <none> game1-nodepool-w-11gc <none> <none>
[root@test11 ~]# kubectl get svc -n ns2 -owide
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
svc-web2 ClusterIP 198.19.211.199 <none> 9002/TCP 6m7s app=webpod2
4
kubectl describe svc -n ns2 svc-web2
[root@test11 ~]# kubectl describe svc -n ns2 svc-web2
Name: svc-web2
Namespace: ns2
Labels: <none>
Annotations: <none>
Selector: app=webpod2
Type: ClusterIP
IP Family Policy: SingleStack
IP Families: IPv4
IP: 198.19.211.199
IPs: 198.19.211.199
Port: <unset> 9002/TCP
TargetPort: 8080/TCP
Endpoints: 198.18.0.124:8080,198.18.0.96:8080
Session Affinity: None
Events: <none>
5
kubectl get ep -n ns2
[root@test11 ~]# kubectl get ep -n ns2
NAME ENDPOINTS AGE
svc-web2 198.18.0.124:8080,198.18.0.96:8080 6m40s
6
kubectl top pod -n ns2 --use-protocol-buffers=true
[root@test11 ~]# kubectl top pod -n ns2 --use-protocol-buffers=true
NAME CPU(cores) MEMORY(bytes)
pod1 0m 9Mi
pod2 0m 9Mi
7
# 서비스(ClusterIP) 접속 확인
curl <CLUSTER-IP>:<PORT>
curl 198.19.211.199:9002
x
<6> ns1 파드 Shell 에서 ns2 svc(서비스)로 접속 확인
1
# ns1 파드pod1 Shell 실행
kubectl exec -it pod1 -n ns1 -- bash
[root@test11 ~]# kubectl exec -it pod1 -n ns1 -- bash
root@pod1:/# ls
bin boot dev docker-entrypoint.d docker-entrypoint.sh etc home lib lib64 media mnt opt proc root run sbin srv sys tmp usr var
root@pod1:/#
2
----------
# curl 아래 접속 시 되고, 안되고 차이는 ?
curl svc-web2:9002
curl svc-web2.ns2:9002
curl svc-web2.ns2.svc.cluster.local:9002
root@pod1:/# curl svc-web2:9002
curl: (6) Could not resolve host: svc-web2
root@pod1:/# curl svc-web2.ns2:9002
Hello Kubernetes bootcamp! | Running on: pod1 | v=1
root@pod1:/# curl svc-web2.ns2.svc.cluster.local:9002
Hello Kubernetes bootcamp! | Running on: pod2 | v=1
네임 스페이스 지정
다음 과정
https://brunch.co.kr/@topasvga/2239
https://brunch.co.kr/@topasvga/2240
감사합니다.
