Kubernetes(k8s)之Pod生命周期(下)

上次推文我们学习了Pod生命周期上知识相位、创建与终止、初始化容器今天继续分享完余下的3个知识钩子函数、容器探测、重启策略。01钩子函数钩子函数能够感知自身生命周期中的事件并在相应的时刻到来时运行用户指定的程序代码。k8s在主容器的启动之后和停止之前提供了两个钩子函数.post start容器创建之后执行如果失败了会重启容器;pre stop容器终止之前执行执行完成之后容器将成功终止在其完成之前会阻塞删除容器的操作;钩子处理器支持使用下面三种方式定义动作1)Exec命令在容器内执行一次命令...... lifecycle: postStart: exec: command: - cat - /tmp/healthy ......2)TCPSocket在当前容器尝试访问指定的socket...... lifecycle: postStart: tcpSocket:3)HttpGet在当前容器中向某url发起http请求...... lifecycle: postStart: httpGet: path: #uri地址 port: host: scheme: HTTP #支持的协议http或者https ......下面演示钩子函数的使用创建pod-hook-exec.yaml文件内容如下apiVersion: v1 kind: Pod metadata: name: pod-hook-exec namespace: dev spec: containers: - name: main-container image: nginx:1.17.1 ports: - name: nginx-port containerPort: 80 lifecycle: postStart: exec: #在容器启动的时候执行一个命令修改掉nginx的默认首页内容 command: [/bin/sh,-c,echo postStart... /usr/share/nginx/html/index.html] preStop: #在容器停止之前停止nginx服务 exec: command: [/usr/sbin/nginx,-s,quit]使用配置文件[rootmaster ~]# vim pod-hook-exec.yaml [rootmaster ~]# kubectl create -f pod-hook-exec.yaml pod/pod-hook-exec created [rootmaster ~]# kubectl get pod pod-hook-exec -n test -o wide NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES pod-hook-exec 1/1 Running 0 34s 10.244.104.24 node2 none none [rootmaster ~]# curl 10.244.104.24:80 postStart...02容器探测容器探测用于检测容器中的应用实例是否能正常工作是保障业务可用性的一种传统机制。如果经过探测实例的状态不符合预期那么K8S就会把该问题实例“摘除”不承担业务流量k8s提供了两种探针来实现容器探测分别是livenessprobes存活性探针用于检测应用实例当前是否处于正常运行状态如果不是k8s会重启容器;readinessprobes就绪性探针用于检测应用实例当前是否可以接受请求如果不能k8s不会转发流量;即livenessProbe决定是否重启容器readinesProbe决定是否将请求转发给容器。startupProbe使用启动探针来了解应用容器何时启动如果配置了这个类探针就可以控制容器在启动成功后再进行存活性liveness和就绪态readiness的检查确保存活、就绪探针不会影响应用的启动。探针参数探针有很多配置参数可以使用这些参数精确地控制启动、存活和就绪检测的行为。--initialDelaySeconds容器启动后要等待多少秒后才启动存活、就绪和启动探针 默认是 0 秒最小值是 0--periodSeconds执行探测的时间间隔单位是秒默认是 10 秒最小值是 1--timeoutSeconds探测的超时后等待多少秒默认值是 1 秒最小值是 1--successThreshold连续探测成功多少次才被认定为执行成功默认值是 1存活和启动探测的这个值必须是 1最小值是1--failureThreshold连续探测失败多少次才被认定为执行失败。对于存活探测而言失败就意味着重新启动容器。对就绪探测而言失败意味着 Pod 会被打上未就绪的标签默认值是 3最小值是 1上面两种探针目前均支持三种探测方式1)Exec命令在容器内执行一次命令如果命令执行的退出码为0则认为程序正常否则不正常​​​​​​​...... livenessProbe: exec: command: - cat - /tmp/healthy ......创建文件exec-liveness.yaml​​​​​​​apiVersion: v1 kind: Pod metadata: labels: app: liveness name: liveness-exec namespace: probe spec: containers: - name: tomcat image: tomcat:latest args: - /bin/sh - -c - touch /tmp/liveness-pod; sleep 30; rm -f /tmp/liveness-pod; sleep 100 livenessProbe: exec: command: - cat - /tmp/liveness-pod initialDelaySeconds: 5 periodSeconds: 5在配置文件中periodSeconds 字段指定了 kubelet 每 5 秒执行一次存活探测。initialDelaySeconds指定 kubelet 在执行第一次探测前应该等待 5 秒。kubelet 在容器内执行命令 cat /tmp/liveness 来进行探测 如果命令执行成功并且返回值为 0kubelet 就会认为这个容器是健康存活的如果这个命令返回非0值kubelet 会杀死这个容器并重新启动它在容器启动时将执行如下命令/bin/sh -c touch /tmp/liveness; sleep 30; rm -f /tmp/liveness; sleep 300容器生命的前 30 秒/tmp/liveness 文件是存在的即在容器启动后的 30 秒内执行命令 cat/tmp/liveness 会返回成功30 秒之后文件被删除再次执行命令 cat /tmp/liveness 时就会返回失败kubectl则会对容器进行重启操作。创建Pod[rootmaster ~]# kubectl apply -f exec-liveness.yaml30秒内查看pod的状态[rootmaster ~]# kubectl describe pod liveness-exec -n test输出结果显示pod创建成功​​​​​​​Events: Type Reason Age From Message ---- ------ ---- ---- ------- Normal Scheduled 9s Successfully assigned test/livenessexec to node2 Normal Pulling 8s kubelet, node2 Pulling image nginx:latest Normal Pulled 4s kubelet, node2 Successfully pulled image nginx:latest in 3.344637979s Normal Created 4s kubelet, node2 Created container nginx Normal Started 4s kubelet, node2 Started container nginx等到35秒再次查看pod的状态显示liveness探测失败Container nginx failed liveness probe, willbe restarted\n Container nginx failed liveness probe, will be restarted容器被重启。​​​​​​​Events: Type Reason Age From Message ---- ------ ---- ---- ------- Normal Scheduled 2m41s Successfully assigned test/liveness-exec to node2 Normal Pulled 2m37s kubelet, node2 Successfully pulled image nginx:latest in 3.344637979s Normal Pulled 81s kubelet, node2 Successfully pulled image nginx:latest in 3.13232767s Warning Unhealthy 39s (x6 over 2m4s) kubelet, node2 Liveness probe failed: cat: /tmp/liveness-pod: No such file or directory Normal Killing 39s (x2 over 114s) kubelet, node2 Container nginx failed liveness probe, will be restarted Normal Pulling 9s (x3 over 2m41s) kubelet, node2 Pulling image nginx:latest Normal Created 5s (x3 over 2m37s) kubelet, node2 Created container nginx Normal Started 5s (x3 over 2m37s) kubelet, node2 Started container nginx Normal Pulled 5s kubelet, node2 Successfully pulled image nginx:latest in 3.870334984s此时查看pod状态显示容器重启次数增加了1​​​​​​​[rootmaster ~]# kubectl get pod liveness-exec -n test NAME READY STATUS RESTARTS AGE liveness-exec 1/1 Running 2 3m27sTCPSocket将会尝试访问同一个用户容器的端口如果能够建立这条连接则认为程序正常否则不正常​​​​​​​...... livenessProbe: tcpSocket: port: 8080 ......创建http-liveness.yaml​​​​​​​apiVersion: v1 kind: Pod metadata: labels: app: liveness name: liveness-http namespace: test spec: containers: - name: nginx image: nginx:latest livenessProbe: httpGet: path: /test port: 80 scheme: HTTP httpHeaders: - name: Accept value: application/json initialDelaySeconds: 5 periodSeconds: 5在配置文件中periodSeconds 指定了 kubelet 应该每 5 秒执行一次存活探测initialDelaySeconds指定 kubelet 在容器启动后等待 5 秒再开始探测。kubelet 会向容器内运行的服务host-默认为pod的ipport为80发送一个HTTP GET 请求来执行探测 如果服务器上 / 路径下的处理程序返回成功则 kubelet 认为容器是健康存活的如果处理程序返回失败则 kubelet 会杀死这个容器并将其重启判断标准返回大于或等于 200 并且小于 400 的任何代码都标示成功其它返回代码都标示失败;创建pod​​​​​​​[rootmaster ~]# kubectl apply -f http-liveness.yaml pod/liveness-http created此时kubelet访问的探测地址为http://podid:80/abc因容器内nginx服务不存在该路径地址则会返回404状态码查看pod状态显示健康检查失败Liveness probe failed: HTTP probe failed with statuscode: 404kubelet 会杀死容器并再次重新启动容器。​​​​​​​Events: Type Reason Age From Message ---- ------ ---- ---- ------- Normal Scheduled 14m Successfully assigned test/liveness-http to master Normal Pulled 11m kubelet, master Successfully pulled image nginx:latest in 2m17.669916167s Normal Pulled 11m kubelet, master Successfully pulled image nginx:latest in 3.366871547s Normal Created 11m (x3 over 11m) kubelet, master Created container nginx Normal Pulled 11m kubelet, master Successfully pulled image nginx:latest in 3.539110367s Normal Started 11m (x3 over 11m) kubelet, master Started container nginx Normal Killing 10m (x3 over 11m) kubelet, master Container nginx failed liveness probe, will be restarted Normal Pulling 10m (x4 over 14m) kubelet, master Pulling image nginx:latest Warning Unhealthy 9m9s (x18 over 11m) kubelet, master Liveness probe failed: HTTP probe failed with statuscode: 404 Warning BackOff 4m3s (x28 over 10m) kubelet, master Back-off restarting failed containerHTTPGet调用容器内Web应用的URL如果返回的状态码在200和399之间则认为程序正常否则不正常。​​​​​​​...... lifecycle: postStart: httpGet: path: #uri地址 port: host: scheme: HTTP #支持的协议http或者https ......TCP 检测的配置和 HTTP 检测方式相近只需要配置端口即可。如果能建立连接这个容器就被看作是健康的脚本片断如下​​​​​​​containers: - name: nginx image: nginx:latest readinessProbe: tcpSocket: port: 8080 initialDelaySeconds: 5 periodSeconds: 10 livenessProbe: tcpSocket: port: 8080 initialDelaySeconds: 15 periodSeconds: 2003重启策略重启策略Pod在遇到故障之后重启的动作1. Always当容器终止退出后总是重启容器默认策略2. OnFailure当容器异常退出退出状态码非0时重启容器3. Never当容器终止退出从不重启容器。注意k8s中不支持重启Pod资源只有删除重建重建重启策略适用于pod对象中的所有容器首次需要重启的容器将在其需要时立即进行重启随后再次需要重启的操作将由kubelet延迟一段时间后进行且反复的重启操作的延迟时长为10s20s40s80s160s300s300s是最大延迟时长;重启策略设置建议因为重启策略默认的就是Always这也是合理的因此在一般情况下重启策略不需要设置这里仅仅是作为知识点拿出来展示一下在实际使用中在大多数情况下都不需要进行重启策略配置。1)Always​​​​​​​[rootmaster test]# vim always.yaml apiVersion: v1 kind: Pod metadata: name: always-restart namespace: test spec: containers: - name: busybox image: busybox args: - /bin/sh - -c - sleep 30; exit 3创建pod[rootmaster ~]# kubectl apply -f always.yaml查看pod重启情况​​​​​​​[rootmaster ~]# kubectl get pods -n test NAME READY STATUS RESTARTS AGE always-restart 0/1 Error 1107s [rootmaster ~]# kubectl describe pods always-restart -n test Events: Type Reason Age From Message ---- ------ ---- ---- ------- Normal Scheduled 4m6s Successfully assigned test/always-restart to master Normal Pulled 3m28s kubelet, master Successfully pulled image busyboxin36.172410045s Normal Pulled 2m54s kubelet, master Successfully pulled image busyboxin3.248301356s Normal Pulled 2m10s kubelet, master Successfully pulled image busyboxin3.068738872s Normal Created 73s (x4 over 3m28s) kubelet, master Created container busybox Normal Started 73s (x4 over 3m28s) kubelet, master Started container busybox Normal Pulled 73s kubelet, master Successfully pulled image busyboxin3.686230207s Warning BackOff 15s (x6 over 2m23s) kubelet, master Back-off restarting failed container Normal Pulling 1s (x5 over 4m4s) kubelet, master Pulling image busybox2)never​​​​​​​[rootmaster test]# vim never.yaml apiVersion: v1 kind: Pod metadata: name: never-always namespace: test spec: containers: - name: busybox image: busybox args: - /bin/sh - -c - sleep 30; exit 3 restartPolicy: Never创建pod​​​​​​​[rootmaster ~]# kubectl apply -f never.yaml pod/never-restart created查看pod重启情况​​​​​​​[rootmaster ~]# kubectl get pod never-restart -n test NAME READY STATUS RESTARTS AGE never-restart 0/1Error073s3onfailure终止退出容器并且是非零状态的退出​​​​​​​[rootmaster test]# vim onfailure.yaml apiVersion: v1 kind: Pod metadata: name: onfailure1-restart namespace: test spec: containers: - name: busybox image: busybox args: - /bin/sh - -c - sleep 20; exit 3 restartPolicy: OnFailure创建pod​​​​​​​[rootmaster ~]# kubectl apply -f onfailure.yaml pod/onfailure1-restart created查看pod的状态​​​​​​​[rootmaster ~]# kubectl get pod onfailure1-restart -n test NAME READY STATUS RESTARTS AGE onfailure1-restart 1/1 Running 274s将退出状态改为0​​​​​​​apiVersion: v1 kind: Pod metadata: name: onfailure1-restart namespace: test spec: containers: - name: busybox image: busybox args: - /bin/sh - -c - sleep 20; exit 0 restartPolicy: OnFailure创建pod​​​​​​​[rootmaster ~]# kubectl apply -f onfailure.yaml pod/onfailure1-restart created查看 pod状态​​​​​​​[rootmaster ~]# kubectl get pod onfailure1-restart -n test NAME READY STATUS RESTARTS AGE onfailure1-restart 0/1 Completed 074s