3.1 K8s服务发现之 Service

#更改kube-proxy配置，kubeadm部署方式可以修改configmap
# kubectl -n kube-system edit configmap/kube-proxy
 ipvs:
      excludeCIDRs: null
      minSyncPeriod: 0s
      scheduler: “rr"  #负载均衡算法
      strictARP: false
      syncPeriod: 0s
      tcpFinTimeout: 0s
      tcpTimeout: 0s
      udpTimeout: 0s
    kind: KubeProxyConfiguration
    metricsBindAddress: ""
    mode: "ipvs"  #代理模式

kubectl expose (-f FILENAME | TYPE NAME) [--port=port] [--protocol=TCP|UDP|SCTP] [--target-port=number-or-name] [--name=name] [--external-ip=external-ip-of-service] [--type=type] [options]

#externalIPs：如果想通过svc来负载,但要求某台指定的(一个或多个)node上监听,而非像nodeport所有节点监听.此时可以指定externalIPs。这时候，会在具有指定externalIP的主机上，有kube-proxy来启动的指定端口svc port(注意不是监听nodePort)。需要注意的是，externalIPs并不受k8s管理，需要用户手动在k8s某个节点上配置该IP.

root@mgt03:~# kubectl get svc lcm-manager -n lcm -oyaml
apiVersion: v1
kind: Service
metadata:
  annotations:
    meta.helm.sh/release-name: lcm-mananager
    meta.helm.sh/release-namespace: lcm
  labels:
    app: lcm-manager
    app.kubernetes.io/managed-by: Helm
    appinstance: lcm-manager
    application: lcm-manager
    deployment: lcm-manager
    user: lcm
    user_group: group-cloud-operator
  name: lcm-manager
  namespace: lcm

spec:
  clusterIP: 100.105.26.62
  clusterIPs:
  - 100.105.26.62
  externalIPs:
  - 10.200.8.71
  - 10.110.62.71
  ports:
  - name: http
    port: 8094
    protocol: TCP
    targetPort: 8094
  selector:
    app: lcm-manager
    appinstance: lcm-manager
    application: lcm-manager
    deployment: lcm-manager
    user: lcm
    user_group: group-cloud-operator
  type: ClusterIP

root@mgt03:~# kubectl get svc lcm-manager -n lcm
NAME          TYPE        CLUSTER-IP      EXTERNAL-IP                PORT(S)    AGE
lcm-manager   ClusterIP   100.105.26.62   10.200.8.71,10.110.62.71   8094/TCP   37d

root@mgt03:~# ip a |grep -E '10.200.8.71|10.110.62.71'
    inet 10.110.62.71/32 scope global br-mgm
    inet 10.200.8.71/32 scope global control
    
root@mgt03:~# ss -tnlp|grep 8094
LISTEN   0         65535           10.200.8.71:8094             0.0.0.0:*        users:(("kube-proxy",pid=6302,fd=89))
LISTEN   0         65535          10.110.62.71:8094             0.0.0.0:*        users:(("kube-proxy",pid=6302,fd=59))    

apiVersion: v1
kind: Service
metadata:
  name: redis   #该名称会自动被k8s dns记录并解析，例如使用“redis.default.svc.cluster.local.”引用
  namespace: default
spec:
  selector:  #注意Service.spec.selector与其他资源对象不同，无需matchLabels或matchExpressions来嵌套
    app: redis
    release: stable
  clusterIP: 10.97.97.97  #Service的IP;缺省为随机分配,手动指定时注意范围，为10.96.0.0/12的子网，不建议指定。如果该值指定为"None"，则该Service为无头Service（headless），其EndPoints为后端Pod的ip。
  type: ClusterIP #默认为ClusterIP,可选值为：ExternalName, ClusterIP, NodePort, LoadBalancer
  ports:
  - name: redis
    protocol: TCP  #Servcie监听协议：TCP|UDP,默认为TCP
    port: 6379  #Service上的端口；required选项
    targetPort: 6379 #Service后端Pod上的端口，缺省时同port。
    #nodePort: 6379 #Node上的端口;只有type为NodePort时，此项才生效；注意如果指定该值，需要保证所有Node上该端口未使用。如果不指定该值，随机分配。无论手动指定还是随机分配，可用端口范围：30000-32767

apiVersion: v1
kind: Service
metadata:
  name: myapp-svc
  namespace: default
spec:
  selector:
     app: myapp
     release: canary
  clusterIP: None #设置为None，表示启用headless Service
  type: ClusterIp #无头服务只支持ClusterIP类型
  ports:
  - name: http
    protocol: TCP
    port: 80
    targetPort: 80

apiVersion: v1
kind: Service
metadata:
  name: myapp-svc
  namespace: default
spec:
  selector:  #注意Service.spec.selector无需matchLabels或matchExpressions来嵌套
     app: myapp
     release: canary
  clusterIP: 10.97.97.98
  type: NodePort
  ports:
  - name: http
    protocol: TCP
    port: 80  #Service上的端口
    targetPort: 80 #Pod上的端口
    nodePort: 30080  #Node上的端口，可用端口范围：30000-32767

apiVersion: v1
kind: Service
metadata:
  labels:
    app: nginx-ingress-lb
  name: nginx-ingress-lb
  namespace: kube-system
spec:
  externalTrafficPolicy: Local
  ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: 80
    - name: https
      port: 443
      protocol: TCP
      targetPort: 443
  selector:
    app: ingress-nginx
  sessionAffinity: None
  type: LoadBalancer

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-address-type: "intranet"     ##  intranet是私网   internet是公网；缺省时为公网SLB
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-id: "${YOUR_LOADBALACER_ID}"   ##  替换为slb id
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-force-override-listeners: "true"  ##  强制覆盖已有slb的监听器
  labels:
    app: nginx-ingress-lb
  name: nginx-ingress-lb
  namespace: kube-system
spec:
  externalTrafficPolicy: Local
  ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: 80
    - name: https
      port: 443
      protocol: TCP
      targetPort: 443
  selector:
    app: ingress-nginx
  sessionAffinity: None
  type: LoadBalancer

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-address-type: intranet
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-force-override-listeners: "true"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-id: lb-2zeup6j3e0suuymgsj9ch
  labels:
    app: nginx-ingress-lb
  name: nginx-ingress-lb
  namespace: kube-system
spec:
  externalTrafficPolicy: Local
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: 80
  - name: https
    port: 443
    protocol: TCP
    targetPort: 443
  selector:
    app: ingress-nginx
  sessionAffinity: None
  type: LoadBalancer

apiVersion: v1
kind: Service
metadata:
  annotations:
    meta.helm.sh/release-name: traefik
    meta.helm.sh/release-namespace: traefik
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-address-type: intranet
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-force-override-listeners: "true"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-id: lb-2zebweusr0iznwe1843hz
  labels:
    app.kubernetes.io/instance: traefik
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: traefik
    helm.sh/chart: traefik-9.14.2
  name: traefik
  namespace: traefik
spec:
  ports:
  - name: web
    port: 80
    protocol: TCP
    targetPort: web
  - name: websecure
    port: 443
    protocol: TCP
    targetPort: websecure
  selector:
    app.kubernetes.io/instance: traefik
    app.kubernetes.io/name: traefik
  sessionAffinity: None
  type: LoadBalancer

kind: Service
apiVersion: v1
metadata:
  name: mysql
  namespace: databases
spec:
  type: ExternalName
  externalName: rm-2zecbr40735wh172y.mysql.rds.aliyuncs.com #将Service映射到指定的外部DNS名称，该名称会被k8s-dns解析为一个外部服务的CNAME记录。

root@test-749fdc9984-bjngh:/# dig -t A mysql.databases.svc.cluster.local @172.21.0.10

; <<>> DiG 9.11.5-P4-5.1+deb10u2-Debian <<>> -t A mysql.databases.svc.cluster.local @172.21.0.10
;; global options: +cmd
;; Got answer:
;; WARNING: .local is reserved for Multicast DNS
;; You are currently testing what happens when an mDNS query is leaked to DNS
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24687
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 44fb8a962c38e4a6 (echoed)
;; QUESTION SECTION:
;mysql.databases.svc.cluster.local. IN  A

;; ANSWER SECTION:
mysql.databases.svc.cluster.local. 30 IN CNAME  rm-2zecbr40735wh172y.mysql.rds.aliyuncs.com. #此处解析为CNAME记录
rm-2zecbr40735wh172y.mysql.rds.aliyuncs.com. 30 IN A 172.17.252.168

;; Query time: 1 msec
;; SERVER: 172.21.0.10#53(172.21.0.10)
;; WHEN: Thu Jan 28 01:10:07 UTC 2021
;; MSG SIZE  rcvd: 223

格式：SVC_NAME.NameSpace_NAME.DOMAIN.LTD.
默认的域名后缀：svc.cluster.local.
pod内默认的搜索域：NameSpace_NAME.svc.cluster.local svc.cluster.local cluster.local
所以redis服务的服务名示例：
	redis
	redis.default
	redis.default.svc
	redis.default.svc.cluster.local.

    hosts {
        192.168.6.124   harbor.ljzsdut.com      notary.harbor.ljzsdut.com
        192.168.6.125   harbor.ljzsdut.com      notary.harbor.ljzsdut.com

        fallthrough
    }

]# cc-main kubectl get cm coredns -n kube-system -o yaml
apiVersion: v1
data:
  Corefile: |
    .:53 {
        errors
        health
        ready
        kubernetes cluster.local in-addr.arpa ip6.arpa {
           pods insecure
           fallthrough in-addr.arpa ip6.arpa
           ttl 30
        }
    hosts {
        192.168.6.124   harbor.ljzsdut.com      notary.harbor.ljzsdut.com
        192.168.6.125   harbor.ljzsdut.com      notary.harbor.ljzsdut.com

        fallthrough
    }
        prometheus :9153
        forward . /etc/resolv.conf
        cache 30
        loop
        reload
        loadbalance
    }
kind: ConfigMap
metadata:
  creationTimestamp: "2019-11-11T04:09:35Z"
  name: coredns
  namespace: kube-system
  resourceVersion: "2939186"
  selfLink: /api/v1/namespaces/kube-system/configmaps/coredns
  uid: a5042c71-a923-42df-9b45-b33f4d302d03

apiVersion: v1
kind: Pod
metadata:
  name: hostaliases-pod
spec:
  restartPolicy: Never
  hostAliases:
  - ip: "127.0.0.1"
    hostnames:
    - "foo.local"
    - "bar.local"
  - ip: "10.1.2.3"
    hostnames:
    - "foo.remote"
    - "bar.remote"
  containers:
  - name: cat-hosts
    image: busybox
    command:
    - cat
    args:
    - "/etc/hosts"

kind: Service
apiVersion: v1
metadata:
  name: mysql
  namespace: databases
spec:
  ports:
  - port: 3306
    name: mysql
    targetPort: 3306
---
kind: Endpoints
apiVersion: v1
metadata: 
  name: mysql
  namespace: databases
subsets:
- addresses:
  - ip: 10.15.9.211
  ports:
    - port: 3306
      name: mysql