测试之家

作者

FunTester

FunTester

FunTester，Have Fun ~ Tester ！

FunTester Fabric8 Kubernetes 教程——PVC、PV、Network、PDB、Role、Cluster

FunTester · 2025年03月30日 · 2449 次阅读
「原创声明：保留所有权利，禁止转载」

EndpointSlice

EndpointSlice 是 Kubernetes 中用于扩展和优化 Endpoints 功能的一种资源对象。它是对传统 Endpoints 的改进，主要用于更高效地管理和存储服务后端的端点信息。

EndpointSlice 资源可以通过 client.discovery().v1().endpointSlices() 访问。

从 YAML 文件加载 EndpointSlice

EndpointSlice es = client.discovery().v1().endpointSlices()
  .load(getClass().getResourceAsStream("/endpointslice.yml")).item();

从 Kubernetes API 服务器获取 EndpointSlice

EndpointSlice esFromServer = client.discovery().v1().endpointSlices()
  .inNamespace("default").withName("es1").get();

创建 EndpointSlice

EndpointSlice esToCreate = new EndpointSliceBuilder()
  .withNewMetadata()
  .withName(name)
  .addToLabels("kubernetes.io/service-name", "example")
  .endMetadata()
  .withAddressType("IPv4")
  .addNewPort()
  .withName("http")
  .withPort(80)
  .endPort()
  .addNewEndpoint()
  .withAddresses("10.1.2.3")
  .withNewConditions().withReady(true).endConditions()
  .withHostname("pod-1")
  .addToTopology("kubernetes.io/hostname", "node-1")
  .addToTopology("topology.kubernetes.io/zone", "us-west2-a")
  .endEndpoint()
  .build();
esToCreate = client.discovery().v1().endpointSlices().inNamespace("ns1").resource(esToCreate).create();

将 EndpointSlice 应用到 Kubernetes 集群

EndpointSlice es = client.discovery().v1().endpointSlices().inNamespace("ns1").resource(endpointSlice).serverSideApply();

列出某个命名空间中的 EndpointSlice

EndpointSliceList esList = client.discovery().v1().endpointSlices().inNamespace("default").list();

列出所有命名空间中的 EndpointSlice

EndpointSliceList esList = client.discovery().v1().endpointSlices().inAnyNamespace().list();

列出具有某些标签的 EndpointSlice

EndpointSliceList esList = client.discovery().v1().endpointSlices().inNamespace("default").withLabel("foo", "bar").list();

删除 EndpointSlice

client.discovery().v1().endpointSlices().inNamespace("default").withName("test-es").delete();

监听 EndpointSlice

client.discovery().v1().endpointSlices().inNamespace("default").watch(new Watcher<>() {
  @Override
  public void eventReceived(Action action, EndpointSlice resource) {
    // 根据操作类型执行某些操作
  }

  @Override
  public void onClose(WatcherException cause) {
    // 处理关闭事件
  }
});

PersistentVolumeClaim

PersistentVolumeClaim (PVC) 是 Kubernetes 中用户对存储资源的请求，用于动态绑定 PersistentVolume (PV)，为 Pod 提供持久化存储。

PersistentVolumeClaim 可以通过 client.persistentVolumeClaims() 访问。

从 YAML 文件加载 PersistentVolumeClaim

PersistentVolumeClaim pvc = client.persistentVolumeClaims().load(new FileInputStream("pvc.yaml")).item();

从 Kubernetes API 服务器获取 PersistentVolumeClaim

PersistentVolumeClaim pvc = client.persistentVolumeClaims().inNamespace("default").withName("test-pv-claim").get();

创建 PersistentVolumeClaim

PersistentVolumeClaim persistentVolumeClaim = new PersistentVolumeClaimBuilder()
  .withNewMetadata().withName("test-pv-claim").endMetadata()
  .withNewSpec()
  .withStorageClassName("my-local-storage")
  .withAccessModes("ReadWriteOnce")
  .withNewResources()
  .addToRequests("storage", new Quantity("500Gi"))
  .endResources()
  .endSpec()
  .build();

client.persistentVolumeClaims().inNamespace("default").resource(persistentVolumeClaim).create();

将 PersistentVolumeClaim 应用到 Kubernetes 集群

PersistentVolumeClaim pvc = client.persistentVolumeClaims().inNamespace("default").resource(pvcToCreate).serverSideApply();

列出某个命名空间中的 PersistentVolumeClaim

PersistentVolumeClaimList pvcList = client.persistentVolumeClaims().inNamespace("default").list();

列出所有命名空间中的 PersistentVolumeClaim

PersistentVolumeClaimList pvcList = client.persistentVolumeClaims().inAnyNamespace().list();

列出具有某些标签的 PersistentVolumeClaim

PersistentVolumeClaimList pvcList = client.persistentVolumeClaims().inNamespace("default").withLabel("foo", "bar").list();

删除 PersistentVolumeClaim

client.persistentVolumeClaims().inNamespace("default").withName("test-pv-claim").delete();

PersistentVolume

PersistentVolume (PV) 是 Kubernetes 中由管理员提供的存储资源，代表集群中的一块持久化存储，可供 Pod 通过 PersistentVolumeClaim (PVC) 绑定和使用。

PersistentVolume 资源可以通过 client.persistentVolumes() 访问。

从 YAML 文件加载 PersistentVolume

PersistentVolume pv = client.persistentVolumes().load(new FileInputStream("pv.yaml")).item();

从 Kubernetes API 服务器获取 PersistentVolume

PersistentVolume pv = client.persistentVolumes().withName("test-local-pv").get();

创建 PersistentVolume

PersistentVolume pv = new PersistentVolumeBuilder()
  .withNewMetadata().withName("test-local-pv").endMetadata()
  .withNewSpec()
  .addToCapacity(Collections.singletonMap("storage", new Quantity("500Gi")))
  .withAccessModes("ReadWriteOnce")
  .withPersistentVolumeReclaimPolicy("Retain")
  .withStorageClassName("my-local-storage")
  .withNewLocal()
  .withPath("/mnt/disks/vol1")
  .endLocal()
  .withNewNodeAffinity()
  .withNewRequired()
  .addNewNodeSelectorTerm()
  .withMatchExpressions(Arrays.asList(new NodeSelectorRequirementBuilder()
    .withKey("kubernetes.io/hostname")
    .withOperator("In")
    .withValues("my-node")
    .build()
  ))
  .endNodeSelectorTerm()
  .endRequired()
  .endNodeAffinity()
  .endSpec()
  .build();

PersistentVolume pvCreated = client.persistentVolumes().resource(pv).create();

将 PersistentVolume 应用到 Kubernetes 集群

PersistentVolume pv = client.persistentVolumes().resource(pvToCreate).serverSideApply();

列出 PersistentVolume

PersistentVolumeList pvList = client.persistentVolumes().list();

列出具有某些标签的 PersistentVolume

PersistentVolumeList pvList = client.persistentVolumes().withLabel("foo", "bar").list();

删除 PersistentVolume

client.persistentVolumes().withName("test-local-pv").delete();

NetworkPolicy

NetworkPolicy 是 Kubernetes 中用于定义 Pod 之间网络通信规则的对象，通过标签选择器控制入站和出站流量，实现网络隔离和安全策略。

NetworkPolicy 可以通过 client.network().networkPolicies() 访问。

从 YAML 文件加载 NetworkPolicy

NetworkPolicy loadedNetworkPolicy = client.network().networkPolicies()
  .load(new FileInputStream("/test-networkpolicy.yml")).item();

从 Kubernetes API 服务器获取 NetworkPolicy

NetworkPolicy getNetworkPolicy = client.network().networkPolicies()
  .withName("networkpolicy").get();

创建 NetworkPolicy

NetworkPolicy networkPolicy = new NetworkPolicyBuilder()
  .withNewMetadata()
  .withName("networkpolicy")
  .addToLabels("foo","bar")
  .endMetadata()
  .withNewSpec()
  .withNewPodSelector()
  .addToMatchLabels("role","db")
  .endPodSelector()
  .addToIngress(0,
    new NetworkPolicyIngressRuleBuilder()
    .addToFrom(0, new NetworkPolicyPeerBuilder().withNewPodSelector()
      .addToMatchLabels("role","frontend").endPodSelector()
      .build()
    ).addToFrom(1, new NetworkPolicyPeerBuilder().withNewNamespaceSelector()
      .addToMatchLabels("project","myproject").endNamespaceSelector()
      .build()
    )
    .addToPorts(0,new NetworkPolicyPortBuilder().withPort(new IntOrString(6379))
      .withProtocol("TCP").build())
    .build()
  )
  .endSpec()
  .build();

NetworkPolicy npCreated = client.network().networkPolicies().resource(networkPolicy).create();

将 NetworkPolicy 应用到 Kubernetes 集群

NetworkPolicy npCreated = client.network().networkPolicies().resource(networkPolicy).serverSideApply();

列出 NetworkPolicy

NetworkPolicyList networkPolicyList = client.network().networkPolicies().list();

列出具有某些标签的 NetworkPolicy

NetworkPolicyList networkPolicyList = client.network().networkPolicies()
  .withLabels(Collections.singletonMap("foo","bar")).list();

删除 NetworkPolicy

client.network().networkPolicies().withName("np-test").delete();

PodDisruptionBudget

PodDisruptionBudget (PDB) 是 Kubernetes 中用于限制自愿中断（如升级或维护）时 Pod 的最大不可用数量或最小可用数量，确保应用的高可用性。

PodDisruptionBudget 可以通过 client.policy().v1().podDisruptionBudget() 访问。

从 YAML 文件加载 PodDisruptionBudget

PodDisruptionBudget pdb = client.policy().v1().podDisruptionBudget().load(new FileInputStream("/test-pdb.yml")).item();

从 Kubernetes API 服务器获取 PodDisruptionBudget

PodDisruptionBudget podDisruptionBudget = client.policy().v1().podDisruptionBudget().inNamespace("default").withName("poddisruptionbudget1").get();

创建 PodDisruptionBudget

PodDisruptionBudget podDisruptionBudget = new PodDisruptionBudgetBuilder()
  .withNewMetadata().withName("zk-pkb").endMetadata()
  .withNewSpec()
  .withMaxUnavailable(new IntOrString("1%"))
  .withNewSelector()
  .withMatchLabels(Collections.singletonMap("app", "zookeeper"))
  .endSelector()
  .endSpec()
  .build();

client.policy().v1().podDisruptionBudget().inNamespace("default").resource(podDisruptionBudget).create();

将 PodDisruptionBudget 应用到 Kubernetes 集群

PodDisruptionBudget pdb = client.policy().v1().podDisruptionBudget().inNamespace("default").resource(podDisruptionBudgetObj).serverSideApply();

列出某个命名空间中的 PodDisruptionBudget

PodDisruptionBudgetList podDisruptionBudgetList = client.policy().v1().podDisruptionBudget().inNamespace("default").list();

列出所有命名空间中的 PodDisruptionBudget

PodDisruptionBudgetList pdbList = client.policy().v1().podDisruptionBudget().inAnyNamespace().list();

列出具有某些标签的 PodDisruptionBudget

PodDisruptionBudgetList pdbList = client.policy().v1().podDisruptionBudget().inNamespace("default").withLabel("foo", "bar").list();

删除 PodDisruptionBudget

client.policy().v1().podDisruptionBudget().inNamespace("default").withName("poddisruptionbudget1").delete();

SelfSubjectAccessReview

创建 SelfSubjectAccessReview

try (KubernetesClient client = new KubernetesClientBuilder().build()) {
  SelfSubjectAccessReview ssar = new SelfSubjectAccessReviewBuilder()
    .withNewSpec()
    .withNewResourceAttributes()
    .withGroup("apps")
    .withResource("deployments")
    .withVerb("create")
    .withNamespace("dev")
    .endResourceAttributes()
    .endSpec()
    .build();

  ssar = client.authorization().v1().selfSubjectAccessReview().create(ssar);
  System.out.println("Allowed: " + ssar.getStatus().getAllowed());
}

SubjectAccessReview

创建 SubjectAccessReview

try (KubernetesClient client = new KubernetesClientBuilder().build()) {
  SubjectAccessReview sar = new SubjectAccessReviewBuilder()
    .withNewSpec()
    .withNewResourceAttributes()
    .withGroup("apps")
    .withResource("deployments")
    .withVerb("create")
    .withNamespace("default")
    .endResourceAttributes()
    .withUser("kubeadmin")
    .endSpec()
    .build();

  sar = client.authorization().v1().subjectAccessReview().create(sar);
  System.out.println("Allowed: " + sar.getStatus().getAllowed());
}

LocalSubjectAccessReview

创建 LocalSubjectAccessReview

try (KubernetesClient client = new KubernetesClientBuilder().build()) {
  LocalSubjectAccessReview lsar = new LocalSubjectAccessReviewBuilder()
    .withNewMetadata().withNamespace("default").endMetadata()
    .withNewSpec()
    .withUser("foo")
    .withNewResourceAttributes()
    .withNamespace("default")
    .withVerb("get")
    .withGroup("apps")
    .withResource("pods")
    .endResourceAttributes()
    .endSpec()
    .build();
  lsar = client.authorization().v1().localSubjectAccessReview().inNamespace("default").create(lsar);
  System.out.println(lsar.getStatus().getAllowed());
}

SelfSubjectRulesReview

创建 SelfSubjectRulesReview

try (KubernetesClient client = new KubernetesClientBuilder().build()) {
  SelfSubjectRulesReview selfSubjectRulesReview = new SelfSubjectRulesReviewBuilder()
    .withNewMetadata().withName("foo").endMetadata()
    .withNewSpec()
    .withNamespace("default")
    .endSpec()
    .build();

  selfSubjectRulesReview = client.authorization().v1().selfSubjectRulesReview().create(selfSubjectRulesReview);
  System.out.println(selfSubjectRulesReview.getStatus().getIncomplete());
  System.out.println("Non-resource rules: " + selfSubjectRulesReview.getStatus().getNonResourceRules().size());
  System.out.println("Resource rules: " + selfSubjectRulesReview.getStatus().getResourceRules().size());
}

ClusterRole

ClusterRole 是 Kubernetes 中定义集群范围内权限的对象，用于授予对集群资源（如节点、命名空间等）的访问权限，通常与 ClusterRoleBinding 结合使用。

ClusterRole 可以通过 client.rbac().clusterRoles() 访问。

从 YAML 文件加载 ClusterRole

ClusterRole clusterRole = client.rbac().clusterRoles().load(new FileInputStream("clusterroles-test.yml")).item();

从 Kubernetes API 服务器获取 ClusterRole

ClusterRole clusterRole = client.rbac().clusterRoles().withName("clusterrole1").get();

列出 ClusterRole

ClusterRoleList clusterRoleList = client.rbac().clusterRoles().list();

列出具有某些标签的 ClusterRole

ClusterRoleList clusterRoleList = client.rbac().clusterRoles().withLabel("key1", "value1").list();

删除 ClusterRole

client.rbac().clusterRoles().withName("clusterrole1").delete();

ClusterRoleBinding

ClusterRoleBinding 可以通过 client.rbac().clusterRoleBindings() 访问。

从 YAML 文件加载 ClusterRoleBinding

ClusterRoleBinding clusterRoleBinding = client.rbac().clusterRoleBindings().load(new FileInputStream("clusterrolebinding-test.yml")).item();

从 Kubernetes API 服务器创建 ClusterRoleBinding

List<Subject> subjects = new ArrayList<>();
Subject subject = new Subject();
subject.setKind("ServiceAccount");
subject.setName("serviceaccountname");
subject.setNamespace("default");
subjects.add(subject);

RoleRef roleRef = new RoleRef();
roleRef.setApiGroup("rbac.authorization.k8s.io");
roleRef.setKind("ClusterRole");
roleRef.setName("clusterrolename");

ClusterRoleBinding clusterRoleBindingCreated = new ClusterRoleBindingBuilder()
  .withNewMetadata().withName("clusterrolebindingname").withNamespace("default").endMetadata()
  .withRoleRef(roleRef)
  .addAllToSubjects(subjects)
  .build();

ClusterRoleBinding clusterRoleBinding = client.rbac().clusterRoleBindings().resource(clusterRoleBindingCreated).create();

从 Kubernetes API 服务器获取 ClusterRoleBinding

ClusterRoleBinding clusterRoleBinding = client.rbac().clusterRoleBindings().withName("clusterrolebindingname").get();

列出 ClusterRoleBinding

ClusterRoleBindingList clusterRoleBindingList = client.rbac().clusterRoleBindings().list();

列出具有某些标签的 ClusterRoleBinding

ClusterRoleBindingList clusterRoleBindingList = client.rbac().clusterRoleBindings().withLabel("key1", "value1").list();

删除 ClusterRoleBinding

client.rbac().clusterRoleBindings().withName("clusterrolebindingname").delete();

Role

Role 可以通过 client.rbac().roles() 访问。以下是一些常见的 Role 使用示例：

  • 从 yaml 文件加载 Role：
Role role = client.rbac().roles().load(new FileInputStream("FunTester-role.yml")).item();
  • 从 Kubernetes API 服务器创建 Role：
List<PolicyRule> policyRuleList = new ArrayList<>();
PolicyRule endpoints = new PolicyRule();
endpoints.setApiGroups(Arrays.asList(""));
endpoints.setResources(Arrays.asList("FunTester"));
endpoints.setVerbs(Arrays.asList("get", "list", "watch", "create", "update", "patch"));
policyRuleList.add(endpoints);
Role roleCreated = new RoleBuilder()
    .withNewMetadata().withName("FunTester-role").withNamespace("default").endMetadata()
    .addAllToRules(policyRuleList)
    .build();
Role role = client.rbac().roles().resource(roleCreated).create();

从 Kubernetes API 服务器获取 Role：

Role role = client.rbac().roles().inNamespace("default").withName("FunTester-role").get();

列出 Role 对象：

RoleList roleList = client.rbac().roles().inNamespace("default").list();

列出具有某些标签的 Role 对象：

RoleList roleList = client.rbac().roles().inNamespace("default").withLabel("FunTester-key", "FunTester-value").list();

删除 Role 对象：

client.rbac().roles().withName("FunTester-role").delete();

RoleBinding

RoleBinding 可以通过 client.rbac().roleBindings() 访问。以下是一些常见的 RoleBinding 使用示例：

  • 从 yaml 文件加载 RoleBinding：
RoleBinding roleBinding = client.rbac().roleBindings().load(new FileInputStream("FunTester-rolebinding.yml")).item();
  • 从 Kubernetes API 服务器创建 RoleBinding：
List<Subject> subjects = new ArrayList<>();
Subject subject = new Subject();
subject.setNamespace("default");
subject.setKind("ServiceAccount");
subject.setName("FunTester-serviceaccount");
subjects.add(subject);
RoleRef roleRef = new RoleRef();
roleRef.setName("FunTester-role");
roleRef.setKind("Role");
roleRef.setApiGroup("rbac.authorization.k8s.io");
RoleBinding roleBindingToCreate = new RoleBindingBuilder()
    .withNewMetadata().withName("FunTester-rolebinding").withNamespace("default").endMetadata()
    .addAllToSubjects(subjects)
    .withRoleRef(roleRef)
    .build();
RoleBinding roleBinding = client.rbac().roleBindings().resource(roleBindingToCreate).create();
  • 从 Kubernetes API 服务器获取 RoleBinding：
RoleBinding roleBinding = client.rbac().roleBindings().inNamespace("default").withName("FunTester-rolebinding").get();
  • 列出 RoleBinding 对象：
RoleBindingList roleBindingList = client.rbac().roleBindings().inNamespace("default").list();
  • 列出具有某些标签的 RoleBinding 对象：
RoleBindingList roleBindingList = client.rbac().roleBindings().inNamespace("default").withLabel("FunTester-key", "FunTester-value").list();
  • 删除 RoleBinding 对象：
client.rbac().roleBindings().inNamespace("default").withName("FunTester-rolebinding").delete();
FunTester 原创精华
【免费合集】从 Java 开始性能测试
故障测试与 Web 前端
服务端功能测试
性能测试专题
Java、Groovy、Go
测试开发、自动化、白盒
测试理论、FunTester 风采
视频专题
TesterHome 为用户提供「保留所有权利，禁止转载」的选项。 除非获得原作者的单独授权，任何第三方不得转载标注了「原创声明：保留所有权利，禁止转载」的内容，否则均视为侵权。 具体请参见TesterHome 知识产权保护协议。
如果觉得我的文章对您有用，请随意打赏。您的支持将鼓励我继续创作！
打赏支持
暂无回复。
需要 登录 后方可回复, 如果你还没有账号请点击这里 注册。