Kubernetes官方维护的Python客户端client-python&＃xff0c; 地址&＃xff1a;https://github.com/kubernetes-client/python
安装模块
pip3 install kubernetes
环境说明
操作系统&＃xff1a;centos 7.6
k8s版本&＃xff1a;1.18.1
ip地址&＃xff1a;192.168.31.74
主机名&＃xff1a;k8s-master
操作系统&＃xff1a;centos 7.6
k8s版本&＃xff1a;1.18.1
ip地址&＃xff1a;192.168.31.71
主机名&＃xff1a;k8s-node01
二、获取API cluster URL与token
获取Cluster URL地址
登录到k8s-master节点&＃xff0c;执行&＃xff1a;
# APISERVER&＃61;$(kubectl config view --minify | grep server | cut -f 2- -d ":" | tr -d " ")
# echo $APISERVER
https://192.168.31.74:6443
下面python脚本要使用&＃xff0c;我获取的是&＃xff1a;https://192.168.31.74:6443
创建k8s admin-token
编辑新文件
# mkdir -p /kube/role
# cd /kube/role
# vi admin-token.yaml
内容如下&＃xff1a;
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:name: adminannotations:rbac.authorization.kubernetes.io/autoupdate: "true"
roleRef:kind: ClusterRolename: cluster-adminapiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccountname: adminnamespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:name: adminnamespace: kube-systemlabels:kubernetes.io/cluster-service: "true"addonmanager.kubernetes.io/mode: Reconcile
执行yaml文件
kubectl create -f admin-token.yaml
获取token值
# kubectl describe secret/$(kubectl get secret -nkube-system |grep admin|awk &＃39;{print $1}&＃39;) -nkube-system|grep token:
输出&＃xff1a;
token: eyJhbGciOiJSUzI1NiIsImtxxxx
由于token过长&＃xff0c;这里用xxx代替
最后将token与APISERVER地址返回内容复制到python client主机上, 供脚本使用.
三、在python client主机上编写脚本
本文采用的python版本为3.7.3&＃xff0c;运行在一台centos 7.6的服务器上面。
创建目录结构
# mkdir -p /kube/auth
# cd /kube/auth
# vim token.txt
将刚才获取的Token字符串复制到该文件&＃xff0c;比如&＃xff1a;eyJhbGciOiJSUzI1NiIsImtxxxx
这里我们获取的token会引入到我们的脚本下, 作为bearer authorization的api key与远程k8s API建立认证连接.
编写python client脚本
获取的命名空间
# &＃xff01;/usr/bin/python3
# -*- coding: utf-8 -*-
from kubernetes.client import api_client
from kubernetes.client.apis import core_v1_api
from kubernetes import client,configclass KubernetesTools(object):def __init__(self):self.k8s_url &＃61; &＃39;https://192.168.31.74:6443&＃39;def get_token(self):"""获取token:return:"""with open(&＃39;token.txt&＃39;, &＃39;r&＃39;) as file:Token &＃61; file.read().strip(&＃39;\n&＃39;)return Tokendef get_api(self):"""获取API的CoreV1Api版本对象:return:"""configuration &＃61; client.Configuration()configuration.host &＃61; self.k8s_urlconfiguration.verify_ssl &＃61; Falseconfiguration.api_key &＃61; {"authorization": "Bearer " &＃43; self.get_token()}client1 &＃61; api_client.ApiClient(configuration&＃61;configuration)api &＃61; core_v1_api.CoreV1Api(client1)return apidef get_namespace_list(self):"""获取命名空间列表:return:"""api &＃61; self.get_api()namespace_list &＃61; []for ns in api.list_namespace().items:# print(ns.metadata.name)namespace_list.append(ns.metadata.name)return namespace_listif __name__ &＃61;&＃61; &＃39;__main__&＃39;:namespace_list &＃61; KubernetesTools().get_namespace_list()print(namespace_list)
执行输出&＃xff1a;
[&＃39;default&＃39;, &＃39;istio-system&＃39;, &＃39;kube-node-lease&＃39;, &＃39;kube-public&＃39;, &＃39;kube-system&＃39;]
注意&＃xff1a;输出时&＃xff0c;会有一段警告信息
InsecureRequestWarning: Unverified HTTPS request is being made to host &＃39;192.168.31.74&＃39;. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warningsInsecureRequestWarning,
这个是requests库提示警告&＃xff0c;因为我是ip访问的&＃xff0c;所以SSL验证会失败。但这个不影响。
获取所有services
在上面的代码基础上&＃xff0c;再加一个方法
def get_services(self):"""获取所有services:return:"""api &＃61; self.get_api()ret &＃61; api.list_service_for_all_namespaces(watch&＃61;False)for i in ret.items:print("%s \t%s \t%s \t%s \t%s \n" % (i.kind, i.metadata.namespace, i.metadata.name, i.spec.cluster_ip, i.spec.ports))
单独执行这个方法&＃xff0c;会输出很多信息。由于由于输出过多&＃xff0c;这里只列出我运行的一个flaskapp
None default flaskapp-1 10.1.168.165 [{&＃39;name&＃39;: &＃39;flaskapp-port&＃39;,&＃39;node_port&＃39;: 30005,&＃39;port&＃39;: 5000,&＃39;protocol&＃39;: &＃39;TCP&＃39;,&＃39;target_port&＃39;: 5000}]
可以看到很多信息&＃xff0c;包括service名&＃xff0c;svc地址&＃xff0c;以及node_port暴露的端口
获取pod信息
先登录k8s-master&＃xff0c;查看目前运行的pod
# kubectl get pods
NAME READY STATUS RESTARTS AGE
flaskapp-1-5d96dbf59b-lhmp8 1/1 Running 4 23d
在上面的代码基础上&＃xff0c;再加一个方法
def get_pod_info(self,namespaces,pod_name):"""查看pod信息:param namespaces: 命令空间&＃xff0c;比如&＃xff1a;default:param pod_name: pod完整名称&＃xff0c;比如&＃xff1a;flaskapp-1-5d96dbf59b-lhmp8:return:"""api &＃61; self.get_api()# 示例参数namespaces &＃61; "default"pod_name &＃61; "flaskapp-1-5d96dbf59b-lhmp8"resp &＃61; api.read_namespaced_pod(namespace&＃61;namespaces,name&＃61;pod_name)#详细信息print(resp)
执行此方法&＃xff0c;输出以下信息&＃xff0c;由于输出过多&＃xff0c;使用...省略
{&＃39;api_version&＃39;: &＃39;v1&＃39;,&＃39;kind&＃39;: &＃39;Pod&＃39;,...
它会输出一段很长的json&＃xff0c;里面包含了此pod的详细信息
获取pod日志
在上面的代码基础上&＃xff0c;再加一个方法
def get_pod_logs(self,namespaces,pod_name):"""查看pod日志:param namespaces: 命令空间&＃xff0c;比如&＃xff1a;default:param pod_name: pod完整名称&＃xff0c;比如&＃xff1a;flaskapp-1-5d96dbf59b-lhmp8:return:"""api &＃61; self.get_api()# 示例参数namespaces &＃61; "default"pod_name &＃61; "flaskapp-1-5d96dbf59b-lhmp8""""pretty美化输出tail_lines&＃61;200输出最近200行"""log_content &＃61; api.read_namespaced_pod_log(pod_name, namespaces, pretty&＃61;True, tail_lines&＃61;200)print(log_content)
执行此方法&＃xff0c;输出以下信息&＃xff1a;
* Serving Flask app "app" (lazy loading)* Environment: productionWARNING: Do not use the development server in a production environment.Use a production WSGI server instead.* Debug mode: on* Running on http://0.0.0.0:5000/ (Press CTRL&＃43;C to quit)* Restarting with stat* Debugger is active!* Debugger PIN: 182-124-947
这个是flask运行之后&＃xff0c;输出的日志信息。
想了解其他更多参考&＃xff0c;请参考链接&＃xff1a;
https://blog.csdn.net/sinat_33431419/article/details/105223726
备注&＃xff1a;token直接写入到txt是不安全的&＃xff0c;可以考虑将token写入到redis中&＃xff0c;然后用python调用即可。
本文参考链接&＃xff1a;
https://blog.csdn.net/hypon2016/article/details/99439309
京公网安备 11010802041100号