Kubernetes Journey — Up and running out of the cloud — Kubernetes Overview

摘要：

作者： Marcos Vallim

正文：

“千里之行，始于足下”——中国谚语

引用自：https://en.wikipedia.org/wiki/A_journey_of_a_thousand_miles_begins_with_a_single_step

我们的Kubernetes已颇有进展。在第一篇文章中，我们概要介绍了IT产业目前的发展情况；第二篇文章给出了我们解决方案的架构情况；第三篇文章深入构成解决方案各技术组件的细节方方面面；第四篇文章详细介绍了支持我们解决方案的网络架构。
We have walked a long path already in this journey. In the first article, we briefly described how the IT industry has evolved to the point we are now. Next, in the second article, we defined how the architecture of our solution what will look like. We then started diving a bit deeper into the bits and pieces of the technology components that will make part of our solution in the third article and finally got into the details of the network architecture that will support our solution.

I hope you are learning something along this way and (why not?) having fun as much as I’m!

I know you are probably anxious to start getting your hands dirty with actual code but I think it’s really important to set a good basis of all the concepts needed to build our solution. This way, when we get to the point to do the actual work, you’ll have a clear idea of why each of the steps are needed.

在该系列教程的本篇文章中，我们终于开始介绍Kubernetes。我们将概要阐述Kubernetes的架构及主要组件，包括Pods、服务、卷、命名空间等。为避免长篇累牍，我们将另起文章介绍一下需要深入解释的重要概念，例如master/worker、etcd和k8s网络等。

In this article, we’ll finally start talking about Kubernetes. We’ll provide a brief introduction of its architecture and its main objects (Pods, services, volumes, namespaces, etc). To avoid it gets too long, we’ll talk in more detail about other important topics that demand a deeper explanation (masters and workers, etcd and k8s network) in separate articles.

想要先睹为快的读者，不必等待所有文章更新，可直接克隆该项目的GitHub代码库。代码库中的文档正在持续改进中，并完全可用。代码库地址为：

mvallim/kubernetes-under-the-hood

本教程适用于那些规划安装Kubernetes集群并希望理解各组件工作机制的读者。

Kubernetes

“Kubernetes是一个可移植的，可扩展的开源平台，用于管理容器化的工作负载和服务，可促进声明式配置和自动化。 它拥有一个庞大且快速增长的生态系统。 Kubernetes的服务，支持和工具广泛可用。
Kubernetes is a portable, extensible open-source platform for managing containerized workloads and services, that facilitates both declarative configuration and automation. It has a large, rapidly growing ecosystem. Kubernetes services, support, and tools are widely available.”

“Google在2014年开源了Kubernetes项目。Kubernetes建立在Google十年半的大规模生产工作负载经验的基础上，并结合了社区中最好的想法和实践。
Google open-sourced the Kubernetes project in 2014. Kubernetes builds upon a decade and a half of experience that Google has with running production workloads at scale, combined with best-of-breed ideas and practices from the community.”

引用自：https://kubernetes.io/docs/concepts/overview/what-is-kubernetes/

Kubernetes的优点包括：
* 敏捷应用开发和部署：与使用虚拟机镜像相比，Kubernetes增加了容器镜像创建和简易和效率。Agile application development and deployment: Increased ease and efficiency of container image creation compared to VM image use.
* 容器开发、集成和部署：提供可靠和频繁容器镜像构建和部署，支持快速和简易的回滚（归因于镜像不可修改）。Continuous development, integration, and deployment: Provides for reliable and frequent container image build and deployment with quick and easy rollbacks (due to image immutability).
* 开发（Dev）和运维（Ops）关注隔离：在构建/发布阶段创建应用容器镜像，而不适在部署阶段，这样将应用从架构中解耦。 and Ops separation of concerns: Create application container images at build/release time rather than deployment time, thereby decoupling applications from infrastructure.
* 能观性（Observability）：不仅流于表面的操作系统层级信息和度量，而且应用健康等深层信息。: Not only surfacing OS-level information and metrics but also application health and other signals.
* 开发、测试和生产环节中的环境一致性：无论在云上，还是在个人笔记本上，运行环境一致。Environmental consistency across development, testing, and production: Runs the same on a laptop as it does in the cloud.
* 云上和操作系统发行版可移植性：运行在Debian、Ubuntu、CoreOS、本地部署、Google Kubernetes Engine、Amazon Elastic Container Service等任何环境中。Cloud and OS distribution portability: Runs on Debian, Ubuntu, CoreOS, on-prem, Google Kubernetes Engine, Amazon Elastic Container Service and anywhere else.
* 以应用为中心的管理：提升了抽象层级，从在虚拟硬件上运行操作系统，提升为使用逻辑资源在操作系统上运行应用。Application-centric management: Raises the level of abstraction from running an OS on virtual hardware to running an application on an OS using logical resources.
* 松耦合、分布式、弹性、无约束微服务：应用分隔为更小独立部分，可动态部署并管理。不是运行在单一用途机器上的单体应用栈。Loosely coupled, distributed, elastic, liberated micro-services: Applications are broken into smaller, independent pieces and can be deployed and managed dynamically — not a monolithic stack running on a big single-purpose machine.
* 资源隔离：可预测的应用性能。Resource isolation: Predictable application performance.
* 资源使用：高效率和密度。Resource utilization: High efficiency and density.

引用自：https://kubernetes.io/docs/concepts/overview/what-is-kubernetes/

为尽可能发挥Kubernetes的最大效能，它依赖并使用其它开源攻击。其中包括：
In order for Kubernetes to reach its full capacity, it depends on and makes use of other open source tools. Among them we can include:
* 注册：例如Docker Registry。Registry, such as the Docker Registry.
* 网络：例如Flannel、Calico、MetalLB、CoreDNS等。
* 遥测：例如Prometheus、Sysdig和Istio。
* 安全：例如LDAP、SELinux、RBAC和具有多层的OAuth。
* 服务：基于广为使用的应用模式所创建的内容，以多种目录形式提供。Services, offered in a varied catalog of previously created content from popular application patterns.

Kubernetes概览 at a glance

图 Kubernetes架构图 Architecture Diagram

Kubernetes管理的集群通常具有两大操作单元：主节点（Master）和工作节点（Worker）。
A cluster managed by Kubernetes basically has two large operational units: Master node(s) and Worker nodes.
* 主节点（Master）：是负责编排与在工作节点上运行的容器相关的所有活动的元素。 它负责安排和部署集群应用程序，并获得有关工作节点和Pod的信息以及许多其他活动。: is the element responsible for orchestrating all activities related to the containers that run on the worker nodes. It is responsible for scheduling and deploying a clustered application and obtaining information about worker nodes and Pods, among many other activities.
* 工作节点（Worker）：由Kubernetes管理的容器有效运行的机器（节点，可以是物理机或VM）。 为了让Kubernetes管理工作节点，必须在其上安装Kubernetes的Kubelet代理。 通过该代理，可以执行与主机的所有通信，因此，可以执行集群操作。: are the machines (nodes, which can be physical or VMs) where the containers managed by Kubernetes effectively run. In order for worker nodes to be managed by Kubernetes, they must have Kubelet agents from Kubernetes installed on them. It is through this agent that all communication with the master is performed and, as a consequence, the cluster operations are performed.

Kubernetes主节点从开发人员/运维人员（DevOps）接收命令，并将指令传递给工作节点。 这些指令由一组服务处理和重传，这些服务会自动确定最适合处理所请求任务的工作节点，然后将资源分配并分配给选定的满足所请求指令的工作节点。
Kubernetes master receives the commands from the Developer/Operator (DevOps) and passes the instructions to the worker nodes. These instructions are processed and retransmitted by a set of services that automatically decide which worker node is most suitable to process the requested the task. The resources are then allocated and assigned to the selected worker node to satisfy the requested statement.

容器管理在更高和更精细的级别上进行，而无需有人主动对容器和工作节点进行微管理。
Container management takes place at a higher and more refined level, without someone needs to actively micromanage containers and worker nodes individually.

主节点和工作节点组件 Master and Worker components

• 容器网络接口（CNI，Container network interface）： 此插件是一种遵循appc / CNI规范的网络插件。 这就是连接运行在不同节点上的Pod以及灵活集成各种网络解决方案（覆盖，纯L3等）的能力。(CNI): This plugin is a type of Network plugin that adheres to the appc/CNI specification. This is what enables connecting Pods running on different nodes and flexibility to integrate different kind of network solutions (overlays, pure L3, etc).
  
  • Kubernetes和CNI信息，参见官方文档“Network plugins”。For information on Kubernetes and CNI refer to [this](Network plugins).
  • For information on Kubernetes and CNI, see “Network plugins”.
• etcd：一致且高度可用的键值存储用作所有集群数据的Kubernetes的后备存储。 如果您的Kubernetes集群使用etcd作为其后备存储，请确保您有针对这些数据的备份计划。: Consistent and highly-available key-value store used as Kubernetes’ backing store for all cluster data. If your Kubernetes cluster uses etcd as its backing store, make sure you have a back up plan for those data.
• API server: Component on the master that exposes the Kubernetes API. It is the front-end for the Kubernetes control plane. It is designed to scale horizontally — that is, it scales by deploying more instances.
• 控制平台（Control Plane）：容器编排层，公开API和接口以定义，部署和管理容器的生命周期。: The container orchestration layer that exposes the API and interfaces to define, deploy, and manage the lifecycle of containers.
• 调度程序（Scheduler）：主节点上的组件，用于监视未分配工作节点的新创建的Pod，并选择一个工作节点供其运行。 计划决策要考虑的因素包括个人和集体资源需求，硬件/软件/策略约束，亲和力和反亲和力规范，数据局部性，工作负载之间的干扰和期限。Scheduler: Component on the master that watches newly created Pods that have no worker node assigned, and selects a worker node for them to run into. Factors taken into account for scheduling decisions include individual and collective resource requirements, hardware/software/policy constraints, affinity and anti-affinity specifications, data locality, inter-workload interference and deadlines.
• 控制器管理器（Controller manager）：运行控制器的主机上的组件。 从逻辑上讲，每个控制器是一个单独的进程，但是为了降低复杂性，它们都被编译为单个二进制文件并在单个进程中运行。Controller manager: Component on the master that runs controllers. Logically, each controller is a separate process but, to reduce complexity, they are all compiled into a single binary and run in a single process.
• kubelet：在工作节点上运行的服务，读取Pod列表，并确保其定义的容器已启动并正在运行。: A service ran on the worker nodes that reads Pod manifests and ensures that its defined containers have been started and are running.
• containerd：强调容器的简单性，鲁棒性和可移植性的容器运行时是在Linux或Windows上作为守护程序运行的容器运行时。 containerd负责获取和存储容器映像，执行容器，提供网络访问等。（在我们的解决方案中，我们将为此使用Docker）。: A container runtime with an emphasis on simplicity, robustness and portability containerd is a container runtime that runs as a daemon on Linux or Windows. containerd takes care of fetching and storing container images, executing containers, providing network access, and more. (in our solution we’ll use Docker for this purpose)
• Kube Proxy：它是在群集中每个工作节点上运行的网络代理。 Kube-proxy负责请求转发。 kube-proxy允许通过一组后端功能进行TCP和UDP流转发或循环TCP和UDP转发。: It is a network proxy that runs on each worker node in the cluster. Kube-proxy is responsible for request forwarding. kube-proxy allows TCP and UDP stream forwarding or round-robin TCP and UDP forwarding across a set of backend functions.

参考资料：https://kubernetes.io/docs/reference/glossary/?fundamental=true

Kubectl

Image from Rising Stack

kubectl是与Kubernetes API服务交互的命令行工具。用户可使用kubectl创建、更新和删除Kubernetes对象。
is a command line tool for communicating with a Kubernetes API server. You can use kubectl to create, inspect, update, and delete Kubernetes objects.

Docker简介

Docker保持其原始功能。 所发生的变化是，当Kubernetes配置Pod时，它会将指令发送到所选工作程序节点的kubelet，其中包含有关Docker启动（或停止）具有给定规范的容器的指令。 反过来，kubelet继续从Docker及其容器中收集信息，并将所有这些信息汇总到master中。 此处的最大区别在于，所有这些操作都是自动进行的，而无需管理员必须手动进行所有这些配置和信息收集。
Docker keeps its original function. What changes is that when Kubernetes configures a Pod, it sends instructions to the kubelet of the selected worker node with instructions for Docker to start (or stop) a container with the given specification. kubelet, in turn, continues collecting information from Docker and its containers and aggregating all this information in the master. The big difference here is that all of this happens in an automated way, without the need of an administrator having to do all this configuration and information gathering manually.

Kubernetes的主要对象 ’ main objects

以下是Kubernetes管理的每个主要对象的简要定义。 我们将在本系列的下一篇文章中详细介绍它们：
Following is a brief definition of each of the main objects managed by Kubernetes. We’ll get into more detail about them in the next articles in this series:

• Pod：最小最简单的Kubernetes对象。 Pod代表集群上一组正在运行的容器。 通常将Pod设置为运行单个主容器。 它还可以运行可选的sidecar容器，以添加诸如日志记录之类的补充功能。 吊舱通常由部署管理。: The smallest and simplest Kubernetes object. A Pod represents a set of running containers on your cluster. A Pod is typically set up to run a single primary container. It can also run optional sidecar containers that add supplementary features like logging. Pods are commonly managed by a Deployment.

• Deployment：管理复制的应用程序的API对象。 每个副本都由一个Pod表示，并且Pod分布在集群的工作节点之间。: An API object that manages a replicated application. Each replica is represented by a Pod, and the Pods are distributed among the worker nodes of a cluster.

• Service：一个API对象，描述如何访问应用程序（例如Pod集），并可以描述端口和负载平衡器。 接入点可以在群集内部或外部。: An API object that describes how to access applications, such as a set of Pods, and can describe ports and load-balancers. The access point can be internal or external to the cluster.

• Volume：包含数据的目录，可用于Pod中的容器。 Kubernetes卷的寿命与包围它的Pod一样长。 因此，卷将超过Pod中运行的所有容器的寿命，并且在容器重新启动后将保留数据。: A directory containing data, accessible to the containers in a Pod. A Kubernetes volume lives as long as the Pod that encloses it. Consequently, a volume outlives any containers that run within the Pod, and data is preserved across container restarts.
  
  • Filesystem：在Kubernetes中，每个容器都可以在其自己的文件系统中进行读写。 但是，重新启动或删除容器时，写入此文件系统的数据将被破坏。: In Kubernetes, each container can read and write in its own filesystem. But the data written into this filesystem is destroyed when the container is restarted or removed.
  • Volume：Kubernetes有容量。 只要Pod存在，Pod中的卷就将存在。 可以在相同的Pod容器之间共享卷。 重新启动或卸下Pod时，该卷将被破坏。: Kubernetes has volumes. Volumes that are in a Pod will exist as long as the Pod exists. Volumes can be shared among the same Pod containers. When a Pod is restarted or removed the volume is destroyed.
  • Persistent Volume：Kubernetes具有持久的容量。 持久卷是Kubernetes集群中的长期存储。 持久卷超出了容器，Pods和工作节点，只要存在Kubernetes集群，它们就存在。 Pod声称使用永久性卷进行读取或写入或读取和写入。: The Kubernetes has persistent volumes. Persistent volumes are long-term stores within the Kubernetes cluster. Persistent volumes go beyond containers, Pods, and worker nodes, they exist as long as the Kubernetes cluster exists. A Pod claims the use of a persistent volume for reading or writing or for reading and writing.

• Namespace：Kubernetes用于支持同一物理集群上的多个虚拟集群的抽象。 命名空间用于组织集群中的对象，并提供一种划分集群资源的方法。 资源名称在名称空间中必须唯一，但在名称空间之间则必须唯一。: An abstraction used by Kubernetes to support multiple virtual clusters on the same physical cluster. Namespaces are used to organize objects in a cluster and provide a way to divide cluster resources. Resource names need to be unique within a namespace but not across namespaces.

参考资料：https://kubernetes.io/docs/reference/glossary/?fundamental=true

小结

希望读者喜欢该文，以及系列教程中的其它文章。下一篇文章将深入介绍Kubernetes架构，解释每个组件是如何应用的。

欢迎在文章下面给出反馈和评论，这对于改进系列文章非常重要。

建议读者关注[作者的Medium账号](Marcos Vallim)，一览系列教程全貌，并第一时间掌握新文章的发布。

查看英文原文： Kubernetes Journey — Up and running out of the cloud — Kubernetes Overview