惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

WordPress大学
WordPress大学
D
Darknet – Hacking Tools, Hacker News & Cyber Security
Hacker News: Ask HN
Hacker News: Ask HN
N
News and Events Feed by Topic
Forbes - Security
Forbes - Security
The Last Watchdog
The Last Watchdog
TaoSecurity Blog
TaoSecurity Blog
Schneier on Security
Schneier on Security
SecWiki News
SecWiki News
V
Vulnerabilities – Threatpost
Project Zero
Project Zero
O
OpenAI News
W
WeLiveSecurity
Security Archives - TechRepublic
Security Archives - TechRepublic
Exploit-DB.com RSS Feed
Exploit-DB.com RSS Feed
H
Hacker News: Front Page
Cisco Talos Blog
Cisco Talos Blog
Spread Privacy
Spread Privacy
Help Net Security
Help Net Security
P
Privacy & Cybersecurity Law Blog
K
Kaspersky official blog
S
Security @ Cisco Blogs
Latest news
Latest news
AWS News Blog
AWS News Blog
U
Unit 42
Martin Fowler
Martin Fowler
阮一峰的网络日志
阮一峰的网络日志
S
Secure Thoughts
CTFtime.org: upcoming CTF events
CTFtime.org: upcoming CTF events
Application and Cybersecurity Blog
Application and Cybersecurity Blog
Know Your Adversary
Know Your Adversary
Scott Helme
Scott Helme
博客园 - 司徒正美
B
Blog RSS Feed
C
Check Point Blog
Hacker News - Newest:
Hacker News - Newest: "LLM"
D
Docker
Google Online Security Blog
Google Online Security Blog
Jina AI
Jina AI
aimingoo的专栏
aimingoo的专栏
Recent Commits to openclaw:main
Recent Commits to openclaw:main
Last Week in AI
Last Week in AI
月光博客
月光博客
C
CXSECURITY Database RSS Feed - CXSecurity.com
S
SegmentFault 最新的问题
NISL@THU
NISL@THU
T
The Blog of Author Tim Ferriss
C
Cisco Blogs
Attack and Defense Labs
Attack and Defense Labs
小众软件
小众软件

mephisto.cc

修复rime-ice无法弹出候选框的问题 开机滚动字体显示优化 个人网站安全防护 树莓派上部署Vaultwarden 使用goaccess实时分析Caddy日志 个人网站监控 Hugo全站AVIF记 Linux下尝试使用Godot开发小游戏 Arch linux dae 透明代理 Airflow接管galler-dl下载任务 如何使用gallery-dl批量下载图像 Arch核显下如何愉快玩Dota2和CS2 Arch/labwc 环境网络相关设置 Rime添加dota2词库 Arch 重装记录 Supertuxkart iOS版终于发布了 打造自己的流媒体音乐服务 剪切板管理工具clipcat推荐 MangoHud性能监控 微信小程序开发记 Rofi试用 解决Arch下VSCode无法输入中文的问题 独立窗口管理器下无法录屏问题处理 上海市二手房成交数据监控 OpenLDAP监控 Arch linux如何顺畅连接蓝牙设备 使用Git和Ansible管理配置文件 Arch Linux SSL VPN 客户端配置 简单获取celery任务实时结果 Arch linux下iNode客户端的安装和使用方法 券商费率调整记 迷你主机组装记 Labwc更换定制皮肤 树莓派跑分流代理 实用自动代理配置示例 九年老鼠标复活记 Openvpn示例 Mac下如何旋转webp图片 如何隐藏Vscode中Markdown PDF插件的头部内容 解决Linux下网络配置无法变更保存的问题 labwc环境启用wlogout Ubuntu下新官方微信尝鲜 简单检测用户是否开启广告屏蔽 Atuin ZFS下卡顿问题解决 Wine安装64位微信 Fish 和 Atuin使用记 Fastapi简单实现临时下载链接 Fastapi微信公众号开发简要 Hugo根据语种展示不同内容 如何修复Waybar微信图标错误 信封加密简要 Linux环境下维护公众号记录 快速隐藏和呼出终端 Wayland环境自动切换壁纸 SuperTuxKart 试玩 简单抓取雪球股票快讯 为什么你的kill命令不能列出信号表 Wine安装微信保姆教程 Hysteria科学上网简要 Ubuntu 23.10 钉钉无法启动解决方法 网站导航栏防止插入Adsense自动广告 Linux环境按键检测 Hugo文末添加最后修改时间 Wayland环境ksnip无法复制问题解决 我眼中的股票市场 Caddy简单图片防盗链 greetd和regreet使用教程 Wayland环境下截图加后期修改 Wayland 环境下gif录屏 Firefox的一些有趣功能 Ubuntu 切换系统语言 Firefox 标题栏高度调整 网站添加回到顶部功能 Hugo自定义字体 Labwc 便捷配置 Wofi使用教程 窗口管理器labwc使用记 文件共享软件Dufs推荐 Hugo静态站点接入Adsense广告 Fcitx5配置详解 Ubuntu安装chrome的方法总结 一种Xterm.js的全屏方案 Google网址收录api Python示例 手机听离线音乐 Snipe it资产导入 应用启动器yofi使用配置 Snipe it资产管理系统安装使用 Ubuntu开机启动加速 Vue3 vite TypeScript跨域等相关设置 Ubuntu手动升级Libreoffice Ubuntu设置alacritty为默认终端 简体文章批量转换为繁体 使用Inkscape调整svg图片大小 实用命令 使用mitmproxy给手机app抓包 Python中rstrip方法细解 Github同主机多仓库部署deploy key问题处理 Linux安装最新版本Python KeePassXC使用教程 Ubuntu 22.10连接蓝牙耳机报错br-connection-profile-unavailable解决方法
k8s的startupProbe探针中initialDelaySeconds是否有效
2022-06-15 · via mephisto.cc

众所周知,k8s 目前有三种探针,官方文档的英文解释如下:

The kubelet uses liveness probes to know when to restart a container. For example, liveness probes could catch a deadlock, where an application is running, but unable to make progress. Restarting a container in such a state can help to make the application more available despite bugs.

The kubelet uses readiness probes to know when a container is ready to start accepting traffic. A Pod is considered ready when all of its containers are ready. One use of this signal is to control which Pods are used as backends for Services. When a Pod is not ready, it is removed from Service load balancers.

The kubelet uses startup probes to know when a container application has started. If such a probe is configured, it disables liveness and readiness checks until it succeeds, making sure those probes don't interfere with the application startup. This can be used to adopt liveness checks on slow starting containers, avoiding them getting killed by the kubelet before they are up and running.

上面的英文概述很清楚,liveness probes 存活探针决定什么时候重启容器,live 英文字面理解也相符,不通过 liveness 检测,容器就会被重启。readiness probes 就是传统负载均衡中的概念,很好理解,检测通过就加入服务池,熟悉 nginx 的都可以类比 upstream 中配置的健康检测,行就上,不行就下,容器还在。最后是新加的 startup probes 启动探针,我理解的使用场景是,慢启动的容器,在启动开始后,运行了一段时间,期间并不想让另外两种探针来处理,等这个启动探针通过后,再由另外两个探针的逻辑接管,这样的好处是多了一道关卡,保护慢启动的容器,避免还没准备好的时候,额外检测操作来导致不可预知的问题。

有了上述基础背景后,initialDelaySeconds 这个参数就出场了,同样给出官方文档解释

initialDelaySeconds: Number of seconds after the container has started before liveness or readiness probes are initiated. Defaults to 0 seconds. Minimum value is 0.

当你细读上面的文字的时候,是否会有疑问,initialDelaySeconds 参数到底对 startup probes 有效吗?我搜了网上的各种信息,很遗憾没有人确切说明,在官方的另外一个文档中

initialDelaySeconds integer Number of seconds after the container has started before liveness probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes

有没有搞错,连 readiness probes 的解释都不见了,怎么办呢,靠别人不行,只能自己加倍努力啦,我的方法是翻源码初步确认,再做实验验证

1.去 github 搜索 k8s 源码,探针为一个 golang 结构体

 1    type Probe struct {
 2        // The action taken to determine the health of a container
 3        ProbeHandler
 4        // Length of time before health checking is activated.  In seconds.
 5        // +optional
 6        InitialDelaySeconds int32
 7        // Length of time before health checking times out.  In seconds.
 8        // +optional
 9        TimeoutSeconds int32
10        // How often (in seconds) to perform the probe.
11        // +optional
12        PeriodSeconds int32
13        // Minimum consecutive successes for the probe to be considered successful after having failed.
14        // Must be 1 for liveness and startup.
15        // +optional
16        SuccessThreshold int32
17        // Minimum consecutive failures for the probe to be considered failed after having succeeded.
18        // +optional
19        FailureThreshold int32
20        // Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
21        // The grace period is the duration in seconds after the processes running in the pod are sent
22        // a termination signal and the time when the processes are forcibly halted with a kill signal.
23        // Set this value longer than the expected cleanup time for your process.
24        // If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
25        // value overrides the value provided by the pod spec.
26        // Value must be non-negative integer. The value zero indicates stop immediately via
27        // the kill signal (no opportunity to shut down).
28        // This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
29        // +optional
30        TerminationGracePeriodSeconds *int64
31    }

上面并没有说 startup probes 不能使用 InitialDelaySeconds 参数

2.做实验,爱迪生也是这么做的,没毛病

 1    apiVersion: v1
 2    kind: Pod
 3    metadata:
 4    labels:
 5        test: liveness
 6    name: liveness-exec
 7    spec:
 8    containers:
 9    - name: liveness
10        image: k8s.gcr.io/busybox
11        args:
12        - /bin/sh
13        - -c
14        - touch /tmp/healthy; sleep 30; rm -f /tmp/healthy; sleep 600
15        resources:
16        limits:
17            cpu: 1000m
18            memory: 2G
19        requests:
20            cpu: 1000m
21            memory: 2G
22        livenessProbe:
23        exec:
24            command:
25            - cat
26            - /tmp/healthy
27        initialDelaySeconds: 5
28        periodSeconds: 5
29
30        startupProbe:
31        exec:
32            command:
33            - cat
34            - /tmp/helloworld   # 这个文件肯定不存在的
35        failureThreshold: 3
36        periodSeconds: 10
37        initialDelaySeconds: 8  # 测试的就是这个参数

保存上述文件为 exec-liveness.yaml,启动 pod 测试

1    kubectl -n xxxx-test apply -f exec-liveness.yaml

终端里面反复查看这个,在输出结果的最下面,有信息显示启动探测器失败了

1    kubectl -n xxxx-test describe pod liveness-exec

注意看那个 age 栏的 9s,非常接近 8s 对不对

1    Events:
2    Type     Reason     Age        From                    Message
3    ----     ------     ----       ----                    -------
4    Normal   Scheduled  <unknown>  default-scheduler       Successfully assigned xxxx-test/liveness-exec to 10.132.135.31
5    Normal   Pulled     9s         kubelet, 10.132.135.31  Container image "xxx/docker/busybox:1.24" already present on machine
6    Normal   Created    9s         kubelet, 10.132.135.31  Created container liveness
7    Normal   Started    9s         kubelet, 10.132.135.31  Started container liveness
8    Warning  Unhealthy  0s         kubelet, 10.132.135.31  Startup probe failed: cat: can't open '/tmp/helloworld': No such file or directory

修改改成 initialDelaySeconds: 15,删除容器重新查看,会发现那个地方变成 16s

1    Events:
2    Type     Reason     Age        From                    Message
3    ----     ------     ----       ----                    -------
4    Normal   Scheduled  <unknown>  default-scheduler       Successfully assigned xxxx-test/liveness-exec to 10.132.133.16
5    Normal   Pulling    16s        kubelet, 10.132.133.16  Pulling image "xxx/docker/busybox:1.24"
6    Normal   Pulled     16s        kubelet, 10.132.133.16  Successfully pulled image "xxxx/docker/busybox:1.24"
7    Normal   Created    16s        kubelet, 10.132.133.16  Created container liveness
8    Normal   Started    16s        kubelet, 10.132.133.16  Started container liveness
9    Warning  Unhealthy  0s         kubelet, 10.132.133.16  Startup probe failed: cat: can't open '/tmp/helloworld': No such file or directory

说明了什么?那就是 InitialDelaySeconds 参数在目前的版本,对 startup probes 是有效的,和源码里面的注释相符,很遗憾,官方文档多少有些误导大家,最后希望大家合理使用这些探针,及时发现问题,高枕无忧