k3s

# 设置所需的 sysctl 参数，参数在重新启动后保持不变
cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.ipv4.ip_forward = 1
EOF
​
# 应用 sysctl 参数而不重新启动
sysctl --system

containerd config default > /etc/containerd/config.toml

[plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runc]
  ...
  [plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runc.options]
    SystemdCgroup = true

ctr images pull docker.io/library/eclipse-temurin:25.0.1_8-jdk

ctr images pull docker.m.daocloud.io/library/eclipse-temurin:25.0.1_8-jdk

useradd -m minikube
passwd minikube

usermod -aG wheel minikube
usermod -aG docker minikube

minikube start

minikube status

minikube
type: Control Plane
host: Running
kubelet: Running
apiserver: Running
kubeconfig: Configured

su minikube

minikube image load eclipse-temurin:25.0.1_8-jdk

vim /etc/systemd/system/docker.service

[Service]
Environment="HTTP_PROXY=http://127.0.0.1:7890"
Environment="HTTPS_PROXY=http://127.0.0.1:7890"
Environment="NO_PROXY=localhost,127.0.0.1"

systemctl daemon-reload

systemctl restart docker

minikube addons list

minikube addons enable metrics-server

minikube addons disable metrics-server

kubectl create deployment api-call-service \
  --image=api-call-service:dev_1.0

kubectl get deployments

kubectl get pods

kubectl describe pod api-call-service-85cdccd5c5-nlpv4

minikube service api-call-service

 kubectl port-forward deployment/api-call-service 8106:8106 --address 0.0.0.0

kubectl delete deployment api-call-service

kubectl expose deployment api-call-service --type=LoadBalancer --port=8106

kubectl get services

minikube service api-call-service

kubectl delete service api-call-service

kubectl get rs

kubectl scale deployments/api-call-service --replicas=4

kubectl logs -l app=api-call-service -f

kubectl describe pod api-call-service-85cdccd5c5-bhzdg

kubectl set image deployments/api-call-service api-call-service=docker.io/library/api-call-service:dev_1.1

kubectl rollout status deployments/api-call-service

kubectl rollout history deployment/api-call-service

kubectl get deployment api-call-service -o yaml

kubectl create deployment api-call-service \
  --image=api-call-service:dev_1.0 \
  --dry-run=client -o yaml

apiVersion: apps/v1
kind: Deployment # 资源类型为 Deployment，用于管理无状态应用的副本和滚动更新
metadata:
  labels:
    app: api-call-service # 为这个 Deployment 资源添加标签，用于资源识别和筛选
  name: api-call-service # Deployment 资源的名称
spec:
  replicas: 4 # pod 副本
  selector:
    matchLabels: # 设置 Deployment 通过标签选择器管理哪些 Pod
      app: api-call-service # 只管理标签为 app: api-call-service 的 Pod
  strategy: {} # 更新策略
  template:
    metadata:
      labels:
        app: api-call-service
    spec:
      containers:
      - image: api-call-service:dev_1.0
        name: api-call-service
        ports:
          - containerPort: 8106
        volumeMounts:
        # 日志目录 - 指定宿主机实际位置
        - name: log-volume
          mountPath: /app/log
          readOnly: false
        resources: {}
      nodeSelector:
        kubernetes.io/hostname: minikube-1  # 固定到指定节点
      volumes:
      - name: log-volume
        hostPath:
          path: /opt/kube/api-call/log  # 宿主机实际路径
          type: DirectoryOrCreate  # 如果不存在则创建

kubectl apply -f deployment.yaml

apiVersion: v1
kind: Service

metadata:
  name: api-call-service

spec:
  type: ClusterIP

  selector:
    app: api-call-service

  ports:
  - port: 80
    targetPort: 8106

apiVersion: v1
kind: Service

metadata:
  name: api-call-service

spec:
  type: LoadBalancer

  selector:
    app: api-call-service

  ports:
  - port: 8106
    targetPort: 8106
    nodePort: 32010

kubectl apply -f service.yaml

ln -s /opt/dev/nerdctl/bin/nerdctl /usr/local/bin/nerdctl
ln -s /opt/dev/nerdctl/bin/buildkitd /usr/local/bin/buildkitd

mkdir -p /etc/nerdctl
​
tee /etc/nerdctl/nerdctl.toml << EOF
address = "/run/k3s/containerd/containerd.sock"
namespace = "k8s.io"
EOF

gunzip -c k3s-airgap-images-amd64.tar.gz | docker load

firewall-cmd --permanent --add-port=6443/tcp #apiserver
firewall-cmd --permanent --zone=trusted --add-source=10.42.0.0/16 #pods
firewall-cmd --permanent --zone=trusted --add-source=10.43.0.0/16 #services
firewall-cmd --permanent --add-port=8472/udp
firewall-cmd --permanent --add-port=10250/tcp
firewall-cmd --reload

cp k3s /usr/local/bin

CREATE DATABASE `neko_integration_k3s` /*!40100 DEFAULT CHARACTER SET utf8mb4 */;

CREATE USER 'k3s'@'%' IDENTIFIED BY 'k3s';

GRANT ALL PRIVILEGES ON neko_integration_k3s.* TO 'k3s'@'%';

FLUSH PRIVILEGES;

export KUBECONFIG=/etc/rancher/k3s/k3s.yaml

ln -s /usr/local/bin/k3s /usr/local/bin/kubectl

mkdir -p /etc/rancher/k3s

vim /etc/rancher/k3s/config.yaml

write-kubeconfig-mode: "0644"
docker: true
datastore-endpoint: "mysql://k3s:k3s@tcp(db:3306)/xlink_k3s"

vim /etc/systemd/system/k3s.service

[Unit]
Description=Lightweight Kubernetes
Documentation=https://k3s.io
After=network.target docker.service
Wants=docker.service
[Service]
ExecStart=/usr/local/bin/k3s server --config /etc/rancher/k3s/config.yaml
Restart=always
RestartSec=5s
[Install]
WantedBy=multi-user.target

systemctl daemon-reload
systemctl enable k3s
systemctl start k3s

gunzip -c k3s-airgap-images-amd64.tar.gz | docker load

firewall-cmd --permanent --add-port=6443/tcp #apiserver
firewall-cmd --permanent --zone=trusted --add-source=10.42.0.0/16 #pods
firewall-cmd --permanent --zone=trusted --add-source=10.43.0.0/16 #services
firewall-cmd --permanent --add-port=8472/udp
firewall-cmd --permanent --add-port=10250/tcp
firewall-cmd --reload

cp k3s /usr/local/bin

export KUBECONFIG=/etc/rancher/k3s/k3s.yaml

ln -s /usr/local/bin/k3s /usr/local/bin/kubectl

mkdir -p /etc/rancher/k3s

vim /etc/rancher/k3s/config.yaml

cat /var/lib/rancher/k3s/server/node-token

server: "https://server:6443"
token: "token"
docker: true

vim /etc/systemd/system/k3s.service

[Unit]
Description=Lightweight Kubernetes
Documentation=https://k3s.io
After=network.target docker.service
Wants=docker.service
[Service]
ExecSta

systemctl daemon-reload
systemctl enable k3s
systemctl start k3s

mv linux-amd64/helm /usr/local/bin

api-call-service/
├── Chart.yaml          # Chart 信息描述文件（必需），YAML 格式，包含 Chart 的名称、版本、描述、依赖等信息
├── LICENSE             # 可选：Chart 的许可证文本文件
├── README.md           # 可选：Chart 的说明文档
├── values.yaml         # 默认配置值文件，在模板渲染时作为变量输入
├── values.schema.json  # 可选：values.yaml 的 JSON Schema 约束文件，用于对 values.yaml 进行结构校验
├── charts/             # 依赖 Chart 目录，存放该 Chart 所依赖的其他 Chart（子 Chart）
├── crds/               # 自定义资源定义（CRD）目录，存放自定义资源定义（CRD）的 YAML 文件，在模板渲染前安装
├── templates/          # 模板文件目录（生成 Kubernetes 清单文件），存放 Go 模板文件，与 values 结合后生成 Kubernetes 清单
└── templates/NOTES.txt # 可选：使用说明文本文件

apiVersion: The chart API version (required)
name: The name of the chart (required)
version: The version of the chart (required)
kubeVersion: A SemVer range of compatible Kubernetes versions (optional)
description: A single-sentence description of this project (optional)
type: The type of the chart (optional)
keywords:
  - A list of keywords about this project (optional)
home: The URL of this projects home page (optional)
sources:
  - A list of URLs to source code for this project (optional)
dependencies: # A list of the chart requirements (optional)
  - name: The name of the chart (nginx)
    version: The version of the chart ("1.2.3")
    repository: (optional) The repository URL ("https://example.com/charts") or alias ("@repo-name")
    condition: (optional) A yaml path that resolves to a boolean, used for enabling/disabling charts (e.g. subchart1.enabled )
    tags: # (optional)
      - Tags can be used to group charts for enabling/disabling together
    import-values: # (optional)
      - ImportValues holds the mapping of source values to parent key to be imported. Each item can be a string or pair of child/parent sublist items.
    alias: (optional) Alias to be used for the chart. Useful when you have to add the same chart multiple times
maintainers: # (optional)
  - name: The maintainers name (required for each maintainer)
    email: The maintainers email (optional for each maintainer)
    url: A URL for the maintainer (optional for each maintainer)
icon: A URL to an SVG or PNG image to be used as an icon (optional).
appVersion: The version of the app that this contains (optional). Needn't be SemVer. Quotes recommended.
deprecated: Whether this chart is deprecated (optional, boolean)
annotations:
  example: A list of annotations keyed by name (optional).

helm create api-call-service

helm install api-call-service ./api-call-service/

helm install api-call-service ./api-call-service/ -n default

helm status api-call-service

helm uninstall api-call-service

mv helmfile /usr/local/bin

# The desired states of Helm releases.
#
# Helmfile runs various helm commands to converge the current state in the live cluster to the desired state defined here.
releases:
  # Published chart example
  - name: vault                            # Release 名称，对应 `helm install [NAME]`
    namespace: vault                       # 目标 Kubernetes 命名空间
    createNamespace: true                  # 自动创建不存在的命名空间（默认 true）
    labels:                                # Release 的标签，用于 `--selector` 筛选
      foo: bar
    chart: roboll/vault-secret-manager     # Chart 来源，格式 `仓库名/Chart名`，对应 `helm install [NAME] [CHART]`
    version: ~1.24.1                       # Chart 版本约束，`~` 表示兼容补丁版本（如 1.24.x），支持 semver 范围
    condition: vault.enabled               # 条件控制，通过 values 中的 `vault.enabled` 值决定是否部署此 Release
    missingFileHandler: Warn               # 缺少 values/secrets 文件时的处理方式：Error（失败）或 Warn（警告并继续）
    missingFileHandlerConfig:
      # 忽略 Git 分支缺失错误，使 Debug/Info/Warn 处理器可将缺失分支视为非错误
      # 详见 https://github.com/helmfile/helmfile/issues/392
      ignoreMissingGitBranch: true
    # Values 文件，用于渲染 Chart
    values:
      # 通过 `--values` 传递的值文件（相对或绝对路径）
      - vault.yaml
      # 内联 values，通过临时值文件和 `--values` 传递，避免 `--set` 的类型问题
      - address: https://vault.example.com
      # Go 模板可用于内联值和值文件
      - image:
          # 最终结果是 YAML 格式。使用 `quote` 防止类似数字的字符串被意外解析为数字！
          # 详见 https://github.com/roboll/helmfile/issues/608
          tag: {{ requiredEnv "IMAGE_TAG" | quote }}
          # 其他写法：
          #   tag: "{{ requiredEnv "IMAGE_TAG" }}"
          #   tag: !!string {{ requiredEnv "IMAGE_TAG" }}
        db:
          username: {{ requiredEnv "DB_USERNAME" }}
          # 从环境变量取值。必须加引号。如果环境变量未设置会报错。
          # $DB_PASSWORD 需要在调用环境中设置，例如：export DB_PASSWORD='password1'
          password: {{ requiredEnv "DB_PASSWORD" }}
        proxy:
          # 将环境变量与固定字符串插值
          domain: {{ requiredEnv "PLATFORM_ID" }}.my-domain.com
          scheme: {{ env "SCHEME" | default "https" }}  # 从环境变量取值，若未设置则使用默认值 "https"
    # 尽可能使用 `values`！
    # `setString` 对应 Helm 的 `--set-string key=val`，强制将值设为字符串类型
    setString:
    # 设置数组中的单个值，对应 `--set-string bar[0]={1,2}`
    - name: bar[0]
      values:
      - 1
      - 2
    # 设置模板化值
    - name: namespace
      value: {{ .Namespace }}  # `.Namespace` 是 Helmfile 内置变量
    # `set` 对应 Helm 的 `--set key=val`，已知存在类型问题（见 https://github.com/roboll/helmfile/issues/608）
    set:
    # 从本地文件加载单个值，对应 `--set-file foo.config=path/to/file`
    - name: foo.config
      file: path/to/file
    # 设置数组中的单个值，对应 `--set bar[0]={1,2}`
    - name: bar[0]
      values:
      - 1
      - 2
    # 设置模板化值
    - name: namespace
      value: {{ .Namespace }}
    # 将尝试使用 helm-secrets 插件解密
    secrets:
      - vault_secret.yaml
    # 覆盖 helmDefaults 中的选项：verify, wait, waitForJobs, timeout, recreatePods, force, reuseValues
    verify: true                           # 验证 Chart 的 GPG 签名
    keyring: path/to/keyring.gpg           # GPG 密钥环文件路径
    # --skip-schema-validation 标志，传递给 helm install/upgrade/lint（默认 false）
    skipSchemaValidation: false
    wait: true                             # 等待所有资源就绪后再返回（对应 `--wait`）
    # DEPRECATED: waitRetries 不再支持 - 见上方文档
    # waitRetries: 3
    waitForJobs: true                      # 配合 `wait`，等待所有 Job 完成后再标记 Release 成功
    timeout: 60                            # 超时时间（秒），默认 300
    recreatePods: true                     # 重新创建 Pod（对应 `--recreate-pods`）
    force: false                           # 强制更新，通过删除/重建资源（对应 `--force`）
    reuseValues: false                     # 复用上一版本的 values（对应 `--reuse-values`）
    # 设为 `false` 会在 `sync` 时卸载此 Release（默认 true）
    installed: true
    # 更新策略，可选值：
    # - "reinstallIfForbidden": 仅在更新被拒绝时（如权限或冲突问题）先卸载再安装
    updateStrategy: ""
    # 原子操作，失败时自动回滚到上一版本（默认 false）
    atomic: true
    # 失败时清理新创建的资源（默认 false）
    cleanupOnFail: false
    # 传递给 Helm 命令的 `--kube-context`
    # 详见 https://github.com/roboll/helmfile/issues/642
    # 默认 ""，使用标准 kubeconfig（~/kubeconfig 或 $KUBECONFIG 指向的文件）
    kubeContext: kube-context
    # 传递 `--disable-validation` 给 helm diff 插件（需要 diff 插件 >= 3.1.2）
    # 对于部署使用 Helm API v1 CRD 的 Chart 可能有帮助
    # 详见 https://github.com/roboll/helmfile/pull/1373
    disableValidation: false
    # 传递 `--disable-validation` 给 helm diff 插件（需要 diff 插件 >= 3.1.2）
    # 当 Release 包含尚未安装到集群的 CRD 自定义资源时有用
    # 详见 https://github.com/roboll/helmfile/pull/1618
    disableValidationOnInstall: false
    # 传递 `--disable-openapi-validation` 给 helm diff 插件（需要 diff 插件 >= 3.1.2）
    # 对于部署使用 Helm API v1 CRD 的 Chart 可能有帮助
    # 详见 https://github.com/roboll/helmfile/pull/1373
    disableOpenAPIValidation: false
    # 每个 Release 保留的最大历史版本数，0 表示不限制（默认 10）
    historyMax: 10
    # 设为 `true` 时跳过运行 `helm dep up` 和 `helm dep build`
    # 当 Chart 有问题时有用，详见 https://github.com/roboll/helmfile/issues/1547
    skipDeps: false
    # 传递 `--post-renderer` 给 helm v3 template 和 helm install
    postRenderer: "path/to/postRenderer"
    # 传递 `--post-renderer-args` 给 helm v3 template 和 helm install
    # 允许在 Windows 上使用 PowerShell 脚本作为后渲染器
    postRendererArgs:
    - PowerShell
    - "-Command"
    - "theScript.ps1"
    # 传递 `--cascade` 给 helm v3 delete，可选值：background（后台）、foreground（前台）、orphan（孤立），默认 background
    cascade: "background"
    # 拉取远程 Chart 时跳过 TLS 验证
    insecureSkipTLSVerify: false
    # 拉取远程 Chart 时使用 HTTP
    plainHttp: false
    # 跳过 helm diff 输出，对于产生大量无用 diff 的 Chart 有用，默认 false
    suppressDiff: false
    # 从 helm diff 输出中抑制匹配正则表达式的行（默认 []），适用于 helmfile v0.162.0+
    suppressOutputLineRegex:
      - "version"
    # 同步时是否添加 Release 标签
    syncReleaseLabels: false
    # 用于 helm-unittest 集成的测试文件或目录路径列表
    # 指定后，`helmfile unittest` 将使用合并后的 values 和这些测试路径运行 `helm unittest`
    # 需要安装 helm-unittest 插件：https://github.com/helm-unittest/helm-unittest
    unitTests:
      - tests/vault
​
​
  # Local chart example（本地 Chart 示例）
  - name: grafana                            # Release 名称
    namespace: another                       # 目标命名空间
    chart: ../my-charts/grafana              # Chart 路径，相对于 helmfile 文件的本地路径
    values:
    - "../../my-values/grafana/values.yaml"             # 值文件路径（相对于 manifest）
    - ./values/{{ requiredEnv "PLATFORM_ENV" }}/config.yaml # 包含环境变量的值文件路径，$PLATFORM_ENV 必须在调用环境中设置
    wait: true                               # 等待资源就绪

helmDefaults:
  wait: true
  timeout: 300
  createNamespace: true
  historyMax: 10
​
# 通过 -e 指定
environments:
  test:
    values:
      - environments/test.yaml
  dev:
    values:
      - environments/dev.yaml
  prod:
    values:
      - environments/prod.yaml
---
releases:
  # 使用 services.txt 生成多个服务
  {{- $services := readFile "services.txt" | splitList "\n" }}
  {{- range $services }}
    {{- if ne . "" }}
  - name: {{ . }}
    # {{ $.Environment.Name }} 读取 -e 指定的环境
    namespace: {{ $.Environment.Name }}
    # 指定 chart 位置
    chart: ./charts/generic-service
    values:
      # 指定每个服务的默认配置值文件，在模板渲染时作为变量输入
      - ./values/{{ . }}.yaml
    {{- end }}
  {{- end }}

# ./charts/generic-service/Chart.yaml
​
apiVersion: v2
name: api-call-service
description: A Helm chart for Kubernetes
# A chart can be either an 'application' or a 'library' chart.
#
# Application charts are a collection of templates that can be packaged into versioned archives
# to be deployed.
#
# Library charts provide useful utilities or functions for the chart developer. They're included as
# a dependency of application charts to inject those utilities and functions into the rendering
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
type: application
# This is the chart version. This version number should be incremented each time you make changes
# to the chart and its templates, including the app version.
# Versions are expected to follow Semantic Versioning (https://semver.org/)
version: 0.1.0
# This is the version number of the application being deployed. This version number should be
# incremented each time you make changes to the application. Versions are not expected to
# follow Semantic Versioning. They should reflect the version the application is using.
# It is recommended to use it with quotes.
appVersion: "1.16.0"

# ./charts/generic-service/templates/deployment.yaml
​
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: {{ .Values.image.repository }}
  name: {{ .Values.image.repository }}
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      app: {{ .Values.image.repository }}
  strategy: {}
  template:
    metadata:
      labels:
        app: {{ .Values.image.repository }}
    spec:
      containers:
      - image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        name: {{ .Values.image.repository }}
        ports:
        - containerPort: {{ .Values.containerPort }}
        volumeMounts:
        {{- range .Values.volumes }}
        - name: {{ .name }}
          mountPath: {{ .mountPath }}
          readOnly: {{ .readOnly | default false }}
        {{- end }}
        resources:
          {{- toYaml .Values.resources | nindent 10 }}
      {{- if .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml .Values.nodeSelector | nindent 8 }}
      {{- end }}
      volumes:
      {{- range .Values.volumes }}
      - name: {{ .name }}
        hostPath:
          path: {{ .hostPath.path }}
          type: {{ .hostPath.type }}
      {{- end }}

# ./charts/generic-service/templates/service.yaml
​
apiVersion: v1
kind: Service
metadata:
  name: {{ .Values.image.repository }}
spec:
  type: {{ .Values.service.type }}
  selector:
    app: {{ .Values.image.repository }}
  ports:
  - port: {{ .Values.service.port }}
    targetPort: {{ .Values.service.targetPort }}
    {{- if eq .Values.service.type "LoadBalancer" }}
    nodePort: {{ .Values.service.nodePort }}
    {{- end }}

# ./environments/dev.yaml
​
global:
  resources:
    limits:
      cpu: 200m
      memory: 512Mi
    requests:
      cpu: 100m
      memory: 256Mi
  replicaCount: 1

helmfile -e dev sync

helmfile -e dev status