apiserver分析(六)-resthandler-v1.5.2

什么是resthandler

之前已经分析到,Kubernetes是如何注册API的。Kubernetes会把对应路径上的请求交给对应的resthandler处理。所以,resthandler是对请求进行处理并响应的函数。在Kubernetes中,给每一种动作设置了对应的resthandler,如下表格所示(只列出了主要部分):

阅读全文

apiserver分析(五)-APIInstaller-v1.5.2

APIInstaller

APIInstaller是对APIGroupVersion的封装,定义在/pkg/apiserver/api_installer.go:

1
2
3
4
5
type APIInstaller struct {
group *APIGroupVersion
prefix string // Path prefix where API resources are to be registered.
minRequestTimeout time.Duration
}

阅读全文

apiserver分析(四)-API安装-v1.5.2

我们都知道,在Kubernetes中,Apiserver提供了API访问服务。那么API是什么时候注册到Apiserver中的呢?本次分析,将会介绍这些内容。

emicklei/go-restful

Kubernetes使用emicklei/go-restful包提供RESTful API服务。所以有必要先来了解下emicklei/go-restful是如何使用的。

阅读全文

apiserver分析(三)-master和genericapiserver-v1.5.2

GenericAPIServer

GenericAPIServer可以理解为Kubernetes中提供API服务的结构体。定义在/pkg/genericapiserver/genericapiserver.go中:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
// GenericAPIServer contains state for a Kubernetes cluster api server.
type GenericAPIServer struct {
// discoveryAddresses is used to build cluster IPs for discovery.
discoveryAddresses DiscoveryAddresses
// LoopbackClientConfig is a config for a privileged loopback connection to the API server
LoopbackClientConfig *restclient.Config
// minRequestTimeout is how short the request timeout can be. This is used to build the RESTHandler
minRequestTimeout time.Duration
// enableSwaggerSupport indicates that swagger should be served. This is currently separate because
// the API group routes are created *after* initialization and you can't generate the swagger routes until
// after those are available.
// TODO eventually we should be able to factor this out to take place during initialization.
enableSwaggerSupport bool
// legacyAPIGroupPrefixes is used to set up URL parsing for authorization and for validating requests
// to InstallLegacyAPIGroup
legacyAPIGroupPrefixes sets.String
// admissionControl is used to build the RESTStorage that backs an API Group.
admissionControl admission.Interface
// requestContextMapper provides a way to get the context for a request. It may be nil.
requestContextMapper api.RequestContextMapper
// The registered APIs
//***含有REST中的container***//
HandlerContainer *genericmux.APIContainer
SecureServingInfo *SecureServingInfo
InsecureServingInfo *ServingInfo
// numerical ports, set after listening
effectiveSecurePort, effectiveInsecurePort int
// ExternalAddress is the address (hostname or IP and port) that should be used in
// external (public internet) URLs for this GenericAPIServer.
ExternalAddress string
// storage contains the RESTful endpoints exposed by this GenericAPIServer
storage map[string]rest.Storage
// Serializer controls how common API objects not in a group/version prefix are serialized for this server.
// Individual APIGroups may define their own serializers.
Serializer runtime.NegotiatedSerializer
// "Outputs"
Handler http.Handler
InsecureHandler http.Handler
// Map storing information about all groups to be exposed in discovery response.
// The map is from name to the group.
apiGroupsForDiscoveryLock sync.RWMutex
apiGroupsForDiscovery map[string]unversioned.APIGroup
// See Config.$name for documentation of these flags
enableOpenAPISupport bool
openAPIConfig *common.Config
// PostStartHooks are each called after the server has started listening, in a separate go func for each
// with no guaranteee of ordering between them. The map key is a name used for error reporting.
// It may kill the process with a panic if it wishes to by returning an error
postStartHookLock sync.Mutex
postStartHooks map[string]postStartHookEntry
postStartHooksCalled bool
// healthz checks
healthzLock sync.Mutex
healthzChecks []healthz.HealthzChecker
healthzCreated bool
}

阅读全文

Docker命令行解析源码分析-v1.12.3

Docker命令行

在使用Docker时,我们通过docker run等命令和dockerd进行交互。目前Docker分为docker和dockerd两个二进制文件,其中docker为客户端;dockerd为server端。本次分析将介绍docker程序是如何解析命令行的。

阅读全文

apiserver分析(二)-authorizer-v1.5.2

什么是Authorizer

Authorizer负责Kubernetes中对请求进行授权,只有通过授权的请求才会被执行。在Kubernetes中,主要有ABAC(Attributes Based Access Control),RBAC(Role Based Access Contro),AlwaysAllow,AlwaysDeny和Webhook(调用网络接口进行授权)这几种授权器。本次分析将介绍Kubernetes是如何管理授权器的,及如何对请求进行授权。

阅读全文

Docker镜像存储分析-v1.12.3

Docker镜像存储

本次将分析Docker v1.12.3的AUFS镜像存储目录结构。首先来看镜像的存储录/var/lib/docker/image/aufs,目录下主要有:

阅读全文

resourcequota分析(二)-quota-v1.5.2

上次分析解读了evaluator是如何计算对象消耗的资源量的,本次分析将介绍Kubernetes如何判断配额是否足够,如何更新配额。

注册

我们之前说过,admission的plugin都要向admission中的plugins注册。resourcequota的注册代码在/plugin/pkg/admission/resourcequota/admission.go中:

1
2
3
4
5
6
7
8
9
10
func init() {
//***向admission中的plugins中注册resourcequota的创建函数***//
admission.RegisterPlugin("ResourceQuota",
func(client clientset.Interface, config io.Reader) (admission.Interface, error) {
// NOTE: we do not provide informers to the registry because admission level decisions
// does not require us to open watches for all items tracked by quota.
registry := install.NewRegistry(client, nil)
return NewResourceQuota(client, registry, 5, make(chan struct{}))
})
}

阅读全文

apiserver分析(一)-authenticator-v1.5.2

什么是Authenticator

Authenticator负责Kubernetes中对请求进行认证,只有通过认证的请求才会被执行。在Kubernetes中,有BasicAuth, Keystone, X509, Token, ServiceAccount, OIDCIssuer, WebhookToken, AnyToken等认证器。本次分析将介绍Kubernetes是如何管理认证器的,及如何对请求进行认证。

阅读全文

resourcequota分析(一)-evaluator-v1.5.2

什么是evaluator

大家都知道,Kubernetes中使用resourcequota对配额进行管理。配额的管理涉及两个步骤:1、计算请求所需要的资源;2、比较并更新配额。所以解读resourcequota将分为两次进行。
evaluator就是用来计算请求所需要的资源的。

阅读全文