1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

apiVersion: "cilium.io/v2"
kind: CiliumClusterwideNetworkPolicy
metadata:
 name: "demo-host-policy"
spec:
 description: ""
 nodeSelector:
 matchLabels:
 node-access: ssh
 ingress:
 - fromEntities:
 - cluster
 - toPorts:
 - ports:
 - port: "22"
 protocol: TCP

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

# exec it in worker node's cilium pod:
# cilium endpoint list

ENDPOINT POLICY (ingress) POLICY (egress) IDENTITY LABELS (source:key[=value]) IPv6 IPv4 STATUS
 ENFORCEMENT ENFORCEMENT
456 Disabled Disabled 4 reserved:health 10.0.0.68 ready
972 Disabled Disabled 63615 k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=kube-system 10.0.0.69 ready
 k8s:io.cilium.k8s.policy.cluster=default
 k8s:io.cilium.k8s.policy.serviceaccount=coredns
 k8s:io.kubernetes.pod.namespace=kube-system
 k8s:k8s-app=kube-dns
1307 Disabled Disabled 63615 k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=kube-system 10.0.0.135 ready
 k8s:io.cilium.k8s.policy.cluster=default
 k8s:io.cilium.k8s.policy.serviceaccount=coredns
 k8s:io.kubernetes.pod.namespace=kube-system
 k8s:k8s-app=kube-dns
1723 Disabled Disabled 1380 k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=default 10.0.0.220 ready
 k8s:io.cilium.k8s.policy.cluster=default
 k8s:io.cilium.k8s.policy.serviceaccount=default
 k8s:io.kubernetes.pod.namespace=default
 k8s:run=nginx
3015 Disabled Disabled 1 reserved:host ready

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# exec it on master node's cilium pod

ENDPOINT POLICY (ingress) POLICY (egress) IDENTITY LABELS (source:key[=value]) IPv6 IPv4 STATUS
 ENFORCEMENT ENFORCEMENT
386 Disabled (Audit) Disabled 1 k8s:node-access=ssh ready
 k8s:node-role.kubernetes.io/control-plane
 k8s:node-role.kubernetes.io/master
 k8s:node.kubernetes.io/exclude-from-external-load-balancers
 reserved:host
565 Disabled Disabled 4 reserved:health 10.0.1.230 ready

1
2
3

# cmd: tc filter show dev eth0 ingress
filter protocol all pref 1 bpf chain 0
filter protocol all pref 1 bpf chain 0 handle 0x1 bpf_netdev_eth0.o:[from-netdev] direct-action not_in_hw id 510 tag ec099af6e42d92d6 jited

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

// FIle: bpf/bpf_host.c
/*
 * from-netdev is attached as a tc ingress filter to one or more physical devices
 * managed by Cilium (e.g., eth0). This program is only attached when:
 * - the host firewall is enabled, or
 * - BPF NodePort is enabled
 */
__section("from-netdev")
int from_netdev(struct __ctx_buff *ctx)
{
 __u32 __maybe_unused vlan_id;

 /* Filter allowed vlan id's and pass them back to kernel.
 */
 if (ctx->vlan_present) {
 vlan_id = ctx->vlan_tci & 0xfff;
 if (vlan_id) {
 if (allow_vlan(ctx->ifindex, vlan_id))
 return CTX_ACT_OK;
 else
 return send_drop_notify_error(ctx, 0, DROP_VLAN_FILTERED,
 CTX_ACT_DROP, METRIC_INGRESS);
 }
 }

 return handle_netdev(ctx, false);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

/**
 * handle_netdev
 * @ctx The packet context for this program
 * @from_host True if the packet is from the local host
 *
 * Handle netdev traffic coming towards the Cilium-managed network.
 */
static __always_inline int
handle_netdev(struct __ctx_buff *ctx, const bool from_host)
{
 __u16 proto;

 if (!validate_ethertype(ctx, &proto)) {
#ifdef ENABLE_HOST_FIREWALL
 int ret = DROP_UNSUPPORTED_L2;

 return send_drop_notify(ctx, SECLABEL, WORLD_ID, 0, ret,
 CTX_ACT_DROP, METRIC_EGRESS);
#else
 send_trace_notify(ctx, TRACE_TO_STACK, HOST_ID, 0, 0, 0,
 REASON_FORWARDED, 0);
 /* Pass unknown traffic to the stack */
 return CTX_ACT_OK;
#endif /* ENABLE_HOST_FIREWALL */
 }

 return do_netdev(ctx, proto, from_host);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

#ifdef ENABLE_IPV4
 case bpf_htons(ETH_P_IP):
 identity = resolve_srcid_ipv4(ctx, identity, &ipcache_srcid,
 from_host);
 ctx_store_meta(ctx, CB_SRC_IDENTITY, identity);
 if (from_host) {
# if defined(ENABLE_HOST_FIREWALL) && !defined(ENABLE_MASQUERADE)
 /* If we don't rely on BPF-based masquerading, we need
 * to pass the srcid from ipcache to host firewall. See
 * comment in ipv4_host_policy_egress() for details.
 */
 ctx_store_meta(ctx, CB_IPCACHE_SRC_LABEL, ipcache_srcid);
# endif
 ep_tail_call(ctx, CILIUM_CALL_IPV4_FROM_HOST);
 } else {
 ep_tail_call(ctx, CILIUM_CALL_IPV4_FROM_LXC);
 }
 /* We are not returning an error here to always allow traffic to
 * the stack in case maps have become unavailable.
 *
 * Note: Since drop notification requires a tail call as well,
 * this notification is unlikely to succeed.
 */
 return send_drop_notify_error(ctx, identity, DROP_MISSED_TAIL_CALL,
 CTX_ACT_OK, METRIC_INGRESS);
#endif

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

static __always_inline int
tail_handle_ipv4(struct __ctx_buff *ctx, __u32 ipcache_srcid, const bool from_host)
{
 __u32 proxy_identity = ctx_load_meta(ctx, CB_SRC_IDENTITY);
 int ret;

 ctx_store_meta(ctx, CB_SRC_IDENTITY, 0);

 ret = handle_ipv4(ctx, proxy_identity, ipcache_srcid, from_host);
 if (IS_ERR(ret))
 return send_drop_notify_error(ctx, proxy_identity,
 ret, CTX_ACT_DROP, METRIC_INGRESS);
 return ret;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

#ifdef ENABLE_HOST_FIREWALL
 if (from_host) {
 /* We're on the egress path of cilium_host. */
 ret = ipv4_host_policy_egress(ctx, secctx, ipcache_srcid, &monitor);
 if (IS_ERR(ret))
 return ret;
 } else if (!ctx_skip_host_fw(ctx)) {
 /* We're on the ingress path of the native device. */
 ret = ipv4_host_policy_ingress(ctx, &remote_id);
 if (IS_ERR(ret))
 return ret;
 }
#endif /* ENABLE_HOST_FIREWALL */

1
2
3
4

#pragma clang loop unroll(full)
 for (i = 0; i < 4; i++) {
 /* Do stuff ... */
 }

1
2

 long bpf_loop(u32 iterations, long (*loop_fn)(u32 index, void *ctx),
 void *ctx, u64 flags);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

apiVersion: v1
kind: Namespace
metadata:
 creationTimestamp: "2021-02-18T03:03:40Z"
 managedFields:
 - apiVersion: v1
 fieldsType: FieldsV1
 fieldsV1:
 f:status:
 f:phase: {}
 manager: kube-apiserver
 operation: Update
 time: "2021-02-18T03:03:40Z"
 name: default
 resourceVersion: "199"
 uid: 2f4536b5-7302-4dc1-9620-052a567c917c
spec:
 finalizers:
 - kubernetes
status:
 phase: Active

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

 conditions:
 - lastHeartbeatTime: "2021-02-18T03:05:25Z"
 lastTransitionTime: "2021-02-18T03:05:25Z"
 message: Flannel is running on this node
 reason: FlannelIsUp
 status: "False"
 type: NetworkUnavailable
 - lastHeartbeatTime: "2021-02-18T07:34:05Z"
 lastTransitionTime: "2021-02-18T03:03:36Z"
 message: kubelet has sufficient memory available
 reason: KubeletHasSufficientMemory
 status: "False"
 type: MemoryPressure

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

apiVersion: apps/v1
kind: Deployment
metadata:
 name: nginx-deployment
 labels:
 app: nginx
spec:
 replicas: 3
 selector:
 matchLabels:
 app: nginx
 template:
 metadata:
 labels:
 app: nginx
 spec:
 containers:
 - name: nginx
 image: nginx:1.14.2

1
2

# -n 后面是希望使用的 namespace, 非关键信息
kubectl apply -f d.yaml -n ssa

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90

apiVersion: apps/v1
kind: Deployment
metadata:
 annotations:
 deployment.kubernetes.io/revision: "1"
 kubectl.kubernetes.io/last-applied-configuration: |
  {"apiVersion":"apps/v1","kind":"Deployment","metadata":{"annotations":{},"labels":{"app":"nginx"},"name":"nginx-deployment","namespace":"ssa"},"spec":{"replicas":3,"selector":{"matchLabels":{"app":"nginx"}},"template":{"metadata":{"labels":{"app":"nginx"}},"spec":{"containers":[{"image":"nginx:1.14.2","name":"nginx"}]}}}}
 creationTimestamp: "2021-02-18T07:41:40Z"
 generation: 1
 labels:
 app: nginx
 managedFields:
 - apiVersion: apps/v1
 fieldsType: FieldsV1
 fieldsV1:
 f:metadata:
 f:annotations:
 .: {}
 f:kubectl.kubernetes.io/last-applied-configuration: {}
 f:labels:
 .: {}
 f:app: {}
 f:spec:
 f:progressDeadlineSeconds: {}
 f:replicas: {}
 f:revisionHistoryLimit: {}
 f:selector: {}
 f:strategy:
 f:rollingUpdate:
 .: {}
 f:maxSurge: {}
 f:maxUnavailable: {}
 f:type: {}
 f:template:
 f:metadata:
 f:labels:
 .: {}
 f:app: {}
 f:spec:
 f:containers:
 k:{"name":"nginx"}:
 .: {}
 f:image: {}
 f:imagePullPolicy: {}
 f:name: {}
 f:resources: {}
 f:terminationMessagePath: {}
 f:terminationMessagePolicy: {}
 f:dnsPolicy: {}
 f:restartPolicy: {}
 f:schedulerName: {}
 f:securityContext: {}
 f:terminationGracePeriodSeconds: {}
 manager: kubectl-client-side-apply
 operation: Update
 time: "2021-02-18T07:41:40Z"
 - apiVersion: apps/v1
 fieldsType: FieldsV1
 fieldsV1:
 f:metadata:
 f:annotations:
 f:deployment.kubernetes.io/revision: {}
 f:status:
 f:availableReplicas: {}
 f:conditions:
 .: {}
 k:{"type":"Available"}:
 .: {}
 f:lastTransitionTime: {}
 f:lastUpdateTime: {}
 f:message: {}
 f:reason: {}
 f:status: {}
 f:type: {}
 k:{"type":"Progressing"}:
 .: {}
 f:lastTransitionTime: {}
 f:lastUpdateTime: {}
 f:message: {}
 f:reason: {}
 f:status: {}
 f:type: {}
 f:observedGeneration: {}
 f:readyReplicas: {}
 f:replicas: {}
 f:updatedReplicas: {}
 manager: kube-controller-manager
 operation: Update
 time: "2021-02-18T07:41:42Z"
 name: nginx-deployment

1
2
3

type PodSpec struct {
 ...
 Containers []Container `json:"containers" patchStrategy:"merge" patchMergeKey:"name" ...`

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

apiVersion: apps/v1
kind: Deployment
metadata:
 name: patch-demo
spec:
 replicas: 2
 selector:
 matchLabels:
 app: nginx
 template:
 metadata:
 labels:
 app: nginx
 spec:
 containers:
 - name: patch-demo-ctr
 image: nginx
 tolerations:
 - effect: NoSchedule
 key: dedicated
 value: test-team

1
2
3
4
5
6

spec:
 template:
 spec:
 containers:
 - name: patch-demo-ctr-2
 image: redis

1

kubectl patch deployment patch-demo --patch "$(cat patch-file.yaml)"

1
2
3
4
5
6
7
8
9

containers:
- image: redis
 imagePullPolicy: Always
 name: patch-demo-ctr-2
 ...
- image: nginx
 imagePullPolicy: Always
 name: patch-demo-ctr
 ...

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

 - apiVersion: apps/v1
 fieldsType: FieldsV1
 fieldsV1:
 f:metadata:
 f:annotations:
 .: {}
 f:deployment.kubernetes.io/revision: {}
 f:status:
 f:availableReplicas: {}
 f:conditions:
 .: {}
 k:{"type":"Available"}:
 .: {}
 f:lastTransitionTime: {}
 f:lastUpdateTime: {}
 f:message: {}
 f:reason: {}
 f:status: {}
 f:type: {}
 k:{"type":"Progressing"}:
 .: {}
 f:lastTransitionTime: {}
 f:lastUpdateTime: {}
 f:message: {}
 f:reason: {}
 f:status: {}
 f:type: {}
 f:observedGeneration: {}
 f:readyReplicas: {}
 f:replicas: {}
 f:updatedReplicas: {}
 manager: kube-controller-manager
 operation: Update
 time: "2021-02-18T04:58:50Z"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

status:
 availableReplicas: 3
 conditions:
 - lastTransitionTime: "2021-02-18T04:58:50Z"
 lastUpdateTime: "2021-02-18T04:58:50Z"
 message: Deployment has minimum availability.
 reason: MinimumReplicasAvailable
 status: "True"
 type: Available
 - lastTransitionTime: "2021-02-18T04:56:00Z"
 lastUpdateTime: "2021-02-18T04:58:50Z"
 message: ReplicaSet "nginx-deployment-877f48f6d" has successfully progressed.
 reason: NewReplicaSetAvailable
 status: "True"
 type: Progressing
 observedGeneration: 1
 readyReplicas: 3
 replicas: 3
 updatedReplicas: 3

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

➜ server-side-apply git:(master) ✗ kubectl apply -f d.yaml --server-side --field-manager='test1'
error: Apply failed with 1 conflict: conflict with "kubectl-client-side-apply" using apps/v1: .spec.replicas
Please review the fields above--they currently have other managers. Here
are the ways you can resolve this warning:
* If you intend to manage all of these fields, please re-run the apply
 command with the `--force-conflicts` flag.
* If you do not intend to manage all of the fields, please edit your
 manifest to remove references to the fields that should keep their
 current managers.
* You may co-own fields by updating your manifest to match the existing
 value; in this case, you'll become the manager if the other manager(s)
 stop managing the field (remove it from their configuration).
See http://k8s.io/docs/reference/using-api/api-concepts/#conflicts

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

#include <stdio.h>
#include <stdlib.h>

/*声明一个链表节点*/
typedef struct node
{
 int number;//数据域，存储编号数值
 struct node *next;//指针域，指向下一个节点
}Node;

/*创建链表节点的函数*/
Node* CreatNode(int x)
{
 Node *p;
 p = (Node*)malloc(sizeof(Node));
 p->number = x;//将链表节点的数据域赋值为编号
 p->next = NULL;
 return p;
}

/*创建环形链表，存放整数1到n*/
Node* CreatJoseph(int n)
{
 Node *head,*p,*q;
 int i;
 for(i = 1; i <= n; i++)
 {
 p = CreatNode(i);//创建链表节点，并完成赋值
 if(i == 1)//如果是头结点
 head = p;
 else//不是头结点，则指向下一个节点
 q->next = p;
 q = p;
 }
 q->next = head;//末尾节点指向头结点，构成循环链表
 return head;
}

/*模拟运行约瑟夫环，每数到一个数，将它从环形链表中删除，并打印出来*/
void RunJoseph(int n,int m)
{
 Node *p,*q;
 p = CreatJoseph(n);//创建循环链表形式的约瑟夫环
 int i;
 while(p->next != p)//循环条件，当前链表数目大于1
 {
 for(i = 1; i < m-1; i++)//开始计数
 {
 p = p->next;
 }
 //第m个人出圈
 q = p->next;
 p->next = q->next;
 p = p->next;
 printf("%d--",q->number);//输出出圈的序号
 free(q);
 }
 printf("n最后剩下的数为：%dn",p->number);
}

int main()
{
 int n,m;
 scanf("%d %d",&n,&m);
 RunJoseph(n,m);
 return 0;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78

package main

import "fmt"

// LRU缓存淘汰策略的demo

// 这是一个单向链表的节点
type Node struct {
 Next *Node
 Value interface{}
}


// 缓存模型
type Memory struct {
 Head *Node // 头节点
 Max int32 // 链表的最大长度
}

// 向内存中插入变量的指针，若链表为空，则插入头节点
func (m *Memory) Insert(newNode interface{}) {
 if m.Head == nil {
 m.Head = &Node {
 Next: nil,
 Value: newNode,
 }
 return
 }

 var pre *Node // 前节点的指针
 current := m.Head // 当前节点位置
 var i int32 = 1 // 计数，第一个节点

 n := &Node {
 Next: m.Head,
 Value: newNode,
 }

 for {
 // 若该记录在内存中存在，则将其在链表相应位置删除，并插入链表的头部，若已在头部，则不变
 if current.Value == newNode {
 if pre != nil {
 pre.Next = current.Next
 m.Head = n
 }
 break
 }

 // 若当前节点是尾节点，则将变量指针插入链表头部，若长度超出了链表长度，则将链表最后一个节点删除
 if current.Next == nil {
 if i >= m.Max {
 pre.Next = nil
 m.Head = n
 } else {
 m.Head = n
 }
 break
 }

 pre = current
 current = current.Next
 i++
 }
}

func main() {
 m := &Memory{
 Max: 10,
 }
 for i := 0; i <= 11; i ++ {
 v := i
 m.Insert(&v)
 fmt.Printf("==========\n")
 fmt.Printf("head is %+v\n", m.Head)
 fmt.Printf("head value is %v\n", *m.Head.Value.(*int))
 fmt.Printf("==========\n")
 }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

import "unused"

// This declaration marks the import as used by referencing an
// item from the package.
var _ = unused.Item // TODO: Delete before committing!

func main() {
 debugData := debug.Profile()
 _ = debugData // Used only during debugging.
 ....
}