kubernetes-ops

Kubernetes 运维

在 Kubernetes 集群上部署和管理容器化应用。

适用场景

在以下情况下使用此技能：

• 将应用部署到 Kubernetes
• 管理 Pod、Deployment 和 Service
• 配置资源限制和扩缩容
• 排查 Kubernetes 工作负载问题
• 配置网络和 Ingress

前置条件

• 已安装并配置 kubectl
• 可以访问 Kubernetes 集群
• 了解容器基础知识

核心资源

Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  labels:
    app: myapp
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
      - name: myapp
        image: myapp:1.0.0
        ports:
        - containerPort: 8080
        resources:
          requests:
            memory: "128Mi"
            cpu: "100m"
          limits:
            memory: "256Mi"
            cpu: "500m"
        livenessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /ready
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 5
        env:
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: myapp-secrets
              key: database-url

Service

apiVersion: v1
kind: Service
metadata:
  name: myapp
spec:
  selector:
    app: myapp
  ports:
  - port: 80
    targetPort: 8080
  type: ClusterIP
---
# LoadBalancer for external access
apiVersion: v1
kind: Service
metadata:
  name: myapp-external
spec:
  selector:
    app: myapp
  ports:
  - port: 80
    targetPort: 8080
  type: LoadBalancer

Ingress

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myapp
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - myapp.example.com
    secretName: myapp-tls
  rules:
  - host: myapp.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: myapp
            port:
              number: 80

配置管理

ConfigMap

apiVersion: v1
kind: ConfigMap
metadata:
  name: myapp-config
data:
  config.yaml: |
    server:
      port: 8080
    logging:
      level: info
  APP_ENV: production

# Using ConfigMap
containers:
- name: myapp
  envFrom:
  - configMapRef:
      name: myapp-config
  volumeMounts:
  - name: config
    mountPath: /etc/config
volumes:
- name: config
  configMap:
    name: myapp-config

Secret

apiVersion: v1
kind: Secret
metadata:
  name: myapp-secrets
type: Opaque
stringData:
  database-url: postgres://user:pass@host:5432/db
  api-key: secret-key-value

# Create secret from command line
kubectl create secret generic myapp-secrets \
  --from-literal=database-url='postgres://...' \
  --from-file=tls.crt=cert.pem

kubectl 命令

资源管理

# Apply configuration
kubectl apply -f deployment.yaml

# Get resources
kubectl get pods
kubectl get deployments
kubectl get services
kubectl get all -n myapp

# Describe resource
kubectl describe pod myapp-xxx

# Delete resource
kubectl delete -f deployment.yaml
kubectl delete pod myapp-xxx

# Edit resource
kubectl edit deployment myapp

调试

# View logs
kubectl logs myapp-xxx
kubectl logs -f myapp-xxx --tail=100
kubectl logs myapp-xxx -c sidecar  # specific container

# Execute command
kubectl exec -it myapp-xxx -- /bin/sh

# Port forward
kubectl port-forward svc/myapp 8080:80
kubectl port-forward pod/myapp-xxx 8080:8080

# View events
kubectl get events --sort-by='.lastTimestamp'

# Debug pod
kubectl debug myapp-xxx -it --image=busybox

扩缩容

# Manual scaling
kubectl scale deployment myapp --replicas=5

# Autoscaling
kubectl autoscale deployment myapp \
  --min=2 --max=10 \
  --cpu-percent=80

水平 Pod 自动扩缩器

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: myapp
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: myapp
  minReplicas: 2
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 80
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80

持久化存储

PersistentVolumeClaim

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: myapp-data
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: standard
  resources:
    requests:
      storage: 10Gi
---
# Using PVC
containers:
- name: myapp
  volumeMounts:
  - name: data
    mountPath: /data
volumes:
- name: data
  persistentVolumeClaim:
    claimName: myapp-data

StatefulSet

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: postgres
spec:
  serviceName: postgres
  replicas: 3
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      containers:
      - name: postgres
        image: postgres:15
        ports:
        - containerPort: 5432
        volumeMounts:
        - name: data
          mountPath: /var/lib/postgresql/data
  volumeClaimTemplates:
  - metadata:
      name: data
    spec:
      accessModes: ["ReadWriteOnce"]
      resources:
        requests:
          storage: 10Gi

Job 和 CronJob

Job

apiVersion: batch/v1
kind: Job
metadata:
  name: migration
spec:
  template:
    spec:
      containers:
      - name: migrate
        image: myapp:1.0.0
        command: ["./migrate.sh"]
      restartPolicy: Never
  backoffLimit: 3

CronJob

apiVersion: batch/v1
kind: CronJob
metadata:
  name: backup
spec:
  schedule: "0 2 * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: backup
            image: backup-tool:latest
            command: ["./backup.sh"]
          restartPolicy: OnFailure

网络策略

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: myapp-network-policy
spec:
  podSelector:
    matchLabels:
      app: myapp
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: database
    ports:
    - protocol: TCP
      port: 5432

资源配额

apiVersion: v1
kind: ResourceQuota
metadata:
  name: myapp-quota
  namespace: myapp
spec:
  hard:
    requests.cpu: "10"
    requests.memory: 20Gi
    limits.cpu: "20"
    limits.memory: 40Gi
    pods: "20"

滚动更新

spec:
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0

# Update image
kubectl set image deployment/myapp myapp=myapp:2.0.0

# Check rollout status
kubectl rollout status deployment/myapp

# View history
kubectl rollout history deployment/myapp

# Rollback
kubectl rollout undo deployment/myapp
kubectl rollout undo deployment/myapp --to-revision=2

常见问题

问题：Pod 卡在 Pending 状态

问题：Pod 无法启动
解决方案：检查资源是否充足、节点选择器和 PVC 绑定情况

kubectl describe pod myapp-xxx
kubectl get events

问题：CrashLoopBackOff

问题：容器不断重启
解决方案：检查日志、确认入口点并检查探针

kubectl logs myapp-xxx --previous
kubectl describe pod myapp-xxx

问题：Service 无法访问

问题：无法连接到 Service
解决方案：检查选择器标签，并确认端点存在

kubectl get endpoints myapp
kubectl describe svc myapp

问题：镜像拉取错误

问题：ImagePullBackOff
解决方案：检查镜像名称，并确认注册表凭据

kubectl create secret docker-registry regcred \
  --docker-server=registry.example.com \
  --docker-username=user \
  --docker-password=pass

最佳实践

• 始终设置资源请求和限制
• 配置存活探针和就绪探针
• 使用命名空间实现隔离
• 应用网络策略以增强安全性
• 使用 ConfigMap 和 Secret 管理配置
• 配置 Pod 中断预算以确保可用性
• 统一使用标签进行组织
• 启用 RBAC 进行访问控制

相关技能

• helm-charts - 包管理
• argocd-gitops - GitOps 部署
• kubernetes-hardening - 安全