1. Kubernetes 技术全景与核心架构解析
Kubernetes(简称K8s)作为容器编排领域的事实标准,其技术栈构成了一套完整的分布式系统管理体系。从架构层面来看,K8s采用经典的Master-Worker节点设计,其中控制平面(Control Plane)包含以下核心组件:
- API Server:集群的唯一切入点,处理所有REST操作
- etcd:分布式键值存储,保存整个集群的状态
- Controller Manager:运行各种控制器(如Deployment、ReplicaSet控制器)
- Scheduler:负责将Pod调度到合适的Node
工作节点(Worker Node)则包含:
- kubelet:与API Server通信的节点代理
- kube-proxy:维护节点网络规则
- 容器运行时:如Docker、containerd等
提示:生产环境中建议将etcd部署为独立集群,采用SSD存储并配置定期备份策略,这是许多初学者容易忽视的关键点。
1.1 核心抽象对象模型
Kubernetes通过若干核心抽象来实现其编排能力:
- Pod:最小部署单元,包含一个或多个紧密关联的容器
- Deployment:声明式更新Pod和ReplicaSet
- Service:定义一组Pod的访问策略
- ConfigMap/Secret:配置与敏感数据管理
- Volume:数据持久化方案
- Namespace:虚拟集群隔离机制
这些抽象对象通过YAML文件定义后提交给API Server,由各控制器驱动集群达到期望状态。例如,当创建一个Deployment时:
- Deployment控制器创建ReplicaSet
- ReplicaSet控制器创建指定数量的Pod
- Scheduler为这些Pod分配节点
- 各节点上的kubelet通过容器运行时启动容器
需要模型API调用? 免费领10W Token,多模型网关一键接入 Claude、DeepSeek 等主流模型。
2. YAML 文件深度解析与编写实践
2.1 YAML 基础语法规范
Kubernetes的资源配置文件采用YAML格式,其核心语法包括:
yaml复制apiVersion: apps/v1 # API组及版本
kind: Deployment # 资源类型
metadata: # 元数据
name: nginx-deployment
labels:
app: nginx
spec: # 规格定义
replicas: 3
selector:
matchLabels:
app: nginx
template: # Pod模板
metadata:
labels:
app: nginx
spec:
containers:
- name: nginx
image: nginx:1.14.2
ports:
- containerPort: 80
关键注意事项:
- 缩进必须使用空格(通常2个空格)
- 键值对用冒号分隔,值后的空格不能省略
- 列表项用短横线加空格表示(
- item) - 多行文本可用
|(保留换行)或>(折叠换行)
2.2 高级YAML技巧
- 锚点与引用:避免重复配置
yaml复制defaults: &defaults
image: nginx:latest
resources:
limits:
cpu: "1"
memory: 512Mi
deployment:
<<: *defaults
replicas: 3
- 多文档分隔:单个文件定义多个资源
yaml复制---
apiVersion: v1
kind: ConfigMap
metadata:
name: app-config
data:
key: value
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: app-deployment
- 环境变量注入:
yaml复制env:
- name: LOG_LEVEL
valueFrom:
configMapKeyRef:
name: app-config
key: log.level
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
name: db-secret
key: password
3. 核心操作流程全解
3.1 集群部署实践
以kubeadm部署生产级集群为例:
- 前置准备:
bash复制# 所有节点关闭swap
sudo swapoff -a
sudo sed -i '/ swap / s/^/#/' /etc/fstab
# 设置内核参数
cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF
sudo sysctl --system
- 安装容器运行时(containerd):
bash复制# 安装依赖
sudo apt-get update && sudo apt-get install -y containerd
# 生成默认配置
sudo mkdir -p /etc/containerd
containerd config default | sudo tee /etc/containerd/config.toml
# 修改cgroup驱动为systemd
sudo sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
# 重启服务
sudo systemctl restart containerd
- 初始化控制平面:
bash复制sudo kubeadm init \
--pod-network-cidr=10.244.0.0/16 \
--upload-certs \
--control-plane-endpoint=CLUSTER_DNS:6443
- 安装网络插件(Calico):
bash复制kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml
3.2 日常运维操作
- 故障排查三板斧:
bash复制# 查看Pod详情(重点看Events部分)
kubectl describe pod <pod-name>
# 查看容器日志
kubectl logs <pod-name> [-c <container-name>]
# 进入容器调试
kubectl exec -it <pod-name> -- /bin/sh
- 资源伸缩与滚动更新:
bash复制# 扩展Deployment副本数
kubectl scale deployment/nginx-deployment --replicas=5
# 触发滚动更新(修改镜像版本)
kubectl set image deployment/nginx-deployment nginx=nginx:1.19.0
# 查看滚动更新状态
kubectl rollout status deployment/nginx-deployment
# 回滚到上一版本
kubectl rollout undo deployment/nginx-deployment
- 配置管理实践:
bash复制# 从文件创建ConfigMap
kubectl create configmap game-config --from-file=./config.properties
# 查看配置
kubectl get configmap game-config -o yaml
# 更新配置(触发关联Pod重启)
kubectl apply -f updated-config.yaml
4. 生产环境最佳实践
4.1 高可用部署方案
- 控制平面高可用:
- 部署3个或5个Master节点
- 使用外部etcd集群(至少3节点)
- 配置负载均衡器指向多个API Server
- 工作节点优化:
yaml复制# Pod资源请求与限制示例
resources:
requests:
cpu: "500m"
memory: "512Mi"
limits:
cpu: "1"
memory: "1Gi"
- Pod调度策略:
yaml复制affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/arch
operator: In
values:
- amd64
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 100
podAffinityTerm:
labelSelector:
matchExpressions:
- key: app
operator: In
values:
- nginx
topologyKey: kubernetes.io/hostname
4.2 常见问题诊断手册
| 问题现象 | 排查步骤 | 解决方案 |
|---|---|---|
| Pod处于Pending状态 | 1. kubectl describe pod查看事件2. kubectl get nodes检查节点状态 |
1. 检查资源配额 2. 检查节点污点设置 |
| Pod不断重启 | 1. kubectl logs查看容器日志2. kubectl exec进入容器检查 |
1. 修复应用崩溃问题 2. 调整存活探针配置 |
| Service无法访问 | 1. 检查Endpoints(kubectl get endpoints)2. 检查kube-proxy日志 |
1. 确认Pod标签与Selector匹配 2. 检查网络插件状态 |
| 节点NotReady | 1. 检查kubelet服务状态 2. 查看节点系统负载 |
1. 重启kubelet服务 2. 排查节点资源不足问题 |
4.3 监控与日志方案
- 监控体系搭建:
bash复制# 部署Prometheus Operator
kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/kube-prometheus/main/manifests/setup.yaml
kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/kube-prometheus/main/manifests/
# 部署kube-state-metrics
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm install kube-state-metrics prometheus-community/kube-state-metrics
- 日志收集方案:
yaml复制# Fluentd DaemonSet配置示例
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: fluentd
spec:
template:
spec:
containers:
- name: fluentd
image: fluent/fluentd-kubernetes-daemonset:v1.16-debian-elasticsearch7-1
env:
- name: FLUENT_ELASTICSEARCH_HOST
value: "elasticsearch-logging"
- name: FLUENT_ELASTICSEARCH_PORT
value: "9200"
volumeMounts:
- name: varlog
mountPath: /var/log
- name: dockercontainers
mountPath: /var/lib/docker/containers
volumes:
- name: varlog
hostPath:
path: /var/log
- name: dockercontainers
hostPath:
path: /var/lib/docker/containers
5. 进阶技巧与生态集成
5.1 CI/CD流水线集成
- GitOps工作流:
bash复制# 安装Argo CD
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
# 配置应用同步
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: guestbook
spec:
destination:
server: https://kubernetes.default.svc
namespace: default
source:
repoURL: https://github.com/argoproj/argocd-example-apps.git
path: guestbook
targetRevision: HEAD
syncPolicy:
automated: {}
- Tekton Pipeline示例:
yaml复制apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
name: build-push
spec:
steps:
- name: build
image: gcr.io/kaniko-project/executor:v1.6.0
args:
- --dockerfile=Dockerfile
- --context=./src
- --destination=gcr.io/my-project/my-image:latest
5.2 服务网格集成
- Istio基础安装:
bash复制istioctl install --set profile=demo -y
kubectl label namespace default istio-injection=enabled
- 流量管理示例:
yaml复制apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: reviews
spec:
hosts:
- reviews
http:
- route:
- destination:
host: reviews
subset: v1
weight: 90
- destination:
host: reviews
subset: v2
weight: 10
5.3 自定义资源开发
- Operator SDK开发流程:
bash复制# 初始化Operator项目
operator-sdk init --domain example.com --repo github.com/example/memcached-operator
# 创建API和控制器
operator-sdk create api --group cache --version v1alpha1 --kind Memcached --resource --controller
# 构建并推送镜像
make docker-build docker-push IMG=quay.io/example/memcached-operator:v0.0.1
# 部署Operator
make deploy IMG=quay.io/example/memcached-operator:v0.0.1
- 自定义资源定义示例:
yaml复制apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
name: memcacheds.cache.example.com
spec:
group: cache.example.com
versions:
- name: v1alpha1
served: true
storage: true
schema:
openAPIV3Schema:
type: object
properties:
spec:
type: object
properties:
size:
type: integer
minimum: 1
maximum: 5
scope: Namespaced
names:
plural: memcacheds
singular: memcached
kind: Memcached
shortNames:
- mc
在实际生产环境中,我们发现合理设置Pod的terminationGracePeriodSeconds(默认30秒)能有效避免强制终止导致的请求中断。对于有状态服务,建议配置preStop钩子实现优雅终止:
yaml复制lifecycle:
preStop:
exec:
command:
- /bin/sh
- -c
- "sleep 10 && nginx -s quit"
