Kubernetes (K8s) 完整指南

1
2
3
4
5
6
7

# 安装后启动
minikube start --driver=docker
# 启用插件
minikube addons enable dashboard
minikube addons enable ingress
# 访问 Dashboard
minikube dashboard

1
2
3
4
5
6
7

kube-apiserver
kube-controller-manager
kube-scheduler
kubelet
kube-proxy
etcd
containerd/docker

1
2
3
4

/registry/pods/default/nginx-pod
/registry/services/default/nginx-service
/registry/deployments/default/nginx-deployment
/registry/secrets/default/db-password

1
2
3
4
5
6

#!/bin/bash
ETCDCTL_API=3 etcdctl snapshot save /backup/etcd-snapshot-$(date +%Y%m%d).db \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

apiVersion: v1
kind: Pod
metadata:
  name: nginx-pod
  labels:
    app: nginx
spec:
  containers:
  - name: nginx
    image: nginx:1.25
    ports:
    - containerPort: 80
    env:
    - name: NGINX_PORT
      value: "80"
    resources:
      requests:
        memory: "64Mi"
        cpu: "250m"
      limits:
        memory: "128Mi"
        cpu: "500m"
    livenessProbe:
      httpGet:
        path: /
        port: 80
      initialDelaySeconds: 15
      periodSeconds: 10

1
2

spec:
  clusterIP: None

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

apiVersion: v1
kind: Service
metadata:
  name: nginx-service
spec:
  type: LoadBalancer
  ports:
  - port: 80
    targetPort: 8080
    protocol: TCP
  selector:
    app: nginx

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.25
        ports:
        - containerPort: 80
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 1

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mysql
spec:
  serviceName: mysql-headless
  replicas: 3
  selector:
    matchLabels:
      app: mysql
  template:
    metadata:
      labels:
        app: mysql
    spec:
      containers:
      - name: mysql
        image: mysql:8.0
        env:
        - name: MYSQL_ROOT_PASSWORD
          valueFrom:
            secretKeyRef:
              name: mysql-secret
              key: password
        volumeMounts:
        - name: mysql-data
          mountPath: /var/lib/mysql
  volumeClaimTemplates:
  - metadata:
      name: mysql-data
    spec:
      accessModes: ["ReadWriteOnce"]
      storageClassName: fast-ssd
      resources:
        requests:
          storage: 50Gi

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluentd
spec:
  selector:
    matchLabels:
      name: fluentd
  template:
    metadata:
      labels:
        name: fluentd
    spec:
      containers:
      - name: fluentd-elasticsearch
        image: fluent/fluentd-kubernetes-daemonset:v1-debian-elasticsearch
        env:
        - name: FLUENT_ELASTICSEARCH_HOST
          value: "elasticsearch.logging.svc.cluster.local"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

apiVersion: batch/v1
kind: Job
metadata:
  name: pi-calculation
spec:
  template:
    spec:
      containers:
      - name: pi
        image: perl:5.34
        command: ["perl", "-Mbignum=bpi", "-wle", "print bpi(2000)"]
      restartPolicy: Never
  backoffLimit: 4

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

apiVersion: batch/v1
kind: CronJob
metadata:
  name: backup-cron
spec:
  schedule: "0 3 * * *"  # 每天凌晨3点执行
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: backup
            image: mysql:8.0
            command:
            - /bin/sh
            - -c
            - mysqldump -h mysql.default.svc.cluster.local -u root -p$MYSQL_ROOT_PASSWORD mydb > /backup/mydb-$(date +%Y%m%d).sql
            env:
            - name: MYSQL_ROOT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: mysql-secret
                  key: password
          restartPolicy: OnFailure

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  database_url: "mysql:3306"
  redis_url: "redis:6379"
  config.yaml: |
    server:
      port: 8080
      timeout: 30s

1
2
3
4
5
6
7
8

apiVersion: v1
kind: Secret
metadata:
  name: db-secret
type: Opaque
data:
  username: YWRtaW4=  # base64 编码
  password: MWYyZDFlMmU2N2Rm  # base64 编码

1
2
3
4
5
6

env:
- name: DB_PASSWORD
  valueFrom:
    secretKeyRef:
      name: db-secret
      key: password

1
2
3
4
5
6
7
8

volumeMounts:
- name: secret-volume
  mountPath: "/etc/secret"
  readOnly: true
volumes:
- name: secret-volume
  secret:
    secretName: db-secret

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# 下载配置
wget https://docs.projectcalico.org/manifests/calico.yaml

# 修改配置（如需要）
# 编辑 calico.yaml，设置 CALICO_IPV4POOL_CIDR 与集群 pod-network-cidr 一致

# 部署
kubectl apply -f calico.yaml

# 验证
kubectl get pods -n kube-system -l k8s-app=calico-node

1
2
3
4
5

# 部署
kubectl apply -f https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml

# 配置后重启节点
systemctl restart kubelet

1
2
3
4
5

# 在 kube-proxy ConfigMap 中修改
kubectl edit configmap kube-proxy -n kube-system
# 设置 mode: "ipvs"
# 重启 kube-proxy
kubectl rollout restart daemonset kube-proxy -n kube-system

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-app-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80
      - path: /web
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80
  tls:
  - hosts:
    - app.example.com
    secretName: tls-secret

1

StorageClass → PersistentVolume → PersistentVolumeClaim → Pod

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv001
spec:
  capacity:
    storage: 10Gi
  accessModes:
  - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: fast-ssd
  hostPath:
    path: /data/pv001

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mysql-data
spec:
  accessModes:
  - ReadWriteOnce
  storageClassName: fast-ssd
  resources:
    requests:
      storage: 50Gi

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

spec:
  containers:
  - name: mysql
    volumeMounts:
    - name: data
      mountPath: /var/lib/mysql
  volumes:
  - name: data
    persistentVolumeClaim:
      claimName: mysql-data

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

# 部署 NFS-Subdir-External-Provisioner
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: nfs-storage
provisioner: k8s-sigs.io/nfs-subdir-external-provisioner
parameters:
  server: nfs-server.example.com
  path: /exports
  archiveOnDelete: "true"
reclaimPolicy: Retain
allowVolumeExpansion: true
mountOptions:
- hard
- nfsvers=4.1

1
2
3
4
5
6
7
8
9

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

1
2
3
4
5
6
7
8

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: node-admin
rules:
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["get", "list", "update", "patch"]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: default
subjects:
- kind: User
  name: jane
  apiGroup: rbac.authorization.k8s.io
- kind: ServiceAccount
  name: default
  namespace: kube-system
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: default
spec:
  policyTypes:
  - Ingress
  - Egress
  podSelector: {}  # 选择所有 Pod

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
  namespace: default
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080

1
2
3

# 为命名空间设置安全等级
kubectl label namespace default pod-security.kubernetes.io/enforce=baseline
kubectl label namespace default pod-security.kubernetes.io/warn=restricted

1
2

# 在 kube-apiserver 配置中启用
--encryption-provider-config=/etc/kubernetes/encryption-config.yaml

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

spec:
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: kubernetes.io/e2e-az-name
            operator: In
            values:
            - az1
            - az2
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 1
        preference:
          matchExpressions:
          - key: another-node-label-key
            operator: In
            values:
            - another-node-label-value

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

spec:
  affinity:
    podAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
      - labelSelector:
          matchExpressions:
          - key: security
            operator: In
            values:
            - S1
        topologyKey: topology.kubernetes.io/zone
    podAntiAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchExpressions:
            - key: app
              operator: In
              values:
              - nginx
          topologyKey: kubernetes.io/hostname

1
2

kubectl taint nodes node1 key1=value1:NoSchedule
kubectl taint nodes node1 gpu=true:NoSchedule

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

spec:
  tolerations:
  - key: "gpu"
    operator: "Equal"
    value: "true"
    effect: "NoSchedule"
  - key: "node.kubernetes.io/unreachable"
    operator: "Exists"
    effect: "NoExecute"
    tolerationSeconds: 6000

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

spec:
  containers:
  - name: nginx
    resources:
      requests:
        memory: "256Mi"
        cpu: "500m"
      limits:
        memory: "512Mi"
        cpu: "1000m"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

apiVersion: v1
kind: LimitRange
metadata:
  name: mem-limit-range
spec:
  limits:
  - default:
      memory: 512Mi
      cpu: 500m
    defaultRequest:
      memory: 256Mi
      cpu: 200m
    type: Container

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# Master 节点
hostnamectl set-hostname k8s-master
bash

# Node1 节点
hostnamectl set-hostname k8s-node1
bash

# Node2 节点
hostnamectl set-hostname k8s-node2
bash

1
2
3
4
5

cat >> /etc/hosts <<EOF
192.168.200.101 k8s-master
192.168.200.102 k8s-node1
192.168.200.103 k8s-node2
EOF

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# 生成密钥
ssh-keygen -t rsa -b 4096 -C "k8s-admin@cluster.local"

# 分发公钥
ssh-copy-id root@k8s-node1
ssh-copy-id root@k8s-node2

# 验证
ssh k8s-node1 "uptime"
ssh k8s-node2 "uptime"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

# 1. 关闭 SELinux
setenforce 0
sed -i 's/^SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config

# 2. 关闭防火墙
systemctl stop firewalld
systemctl disable firewalld

# 3. 禁用 Swap
swapoff -a
sed -i '/swap/s/^/#/' /etc/fstab

# 4. 配置内核参数
cat <<EOF > /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
EOF
sysctl --system

# 5. 时间同步
timedatectl set-timezone Asia/Shanghai
systemctl enable chronyd
systemctl start chronyd
chronyc sources

# 6. 加载内核模块
cat <<EOF > /etc/modules-load.d/k8s.conf
overlay
br_netfilter
EOF
modprobe overlay
modprobe br_netfilter

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

# 所有节点执行
yum install -y yum-utils device-mapper-persistent-data lvm2
yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
yum install -y containerd.io

# 配置 containerd
mkdir -p /etc/containerd
containerd config default | tee /etc/containerd/config.toml

# 修改配置，启用 systemd cgroup
sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml

# 启动服务
systemctl enable containerd
systemctl start containerd
systemctl status containerd

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

yum install -y docker-ce docker-ce-cli containerd.io
systemctl enable docker
systemctl start docker

# 配置 cgroupdriver
cat <<EOF > /etc/docker/daemon.json
{
  "exec-opts": ["native.cgroupdriver=systemd"],
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "100m"
  },
  "storage-driver": "overlay2"
}
EOF
systemctl restart docker

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

cat <<EOF | tee /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=1
gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
exclude=kubelet kubeadm kubectl
EOF

# 国内可使用阿里云镜像
cat <<EOF | tee /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
exclude=kubelet kubeadm kubectl
EOF

1
2
3
4
5
6
7

yum install -y kubelet-1.28.0 kubeadm-1.28.0 kubectl-1.28.0 --disableexcludes=kubernetes

# 配置 kubelet cgroupdriver
sed -i 's/cgroupDriver: systemd/cgroupDriver: systemd/' /var/lib/kubelet/config.yaml

# 启动 kubelet
systemctl enable --now kubelet

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

# 在 Master 节点执行
kubeadm init \
  --apiserver-advertise-address=192.168.200.101 \
  --pod-network-cidr=10.244.0.0/16 \
  --service-cidr=10.96.0.0/12 \
  --image-repository=registry.aliyuncs.com/google_containers \
  --kubernetes-version=v1.28.0

# 配置 kubectl
mkdir -p $HOME/.kube
cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
chown $(id -u):$(id -g) $HOME/.kube/config

# 查看初始化结果
kubectl get nodes
kubectl get pods -n kube-system

1
2
3
4
5

# 在 Master 节点获取 node 加入命令
kubeadm token create --print-join-command
# 输出示例：
# kubeadm join 192.168.200.101:6443 --token abcdef.0123456789abcdef \
#   --discovery-token-ca-cert-hash sha256:xxx

1
2
3
4
5
6
7
8

# Calico
kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml

# 或 Flannel
kubectl apply -f https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml

# 验证部署
kubectl get pods -n kube-system -w

1
2
3
4
5
6
7

# 在每个 Node 节点执行
kubeadm join 192.168.200.101:6443 --token abcdef.0123456789abcdef \
  --discovery-token-ca-cert-hash sha256:xxx

# 在 Master 节点验证
kubectl get nodes
# 状态应为 Ready

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

# 查看节点状态
kubectl get nodes -o wide

# 查看核心组件
kubectl get pods -n kube-system

# 查看集群信息
kubectl cluster-info

# 测试 DNS
kubectl run dns-test --rm -it --image=busybox:1.28 -- nslookup kubernetes.default

# 测试部署
kubectl create deployment nginx --image=nginx:1.25
kubectl expose deployment/nginx --port=80 --type=NodePort
kubectl get svc nginx
# 访问测试
curl http://<NodeIP>:<NodePort>

1
2
3
4
5
6
7
8

# 第一个 Master 初始化
kubeadm init --control-plane-endpoint "k8s-lb.example.com:6443" \
  --upload-certs --pod-network-cidr=10.244.0.0/16

# 其他 Master 加入
kubeadm join k8s-lb.example.com:6443 --token <token> \
  --discovery-token-ca-cert-hash sha256:<hash> \
  --control-plane --certificate-key <certificate-key>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

# 集群基本信息
kubectl cluster-info

# 节点列表
kubectl get nodes
kubectl get nodes -o wide

# 组件状态
kubectl get componentstatuses
kubectl get cs

# API 资源类型
kubectl api-resources

# 集群版本
kubectl version --short

# 查看事件（按时间排序）
kubectl get events --sort-by=.lastTimestamp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

# Pod 操作
kubectl get pods
kubectl get pods -A
kubectl get pods -n kube-system
kubectl get pods -l app=nginx
kubectl get pods --show-labels
kubectl get pods --sort-by=.status.startTime

# 查看详情
kubectl describe pod <pod-name>
kubectl get pod <pod-name> -o yaml
kubectl get pod <pod-name> -o json

# 实时监控
kubectl get pods -w
kubectl top pods
kubectl top pods --containers

# 多资源查看
kubectl get pods,svc,deploy
kubectl get all

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

# 创建资源
kubectl apply -f deployment.yaml  # 推荐，幂等
kubectl create -f service.yaml    # 仅创建

# 删除资源
kubectl delete -f deployment.yaml
kubectl delete pod <pod-name>
kubectl delete pods -l app=nginx
kubectl delete pods --all

# 强制删除
kubectl delete pod <pod-name> --grace-period=0 --force

# 清空命名空间
kubectl delete all --all -n <namespace>
kubectl delete namespace <namespace-name>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

# 查看日志
kubectl logs <pod-name>
kubectl logs -f <pod-name>
kubectl logs --tail=20 <pod-name>
kubectl logs --since=1h <pod-name>
kubectl logs <pod-name> -c <container-name>

# 进入容器
kubectl exec -it <pod-name> -- /bin/bash
kubectl exec -it <pod-name> -c <container-name> -- sh

# 执行命令
kubectl exec <pod-name> -- ls /

# 文件复制
kubectl cp <pod-name>:/path/to/file /local/path
kubectl cp /local/file <pod-name>:/path/to/file

# 端口转发
kubectl port-forward <pod-name> 8080:80
kubectl port-forward svc/<service-name> 3000:80

# 临时调试 Pod
kubectl run debug-pod --rm -i --tty --image=busybox -- sh
kubectl run curl-test --rm -i --image=curlimages/curl -- curl http://nginx-service

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

# 查看 Deployment
kubectl get deployments
kubectl get deploy

# 滚动更新
kubectl set image deployment/nginx nginx=nginx:1.20
kubectl rollout status deployment/nginx

# 扩缩容
kubectl scale deployment/nginx --replicas=5

# 回滚
kubectl rollout undo deployment/nginx
kubectl rollout undo deployment/nginx --to-revision=2

# 查看历史
kubectl rollout history deployment/nginx
kubectl rollout history deployment/nginx --revision=3

# 暂停/恢复
kubectl rollout pause deployment/nginx
kubectl rollout resume deployment/nginx

# 编辑配置
kubectl edit deployment/nginx

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

# 查看 Service
kubectl get services
kubectl get svc

# 暴露 Deployment
kubectl expose deployment/nginx --type=NodePort --port=80
kubectl expose deployment/nginx --type=LoadBalancer --port=80 --target-port=8080

# 查看 Endpoint
kubectl get endpoints <service-name>

# 查看详情
kubectl describe svc <service-name>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

# 查看配置
kubectl config view
kubectl config view --raw

# 查看当前上下文
kubectl config current-context

# 列出所有上下文
kubectl config get-contexts

# 切换上下文
kubectl config use-context <context-name>

# 添加集群配置
kubectl config set-cluster <cluster-name> --server=https://192.168.200.101:6443

# 添加用户凭证
kubectl config set-credentials <user-name> --token=<token>
kubectl config set-credentials <user-name> --client-certificate=/path/to/cert --client-key=/path/to/key

# 设置上下文
kubectl config set-context <context-name> --cluster=<cluster-name> --user=<user-name> --namespace=default

# 删除上下文
kubectl config delete-context <context-name>

# 设置默认命名空间
kubectl config set-context --current --namespace=<namespace-name>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

# 权限检查
kubectl auth can-i create pods
kubectl auth can-i "*" "*" --all-namespaces
kubectl auth can-i list secrets --as=system:serviceaccount:default:test-sa

# 查看 API 请求日志
kubectl get pods -v=6  # 级别 0-9

# 启动临时调试容器
kubectl run debug-pod --rm -i --tty --image=nicolaka/netshoot -- sh

# 查看资源配额
kubectl get resourcequota -n <namespace>

# 查看网络策略
kubectl get networkpolicies

# 查看所有 API 资源
kubectl api-resources --verbs=list --namespaced -o name | xargs -n 1 kubectl get --show-kind --ignore-not-found -n <namespace>

1

KUBECONFIG=file1:file2:file3 kubectl config view --merge --flatten > ~/.kube/config

1
2
3
4
5
6
7
8

# 生成 Pod 模板（不创建）
kubectl run nginx --image=nginx --dry-run=client -o yaml > pod.yaml

# 生成 Deployment 模板
kubectl create deploy nginx --image=nginx --replicas=3 --dry-run=client -o yaml > deploy.yaml

# 生成 Service 模板
kubectl expose deploy/nginx --port=80 --dry-run=client -o yaml > service.yaml

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

# 添加标签
kubectl label pods <pod-name> env=prod
kubectl label nodes node1 disk=ssd gpu=true

# 删除标签
kubectl label pods <pod-name> env-

# 添加注解
kubectl annotate pods <pod-name> description="Production nginx pod" commit-hash="a1b2c3d"

# 查看标签和注解
kubectl get pods --show-labels
kubectl describe pod <pod-name>

1
2
3
4
5
6
7

# 提取特定字段
kubectl get pods <pod-name> -o jsonpath='{.status.podIP}'
kubectl get pods <pod-name> -o jsonpath='{.spec.containers[*].name}'
kubectl get pods <pod-name> -o jsonpath='{range .spec.containers[*]}{.name}{"\t"}{.image}{"\n"}{end}'

# 提取 Secret 并解码
kubectl get secret <secret-name> -o jsonpath="{.data.password}" | base64 -d

1
2
3
4
5
6
7
8

# 批量删除 Evicted Pod
kubectl get pods | grep Evicted | awk '{print $1}' | xargs kubectl delete pod

# 批量重启 Deployment
kubectl get deploy -n default -o name | xargs -I {} kubectl rollout restart {}

# 导出所有 ConfigMap
kubectl get configmap -n default -o yaml > configmaps.yaml

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml

# 或修改配置以允许不安全 TLS
kubectl apply -f - <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: metrics-server
  namespace: kube-system
spec:
  template:
    spec:
      containers:
      - name: metrics-server
        args:
        - --kubelet-insecure-tls
        - --kubelet-preferred-address-types=InternalIP
EOF

1
2
3

kubectl top nodes
kubectl top pods
kubectl top pods --containers

1
2
3
4
5

Prometheus ← ServiceMonitor ← Prometheus Operator
    ↓
Prometheus Adapter ← HPA
    ↓
Grafana (可视化)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

# 添加 Helm 仓库
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm repo update

# 安装 kube-prometheus-stack
helm install monitoring prometheus-community/kube-prometheus-stack \
  --namespace monitoring --create-namespace \
  --set grafana.adminPassword=admin123

# 查看访问地址
kubectl get svc -n monitoring

# 端口转发访问 Grafana
kubectl port-forward -n monitoring svc/monitoring-grafana 3000:80
# 访问 http://localhost:3000，用户名 admin，密码 admin123

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

# 添加 Helm 仓库
helm repo add elastic https://helm.elastic.co
helm repo update

# 安装 Elasticsearch
helm install elasticsearch elastic/elasticsearch \
  --namespace logging --create-namespace \
  --set replicas=3 \
  --set volumeClaimTemplate.storageClassName=fast-ssd

# 安装 Fluentd
helm install fluentd stable/fluentd \
  --namespace logging \
  --set elasticsearch.host=elasticsearch-master.logging.svc.cluster.local

# 安装 Kibana
helm install kibana elastic/kibana \
  --namespace logging \
  --set elasticsearchHosts=http://elasticsearch-master:9200

# 端口转发访问 Kibana
kubectl port-forward -n logging svc/kibana-kibana 5601:5601

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# 1. 查看 Pod 详情
kubectl describe pod <pod-name>

# 2. 常见原因
- 资源不足：检查节点资源 kubectl describe nodes
- 调度约束：检查 nodeSelector/affinity/tolerations
- 镜像拉取失败：检查镜像地址和 Secret
- PV 绑定失败：检查 StorageClass 和 PVC

# 3. 查看调度事件
kubectl get events --sort-by=.lastTimestamp | grep <pod-name>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

# 1. 查看日志
kubectl logs <pod-name> --previous  # 查看前一次日志

# 2. 进入容器调试
kubectl run debug --rm -it --image=busybox -- sh
# 在容器内测试网络、DNS、依赖服务

# 3. 检查健康检查配置
kubectl get pod <pod-name> -o yaml | grep -A 10 liveness

# 4. 常见问题
- 应用启动失败：检查镜像、配置、依赖
- 端口冲突：检查容器端口配置
- 权限不足：检查 SecurityContext 和 RBAC

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

# 1. 检查 Pod IP
kubectl get pod <pod-name> -o wide

# 2. 检查 Service Endpoint
kubectl get endpoints <service-name>

# 3. 在节点上测试
# 进入节点网络命名空间
docker run --rm -it --net=host nicolaka/netshoot -- ping <pod-ip>

# 4. 检查网络插件
kubectl get pods -n kube-system -l k8s-app=calico-node

# 5. 检查 NetworkPolicy
kubectl get networkpolicy -A

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

# 1. 查看节点详情
kubectl describe node <node-name>

# 2. 在节点上检查 kubelet 状态
systemctl status kubelet
journalctl -u kubelet -f

# 3. 检查容器运行时
crictl ps
crictl logs <container-id>

# 4. 常见原因
- kubelet 无法连接 API Server
- 容器运行时故障
- 磁盘空间不足（/var/lib/kubelet）
- 网络插件异常

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

# 1. 查看节点资源
kubectl describe node <node-name> | grep -A 5 Capacity

# 2. 查看被驱逐 Pod
kubectl get pods --all-namespaces | grep Evicted

# 3. 清理 Docker 镜像
docker image prune -a

# 4. 清理无用卷
docker volume prune

# 5. 调整磁盘预留
vim /var/lib/kubelet/config.yaml
evictionHard:
  imagefs.available: 15%
  memory.available: 100Mi
  nodefs.available: 10%
  nodefs.inodesFree: 5%

1
2
3
4
5
6
7
8
9

# 1. 查看调度器日志
kubectl logs -n kube-system kube-scheduler-<master-node>

# 2. 检查调度器扩展器
kubectl get configmap scheduler-config -n kube-system -o yaml

# 3. 模拟调度
kubectl create deployment test --image=nginx --dry-run=client -o yaml | kubectl apply -f-
kubectl describe pod <test-pod>

1
2
3
4
5
6
7
8

# 1. 检查 Pod 亲和性配置
kubectl get pod <pod-name> -o yaml | grep -A 20 affinity

# 2. 检查节点标签
kubectl get nodes --show-labels

# 3. 验证调度器配置
kubectl get configmap scheduler-config -n kube-system -o yaml

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

# 检查 ETCD 集群健康
ETCDCTL_API=3 etcdctl endpoint health \
  --endpoints=https://127.0.0.1:2379,https://127.0.0.2:2379,https://127.0.0.3:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt \
  --key=/etc/kubernetes/pki/etcd/healthcheck-client.key

# 检查 Leader
ETCDCTL_API=3 etcdctl endpoint status \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt \
  --key=/etc/kubernetes/pki/etcd/healthcheck-client.key \
  --write-out=table

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# 1. 检查 ETCD 存储
ETCDCTL_API=3 etcdctl --write-out=table endpoint status

# 2. 清理缓存
ETCDCTL_API=3 etcdctl compact <revision>
ETCDCTL_API=3 etcdctl defrag

# 3. 调整 ETCD 配额
# 编辑 /etc/kubernetes/manifests/etcd.yaml
# 添加 --quota-backend-bytes=8589934592 (8GB)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# 1. 检查 API Server 请求量
kubectl top pods -n kube-system -l component=kube-apiserver

# 2. 查看审计日志
# 启用审计日志
# /etc/kubernetes/manifests/kube-apiserver.yaml
--audit-policy-file=/etc/kubernetes/audit-policy.yaml
--audit-log-path=/var/log/kubernetes/audit.log

# 3. 检查 etcd 延迟
ETCDCTL_API=3 etcdctl check perf

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# 1. 测试 Pod 间网络
kubectl run netshoot --rm -it --image=nicolaka/netshoot -- sh
# 在容器中
iperf3 -c <target-pod-ip>

# 2. 检查 CNI 插件日志
kubectl logs -n kube-system -l k8s-app=calico-node

# 3. 检查节点网络
ethtool -S eth0 | grep drop
netstat -i

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

# /etc/kubernetes/manifests/kube-apiserver.yaml
spec:
  containers:
  - name: kube-apiserver
    command:
    - kube-apiserver
    - --max-requests-inflight=400  # 限制并发请求数
    - --max-mutating-requests-inflight=200
    - --enable-aggregator-routing=true
    - --audit-log-maxsize=100
    - --audit-log-maxbackup=10
    - --audit-log-maxage=30
    resources:
      requests:
        cpu: 250m
        memory: 256Mi
      limits:
        cpu: 2000m
        memory: 2Gi

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

# 自定义调度配置
apiVersion: kubescheduler.config.k8s.io/v1
kind: KubeSchedulerConfiguration
profiles:
- schedulerName: default-scheduler
  plugins:
    score:
      disabled:
      - name: ImageLocality
      enabled:
      - name: MyCustomPlugin
        weight: 10

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

# ETCD 配置优化
spec:
  containers:
  - name: etcd
    command:
    - etcd
    - --quota-backend-bytes=8589934592  # 8GB
    - --auto-compaction-mode=periodic
    - --auto-compaction-retention=8h
    - --snapshot-count=50000
    resources:
      requests:
        cpu: 500m
        memory: 1Gi
      limits:
        cpu: 2000m
        memory: 4Gi

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

# 根据实际使用情况设置 request 和 limit
spec:
  containers:
  - name: app
    resources:
      requests:
        # 初始设置为 limit 的 70%
        memory: "700Mi"
        cpu: "700m"
      limits:
        # 通过监控确定峰值
        memory: "1Gi"
        cpu: "1000m"