1. Kubernetes核心概念与学习路径Kubernetes简称K8s作为容器编排领域的事实标准已经成为云原生技术栈的核心组件。我最初接触K8s是在2017年当时我们团队正在将单体应用迁移到微服务架构经历了从手动管理Docker容器到采用K8s编排的完整转型过程。这个转变不仅提升了我们的部署效率更重要的是建立了可扩展的基础设施体系。1.1 为什么需要容器编排当你的应用从单体架构转向微服务时会面临几个典型问题服务实例数量呈指数级增长跨节点网络通信变得复杂存储和配置管理需要统一方案故障自愈能力成为刚需早期我们尝试用Shell脚本配合Docker命令管理容器很快就遇到了瓶颈。比如某个服务崩溃后需要人工介入重启流量激增时扩容操作滞后不同环境配置差异导致部署失败等。这些都是K8s原生解决的痛点。1.2 K8s架构设计精要Master节点包含三大核心组件API Server集群的前台接待处理所有REST操作Controller Manager集群的大脑确保实际状态符合预期Scheduler资源分配的调度专家决定Pod运行位置Node节点运行着kubelet节点管家与API Server保持通信kube-proxy网络交警管理Service的IP路由容器运行时实际运行容器的引擎如containerd生产环境建议Master节点至少部署3个实例形成高可用集群使用etcd集群保障数据一致性。我们曾经因为单Master节点宕机导致整个集群不可用这个教训价值百万。2. 集群部署实战手册2.1 本地开发环境搭建对于初学者我强烈推荐以下两种方式Minikube单节点本地集群minikube start --driverdocker --cpus4 --memory8192KindKubernetes in Dockerkind create cluster --configmulti-node.yaml我曾经在Windows平台上尝试过多种方案最终发现WSL2 Docker Desktop Kind的组合最稳定。特别是当需要模拟多节点场景时Kind可以通过配置文件轻松创建符合生产环境拓扑的集群。2.2 生产级集群部署以kubeadm为例关键步骤如下系统准备所有节点# 关闭Swap swapoff -a sed -i / swap / s/^/#/ /etc/fstab # 加载内核模块 cat EOF | sudo tee /etc/modules-load.d/k8s.conf br_netfilter EOF # 设置网络参数 cat EOF | sudo tee /etc/sysctl.d/k8s.conf net.bridge.bridge-nf-call-ip6tables 1 net.bridge.bridge-nf-call-iptables 1 EOFMaster节点初始化kubeadm init \ --pod-network-cidr10.244.0.0/16 \ --apiserver-advertise-address192.168.1.100 \ --control-plane-endpointcluster.example.com网络插件安装以Calico为例kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml血泪教训一定要提前规划好Pod CIDR和Service CIDR我们曾经因为IP地址耗尽导致集群需要重建。建议预留至少/16的网络空间。3. 核心对象深度解析3.1 Pod设计模式Pod是K8s的最小调度单元但实际应用中我们很少直接创建裸Pod。以下是三种经典模式Sidecar模式主容器辅助容器apiVersion: v1 kind: Pod metadata: name: web-server spec: containers: - name: nginx image: nginx:1.19 ports: - containerPort: 80 - name: log-agent image: fluentd:1.14 volumeMounts: - name: logs mountPath: /var/log/nginxAdapter模式标准化输出Ambassador模式代理网络请求3.2 Deployment高级策略滚动更新配置示例apiVersion: apps/v1 kind: Deployment metadata: name: canary-demo spec: strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% type: RollingUpdate replicas: 10 template: spec: containers: - name: nginx image: nginx:1.19 readinessProbe: httpGet: path: /healthz port: 80 initialDelaySeconds: 5 periodSeconds: 5金丝雀发布技巧# 先发布金丝雀版本 kubectl set image deployment/canary-demo nginxnginx:1.20 --record kubectl rollout pause deployment/canary-demo # 验证通过后继续 kubectl rollout resume deployment/canary-demo4. 存储与网络实战4.1 持久化存储方案PVC动态供给示例apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: name: fast-ssd provisioner: pd.csi.storage.gke.io parameters: type: pd-ssd --- apiVersion: v1 kind: PersistentVolumeClaim metadata: name: mysql-pvc spec: storageClassName: fast-ssd accessModes: - ReadWriteOnce resources: requests: storage: 100Gi4.2 Ingress高级配置基于路径的路由示例apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: path-based annotations: nginx.ingress.kubernetes.io/rewrite-target: /$2 spec: rules: - http: paths: - path: /api(/|$)(.*) pathType: Prefix backend: service: name: api-service port: number: 8000 - path: /admin pathType: Exact backend: service: name: admin-console port: number: 80805. 运维监控与调优5.1 监控体系搭建Prometheus-Operator部署要点helm repo add prometheus-community https://prometheus-community.github.io/helm-charts helm install prometheus prometheus-community/kube-prometheus-stack \ --namespace monitoring \ --set grafana.adminPasswordsecret \ --set prometheus.prometheusSpec.retention30d关键监控指标CPU Throttlingcontainer_spec_cpu_quota / container_spec_cpu_period内存压力container_memory_working_set_bytes网络异常kube_pod_container_status_restarts_total5.2 性能调优实战Kubelet参数优化--kube-reservedcpu500m,memory1Gi \ --system-reservedcpu1000m,memory2Gi \ --eviction-hardmemory.available500Mi,nodefs.available10% \ --image-gc-high-threshold85 \ --image-gc-low-threshold80调度器优化策略apiVersion: scheduling.k8s.io/v1 kind: PriorityClass metadata: name: high-priority value: 1000000 globalDefault: false description: 用于关键业务Pod6. 安全加固方案6.1 RBAC精细控制开发人员权限示例apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: namespace: dev name: developer rules: - apiGroups: [] resources: [pods, pods/log] verbs: [get, list, watch] - apiGroups: [apps] resources: [deployments] verbs: [get, list, create, update]6.2 网络策略实践隔离命名空间示例apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: deny-cross-ns namespace: production spec: podSelector: {} policyTypes: - Ingress ingress: - from: - podSelector: {} - namespaceSelector: matchLabels: role: monitoring7. 生态工具链集成7.1 CI/CD流水线设计Argo CD声明式配置示例apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: production-app spec: destination: server: https://kubernetes.default.svc namespace: production source: repoURL: gitgithub.com:myorg/config.git path: kustomize/production targetRevision: HEAD syncPolicy: automated: prune: true selfHeal: true syncOptions: - CreateNamespacetrue7.2 服务网格集成Istio sidecar自动注入apiVersion: apps/v1 kind: Deployment metadata: name: product-service labels: istio.io/rev: canary spec: template: metadata: annotations: sidecar.istio.io/inject: true traffic.sidecar.istio.io/excludeOutboundPorts: 33068. 故障排查指南8.1 诊断命令速查关键问题定位命令# 查看Pod事件 kubectl describe pod -n namespace pod-name # 容器日志查看 kubectl logs -f pod-name -c container-name --tail100 # 进入容器调试 kubectl exec -it pod-name -- /bin/sh # 资源使用情况 kubectl top pod --sort-bymemory8.2 常见问题案例案例1ImagePullBackOff错误检查镜像地址是否正确验证镜像仓库权限排查网络连通性案例2CrashLoopBackOff查看容器日志获取崩溃原因检查资源配额是否充足验证探针配置是否合理案例3Pending状态检查资源请求是否超出节点容量验证节点选择器/污点配置查看调度器日志获取详情