267 lines
7.3 KiB
Markdown
267 lines
7.3 KiB
Markdown
|
---
|
|||
|
|
tags: [microservice, kubernetes, k8s, container-orchestration]
|
|||
|
|
create time: 2026-05-05
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
# Kubernetes
|
|||
|
|
|
|||
|
|
## 概述
|
|||
|
|
|
|||
|
|
Kubernetes (K8s) 是微服务架构的事实标准编排引擎。它将容器化的服务组织成声明式的资源对象，自动处理部署、扩展、故障恢复。
|
|||
|
|
|
|||
|
|
```mermaid
|
|||
|
|
graph TB
|
|||
|
|
subgraph CLUSTER["K8s Cluster"]
|
|||
|
|
Master["控制面<br/>API Server / Scheduler / Controller Manager / etcd"]
|
|||
|
|
|
|||
|
|
subgraph NODES["工作节点"]
|
|||
|
|
N1["Node A<br/>kubelet + kube-proxy"]
|
|||
|
|
N2["Node B<br/>kubelet + kube-proxy"]
|
|||
|
|
end
|
|||
|
|
|
|||
|
|
Master --> N1
|
|||
|
|
Master --> N2
|
|||
|
|
|
|||
|
|
subgraph APPS["应用层"]
|
|||
|
|
Order["Order Service Deployment"]
|
|||
|
|
Pay["Payment Service Deployment"]
|
|||
|
|
end
|
|||
|
|
|
|||
|
|
N1 --> Order
|
|||
|
|
N2 --> Order
|
|||
|
|
N1 --> Pay
|
|||
|
|
N2 --> Pay
|
|||
|
|
end
|
|||
|
|
|
|||
|
|
SVC["Service (ClusterIP)"] -->|Load Balance| Order
|
|||
|
|
Ingress["Ingress (HTTP Routing)"] --> SVC
|
|||
|
|
|
|||
|
|
style Master fill:#e3f2fd
|
|||
|
|
style N1 fill:#fff3e0
|
|||
|
|
style N2 fill:#fff3e0
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 核心概念速查
|
|||
|
|
|
|||
|
|
| K8s 对象 | 用途 | 类比 |
|
|||
|
|
|---------|------|------|
|
|||
|
|
| **Pod** | 最小部署单元，包含一个或多个容器 | 应用实例 |
|
|||
|
|
| **Deployment** | 管理 Pod 的副本数和滚动更新 | 应用的"模板" |
|
|||
|
|
| **Service** | 稳定的网络入口，负载均衡 | 内部 VIP |
|
|||
|
|
| **Ingress** | HTTP/HTTPS 路由规则 | 外部网关 |
|
|||
|
|
| **ConfigMap** | 配置注入（明文） | 环境变量/配置文件 |
|
|||
|
|
| **Secret** | 敏感配置注入（base64） | 密码/API Key |
|
|||
|
|
| **HPA** | 根据指标自动扩缩容 | 弹性伸缩 |
|
|||
|
|
| **StatefulSet** | 有状态应用的有序管理 | DB、ZK |
|
|||
|
|
| **Job/CronJob** | 一次性任务 / 定时任务 | 批处理 |
|
|||
|
|
|
|||
|
|
## Deployment 详解
|
|||
|
|
|
|||
|
|
### 完整示例
|
|||
|
|
|
|||
|
|
```yaml
|
|||
|
|
apiVersion: apps/v1
|
|||
|
|
kind: Deployment
|
|||
|
|
metadata:
|
|||
|
|
name: order-service
|
|||
|
|
labels:
|
|||
|
|
app: order
|
|||
|
|
version: v1.2.3
|
|||
|
|
spec:
|
|||
|
|
replicas: 3 # 期望副本数
|
|||
|
|
strategy:
|
|||
|
|
type: RollingUpdate
|
|||
|
|
rollingUpdate:
|
|||
|
|
maxSurge: 1 # 最多超额 1 个 Pod
|
|||
|
|
maxUnavailable: 0 # 滚动更新期间不允许不可用
|
|||
|
|
|
|||
|
|
selector:
|
|||
|
|
matchLabels:
|
|||
|
|
app: order
|
|||
|
|
|
|||
|
|
template:
|
|||
|
|
metadata:
|
|||
|
|
labels:
|
|||
|
|
app: order
|
|||
|
|
version: v1.2.3
|
|||
|
|
spec:
|
|||
|
|
containers:
|
|||
|
|
- name: order-service
|
|||
|
|
image: registry.example.com/order:v1.2.3
|
|||
|
|
ports:
|
|||
|
|
- containerPort: 8080
|
|||
|
|
|
|||
|
|
# ========== 资源配置 ==========
|
|||
|
|
resources:
|
|||
|
|
requests: # 调度依据：保证至少有这些
|
|||
|
|
cpu: "250m"
|
|||
|
|
memory: "256Mi"
|
|||
|
|
limits: # 硬上限：超过则 OOMKill/CPU Throttle
|
|||
|
|
cpu: "500m"
|
|||
|
|
memory: "512Mi"
|
|||
|
|
|
|||
|
|
# ========== 探针 ==========
|
|||
|
|
livenessProbe:
|
|||
|
|
httpGet:
|
|||
|
|
path: /healthz
|
|||
|
|
port: 8080
|
|||
|
|
initialDelaySeconds: 15
|
|||
|
|
periodSeconds: 10
|
|||
|
|
failureThreshold: 3 # 连续失败 3 次才重启
|
|||
|
|
|
|||
|
|
readinessProbe:
|
|||
|
|
httpGet:
|
|||
|
|
path: /ready
|
|||
|
|
port: 8080
|
|||
|
|
initialDelaySeconds: 5
|
|||
|
|
periodSeconds: 5
|
|||
|
|
failureThreshold: 3
|
|||
|
|
|
|||
|
|
startupProbe:
|
|||
|
|
httpGet:
|
|||
|
|
path: /healthz
|
|||
|
|
port: 8080
|
|||
|
|
failureThreshold: 30 # 最长等待 300s (慢启动友好)
|
|||
|
|
|
|||
|
|
# ========== 环境变量 & 挂载 ==========
|
|||
|
|
envFrom:
|
|||
|
|
- configMapRef:
|
|||
|
|
name: order-service-config
|
|||
|
|
- secretRef:
|
|||
|
|
name: order-service-secrets
|
|||
|
|
|
|||
|
|
lifecycle:
|
|||
|
|
preStop:
|
|||
|
|
exec:
|
|||
|
|
command: ["sh", "-c", "sleep 15"] # 优雅退出，给 LB 摘流时间
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### Probe 选择指南
|
|||
|
|
|
|||
|
|
| 探针类型 | 触发条件 | 动作 | 适用场景 |
|
|||
|
|
|---------|---------|------|---------|
|
|||
|
|
| **Liveness** | `/healthz` 返回非 2xx | 重启容器 | 死锁、无法恢复的崩溃 |
|
|||
|
|
| **Readiness** | `/ready` 返回非 2xx | 摘除 Service 流量 | 依赖未就绪、热加载中 |
|
|||
|
|
| **Startup** | 首次成功前持续失败 | 不重启，只等待 | 大模型/JVM 冷启动 |
|
|||
|
|
|
|||
|
|
> [!warning] 经典陷阱：CrashLoopBackOff
|
|||
|
|
>
|
|||
|
|
> 如果 Liveness Probe 因为 DB 连接超时而返回 503，K8s 会认为容器挂了并反复重启它——这就是 CrashLoopBackOff。正确做法是：让 `/healthz` 做降级判断（DB 不可用时返回 200），用 `/ready` 来摘除流量。
|
|||
|
|
|
|||
|
|
## Service 与 Ingress
|
|||
|
|
|
|||
|
|
### Service 类型
|
|||
|
|
|
|||
|
|
| 类型 | 特点 | 使用场景 |
|
|||
|
|
|------|------|---------|
|
|||
|
|
| **ClusterIP** | 集群内 IP，外部不可访问 | 默认，内部服务间调用 |
|
|||
|
|
| **NodePort** | 在每个 Node 上开端口 | 调试、临时访问 |
|
|||
|
|
| **LoadBalancer** | 云厂商分配公网 IP | 对外暴露的服务 |
|
|||
|
|
| **ExternalName** | CNAME 到外部域名 | 对接外部系统 |
|
|||
|
|
|
|||
|
|
```yaml
|
|||
|
|
# ClusterIP Service — 服务发现的载体
|
|||
|
|
apiVersion: v1
|
|||
|
|
kind: Service
|
|||
|
|
metadata:
|
|||
|
|
name: order-service
|
|||
|
|
spec:
|
|||
|
|
selector:
|
|||
|
|
app: order
|
|||
|
|
ports:
|
|||
|
|
- port: 80
|
|||
|
|
targetPort: 8080
|
|||
|
|
protocol: TCP
|
|||
|
|
type: ClusterIP
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
调用方只需 `http://order-service:80`，K8s 通过 iptables/IPVS 自动实现负载均衡。
|
|||
|
|
|
|||
|
|
### Ingress — HTTP 路由
|
|||
|
|
|
|||
|
|
```yaml
|
|||
|
|
apiVersion: networking.k8s.io/v1
|
|||
|
|
kind: Ingress
|
|||
|
|
metadata:
|
|||
|
|
name: main-ingress
|
|||
|
|
annotations:
|
|||
|
|
nginx.ingress.kubernetes.io/rewrite-target: /
|
|||
|
|
spec:
|
|||
|
|
rules:
|
|||
|
|
- host: api.example.com
|
|||
|
|
http:
|
|||
|
|
paths:
|
|||
|
|
- path: /orders
|
|||
|
|
pathType: Prefix
|
|||
|
|
backend:
|
|||
|
|
service:
|
|||
|
|
name: order-service
|
|||
|
|
port:
|
|||
|
|
number: 80
|
|||
|
|
- path: /users
|
|||
|
|
pathType: Prefix
|
|||
|
|
backend:
|
|||
|
|
service:
|
|||
|
|
name: user-service
|
|||
|
|
port:
|
|||
|
|
number: 80
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## HPA 弹性伸缩
|
|||
|
|
|
|||
|
|
```yaml
|
|||
|
|
apiVersion: autoscaling/v2
|
|||
|
|
kind: HorizontalPodAutoscaler
|
|||
|
|
metadata:
|
|||
|
|
name: order-service-hpa
|
|||
|
|
spec:
|
|||
|
|
scaleTargetRef:
|
|||
|
|
apiVersion: apps/v1
|
|||
|
|
kind: Deployment
|
|||
|
|
name: order-service
|
|||
|
|
minReplicas: 3
|
|||
|
|
maxReplicas: 20
|
|||
|
|
metrics:
|
|||
|
|
- type: Resource
|
|||
|
|
resource:
|
|||
|
|
name: cpu
|
|||
|
|
target:
|
|||
|
|
type: Utilization
|
|||
|
|
averageUtilization: 70 # CPU > 70% 时扩容
|
|||
|
|
- type: Resource
|
|||
|
|
resource:
|
|||
|
|
name: memory
|
|||
|
|
target:
|
|||
|
|
type: Utilization
|
|||
|
|
averageUtilization: 80
|
|||
|
|
behavior:
|
|||
|
|
scaleUp:
|
|||
|
|
stabilizationWindowSeconds: 60 # 扩容稳定期
|
|||
|
|
policies:
|
|||
|
|
- type: Pods
|
|||
|
|
value: 2
|
|||
|
|
periodSeconds: 60 # 每分钟最多扩 2 个
|
|||
|
|
scaleDown:
|
|||
|
|
stabilizationWindowSeconds: 300 # 缩容稳定期 5min（防抖动）
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## K8s 运维 Checklist
|
|||
|
|
|
|||
|
|
每次上线前过一遍这个清单：
|
|||
|
|
|
|||
|
|
| # | 检查项 | 说明 |
|
|||
|
|
|---|--------|------|
|
|||
|
|
| 1 | **Probe 已配置** | liveness/readiness/startup 都设定了阈值 |
|
|||
|
|
| 2 | **Resources Limits** | 防止单个 Pod OOMKill 拖垮整台机器 |
|
|||
|
|
| 3 | **日志输出到 stdout/stderr** | 可被采集器解析为 JSON |
|
|||
|
|
| 4 | **trace_id 透传** | 跨服务调用链 trace_id 不丢失 |
|
|||
|
|
| 5 | **回滚预案** | `kubectl rollout undo deployment/order-service` 能用 |
|
|||
|
|
| 6 | **告警已配置** | 关键指标异常时有人收到通知 |
|
|||
|
|
| 7 | **镜像 Tag** | 不用 latest，用语义化版本或 commit SHA |
|
|||
|
|
|
|||
|
|
## 关联笔记
|
|||
|
|
|
|||
|
|
- [[02-服务治理/04-服务发现]] — K8s Service 是服务端发现模式的代表
|
|||
|
|
- [[02-服务治理/08-流量治理]] — Istio VirtualService 在 K8s 上的高级路由
|
|||
|
|
- [[05-部署运维/04-SRE实践]] — SLO/Error Budget 在 K8s 中的落地
|