Init
This commit is contained in:
@@ -0,0 +1,266 @@
|
||||
---
|
||||
tags: [microservice, kubernetes, k8s, container-orchestration]
|
||||
create time: 2026-05-05
|
||||
---
|
||||
|
||||
# Kubernetes
|
||||
|
||||
## 概述
|
||||
|
||||
Kubernetes (K8s) 是微服务架构的事实标准编排引擎。它将容器化的服务组织成声明式的资源对象，自动处理部署、扩展、故障恢复。
|
||||
|
||||
```mermaid
|
||||
graph TB
|
||||
subgraph CLUSTER["K8s Cluster"]
|
||||
Master["控制面<br/>API Server / Scheduler / Controller Manager / etcd"]
|
||||
|
||||
subgraph NODES["工作节点"]
|
||||
N1["Node A<br/>kubelet + kube-proxy"]
|
||||
N2["Node B<br/>kubelet + kube-proxy"]
|
||||
end
|
||||
|
||||
Master --> N1
|
||||
Master --> N2
|
||||
|
||||
subgraph APPS["应用层"]
|
||||
Order["Order Service Deployment"]
|
||||
Pay["Payment Service Deployment"]
|
||||
end
|
||||
|
||||
N1 --> Order
|
||||
N2 --> Order
|
||||
N1 --> Pay
|
||||
N2 --> Pay
|
||||
end
|
||||
|
||||
SVC["Service (ClusterIP)"] -->|Load Balance| Order
|
||||
Ingress["Ingress (HTTP Routing)"] --> SVC
|
||||
|
||||
style Master fill:#e3f2fd
|
||||
style N1 fill:#fff3e0
|
||||
style N2 fill:#fff3e0
|
||||
```
|
||||
|
||||
## 核心概念速查
|
||||
|
||||
| K8s 对象 | 用途 | 类比 |
|
||||
|---------|------|------|
|
||||
| **Pod** | 最小部署单元，包含一个或多个容器 | 应用实例 |
|
||||
| **Deployment** | 管理 Pod 的副本数和滚动更新 | 应用的"模板" |
|
||||
| **Service** | 稳定的网络入口，负载均衡 | 内部 VIP |
|
||||
| **Ingress** | HTTP/HTTPS 路由规则 | 外部网关 |
|
||||
| **ConfigMap** | 配置注入（明文） | 环境变量/配置文件 |
|
||||
| **Secret** | 敏感配置注入（base64） | 密码/API Key |
|
||||
| **HPA** | 根据指标自动扩缩容 | 弹性伸缩 |
|
||||
| **StatefulSet** | 有状态应用的有序管理 | DB、ZK |
|
||||
| **Job/CronJob** | 一次性任务 / 定时任务 | 批处理 |
|
||||
|
||||
## Deployment 详解
|
||||
|
||||
### 完整示例
|
||||
|
||||
```yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: order-service
|
||||
labels:
|
||||
app: order
|
||||
version: v1.2.3
|
||||
spec:
|
||||
replicas: 3 # 期望副本数
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxSurge: 1 # 最多超额 1 个 Pod
|
||||
maxUnavailable: 0 # 滚动更新期间不允许不可用
|
||||
|
||||
selector:
|
||||
matchLabels:
|
||||
app: order
|
||||
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: order
|
||||
version: v1.2.3
|
||||
spec:
|
||||
containers:
|
||||
- name: order-service
|
||||
image: registry.example.com/order:v1.2.3
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
|
||||
# ========== 资源配置 ==========
|
||||
resources:
|
||||
requests: # 调度依据：保证至少有这些
|
||||
cpu: "250m"
|
||||
memory: "256Mi"
|
||||
limits: # 硬上限：超过则 OOMKill/CPU Throttle
|
||||
cpu: "500m"
|
||||
memory: "512Mi"
|
||||
|
||||
# ========== 探针 ==========
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8080
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3 # 连续失败 3 次才重启
|
||||
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ready
|
||||
port: 8080
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
failureThreshold: 3
|
||||
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8080
|
||||
failureThreshold: 30 # 最长等待 300s (慢启动友好)
|
||||
|
||||
# ========== 环境变量 & 挂载 ==========
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: order-service-config
|
||||
- secretRef:
|
||||
name: order-service-secrets
|
||||
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command: ["sh", "-c", "sleep 15"] # 优雅退出，给 LB 摘流时间
|
||||
```
|
||||
|
||||
### Probe 选择指南
|
||||
|
||||
| 探针类型 | 触发条件 | 动作 | 适用场景 |
|
||||
|---------|---------|------|---------|
|
||||
| **Liveness** | `/healthz` 返回非 2xx | 重启容器 | 死锁、无法恢复的崩溃 |
|
||||
| **Readiness** | `/ready` 返回非 2xx | 摘除 Service 流量 | 依赖未就绪、热加载中 |
|
||||
| **Startup** | 首次成功前持续失败 | 不重启，只等待 | 大模型/JVM 冷启动 |
|
||||
|
||||
> [!warning] 经典陷阱：CrashLoopBackOff
|
||||
>
|
||||
> 如果 Liveness Probe 因为 DB 连接超时而返回 503，K8s 会认为容器挂了并反复重启它——这就是 CrashLoopBackOff。正确做法是：让 `/healthz` 做降级判断（DB 不可用时返回 200），用 `/ready` 来摘除流量。
|
||||
|
||||
## Service 与 Ingress
|
||||
|
||||
### Service 类型
|
||||
|
||||
| 类型 | 特点 | 使用场景 |
|
||||
|------|------|---------|
|
||||
| **ClusterIP** | 集群内 IP，外部不可访问 | 默认，内部服务间调用 |
|
||||
| **NodePort** | 在每个 Node 上开端口 | 调试、临时访问 |
|
||||
| **LoadBalancer** | 云厂商分配公网 IP | 对外暴露的服务 |
|
||||
| **ExternalName** | CNAME 到外部域名 | 对接外部系统 |
|
||||
|
||||
```yaml
|
||||
# ClusterIP Service — 服务发现的载体
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: order-service
|
||||
spec:
|
||||
selector:
|
||||
app: order
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 8080
|
||||
protocol: TCP
|
||||
type: ClusterIP
|
||||
```
|
||||
|
||||
调用方只需 `http://order-service:80`，K8s 通过 iptables/IPVS 自动实现负载均衡。
|
||||
|
||||
### Ingress — HTTP 路由
|
||||
|
||||
```yaml
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: main-ingress
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/rewrite-target: /
|
||||
spec:
|
||||
rules:
|
||||
- host: api.example.com
|
||||
http:
|
||||
paths:
|
||||
- path: /orders
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: order-service
|
||||
port:
|
||||
number: 80
|
||||
- path: /users
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: user-service
|
||||
port:
|
||||
number: 80
|
||||
```
|
||||
|
||||
## HPA 弹性伸缩
|
||||
|
||||
```yaml
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: order-service-hpa
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: order-service
|
||||
minReplicas: 3
|
||||
maxReplicas: 20
|
||||
metrics:
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: 70 # CPU > 70% 时扩容
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: 80
|
||||
behavior:
|
||||
scaleUp:
|
||||
stabilizationWindowSeconds: 60 # 扩容稳定期
|
||||
policies:
|
||||
- type: Pods
|
||||
value: 2
|
||||
periodSeconds: 60 # 每分钟最多扩 2 个
|
||||
scaleDown:
|
||||
stabilizationWindowSeconds: 300 # 缩容稳定期 5min（防抖动）
|
||||
```
|
||||
|
||||
## K8s 运维 Checklist
|
||||
|
||||
每次上线前过一遍这个清单：
|
||||
|
||||
| # | 检查项 | 说明 |
|
||||
|---|--------|------|
|
||||
| 1 | **Probe 已配置** | liveness/readiness/startup 都设定了阈值 |
|
||||
| 2 | **Resources Limits** | 防止单个 Pod OOMKill 拖垮整台机器 |
|
||||
| 3 | **日志输出到 stdout/stderr** | 可被采集器解析为 JSON |
|
||||
| 4 | **trace_id 透传** | 跨服务调用链 trace_id 不丢失 |
|
||||
| 5 | **回滚预案** | `kubectl rollout undo deployment/order-service` 能用 |
|
||||
| 6 | **告警已配置** | 关键指标异常时有人收到通知 |
|
||||
| 7 | **镜像 Tag** | 不用 latest，用语义化版本或 commit SHA |
|
||||
|
||||
## 关联笔记
|
||||
|
||||
- [[02-服务治理/04-服务发现]] — K8s Service 是服务端发现模式的代表
|
||||
- [[02-服务治理/08-流量治理]] — Istio VirtualService 在 K8s 上的高级路由
|
||||
- [[05-部署运维/04-SRE实践]] — SLO/Error Budget 在 K8s 中的落地
|
||||
Reference in New Issue
Block a user