Kubernetes — 容器编排平台完全指南

适合本地学习和开发，在单节点上运行完整 K8s 集群：

# 安装 minikube
curl -LO https://storage.googleapis.com/minikube/releases/latest/minikube-linux-amd64
sudo install minikube-linux-amd64 /usr/local/bin/minikube

# 启动集群
minikube start --driver=docker --cpus=2 --memory=4096

# 验证
kubectl get nodes

官方推荐的生产级部署工具，适合自建集群：

# 所有节点安装 kubeadm、kubelet、kubectl
sudo apt-get update && sudo apt-get install -y kubelet kubeadm kubectl
sudo apt-mark hold kubelet kubeadm kubectl

# Master 节点初始化
sudo kubeadm init --pod-network-cidr=10.244.0.0/16

# 配置 kubectl
mkdir -p $HOME/.kube
sudo cp /etc/kubernetes/admin.conf $HOME/.kube/config

# 安装网络插件（Flannel）
kubectl apply -f https://github.com/flannel-io/flannel/releases/latest/download/kube-flannel.yml

# Worker 节点加入
sudo kubeadm join <master-ip>:6443 --token <token> --discovery-token-ca-cert-hash sha256:<hash>

使用 Docker 容器作为节点，适合 CI/CD 和测试：

# 安装 kind
go install sigs.k8s.io/kind@latest

# 创建多节点集群
cat <<EOF | kind create cluster --config=-
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
- role: worker
- role: worker
EOF

kubectl cluster-info --context kind-kind

使用云厂商的托管服务，免维护控制面：

# AWS EKS
eksctl create cluster --name my-cluster --region ap-east-1 --nodes 3

# Google GKE
gcloud container clusters create my-cluster --zone asia-east1-a --num-nodes 3

# Azure AKS
az aks create -g myRG -n myCluster --node-count 3

Pod 是 K8s 中最小的可部署单元，包含一个或多个共享网络和存储的容器。每个 Pod 拥有独立 IP。

apiVersion: v1
kind: Pod
metadata:
  name: nginx-pod
spec:
  containers:
  - name: nginx
    image: nginx:1.25
    ports:
    - containerPort: 80

Service 为一组 Pod 提供稳定的访问入口（ClusterIP），支持 ClusterIP、NodePort、LoadBalancer 三种类型。

apiVersion: v1
kind: Service
metadata:
  name: nginx-svc
spec:
  selector:
    app: nginx
  ports:
  - port: 80
    targetPort: 80
  type: ClusterIP

Deployment 管理 ReplicaSet，支持声明式更新、回滚、扩缩容，是最常用的工作负载控制器。

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deploy
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.25
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 250m
            memory: 256Mi

ConfigMap 存储非敏感配置，Secret 存储敏感数据（如密码、证书），均可以环境变量或卷挂载方式注入 Pod。

# 创建 ConfigMap
kubectl create configmap app-config --from-literal=DB_HOST=mysql --from-literal=DB_PORT=3306

# 创建 Secret
kubectl create secret generic db-secret --from-literal=DB_PASS=mypassword

# 在 Pod 中使用
env:
- name: DB_HOST
  valueFrom:
    configMapKeyRef:
      name: app-config
      key: DB_HOST

Namespace 提供逻辑隔离，适合多团队、多环境共用同一集群。可配合 ResourceQuota 和 NetworkPolicy 实现资源与网络隔离。

# 创建命名空间
kubectl create namespace production
kubectl create namespace staging

# 在指定命名空间部署
kubectl apply -f deploy.yaml -n production

# 设置资源配额
apiVersion: v1
kind: ResourceQuota
metadata:
  name: compute-quota
  namespace: production
spec:
  hard:
    requests.cpu: "4"
    requests.memory: 8Gi
    limits.cpu: "8"
    limits.memory: 16Gi

Ingress 提供 HTTP/HTTPS 路由规则，将外部流量导入集群内 Service。需配合 Ingress Controller（如 nginx-ingress）使用。

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: nginx-svc
            port:
              number: 80

kubectl create deployment nginx --image=nginx:1.25 --replicas=3
kubectl expose deployment nginx --port=80 --type=LoadBalancer
kubectl get svc nginx

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mysql
spec:
  serviceName: mysql
  replicas: 1
  selector:
    matchLabels:
      app: mysql
  template:
    metadata:
      labels:
        app: mysql
    spec:
      containers:
      - name: mysql
        image: mysql:8.0
        env:
        - name: MYSQL_ROOT_PASSWORD
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: DB_PASS
        ports:
        - containerPort: 3306
        volumeMounts:
        - name: mysql-data
          mountPath: /var/lib/mysql
  volumeClaimTemplates:
  - metadata:
      name: mysql-data
    spec:
      accessModes: ["ReadWriteOnce"]
      resources:
        requests:
          storage: 10Gi

# 安装 Helm
curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash

# 添加仓库并安装
helm repo add bitnami https://charts.bitnami.com/bitnami
helm install my-redis bitnami/redis --set auth.password=mypass
helm list

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: nginx-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: nginx-deploy
  minReplicas: 2
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70

apiVersion: batch/v1
kind: CronJob
metadata:
  name: db-backup
spec:
  schedule: "0 2 * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: backup
            image: mysql:8.0
            command: ["mysqldump", "-h", "mysql", "-u", "root", "-p$(DB_PASS)", "--all-databases"]
          restartPolicy: OnFailure

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - port: 8080

使用 kube-prometheus-stack 一键部署完整监控栈：

helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm install monitoring prometheus-community/kube-prometheus-stack -n monitoring --create-namespace

# 访问 Grafana
kubectl port-forward svc/monitoring-grafana 3000:80 -n monitoring
# 默认用户 admin，密码 prom-operator

使用 Elasticsearch + Fluentd + Kibana 收集和查询日志：

# 使用 Helm 部署 EFK
helm install elasticsearch elastic/elasticsearch -n logging --create-namespace
helm install kibana elastic/kibana -n logging
helm install fluentd bitnami/fluentd -n logging

# 查看实时日志
kubectl logs -f deployment/nginx-deploy --all-containers=true
kubectl logs --previous pod-name  # 查看崩溃前日志

使用 Velero 备份集群资源和持久卷数据：

# 安装 Velero
velero install --provider aws --bucket my-backup \
  --secret-file ./credentials-velero --backup-location-config region=ap-east-1

# 创建备份
velero backup create daily-backup --include-namespaces production

# 恢复
velero restore create --from-backup daily-backup

# 定期备份
velero schedule create daily --schedule="0 3 * * *" --include-namespaces production