Kubernetes 集群运维指南

目录

  1. Kubernetes 架构概述
  2. 集群部署
  3. kubectl 使用指南
  4. 工作负载管理
  5. 服务与网络
  6. 存储管理
  7. 配置管理
  8. 集群监控
  9. 故障排查
  10. 备份与恢复

1. Kubernetes 架构概述

1.1 核心组件

控制平面（Control Plane）

  • kube-apiserver: API 服务器，集群的统一入口
  • etcd: 分布式键值存储，保存集群状态
  • kube-scheduler: 负责 Pod 调度
  • kube-controller-manager: 运行各种控制器
  • cloud-controller-manager: 与云提供商交互

节点组件（Node Components）

  • kubelet: 节点代理，管理 Pod 生命周期
  • kube-proxy: 网络代理，维护网络规则
  • 容器运行时: Docker, containerd, CRI-O

1.2 核心概念

1
2
3
4
5
6
7
8
9
10
11
12
Cluster（集群）
├── Node（节点）
│   ├── Pod（最小调度单元）
│   │   └── Container（容器）
├── Namespace（命名空间）
└── Resource（资源）
    ├── Deployment
    ├── StatefulSet
    ├── DaemonSet
    ├── Service
    ├── ConfigMap
    └── Secret

2. 集群部署

2.1 kubeadm 部署

Master 节点配置

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
# 禁用 swap
swapoff -a
sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab

# 配置内核参数
cat > /etc/sysctl.d/k8s.conf << EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
EOF
sysctl --system

# 安装 containerd
apt-get update
apt-get install -y containerd
containerd config default > /etc/containerd/config.toml
sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
systemctl restart containerd

# 安装 kubeadm, kubelet, kubectl
apt-get update
apt-get install -y apt-transport-https ca-certificates curl
curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg | gpg --dearmor -o /etc/apt/keyrings/kubernetes-archive-keyring.gpg
echo "deb [signed-by=/etc/apt/keyrings/kubernetes-archive-keyring.gpg] https://apt.kubernetes.io/ kubernetes-xenial main" | tee /etc/apt/sources.list.d/kubernetes.list
apt-get update
apt-get install -y kubelet kubeadm kubectl
apt-mark hold kubelet kubeadm kubectl

初始化集群

1
2
3
4
5
6
7
8
9
10
11
12
13
# 初始化 master 节点
kubeadm init --pod-network-cidr=10.244.0.0/16

# 配置 kubectl
mkdir -p $HOME/.kube
cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
chown $(id -u):$(id -g) $HOME/.kube/config

# 安装网络插件（Flannel）
kubectl apply -f https://github.com/flannel-io/flannel/releases/latest/download/kube-flannel.yml

# 获取 join 命令
kubeadm token create --print-join-command

Worker 节点加入

1
2
# 在 worker 节点执行 join 命令
kubeadm join <master-ip>:<master-port> --token <token> --discovery-token-ca-cert-hash sha256:<hash>

2.2 验证集群

1
2
3
4
5
6
7
8
# 查看节点
kubectl get nodes

# 查看组件状态
kubectl get componentstatuses

# 查看系统 Pod
kubectl get pods -n kube-system

3. kubectl 使用指南

3.1 基本命令

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
# 配置
kubectl config view
kubectl config get-contexts
kubectl config use-context <context-name>

# 查看资源
kubectl get pods
kubectl get pods -n <namespace>
kubectl get pods -o wide
kubectl get pods -o yaml
kubectl get pods -o json

# 详细描述
kubectl describe pod <pod-name>
kubectl describe pod <pod-name> -n <namespace>

# 日志
kubectl logs <pod-name>
kubectl logs -f <pod-name>
kubectl logs <pod-name> -c <container-name>

3.2 资源操作

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
# 创建资源
kubectl create -f manifest.yaml
kubectl apply -f manifest.yaml
kubectl apply -f ./directory/

# 删除资源
kubectl delete -f manifest.yaml
kubectl delete pod <pod-name>
kubectl delete namespace <namespace>

# 编辑资源
kubectl edit pod <pod-name>
kubectl edit deployment <deployment-name>

# 扩缩容
kubectl scale deployment <deployment-name> --replicas=3

3.3 进入容器

1
2
3
4
5
6
7
# 进入 Pod
kubectl exec -it <pod-name> -- /bin/bash
kubectl exec -it <pod-name> -c <container-name> -- /bin/sh

# 在容器中执行命令
kubectl exec <pod-name> -- ls -la
kubectl exec <pod-name> -- cat /etc/hosts

3.4 端口转发

1
2
3
4
5
6
# 本地端口转发
kubectl port-forward <pod-name> 8080:80
kubectl port-forward deployment/<deployment-name> 8080:80

# 服务端口转发
kubectl port-forward svc/<service-name> 8080:80

3.5 常用别名

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
# 添加别名
alias k=kubectl
complete -o default -F __start_kubectl k

# 常用别名
alias kgp='kubectl get pods'
alias kgd='kubectl get deployments'
alias kgs='kubectl get services'
alias kgn='kubectl get nodes'
alias kgl='kubectl get pods -o wide'
alias kdp='kubectl describe pod'
alias kdd='kubectl describe deployment'
alias kaf='kubectl apply -f'
alias kdf='kubectl delete -f'
alias kl='kubectl logs'
alias klf='kubectl logs -f'
alias ke='kubectl edit'
alias kx='kubectl delete pod'

4. 工作负载管理

4.1 Deployment

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  namespace: default
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.21
        ports:
        - containerPort: 80
        resources:
          requests:
            memory: "64Mi"
            cpu: "250m"
          limits:
            memory: "128Mi"
            cpu: "500m"
        readinessProbe:
          httpGet:
            path: /
            port: 80
          initialDelaySeconds: 5
          periodSeconds: 10
        livenessProbe:
          httpGet:
            path: /
            port: 80
          initialDelaySeconds: 15
          periodSeconds: 20

4.2 StatefulSet

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mysql
spec:
  serviceName: "mysql"
  replicas: 3
  selector:
    matchLabels:
      app: mysql
  template:
    metadata:
      labels:
        app: mysql
    spec:
      containers:
      - name: mysql
        image: mysql:5.7
        ports:
        - containerPort: 3306
        volumeMounts:
        - name: data
          mountPath: /var/lib/mysql
        env:
        - name: MYSQL_ROOT_PASSWORD
          valueFrom:
            secretKeyRef:
              name: mysql-secret
              key: password
  volumeClaimTemplates:
  - metadata:
      name: data
    spec:
      accessModes: ["ReadWriteOnce"]
      resources:
        requests:
          storage: 10Gi

4.3 DaemonSet

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: node-exporter
  namespace: monitoring
spec:
  selector:
    matchLabels:
      app: node-exporter
  template:
    metadata:
      labels:
        app: node-exporter
    spec:
      hostNetwork: true
      hostPID: true
      containers:
      - name: node-exporter
        image: prom/node-exporter:latest
        ports:
        - containerPort: 9100
          hostPort: 9100

4.4 Job & CronJob

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
# Job
apiVersion: batch/v1
kind: Job
metadata:
  name: backup-job
spec:
  template:
    spec:
      containers:
      - name: backup
        image: backup-tool:latest
        command: ["./backup.sh"]
      restartPolicy: OnFailure
  backoffLimit: 3

---
# CronJob
apiVersion: batch/v1
kind: CronJob
metadata:
  name: backup-cronjob
spec:
  schedule: "0 2 * * *"  # 每天凌晨 2 点
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: backup
            image: backup-tool:latest
          restartPolicy: OnFailure

5. 服务与网络

5.1 Service 类型

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
# ClusterIP（默认）
apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  selector:
    app: myapp
  ports:
  - port: 80
    targetPort: 8080
  type: ClusterIP

---
# NodePort
apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  selector:
    app: myapp
  ports:
  - port: 80
    targetPort: 8080
    nodePort: 30080
  type: NodePort

---
# LoadBalancer
apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  selector:
    app: myapp
  ports:
  - port: 80
    targetPort: 8080
  type: LoadBalancer

---
# Headless Service
apiVersion: v1
kind: Service
metadata:
  name: headless-service
spec:
  clusterIP: None
  selector:
    app: myapp
  ports:
  - port: 80

5.2 Ingress

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 8080
  tls:
  - hosts:
    - example.com
    secretName: tls-secret

5.3 Network Policy

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
  namespace: default
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-web
  namespace: default
spec:
  podSelector:
    matchLabels:
      app: web
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: ingress-nginx
    ports:
    - protocol: TCP
      port: 80

6. 存储管理

6.1 Volume 类型

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
# emptyDir
volumes:
- name: cache
  emptyDir: {}

# hostPath
volumes:
- name: log-volume
  hostPath:
    path: /var/log
    type: Directory

# PersistentVolumeClaim
volumes:
- name: data-volume
  persistentVolumeClaim:
    claimName: my-pvc

# ConfigMap
volumes:
- name: config
  configMap:
    name: my-config

# Secret
volumes:
- name: secret
  secret:
    secretName: my-secret

6.2 PersistentVolume

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-data
spec:
  capacity:
    storage: 10Gi
  accessModes:
  - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: manual
  hostPath:
    path: /mnt/data

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc-data
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi
  storageClassName: manual

6.3 StorageClass

1
2
3
4
5
6
7
8
9
10
11
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: fast
provisioner: kubernetes.io/aws-ebs
parameters:
  type: gp2
  fsType: ext4
reclaimPolicy: Retain
allowVolumeExpansion: true
volumeBindingMode: WaitForFirstConsumer

7. 配置管理

7.1 ConfigMap

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  app.properties: |
    server.port=8080
    database.host=mysql
  LOG_LEVEL: INFO
  ENVIRONMENT: production

---
# 使用 ConfigMap
apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  containers:
  - name: my-container
    image: myapp
    envFrom:
    - configMapRef:
        name: app-config
    volumeMounts:
    - name: config
      mountPath: /etc/config
  volumes:
  - name: config
    configMap:
      name: app-config

7.2 Secret

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
apiVersion: v1
kind: Secret
metadata:
  name: db-secret
type: Opaque
data:
  username: YWRtaW4=  # base64 encoded
  password: cGFzc3dvcmQxMjM=

---
# 使用 Secret
apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  containers:
  - name: my-container
    image: myapp
    env:
    - name: DB_USERNAME
      valueFrom:
        secretKeyRef:
          name: db-secret
          key: username
    - name: DB_PASSWORD
      valueFrom:
        secretKeyRef:
          name: db-secret
          key: password

8. 集群监控

8.1 Metrics Server

1
2
3
4
5
6
# 安装 Metrics Server
kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml

# 查看资源使用
kubectl top nodes
kubectl top pods

8.2 Prometheus + Grafana

1
2
3
4
5
6
# 使用 Helm 安装
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm install monitoring prometheus-community/kube-prometheus-stack -n monitoring --create-namespace

# 访问 Grafana
kubectl port-forward svc/monitoring-grafana -n monitoring 3000:80

8.3 日志收集

1
2
3
4
5
6
# 使用 EFK Stack
# Elasticsearch + Fluentd + Kibana

# 或使用 Loki + Promtail
helm repo add grafana https://grafana.github.io/helm-charts
helm install loki grafana/loki-stack -n logging --create-namespace

9. 故障排查

9.1 常见问题

Pod 无法启动

1
2
3
4
5
6
7
8
9
10
# 查看 Pod 状态
kubectl get pods -o wide
kubectl describe pod <pod-name>

# 查看日志
kubectl logs <pod-name>
kubectl logs <pod-name> --previous

# 检查事件
kubectl get events --sort-by='.lastTimestamp'

Pod 处于 Pending 状态

1
2
3
4
5
6
# 检查资源
kubectl describe pod <pod-name>
kubectl top nodes

# 检查调度
kubectl get events | grep <pod-name>

节点 NotReady

1
2
3
4
5
6
7
8
9
# 检查节点状态
kubectl describe node <node-name>

# 检查 kubelet
systemctl status kubelet
journalctl -u kubelet -f

# 检查网络
kubectl get pods -n kube-system -o wide

9.2 调试工具

1
2
3
4
5
6
7
8
# 临时调试容器
kubectl debug -it <pod-name> --image=busybox

# 创建调试 Pod
kubectl run -it --rm debug --image=busybox --restart=Never

# 网络调试
kubectl run -it --rm netshoot --image=nicolaka/netshoot --restart=Never

10. 备份与恢复

10.1 etcd 备份

1
2
3
4
5
6
7
8
9
10
# 备份 etcd
ETCDCTL_API=3 etcdctl snapshot save snapshot.db \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key

# 恢复 etcd
ETCDCTL_API=3 etcdctl snapshot restore snapshot.db \
  --data-dir=/var/lib/etcd-restore

10.2 资源备份

1
2
3
4
5
6
7
8
9
10
# 备份所有资源
kubectl get all --all-namespaces -o yaml > all-resources.yaml

# 备份特定命名空间
kubectl get all -n <namespace> -o yaml > namespace-resources.yaml

# 使用 velero
velero backup create daily-backup --include-namespaces default,production
velero backup get
velero restore create --from-backup daily-backup

文档版本: 1.0
最后更新: 2026-02-27
适用版本: Kubernetes 1.23+