389 lines
7.6 KiB
Markdown
389 lines
7.6 KiB
Markdown
# Kubernetes 部署完整指南
|
||
|
||
Kubernetes 作为容器编排的事实标准，已经成为现代云原生应用部署的核心技术。本指南将从零开始，详细介绍 Kubernetes 集群的搭建、应用部署和服务管理的完整流程。
|
||
|
||
## 概述
|
||
|
||
Kubernetes 是一个开源的容器编排平台，它能够自动化部署、扩展和管理容器化应用程序。通过 Kubernetes，您可以轻松管理大规模的容器集群，实现高可用性、自动扩展和滚动更新等企业级特性。
|
||
|
||
## 前置要求
|
||
|
||
### 1. 系统要求
|
||
- **操作系统**: Ubuntu 20.04+ / CentOS 7+ / RHEL 7+
|
||
- **CPU**: 至少 2 核
|
||
- **内存**: 至少 4GB RAM
|
||
- **存储**: 至少 20GB 可用空间
|
||
- **网络**: 稳定的网络连接
|
||
|
||
### 2. 软件依赖
|
||
- Docker 20.10+ 或 containerd 1.4+
|
||
- 支持的内核版本 (3.10+)
|
||
- 禁用 swap 分区
|
||
- 配置防火墙规则
|
||
|
||
## 集群搭建
|
||
|
||
### 1. 安装 Docker
|
||
|
||
```bash
|
||
# Ubuntu/Debian
|
||
sudo apt-get update
|
||
sudo apt-get install -y docker.io
|
||
sudo systemctl enable docker
|
||
sudo systemctl start docker
|
||
|
||
# CentOS/RHEL
|
||
sudo yum install -y docker
|
||
sudo systemctl enable docker
|
||
sudo systemctl start docker
|
||
```
|
||
|
||
### 2. 安装 Kubernetes 组件
|
||
|
||
```bash
|
||
# 添加 Kubernetes 源
|
||
curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add -
|
||
echo "deb https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list
|
||
|
||
# 安装 kubeadm, kubelet 和 kubectl
|
||
sudo apt-get update
|
||
sudo apt-get install -y kubelet kubeadm kubectl
|
||
sudo apt-mark hold kubelet kubeadm kubectl
|
||
```
|
||
|
||
### 3. 初始化主节点
|
||
|
||
```bash
|
||
# 初始化集群
|
||
sudo kubeadm init --pod-network-cidr=10.244.0.0/16
|
||
|
||
# 配置 kubectl
|
||
mkdir -p $HOME/.kube
|
||
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
|
||
sudo chown $(id -u):$(id -g) $HOME/.kube/config
|
||
|
||
# 安装网络插件 (Flannel)
|
||
kubectl apply -f https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml
|
||
```
|
||
|
||
### 4. 添加工作节点
|
||
|
||
```bash
|
||
# 在主节点上生成加入命令
|
||
kubeadm token create --print-join-command
|
||
|
||
# 在工作节点上执行加入命令
|
||
sudo kubeadm join <master-ip>:6443 --token <token> --discovery-token-ca-cert-hash <hash>
|
||
```
|
||
|
||
## 应用部署
|
||
|
||
### 1. 创建命名空间
|
||
|
||
```yaml
|
||
# namespace.yaml
|
||
apiVersion: v1
|
||
kind: Namespace
|
||
metadata:
|
||
name: myapp
|
||
labels:
|
||
name: myapp
|
||
```
|
||
|
||
```bash
|
||
kubectl apply -f namespace.yaml
|
||
```
|
||
|
||
### 2. 部署应用
|
||
|
||
#### 2.1 使用 Deployment
|
||
|
||
```yaml
|
||
# deployment.yaml
|
||
apiVersion: apps/v1
|
||
kind: Deployment
|
||
metadata:
|
||
name: nginx-deployment
|
||
namespace: myapp
|
||
spec:
|
||
replicas: 3
|
||
selector:
|
||
matchLabels:
|
||
app: nginx
|
||
template:
|
||
metadata:
|
||
labels:
|
||
app: nginx
|
||
spec:
|
||
containers:
|
||
- name: nginx
|
||
image: nginx:1.21
|
||
ports:
|
||
- containerPort: 80
|
||
resources:
|
||
requests:
|
||
memory: "64Mi"
|
||
cpu: "250m"
|
||
limits:
|
||
memory: "128Mi"
|
||
cpu: "500m"
|
||
```
|
||
|
||
#### 2.2 使用 Service 暴露服务
|
||
|
||
```yaml
|
||
# service.yaml
|
||
apiVersion: v1
|
||
kind: Service
|
||
metadata:
|
||
name: nginx-service
|
||
namespace: myapp
|
||
spec:
|
||
selector:
|
||
app: nginx
|
||
ports:
|
||
- protocol: TCP
|
||
port: 80
|
||
targetPort: 80
|
||
type: ClusterIP
|
||
```
|
||
|
||
#### 2.3 使用 Ingress 配置外部访问
|
||
|
||
```yaml
|
||
# ingress.yaml
|
||
apiVersion: networking.k8s.io/v1
|
||
kind: Ingress
|
||
metadata:
|
||
name: nginx-ingress
|
||
namespace: myapp
|
||
annotations:
|
||
nginx.ingress.kubernetes.io/rewrite-target: /
|
||
spec:
|
||
rules:
|
||
- host: myapp.example.com
|
||
http:
|
||
paths:
|
||
- path: /
|
||
pathType: Prefix
|
||
backend:
|
||
service:
|
||
name: nginx-service
|
||
port:
|
||
number: 80
|
||
```
|
||
|
||
### 3. 应用配置管理
|
||
|
||
#### 3.1 使用 ConfigMap
|
||
|
||
```yaml
|
||
# configmap.yaml
|
||
apiVersion: v1
|
||
kind: ConfigMap
|
||
metadata:
|
||
name: app-config
|
||
namespace: myapp
|
||
data:
|
||
app.properties: |
|
||
database.url=jdbc:mysql://mysql:3306/myapp
|
||
cache.enabled=true
|
||
log.level=INFO
|
||
```
|
||
|
||
#### 3.2 使用 Secret
|
||
|
||
```yaml
|
||
# secret.yaml
|
||
apiVersion: v1
|
||
kind: Secret
|
||
metadata:
|
||
name: app-secret
|
||
namespace: myapp
|
||
type: Opaque
|
||
data:
|
||
username: YWRtaW4= # admin
|
||
password: cGFzc3dvcmQ= # password
|
||
```
|
||
|
||
## 服务管理
|
||
|
||
### 1. 扩缩容
|
||
|
||
```bash
|
||
# 手动扩缩容
|
||
kubectl scale deployment nginx-deployment --replicas=5
|
||
|
||
# 自动扩缩容 (HPA)
|
||
kubectl autoscale deployment nginx-deployment --cpu-percent=50 --min=1 --max=10
|
||
```
|
||
|
||
### 2. 滚动更新
|
||
|
||
```bash
|
||
# 更新镜像
|
||
kubectl set image deployment/nginx-deployment nginx=nginx:1.22
|
||
|
||
# 查看更新状态
|
||
kubectl rollout status deployment/nginx-deployment
|
||
|
||
# 回滚到上一个版本
|
||
kubectl rollout undo deployment/nginx-deployment
|
||
```
|
||
|
||
### 3. 健康检查
|
||
|
||
```yaml
|
||
# 在 Deployment 中添加健康检查
|
||
spec:
|
||
template:
|
||
spec:
|
||
containers:
|
||
- name: nginx
|
||
image: nginx:1.21
|
||
livenessProbe:
|
||
httpGet:
|
||
path: /
|
||
port: 80
|
||
initialDelaySeconds: 30
|
||
periodSeconds: 10
|
||
readinessProbe:
|
||
httpGet:
|
||
path: /
|
||
port: 80
|
||
initialDelaySeconds: 5
|
||
periodSeconds: 5
|
||
```
|
||
|
||
## 监控与日志
|
||
|
||
### 1. 资源监控
|
||
|
||
```bash
|
||
# 查看节点资源使用情况
|
||
kubectl top nodes
|
||
|
||
# 查看 Pod 资源使用情况
|
||
kubectl top pods
|
||
|
||
# 查看命名空间资源使用情况
|
||
kubectl top pods --namespace=myapp
|
||
```
|
||
|
||
### 2. 日志管理
|
||
|
||
```bash
|
||
# 查看 Pod 日志
|
||
kubectl logs <pod-name> -n myapp
|
||
|
||
# 实时跟踪日志
|
||
kubectl logs -f <pod-name> -n myapp
|
||
|
||
# 查看多个容器的日志
|
||
kubectl logs <pod-name> -c <container-name> -n myapp
|
||
```
|
||
|
||
### 3. 事件监控
|
||
|
||
```bash
|
||
# 查看集群事件
|
||
kubectl get events --sort-by='.lastTimestamp'
|
||
|
||
# 查看特定命名空间的事件
|
||
kubectl get events -n myapp --sort-by='.lastTimestamp'
|
||
```
|
||
|
||
## 故障排除
|
||
|
||
### 1. 常见问题诊断
|
||
|
||
#### Pod 无法启动
|
||
```bash
|
||
# 查看 Pod 状态
|
||
kubectl describe pod <pod-name> -n myapp
|
||
|
||
# 查看 Pod 日志
|
||
kubectl logs <pod-name> -n myapp
|
||
|
||
# 检查节点资源
|
||
kubectl describe node <node-name>
|
||
```
|
||
|
||
#### 服务无法访问
|
||
```bash
|
||
# 检查 Service 配置
|
||
kubectl get svc -n myapp
|
||
|
||
# 检查 Endpoints
|
||
kubectl get endpoints -n myapp
|
||
|
||
# 测试网络连通性
|
||
kubectl run test-connection --image=busybox --rm -it --restart=Never -- nslookup nginx-service
|
||
```
|
||
|
||
### 2. 性能优化
|
||
|
||
#### 资源限制
|
||
```yaml
|
||
resources:
|
||
requests:
|
||
memory: "64Mi"
|
||
cpu: "250m"
|
||
limits:
|
||
memory: "128Mi"
|
||
cpu: "500m"
|
||
```
|
||
|
||
#### 节点亲和性
|
||
```yaml
|
||
affinity:
|
||
nodeAffinity:
|
||
requiredDuringSchedulingIgnoredDuringExecution:
|
||
nodeSelectorTerms:
|
||
- matchExpressions:
|
||
- key: kubernetes.io/os
|
||
operator: In
|
||
values:
|
||
- linux
|
||
```
|
||
|
||
## 最佳实践
|
||
|
||
### 1. 安全性
|
||
- 使用 RBAC 控制访问权限
|
||
- 定期更新 Kubernetes 版本
|
||
- 启用 Pod 安全策略
|
||
- 使用网络策略限制 Pod 间通信
|
||
|
||
### 2. 可靠性
|
||
- 配置多个副本确保高可用
|
||
- 使用反亲和性分散 Pod 分布
|
||
- 实施健康检查和自动恢复
|
||
- 配置资源限制防止资源耗尽
|
||
|
||
### 3. 可维护性
|
||
- 使用标签和注解组织资源
|
||
- 实施基础设施即代码 (IaC)
|
||
- 建立监控和告警体系
|
||
- 定期备份集群配置
|
||
|
||
## 总结
|
||
|
||
Kubernetes 提供了强大的容器编排能力，但同时也带来了复杂性和学习成本。通过本指南的学习，您应该能够：
|
||
|
||
1. 搭建一个基本的 Kubernetes 集群
|
||
2. 部署和管理容器化应用
|
||
3. 配置网络和服务发现
|
||
4. 实施监控和故障排除
|
||
5. 遵循最佳实践确保生产环境的稳定性
|
||
|
||
记住，Kubernetes 是一个不断发展的平台，建议您：
|
||
- 保持对最新版本的关注
|
||
- 参与社区讨论和贡献
|
||
- 在实际项目中积累经验
|
||
- 持续学习和改进
|
||
|
||
---
|
||
|
||
*本文由 CloudPro 技术团队编写，如有疑问请联系我们。*
|