Kubernetes实用命令及运维场景操作

最新推荐文章于 2025-12-08 21:38:07 发布

原创最新推荐文章于 2025-12-08 21:38:07 发布 · 353 阅读

5 ·

CC 4.0 BY-SA版权

文章标签：

#kubernetes #容器 #云原生 #运维

Kubernetes/K8S 专栏收录该内容

20 篇文章

订阅专栏

一.常用命令

1.统计deployment & image信息

$ kubectl get deploy -o custom-columns='NAME:.metadata.name,READY:.status.readyReplicas,UP-TO-DATE:.status.updatedReplicas,AVAILABLE:.status.availableReplicas,AGE:.metadata.creationTimestamp,IMAGES:.spec.template.spec.containers[*].image'

输出示例：

NAME                              READY    UP-TO-DATE   AVAILABLE   AGE                    IMAGES
cert-manager                      1        1            1           2025-05-30T07:01:33Z   quay.io/jetstack/cert-manager-controller:v1.17.2
cert-manager-cainjector           1        1            1           2025-05-30T07:01:32Z   quay.io/jetstack/cert-manager-cainjector:v1.17.2
cert-manager-webhook              1        1            1           2025-05-30T07:01:33Z   quay.io/jetstack/cert-manager-webhook:v1.17.2
app-a                             1        1            1           2025-05-30T07:51:37Z   nginx:alpine
app-b                             1        1            1           2025-05-30T07:54:38Z   nginx:alpine
drone-runner                      1        1            1           2025-07-02T04:01:13Z   drone/drone-runner-kube:latest
drone-server                      1        1            1           2025-07-01T09:52:39Z   drone/drone:2.17
ingress-nginx-controller          1        1            1           2025-11-15T08:31:52Z   registry.k8s.io/ingress-nginx/controller:v1.13.4@sha256:4042ae3c512c5d7bcf9682b0fdff96cd7b46a23dcbe15a762349094cd8087be7
coredns                           2        2            2           2025-05-04T16:06:29Z   registry.aliyuncs.com/google_containers/coredns:v1.12.0
metrics-server                    1        1            1           2025-05-15T06:54:04Z   registry.k8s.io/metrics-server/metrics-server:v0.7.2
nfs-subdir-external-provisioner   1        1            1           2025-05-08T12:14:54Z   registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.2

2.下线node节点

$ kubectl get node
$ kubectl cordon 10.151.1.32
$ kubectl drain 10.151.1.32 --ignore-daemonsets --delete-emptydir-data
$ kubectl describe node/10.151.1.32
#1.有autoscaler的集群(如AWS EKS、OCI OKE等)，可以观察cluster-autoscaler日志，等待节点自动下线
$ kubectl logs -f cluster-autoscaler-558b9bc664-d8929  -n kube-system
#2.自己管理的集群可以手动删除
$ kubectl delete node/10.151.1.32

3.修改deployment资源占用

$ kubectl patch deployment app-a --type='json'  -p='[{"op": "replace", "path": "/spec/template/spec/containers/0/resources/requests/cpu", "value": "125m"},{"op": "replace", "path": "/spec/template/spec/containers/0/resources/requests/memory", "value": "256Mi"} ]'

4.临时删除/启动pod

$ kubectl scale deployments/app-a --replicas=0
$ kubectl scale deployments/app-a --replicas=1

5.查看pod的实际cpu和内存占用示例

#查看request和limit数值
$ kubectl get pod app-a-776f8bb486-zxhk4  -o jsonpath="{.spec.containers[*].resources}"

输出示例：

{"limits":{"cpu":"2","memory":"2Gi"},"requests":{"cpu":"250m","memory":"512Mi"}}

#查看实际占用
$ kubectl top pod

输出示例：

NAME                        CPU(cores)   MEMORY(bytes)   
app-a-776f8bb486-zxhk4      0m           5Mi             
app-b-6c6878fc5b-tbz5d      0m           2Mi             
cm-acme-http-solver-247nx   1m           2Mi             
cm-acme-http-solver-rcnbr   1m           2Mi

6.开启debug模式

$ kubectl debug -it app-a-776f8bb486-zxhk4  --image=nicolaka/netshoot

输出示例：

--profile=legacy is deprecated and will be removed in the future. It is recommended to explicitly specify a profile, for example "--profile=general".
Defaulting debug container name to debugger-dxhp7.
If you don't see a command prompt, try pressing enter.
                    dP            dP                           dP   
                    88            88                           88   
88d888b. .d8888b. d8888P .d8888b. 88d888b. .d8888b. .d8888b. d8888P 
88'  `88 88ooood8   88   Y8ooooo. 88'  `88 88'  `88 88'  `88   88   
88    88 88.  ...   88         88 88    88 88.  .88 88.  .88   88   
dP    dP `88888P'   dP   `88888P' dP    dP `88888P' `88888P'   dP   
                                                                    
Welcome to Netshoot! (github.com/nicolaka/netshoot)
Version: 0.14

 app-a-776f8bb486-zxhk4 > ~ >

7.查看集群信息

$ kubectl cluster-info
$ kubectl version
$ kubectl api-resources
$ kubectl api-versions

8.查看日志

#查看pod日志
$ kubectl logs <pod> -n <ns> -f
$ kubectl logs <pod> -n <ns> --tail=200
#查看特定容器日志
$ kubectl logs <pod> -c <container> -n <ns> -f
#查看event日志
$ kubectl get events -A --sort-by=.metadata.creationTimestamp

二.运维场景操作

1.Pod中临时阻断某些IP的tcp链接

先在Pod中测试网络连通性(网络可达)：

$ kubectl exec -it app-a-645cb9b896-mxpx2 -n ns-01 -- /bin/sh
/ # nc -vz 204.75.143.83 443
204.75.143.83 (204.75.143.83:443) open
/ # nc -vz 52.18.223.17 443
52.18.223.17 (52.18.223.17:443) open
/ # nc -vz 34.250.86.73 443
34.250.86.73 (34.250.86.73:443) open

找到Pod的容器ID和Pod运行的Node节点:

$ kubectl get pod app-a-645cb9b896-mxpx2 -n ns-01 -o jsonpath='{.status.containerStatuses[0].containerID}' | cut -d '/' -f 3
$ kubectl get pod -n ns-01 app-a-645cb9b896-mxpx2 -o wide

ssh到node节点上：

$ ssh -i ~/key/my-demo-k8s.pem demo@xxxxxx

找到容器的PID：

$ crictl inspect -o go-template --template '{{.info.pid}}' [第一步查询到的containerID]

在node节点上进入容器的网络命名空间：

$ nsenter -t [第3步查询到的PID] -n

在网络命名空间添加iptables规则：

# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination               

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination 

# iptables -A OUTPUT -d 34.250.86.73 -j DROP
# iptables -A OUTPUT -d 52.18.223.17 -j DROP
# iptables -A OUTPUT -d 204.75.143.83 -j DROP
# iptables -A INPUT -s 34.250.86.73 -j DROP
# iptables -A INPUT -s 52.18.223.17 -j DROP
# iptables -A INPUT -s 204.75.143.83 -j DROP

再次在Pod中测试网络连通性(没有响应，网络阻断)：

$ kubectl exec -it app-a-645cb9b896-mxpx2 -n ns-01 -- /bin/sh
/ # nc -vz 204.75.143.83 443
/ # nc -vz 52.18.223.17 443
/ # nc -vz 34.250.86.73 443

在node节点上进入容器的网络命名空间，恢复对iptables的操作：

# iptables -L
# iptables -D OUTPUT -d 34.250.86.73 -j DROP
# iptables -D OUTPUT -d 52.18.223.17 -j DROP
# iptables -D OUTPUT -d 204.75.143.83 -j DROP
# iptables -D INPUT -s 34.250.86.73 -j DROP
# iptables -D INPUT -s 52.18.223.17 -j DROP
# iptables -D INPUT -s 204.75.143.83 -j DROP
# iptables -L

最后在Pod中测试网络连通性(网络再次可达)：

$ kubectl exec -it app-a-645cb9b896-mxpx2 -n ns-01 -- /bin/sh
/ # nc -vz 204.75.143.83 443
204.75.143.83 (204.75.143.83:443) open
/ # nc -vz 52.18.223.17 443
52.18.223.17 (52.18.223.17:443) open
/ # nc -vz 34.250.86.73 443
34.250.86.73 (34.250.86.73:443) open

2.只有指定的Deployment可以操作某些资源

以AWS EKS为示例，要求有且只有某个业务的容器能创建AWS KMS：

手动创建iam policy:demo-kms-service-policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowCreateKeyWithTag",
            "Effect": "Allow",
            "Action": [
                "kms:TagResource",
                "kms:CreateKey"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:RequestTag/CreatedBy": "app-a-service"
                }
            }
        },
        {
            "Sid": "AllowUseKeysWithAliasPrefix",
            "Effect": "Allow",
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:GetPublicKey",
                "kms:PutKeyPolicy",
                "kms:GetKeyPolicy",
                "kms:ListResourceTags"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/CreatedBy": "app-a-service"
                }
            }
        }
    ]
}

将demo-kms-service-policy挂载到新建的iam role：demo-kms-service-role 并且role的信任关系如下：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::xxxxxx:oidc-provider/oidc.eks.ap-xxxxxx-1.amazonaws.com/id/xxxxxx"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "oidc.eks.ap-xxxxxx-1.amazonaws.com/id/xxxxxx:sub": [
                        "system:serviceaccount:default:app-a-service-account",
                        "system:serviceaccount:ns-01:app-a-service-account"
                    ]
                }
            }
        }
    ]
}

新建service account : app-a-service-account 并挂载到app-a-service的deployment中：

apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-a-service-account
  namespace: default
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::xxxxxx:role/demo-kms-service-role

部署deployment后，确定身份是否为IRSA使用的Role,而不是node节点上的role

$ cd /test/serviceaccount-selfcontrol-test
$ kubectl exec -it testonly-8479f77456-czqzf -- /bin/sh
sh-4.2# aws sts get-caller-identity
{
    "UserId": "AROATBWVUZE5YGR25Y2HV:botocore-session-1753154494",
    "Account": "xxxxxx",
    "Arn": "arn:aws:sts::xxxxxx:assumed-role/demo-kms-service-role/botocore-session-1753154494"
}

以上输出说明配置已经成功；然后执行如下操作，验证一下iam policy中的tag限制：

#测试创建不带tag的key，失败,符合预期
$ aws kms create-key --key-spec ECC_SECG_P256K1 --key-usage SIGN_VERIFY --output json

An error occurred (AccessDeniedException) when calling the CreateKey operation: User: arn:aws:sts::xxxxxx:assumed-role/demo-kms-service-role/botocore-session-1753157237 is not authorized to perform: kms:CreateKey on resource: * because no identity-based policy allows the kms:CreateKey action
#测试创建带tag的key，成功,符合预期
$ aws kms create-key --key-spec ECC_SECG_P256K1 --key-usage SIGN_VERIFY --tags TagKey=CreatedBy,TagValue=app-a-service --output json
{
    "KeyMetadata": {
        "AWSAccountId": "xxxxxx",
        "KeyId": "b00e5ea1-b053-4427-ba4e-48d0d6445144",
        "Arn": "arn:aws:kms:ap-xxxxxx-1:xxxxxx:key/b00e5ea1-b053-4427-ba4e-48d0d6445144",
        "CreationDate": "2025-07-22T03:33:15.278000+00:00",
        "Enabled": true,
        "Description": "",
        "KeyUsage": "SIGN_VERIFY",
        "KeyState": "Enabled",
        "Origin": "AWS_KMS",
        "KeyManager": "CUSTOMER",
        "CustomerMasterKeySpec": "ECC_SECG_P256K1",
        "KeySpec": "ECC_SECG_P256K1",
        "SigningAlgorithms": [
            "ECDSA_SHA_256"
        ],
        "MultiRegion": false
    }
}