Kubernetes 集成的全面指南

独隅

已于 2025-04-15 16:53:07 修改

阅读量1.2k

点赞数 19

分类专栏：服务器运维 Kubernetes 文章标签： kubernetes 容器云原生

于 2025-03-17 14:29:43 首次发布

本文链接：https://blog.youkuaiyun.com/qq_45657541/article/details/146314448

版权

运维同时被 3 个专栏收录

115 篇文章

订阅专栏

服务器

34 篇文章

订阅专栏

Kubernetes

17 篇文章

订阅专栏

在这里插入图片描述

以下是 Kubernetes 集成的全面指南，涵盖部署、网络、存储、监控等核心场景，结合实战示例和云平台适配方案！

一、Kubernetes 基础集成

1. 部署首个应用

使用 Helm Charts

# 安装 Helm
curl -L https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash

# 部署 Nginx
helm install nginx stable/nginx

# 查看部署状态
kubectl get pods -w

手动创建 Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  replicas: 3
  template:
    spec:
      containers:
      - name: my-container
        image: my-image:latest
        ports:
        - containerPort: 8080

kubectl apply -f deployment.yaml

2. 服务暴露与负载均衡

Ingress 配置

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: my-app
            port:
              number: 8080

kubectl apply -f ingress.yaml

Service 配置

apiVersion: v1
kind: Service
metadata:
  name: my-app
spec:
  selector:
    app: my-app
  ports:
    - protocol: TCP
      port: 80
      targetPort: 8080
  type: LoadBalancer  # 自动分配公网 IP（云环境）

二、云平台集成

1. AWS EKS 集成

创建集群

# 安装 eksctl
curl -LO "https://eksctl.io/install-eksctl.sh"
chmod +x install-eksctl.sh
./install-eksctl.sh

# 创建集群（自动配置 VPC、IAM 等）
eksctl create cluster \
  --name my-eks-cluster \
  --region us-west-2 \
  --nodes 3

配置 AWS 安全组

apiVersion: v1
kind: NetworkPolicy
metadata:
  name: allow-ssh
spec:
  podSelector:
    matchLabels:
      app: my-app
  ingress:
  - from:
    - ipBlock:
        cidr: 10.0.0.0/8  # 允许私有网络访问
    ports:
    - protocol: TCP
      port: 22

2. GCP GKE 集成

创建集群

gcloud config set project my-gcp-project
gcloud container clusters create my-gke-cluster \
  --zone us-central1-a \
  --num-nodes 3

启用 Cloud Armor 防火墙

# 创建防火墙规则允许 HTTP/HTTPS
gcloud compute firewall-rules create \
  --project my-gcp-project \
  --network my-gke-cluster \
  --name allow-http-https \
  --priority 1000 \
  --direction inbound \
  --protocol tcp \
  --ports 80,443 \
  --action allow \
  --source-ranges 0.0.0.0/0

三、核心功能集成

1. 持久化存储

PersistentVolumeClaim (PVC)

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: my-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi

StorageClass 配置（AWS EBS）

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: fast-ebs
provisioner: kubernetes.io/aws-ebs
parameters:
  type: gp3
  zone: us-west-2a

2. 监控与日志

集成 Prometheus 和 Grafana

# 安装 Prometheus
kubectl apply -f https://raw.githubusercontent.com/prometheus-community/helm-charts/prometheus-server/master/values.yaml

# 配置 ServiceMonitor
kubectl apply -f https://raw.githubusercontent.com/prometheus-community/helm-charts/prometheus-server/master/examples/service-monitor.yaml

日志收集（Fluentd + Elasticsearch）

apiVersion: logging.fluentd.org/v1alpha1
kind: FluentdConfig
metadata:
  name: my-fluentd
spec:
  configMap:
    data:
      fluent.conf: |
        <source>
          @type tail
          path /var/log/containers/*.log
          pos_file /var/log/fluentd-containers.pos
        </source>
        <match >
          @type elasticsearch
          host elasticsearch-host
          port 9200
        </match>

3. CI/CD 集成

GitOps 工作流（Argo CD）

# 安装 Argo CD
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# 创建应用配置
kubectl create configmap argocd-app-config \
  --from-file=app.yaml

Jenkins Pipeline 示例

pipeline {
  agent any
  stages {
    stage('Build') {
      steps {
        sh 'docker build -t my-app:latest .'
      }
    }
    stage('Deploy') {
      steps {
        withKubeConfig([credentialsId: 'my-kubernetes-creds']) {
          sh 'kubectl apply -f deployment.yaml'
        }
      }
    }
  }
}

四、高级场景

1. 多集群管理

使用 Kubespray

# 安装 Kubespray
curl -L https://github.com/kubernetes-sigs/kubespray/releases/download/v1.26.0/kubespray-v1.26.0-$(uname -s)-$(uname -m).tar.gz | tar -xzC /opt
cd /opt/kubespray-v1.26.0
./install.sh --cluster-name my-multi-cluster --provider cloud --cloud-provider aws

2. 服务网格（Istio）集成

apiVersion: install.k8s.io/istio
kind: IstioOperator
spec:
  profile: default
  components:
    pilot:
      k8s:
        resources:
          requests:
            memory: "100Mi"
            cpu: "50m"

kubectl apply -f istio-operator.yaml

3. 动态扩缩容

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: my-app-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: my-app
  minReplicas: 3
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70

五、调试与优化

1. 查看集群状态

kubectl cluster-info
kubectl get nodes -o wide

2. 分析性能瓶颈

# 使用 kubectl top
kubectl top pods --namespace=default

# 获取节点详细信息
kubectl describe node <node-name>

3. 优化资源配额

apiVersion: v1
kind: ResourceQuota
metadata:
  name: team-a-quota
spec:
  hard:
    requests.cpu: "10"
    requests.memory: 20Gi
    limits.cpu: "20"
    limits.memory: 40Gi

六、云原生工具链

1. 容器注册表集成

AWS ECR

# 创建 ECR 仓库
aws ecr create-repository --repository-name my-app

# 配置 Kubernetes 镜像拉取
kubectl create secret docker-registry my-ecr-secret \
  --docker-server=aws.ecr.aws \
  --docker-username=AWS_ACCOUNT_ID \
  --docker-password=$(aws ecr get-login-password --region us-west-2)

2. 安全扫描（Trivy）

# 安装 Trivy
curl -sfL https://github.com/aquasecurity/trivy/releases/download/v0.26.0/trivy_0.26.0_linux_amd64.tar.gz | tar -xzf -
sudo mv trivy /usr/local/bin/

# 扫描镜像
trivy image my-app:latest