云原生——k8s的pod管理及优化

1 kubernetes 中的资源

1.1 资源管理方式

命令式对象管理：直接使用命令去操作kubernetes资源

kubectl run nginx-pod --image=nginx:latest --port=80

命令式对象配：通过命令配置和配置文件去操作kubernetes资源

kubectl create/patch -f nginx-pod.yaml

声明式对象配置：通过apply命令和配置文件去操作kubernetes资源

kubectl apply -f nginx-pod.yaml

1.2 常用的资源类型

1.3 kubectl 常见命令操作

1.4 基础命令示例

命名空间管理

复制代码

[root@k8s-master ~]# kubectl get namespaces
NAME              STATUS   AGE
default           Active   2d22h
kube-flannel      Active   2d21h
kube-node-lease   Active   2d22h
kube-public       Active   2d22h
kube-system       Active   2d22h


#创建命名空间
[root@k8s-master ~]# kubectl create namespace timinglee
namespace/timinglee created
[root@k8s-master ~]# kubectl get namespaces
NAME              STATUS   AGE
default           Active   2d22h
kube-flannel      Active   2d21h
kube-node-lease   Active   2d22h
kube-public       Active   2d22h
kube-system       Active   2d22h
timinglee         Active   4s


#删除命名空间
[root@k8s-master ~]# kubectl delete namespaces timinglee 
namespace "timinglee" deleted
[root@k8s-master ~]# kubectl get namespaces 
NAME              STATUS   AGE
default           Active   2d22h
kube-flannel      Active   2d21h
kube-node-lease   Active   2d22h
kube-public       Active   2d22h
kube-system       Active   2d22h

pod的管理------自助式创建pod（生产不推荐）

bash 复制代码

#查看pod在哪里运行
#-o wied 是看pod的IP和标签
[root@k8s-master ~]# kubectl get pods -o wide
No resources found in default namespace.

#创建pod------在创建时所用的镜像必须是docker中所有的镜像，不然pods无法运行成功
[root@k8s-master ~]# kubectl run lee --image nginx:1.26
pod/lee created
[root@k8s-master ~]# kubectl get pods
NAME   READY   STATUS    RESTARTS   AGE
lee    1/1     Running   0          11s

#创建失败的案例
[root@k8s-master ~]#  kubectl run  error --image lee:v1
pod/error created
[root@k8s-master ~]# kubectl get pods -o wide
NAME    READY   STATUS              RESTARTS   AGE    IP           NODE        NOMINATED NODE   READINESS GATES
error   0/1     ContainerCreating   0          4s     <none>       k8s-node2   <none>           <none>  #这里就能看出来running无法运行
lee     1/1     Running             0          106s   10.244.2.4   k8s-node2   <none>           <none>

#查看pod的详细详细信息------这样就能通过情况来看失败原因
[root@k8s-master ~]# kubectl describe  pods  error  

#删除pod
[root@k8s-master ~]# kubectl delete  pods error
pod "error" deleted from default namespace
#--all是对于所有的pod进行删除
[root@k8s-master ~]# kubectl delete pods --all
pod "lee" deleted from default namespace

1.5 kubectl 命令实操

准备环境

2 利用控制器管理pod（推荐）

高可用性和可靠性：

自动故障恢复：如果一个 Pod 失败或被删除，控制器会自动创建新的 Pod 来维持期望的副本数量。确保应用始终处于可用状态，减少因单个 Pod 故障导致的服务中断。
健康检查和自愈：可以配置控制器对 Pod 进行健康检查（如存活探针和就绪探针）。如果 Pod 不健康，控制器会采取适当的行动，如重启 Pod 或删除并重新创建它，以保证应用的正常运行。

可扩展性：

轻松扩缩容：可以通过简单的命令或配置更改来增加或减少 Pod 的数量，以满足不同的工作负载需求。例如，在高流量期间可以快速扩展以处理更多请求，在低流量期间可以缩容以节省资源。
水平自动扩缩容（HPA）：可以基于自定义指标（如 CPU 利用率、内存使用情况或应用特定的指标）自动调整 Pod 的数量，实现动态的资源分配和成本优化。

版本管理和更新：

滚动更新：对于 Deployment 等控制器，可以执行滚动更新来逐步替换旧版本的 Pod 为新版本，确保应用在更新过程中始终保持可用。可以控制更新的速率和策略，以减少对用户的影响。
回滚：如果更新出现问题，可以轻松回滚到上一个稳定版本，保证应用的稳定性和可靠性。

声明式配置：

简洁的配置方式：使用 YAML 或 JSON 格式的声明式配置文件来定义应用的部署需求。这种方式使得配置易于理解、维护和版本控制，同时也方便团队协作。
期望状态管理：只需要定义应用的期望状态（如副本数量、容器镜像等），控制器会自动调整实际状态与期望状态保持一致。无需手动管理每个 Pod 的创建和删除，提高了管理效率。

服务发现和负载均衡：

自动注册和发现：Kubernetes 中的服务（Service）可以自动发现由控制器管理的 Pod，并将流量路由到它们。这使得应用的服务发现和负载均衡变得简单和可靠，无需手动配置负载均衡器。
流量分发：可以根据不同的策略（如轮询、随机等）将请求分发到不同的 Pod，提高应用的性能和可用性。

多环境一致性：

一致的部署方式：在不同的环境（如开发、测试、生产）中，可以使用相同的控制器和配置来部署应用，确保应用在不同环境中的行为一致。这有助于减少部署差异和错误，提高开发和运维效率。

2.1 kubectl命名的使用方法

Deployment 是 Kubernetes 中用于管理无状态应用的声明式控制器。它定义了应用的期望状态（如使用哪个镜像、运行多少个副本、如何更新等），并负责持续将实际状态调整为该期望状态。

create------通过文件或标准输入创建资源

bash 复制代码

#----replicas表示生成的pod的数量
[root@k8s-master ~]# kubectl create deployment webcluster --replicas 2 --image myapp:v1
deployment.apps/webcluster created
[root@k8s-master ~]# kubectl get deployments.apps 
NAME         READY   UP-TO-DATE   AVAILABLE   AGE
webcluster   2/2     2            2           11s
[root@k8s-master ~]# kubectl get pods
NAME                          READY   STATUS    RESTARTS   AGE
webcluster-77c87d9946-2t9gt   1/1     Running   0          21s
webcluster-77c87d9946-9nqd7   1/1     Running   0          21s

#对于控制器进行删除
[root@k8s-master ~]# kubectl delete deployments.apps webcluster
deployment.apps "webcluster" deleted from default namespace
[root@k8s-master ~]# kubectl get pods
No resources found in default namespace.

edit------直接编辑集群中已存在的资源对象在线修改副本数或镜像版本

bash 复制代码

#实验环境的设定
[root@k8s-master ~]# kubectl create deployment webcluster --image myapp:v1
deployment.apps/webcluster created
[root@k8s-master ~]# kubectl get pods
NAME                          READY   STATUS    RESTARTS   AGE
webcluster-77c87d9946-5q8qb   1/1     Running   0          10s

#在线进行修改
[root@k8s-master ~]# kubectl edit deployments.apps webcluster

# Please edit the object below. Lines beginning with a '#' will be ignored,
# and an empty file will abort the edit. If an error occurs while saving this file will be
# reopened with the relevant failures.
#
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    deployment.kubernetes.io/revision: "1"
  creationTimestamp: "2026-08-25T13:00:55Z"
  generation: 1
  labels:
    app: webcluster
  name: webcluster
  namespace: default
  resourceVersion: "11712"
  uid: a9d28b1d-94f5-4524-b926-f62f7462424d
spec:
  progressDeadlineSeconds: 600
  replicas: 2  #对于pod数量进行修改

[root@k8s-master ~]# kubectl get pods
NAME                          READY   STATUS    RESTARTS   AGE
webcluster-77c87d9946-5q8qb   1/1     Running   0          2m7s
webcluster-77c87d9946-8dknp   1/1     Running   0          9s

patch------对资源进行局部字段更新，快速调整副本数

bash 复制代码

[root@k8s-master ~]# kubectl patch deployments.apps webcluster -p '{"spec":{"replicas":1}}'
deployment.apps/webcluster patched
[root@k8s-master ~]# kubectl get pods
NAME                          READY   STATUS    RESTARTS   AGE
webcluster-77c87d9946-5q8qb   1/1     Running   0          71m

expose------将 Deployment/Pod 暴露为 Service，创建内部/外部访问入口

bash 复制代码

[root@k8s-master ~]# kubectl expose deployment webcluster --port  80 --target-port 80
service/webcluster exposed
[root@k8s-master ~]#  kubectl get service
NAME         TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)   AGE
kubernetes   ClusterIP   10.96.0.1        <none>        443/TCP   3d
webcluster   ClusterIP   10.103.240.138   <none>        80/TCP    4s
[root@k8s-master ~]# kubectl describe  svc webcluster
Name:                     webcluster
Namespace:                default
Labels:                   app=webcluster
Annotations:              <none>
Selector:                 app=webcluster
Type:                     ClusterIP
IP Family Policy:         SingleStack
IP Families:              IPv4
IP:                       10.103.240.138
IPs:                      10.103.240.138
Port:                     <unset>  80/TCP
TargetPort:               80/TCP
Endpoints:                10.244.2.8:80     #这里就能看出暴露的端口
Session Affinity:         None
Internal Traffic Policy:  Cluster
Events:                   <none>

#测试------通过随机数访问pods
[root@k8s-master ~]# curl 10.103.240.138/hostname.html
webcluster-77c87d9946-5q8qb
[root@k8s-master ~]# curl 10.103.240.138/hostname.html
webcluster-77c87d9946-w94qj
[root@k8s-master ~]# curl 10.103.240.138/hostname.html
webcluster-77c87d9946-5q8qb

logs------查看 Pod 容器的日志输出

bash 复制代码

#能够实时追踪应用日志，排查错误
[root@k8s-master ~]# kubectl logs pods/webcluster-77c87d9946-5
error: error from server (NotFound): pods "webcluster-77c87d9946-5" not found in namespace "default"
[root@k8s-master ~]# kubectl logs pods/webcluster-77c87d9946-5q8qb 
10.244.0.0 - - [25/Aug/2026:14:15:30 +0000] "GET /hostname.html HTTP/1.1" 200 28 "-" "curl/7.76.1" "-"
10.244.0.0 - - [25/Aug/2026:14:15:32 +0000] "GET /hostname.html HTTP/1.1" 200 28 "-" "curl/7.76.1" "-"

attch------进入容器进程（不常用）

bash 复制代码

[root@k8s-master ~]# kubectl run -it testpod --image busybox:latest
All commands and output from this session will be recorded in container logs, including credentials and sensitive information passed through the command prompt.
If you don't see a command prompt, try pressing enter.
/ # 
/ # 
/ # Session ended, resume using 'kubectl attach testpod -c testpod -i -t' command when the pod is running  
#退出是ctrl+pq键

[root@k8s-master ~]# kubectl get pods
NAME      READY   STATUS    RESTARTS   AGE
testpod   1/1     Running   0          43s

[root@k8s-master ~]# kubectl attach pods/testpod -it
All commands and output from this session will be recorded in container logs, including credentials and sensitive information passed through the command prompt.
If you don't see a command prompt, try pressing enter.
/ # 
/ # 
/ # Session ended, resume using 'kubectl attach testpod -c testpod -i -t' command when the pod is running

#在进行下一个实验时可以删掉  --force能够加快交互的删掉
[root@k8s-master ~]# kubectl delete pods testpod --force 
Warning: Immediate deletion does not wait for confirmation that the running resource has been terminated. The resource may continue to run on the cluster indefinitely.
pod "testpod" force deleted from default namespace

exec------进入容器进程，在容器内执行命令（最常用调试手段）

bash 复制代码

[root@k8s-master ~]# kubectl run  testpod --image  nginx:1.26
pod/testpod created
[root@k8s-master ~]# kubectl get pods 
NAME      READY   STATUS    RESTARTS   AGE
testpod   1/1     Running   0          7s

[root@k8s-master ~]# kubectl exec -it pods/testpod -c testpod -- /bin/bash
root@testpod:/# 
#退出是输入exit

cp------在本地文件系统和容器之间复制文件

bash 复制代码

[root@k8s-master ~]# kubectl cp  testpod:/usr/share/nginx/html  /mnt/
tar: Removing leading `/' from member names

[root@k8s-master ~]# ls /mnt/
50x.html  hgfs  index.html  test
[root@k8s-master ~]# echo timinglee > /mnt/index.html
[root@k8s-master ~]# kubectl cp /mnt/index.html testpod:/usr/share/nginx/html/index.html
[root@k8s-master ~]# kubectl get pods  -o wide
NAME      READY   STATUS    RESTARTS   AGE   IP            NODE        NOMINATED NODE   READINESS GATES
testpod   1/1     Running   0          61s   10.244.2.14   k8s-node2   <none>           <none>
[root@k8s-master ~]# curl  10.244.2.14
timinglee

rollout------管理 Deployment/DaemonSet/StatefulSet 的发布过程

bash 复制代码

[root@k8s-master ~]# kubectl create deployment webcluster --image myapp:v1 --replicas 2 --dry-run=client -o yaml > webcluster.yml
[root@k8s-master ~]# vim webcluster.yml 
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: webcluster
  name: webcluster
spec:
  replicas: 2
  selector:
    matchLabels:
      app: webcluster
  template:
    metadata:
      labels:
        app: webcluster
    spec:
      containers:
      - image: myapp:v1
        name: myapp

#运行文件
[root@k8s-master ~]# kubectl apply -f webcluster.yml
deployment.apps/webcluster created
[root@k8s-master ~]# kubectl get deployments.apps
NAME         READY   UP-TO-DATE   AVAILABLE   AGE
webcluster   2/2     2            2           4s
[root@k8s-master ~]# kubectl get pods
NAME                          READY   STATUS    RESTARTS   AGE
webcluster-77c87d9946-tf425   1/1     Running   0          11s
webcluster-77c87d9946-zpmf5   1/1     Running   0          11s

#查看更新状态
[root@k8s-master ~]# kubectl rollout status  deployment webcluster
deployment "webcluster" successfully rolled out

#重启所有 Pod（常用于重新加载配置）
[root@k8s-master ~]# kubectl rollout  restart   deployment webcluster
deployment.apps/webcluster restarted
[root@k8s-master ~]# kubectl get pods
NAME                          READY   STATUS      RESTARTS   AGE
webcluster-84b55d6774-fj5b9   1/1     Running     0          2s
webcluster-84b55d6774-tdbv5   1/1     Running     0          3s
webcluster-b85f9b8f-j2qpv     0/1     Completed   0          32s

scale------手动扩缩容副本数应对突发流量或缩容节省资源

bash 复制代码

[root@k8s-master ~]# kubectl scale deployment webcluster --replicas 4
deployment.apps/webcluster scaled
[root@k8s-master ~]# kubectl get pods
NAME                          READY   STATUS    RESTARTS   AGE
webcluster-77c87d9946-hflrc   1/1     Running   0          9s
webcluster-77c87d9946-hm8qs   1/1     Running   0          4s
webcluster-77c87d9946-hpcm6   1/1     Running   0          9s
webcluster-77c87d9946-lwnnp   1/1     Running   0          4s
[root@k8s-master ~]# kubectl scale deployment webcluster --replicas 1
deployment.apps/webcluster scaled
[root@k8s-master ~]# kubectl get pods
NAME                          READY   STATUS    RESTARTS   AGE
webcluster-77c87d9946-hpcm6   1/1     Running   0          18s

label------为资源添加、修改或删除标签

bash 复制代码

[root@k8s-master ~]# kubectl get pods
NAME                          READY   STATUS    RESTARTS   AGE
webcluster-77c87d9946-hpcm6   1/1     Running   0          18s

#将标签删掉
[root@k8s-master ~]# kubectl label pods webcluster-77c87d9946-hpcm6 app-
pod/webcluster-77c87d9946-hpcm6 unlabeled

#标签删掉之后就会新生成一个pod
[root@k8s-master ~]# kubectl get pods 
NAME                          READY   STATUS    RESTARTS   AGE
webcluster-77c87d9946-7m8r9   1/1     Running   0          66s
webcluster-77c87d9946-hpcm6   1/1     Running   0          2m47s

#将标签恢复后，新加的ood消失
[root@k8s-master ~]# kubectl label pods webcluster-77c87d9946-hpcm6 app=webcluster
pod/webcluster-77c87d9946-hpcm6 labeled
[root@k8s-master ~]# kubectl get pods -o wide 
NAME                          READY   STATUS    RESTARTS   AGE     IP            NODE        NOMINATED NODE   READINESS GATES
webcluster-77c87d9946-hpcm6   1/1     Running   0          5m28s   10.244.2.23   k8s-node2   <none>           <none>

3 利用控制其实现版本的更替

3.1 建立控制器

注意：在做以下实验时harbor仓库中的library项目中必须有myapp:v1和myapp:v2两个镜像

bash 复制代码

[root@k8s-master ~]# kubectl create deployment webcluster --image myapp:v1 --replicas 2 --dry-run=client -o yaml > webcluster.yml

[root@k8s-master ~]# vim webcluster.yml
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: webcluster
  name: webcluster
spec:
  replicas: 2
  selector:
    matchLabels:
      app: webcluster
  template:
    metadata:
      labels:
        app: webcluster
    spec:
      containers:
      - image: myapp:v1
        name: myapp

[root@k8s-master ~]#  kubectl apply -f webcluster.yml
deployment.apps/webcluster created
[root@k8s-master ~]#  kubectl get pods
NAME                          READY   STATUS    RESTARTS   AGE
webcluster-77c87d9946-4l5jt   1/1     Running   0          9s
webcluster-77c87d9946-sxpbf   1/1     Running   0          9s

#查看webcluster的版本
[root@k8s-master ~]# kubectl rollout history deployment webcluster
deployment.apps/webcluster 
REVISION  CHANGE-CAUSE
1         <none>

#暴露端口，能够对外能够访问到
[root@k8s-master ~]# kubectl expose deployment webcluster --port 80 --target-port 80 --type NodePort
service/webcluster exposed
[root@k8s-master ~]# kubectl get svc
NAME         TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)        AGE
kubernetes   ClusterIP   10.96.0.1       <none>        443/TCP        3d1h
webcluster   NodePort    10.107.99.174   <none>        80:32320/TCP   8s
#测试
[root@k8s-master ~]# curl http://172.25.254.100:32320/hostname.html
webcluster-77c87d9946-sxpbf

3.2 更新版本

bash 复制代码

#set image 用于更新资源的容器镜像
[root@k8s-master ~]#  kubectl set image deployments webcluster myapp=myapp:v2
deployment.apps/webcluster image updated

#annotate 用于为资源添加/修改/删除注解
#kubernetes.io/change-cause="myappv2" 注解键=值，记录本次变更的原因/说明
#--overwrite 覆盖标志，如果该注解已存在则强制覆盖，否则命令会报错
[root@k8s-master ~]# kubectl annotate deployment webcluster kubernetes.io/change-cause="myappv2" --overwrite
deployment.apps/webcluster annotated
[root@k8s-master ~]# kubectl get pods
NAME                          READY   STATUS    RESTARTS   AGE
webcluster-6c8b4bb9d7-6gk4r   1/1     Running   0          75s
webcluster-6c8b4bb9d7-s99lt   1/1     Running   0          76s


[root@k8s-master ~]#  kubectl rollout history deployment webcluster
deployment.apps/webcluster 
REVISION  CHANGE-CAUSE
1         <none>
2         myappv2

#版本已经发生改变
[root@k8s-master ~]# curl http://172.25.254.100:32320
Hello MyApp | Version: v2 | <a href="hostname.html">Pod Name</a>

3.3 版本回退

bash 复制代码

[root@k8s-master ~]# kubectl rollout history deployment webcluster
deployment.apps/webcluster 
REVISION  CHANGE-CAUSE
1         <none>
2         myappv2

[root@k8s-master ~]# kubectl rollout undo deployment webcluster --to-revision 1
deployment.apps/webcluster rolled back
[root@k8s-master ~]# curl http://172.25.254.100:32320
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>

4 利用yaml文件

4.1 在pod中运行多容器声明资源

通过 YAML 配置文件，来定义一个包含多个容器的 Pod，并为这些容器明确申请和限制计算资源

bash 复制代码

[root@k8s-master ~]# kubectl run  testpod --image  myapp:v1  --dry-run=client -o yaml > testpod.yaml
[root@k8s-master ~]# vim testpod.yaml 
apiVersion: v1
kind: Pod
metadata:
  labels:
    run: testpod
  name: testpod
spec:
  containers:
  - image: myapp:v1
    name: testpod
  - image: busyboxplus:latest
    name: busybox
    command:
    - /bin/sh
    - -c
    - sleep 10000


[root@k8s-master ~]# kubectl apply -f testpod.yaml
pod/testpod created
[root@k8s-master ~]# kubectl get pods
NAME      READY   STATUS    RESTARTS   AGE
testpod   2/2     Running   0          11s
[root@k8s-master ~]# kubectl exec -it pods/testpod -c busybox -- /bin/sh
/bin/sh: shopt: not found
[ root@testpod:/ ]$ curl 127.0.0.1
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>
[ root@testpod:/ ]$ exit
command terminated with exit code 127

4.2 在pod运行主机中暴漏端口

bash 复制代码

[root@k8s-master pod]# vim testpod.yaml
apiVersion: v1
kind: Pod
metadata:
  labels:
    run: testpod
  name: testpod
spec:
  containers:
  - image: myapp:v1
    name: myapp1
    ports:
    - name: http
      containerPort: 80			#pod内部容器端口
      hostPort: 80				#pod所在节点端口
      protocol: TCP				#端口所用协议


[root@k8s-master ~]# kubectl apply -f testpod.yaml
pod/testpod created
[root@k8s-master ~]# kubectl get pods -o wide 
NAME      READY   STATUS    RESTARTS   AGE   IP            NODE        NOMINATED NODE   READINESS GATES
testpod   1/1     Running   0          11s   10.244.2.36   k8s-node2   <none>           <none>
[root@k8s-master ~]# curl  k8s-node2
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>

4.3 在pod中指定变量

bash 复制代码

[root@k8s-master pod]# vim mysql.yml
apiVersion: v1
kind: Pod
metadata:
  labels:
    run: mysql
  name: mysql
spec:
  containers:
  - image: mysql:8.0
    name: mysql8
    env:
    - name: MYSQL_ROOT_PASSWORD
      value: lee

  - image: phpmyadmin:latest
    name: mysqladmin
    env:
    - name: PMA_ARBITRARY
      value: "1"
    ports:
    - name: phpadminport
      containerPort: 80
      hostPort: 80
      protocol: TCP

[root@k8s-master pod]# kubectl apply -f mysql.yml
[root@k8s-master pod]# kubectl get pods  -o wide
NAME    READY   STATUS    RESTARTS   AGE   IP            NODE        NOMINATED NODE   READINESS GATES
mysql   2/2     Running   0          36s   10.244.1.44   k8s-node1   <none>           <none>


#在浏览器中访问 node下面看到的主机ip  就比如我的是node1就是172.25.254.10

4.4 选择运行节点

bash 复制代码

[root@k8s-master pod]# vim mysql.yml
apiVersion: v1
kind: Pod
metadata:
  labels:
    run: mysql
  name: mysql
spec:
  nodeSelector:
    kubernetes.io/hostname: k8s-node2
  containers:
  - image: mysql:8.0
    name: mysql8
    env:
    - name: MYSQL_ROOT_PASSWORD
      value: lee

  - image: phpmyadmin:latest
    name: mysqladmin
    env:
    - name: PMA_ARBITRARY
      value: "1"
    ports:
    - name: phpadminport
      containerPort: 80
      hostPort: 80
      protocol: TCP

[root@k8s-master pod]# kubectl apply -f mysql.yml
pod/mysql created

[root@k8s-master ~]# kubectl get pods  -o wide
NAME    READY   STATUS    RESTARTS   AGE   IP           NODE        NOMINATED NODE   READINESS GATES
mysql   2/2     Running   0          9s    10.244.2.5   k8s-node2   <none>           <none>

4.5 共享宿主机网络

bash 复制代码

[root@k8s-master pod]# vim testpod.yaml
apiVersion: v1
kind: Pod
metadata:
  labels:
    run: testpod
  name: testpod
spec:
  hostNetwork: true
  containers:
  - image: busybox:latest
    name: busybox
    command:
    - /bin/sh
    - -c
    - sleep 10000

[root@k8s-master ~]# kubectl apply -f testpod.yaml
pod/testpod created
[root@k8s-master ~]# kubectl exec -it pods/testpod -c busybox -- /bin/sh
/ # ifconfig 
cni0      Link encap:Ethernet  HWaddr 22:0B:A8:DF:16:85  
          inet addr:10.244.2.1  Bcast:10.244.2.255  Mask:255.255.255.0
          inet6 addr: fe80::200b:a8ff:fedf:1685/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1450  Metric:1
          RX packets:7296 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8281 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:610108 (595.8 KiB)  TX bytes:808645 (789.6 KiB)

docker0   Link encap:Ethernet  HWaddr 2A:F6:2F:CD:D9:32  
          inet addr:172.17.0.1  Bcast:172.17.255.255  Mask:255.255.0.0
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:9 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
#这里能够看到node2的IP地址
eth0      Link encap:Ethernet  HWaddr 00:0C:29:16:D8:8D  
          inet addr:172.25.254.20  Bcast:172.25.254.255  Mask:255.255.255.0
          inet6 addr: fe80::ceeb:8a6b:d0c0:fe24/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:5560 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5270 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:2019416 (1.9 MiB)  TX bytes:743864 (726.4 KiB)

flannel.1 Link encap:Ethernet  HWaddr 7A:E0:0D:83:20:E2  
          inet addr:10.244.2.0  Bcast:0.0.0.0  Mask:255.255.255.255
          inet6 addr: fe80::78e0:dff:fe83:20e2/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1450  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:39 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:167 errors:0 dropped:0 overruns:0 frame:0
          TX packets:167 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:13934 (13.6 KiB)  TX bytes:13934 (13.6 KiB)

veth19e68add Link encap:Ethernet  HWaddr 62:98:B0:38:27:A9  
          inet6 addr: fe80::6098:b0ff:fe38:27a9/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1450  Metric:1
          RX packets:3671 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4167 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:357335 (348.9 KiB)  TX bytes:408612 (399.0 KiB)

vethe1bb0726 Link encap:Ethernet  HWaddr D2:7B:EF:34:C4:1F  
          inet6 addr: fe80::d07b:efff:fe34:c41f/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1450  Metric:1
          RX packets:3603 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4267 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:353161 (344.8 KiB)  TX bytes:415270 (405.5 KiB)

/ #

4.6 资源优先级

BestEffort没有做任何资源限制，资源使用优先级最低

bash 复制代码

[root@k8s-master pod]# vim testpod.yaml
apiVersion: v1
kind: Pod
metadata:
  labels:
    run: testpod
  name: testpod
spec:
  hostNetwork: true
  containers:
  - image: busybox:latest
    name: busybox
    command:
    - /bin/sh
    - -c
    - sleep 10000
apiVersion: v1
kind: Pod
metadata:
  labels:
    run: testpod
  name: testpod
spec:
  hostNetwork: true
  containers:
  - image: busybox:latest
    name: busybox
    command:
    - /bin/sh
    - -c
    - sleep 10000



[root@k8s-master ~]# vim testpod.yaml 
[root@k8s-master ~]# kubectl apply -f testpod.yaml
pod/testpod created
[root@k8s-master ~]# kubectl describe pods testpod | grep "QoS Class:"
QoS Class:                   BestEffort

Burstable 设定了资源限制，但是期望值和限制值不同，资源使用优先级次之

bash 复制代码

[root@k8s-master pod]# vim testpod.yaml
apiVersion: v1
kind: Pod
metadata:
  labels:
    run: testpod
  name: testpod
spec:
  hostNetwork: true
  containers:
  - image: busybox:latest
    name: busybox
    command:
    - /bin/sh
    - -c
    - sleep 10000
	resources:
      limits:
        cpu: 700m
        memory: 200M
      requests:
        cpu: 500m
        memory: 100M

[root@k8s-master pod]# kubectl apply -f testpod.yaml
pod/testpod changed

[root@k8s-master ~]# kubectl describe pods  testpod  | grep "QoS Class:"
QoS Class:                   Burstable

Guaranteed期望值和最大使用限制相同，优先级最高

bash 复制代码

[root@k8s-master ~]# vim testpod.yaml
apiVersion: v1
kind: Pod
metadata:
  labels:
    run: testpod
  name: testpod
spec:
  hostNetwork: true
  containers:
  - image: busybox:latest
    name: busybox
    command:
    - /bin/sh
    - -c
    - sleep 10000
	resources:
      limits:
        cpu: 500m    #将资源限制和期望都变为一致
        memory: 100M
      requests:
        cpu: 500m
        memory: 100M

[root@k8s-master ~]#  kubectl apply -f testpod.yaml
pod/testpod created
[root@k8s-master ~]# kubectl describe pods  testpod  | grep "QoS Class:"
QoS Class:                   Guaranteed

4.7 容器重启规则

Always 无论什么原因都会从新运行pod

bash 复制代码

[root@k8s-master ~]# vim testpod.yaml 
apiVersion: v1
kind: Pod
metadata:
  labels:
    run: testpod
  name: testpod
spec:
  hostNetwork: true
  restartPolicy: Always  #这里添加重启规则
  containers:
  - image: busybox:latest
    name: busybox
    command:
    - /bin/sh
    - -c
    - sleep 60  #每隔1分钟都会重新启动一个pod
[root@k8s-master ~]# kubectl apply -f testpod.yaml 
pod/testpod created

[root@k8s-master pod]# kubectl get pods -o wide  -w
[root@k8s-master ~]# kubectl get pods -o wide  -w
NAME      READY   STATUS    RESTARTS   AGE   IP       NODE     NOMINATED NODE   READINESS GATES
testpod   0/1     Pending   0          0s    <none>   <none>   <none>           <none>
testpod   0/1     Pending   0          0s    <none>   k8s-node2   <none>           <none>
testpod   0/1     ContainerCreating   0          0s    172.25.254.20   k8s-node2   <none>           <none>
testpod   1/1     Running             0          2s    172.25.254.20   k8s-node2   <none>           <none>

bash 复制代码

root@k8s-master ~]# kubectl delete -f testpod.yaml  --force 
Warning: Immediate deletion does not wait for confirmation that the running resource has been terminated. The resource may continue to run on the cluster indefinitely.
pod "testpod" force deleted from default namespace
[root@k8s-master ~]# kubectl apply -f testpod.yaml 
pod/testpod created

[root@k8s-master ~]# kubectl get pods -o wide  -w

OnFailure 非正常管关闭会重启pod

bash 复制代码

[root@k8s-master ~]# vim testpod.yaml 
apiVersion: v1
kind: Pod
metadata:
  labels:
    run: testpod
  name: testpod
spec:
  hostNetwork: true
  restartPolicy: OnFailure
  containers:
  - image: busybox:latest
    name: busybox
    command:
    - /bin/sh
    - -c
    - sleep 30

[root@k8s-master ~]# kubectl apply -f testpod.yaml 
pod/testpod created

#可以分屏查看效果
[root@k8s-master ~]#  kubectl get pods -o wide  -w

#在你查看的pod是看testpod是在哪一个后端主机运行，然后去散掉查看配置的效果
[root@k8s-node2 ~]# docker ps

[root@k8s-node2 ~]# docker rm -f 97b7a715da52
97b7a715da52

#在非正常删除后，将重行生成新的pod

Never pod关闭后不重启

bash 复制代码

[root@k8s-master ~]# vim testpod.yaml 
apiVersion: v1
kind: Pod
metadata:
  labels:
    run: testpod
  name: testpod
spec:
  hostNetwork: true
  restartPolicy: Never
  containers:
  - image: busybox:latest
    name: busybox
    command:
    - /bin/sh
    - -c
    - sleep 30

[root@k8s-master ~]# kubectl apply -f testpod.yaml 
pod/testpod created

[root@k8s-master ~]#  kubectl get pods -o wide  -w

[root@k8s-node2 ~]# docker rm -f b4e1686643da 
b4e1686643da

5 pod的生命周期

init容器

Init 容器是 Kubernetes 中一种特殊的容器，它在 Pod 的主应用容器启动之前运行，并且必须成功完成（退出）后，主容器才会被启动，核心作用是分离初始化逻辑和主业务逻辑。

bash 复制代码

[root@k8s-master ~]# kubectl run  webserver --image myapp:v1 --dry-run=client -o yaml > init-example.yml
[root@k8s-master ~]# # vim init-example.yml
apiVersion: v1
kind: Pod
metadata:
  labels:
    run: webserver
  name: webserver
spec:
  initContainers:
  - name: busybox
    image: busybox:latest
    command:
    - /bin/sh
    - -c
    - "until test -e /testfile;do echo wating for myservice; sleep 2;done" 
    #Init Containe中的等待脚本
  containers:
  - image: myapp:v1
    name: webserver
  restartPolicy: Always


复制一个会话能给更直观
[root@k8s-master ~]#  watch -n 1 kubectl get pods  -o wide

[root@k8s-master ~]#  kubectl apply -f init-example.yml
pod/webserver created

#能够看到没有检查到/testfile这个目录，服务没有开启成功
Every 1.0s: kubectl get pods -o wide                                                              k8s-master: Wed Aug 26 18:50:03 2026

NAME        READY   STATUS     RESTARTS   AGE    IP           NODE        NOMINATED NODE   READINESS GATES
webserver   0/1     Init:0/1   0          3m3s   10.244.2.7   k8s-node2   <none>           <none>


[root@k8s-master ~]# kubectl exec -it pods/webserver -c busybox -- /bin/sh
/ # touch /testfile
/ # command terminated with exit code 137

5.2 Livness存活探针

存活探针是 Kubernetes 用来检查容器是否"活着"的机制。它的核心作用是自动修复：如果探测失败，kubelet 就会重启该容器，以实现故障自愈

没有存活探针时

bash 复制代码

[root@k8s-master ~]# kubectl run  testpod --image  myapp:v1  --dry-run=client -o yaml > livness-example.yaml
[root@k8s-master pod]# vim livness-example.yaml
apiVersion: v1
kind: Pod
metadata:
  labels:
    run: webserver
  name: webserver
spec:
  containers:
  - image: myapp:v1
    name: webserver
    command: ["/bin/sh", "-c"]
    args:
    - |
      nginx -g "daemon off;"
      sleep 10000
  restartPolicy: Always

#监控程序
[root@k8s-master ~]# watch -n 1 kubectl get pods  -o wide


[root@k8s-master ~]#  kubectl apply -f livness-example.yaml


Every 1.0s: kubectl get pods -o wide                                                              k8s-master: Wed Aug 26 18:56:49 2026

NAME        READY   STATUS    RESTARTS   AGE     IP           NODE        NOMINATED NODE   READINESS GATES
webserver   1/1     Running   0          3m11s   10.244.2.8   k8s-node2   <none>           <none>

#测试操作：
[root@k8s-master ~]# kubectl exec  -it  pods/webserver -c webserver  -- /bin/sh
/ #  nginx -s stop
2026/08/26 10:53:54 [notice] 15#15: signal process started
/ # exit

##查看pod的状态仍然是runing，但是访问此pod时访问失败
[root@k8s-node2 ~]# curl 10.244.2.8
curl: (7) Failed to connect to 10.244.2.8 port 80: 拒绝连接

有存活探针livness

bash 复制代码

[root@k8s-master ~]# kubectl delete -f livness-example.yaml  --force
Warning: Immediate deletion does not wait for confirmation that the running resource has been terminated. The resource may continue to run on the cluster indefinitely.
pod "webserver" force deleted from default namespace


[root@k8s-master ~]# vim livness-example.yaml 
kind: Pod
metadata:
  labels:
    run: webserver
  name: webserver
spec:
  containers:
  - image: myapp:v1
    name: testpod
    command: ["/bin/sh", "-c"]
    args:
    - |
      nginx -g "daemon off;"
      sleep 10000
    livenessProbe:
      tcpSocket:
        port: 80
      initialDelaySeconds: 3
      periodSeconds: 1
      timeoutSeconds: 1
  restartPolicy: Always

[root@k8s-master pod]# kubectl get pods  -o wide  -w

[root@k8s-master ~]# kubectl exec -it pods/webserver -c webserver -- /bin/sh
/ # nginx -s stop
2026/08/26 11:00:19 [notice] 15#15: signal process started
/ # exit

#定时检查，如果探测失败，kubelet 就会重启该容器，以实现故障自愈
curl: (7) Failed to connect to 10.244.2.9 port 80: 拒绝连接
[root@k8s-node2 ~]# curl 10.244.2.9
curl: (7) Failed to connect to 10.244.2.9 port 80: 拒绝连接
[root@k8s-node2 ~]# curl 10.244.2.9
curl: (7) Failed to connect to 10.244.2.9 port 80: 拒绝连接
[root@k8s-node2 ~]# curl 10.244.2.9
curl: (7) Failed to connect to 10.244.2.9 port 80: 拒绝连接
[root@k8s-node2 ~]# curl 10.244.2.9
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>
[root@k8s-node2 ~]# curl 10.244.2.9

5.3 readness 就绪探针

就绪探针是 Kubernetes 用来判断容器是否已准备好接收并处理外部流量的机制。它的核心作用是流量调度：如果探测失败，kubelet 会将 Pod 从对应 Service 的访问列表中摘除，确保不会有请求被转发到这个"尚未就绪"的 Pod。

没有就绪探针情况

bash 复制代码

[root@k8s-master ~]# vim readness-example.yml
apiVersion: v1
kind: Pod
metadata:
  labels:
    run: webserver
  name: webserver
spec:
  containers:
  - image: myapp:v1
    name: webserver
  restartPolicy: Always

---
apiVersion: v1
kind: Service
metadata:
  labels:
    run: webserver
  name: webserver
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    run: webserver
[root@k8s-master ~]# kubectl apply -f readness-example.yml
pod/webserver created
service/webserver created
[root@k8s-master ~]# kubectl describe  svc webserver
Name:                     webserver
Namespace:                default
Labels:                   run=webserver
Annotations:              <none>
Selector:                 run=webserver
Type:                     ClusterIP
IP Family Policy:         SingleStack
IP Families:              IPv4
IP:                       10.106.148.66
IPs:                      10.106.148.66
Port:                     <unset>  80/TCP
TargetPort:               80/TCP
Endpoints:                10.244.2.10:80
Session Affinity:         None
Internal Traffic Policy:  Cluster
Events:                   <none>

[root@k8s-master ~]# kubectl exec -it pods/webserver -c webserver -- /bin/sh
/ #  cd /usr/share/nginx/
/usr/share/nginx # ls
html
/usr/share/nginx # cd html/
/usr/share/nginx/html # ls
50x.html    index.html
/usr/share/nginx/html # rm -fr index.html
/usr/share/nginx/html # ls
50x.html
/usr/share/nginx/html # exit


[root@k8s-master ~]# kubectl describe  svc webserver
Name:                     webserver
Namespace:                default
Labels:                   run=webserver
Annotations:              <none>
Selector:                 run=webserver
Type:                     ClusterIP
IP Family Policy:         SingleStack
IP Families:              IPv4
IP:                       10.106.148.66
IPs:                      10.106.148.66
Port:                     <unset>  80/TCP
TargetPort:               80/TCP
Endpoints:                10.244.2.10:80  #就绪探测失败，但是没有被摘除
Session Affinity:         None
Internal Traffic Policy:  Cluster
Events:                   <none>

#导致业务被拒绝访问
[root@k8s-master ~]# curl 10.106.148.66
<html>
<head><title>403 Forbidden</title></head>
<body bgcolor="white">
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.12.2</center>
</body>
</html>

有就绪探针情况

bash 复制代码

[root@k8s-master ~]# vim readness-example.yml 
apiVersion: v1
kind: Pod
metadata:
  labels:
    run: webserver
  name: webserver
spec:
  containers:
  - image: myapp:v1
    name: webserver
    readinessProbe:  #添加就绪探针
      httpGet:
        path: /index.html
        port: 80
      initialDelaySeconds: 3
      periodSeconds: 2
      timeoutSeconds: 1
  restartPolicy: Always
---
apiVersion: v1
kind: Service
metadata:
  labels:
    run: webserver
  name: webserver
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    run: webserver
[root@k8s-master ~]# kubectl apply -f readness-example.yml
pod/webserver created
service/webserver created

#情景复现
[root@k8s-master ~]# kubectl exec -it pods/webserver -c webserver -- /bin/sh
/ # rm -fr /usr/share/nginx/html/index.html
/ # 

#删掉后Endpoints 被摘除
[root@k8s-master ~]# kubectl describe  svc webserver
Name:                     webserver
Namespace:                default
Labels:                   run=webserver
Annotations:              <none>
Selector:                 run=webserver
Type:                     ClusterIP
IP Family Policy:         SingleStack
IP Families:              IPv4
IP:                       10.105.234.13
IPs:                      10.105.234.13
Port:                     <unset>  80/TCP
TargetPort:               80/TCP
Endpoints:                
Session Affinity:         None
Internal Traffic Policy:  Cluster
Events:                   <none>

#当恢复时------Endpoints重新加入
[root@k8s-master ~]# kubectl exec -it pods/webserver -c webserver -- /bin/sh
/ # rm -fr /usr/share/nginx/html/index.html
/ # echo timinglee > /usr/share/nginx/html/index.html
/ # 

[root@k8s-master ~]# kubectl describe  svc webserver
Name:                     webserver
Namespace:                default
Labels:                   run=webserver
Annotations:              <none>
Selector:                 run=webserver
Type:                     ClusterIP
IP Family Policy:         SingleStack
IP Families:              IPv4
IP:                       10.105.234.13
IPs:                      10.105.234.13
Port:                     <unset>  80/TCP
TargetPort:               80/TCP
Endpoints:                10.244.2.11:80
Session Affinity:         None
Internal Traffic Policy:  Cluster
Events:                   <none>

云原生——k8s的pod管理及优化

1 kubernetes 中的资源

1.1 资源管理方式

1.2 常用的资源类型

1.3 kubectl 常见命令操作

1.4 基础命令示例

命名空间管理

pod的管理------自助式创建pod（生产不推荐）

1.5 kubectl 命令实操

2 利用控制器管理****pod（推荐）

2.1 kubectl命名的使用方法

create------通过文件或标准输入创建资源

edit------直接编辑集群中已存在的资源对象 在线修改副本数或镜像版本

patch------对资源进行局部字段更新，快速调整副本数

expose------将 Deployment/Pod 暴露为 Service，创建内部/外部访问入口

logs------查看 Pod 容器的日志输出

attch------进入容器进程（不常用）

exec------进入容器进程，在容器内执行命令（最常用调试手段）

cp------在本地文件系统和容器之间复制文件

rollout------管理 Deployment/DaemonSet/StatefulSet 的发布过程

scale------手动扩缩容副本数 应对突发流量或缩容节省资源

label------为资源添加、修改或删除标签

3 利用控制其实现版本的更替

3.1 建立控制器

3.2 更新版本

3.3 版本回退

4 利用yaml文件

4.1 在pod中运行多容器声明资源

4.2 在pod运行主机中暴漏端口

4.3 在pod中指定变量

4.4 选择运行节点

4.5 共享宿主机网络

4.6 资源优先级

BestEffort没有做任何资源限制，资源使用优先级最低

Burstable 设定了资源限制，但是期望值和限制值不同，资源使用优先级次之

Guaranteed期望值和最大使用限制相同，优先级最高

4.7 容器重启规则

Always 无论什么原因都会从新运行pod

OnFailure 非正常管关闭会重启pod

Never pod关闭后不重启

5 pod的生命周期

init容器

5.2 Livness存活探针

没有存活探针时

有存活探针livness

5.3 readness 就绪探针

没有就绪探针情况

有就绪探针情况

2 利用控制器管理pod（推荐）

edit------直接编辑集群中已存在的资源对象在线修改副本数或镜像版本

scale------手动扩缩容副本数应对突发流量或缩容节省资源