kubernetes

# Kubernetes 与容器编排 ## Kubernetes 架构基础 ### 核心组件 - **控制平面 (Control Plane)**：API Server, Scheduler, Controller Manager, etcd - **工作节点 (Worker Nodes)**：Kubelet, Kube-proxy, 容器运行时 - **插件 (Add-ons)**：CoreDNS, Metrics Server, Ingress Controller ### 关键 Kubernetes 资源 - **工作负载**：Pods, Deployments, StatefulSets, DaemonSets, Jobs, CronJobs - **网络**：Services, Ingress, NetworkPolicies - **配置**：ConfigMaps, Secrets - **存储**：PersistentVolumes, PersistentVolumeClaims, StorageClasses - **访问控制**：ServiceAccounts, Roles, RoleBindings, ClusterRoles, ClusterRoleBindings ## 生产级部署模式 ### 最佳实践部署 yaml apiVersion: apps/v1 kind: Deployment metadata: name: myapp namespace: production labels: app: myapp version: v1.0.0 environment: production spec: replicas: 3 revisionHistoryLimit: 10 # 部署策略 strategy: type: RollingUpdate rollingUpdate: maxSurge: 1 maxUnavailable: 0 # 零停机部署 selector: matchLabels: app: myapp template: metadata: labels: app: myapp version: v1.0.0 annotations: prometheus.io/scrape: "true" prometheus.io/port: "8080" prometheus.io/path: "/metrics" spec: # Pod 级别的安全上下文 securityContext: runAsNonRoot: true runAsUser: 1000 fsGroup: 2000 seccompProfile: type: RuntimeDefault # 用于 Pod 身份的服务账号 serviceAccountName: myapp # 用于设置任务的初始化容器 initContainers: - name: init-config image: busybox:1.36 command: ['sh', '-c', 'echo Initializing... && sleep 2'] securityContext: allowPrivilegeEscalation: false runAsNonRoot: true runAsUser: 1000 capabilities: drop: - ALL containers: - name: myapp image: myapp:1.0.0 imagePullPolicy: IfNotPresent # 资源限制与请求 resources: requests: memory: "256Mi" cpu: "250m" limits: memory: "512Mi" cpu: "500m" # 容器安全 securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 1000 c