一简介1k8s概述容器管理适用于集群部署自动化部署k8s利于应用扩展k8s目标实施让容器化应用更加简洁和高效2k8s特性自动装箱基于容器对应用运行环境的资源配值要求自动部署应用自我修复当节点出错时会对容器进行重新部署和重新调度水平扩展负载均衡滚动中心版本回退批处理2架构组件Master和nodeMaster组件apiserver 集群统一入口以restful方式交给etcd存储scheduler节点调度controller—manager处理集群中常规后台任务一个资源对应一个控制器etcd存储系统node节点组件kubeeletmaster派到node的代表kube—proxy提供网络代理负载均衡二基础命令kubectl get pods //查看所有podkubectl get pods -w //实时刷新三核心概念pod最小部署单元一组容器的集合共享网络生命周期短暂重器消失controller确保预期的pod副本数量有状态容器部署(有特顶条件才可以用无状态部署确保所有node在一个pod一次性任务和定时任务Server 定义一组pod的访问规则四搭建k8s搭建规则单master集群多master集群(增加负载均衡硬件要求master 【2核4G 20g] node【4核 8g 40g】kubeadm搭建1安装虚拟机2对虚拟机进行初始化systemctl stop firewalld //关防火墙sed -i s/SELINUXenforcing/SELINUXdisabled/ /etc/selinux/config//这是 Linux 安全组件关闭后虚拟机网络、软件安装更稳定sed -ri s/.*swap.*/#/ /etc/fstab//关闭swap风区hostnamectl set-hostname hostname //根据规划设置主机名称##在master中添加hostcat /etc/hosts EOF192.168.10.100 masterk8s192.168.10.200 node1k8s192.168.10.300 node2k8sEOF##将桥接的ipv4流量传递到iptables的链cat /etc/sysctl.d/k8s.conf EOFnet.bridge.bridge-nf-call-ip6tables 1net.bridge.bridge-nf-call-iptables 1EOFsysctl --system#时间同步timedatectl set-timezone Asia/Shanghaitimedatectl set-ntp true安装Docker$ wget https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo -O /etc/yum.repos.d/docker-ce.repo yum install -y https://mirrors.aliyun.com/centos/7/extras/x86_64/Packages/container-selinux-2.119.2-1.911c772.el7_8.noarch.rpm {安装不上添加镜像} $ yum -y install docker-ce-18.06.1.ce-3.el7 $ systemctl enable docker systemctl start docker $ docker --version Docker version 18.06.1-ce, build e68fc7acat /etc/docker/daemon.json EOF{ registry-mirrors:[https://b9pmyelo.mirror.aliyuncs.com]}EOFcat /etc/yum.repos.d/kubernetes.repo EOF[kubernetes]nameKubernetesbaseurlhttps://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64 enabled1gpgcheck0repo_gpgcheck0gpgkeyhttps://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpgEOF##方便后面下载yum install -y kubelet-1.18.0 kubeadm-1.18.0 kubectl-1.18.0 systemctl enable kubelet4. 部署Kubernetes Master kubeadm init --apiserver-advertise-address192.168.10.100 --image-repository registry.aliyuncs.com/google_containers --kubernetes-version v1.18.0 --service-cidr10.96.0.0/12 --pod-network-cidr10.244.0.0/16 mkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config kubeadm join 192.168.10.100:6443 --token 91acss.bpc17b7fzze0401p \ --discovery-token-ca-cert-hash sha256:f32cbbcadfdf7bf3bf4ed70d0addbcab4a535d09ddc3225bbea381f6015d8392部署部署网络插件cat flannel.yml EOF apiVersion: v1 kind: Namespace metadata: name: kube-flannel --- apiVersion: v1 kind: ServiceAccount metadata: name: flannel namespace: kube-flannel --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: flannel rules: - apiGroups: [] resources: [pods] verbs: [get, list, watch] - apiGroups: [] resources: [nodes] verbs: [list, watch] - apiGroups: [] resources: [namespaces] verbs: [list, watch] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: flannel subjects: - kind: ServiceAccount name: flannel namespace: kube-flannel roleRef: kind: ClusterRole name: flannel apiGroup: rbac.authorization.k8s.io --- apiVersion: v1 kind: ConfigMap metadata: name: kube-flannel-cfg namespace: kube-flannel data: cni-conf.json: | { name: cbr0, cniVersion: 0.3.1, plugins: [ { type: flannel, delegate: { hairpinMode: true, isDefaultGateway: true } }, { type: portmap, capabilities: { portMappings: true } } ] } net-conf.json: | { Network: 10.244.0.0/16, Backend: { Type: vxlan } } --- apiVersion: apps/v1 kind: DaemonSet metadata: name: kube-flannel-ds namespace: kube-flannel spec: selector: matchLabels: app: flannel template: metadata: labels: app: flannel spec: hostNetwork: true serviceAccountName: flannel containers: - name: kube-flannel image: quay.io/coreos/flannel:v0.12.0-amd64 command: [/opt/bin/flanneld, --ip-masq, --kube-subnet-mgr] volumeMounts: - name: run mountPath: /run/flannel - name: flannel-cfg mountPath: /etc/kube-flannel/ volumes: - name: run hostPath: path: /run/flannel - name: flannel-cfg configMap: name: kube-flannel-cfg EOFkubectl apply -f kube-flannel.yml运行后转为ready边测试kubernetes集群在Kubernetes集群中创建一个pod验证是否正常运行$ kubectl create deployment nginx --imagenginx $ kubectl expose deployment nginx --port80 --typeNodePort $ kubectl get pod,svc访问地址http://NodeIP:Port五.k8s的集群命令行工具kubectlkubectl命令的语法kubectl [command] [type] [name] [flags]command:指定要对资源执行的操作name:指定资源名称typde:指定资源类型flags指点端口基础命令create 通过文件名或标注输入创建资源 expose将资源公开为一个新的service run运行一个特定的镜像 set设置一个特定的功能 get显示一个或多个资源 explain文档参考资料 edit编辑一个资源使用默认编辑器 delete删除常用命令kubectl create deployment nginx --imagesnginx //创键pod kubectl expose deployment nginx --port80 --typeNodePort ///暴露端口 kubectl get pod ,svc //查看 kubectl apply -f kubectl get deploy //查看副本和有没有创建成功yaml文件资源清单文件或资源编排文件语法格式使用缩进表示层级不能使用tap开头缩进2空格字符后缩进一个空格yaml文件组成部分常用字段含义控制器定义被控制的对象apiVersionK8s 接口版本Deployment 固定apps/v1kind资源类型Pod/Deployment/Service/ConfigMap 等metadata.name资源名字用于kubectl get/deletespec.replicas要跑几个 Pod 副本spec.selectorDeployment 靠标签识别要管理哪些 Podspec.templatePod 的 “模板”创建 Pod 都按这个来spec.template.metadata.labelsPod 的标签必须和 selector 匹配spec.containers.image容器镜像imagePullPolicy镜像拉取策略IfNotPresent本地有就用本地没有才拉取Always每次都重新拉默认Never永远不拉只用本地containerPort容器内部服务监听的端口如何快速编写yaml文件一.使用kubectl create 命令生成kubectl create deployment web --imagenginx -o yaml --dry-run 文件名 //定向输出二.使用kubectl get 命令导出kubectl get deploy nginx -oyaml --export 2.yaml[rootmasterk8s ~]# kubectl get deployNAME READY UP-TO-DATE AVAILABLE AGEnginx 1/1 1 1 42m[rootmasterk8s ~]# kubectl get deploy nginx -oyaml --export 2.yamlFlag --export has been deprecated, This flag is deprecated and will be removed in future.[rootmasterk8s ~]# ls2.yaml anaconda-ks.cfg flannel.yaml flannel.yml kube-flannel.yml[rootmasterk8s ~]# cat 2.yamlapiVersion: apps/v1kind: Deploymentmetadata:annotations:deployment.kubernetes.io/revision: 1creationTimestamp: nullgeneration: 1labels:app: nginxmanagedFields:- apiVersion: apps/v1fieldsType: FieldsV1fieldsV1:f:metadata:f:labels:.: {}f:app: {}f:spec:f:progressDeadlineSeconds: {}f:replicas: {}f:revisionHistoryLimit: {}f:selector:f:matchLabels:.: {}f:app: {}f:strategy:f:rollingUpdate:.: {}f:maxSurge: {}f:maxUnavailable: {}f:type: {}f:template:f:metadata:f:labels:.: {}f:app: {}f:spec:f:containers:k:{name:nginx}:.: {}f:image: {}f:imagePullPolicy: {}f:name: {}f:resources: {}f:terminationMessagePath: {}f:terminationMessagePolicy: {}f:dnsPolicy: {}f:restartPolicy: {}f:schedulerName: {}f:securityContext: {}f:terminationGracePeriodSeconds: {}manager: kubectloperation: Updatetime: 2026-03-30T15:53:14Z- apiVersion: apps/v1fieldsType: FieldsV1fieldsV1:f:metadata:f:annotations:.: {}f:deployment.kubernetes.io/revision: {}f:status:f:availableReplicas: {}f:collisionCount: {}f:conditions:.: {}k:{type:Available}:.: {}f:lastTransitionTime: {}f:lastUpdateTime: {}f:message: {}f:reason: {}f:status: {}f:type: {}k:{type:Progressing}:.: {}f:lastTransitionTime: {}f:lastUpdateTime: {}f:message: {}f:reason: {}f:status: {}f:type: {}f:observedGeneration: {}f:readyReplicas: {}f:replicas: {}f:updatedReplicas: {}manager: kube-controller-manageroperation: Updatetime: 2026-03-30T15:56:40Zname: nginxselfLink: /apis/apps/v1/namespaces/default/deployments/nginxspec:progressDeadlineSeconds: 600replicas: 1revisionHistoryLimit: 10selector:matchLabels:app: nginxstrategy:rollingUpdate:maxSurge: 25%maxUnavailable: 25%type: RollingUpdatetemplate:metadata:creationTimestamp: nulllabels:app: nginxspec:containers:- image: nginximagePullPolicy: Alwaysname: nginxresources: {}terminationMessagePath: /dev/termination-logterminationMessagePolicy: FilednsPolicy: ClusterFirstrestartPolicy: AlwaysschedulerName: default-schedulersecurityContext: {}terminationGracePeriodSeconds: 30status: {}六k8s核心技术pod1最小部署单元2由一个或多个容器组成3一个pod中容器共享网络命名空间4pod是短暂的二pod的意义1创建容器使用docker一个docker对应一个容器一个容器有进程一个容器运行一个2是一个多进程的模式可以运行多个进程3亲密性应用两个应用之间进行交互网络之间调用两个应用需要频繁调用三pod的实现机制1共享网络通过pause容器吧其他业务容器加入到pause容器里面让所有业务容器在同一个命名空间中可以实现网络共享2贡献存储云如数据卷概念volumn使用数据卷进行持久化存储3、Pod的分类Pod 有两种类型1普通 Pod普通 Pod 一旦被创建就会被放入到 etcd 中存储随后会被 Kubernetes Master 调度到某个具体的 Node 上并进行绑定随后该 Pod 对应的 Node 上的 kubelet 进程实例化成一组相关的 Docker 容器并启动起来。在默认情 况下当 Pod 里某个容器停止时Kubernetes 会自动检测到这个问题并且重新启动这个 Pod 里某所有容器 如果 Pod 所在的 Node 宕机则会将这个 Node 上的所有 Pod 重新调度到其它节点上。2静态 Pod静态 Pod 是由 kubelet 进行管理的仅存在于特定 Node 上的 Pod,它们不能通过 API Server进行管理无法与 ReplicationController、Deployment 或 DaemonSet 进行关联并且kubelet 也无法对它们进行健康检查。4pod镜像的拉取策略5.pod资源限制6、Pod生命周期和重启策略7.pod健康检查8.pod调度四.controller1.什么是controller2.pod和controller的关系3.Deployment应用场景4.使用deployment部署应用1.导出yaml文件2使用yaml部署应用3对外暴露端口kubectl expose deployment web --port80 --typeNodePort --target-port80 --nameweb1 -o yaml web1.yaml暴露端口5.deployment的升级回滚和弹性伸缩