3.3.1 K8s 核心对象 · Pod / Deployment / StatefulSet / DaemonSet

apiVersion: v1
kind: Pod
metadata:
  name: web-with-sidecar
  labels:
    app: web
spec:
  # 1. Init Container:先从 git 拉配置
  initContainers:
  - name: init-config
    image: alpine/git:2.45
    command: ['sh', '-c',
      'git clone https://github.com/myorg/configs.git /config']
    volumeMounts:
    - name: config-vol
      mountPath: /config

  # 2. 主容器:Nginx
  containers:
  - name: nginx
    image: nginx:1.27
    ports:
    - containerPort: 80
    volumeMounts:
    - name: config-vol
      mountPath: /etc/nginx/conf.d
    resources:
      requests:
        cpu: 100m
        memory: 128Mi
      limits:
        cpu: 500m
        memory: 256Mi
    readinessProbe:
      httpGet:
        path: /healthz
        port: 80
      initialDelaySeconds: 5
      periodSeconds: 5

  # 3. Sidecar:Filebeat 日志收集
  - name: filebeat
    image: docker.elastic.co/beats/filebeat:8.13
    volumeMounts:
    - name: config-vol
      mountPath: /etc/filebeat
    - name: var-log
      mountPath: /var/log/nginx

  volumes:
  - name: config-vol
    emptyDir: {}
  - name: var-log
    emptyDir: {}

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app
  labels:
    app: web
spec:
  replicas: 3
  # 滚动更新策略
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1         # 最多多出 1 个 Pod(总数 4)
      maxUnavailable: 0   # 不可用上限为 0(零停机)
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      containers:
      - name: web
        image: myorg/web:v1.0.0
        ports:
        - containerPort: 8080
        env:
        - name: LOG_LEVEL
          value: info
        resources:
          requests:
            cpu: 200m
            memory: 256Mi
          limits:
            cpu: 1000m
            memory: 512Mi
        # 健康检查 - 滚动更新的关键
        readinessProbe:
          httpGet:
            path: /healthz
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 5
          failureThreshold: 3
        livenessProbe:
          httpGet:
            path: /livez
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10

# blue-deployment.yaml (v1)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-blue
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web
      version: v1   # blue
  template:
    metadata:
      labels:
        app: web
        version: v1
    spec:
      containers:
      - name: web
        image: myorg/web:v1.0.0
---
# green-deployment.yaml (v2)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-green
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web
      version: v2   # green
  template:
    metadata:
      labels:
        app: web
        version: v2
    spec:
      containers:
      - name: web
        image: myorg/web:v2.0.0

# Headless Service:让 Pod 之间能通过 DNS 互相发现
apiVersion: v1
kind: Service
metadata:
  name: redis-headless
spec:
  clusterIP: None   # headless
  selector:
    app: redis
  ports:
  - port: 6379
      name: redis
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: redis
spec:
  serviceName: redis-headless   # 必须指向上面的 headless service
  replicas: 3
  selector:
    matchLabels:
      app: redis
  template:
    metadata:
      labels:
        app: redis
    spec:
      containers:
      - name: redis
        image: redis:7.4-alpine
        ports:
        - containerPort: 6379
          name: redis
        # 关键:用 $(POD_NAME) 把每个 Pod 自己的名字传进去
        command:
        - sh
        - -c
        - |
          echo "启动 redis,我是 $(POD_NAME)"
          redis-server \
            --cluster-enabled yes \
            --cluster-config-file /data/nodes.conf \
            --cluster-announce-ip $(POD_NAME).redis-headless.default.svc.cluster.local \
            --port 6379
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        volumeMounts:
        - name: data
          mountPath: /data
        resources:
          requests:
            cpu: 100m
            memory: 256Mi
          limits:
            cpu: 500m
            memory: 512Mi
  # volumeClaimTemplates:每个 Pod 自动创建一个 PVC
  volumeClaimTemplates:
  - metadata:
      name: data
    spec:
      accessModes: ["ReadWriteOnce"]
      storageClassName: standard
      resources:
        requests:
          storage: 5Gi

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mysql
spec:
  serviceName: mysql-headless
  replicas: 3
  selector:
    matchLabels:
      app: mysql
  template:
    metadata:
      labels:
        app: mysql
    spec:
      initContainers:
      - name: init-mysql
        image: mysql:8.0
        # 0 号初始化为主库,其他为从库
        command:
        - bash
        - -c
        - |
          if [[ $(hostname) == *-0 ]]; then
            echo "我是主库"
          else
            echo "我是从库,等待主库..."
          fi
      containers:
      - name: mysql
        image: mysql:8.0
        env:
        - name: MYSQL_ROOT_PASSWORD
          valueFrom:
            secretKeyRef:
              name: mysql-secret
              key: password
        ports:
        - containerPort: 3306
        volumeMounts:
        - name: data
          mountPath: /var/lib/mysql
  volumeClaimTemplates:
  - metadata:
      name: data
    spec:
      accessModes: ["ReadWriteOnce"]
      storageClassName: ssd
      resources:
        requests:
          storage: 20Gi

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: node-exporter
  namespace: monitoring
spec:
  selector:
    matchLabels:
      app: node-exporter
  template:
    metadata:
      labels:
        app: node-exporter
    spec:
      # 关键:用 hostNetwork 让 Pod 看到宿主机网络
      hostNetwork: true
      hostPID: true
      tolerations:
      - key: node-role.kubernetes.io/control-plane
        effect: NoSchedule   # Master 节点也跑
      containers:
      - name: node-exporter
        image: prom/node-exporter:v1.8.2
        args:
        - '--path.rootfs=/host'
        - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'
        ports:
        - containerPort: 9100
          hostPort: 9100     # 直接暴露到宿主机
        resources:
          requests:
            cpu: 50m
            memory: 32Mi
          limits:
            cpu: 200m
            memory: 128Mi
        volumeMounts:
        - name: host-root
          mountPath: /host
          readOnly: true
      volumes:
      - name: host-root
        hostPath:
          path: /

apiVersion: batch/v1
kind: Job
metadata:
  name: db-migrate
spec:
  # 关键参数
  completions: 1        # 期望成功完成 1 次
  parallelism: 1        # 并行度 1
  backoffLimit: 3       # 失败重试 3 次
  activeDeadlineSeconds: 600   # 最长跑 10 分钟
  template:
    metadata:
      labels:
        app: db-migrate
    spec:
      restartPolicy: OnFailure   # 失败时重启 Pod
      containers:
      - name: migrate
        image: myorg/migrate:v1.0
        command: ["./migrate.sh"]
        env:
        - name: DB_URL
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: url
      # 如果任务完成后 Pod 还在,可手动清理
  # ttlSecondsAfterFinished: 3600   # K8s 1.23+ 自动清理

apiVersion: batch/v1
kind: CronJob
metadata:
  name: nightly-backup
spec:
  schedule: "0 2 * * *"           # 每天凌晨 2 点
  timezone: "Asia/Shanghai"       # 时区(可选,K8s 1.27+)
  startingDeadlineSeconds: 200    # 错过了 200 秒内还会跑
  concurrencyPolicy: Forbid      # 不允许并发(默认 Allow / Replace)
  successfulJobsHistoryLimit: 3  # 保留 3 个成功历史
  failedJobsHistoryLimit: 1      # 保留 1 个失败历史
  suspend: false                 # 是否暂停
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: OnFailure
          containers:
          - name: backup
            image: myorg/backup:v1.0
            args:
            - /bin/sh
            - -c
            - date; echo "开始备份"; pg_dump ... > /backup/$(date +\%F).sql

# ClusterIP(默认)
apiVersion: v1
kind: Service
metadata:
  name: web-svc
spec:
  type: ClusterIP
  selector:
    app: web              # 选择 Pod
  ports:
  - name: http
    port: 80              # Service 对内端口
    targetPort: 8080      # Pod 内端口
    protocol: TCP
---
# NodePort
apiVersion: v1
kind: Service
metadata:
  name: web-nodeport
spec:
  type: NodePort
  selector:
    app: web
  ports:
  - port: 80
    targetPort: 8080
    nodePort: 30080       # 30000-32767
---
# LoadBalancer(自动创建云 LB)
apiVersion: v1
kind: Service
metadata:
  name: web-lb
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-type: nlb
spec:
  type: LoadBalancer
  selector:
    app: web
  ports:
  - port: 80
    targetPort: 8080
---
# ExternalName
apiVersion: v1
kind: Service
metadata:
  name: external-db
spec:
  type: ExternalName
  externalName: db.example.com

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    cert-manager.io/cluster-issuer: letsencrypt-prod   # 自动证书
spec:
  ingressClassName: nginx
  # TLS 配置
  tls:
  - hosts:
    - app.example.com
    secretName: app-tls   # 证书存在这个 Secret 中
  rules:
  - host: app.example.com
    http:
      paths:
      # 路径 1:/  → web 服务
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-svc
            port:
              number: 80
      # 路径 2:/api  → api 服务
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-svc
            port:
              number: 8080

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: traefik-example
spec:
  ingressClassName: traefik
  rules:
  - host: whoami.example.com
    http:
      paths:
      - path: /
        pathType: Exact
        backend:
          service:
            name: whoami
            port:
              number: 80

# ClusterIssuer:全局证书签发者
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: ops@example.com
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          ingressClassName: nginx
---
# Ingress:加注释自动签发
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-ingress
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - app.example.com
    secretName: app-tls
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-svc
            port:
              number: 80

apiVersion: v1
kind: ConfigMap
metadata:
  name: web-config
data:
  # 键值对(字符串)
  LOG_LEVEL: "info"
  DB_HOST: "mysql.default.svc.cluster.local"
  # 整个配置文件
  application.yaml: |
    server:
      port: 8080
    spring:
      profiles:
        active: prod
    logging:
      level:
        root: INFO
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      containers:
      - name: web
        image: myorg/web:v1.0.0
        # 方式 1:环境变量注入
        envFrom:
        - configMapRef:
            name: web-config
        # 方式 2:挂载为文件(支持热更新,K8s 1.13+)
        volumeMounts:
        - name: config-vol
          mountPath: /etc/config
      volumes:
      - name: config-vol
        configMap:
          name: web-config

apiVersion: v1
kind: Secret
metadata:
  name: db-secret
type: Opaque
stringData:
  # stringData 会自动 base64,比 data 更直观
  password: "S3cret!2024"
  url: "mysql://user:S3cret!2024@mysql:3306/db"
---
# 或者用 kubectl 命令创建(推荐)
# kubectl create secret generic db-secret \
#   --from-literal=password='S3cret!2024' \
#   --from-literal=url='mysql://...'
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
spec:
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      containers:
      - name: web
        image: myorg/web:v1.0.0
        env:
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: password
        - name: DB_URL
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: url

# StorageClass:动态供给存储(调用云厂商 CSI)
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: ssd
provisioner: disk.csi.cloud.example.com
parameters:
  type: ssd
  fsType: ext4
reclaimPolicy: Retain     # 关键:删除 PVC 时保留数据
volumeBindingMode: WaitForFirstConsumer
allowVolumeExpansion: true
---
# PVC:用户申请 20G SSD
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mysql-data
spec:
  accessModes:
  - ReadWriteOnce
  storageClassName: ssd
  resources:
    requests:
      storage: 20Gi
---
# Deployment 中使用
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mysql
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mysql
  template:
    metadata:
      labels:
        app: mysql
    spec:
      containers:
      - name: mysql
        image: mysql:8.0
        volumeMounts:
        - name: data
          mountPath: /var/lib/mysql
      volumes:
      - name: data
        persistentVolumeClaim:
          claimName: mysql-data

apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: web
spec:
  replicas: 10
  selector:
    matchLabels:
      app: web
  strategy:
    canary:
      steps:
      - setWeight: 5        # 先放 5% 流量
      - pause: {duration: 5m}   # 观察 5 分钟
      - setWeight: 25       # 扩到 25%
      - pause: {duration: 5m}
      - setWeight: 50
      - pause: {duration: 5m}
      - setWeight: 100      # 全量
      # 可选:接 Prometheus 自动分析
      analysis:
        templates:
        - templateName: success-rate
        args:
        - name: service-name
          value: web-svc
  template:
    metadata:
      labels:
        app: web
    spec:
      containers:
      - name: web
        image: myorg/web:v1.0.0

name: Deploy
on: {push: {branches: [main]}}
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Build & Push
      run: |
        docker build -t myorg/web:${{ github.sha }} .
        docker push myorg/web:${{ github.sha }}
    - name: Deploy
      run: |
        echo "${{ secrets.KUBECONFIG }}" > /tmp/kc
        KUBECONFIG=/tmp/kc kubectl set image deploy/web web=myorg/web:${{ github.sha }}
        KUBECONFIG=/tmp/kc kubectl rollout status deploy/web

spec:
  containers:
  - name: web
    env:
    - name: TZ
      value: Asia/Shanghai
    volumeMounts:
    - name: tz
      mountPath: /etc/localtime
      readOnly: true
  volumes:
  - name: tz
    hostPath:
      path: /usr/share/zoneinfo/Asia/Shanghai

readinessProbe:
  httpGet:
    path: /healthz       # 必须和实际接口一致
    port: 8080           # 必须和 containerPort 一致
  initialDelaySeconds: 10
  periodSeconds: 5
  failureThreshold: 3

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: ssd
provisioner: disk.csi.cloud.example.com
reclaimPolicy: Retain         # 关键:保留数据
allowVolumeExpansion: true

resources:
  requests:
    memory: 256Mi
  limits:
    memory: 1Gi           # 调高,或去掉 limits

apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
  namespace: default
spec:
  limits:
  - type: Container
    default: {cpu: 500m, memory: 512Mi}
    defaultRequest: {cpu: 100m, memory: 128Mi}
    max: {memory: 2Gi}