Kubernetes Deployment字段配置详解

用户11081884

发布于 2026-07-20 18:03:04

270

Kubernetes Deployment是管理应用部署的核心控制器，它提供了一种声明式的方式来定义应用的期望状态。通过Deployment可以轻松实现应用的部署、滚动更新、回滚和扩缩容等操作。

能力	说明
滚动更新	零停机逐步替换旧版本 Pod
回滚	可快速回退到任意历史版本
扩缩容	手动或自动（HPA）调整副本数
自愈	节点故障时自动重新调度 Pod

一、基础字段配置

1. 必须字段

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
      - name: my-app
        image: my-app:1.0.0
        ports:
        - containerPort: 8080

apiVersion: 固定为apps/v1
kind: 固定为Deployment
metadata.name: Deployment名称，在命名空间内唯一
spec.replicas: 期望的Pod副本数量
spec.selector.matchLabels: 必须与template.metadata.labels匹配
spec.template.spec.containers: 定义Pod中的容器配置

2. 可选基础字段

metadata:
  namespace: production
  labels:
    environment: prod
    team: backend

namespace: 指定部署的命名空间
labels: 为Deployment添加标签，便于管理

三、高级字段配置

1. 资源限制与健康检查

spec:
  template:
    spec:
      containers:
      - name: my-app
        resources:
          limits:
            cpu: "1"
            memory: "1Gi"
          requests:
            cpu: "500m"
            memory: "512Mi"
        livenessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /ready
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 5

resources: 定义容器的资源请求和限制
livenessProbe: 存活探针，检测容器是否正常运行
readinessProbe: 就绪探针，检测容器是否准备好接收流量

2. 更新策略

spec:
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
  minReadySeconds: 30
  revisionHistoryLimit: 10

strategy.type: 更新策略类型(RollingUpdate或Recreate)
rollingUpdate: 滚动更新参数配置
minReadySeconds: Pod就绪后等待时间
revisionHistoryLimit: 保留的历史版本数量

四、环境变量与存储配置

1. 环境变量

spec:
  template:
    spec:
      containers:
      - name: my-app
        env:
        - name: ENVIRONMENT
          value: "production"
        - name: DB_HOST
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: host

2. 存储卷配置

spec:
  template:
    spec:
      containers:
      - name: my-app
        volumeMounts:
        - name: config-volume
          mountPath: /etc/config
      volumes:
      - name: config-volume
        configMap:
          name: app-config

五、亲和性配置

1. 节点亲和性

spec:
  template:
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: kubernetes.io/arch
                operator: In
                values:
                - amd64

2. Pod反亲和性

spec:
  template:
    spec:
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app
                  operator: In
                  values:
                  - my-app
              topologyKey: kubernetes.io/hostname

3. 容忍与污点（Tolerations）

tolerations:
- key: "gpu"
  operator: "Equal"
  value: "true"
  effect: "NoSchedule"

六、安全与权限

1. 安全上下文

securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  fsGroup: 2000

2. 服务账户

serviceAccountName: my-app-sa

七、暂停与恢复发布

spec:
  paused: true   # 暂停滚动更新，便于手动调试

八、完整示例

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
  namespace: production
  labels:
    app: my-app
    environment: prod
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  minReadySeconds: 30
  revisionHistoryLimit: 10
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
      - name: my-app
        image: my-app:1.0.0
        ports:
        - containerPort: 8080
        env:
        - name: ENVIRONMENT
          value: "production"
        resources:
          limits:
            cpu: "1"
            memory: "1Gi"
          requests:
            cpu: "500m"
            memory: "512Mi"
        livenessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /ready
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 5
        volumeMounts:
        - name: config-volume
          mountPath: /etc/config
      volumes:
      - name: config-volume
        configMap:
          name: app-config
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: kubernetes.io/arch
                operator: In
                values:
                - amd64
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app
                  operator: In
                  values:
                  - my-app
              topologyKey: kubernetes.io/hostname

维度	建议
资源限制	始终设置 requests 与 limits
健康检查	三套探针（startup + liveness + readiness）
更新策略	生产环境 maxUnavailable: 0 + maxSurge: 25%
历史版本	revisionHistoryLimit ≥ 10，便于回滚
安全	使用 securityContext.runAsNonRoot: true
调度	搭配 podAntiAffinity 打散副本
配置	ConfigMap/Secret 统一注入，避免硬编码
暂停发布	调试时可设置 paused: true