Kubernetes集群管理必备的30个管理技巧，早用早知道

# 基础别名
alias k='kubectl'
alias kc='kubectl config'
alias kgp='kubectl get pods -o wide'
alias kgs='kubectl get svc'
alias kgd='kubectl get deployment'

# 上下文管理
alias kctx='kubectl config use-context'
alias kns='kubectl config set-context --current --namespace'

# 高效查询
alias klogs='kubectl logs --tail=100 -f'
alias kexec='kubectl exec -it'
alias kpf='kubectl port-forward'

# 使用示例：快速切换生产环境并查看 Pod
kctx prod-cluster && kns production && kgp

# 安装 krew
(
  set-x; cd"$(mktemp -d)" &&
  OS="$(uname | tr '[:upper:]' '[:lower:]')" &&
  ARCH="$(uname -m | sed -e 's/x86_64/amd64/' -e 's/\(arm\)\(64\)\?.*/\1\2/' -e 's/aarch64$/arm64/')" &&
  KREW="krew-${OS}_${ARCH}" &&
  curl-fsSLO"https://github.com/kubernetes-sigs/krew/releases/latest/download/${KREW}.tar.gz" &&
  tar zxvf "${KREW}.tar.gz" &&
  ./"${KREW}" install krew
)

# 安装实用插件
kubectl krew install ctx      # 快速切换上下文
kubectl krew install ns       # 快速切换命名空间
kubectl krew install neat     # 清理 YAML 输出
kubectl krew install df-pv    # 查看 PV 磁盘使用情况

# 使用示例
kubectl ctx                 # 交互式选择上下文
kubectl ns production       # 切换到 production 命名空间
kubectl get pod myapp -o yaml | kubectl neat

# 提取所有 Pod 的镜像名称
kubectl get pods -ojsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.containers[0].image}{"\n"}{end}'

# 自定义列输出：显示 Pod 名称、状态、重启次数和节点
kubectl get pods -ocustom-columns='NAME:.metadata.name,STATUS:.status.phase,RESTARTS:.status.containerStatuses[0].restartCount,NODE:.spec.nodeName'

# 查询所有非 Running 状态的 Pod
kubectl get pods --all-namespaces--field-selector=status.phase!=Running

# 获取所有服务的 ClusterIP 和端口映射
kubectl get svc -ocustom-columns='NAME:.metadata.name,CLUSTER_IP:.spec.clusterIP,PORTS:.spec.ports[*].port'

# 客户端 dry-run：验证 YAML 语法和 API 兼容性
kubectl apply -f deployment.yaml --dry-run=client

# 服务器端 dry-run：验证权限和准入控制器
kubectl apply -f deployment.yaml --dry-run=server

# 对比当前部署与 YAML 文件的差异
kubectl diff-f deployment.yaml

# 使用示例：安全更新 ConfigMap
kubectl create configmap app-config --from-file=config.properties --dry-run=client -o yaml | kubectl apply -f-

# Bash
echo'source <(kubectl completion bash)' >> ~/.bashrc
echo'alias k=kubectl' >> ~/.bashrc
echo'complete -o default -F __start_kubectl k' >> ~/.bashrc

# Zsh
echo'source <(kubectl completion zsh)' >> ~/.zshrc
echo'alias k=kubectl' >> ~/.zshrc
echo'compdef __start_kubectl k' >> ~/.zshrc

# 启用后生效
source ~/.bashrc  # 或 source ~/.zshrc

# ResourceQuota：命名空间级别资源限制
apiVersion: v1
kind: ResourceQuota
metadata:
  name: team-quota
  namespace: team-a
spec:
  hard:
    requests.cpu: "20"
    requests.memory: 40Gi
    limits.cpu: "40"
    limits.memory: 80Gi
    pods: "50"
    services: "10"
    persistentvolumeclaims: "10"

# LimitRange：默认资源限制，防止无限制 Pod
apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
  namespace: team-a
spec:
  limits:
  - default:
      cpu: "500m"
      memory: "512Mi"
    defaultRequest:
      cpu: "100m"
      memory: "128Mi"
    type: Container

# Pod 亲和性：将前端 Pod 调度到同一节点以共享缓存
apiVersion: apps/v1
kind: Deployment
metadata:
  name: frontend
spec:
  replicas: 3
  template:
    spec:
      affinity:
        podAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app
                  operator: In
                  values:
                  - frontend
              topologyKey: kubernetes.io/hostname

# Pod 反亲和性：确保同一 Deployment 的 Pod 分散在不同节点
apiVersion: apps/v1
kind: Deployment
metadata:
  name: backend-api
spec:
  replicas: 3
  template:
    spec:
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: app
                operator: In
                values:
                - backend-api
            topologyKey: kubernetes.io/hostname

# 定义高优先级类
apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
  name: high-priority
value: 1000000
globalDefault: false
description: "关键业务应用，可抢占低优先级 Pod"

# 定义低优先级类
apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
  name: low-priority
value: 1000
globalDefault: true
description: "批处理任务，可被高优先级抢占"

# 使用优先级
apiVersion: apps/v1
kind: Deployment
metadata:
  name: critical-service
spec:
  template:
    spec:
      priorityClassName: high-priority
      containers:
      - name: app
        image: myapp:v1.0

# 为 GPU 节点添加污点
kubectl taint nodes gpu-node-1 dedicated=gpu:NoSchedule
kubectl taint nodes gpu-node-1 dedicated=gpu:NoExecute

# 为 SSD 节点添加污点
kubectl taint nodes ssd-node-1 storage=ssd:PreferNoSchedule

# GPU 工作负载容忍污点
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ml-training
spec:
  template:
    spec:
      tolerations:
      - key: "dedicated"
        operator: "Equal"
        value: "gpu"
        effect: "NoSchedule"
      nodeSelector:
        accelerator: nvidia-tesla-v100
      containers:
      - name: trainer
        image: tensorflow/gpu:latest
        resources:
          limits:
            nvidia.com/gpu: 1

# 批处理任务容忍 PreferNoSchedule
apiVersion: batch/v1
kind: Job
metadata:
  name: data-processing
spec:
  template:
    spec:
      tolerations:
      - key: "storage"
        operator: "Equal"
        value: "ssd"
        effect: "PreferNoSchedule"
      containers:
      - name: processor
        image: data-processor:v2

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-service
spec:
  replicas: 6
  template:
    spec:
      topologySpreadConstraints:
      - maxSkew: 1
        topologyKey: topology.kubernetes.io/zone
        whenUnsatisfiable: DoNotSchedule
        labelSelector:
          matchLabels:
            app: web-service
      - maxSkew: 2
        topologyKey: kubernetes.io/hostname
        whenUnsatisfiable: ScheduleAnyway
        labelSelector:
          matchLabels:
            app: web-service
      containers:
      - name: web
        image: nginx:1.25

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-service
spec:
  template:
    spec:
      containers:
      - name: api
        image: myapi:v2.1
        ports:
        - containerPort: 8080
        # 启动探针：保护慢启动应用
        startupProbe:
          httpGet:
            path: /health/startup
            port: 8080
          failureThreshold: 30
          periodSeconds: 10
        # 存活探针：检测应用是否死锁
        livenessProbe:
          httpGet:
            path: /health/live
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 15
          timeoutSeconds: 5
          failureThreshold: 3
        # 就绪探针：控制流量接入
        readinessProbe:
          httpGet:
            path: /health/ready
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 5
          successThreshold: 2
          failureThreshold: 3

apiVersion: apps/v1
kind: Deployment
metadata:
  name: app-deployment
spec:
  replicas: 10
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 25%        # 最多超出 25% 的新 Pod
      maxUnavailable: 0    # 不允许不可用 Pod（零停机）
  template:
    spec:
      containers:
      - name: app
        image: myapp:v2.0
        lifecycle:
          preStop:
            exec:
              command: ["/bin/sh","-c","sleep 15"]  # 优雅关闭等待
      terminationGracePeriodSeconds: 60

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: api-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: api-service
  minReplicas: 3
  maxReplicas: 50
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300  # 缩容前等待 5 分钟
      policies:
      - type: Percent
        value: 10
        periodSeconds: 60

# 百分比模式：适用于动态副本数
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: api-pdb
spec:
  minAvailable: 50%      # 至少 50% Pod 可用
  selector:
    matchLabels:
      app: api-service

# 绝对数量模式
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: database-pdb
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app: database

# 1. 标记节点不可调度（阻止新 Pod 调度）
kubectl cordon <node-name>

# 2. 优雅驱逐节点上所有 Pod（遵守 PDB）
kubectl drain <node-name> \
  --ignore-daemonsets \
  --delete-emptydir-data \
  --force \
  --grace-period=60 \
  --timeout=300s

# 3. 执行维护操作（升级、重启等）
# ...

# 4. 恢复节点可调度
kubectl uncordon <node-name>

# 批量维护脚本示例
#!/bin/bash
NODES=$(kubectl get nodes -l maintenance=true -o name)
for NODE in$NODES; do
  echo"Processing $NODE..."
  kubectl cordon $NODE
  kubectl drain $NODE--ignore-daemonsets--delete-emptydir-data--force
  # 执行维护...
  kubectl uncordon $NODE
done

# 开发人员角色：仅对特定命名空间有读写权限
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: dev-team
  name: developer
rules:
- apiGroups: ["","apps","extensions"]
  resources: ["pods","services","deployments","configmaps"]
  verbs: ["get","list","watch","create","update","patch","delete"]
- apiGroups: [""]
  resources: ["pods/log","pods/exec"]
  verbs: ["get","create"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: dev-team
  name: developer-binding
subjects:
- kind: Group
  name: dev-team
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: developer
  apiGroup: rbac.authorization.k8s.io

# 只读审计角色
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: readonly-viewer
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["get","list","watch"]

# 默认拒绝所有入站流量
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Ingress

# 允许前端访问后端 API
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: backend-allow-frontend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend-api
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080

# 允许后端访问数据库
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: database-allow-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: database
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: backend-api
    ports:
    - protocol: TCP
      port: 5432

apiVersion: apps/v1
kind: Deployment
metadata:
  name: secure-app
spec:
  template:
    spec:
      securityContext:
        runAsNonRoot: true          # 禁止以 root 运行
        runAsUser: 1000             # 指定用户 ID
        runAsGroup: 1000            # 指定组 ID
        fsGroup: 1000               # 卷挂载的组所有权
        seccompProfile:
          type: RuntimeDefault      # 使用默认 seccomp 配置
      containers:
      - name: app
        image: myapp:v1.0
        securityContext:
          allowPrivilegeEscalation: false    # 禁止权限提升
          readOnlyRootFilesystem: true       # 根文件系统只读
          capabilities:
            drop:
            - ALL                            # 丢弃所有能力
            add:
            - NET_BIND_SERVICE               # 仅保留必要能力
        volumeMounts:
        - name: tmp
          mountPath: /tmp
        - name: cache
          mountPath: /var/cache
      volumes:
      - name: tmp
        emptyDir: {}
      - name: cache
        emptyDir: {}

# 从文件创建 Secret（避免命令行历史泄露）
kubectl create secret generic db-credentials \
  --from-literal=username=admin \
  --from-file=password=./password.txt

# 使用 sealed-secrets 加密提交到 Git
kubeseal --format=yaml < secret.yaml > sealed-secret.yaml

# 使用外部密钥管理（AWS Secrets Manager 示例）
# 配合 external-secrets 控制器

# External Secret 示例
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: db-credentials
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: aws-secrets-manager
  target:
    name: db-credentials
    creationPolicy: Owner
  data:
  - secretKey: username
    remoteRef:
      key: production/db
      property: username
  - secretKey: password
    remoteRef:
      key: production/db
      property: password

# 审计策略示例
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
# 记录所有请求到特定资源
- level: RequestResponse
  resources:
  - group: ""
    resources: ["pods","services","configmaps","secrets"]

# 记录修改操作
- level: Metadata
  verbs: ["create","update","patch","delete"]

# 记录认证失败
- level: Metadata
  omitStages:
  - RequestReceived
  userGroups: ["system:authenticated"]

# 默认不记录
- level: None

# Fluent Bit DaemonSet 配置示例
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluent-bit
  namespace: logging
spec:
  selector:
    matchLabels:
      app: fluent-bit
  template:
    spec:
      containers:
      - name: fluent-bit
        image: fluent/fluent-bit:2.1
        volumeMounts:
        - name: varlog
          mountPath: /var/log
        - name: varlibdockercontainers
          mountPath: /var/lib/docker/containers
          readOnly: true
        - name: fluent-bit-config
          mountPath: /fluent-bit/etc/
      volumes:
      - name: varlog
        hostPath:
          path: /var/log
      - name: varlibdockercontainers
        hostPath:
          path: /var/lib/docker/containers
      - name: fluent-bit-config
        configMap:
          name: fluent-bit-config

# Prometheus ServiceMonitor 示例
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: app-metrics
  namespace: monitoring
spec:
  selector:
    matchLabels:
      app: my-application
  endpoints:
  - port: metrics
    interval: 15s
    path: /metrics
  namespaceSelector:
    matchNames:
    - production

# PrometheusRule 告警规则
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: app-alerts
spec:
  groups:
  - name: application
    rules:
    - alert: HighErrorRate
      expr: |
        (
          sum(rate(http_requests_total{status=~"5.."}[5m]))
          /
          sum(rate(http_requests_total[5m]))
        ) > 0.05
      for: 5m
      labels:
        severity: critical
      annotations:
        summary: "High error rate detected"
        description: "Error rate is {{ $value | humanizePercentage }}"

# OpenTelemetry Collector 配置
apiVersion: opentelemetry.io/v1alpha1
kind: OpenTelemetryCollector
metadata:
  name: otel-collector
spec:
  mode: deployment
  config: |
    receivers:
      otlp:
        protocols:
          grpc:
            endpoint: 0.0.0.0:4317
          http:
            endpoint: 0.0.0.0:4318
    
    processors:
      batch:
        timeout: 1s
        send_batch_size: 1024
    
    exporters:
      jaeger:
        endpoint: jaeger-collector:14250
        tls:
          insecure: true
    
    service:
      pipelines:
        traces:
          receivers: [otlp]
          processors: [batch]
          exporters: [jaeger]

# 查看 Pod 事件
kubectl describe pod <pod-name>

# 查看节点事件
kubectl describe node <node-name>

# 查看所有警告事件
kubectl get events --field-selectortype=Warning --sort-by='.lastTimestamp'

# 查看特定对象的全部事件
kubectl get events --field-selector involvedObject.name=<pod-name>

# 导出事件用于分析
kubectl get events --all-namespaces-o json > events.json

# 使用 stern 实时追踪多 Pod 日志
stern -lapp=backend --since 10m

# 进入容器调试
kubectl debug -it <pod-name> --image=busybox --target=<container-name>

# 创建临时调试 Pod
kubectl run debug --rm-it--image=nicolaka/netshoot -- /bin/bash

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-service
spec:
  template:
    spec:
      initContainers:
      # 等待数据库就绪
      - name: wait-for-db
        image: busybox:1.36
        command: ['sh','-c','until nc -z postgres 5432; do echo waiting for db; sleep 2; done;']
      # 等待缓存就绪
      - name: wait-for-cache
        image: busybox:1.36
        command: ['sh','-c','until nc -z redis 6379; do echo waiting for cache; sleep 2; done;']
      # 等待配置加载
      - name: wait-for-config
        image: busybox:1.36
        command: ['sh','-c','until wget -qO- http://config-server:8888/health | grep UP; do sleep 2; done;']
      containers:
      - name: api
        image: api-service:v1.0

# 高性能 SSD StorageClass
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: fast-ssd
provisioner: kubernetes.io/gce-pd
parameters:
  type: pd-ssd
  replication-type: regional-disk
reclaimPolicy: Retain
allowVolumeExpansion: true
volumeBindingMode: WaitForFirstConsumer

# 标准 HDD StorageClass
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: standard-hdd
provisioner: kubernetes.io/gce-pd
parameters:
  type: pd-standard
reclaimPolicy: Delete
allowVolumeExpansion: true

# 使用示例
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: database-storage
spec:
  storageClassName: fast-ssd
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 100Gi

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: postgres
spec:
  serviceName: postgres-headless
  replicas: 3
  podManagementPolicy: OrderedReady
  template:
    spec:
      containers:
      - name: postgres
        image: postgres:15
        ports:
        - containerPort: 5432
        volumeMounts:
        - name: data
          mountPath: /var/lib/postgresql/data
        - name: init-scripts
          mountPath: /docker-entrypoint-initdb.d
        resources:
          requests:
            memory: "2Gi"
            cpu: "1000m"
          limits:
            memory: "4Gi"
            cpu: "2000m"
  volumeClaimTemplates:
  - metadata:
      name: data
    spec:
      storageClassName: fast-ssd
      accessModes: ["ReadWriteOnce"]
      resources:
        requests:
          storage: 50Gi

# 安装 Velero
velero install \
  --provider aws \
  --plugins velero/velero-plugin-for-aws:v1.7.0 \
  --bucket my-backup-bucket \
  --backup-location-configregion=us-east-1 \
  --snapshot-location-configregion=us-east-1 \
  --secret-file ./credentials-velero

# 创建备份（包含 PV 数据）
velero backup create production-backup \
  --include-namespaces production \
  --include-resources deployments,services,pvc,pv \
  --snapshot-volumes \
  --ttl 720h

# 定时备份
velero schedule create daily-backup \
  --schedule="0 2 * * *" \
  --include-namespaces production \
  --snapshot-volumes

# 灾难恢复
velero restore create --from-backup production-backup

# ArgoCD Application 示例
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: production-apps
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/org/gitops-repo.git
    targetRevision: main
    path: overlays/production
    helm:
      valueFiles:
      - values-production.yaml
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true        # 自动删除无用资源
      selfHeal: true     # 自动修复配置漂移
      allowEmpty: false
    syncOptions:
    - CreateNamespace=true
    - PrunePropagationPolicy=foreground
    - PruneLast=true
    retry:
      limit: 5
      backoff:
        duration: 5s
        factor: 2
        maxDuration: 3m

apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: api-rollout
spec:
  replicas: 10
  strategy:
    canary:
      canaryService: api-canary
      stableService: api-stable
      trafficRouting:
        nginx:
          stableIngress: api-ingress
          annotationPrefix: nginx.ingress.kubernetes.io
      steps:
      - setWeight: 10        # 10% 流量到新版本
      - pause: {duration: 10m}  # 观察 10 分钟
      - setWeight: 25
      - pause: {duration: 10m}
      - setWeight: 50
      - pause: {duration: 10m}
      - setWeight: 100
      analysis:
        templates:
        - templateName: success-rate
        args:
        - name: service-name
          value: api-canary
  selector:
    matchLabels:
      app: api
  template:
    spec:
      containers:
      - name: api
        image: api:v2.0
---
apiVersion: argoproj.io/v1alpha1
kind: AnalysisTemplate
metadata:
  name: success-rate
spec:
  metrics:
  - name: success-rate
    interval: 1m
    count: 5
    successCondition: result[0] >= 0.95
    provider:
      prometheus:
        address: http://prometheus:9090
        query: |
          sum(rate(http_requests_total{service="{{args.service-name}}",status=~"2.."}[1m]))
          /
          sum(rate(http_requests_total{service="{{args.service-name}}"}[1m]))