igozhang

——

    Kubernetes 常用资源/对象速查

    2026-07-19 · k8s · 51 次阅读

    本文介绍 Kubernetes 最常用的资源（对象），演示增删改查（CRUD）。命令基于 kubectl，YAML 可直接复制改用。

    页内导航

    分类 资源
    工作负载 Pod · Deployment · StatefulSet · DaemonSet · Job · CronJob
    服务与网络 Service · Ingress · NetworkPolicy
    配置与密钥 ConfigMap · Secret
    存储 PersistentVolume · PersistentVolumeClaim · StorageClass
    组织与权限 Namespace · ServiceAccount · Role / ClusterRole · RoleBinding / ClusterRoleBinding
    常用运维 副本数扩缩容 · CPU/内存 requests 与 limits · 命名空间配额 · HPA 自动扩缩 · 滚动更新与回滚 · 健康检查探针 · 环境变量与配置挂载 · 标签注解与排查 · 优雅终止与强制删除
    其它 通用操作速查 · 推荐最小组合

    通用操作速查

    几乎所有资源都遵循同一套 CRUD 模式：

    操作 命令模式 示例
    增（创建） kubectl apply -f <file>.yaml kubectl apply -f igo-deploy.yaml
    查（列表） kubectl get <kind> [-n ns] kubectl get deploy -n igo-ns
    查（详情） kubectl describe <kind> <name> [-n ns] kubectl describe pod igo-pod -n igo-ns
    查（YAML） kubectl get <kind> <name> -o yaml kubectl get cm igo-config -n igo-ns -o yaml
    改（编辑） kubectl edit <kind> <name> kubectl edit deploy igo-web -n igo-ns
    改（补丁） kubectl patch ... / kubectl set ... kubectl set image deploy/igo-web ...
    删 kubectl delete <kind> <name> kubectl delete svc igo-web -n igo-ns
    删（按文件） kubectl delete -f <file>.yaml kubectl delete -f igo-deploy.yaml

    先创建命名空间（后续示例都会用到）：

    kubectl create namespace igo-ns
# 或
kubectl apply -f - <<'EOF'
apiVersion: v1
kind: Namespace
metadata:
  name: igo-ns
EOF

    Namespace

    是什么：资源隔离边界，常按环境/团队划分（如 igo-ns）。

    增

    kubectl create namespace igo-ns

    查

    kubectl get ns
kubectl get ns igo-ns -o yaml
kubectl describe ns igo-ns

    改

    # 给命名空间加标签
kubectl label ns igo-ns env=dev --overwrite

    删

    # 会级联删除该命名空间下的多数资源，谨慎操作
kubectl delete ns igo-ns

    Pod

    是什么：最小可调度单元，包含一个或多个容器。生产中通常由 Deployment 等控制器创建，较少直接长期托管裸 Pod。

    增

    kubectl run igo-pod --image=nginx:1.25 -n igo-ns --restart=Never

    或 YAML：

    # igo-pod.yaml
apiVersion: v1
kind: Pod
metadata:
  name: igo-pod
  namespace: igo-ns
  labels:
    app: igo
spec:
  containers:
    - name: nginx
      image: nginx:1.25
      ports:
        - containerPort: 80

    kubectl apply -f igo-pod.yaml

    查

    kubectl get pods -n igo-ns
kubectl get pod igo-pod -n igo-ns -o wide
kubectl describe pod igo-pod -n igo-ns
kubectl logs igo-pod -n igo-ns

    改

    Pod 多数字段不可原地修改；常见做法是删了重建，或改上层控制器。

    # 进入容器排查（不算改资源定义，但很常用）
kubectl exec -it igo-pod -n igo-ns -- /bin/sh

    删

    kubectl delete pod igo-pod -n igo-ns

    Deployment

    是什么：管理无状态副本，支持滚动更新与回滚。日常部署首选。

    增

    # igo-deploy.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: igo-web
  namespace: igo-ns
spec:
  replicas: 2
  selector:
    matchLabels:
      app: igo-web
  template:
    metadata:
      labels:
        app: igo-web
    spec:
      containers:
        - name: web
          image: nginx:1.25
          ports:
            - containerPort: 80

    kubectl apply -f igo-deploy.yaml

    查

    kubectl get deploy -n igo-ns
kubectl get deploy igo-web -n igo-ns -o yaml
kubectl describe deploy igo-web -n igo-ns
kubectl get rs,pods -l app=igo-web -n igo-ns
kubectl rollout status deploy/igo-web -n igo-ns

    改

    # 扩缩容
kubectl scale deploy/igo-web --replicas=3 -n igo-ns

# 换镜像（触发滚动更新）
kubectl set image deploy/igo-web web=nginx:1.26 -n igo-ns

# 交互编辑
kubectl edit deploy igo-web -n igo-ns

# 回滚
kubectl rollout undo deploy/igo-web -n igo-ns
kubectl rollout history deploy/igo-web -n igo-ns

# 设资源限额（详见「常用运维操作」）
kubectl set resources deploy/igo-web -n igo-ns \
  --containers=web \
  --requests=cpu=100m,memory=128Mi \
  --limits=cpu=500m,memory=256Mi

    更多：副本策略、HPA、探针、配额等见 常用运维操作。

    删

    kubectl delete deploy igo-web -n igo-ns
# 或
kubectl delete -f igo-deploy.yaml

    StatefulSet

    是什么：有状态应用（数据库、消息队列等），提供稳定 Pod 名、有序扩缩、稳定存储绑定。

    增

    # igo-sts.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: igo-db
  namespace: igo-ns
spec:
  serviceName: igo-db-headless
  replicas: 2
  selector:
    matchLabels:
      app: igo-db
  template:
    metadata:
      labels:
        app: igo-db
    spec:
      containers:
        - name: redis
          image: redis:7
          ports:
            - containerPort: 6379
  volumeClaimTemplates:
    - metadata:
        name: igo-data
      spec:
        accessModes: ["ReadWriteOnce"]
        resources:
          requests:
            storage: 1Gi

    配合 Headless Service：

    # igo-db-headless.yaml
apiVersion: v1
kind: Service
metadata:
  name: igo-db-headless
  namespace: igo-ns
spec:
  clusterIP: None
  selector:
    app: igo-db
  ports:
    - port: 6379
      name: redis

    kubectl apply -f igo-db-headless.yaml -f igo-sts.yaml

    查

    kubectl get sts -n igo-ns
kubectl get pods -l app=igo-db -n igo-ns
kubectl describe sts igo-db -n igo-ns

    改

    kubectl scale sts/igo-db --replicas=3 -n igo-ns
kubectl edit sts igo-db -n igo-ns

    删

    kubectl delete sts igo-db -n igo-ns
# PVC 默认常会保留，需单独删除 igo-data-*
kubectl get pvc -n igo-ns

    DaemonSet

    是什么：在每个（或选定）节点上跑一个 Pod，适合日志采集、监控 Agent、网络插件等。

    增

    # igo-ds.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: igo-agent
  namespace: igo-ns
spec:
  selector:
    matchLabels:
      app: igo-agent
  template:
    metadata:
      labels:
        app: igo-agent
    spec:
      containers:
        - name: agent
          image: busybox:1.36
          command: ["sh", "-c", "while true; do echo igo-agent; sleep 60; done"]

    kubectl apply -f igo-ds.yaml

    查

    kubectl get ds -n igo-ns
kubectl get pods -l app=igo-agent -n igo-ns -o wide
kubectl describe ds igo-agent -n igo-ns

    改

    kubectl set image ds/igo-agent agent=busybox:1.37 -n igo-ns
kubectl edit ds igo-agent -n igo-ns

    删

    kubectl delete ds igo-agent -n igo-ns

    Job

    是什么：跑一次性任务，成功完成后 Pod 不再重启（按 restartPolicy 配置）。

    增

    # igo-job.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: igo-batch
  namespace: igo-ns
spec:
  template:
    spec:
      restartPolicy: Never
      containers:
        - name: worker
          image: busybox:1.36
          command: ["sh", "-c", "echo hello-from-igo; sleep 5"]

    kubectl apply -f igo-job.yaml

    查

    kubectl get jobs -n igo-ns
kubectl get pods -l job-name=igo-batch -n igo-ns
kubectl logs job/igo-batch -n igo-ns
kubectl describe job igo-batch -n igo-ns

    改

    Job 一般不原地改规格；失败可删建，或调 backoffLimit 后重建。

    kubectl delete job igo-batch -n igo-ns
kubectl apply -f igo-job.yaml

    删

    kubectl delete job igo-batch -n igo-ns

    CronJob

    是什么：按 cron 表达式周期性创建 Job。

    增

    # igo-cronjob.yaml
apiVersion: batch/v1
kind: CronJob
metadata:
  name: igo-cleanup
  namespace: igo-ns
spec:
  schedule: "*/5 * * * *"   # 每 5 分钟
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: OnFailure
          containers:
            - name: cleanup
              image: busybox:1.36
              command: ["sh", "-c", "echo igo-cleanup; date"]

    kubectl apply -f igo-cronjob.yaml

    查

    kubectl get cronjob -n igo-ns
kubectl get jobs -n igo-ns
kubectl describe cronjob igo-cleanup -n igo-ns

    改

    # 暂停调度
kubectl patch cronjob igo-cleanup -n igo-ns -p '{"spec":{"suspend":true}}'

# 改调度时间
kubectl patch cronjob igo-cleanup -n igo-ns -p '{"spec":{"schedule":"0 * * * *"}}'

    删

    kubectl delete cronjob igo-cleanup -n igo-ns

    Service

    是什么：给一组 Pod 提供稳定虚拟 IP / DNS 名；常见类型：ClusterIP、NodePort、LoadBalancer。

    增

    # igo-svc.yaml
apiVersion: v1
kind: Service
metadata:
  name: igo-web
  namespace: igo-ns
spec:
  type: ClusterIP
  selector:
    app: igo-web
  ports:
    - name: http
      port: 80
      targetPort: 80

    kubectl apply -f igo-svc.yaml
# 或快捷暴露
kubectl expose deploy/igo-web --name=igo-web --port=80 -n igo-ns

    查

    kubectl get svc -n igo-ns
kubectl get endpoints igo-web -n igo-ns
kubectl describe svc igo-web -n igo-ns

    集群内访问示例：http://igo-web.igo-ns.svc.cluster.local

    改

    kubectl edit svc igo-web -n igo-ns
# 例如改成 NodePort
kubectl patch svc igo-web -n igo-ns -p '{"spec":{"type":"NodePort"}}'

    删

    kubectl delete svc igo-web -n igo-ns

    Ingress

    是什么：集群入口的 HTTP/HTTPS 路由（按域名、路径转发到 Service）。需安装 Ingress Controller（如 nginx、traefik）。

    增

    # igo-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: igo-web
  namespace: igo-ns
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  rules:
    - host: igo.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: igo-web
                port:
                  number: 80

    kubectl apply -f igo-ingress.yaml

    查

    kubectl get ingress -n igo-ns
kubectl describe ingress igo-web -n igo-ns

    改

    kubectl edit ingress igo-web -n igo-ns

    删

    kubectl delete ingress igo-web -n igo-ns

    NetworkPolicy

    是什么：声明式网络隔离策略，控制哪些流量可进出 Pod（依赖支持 NetworkPolicy 的 CNI）。

    增

    # igo-netpol.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: igo-web-allow
  namespace: igo-ns
spec:
  podSelector:
    matchLabels:
      app: igo-web
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: igo-frontend
      ports:
        - protocol: TCP
          port: 80

    kubectl apply -f igo-netpol.yaml

    查

    kubectl get netpol -n igo-ns
kubectl describe netpol igo-web-allow -n igo-ns

    改

    kubectl edit netpol igo-web-allow -n igo-ns

    删

    kubectl delete netpol igo-web-allow -n igo-ns

    ConfigMap

    是什么：存放非敏感配置（环境变量、配置文件片段）。

    增

    kubectl create configmap igo-config \
  -n igo-ns \
  --from-literal=APP_NAME=igo \
  --from-literal=LOG_LEVEL=info

    或 YAML：

    # igo-cm.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: igo-config
  namespace: igo-ns
data:
  APP_NAME: igo
  LOG_LEVEL: info
  app.properties: |
    name=igo
    mode=dev

    kubectl apply -f igo-cm.yaml

    查

    kubectl get cm -n igo-ns
kubectl get cm igo-config -n igo-ns -o yaml
kubectl describe cm igo-config -n igo-ns

    改

    kubectl edit cm igo-config -n igo-ns
# 或重新 apply 覆盖
kubectl apply -f igo-cm.yaml

    注意：已挂载的 ConfigMap 更新后，应用是否生效取决于挂载方式与应用是否热加载。

    删

    kubectl delete cm igo-config -n igo-ns

    Secret

    是什么：存放敏感数据（密码、Token、证书）。默认多为 base64 编码，不等于加密，生产需配合 KMS/加密配置等。

    增

    kubectl create secret generic igo-secret \
  -n igo-ns \
  --from-literal=username=igo \
  --from-literal=password='s3cret'

    或 YAML（值需 base64）：

    echo -n 'igo' | base64      # aWdv
echo -n 's3cret' | base64   # czNjcmV0

    # igo-secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: igo-secret
  namespace: igo-ns
type: Opaque
data:
  username: aWdv
  password: czNjcmV0

    kubectl apply -f igo-secret.yaml

    查

    kubectl get secret -n igo-ns
kubectl describe secret igo-secret -n igo-ns
# 解码查看（注意权限与审计）
kubectl get secret igo-secret -n igo-ns -o jsonpath='{.data.username}' | base64 -d; echo

    改

    kubectl edit secret igo-secret -n igo-ns
# 或
kubectl create secret generic igo-secret \
  -n igo-ns \
  --from-literal=username=igo \
  --from-literal=password='newpass' \
  --dry-run=client -o yaml | kubectl apply -f -

    删

    kubectl delete secret igo-secret -n igo-ns

    PersistentVolume (PV)

    是什么：集群级存储资源，由管理员或 StorageClass 动态供给创建。应用一般不直接绑 PV，而是用 PVC。

    增（静态示例）

    # igo-pv.yaml
apiVersion: v1
kind: PersistentVolume
metadata:
  name: igo-pv
spec:
  capacity:
    storage: 5Gi
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: igo-manual
  hostPath:
    path: /mnt/igo-data

    kubectl apply -f igo-pv.yaml

    查

    kubectl get pv
kubectl get pv igo-pv -o yaml
kubectl describe pv igo-pv

    改

    kubectl edit pv igo-pv

    多数容量/后端字段受限制，改不动时通常重建。

    删

    # 需先解除与 PVC 的绑定（且注意 reclaimPolicy）
kubectl delete pv igo-pv

    PersistentVolumeClaim (PVC)

    是什么：应用对存储的「申请单」；绑定到 PV 后可挂到 Pod。

    增

    # igo-pvc.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: igo-pvc
  namespace: igo-ns
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: igo-manual   # 或集群默认 StorageClass
  resources:
    requests:
      storage: 1Gi

    kubectl apply -f igo-pvc.yaml

    在 Deployment/Pod 中挂载示例：

    volumes:
  - name: igo-storage
    persistentVolumeClaim:
      claimName: igo-pvc
containers:
  - name: web
    volumeMounts:
      - name: igo-storage
        mountPath: /data

    查

    kubectl get pvc -n igo-ns
kubectl describe pvc igo-pvc -n igo-ns

    改

    # 部分存储类支持扩容
kubectl edit pvc igo-pvc -n igo-ns
# 将 storage 请求改大后保存

    删

    kubectl delete pvc igo-pvc -n igo-ns
# 若 PV reclaimPolicy=Retain，数据卷可能仍保留

    StorageClass

    是什么：定义「如何动态创建 PV」（云盘类型、回收策略等）。通常由平台管理员维护。

    增

    # igo-sc.yaml
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: igo-fast
provisioner: kubernetes.io/aws-ebs   # 按实际 CSI 修改
parameters:
  type: gp3
reclaimPolicy: Delete
volumeBindingMode: WaitForFirstConsumer

    kubectl apply -f igo-sc.yaml

    查

    kubectl get sc
kubectl describe sc igo-fast

    改

    kubectl edit sc igo-fast

    删

    kubectl delete sc igo-fast

    ServiceAccount

    是什么：Pod 在集群内的身份，用于调用 API Server（配合 RBAC）。

    增

    kubectl create sa igo-sa -n igo-ns

    # igo-sa.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: igo-sa
  namespace: igo-ns

    查

    kubectl get sa -n igo-ns
kubectl describe sa igo-sa -n igo-ns

    改

    kubectl annotate sa igo-sa igo.io/owner=igo -n igo-ns --overwrite

    在 Pod/Deployment 中引用：

    spec:
  serviceAccountName: igo-sa

    删

    kubectl delete sa igo-sa -n igo-ns

    Role / ClusterRole

    是什么：

    • Role：命名空间内权限规则
    • ClusterRole：集群级（或可复用到多个命名空间）权限规则

    增

    # igo-role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: igo-reader
  namespace: igo-ns
rules:
  - apiGroups: [""]
    resources: ["pods", "services", "configmaps"]
    verbs: ["get", "list", "watch"]

    # igo-clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: igo-node-reader
rules:
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list"]

    kubectl apply -f igo-role.yaml
kubectl apply -f igo-clusterrole.yaml

    查

    kubectl get role -n igo-ns
kubectl get clusterrole igo-node-reader
kubectl describe role igo-reader -n igo-ns

    改

    kubectl edit role igo-reader -n igo-ns
kubectl edit clusterrole igo-node-reader

    删

    kubectl delete role igo-reader -n igo-ns
kubectl delete clusterrole igo-node-reader

    RoleBinding / ClusterRoleBinding

    是什么：把 Role/ClusterRole「绑」到用户、组或 ServiceAccount。

    增

    # igo-rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: igo-reader-binding
  namespace: igo-ns
subjects:
  - kind: ServiceAccount
    name: igo-sa
    namespace: igo-ns
roleRef:
  kind: Role
  name: igo-reader
  apiGroup: rbac.authorization.k8s.io

    # igo-crb.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: igo-node-reader-binding
subjects:
  - kind: ServiceAccount
    name: igo-sa
    namespace: igo-ns
roleRef:
  kind: ClusterRole
  name: igo-node-reader
  apiGroup: rbac.authorization.k8s.io

    kubectl apply -f igo-rolebinding.yaml
kubectl apply -f igo-crb.yaml

    查

    kubectl get rolebinding -n igo-ns
kubectl get clusterrolebinding igo-node-reader-binding
kubectl describe rolebinding igo-reader-binding -n igo-ns

# 权限自检
kubectl auth can-i get pods --as=system:serviceaccount:igo-ns:igo-sa -n igo-ns

    改

    kubectl edit rolebinding igo-reader-binding -n igo-ns

    删

    kubectl delete rolebinding igo-reader-binding -n igo-ns
kubectl delete clusterrolebinding igo-node-reader-binding

    常用运维操作

    下面以 igo-web（Deployment）为主，覆盖日常改副本、设资源上限、发布回滚等高频操作。
    ↑ 回到导航

    副本数扩缩容

    命令行（最快）

    # 扩到 5 副本
kubectl scale deploy/igo-web --replicas=5 -n igo-ns

# 缩到 1（或 0，相当于停服但保留 Deployment）
kubectl scale deploy/igo-web --replicas=1 -n igo-ns
kubectl scale deploy/igo-web --replicas=0 -n igo-ns

# StatefulSet 同理
kubectl scale sts/igo-db --replicas=3 -n igo-ns

    YAML 声明

    spec:
  replicas: 3

    # 改 YAML 后 apply，或直接 patch
kubectl patch deploy igo-web -n igo-ns -p '{"spec":{"replicas":3}}'

    查当前副本与就绪情况

    kubectl get deploy igo-web -n igo-ns
# READY 列形如 3/3 表示期望/就绪
kubectl get pods -l app=igo-web -n igo-ns -o wide

    若已配置 HPA，不要再用手工 scale 长期固定副本，否则会被 HPA 覆盖。

    CPU/内存 requests 与 limits

    概念简要：

    • requests：调度保证量（调度器按此选节点）
    • limits：硬上限；CPU 超限会被节流，内存超限常 OOMKill

    YAML（写在容器里）

    # igo-deploy-resources.yaml 片段
apiVersion: apps/v1
kind: Deployment
metadata:
  name: igo-web
  namespace: igo-ns
spec:
  replicas: 2
  selector:
    matchLabels:
      app: igo-web
  template:
    metadata:
      labels:
        app: igo-web
    spec:
      containers:
        - name: web
          image: nginx:1.25
          ports:
            - containerPort: 80
          resources:
            requests:
              cpu: "100m"      # 0.1 核
              memory: "128Mi"
            limits:
              cpu: "500m"      # 0.5 核
              memory: "256Mi"

    kubectl apply -f igo-deploy-resources.yaml

    命令行 patch（已有 Deployment）

    kubectl set resources deploy/igo-web -n igo-ns \
  --containers=web \
  --requests=cpu=100m,memory=128Mi \
  --limits=cpu=500m,memory=256Mi

    查实际用量与配置

    # 看 Pod 实际用量（需 metrics-server）
kubectl top pods -n igo-ns
kubectl top pod -l app=igo-web -n igo-ns --containers

# 看已配置的 requests/limits
kubectl get pod -l app=igo-web -n igo-ns \
  -o custom-columns=NAME:.metadata.name,CPU_REQ:.spec.containers[*].resources.requests.cpu,MEM_REQ:.spec.containers[*].resources.requests.memory,CPU_LIM:.spec.containers[*].resources.limits.cpu,MEM_LIM:.spec.containers[*].resources.limits.memory

# 或 describe 里看 Limits / Requests
kubectl describe pod -l app=igo-web -n igo-ns | grep -A6 'Limits\|Requests'

    常见取值参考（仅作起点）

    场景 requests limits
    轻量 Web（igo-web） cpu 100m / mem 128Mi cpu 500m / mem 256Mi
    中等 API cpu 250m / mem 256Mi cpu 1 / mem 512Mi
    批处理 Job 按峰值设 requests，limits ≈ 1～2× requests —

    命名空间配额（ResourceQuota / LimitRange）

    给整个 igo-ns 设「总预算」和「单容器默认/上限」，避免某个应用把节点打爆。

    ResourceQuota：命名空间总量

    # igo-quota.yaml
apiVersion: v1
kind: ResourceQuota
metadata:
  name: igo-quota
  namespace: igo-ns
spec:
  hard:
    requests.cpu: "4"
    requests.memory: 8Gi
    limits.cpu: "8"
    limits.memory: 16Gi
    pods: "20"
    persistentvolumeclaims: "10"

    kubectl apply -f igo-quota.yaml
kubectl get resourcequota -n igo-ns
kubectl describe resourcequota igo-quota -n igo-ns

    LimitRange：单 Pod/容器默认与上下限

    # igo-limitrange.yaml
apiVersion: v1
kind: LimitRange
metadata:
  name: igo-limitrange
  namespace: igo-ns
spec:
  limits:
    - type: Container
      defaultRequest:          # 未写 requests 时自动填
        cpu: "100m"
        memory: "128Mi"
      default:                 # 未写 limits 时自动填
        cpu: "500m"
        memory: "256Mi"
      max:
        cpu: "2"
        memory: 2Gi
      min:
        cpu: "50m"
        memory: "64Mi"

    kubectl apply -f igo-limitrange.yaml
kubectl get limitrange -n igo-ns
kubectl describe limitrange igo-limitrange -n igo-ns

    # 删除配额
kubectl delete resourcequota igo-quota -n igo-ns
kubectl delete limitrange igo-limitrange -n igo-ns

    HPA 自动扩缩

    按 CPU/内存（或自定义指标）自动调 Deployment 副本数。

    # igo-hpa.yaml
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: igo-web
  namespace: igo-ns
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: igo-web
  minReplicas: 2
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70

    # 快捷创建（需已设好 resources.requests.cpu）
kubectl autoscale deploy/igo-web -n igo-ns \
  --cpu-percent=70 --min=2 --max=10

# 或 apply YAML
kubectl apply -f igo-hpa.yaml

# 查
kubectl get hpa -n igo-ns
kubectl describe hpa igo-web -n igo-ns

# 改（如调大上限）
kubectl patch hpa igo-web -n igo-ns -p '{"spec":{"maxReplicas":15}}'

# 删
kubectl delete hpa igo-web -n igo-ns

    滚动更新与回滚

    # 换镜像触发滚动更新
kubectl set image deploy/igo-web web=nginx:1.26 -n igo-ns

# 看进度
kubectl rollout status deploy/igo-web -n igo-ns
kubectl rollout history deploy/igo-web -n igo-ns

# 回滚到上一版
kubectl rollout undo deploy/igo-web -n igo-ns

# 回滚到指定 revision
kubectl rollout undo deploy/igo-web --to-revision=2 -n igo-ns

# 暂停 / 恢复（批量改多项再一起发布）
kubectl rollout pause deploy/igo-web -n igo-ns
kubectl set resources deploy/igo-web -n igo-ns --limits=cpu=1,memory=512Mi
kubectl set image deploy/igo-web web=nginx:1.26 -n igo-ns
kubectl rollout resume deploy/igo-web -n igo-ns

# 重启所有 Pod（不改镜像，常用于吃到新 ConfigMap）
kubectl rollout restart deploy/igo-web -n igo-ns

    YAML 中可调发布策略：

    spec:
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0      # 更新时不允许不可用
      maxSurge: 1            # 最多多起 1 个新 Pod

    健康检查探针

    避免流量打到未就绪实例、卡死进程无人重启。

    containers:
  - name: web
    image: nginx:1.25
    ports:
      - containerPort: 80
    readinessProbe:            # 就绪才进 Service 负载
      httpGet:
        path: /
        port: 80
      initialDelaySeconds: 5
      periodSeconds: 10
    livenessProbe:             # 不健康则重启容器
      httpGet:
        path: /
        port: 80
      initialDelaySeconds: 15
      periodSeconds: 20
    startupProbe:              # 慢启动应用可先用这个
      httpGet:
        path: /
        port: 80
      failureThreshold: 30
      periodSeconds: 5

    # 看探针失败原因
kubectl describe pod -l app=igo-web -n igo-ns | grep -A20 'Liveness\|Readiness\|Startup\|Events'
kubectl get pods -n igo-ns   # READY 0/1 常与 readiness 有关

    环境变量与配置挂载

    # 直接设环境变量（会触发滚动更新）
kubectl set env deploy/igo-web APP_ENV=prod LOG_LEVEL=info -n igo-ns

# 从 ConfigMap / Secret 注入
kubectl set env deploy/igo-web --from=configmap/igo-config -n igo-ns
kubectl set env deploy/igo-web --from=secret/igo-secret -n igo-ns

# 删某个环境变量
kubectl set env deploy/igo-web LOG_LEVEL- -n igo-ns

    YAML 写法：

    containers:
  - name: web
    env:
      - name: APP_NAME
        value: igo
      - name: DB_PASSWORD
        valueFrom:
          secretKeyRef:
            name: igo-secret
            key: password
    envFrom:
      - configMapRef:
          name: igo-config
    volumeMounts:
      - name: igo-cfg
        mountPath: /etc/igo
        readOnly: true
volumes:
  - name: igo-cfg
    configMap:
      name: igo-config

    标签注解与排查

    # 打标签 / 注解
kubectl label deploy igo-web owner=igo tier=frontend -n igo-ns --overwrite
kubectl annotate deploy igo-web igo.io/change-id=CR-1001 -n igo-ns --overwrite

# 按标签筛选
kubectl get pods -l app=igo-web -n igo-ns
kubectl get all -l owner=igo -n igo-ns

# 常用排查
kubectl get events -n igo-ns --sort-by='.lastTimestamp'
kubectl logs -l app=igo-web -n igo-ns --tail=100 -f
kubectl logs deploy/igo-web -n igo-ns --previous          # 上次崩溃容器日志
kubectl exec -it deploy/igo-web -n igo-ns -- /bin/sh
kubectl port-forward svc/igo-web 8080:80 -n igo-ns

# 节点资源
kubectl top nodes
kubectl describe node <node-name> | grep -A20 Allocated

    优雅终止与强制删除

    # 默认会等 terminationGracePeriodSeconds（常为 30s）
kubectl delete pod igo-pod -n igo-ns

# 缩短等待
kubectl delete pod igo-pod -n igo-ns --grace-period=10

# 卡住删不掉时（慎用，可能留脏状态）
kubectl delete pod igo-pod -n igo-ns --force --grace-period=0

# Deployment 滚动时想更快腾出节点，可在 YAML 中设置

    spec:
  template:
    spec:
      terminationGracePeriodSeconds: 30
      containers:
        - name: web
          lifecycle:
            preStop:
              exec:
                command: ["sh", "-c", "sleep 5"]   # 给负载均衡摘流一点时间

    运维操作一览（igo-web）

    目标 命令
    改副本 kubectl scale deploy/igo-web --replicas=3 -n igo-ns
    设 CPU/内存 kubectl set resources deploy/igo-web ...
    换镜像发布 kubectl set image deploy/igo-web web=nginx:1.26 -n igo-ns
    回滚 kubectl rollout undo deploy/igo-web -n igo-ns
    重启 Pod kubectl rollout restart deploy/igo-web -n igo-ns
    看用量 kubectl top pods -n igo-ns
    自动扩缩 kubectl autoscale deploy/igo-web --cpu-percent=70 --min=2 --max=10 -n igo-ns
    注入环境变量 kubectl set env deploy/igo-web APP_ENV=prod -n igo-ns

    ↑ 回到导航

    推荐最小组合

    日常无状态 Web 应用，最小闭环通常是：

    Namespace(igo-ns)
  └─ Deployment(igo-web)
       ├─ ConfigMap(igo-config) / Secret(igo-secret)   # 可选
       └─ Service(igo-web)
            └─ Ingress(igo-web)                        # 对外 HTTP 时

    一键骨架示例：

    kubectl create ns igo-ns
kubectl create deploy igo-web --image=nginx:1.25 -n igo-ns
kubectl expose deploy/igo-web --port=80 -n igo-ns
kubectl get all -n igo-ns

    清理实验资源：

    kubectl delete ns igo-ns
# 集群级资源需单独删：PV / StorageClass / ClusterRole / ClusterRoleBinding
kubectl delete pv igo-pv --ignore-not-found
kubectl delete sc igo-fast --ignore-not-found
kubectl delete clusterrole igo-node-reader --ignore-not-found
kubectl delete clusterrolebinding igo-node-reader-binding --ignore-not-found

    附录：kind 缩写速查

    全称 缩写 igo 示例名
    Namespace ns igo-ns
    Pod po igo-pod
    Deployment deploy igo-web
    StatefulSet sts igo-db
    DaemonSet ds igo-agent
    Job job igo-batch
    CronJob cj igo-cleanup
    Service svc igo-web
    Ingress ing igo-web
    NetworkPolicy netpol igo-web-allow
    ConfigMap cm igo-config
    Secret secret igo-secret
    PersistentVolume pv igo-pv
    PersistentVolumeClaim pvc igo-pvc
    StorageClass sc igo-fast
    ServiceAccount sa igo-sa
    Role role igo-reader
    ClusterRole clusterrole igo-node-reader
    RoleBinding rolebinding igo-reader-binding
    ClusterRoleBinding clusterrolebinding igo-node-reader-binding

    ↑ 回到导航

    作者 · igozhang

    MP3