1 篇博文 含有标签「Pod」

apiVersion: v1          # API 版本，Pod 属于核心 v1 组
kind: Pod               # 资源类型
metadata:
  name: nginx-pod       # Pod 名称，在同一个 Namespace 内必须唯一
  namespace: default    # 命名空间，不指定则使用 default
  labels:               # 标签，用于选择器和组织资源
    app: nginx
    tier: frontend
  annotations:          # 注解，用于存储非标识性的元数据
    description: "A sample nginx pod"
spec:
  # --- 重启策略 ---
  restartPolicy: Always  # 容器退出后的重启策略：Always / OnFailure / Never

  # --- 节点选择 ---
  nodeSelector:          # 通过标签选择节点
    disktype: ssd
  tolerations:           # 容忍度，用于调度到有特定 Taint 的节点
  - key: "dedicated"
    operator: "Equal"
    value: "gpu"
    effect: "NoSchedule"

  # --- 容器定义 ---
  containers:
  - name: nginx          # 容器名称
    image: nginx:1.27    # 镜像地址（含标签）
    imagePullPolicy: IfNotPresent  # 镜像拉取策略：Always / IfNotPresent / Never
    ports:
    - containerPort: 80  # 容器暴露的端口（仅声明，不自动发布）
      protocol: TCP
    resources:           # 资源请求与限制
      requests:          # 调度时保证的最小资源量
        cpu: "100m"      # 100 millicores = 0.1 核
        memory: "128Mi"
      limits:            # 容器可使用的最大资源量
        cpu: "500m"
        memory: "256Mi"
    env:                 # 环境变量
    - name: ENVIRONMENT
      value: "production"
    - name: DB_PASSWORD
      valueFrom:
        secretKeyRef:
          name: db-secret
          key: password
    volumeMounts:        # 挂载存储卷
    - name: nginx-data
      mountPath: /usr/share/nginx/html
    livenessProbe:       # 存活探针
      httpGet:
        path: /healthz
        port: 80
      initialDelaySeconds: 15
      periodSeconds: 10
    readinessProbe:      # 就绪探针
      httpGet:
        path: /ready
        port: 80
      initialDelaySeconds: 5
      periodSeconds: 5
    startupProbe:        # 启动探针（K8s 1.18+）
      httpGet:
        path: /startup
        port: 80
      failureThreshold: 30  # 最多失败 30 次（即最多等待 300 秒）

  # --- Init 容器 ---
  initContainers:
  - name: init-db
    image: busybox:1.36
    command: ['sh', '-c', 'until nslookup db-service; do echo waiting for db; sleep 2; done']

  # --- 存储卷 ---
  volumes:
  - name: nginx-data
    persistentVolumeClaim:
      claimName: nginx-pvc  # 引用 PVC
  - name: config-volume
    configMap:
      name: nginx-config    # 引用 ConfigMap

  # --- DNS 配置 ---
  dnsPolicy: ClusterFirst  # DNS 策略：ClusterFirst / Default / ClusterFirstWithHostNet / None

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  namespace: default
  labels:
    app: nginx
spec:
  replicas: 3                          # 期望的 Pod 副本数
  revisionHistoryLimit: 10             # 保留的历史 ReplicaSet 数量
  strategy:
    type: RollingUpdate                # 更新策略：RollingUpdate / Recreate
    rollingUpdate:
      maxSurge: 1                      # 滚动更新时最多多创建 1 个 Pod
      maxUnavailable: 0                # 滚动更新时最多允许 0 个 Pod 不可用
  selector:
    matchLabels:                       # 必须与 Pod template 的 labels 匹配
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.27
        ports:
        - containerPort: 80
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 500m
            memory: 256Mi
        livenessProbe:
          httpGet:
            path: /
            port: 80
          initialDelaySeconds: 10
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /
            port: 80
          initialDelaySeconds: 5
          periodSeconds: 5

apiVersion: v1
kind: Service                     # Headless Service，用于稳定的网络标识
metadata:
  name: mysql
  labels:
    app: mysql
spec:
  clusterIP: None                # Headless Service：不分配 ClusterIP
  selector:
    app: mysql
  ports:
  - port: 3306
    targetPort: 3306
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mysql
spec:
  serviceName: mysql             # 必须指向关联的 Headless Service
  replicas: 3
  selector:
    matchLabels:
      app: mysql
  template:
    metadata:
      labels:
        app: mysql
    spec:
      containers:
      - name: mysql
        image: mysql:8.0
        ports:
        - containerPort: 3306
        env:
        - name: MYSQL_ROOT_PASSWORD
          valueFrom:
            secretKeyRef:
              name: mysql-secret
              key: root-password
        volumeMounts:
        - name: data
          mountPath: /var/lib/mysql
        livenessProbe:
          exec:
            command: ["mysqladmin", "ping", "-h", "localhost"]
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          exec:
            command: ["mysql", "-h", "localhost", "-e", "SELECT 1"]
          initialDelaySeconds: 5
          periodSeconds: 5
  volumeClaimTemplates:          # 为每个 Pod 自动创建独立的 PVC
  - metadata:
      name: data
    spec:
      accessModes: ["ReadWriteOnce"]
      storageClassName: standard
      resources:
        requests:
          storage: 10Gi

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: node-exporter
  namespace: monitoring
  labels:
    app: node-exporter
spec:
  selector:
    matchLabels:
      app: node-exporter
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1           # 最多允许 1 个节点上的 Pod 不可用
  template:
    metadata:
      labels:
        app: node-exporter
    spec:
      hostNetwork: true           # 使用宿主机网络（监控场景常见）
      hostPID: true               # 使用宿主机 PID 命名空间
      tolerations:                # 容忍所有 Taint，确保在所有节点上运行
      - operator: Exists
      containers:
      - name: node-exporter
        image: prom/node-exporter:v1.8.0
        args:
        - "--web.listen-address=:9100"
        - "--path.procfs=/host/proc"
        - "--path.sysfs=/host/sys"
        ports:
        - containerPort: 9100
          hostPort: 9100
        volumeMounts:
        - name: proc
          mountPath: /host/proc
          readOnly: true
        - name: sys
          mountPath: /host/sys
          readOnly: true
        resources:
          limits:
            cpu: 200m
            memory: 100Mi
      volumes:
      - name: proc
        hostPath:
          path: /proc
      - name: sys
        hostPath:
          path: /sys

apiVersion: batch/v1
kind: CronJob
metadata:
  name: database-backup
spec:
  schedule: "0 2 * * *"              # 每天凌晨 2 点执行
  concurrencyPolicy: Forbid          # 禁止并发运行
  successfulJobsHistoryLimit: 3      # 保留最近 3 个成功的 Job
  failedJobsHistoryLimit: 1          # 保留最近 1 个失败的 Job
  jobTemplate:
    spec:
      backoffLimit: 2
      activeDeadlineSeconds: 3600    # 超过 1 小时则标记为失败
      template:
        spec:
          containers:
          - name: backup
            image: postgres:16
            command:
            - /bin/bash
            - -c
            - pg_dump -h db-service -U $DB_USER -d $DB_NAME > /backup/$(date +%Y%m%d).sql
            env:
            - name: DB_USER
              valueFrom:
                secretKeyRef:
                  name: db-secret
                  key: username
            - name: DB_NAME
              value: "myapp"
            volumeMounts:
            - name: backup-data
              mountPath: /backup
          restartPolicy: Never        # Job 必须设置为 Never 或 OnFailure
          volumes:
          - name: backup-data
            persistentVolumeClaim:
              claimName: backup-pvc

apiVersion: batch/v1
kind: Job
metadata:
  name: data-migration
spec:
  completions: 1                     # 需要成功完成 1 次
  parallelism: 1                     # 同时运行 1 个 Pod
  backoffLimit: 3                    # 最多重试 3 次
  activeDeadlineSeconds: 600         # 超时 10 分钟
  ttlSecondsAfterFinished: 86400     # 完成后 24 小时自动清理
  template:
    spec:
      restartPolicy: Never
      containers:
      - name: migrate
        image: myapp:v2.0
        command: ["python", "manage.py", "migrate"]
        env:
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: app-secrets
              key: database-url