K8S 学习笔记（一）—— 集群的启动以及部署

# 拉镜像并启动容器
kubectl create deployment hello-minikube --image=kicbase/echo-server:1.0
# 使用 NodePort 暴露端口， --port=8080 对应服务内部的端口
kubectl expose deployment hello-minikube --type=NodePort --port=8080

kubectl get services hello-minikube

minikube service hello-minikube

kubectl port-forward service/hello-minikube 7080:8080

# 把你 本地电脑（Windows）的 7080 端口 转发到 Kubernetes 集群里的 Service hello-minikube 的 8080 端口。

minikube pause

minikube unpause

minikube stop

minikube config set memory 9001

minikube addons list

minikube start -p aged --kubernetes-version=v1.34.0

minikube delete --all

eyJhbGciOiJSUzI1NiIsImtpZCI6Ik5kcmRfcWo0RGRLSUI0Y3I1bXFLNm9aeUJoNjRvbHQzdFMwcG9KRmYtbk0ifQ.eyJhdWQiOlsiaHR0cHM6Ly9rdWJlcm5ldGVzLmRlZmF1bHQuc3ZjLmNsdXN0ZXIubG9jYWwiXSwiZXhwIj
oxNzk1Njg3Nzg4LCJpYXQiOjE3NjQxNTE3ODgsImlzcyI6Imh0dHBzOi8va3ViZXJuZXRlcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwianRpIjoiMDgxN2QyYTUtMjIxZC00NzUxLWE4ZDctZDUyMTZlMzAwZWFmIiwia3V
iZXJuZXRlcy5pbyI6eyJuYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsInNlcnZpY2VhY2NvdW50Ijp7Im5hbWUiOiJhZG1pbi11c2VyIiwidWlkIjoiZGI4MGZhM2ItZTcxOC00ODIxLTg1YWUtNTE2M2Q5MWNhZWU0
In19LCJuYmYiOjE3NjQxNTE3ODgsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlcm5ldGVzLWRhc2hib2FyZDphZG1pbi11c2VyIn0.wgv1-JvoLJBlsHMLaYyyTz0X9_luIwpNRdzcVVxu0cmK1L47X3mvL5T3YXKsX
2B-Ny8LatAnx_-Z0-HiTCh-KXigSZ6twqqsnNvb9MRnIfBoiGZcD2yL0tjFJoIVVSJLfJphfZSMtQC_cAvDt_tURwb4Wn9SGy5ZrgCwXdHnthmAapfNFtEWg167quMCoOYoycrk-MAlAiL4dNPaKaLQFb747sHCFFhTSsFd-snf1b
yP23MORxGF1gCT3iysrJ91pSknOTm9FCSjb6SiTCGR90k43yEpZ6787C--GZUyfpeFoa7HjWSlSzU77P-RE4SlGjYFKPynghK3vBPKMhI3TQ

minikube addons enable metrics-server

kubectl get apiservices

kubectl create namespace mem-example
# 你也可以改成自己想要的命名空间名字 这里 mem-example 我改成了 waite

apiVersion: v1
kind: Pod
metadata:
  name: memory-demo
  namespace: waite
spec:
  containers:
  - name: memory-demo-ctr
    image: polinux/stress
    resources:
      requests:
        memory: "100Mi"
      limits:
        memory: "200Mi"
    command: ["stress"]
    args: ["--vm", "1", "--vm-bytes", "150M", "--vm-hang", "1"]

kubectl apply -f memory-request-limit.yaml --namespace=waite

kubectl get pod memory-demo --namespace=waite
kubectl get pod -n waite

kubectl get pod memory-demo --output=yaml --namespace=waite

kubectl top pod memory-demo --namespace=waite

NAME          CPU(cores)   MEMORY(bytes)   
memory-demo   76m          150Mi

kubectl delete pod memory-demo --namespace=waite

apiVersion: v1
kind: Pod
metadata:
  name: memory-demo-2
  namespace: waite
spec:
  containers:
  - name: memory-demo-2-ctr
    image: polinux/stress
    resources:
      requests:
        memory: "50Mi"
      limits:
        memory: "100Mi"
    command: ["stress"]
    args: ["--vm", "1", "--vm-bytes", "250M", "--vm-hang", "1"]

kubectl apply -f memory-request-limit.yaml --namespace=waite

D:\k8s>kubectl get pod memory-demo-1 --namespace=waite
NAME            READY   STATUS      RESTARTS       AGE
memory-demo-1   0/1     OOMKilled   5 (107s ago)   3m32s

D:\k8s>kubectl get pod memory-demo-1 --namespace=waite
NAME            READY   STATUS             RESTARTS      AGE
memory-demo-1   0/1     CrashLoopBackOff   5 (17s ago)   3m35s
# 容器反复重启又崩溃

D:\k8s>kubectl get pod memory-demo-1 --output=yaml --namespace=waite
	......
   lastState:
      terminated:
        containerID: docker://718a86ad475ac286f097a31b6dd678aa2656d05df63fdb27aae32658b7ca19a6
        exitCode: 1
        finishedAt: "2025-11-27T01:52:34Z"
        reason: OOMKilled
        startedAt: "2025-11-27T01:52:34Z"
# 输出结果显示：由于内存溢出（OOM），容器已被杀掉

apiVersion: v1
kind: Pod
metadata:
  name: memory-demo-2
  namespace: waite
spec:
  containers:
  - name: memory-demo-3-ctr
    image: polinux/stress
    resources:
      requests:
        memory: "1000Gi"
      limits:
        memory: "1000Gi"
    command: ["stress"]
    args: ["--vm", "1", "--vm-bytes", "150M", "--vm-hang", "1"]

D:\k8s>kubectl apply -f memory-request-limit.yaml --namespace=waite
pod/memory-demo-2 created

D:\k8s>kubectl get pod -n waite
NAME            READY   STATUS    RESTARTS   AGE
memory-demo-2   0/1     Pending   0          3s
# 输出结果显示：Pod 处于 PENDING 状态。 这意味着，该 Pod 没有被调度至任何节点上运行，并且它会无限期的保持该状态：

D:\k8s>kubectl describe pod memory-demo-2 --namespace=waite
Events:
  Type     Reason            Age   From               Message
  ----     ------            ----  ----               -------
  Warning  FailedScheduling  49s   default-scheduler  0/1 nodes are available: 1 Insufficient memory. no new claims to deallocate, preemption: 0/1 nodes are available: 1 Preemption is not helpful for scheduling.
# 输出结果显示：由于节点内存不足，该容器无法被调度：

apiVersion: v1
kind: Pod
metadata:
  name: cpu-demo
  namespace: waite
spec:
  containers:
  - name: cpu-demo-ctr
    image: polinux/stress
    resources:
      limits:
        cpu: "1"
      requests:
        cpu: "0.5"
    args:
    - -cpus
    - "2"

D:\k8s>kubectl get pod cpu-demo --namespace=waite
NAME       READY   STATUS    RESTARTS   AGE
cpu-demo   1/1     Running   0          2m46s

D:\k8s>kubectl get pod cpu-demo --output=yaml --namespace=waite
spec:
  containers:
  - args:
    - -cpus
    - "2"
    image: vish/stress
    imagePullPolicy: Always
    name: cpu-demo-ctr
    resources:
      limits:
        cpu: "1"
      requests:
        cpu: 500m
# 输出显示 Pod 中的一个容器的 CPU 请求为 500 milliCPU，并且 CPU 限制为 1 个 CPU。

D:\k8s>kubectl top pod cpu-demo --namespace=waite
NAME       CPU(cores)   MEMORY(bytes)   
cpu-demo   1000m        0Mi
# 此示例输出显示 Pod 使用的是 1000 M，小于等于限制的 1 GPU,  如果你的容器在只有 1 个 CPU 的节点上运行，则容器无论为容器指定的 CPU 限制如何， 都不能使用超过 1 个 CPU。

apiVersion: v1
kind: Pod
metadata:
  name: redis
spec:
  containers:
  - name: redis
    image: redis
    volumeMounts:
    - name: redis-storage
      mountPath: /data/redis
  volumes:
  - name: redis-storage
    emptyDir: {}

# 这里假定你的节点使用 "sudo" 来以超级用户角色执行命令
sudo mkdir /mnt/data

# 这里再次假定你的节点使用 "sudo" 来以超级用户角色执行命令
sudo sh -c "echo 'Hello from Kubernetes storage' > /mnt/data/index.html"

cat /mnt/data/index.html

Hello from Kubernetes storage

apiVersion: v1
kind: PersistentVolume
metadata:
  name: task-pv-volume
  labels:
    type: local
spec:
  storageClassName: manual
  capacity:
    storage: 10Gi
  accessModes:
    - ReadWriteOnce
  hostPath:
    path: "/mnt/data"

kubectl apply -f https://k8s.io/examples/pods/storage/pv-volume.yaml

kubectl get pv task-pv-volume

NAME             CAPACITY   ACCESSMODES   RECLAIMPOLICY   STATUS      CLAIM     STORAGECLASS   REASON    AGE
task-pv-volume   10Gi       RWO           Retain          Available             manual                 

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: task-pv-claim
spec:
  storageClassName: manual
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 3Gi

# 这里假定你的节点使用 "sudo" 来以超级用户角色执行命令
sudo mkdir /mnt/data

# 这里再次假定你的节点使用 "sudo" 来以超级用户角色执行命令
sudo sh -c "echo 'Hello from Kubernetes storage' > /mnt/data/index.html"

cat /mnt/data/index.html

Hello from Kubernetes storage

apiVersion: v1
kind: PersistentVolume
metadata:
  name: task-pv-volume
  labels:
    type: local
spec:
  storageClassName: manual
  capacity:
    storage: 10Gi
  accessModes:
    - ReadWriteOnce
  hostPath:
    path: "/mnt/data"

kubectl apply -f https://k8s.io/examples/pods/storage/pv-volume.yaml

kubectl get pv task-pv-volume

NAME             CAPACITY   ACCESSMODES   RECLAIMPOLICY   STATUS      CLAIM     STORAGECLASS   REASON    AGE
task-pv-volume   10Gi       RWO           Retain          Available             manual                   4s

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: task-pv-claim
spec:
  storageClassName: manual
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 3Gi

kubectl apply -f https://k8s.io/examples/pods/storage/pv-claim.yaml

kubectl get pv task-pv-volume

NAME             CAPACITY   ACCESSMODES   RECLAIMPOLICY   STATUS    CLAIM                   STORAGECLASS   REASON    AGE
task-pv-volume   10Gi       RWO           Retain          Bound     default/task-pv-claim   manual                   2m

kubectl get pvc task-pv-claim

NAME            STATUS    VOLUME           CAPACITY   ACCESSMODES   STORAGECLASS   AGE
task-pv-claim   Bound     task-pv-volume   10Gi       RWO           manual         30s

apiVersion: v1
kind: Pod
metadata:
  name: task-pv-pod
spec:
  volumes:
    - name: task-pv-storage
      persistentVolumeClaim:
        claimName: task-pv-claim
  containers:
    - name: task-pv-container
      image: nginx
      ports:
        - containerPort: 80
          name: "http-server"
      volumeMounts:
        - mountPath: "/usr/share/nginx/html"
          name: task-pv-storage

kubectl apply -f https://k8s.io/examples/pods/storage/pv-pod.yaml

kubectl get pod task-pv-pod

kubectl exec -it task-pv-pod -- /bin/bash

# 一定要在上一步 "kubectl exec" 所返回的 Shell 中执行下面三个命令
apt update
apt install curl
curl http://localhost/

Hello from Kubernetes storage

apiVersion: v1
kind: Pod
metadata:
  name: test-projected-volume
spec:
  containers:
  - name: test-projected-volume
    image: busybox:1.28
    args:
    - sleep
    - "86400"
    volumeMounts:
    - name: all-in-one
      mountPath: "/projected-volume"
      readOnly: true
  volumes:
  - name: all-in-one
    projected:
      sources:
      - secret:
          name: user
      - secret:
          name: pass

docker login

cat ~/.docker/config.json

{
    "auths": {
        "https://index.docker.io/v1/": {
            "auth": "c3R...zE2"
        }
    }
}

kubectl create secret generic regcred \
    --from-file=.dockerconfigjson=<path/to/.docker/config.json> \
    --type=kubernetes.io/dockerconfigjson

apiVersion: v1
kind: Secret
metadata:
  name: myregistrykey
  namespace: awesomeapps
data:
  .dockerconfigjson: UmVhbGx5IHJlYWxseSByZWVlZWVlZWVlZWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGx5eXl5eXl5eXl5eXl5eXl5eXl5eSBsbGxsbGxsbGxsbGxsbG9vb29vb29vb29vb29vb29vb29vb29vb29vb25ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubmdnZ2dnZ2dnZ2dnZ2dnZ2dnZ2cgYXV0aCBrZXlzCg==
type: kubernetes.io/dockerconfigjson

kubectl create secret docker-registry regcred \
  --docker-server=<你的镜像仓库服务器> \
  --docker-username=<你的用户名> \
  --docker-password=<你的密码> \
  --docker-email=<你的邮箱地址>

kubectl get secret regcred --output=yaml

apiVersion: v1
kind: Secret
metadata:
  ...
  name: regcred
  ...
data:
  .dockerconfigjson: eyJodHRwczovL2luZGV4L ... J0QUl6RTIifX0=
type: kubernetes.io/dockerconfigjson

kubectl get secret regcred --output="jsonpath={.data.\.dockerconfigjson}" | base64 --decode

{"auths":{"your.private.registry.example.com":{"username":"janedoe","password":"xxxxxxxxxxx","email":"jdoe@example.com","auth":"c3R...zE2"}}}

echo "c3R...zE2" | base64 --decode

janedoe:xxxxxxxxxxx

apiVersion: v1
kind: Pod
metadata:
  name: private-reg
spec:
  containers:
  - name: private-reg-container
    image: <your-private-image>
  imagePullSecrets:
  - name: regcred

curl -L -o my-private-reg-pod.yaml https://k8s.io/examples/pods/private-reg-pod.yaml

your.private.registry.example.com/janedoe/jdoe-private:v1

kubectl apply -f my-private-reg-pod.yaml
kubectl get pod private-reg

kubectl describe pod private-reg

Events:
  ...  Reason                           ...  Message
       ------                                -------
  ...  FailedToRetrieveImagePullSecret  ...  Unable to retrieve some image pull secrets (<regcr

apiVersion: v1
kind: Pod
metadata:
  labels:
    test: liveness
  name: liveness-exec
spec:
  containers:
  - name: liveness
    image: registry.k8s.io/busybox:1.27.2
    args:
    - /bin/sh
    - -c
    - touch /tmp/healthy; sleep 30; rm -f /tmp/healthy; sleep 600
    livenessProbe:
      exec:
        command:
        - cat
        - /tmp/healthy
      initialDelaySeconds: 5
      periodSeconds: 5

/bin/sh -c "touch /tmp/healthy; sleep 30; rm -f /tmp/healthy; sleep 600"

kubectl apply -f https://k8s.io/examples/pods/probe/exec-liveness.yaml

kubectl describe pod liveness-exec

Type    Reason     Age   From               Message
----    ------     ----  ----               -------
Normal  Scheduled  11s   default-scheduler  Successfully assigned default/liveness-exec to node01
Normal  Pulling    9s    kubelet, node01    Pulling image "registry.k8s.io/busybox:1.27.2"
Normal  Pulled     7s    kubelet, node01    Successfully pulled image "registry.k8s.io/busybox:1.27.2"
Normal  Created    7s    kubelet, node01    Created container liveness
Normal  Started    7s    kubelet, node01    Started container liveness

kubectl describe pod liveness-exec

Type     Reason     Age                From               Message
----     ------     ----               ----               -------
Normal   Scheduled  57s                default-scheduler  Successfully assigned default/liveness-exec to node01
Normal   Pulling    55s                kubelet, node01    Pulling image "registry.k8s.io/busybox:1.27.2"
Normal   Pulled     53s                kubelet, node01    Successfully pulled image "registry.k8s.io/busybox:1.27.2"
Normal   Created    53s                kubelet, node01    Created container liveness
Normal   Started    53s                kubelet, node01    Started container liveness
Warning  Unhealthy  10s (x3 over 20s)  kubelet, node01    Liveness probe failed: cat: can't open '/tmp/healthy': No such file or directory
Normal   Killing    10s                kubelet, node01    Container liveness failed liveness probe, will be restarted

kubectl get pod liveness-exec

NAME            READY     STATUS    RESTARTS   AGE
liveness-exec   1/1       Running   1          1m

apiVersion: v1
kind: Pod
metadata:
  labels:
    test: liveness
  name: liveness-http
spec:
  containers:
  - name: liveness
    image: registry.k8s.io/e2e-test-images/agnhost:2.40
    args:
    - liveness
    livenessProbe:
      httpGet:
        path: /healthz
        port: 8080
        httpHeaders:
        - name: Custom-Header
          value: Awesome
      initialDelaySeconds: 3
      periodSeconds: 3

http.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
    duration := time.Now().Sub(started)
    if duration.Seconds() > 10 {
        w.WriteHeader(500)
        w.Write([]byte(fmt.Sprintf("error: %v", duration.Seconds())))
    } else {
        w.WriteHeader(200)
        w.Write([]byte("ok"))
    }
})

kubectl apply -f https://k8s.io/examples/pods/probe/http-liveness.yaml

kubectl describe pod liveness-http

apiVersion: v1
kind: Pod
metadata:
  name: goproxy
  labels:
    app: goproxy
spec:
  containers:
  - name: goproxy
    image: registry.k8s.io/goproxy:0.1
    ports:
    - containerPort: 8080
    readinessProbe:
      tcpSocket:
        port: 8080
      initialDelaySeconds: 15
      periodSeconds: 10
    livenessProbe:
      tcpSocket:
        port: 8080
      initialDelaySeconds: 15
      periodSeconds: 10

kubectl apply -f https://k8s.io/examples/pods/probe/tcp-liveness-readiness.yaml

kubectl describe pod goproxy

apiVersion: v1
kind: Pod
metadata:
  name: etcd-with-grpc
spec:
  containers:
  - name: etcd
    image: registry.k8s.io/etcd:3.5.1-0
    command: [ "/usr/local/bin/etcd", "--data-dir",  "/var/lib/etcd", "--listen-client-urls", "http://0.0.0.0:2379", "--advertise-client-urls", "http://127.0.0.1:2379", "--log-level", "debug"]
    ports:
    - containerPort: 2379
    livenessProbe:
      grpc:
        port: 2379
      initialDelaySeconds: 10

kubectl apply -f https://k8s.io/examples/pods/probe/grpc-liveness.yaml

kubectl describe pod etcd-with-grpc

ports:
- name: liveness-port
  containerPort: 8080

livenessProbe:
  httpGet:
    path: /healthz
    port: liveness-port

ports:
- name: liveness-port
  containerPort: 8080

livenessProbe:
  httpGet:
    path: /healthz
    port: liveness-port
  failureThreshold: 1
  periodSeconds: 10

startupProbe:
  httpGet:
    path: /healthz
    port: liveness-port
  failureThreshold: 30
  periodSeconds: 10

readinessProbe:
  exec:
    command:
    - cat
    - /tmp/healthy
  initialDelaySeconds: 5
  periodSeconds: 5

livenessProbe:
  httpGet:
    httpHeaders:
      - name: Accept
        value: application/json

startupProbe:
  httpGet:
    httpHeaders:
      - name: User-Agent
        value: MyUserAgent

livenessProbe:
  httpGet:
    httpHeaders:
      - name: Accept
        value: ""

startupProbe:
  httpGet:
    httpHeaders:
      - name: User-Agent
        value: ""

Events:
  Type     Reason        Age                     From               Message
  ----     ------        ----                    ----               -------
  Normal   Scheduled     29m                     default-scheduler  Successfully assigned default/httpbin-7b8bc9cb85-bjzwn to daocloud
  Normal   Pulling       29m                     kubelet            Pulling image "docker.io/kennethreitz/httpbin"
  Normal   Pulled        24m                     kubelet            Successfully pulled image "docker.io/kennethreitz/httpbin" in 5m12.402735213s
  Normal   Created       24m                     kubelet            Created container httpbin
  Normal   Started       24m                     kubelet            Started container httpbin
 Warning  ProbeWarning  4m11s (x1197 over 24m)  kubelet            Readiness probe warning: Probe terminated redirects

spec:
  terminationGracePeriodSeconds: 3600  # Pod 级别设置
  containers:
  - name: test
    image: ...

    ports:
    - name: liveness-port
      containerPort: 8080

    livenessProbe:
      httpGet:
        path: /healthz
        port: liveness-port
      failureThreshold: 1
      periodSeconds: 60
      # 重载 Pod 级别的 terminationGracePeriodSeconds
      terminationGracePeriodSeconds: 60