ʹÓà Kubernetes£¬´ó¼Ò¶¼»áÓöµ½ÄÄЩ´íÎ󣿱¾ÎÄ·ÖÏíÁË×÷Õ߶àÄêÀ´Ê¹Óà Kubernetes ×î³£¼ûµÄ 10 ¸ö´íÎó¡£
ʹÓà kubernetes Õâô¶àÄêÒÔÀ´£¬ÎÒÃǼû¹ýµÄ¼¯Èº²»¼ÆÆäÊý£¨°üÀ¨ÍйܵĺͷÇÍйܵģ¬GCP¡¢AWS ºÍ Azure ÉϵĶ¼ÓУ©£¬»¹¼ûʶÁ˺ܶླ£Öظ´³öÏֵĴíÎó¡£ÆäÖд󲿷ִíÎóÎÒÃÇ×Ô¼ºÒ²·¸¹ý£¬Õâûʲô¶ªÈ˵ģ¡
±¾ÎÄ»á¸ø´ó¼ÒչʾһЩÎÒÃǾ³£Óöµ½µÄÎÊÌ⣬²¢Ì¸Ì¸ÐÞ¸´ËüÃǵķ½·¨¡£
ÕâÎÞÒÉÊÇ×îÖµµÃ¹Ø×¢µÄ£¬Ò²ÊÇÕâ¸ö°ñµ¥ÉϵĵÚÒ»Ãû¡£
ÈËÃǾ³£²»ÉèÖà CPU ÇëÇó»ò½« CPU ÇëÇóÉèÖõùýµÍ£¨ÕâÑùÎÒÃǾͿÉÒÔÔÚÿ¸ö½ÚµãÉÏÈÝÄɺܶà Pod£©£¬½á¹û½Úµã¾Í»á¹ýÁ¿Ê¹Óã¨overcommited£©¡£ÔÚÐèÇó½Ï¸ßʱ£¬½ÚµãµÄ CPU È«¸ººÉÔËÐУ¬¶øÎÒÃǵĸºÔØÖ»Äܵõ½¡°ËüËùÇëÇóµÄ¡±Êý¾Ý£¬Ê¹ CPU ½ÚÁ÷£¨throttled£©£¬´Ó¶øµ¼ÖÂÓ¦ÓóÌÐòÑӳٺͳ¬Ê±µÈÖ¸±êÔö¼Ó¡£
BestEffort£¨²»ÒªÕâÑù×ö£©£º
resources:?{}?
very low cpu£¨²»ÒªÕâÑù×ö£©£º
resources:???????requests:?????????cpu:?"1m"?
ÁíÒ»·½Ã棬ÆôÓà CPU ÏÞÖÆ¿ÉÄÜ»áÔÚ½ÚµãµÄ CPU ûÓгä·ÖÀûÓõÄÇé¿öÏ£¬¶Ô Pod ½øÐв»±ØÒªµØ½ÚÁ÷£¬ÕâÒ²»áµ¼ÖÂÑÓ³ÙÔö¼Ó¡£ÈËÃÇÒ²ÌÖÂÛ¹ý¹ØÓÚ Linux ÄÚºËÖÐµÄ CPU CFS Åä¶î£¬ºÍÒòΪÉèÖÃÁË CPU ÏÞÖƲ¢¹Ø±Õ CFS Åä¶î¶øµ¼Ö嵀 CPU ½ÚÁ÷ÎÊÌâ¡£CPU ÏÞÖÆÔì³ÉµÄÎÊÌâ¿ÉÄÜ»á±ÈËüÄܽâ¾öµÄÎÊÌ⻹¶à¡£ÏëÁ˽â¸ü¶àÐÅÏ¢£¬Çë²é¿´ÏÂÃæµÄÁ´½Ó¡£
ÄÚ´æ¹ýÁ¿Ê¹Óûá¸øÎÒÃÇ´øÀ´¸ü¶àÂé·³¡£´ïµ½ CPU ÏÞÖƽ«µ¼Ö½ÚÁ÷£¬´ïµ½ÄÚ´æÏÞÖƻᵼÖ Pod ±»É±¡£¼û¹ý OOMkill£¨ÒòÄÚ´æ²»×ã¶ø±»É±ËÀ£©Âð£¿ÎÒÃÇҪ˵µÄ¾ÍÊÇÕâ¸öÒâ˼¡£ÏëÒª¾¡Á¿¼õÉÙÕâÀà×´¿ö£¿ÄǾͲ»Òª¹ýÁ¿Ê¹ÓÃÄڴ棬²¢Ê¹Óà Guaranteed QoS£¨Quality of Service£©½«ÄÚ´æÇëÇóÉèÖÃΪÓëÏÞÖÆÏàµÈ£¬¾ÍÏñÏÂÃæµÄÀý×ÓÄÇÑù¡£Á˽â¸ü¶àÐÅÏ¢£¬Çë²Î¿¼ Henning Jacobs£¨Zalando£©µÄÑݽ²¡£
https://www.slideshare.net/try_except_/optimizing-kubernetes-resource-requestslimits-for-costefficiency-and-latency-highload
Burstable£¨ÈÝÒ×´øÀ´¸ü¶à OOMkilled£©£º
resources:???????requests:?????????memory:?"128Mi"?????????cpu:?"500m"???????limits:?????????memory:?"256Mi"?????????cpu:?2?
Guaranteed£º
resources:??????requests:????????memory:?"128Mi"????????cpu:?2??????limits:????????memory:?"128Mi"????????cpu:?2?
ÄÇôÎÒÃÇÉèÖÃ×ÊԴʱÓÐʲô¾÷ÇÏÄØ£¿
ÎÒÃÇ¿ÉÒÔʹÓà metrics-server ²é¿´ Pod£¨ÒÔ¼°ÆäÖеÄÈÝÆ÷£©µÄµ±Ç° CPU ºÍÄÚ´æʹÓÃÇé¿ö¡£Äã¿ÉÄÜÒѾÆôÓÃËüÁË¡£Ö»ÐèÔËÐÐÒÔÏÂÃüÁî¼´¿É£º
kubectl?top?pods?kubectl?top?pods?--containers?kubectl?top?nodes?
²»¹ý£¬ÕâЩֻ»áÏÔʾµ±Ç°µÄʹÓÃÇé¿ö¡£Òª´óÖÂÁ˽âÕâЩÊý¾ÝµÄ»°Õâ¾Í¹»ÓÃÁË£¬µ«ÎÒÃǵ½Í·À´ÊÇÏ£ÍûÄܼ°Ê±¿´µ½ÕâЩʹÓÃÁ¿Ö¸±ê£¨ÒԻشðÖîÈ磺×òÌìÉÏÎç CPU ʹÓÃÁ¿µÄ·åÖµµÈÎÊÌ⣩¡£Îª´ËÎÒÃÇ¿ÉÒÔʹÓà Prometheus ºÍ DataDog µÈ¹¤¾ß¡£ËüÃÇÖ»ÊÇ´Ó metrics-server ½ÓÊÕ¶ÈÁ¿Êý¾Ý²¢´æ´¢ÏÂÀ´£¬È»ºóÎÒÃǾÍÄܲéѯºÍ»æÖÆÕâЩÊý¾ÝÁË¡£
VerticalPodAutoscaler ¿ÉÒÔ°ïÖúÎÒÃÇ×Ô¶¯»¯ÕâÒ»ÊÖ¶¯¹ý³Ì¡ª¡ª¼°Ê±²é¿´ cpu/ ÄÚ´æµÄʹÓÃÇé¿ö£¬²¢»ùÓÚÕâЩÊý¾ÝÔÙÉèÖÃеÄÇëÇóºÍÏÞÖÆ¡£
https://cloud.google.com/kubernetes-engine/docs/concepts/verticalpodautoscaler
ÓÐЧÀûÓüÆËã×ÊÔ´²»ÊÇÒ»¼þÈÝÒ×µÄÊÂÇ飬¾ÍÏñ²»Í£µØÍæ¶íÂÞ˹·½¿é¡£Èç¹ûÎÒÃÇ·¢ÏÖ×Ô¼º»¨ÁË´ó±ÊÇ®¹ºÂò¼ÆËã×ÊÔ´£¬¿ÉÊÇƽ¾ùÀûÓÃÂÊÈ´ºÜµÍ£¨±ÈÈç´óÔ¼ 10%£©£¬ÄÇôÎÒÃÇ¿ÉÄܾÍÐèÒª AWS Fargate »ò»ùÓÚ Virtual Kubelet µÄ²úÆ·¡£ËüÃÇÖ÷ҪʹÓÃÎÞ·þÎñÆ÷ / °´Ê¹ÓÃÁ¿¸¶·ÑµÄµÄ¼Æ·Ñģʽ£¬Õâ¶ÔÎÒÃÇÀ´Ëµ¿ÉÄÜ»á¸üÊ¡Ç®¡£
ĬÈÏÇé¿öÏ£¬Kubernetes ²»»áÖ¸¶¨ÈκΠliveness ºÍ readiness ̽Õë¡£ÓÐʱËü»áÒ»Ö±±£³ÖÕâÖÖ״̬¡¡
µ«Èç¹û³öÏÖ²»¿É»Ö¸´µÄ´íÎó£¬ÎÒÃǵķþÎñ½«ÈçºÎÖØÐÂÆô¶¯ÄØ£¿¸ºÔؾùºâÆ÷ÈçºÎÖªµÀÌض¨µÄ Pod ¿ÉÒÔ¿ªÊ¼´¦ÀíÁ÷Á¿£¬»òÄÜ´¦Àí¸ü¶àÁ÷Á¿ÄØ£¿
ÈËÃÇͨ³£²»ÖªµÀÕâÁ½Õß¼äµÄÇø±ð¡£
ËüÃÇÁ½¸ö¶¼ÔËÐÐÔÚÕû¸ö Pod ÉúÃüÖÜÆÚÖС£ÕâÒ»µãÊǺÜÖØÒªµÄ¡£
ÈËÃÇͨ³£ÈÏΪ£¬readiness ̽ÕëÖ»ÔÚ¿ªÊ¼Ê±ÔËÐУ¬ÒÔÅÐ¶Ï Pod ºÎʱ Ready ²¢¿ÉÒÔ¿ªÊ¼´¦ÀíÁ÷Á¿¡£µ«ÕâÖ»ÊÇËüµÄÒ»¸öÓÃÀý¶øÒÑ¡£
ËüµÄÁíÒ»¸öÓÃÀýÊÇÔÚÒ»¸ö Pod µÄÉúÃüÖÜÆÚÖÐÅжÏËüÊÇ·ñÒò¹ýÈȶøÎÞ·¨´¦ÀíÌ«¶àÁ÷Á¿£¨»òÒ»Ïî°º¹óµÄ¼ÆË㣩£¬ÕâÑùÎÒÃǾͲ»»áÈÃËü×ö¸ü¶à¹¤×÷£¬¶øÊÇÈÃËüÀäÈ´ÏÂÀ´£»µÈµ½ readiness ̽Õë³É¹¦£¬ÎÒÃÇ»áÔÙ¸øËü·¢Ë͸ü¶àÁ÷Á¿¡£ÔÚÕâÖÖÇé¿öÏ£¨µ± readiness ̽Õëʧ°Üʱ£©£¬Èç¹û liveness ̽ÕëҲʧ°Ü¾Í»á·Ç³£Ó°ÏìЧÂÊÁË¡£ÎÒÃÇΪʲôҪÖØÐÂÆô¶¯Ò»¸ö½¡¿µµÄ¡¢ÕýÔÚ×ö´óÁ¿¹¤×÷µÄ Pod ÄØ£¿
ÓÐʱºò£¬²»Ö¸¶¨ÈκÎ̽Õ붼±ÈÖ¸¶¨Ò»¸ö´íÎóµÄ̽ÕëÒªºÃ¡£ÈçÉÏËùÊö£¬Èç¹û liveness ̽ÕëµÈÓÚ readiness ̽Õ룬ÎÒÃǽ«Óöµ½ºÜ´óµÄÂé·³¡£ÎÒÃÇÒ»¿ªÊ¼¿ÉÄÜÖ»»áÖ¸¶¨ readiness ̽Õ룬ÒòΪ liveness ̽Õë̫ΣÏÕÁË¡£
https://twitter.com/sszuecs/status/1175803113204269059
https://srcco.de/posts/kubernetes-liveness-probes-are-dangerous.html
Èç¹ûÄãµÄÈκι²ÏíÒÀÀµÏî³öÏÖ¹ÊÕÏ£¬¾Í²»ÒªÈÃÈκÎÒ»¸ö̽Õëʧ°Ü£¬·ñÔòËü½«µ¼ÖÂËùÓÐ Pod µÄ¼¶Áª¹ÊÕÏ¡£ÎÒÃÇÕâÊÇ°áÆðʯͷÔÒ×Ô¼ºµÄ½Å¡£
https://blog.colinbreck.com/kubernetes-liveness-and-readiness-probes-how-to-avoid-shooting-yourself-in-the-foot/
ÎÒÃǵļ¯ÈºÖпÉÄÜÓкܶà HTTP ·þÎñ£¬²¢ÇÒÎÒÃÇÏ£Íû½«ÕâЩ·þÎñ¶ÔÍâ½ç¹«¿ª¡£
Èç¹ûÎÒÃǽ« Kubernetes ·þÎñÒÔtype: LoadBalancerµÄÐÎʽ¹«¿ª£¬ÄÇôËüµÄ¿ØÖÆÆ÷£¨È¡¾öÓÚ¹©Ó¦ÉÌ£©½«Ìṩ²¢Ðµ÷Ò»¸öÍⲿ¸ºÔؾùºâÆ÷£¨²»Ò»¶¨ÊÇ L7 µÄ£¬¸ü¿ÉÄÜÊÇ L4 lb£©£»µ±ÎÒÃÇ´´½¨ºÜ¶àÕâÖÖ×ÊԴʱ£¬ËüÃÇ¿ÉÄÜ»á±äµÃºÜ°º¹ó£¨Íⲿ¾²Ì¬ ipv4 µØÖ·¡¢¼ÆËã¡¢°´Ãë¼Æ·Ñ¡¡£©¡£
ÔÚÕâÖÖÇé¿öÏ£¬¹²Ïíͬһ¸öÍⲿ¸ºÔؾùºâÆ÷¿ÉÄÜ»á¸üºÃЩ£¬ÕâʱÎÒÃǽ«·þÎñÒÔtype: NodePortµÄÐÎʽ¹«¿ª¡£»òÕ߸üºÃµÄ·½·¨ÊÇ£¬²¿Êð nginx-ingress-controller£¨»ò traefik£©Ö®ÀàµÄ¶«Î÷£¬×÷Ϊ¹«¿ª¸øÕâ¸öÍⲿ¸ºÔؾùºâÆ÷µÄµ¥¸ö NodePort ¶Ëµã£¬²¢»ùÓÚ Kubernetes ingress ×ÊÔ´ÔÚ¼¯ÈºÖзÓÉÁ÷Á¿¡£
ÆäËûÏ໥ͨÐŵļ¯ÈºÄÚ£¨Î¢£©·þÎñ¿ÉÒÔͨ¹ý ClusterIP ·þÎñºÍ¿ªÏä¼´ÓÃµÄ DNS ·þÎñ·¢ÏÖÀ´Í¨ÐÅ¡£×¢ÒⲻҪʹÓÃËüÃǵĹ«¹² DNS/IP£¬ÒòΪÕâ¿ÉÄÜ»áÓ°ÏìËüÃǵÄÑÓ³ÙºÍÔƳɱ¾¡£
ÔÚ¼¯ÈºÖÐÌí¼Ó½Úµã»òɾ³ý½Úµãʱ£¬²»Ó¦¸Ã¿¼ÂÇһЩ¼òµ¥µÄ¶ÈÁ¿Ö¸±ê£¬±ÈÈçÕâЩ½ÚµãµÄ CPU ÀûÓÃÂÊ¡£ÔÚµ÷¶È Pod ʱ£¬ÎÒÃÇÐèÒª¸ù¾ÝÐí¶àµ÷¶ÈÔ¼ÊøÀ´½øÐоö²ß£¬±ÈÈç Pod ºÍ½ÚµãµÄÇ×ÃܹØϵ£¨affinities£©¡¢Î۵㣨taints£©ºÍÈÝÈÌ£¨tolerations£©¡¢×ÊÔ´ÇëÇó£¨resource requests£©¡¢QoS µÈ¡£ÈÃÒ»¸ö²»Á˽âÕâЩԼÊøµÄÍⲿ×Ô¶¯Ëõ·ÅÆ÷£¨autoscaler£©À´´¦ÀíËõ·Å¿ÉÄÜ»áÕÐÀ´Âé·³¡£
¼ÙÉèÓÐÒ»¸öÐ嵀 Pod Òª±»µ÷¶È£¬µ«ÊÇËùÓпÉÓÃµÄ CPU ¶¼±»ÇëÇóÁË£¬²¢ÇÒ Pod ¿¨ÔÚÁË Pending ״̬¡£¿ÉÊÇÍⲿ×Ô¶¯Ëõ·ÅÆ÷»á²é¿´µ±Ç°µÄƽ¾ù CPU ʹÓÃÂÊ£¨²»ÊÇÇëÇóÊýÁ¿£©£¬È»ºó¾ö¶¨²»À©ÈÝ£¨²»Ìí¼ÓеĽڵ㣩¡£½á¹û Pod Ò²²»»á±»µ÷¶È¡£
ËõÈÝ£¨´Ó¼¯ÈºÖÐɾ³ý½Úµã£©×ÜÊǸüÄÑһЩ¡£¼ÙÉèÎÒÃÇÓÐÒ»¸öÓÐ״̬µÄ Pod£¨Á¬½ÓÁË³Ö¾Ã¾í£©£¬ÓÉÓÚ³Ö¾Ã¾í£¨persistent volumes£©Í¨³£ÊÇÊôÓÚÌض¨¿ÉÓÃÇøÓòµÄ×ÊÔ´£¬²¢ÇÒûÓÐÔÚ¸ÃÇøÓòÖи´ÖÆ£¬ÎÒÃÇ×Ô¶¨ÒåµÄ×Ô¶¯Ëõ·ÅÆ÷»áɾ³ýÒ»¸ö´øÓÐ´Ë Pod µÄ½Úµã£¬¶øµ÷¶ÈÆ÷ÎÞ·¨½«Æäµ÷¶Èµ½ÁíÒ»¸ö½ÚµãÉÏ£¬ÒòΪÕâ¸ö Pod Ö»ÄÜ´ýÔڳ־ôÅÅÌËùÔÚµÄÄǸö¿ÉÓÃÇøÓòÀï¡£Pod ½«ÔÙ´ÎÏÝÈë Pending ״̬¡£
ÉçÇøÕýÔڹ㷺ʹÓà cluster-autoscaler£¬ËüÔËÐÐÔÚ¼¯ÈºÖУ¬ÄÜÓë´ó¶àÊýÖ÷ÒªµÄ¹«¹²Ôƹ©Ó¦ÉÌ API ¼¯³É£»Ëü¿ÉÒÔÀí½âËùÓÐÕâЩԼÊø£¬²¢ÄÜÔÚÉÏÊöÇé¿öÏÂÀ©ÈÝ¡£Ëü»¹ÄܸãÇå³þÊÇ·ñ¿ÉÒÔÔÚ²»Ó°ÏìÎÒÃÇÉèÖõÄÈκÎÔ¼ÊøµÄÇ°ÌáÏÂÓÅÑŵØËõÈÝ£¬´Ó¶ø½ÚÊ¡ÎÒÃǵļÆËã³É±¾¡£
https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler
²»ÒªÊ¹Óà IAM Users ÓÀ¾Ã´æ´¢»úÆ÷ºÍÓ¦ÓóÌÐòµÄÃØÔ¿£¬¶øҪʹÓýÇÉ«ºÍ·þÎñÕÊ»§Éú³ÉµÄÁÙʱÃØÔ¿¡£
ÎÒÃǾ³£¿´µ½ÕâÖÖÇé¿ö£¬ÄǾÍÊÇÔÚÓ¦ÓóÌÐòÅäÖÃÖÐÓ²±àÂë·ÃÎÊ£¨access £©ºÍÃÜÔ¿£¨secret£©£¬²¢ÔÚʹÓà Cloud IAM ʱ´ÓÀ´²»ÂÖ»»ÃÜÔ¿¡£ÎÒÃÇÓ¦¸Ã¾¡Á¿Ê¹Óà IAM ½ÇÉ«ºÍ·þÎñÕÊ»§À´´úÌæ Users¡£
ÇëÌø¹ý kube2iam£¬Ö±½Ó°´ÕÕ?t¨§p¨¢n Vran?ÔÚÕâƪ²©ÎÄÖнéÉܵÄÄÇÑù£¬Ê¹Ó÷þÎñÕË»§µÄ IAM ½ÇÉ«¡£
https://blog.pipetail.io/posts/2020-04-13-more-eks-tips/
apiVersion:?v1?kind:?ServiceAccount?metadata:???annotations:?????eks.amazonaws.com/role-arn:?arn:aws:iam::123456789012:role/my-app-role???name:?my-serviceaccount???namespace:?default?
Ö»ÓÐÒ»¸ö annotation¡£Ã»ÄÇôÄÑ×ö°É¡£
ÁíÍ⣬µ±·þÎñÕÊ»§»òʵÀýÅäÖÃÎļþ²»ÐèÒªadminºÍcluster-adminȨÏÞʱ£¬Ò²²»Òª¸øËüÃÇÕâЩȨÏÞ¡£ÕâÓеãÀ§ÄÑ£¬ÓÈÆäÊÇÔÚ k8s RBAC ÖУ¬µ«ÈÔȻֵµÃÒ»ÊÔ¡£
ij¸ö²¿ÊðÓÐ 3 ¸ö Pod ¸±±¾ÕýÔÚÔËÐУ¬È»ºó½Úµã¹Ø±ÕÁË£¬ËùÓеĸ±±¾Ò²¶¼ËæÖ®¹Ø±Õ¡£ÆñÓдËÀí£¿ËùÓи±±¾¶¼ÔÚÒ»¸ö½ÚµãÉÏÔËÐУ¿Kubernetes ÄѵÀ²»Ó¦¸ÃºÜÀ÷º¦£¬²¢Ìṩ¸ß¿ÉÓÃÐÔµÄÂ𣿣¡
ÎÒÃDz»ÄÜÖ¸Íû Kubernetes µ÷¶È³ÌÐòΪÎÒÃÇµÄ Pod Ç¿ÖÆʹÓà anti-affinites¡£ÎÒÃDZØÐëÏÔʽµØ¶¨ÒåËüÃÇ¡£
//?omitted?for?brevity???????labels:?????????app:?zk?//?omitted?for?brevity???????affinity:?????????podAntiAffinity:???????????requiredDuringSchedulingIgnoredDuringExecution:?????????????-?labelSelector:?????????????????matchExpressions:???????????????????-?key:?"app"?????????????????????operator:?In?????????????????????values:?????????????????????-?zk???????????????topologyKey:?"kubernetes.io/hostname"?
¾ÍÊÇÕâÑù¡£ÕâÑù¾ÍÄܱ£Ö¤ Pod ±»µ÷¶Èµ½²»Í¬µÄ½ÚµãÉÏ£¨Õâ½öÔÚµ÷¶Èʱ¼ì²é£¬¶ø²»ÊÇÔÚÖ´ÐÐʱ¼ì²é£¬Òò´ËÐèÒªrequiredDuringSchedulingIgnoredDuringExecution £©¡£
ÎÒÃÇÌÖÂÛµÄÊDz»Í¬½ÚµãÃû³ÆÉÏ£¨ ?topologyKey: "kubernetes.io/hostname" £©µÄ podAntiAffinity£¬¶ø²»ÊDz»Í¬¿ÉÓÃÇøÓòµÄ podAntiAffinity¡£Èç¹ûÄãȷʵÐèÒªºÜºÃµÄ¿ÉÓÃÐÔˮƽ£¬¿ÉÒÔÔÚÕâ¸öÖ÷ÌâÉÏÔÙÉîÈë×öЩÑо¿¡£
ÎÒÃÇÔÚ Kubernetes ÉÏÔËÐÐÉú²ú¸ºÔØ¡£ÎÒÃǵĽڵãºÍ¼¯Èº±ØÐ벻ʱÉý¼¶»òÍ£Óá£PodDisruptionBudget£¨pdb£©ÊÇÒ»ÖÖÓÃÓÚÔÚ¼¯Èº¹ÜÀíÔ±ºÍ¼¯ÈºÓû§Ö®¼äÌṩ·þÎñ±£Ö¤µÄ API¡£
ÇëÈ·±£´´½¨ÁËpdb £¬ÒÔ±ÜÃâÓÉÓÚ½ÚµãºÄ¾¡¶øÔì³É²»±ØÒªµÄ·þÎñÖжϡ£
apiVersion:?policy/v1beta1?kind:?PodDisruptionBudget?metadata:???name:?zk-pdb?spec:???minAvailable:?2???selector:?????matchLabels:???????app:?zookeeper?
×÷Ϊһ¸ö¼¯ÈºÓû§£¬ÎÒÃÇ¿ÉÒÔ¸æËß¼¯Èº¹ÜÀíÔ±£º¡°ºÙ£¬ÎÒÕâÀïÓиö zookeeper ·þÎñ£¬ÎÞÂÛÈçºÎÎÒ¶¼Ï£ÍûÖÁÉÙÓÐ 2 ¸ö¸±±¾ÊÇʼÖÕ¿ÉÓõġ±¡£
ÎÒÔÚÕâƪ²©¿ÍÎÄÕÂÖиüÉîÈëµØÌÖÂÛÁËÕâ¸ö»°Ìâ¡£
https://blog.marekbartik.com/posts/2018-06-29_kubernetes-in-production-poddisruptionbudget/
Kubernetes ÃüÃû¿Õ¼ä²»ÌṩÈκÎÇ¿¸ôÀë¡£
ÈËÃÇËƺõÆÚÍû£¬Èç¹û½«·ÇÉú²ú¸ºÔطŵ½Ò»¸öÃüÃû¿Õ¼ä£¬È»ºó½«Éú²ú¸ºÔطŵ½Éú²úÃüÃû¿Õ¼ä£¬ÄÇôÕâЩ¸ºÔØÖ®¼ä¾ÍÓÀÔ¶²»»áÏ໥ӰÏìÁË¡£ÎÒÃÇ¿ÉÒÔÔÚijÖ̶ֳÈÉϹ«Æ½·ÖÅ䣨±ÈÈç×ÊÔ´µÄÇëÇóºÍÏÞÖÆ¡¢Åä¶î¡¢ÓÅÏȼ¶£©²¢ÊµÏÖ¸ôÀ루±ÈÈç affinities¡¢tolerations¡¢taints »ò nodeselectors£©£¬½ø¶ø¡°ÎïÀíµØ¡±·ÖÀëÊý¾ÝƽÃæÉϵĸºÔØ£¬µ«ÕâÖÖ·ÖÀëÊÇÏ൱¸´Ôӵġ£
Èç¹ûÎÒÃÇÐèÒªÔÚͬһ¸ö¼¯ÈºÖÐͬʱӵÓÐÕâÁ½ÖÖÀàÐ͵ĸºÔØ£¬ÄÇô¾Í±ØÐëÒª³Ðµ£ÕâÖÖ¸´ÔÓÐÔ¡£Èç¹ûÎÒÃÇÓò»×žÖÏÞÔÚÒ»¸ö¼¯ÈºÀ¶øÇÒÔÙ¼ÓÒ»¸ö¼¯ÈºµÄ³É±¾¸üµÍʱ£¨±ÈÈçÔÚ¹«¹²ÔÆÉÏ£©£¬ÄÇôӦ¸Ã½«ËüÃÇ·ÅÔÚ²»Í¬µÄ¼¯ÈºÖÐÒÔ»ñµÃ¸üÇ¿µÄ¸ôÀ뼶±ð¡£
¾³£¿´µ½ÕâÖÖÇé¿ö£¬ËùÓÐÁ÷Á¿¶¼ÔÚ¼¯ÈºÄÚ·Óɵ½Ò»¸ö NodePort ·þÎñÉÏ£¬¸Ã·þÎñĬÈÏʹÓà externalTrafficPolicy: Cluster ¡£ÕâÒâζ×ÅÔÚ¼¯ÈºÖеÄÿ¸ö½ÚµãÉ϶¼´ò¿ªÁË NodePort£¬ÕâÑùÎÒÃÇ¿ÉÒÔÈÎÑ¡Ò»¸öÀ´ÓëËùÐèµÄ·þÎñ£¨Ò»×é Pod£©Í¨ÐÅ¡£
ͨ³£Çé¿öÏ£¬NodePort ·þÎñËùÕë¶ÔµÄÄÇЩ Pod ʵ¼ÊÉÏÖ»ÔËÐÐÔÚÕâЩ½ÚµãµÄÒ»¸ö×Ó¼¯ÉÏ¡£ÕâÒâζ×Å£¬Èç¹ûÎÒÓëÒ»¸öûÓÐÔËÐÐ Pod µÄ½ÚµãͨÐÅ£¬Ëü½«»á°ÑÁ÷Á¿×ª·¢¸øÁíÒ»¸ö½Úµã£¬´Ó¶øµ¼Ö¶îÍâµÄÍøÂçÌøת²¢Ôö¼ÓÑÓ³Ù£¨Èç¹û½ÚµãλÓÚ²»Í¬µÄ AZs »òÊý¾ÝÖÐÐÄ£¬ÄÇôÑÓ³Ù¿ÉÄÜ»áºÜ¸ß£¬²¢ÇÒ»á´øÀ´¶îÍâµÄ³ö¿Ú³É±¾£©¡£
ÔÚ Kubernetes ·þÎñÉÏÉèÖÃexternalTrafficPolicy: Local£¬¾Í²»»áÔÚÿ¸ö½ÚµãÉ϶¼´ò¿ª NodePort£¬Ö»»áÔÚʵ¼ÊÔËÐÐ Pod µÄ½ÚµãÉÏ¿ªÆôËü¡£Èç¹ûÎÒÃÇʹÓÃÒ»¸öÍⲿ¸ºÔؾùºâÆ÷À´¼ì²éËü¶ËµãµÄÔËÐÐ×´¿ö£¨¾ÍÏñ AWS ELB Ëù×öµÄÄÇÑù£©£¬Ëü¾Í»áÖ»½«Á÷Á¿·¢Ë͵½Ó¦¸Ã½ÓÊÕÁ÷Á¿µÄ½ÚµãÉÏ£¬ÕâÑù¾ÍÄܸÄÉÆÑÓ³Ù¡¢¼õÉÙ¼ÆË㿪Ïú¡¢½µµÍ³ö¿Ú³É±¾²¢ÌáÉý½¡È«ÐÔ¡£
ÎÒÃÇ¿ÉÄÜ»áÓÐÏñ traefik »ò nginx-ingress-controller Ö®ÀàµÄ¶«Î÷£¬±»¹«¿ª³É NodePort£¨»òʹÓà NodePort µÄ¸ºÔؾùºâÆ÷£©À´´¦ÀíÈë¿Ú HTTP Á÷Á¿Â·ÓÉ£¬¶øÕâÖÖÉèÖÿÉÒÔ¼«´óµØ¼õÉÙ´ËÀàÇëÇóµÄÑÓ³Ù¡£
ÕâÀïÓÐһƪºÜ°ôµÄ²©¿ÍÎÄÕ£¬¸üÉîÈëµØÌÖÂÛÁË externalTrafficPolicy ºÍËüÃǵÄȨºâÈ¡Éá¡£
https://www.asykim.com/blog/deep-dive-into-kubernetes-external-traffic-policies
ÄãÓÐûÓйýÕâÑùµÄ¾Àú£º¸ø·þÎñÆ÷È¡ Anton¡¢HAL9000 »ò Colossus Ö®ÀàµÄÃû×Ö£¨¶¼ÊÇ´ø¹£µÄÃû³Æ£¬Òë×¢£©£¬»òÕ߸ø½ÚµãËæ»úÉú³É id£¬È´¸ø¼¯ÈºÈ¡¸öÓк¬ÒåµÄÃû³Æ£¿
»¹¿ÉÄÜÊÇÕâÑùµÄ¾Àú£ºÒ»¿ªÊ¼Óà Kubernetes ×ö¸ÅÄîÑéÖ¤£¬¸ø¼¯ÈºÈ¡Ãû"testing"£¬½á¹ûµ½ÁËÉú²ú»·¾³»¹Ã»¸øËü¸ÄÃû£¬½á¹û˶¼²»¸ÒÅöËü£¿£¨ÕæʵµÄ¹ÊÊ£©
°Ñ¼¯Èºµ±³èÎï¿É²»ÊÇ¿ªÍæЦµÄ£¬ÎÒÃÇ¿ÉÄÜÐèÒª²»Ê±É¾³ý¼¯Èº£¬ÑÝÁ·ÔÖÄѻָ´²¢¹ÜÀíÎÒÃǵĿØÖÆƽÃæ¡£º¦Å´¥Åö¿ØÖÆƽÃæ²»ÊǸöºÃÕ×Í·¡£Etcd ¹ÒµôÁË£¿ºÃàÏ£¬ÎÒÃÇÓöµ½´óÂé·³¡£
·´¹ýÀ´Ëµ£¬¿ØÖÆƽÃæÒ²²»ÒªÓùýÍ·ÁË¡£Ò²ÐíËæ×Åʱ¼äµÄÁ÷ÊÅ£¬¿ØÖÆƽÃæ±äÂýÁË¡£ÕâºÜ¿ÉÄÜÊÇÒòΪÎÒÃÇ´´½¨Á˺ܶà¶ÔÏó¶øûÓÐÂÖ»»ËüÃÇ£¨Ê¹Óà helm ʱ³£¼ûµÄÇé¿ö£¬ËüµÄĬÈÏÉèÖò»»áÂÖ»» configmaps/secrets µÄ״̬£¬½á¹ûÎÒÃÇÔÚ¿ØÖÆƽÃæÖлáÓÐÊýǧ¸ö¶ÔÏ󣩣¬»òÕßÊÇÒòΪÎÒÃDz»¶Ï´Ó kube-api£¨ÓÃÓÚ×Ô¶¯ÉìËõ¡¢CI/CD¡¢¼àÊÓ¡¢Ê¼þÈÕÖ¾¡¢¿ØÖÆÆ÷µÈ£©ÖÐɾ³ýºÍ±à¼ÁË´óÁ¿ÄÚÈÝ¡£
ÁíÍ⣬Çë¼ì²éÍÐ¹Ü Kubernetes ÌṩµÄ¡°SLAs¡±/SLOs ºÍ±£Ö¤¡£¹©Ó¦ÉÌ¿ÉÄܻᱣ֤¿ØÖÆƽÃ棨»òÆä×Ó×é¼þ£©µÄ¿ÉÓÃÐÔ£¬µ«²»Äܱ£Ö¤·¢Ë͸øËüµÄÇëÇóµÄ p99 ÑÓ³Ùˮƽ¡£»»¾ä»°Ëµ£¬¾ÍËãÎÒÃÇkubectl get nodesºóÓÃÁË 10 ·ÖÖӲŵõ½ÕýÈ·½á¹û£¬Ò²Ã»ÓÐÎ¥·´·þÎñ±£Ö¤¡£
ÕâÒ»ÌõÊǺܾµäµÄ¡£ÎÒ¾õµÃ×î½üËüûÄÇô³£¼ûÁË£¬ÒòΪ´ó¼Ò±»¿ÓµÄ´ÎÊýÌ«¶à£¬ËùÒÔÔÙÒ²²»Óà :latest £¬¿ªÊ¼¼ÓÉÏ°æ±¾ºÅÁË¡£ÕâÏÂÇå¾²ÁË£¡
ECR ÓÐÒ»¸ö±êÇ©²»±äÐÔµÄÇ¿´ó¹¦ÄÜ£¬¾ø¶ÔÖµµÃÒ»ÊÔ¡£
https://aws.amazon.com/about-aws/whats-new/2019/07/amazon-ecr-now-supports-immutable-image-tags/
±ðÖ¸ÍûËùÓÐÎÊÌⶼÄÜ×Ô¶¯½â¾ö¡ª¡ªKubernetes ²»ÊÇÒøµ¯¡£¼´Ê¹ÊÇÔÚ Kubernetes ÉÏ£¬Ò»¸öÔã¸âµÄÓ¦ÓóÌÐò»¹»áÊÇÒ»¸öÔã¸âµÄÓ¦ÓóÌÐò£¨Êµ¼ÊÉÏ£¬ÉõÖÁ»¹¿ÉÄܸüÔã¸â£©¡£Èç¹ûÎÒÃDz»¹»Ð¡ÐÄ£¬×îºó¾Í»áÓöµ½Ò»ÏµÁÐÎÊÌ⣺̫¹ý¸´ÔÓ¡¢Ñ¹Á¦¹ý´ó¡¢¿ØÖÆƽÃæ±äÂý¡¢Ã»ÓÐÔÖÄѻָ´²ßÂÔ¡£²»ÒªÖ¸Íû¶à×⻧ºÍ¸ß¿ÉÓÃÐÔÊÇ¿ªÏä¼´Óõġ£Ç뻨µãʱ¼äÈÃÎÒÃǵÄÓ¦ÓóÌÐòÔÆÔÉú»¯¡£
ÁìȡרÊô 10ÔªÎÞÃż÷ȯ
˽Ïí×îР¼¼Êõ¸É»õ