1
1)编写资源清单（镜像名称故意写错，多了很多个1）
2
root@Master ~# vim /k8s/pods/03-pods-troubleshooting-describe.yaml
3
apiVersion: v1
4
kind: Pod
5
metadata:
6
  name: troubleshooting-describe
7
spec:
8
  containers:
9
  - name: c1
10
    image: registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:v111
11
root@Master ~# kubectl apply -f /k8s/pods/03-pods-troubleshooting-describe.yaml
12
pod/troubleshooting-describe created
13

14
2)查看Pod状态（先是ErrImagePull，随后变成ImagePullBackOff）
15
root@Master pods# kubectl get pods -o wide
16
NAME                       READY   STATUS         RESTARTS   AGE   IP            NODE
17
troubleshooting-describe   0/1     ErrImagePull   0          15s   10.100.1.13   worker01
18
# ErrImagePull = 镜像拉取失败
19
'稍等片刻，会变成 ImagePullBackOff，表示镜像拉取失败后进入退避重试'
20
# 我这次没拉成功，我休息一会儿（退避）再拉
21

22
3)用 describe 查看错误信息（重点看 Events 段）
23
root@Master pods# kubectl describe pod troubleshooting-describe
24
Type     Reason     Age                  From               Message
25
  ----     ------     ----                 ----               -------
26
  Normal   Scheduled  12m                  default-scheduler Successfully assigned default/troubleshooting-describe to worker01
27
  Normal   Pulling    9m22s (x5 over 12m)  kubelet       spec.containers{c1}: Pulling image "registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:v111"
28
  Warning  Failed     9m22s (x5 over 12m)  kubelet       spec.containers{c1}: Failed to pull image "registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:v111": rpc error: code = NotFound desc = failed to pull and unpack image "registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:v111": failed to resolve image: registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:v111: not found
29
  # ⬆️ Events 里能看到 Failed to pull image + not found，一眼定位是镜像拉取失败

1
1)编写资源清单（c1、c2 都是 nginx 镜像，都监听80端口）
2
root@Master pods# vim /k8s/pods/04-troubleshooting-logs.yaml
3
apiVersion: v1
4
kind: Pod
5
metadata:
6
  name: troubleshooting-logs
7
spec:
8
  containers:
9
  - name: c1
10
    image: registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:v1
11
  - name: c2
12
    image: registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:v2
13
root@Master pods# kubectl apply -f 04-troubleshooting-logs.yaml
14
pod/troubleshooting-logs created
15

16
2)查看状态（1/2 Error，c2 容器挂了）
17
root@Master pods# kubectl get pods -o wide
18
NAME                   READY   STATUS   RESTARTS      AGE   IP           NODE
19
troubleshooting-logs   1/2     Error    1 (16s ago)   20s   10.100.2.8   worker02
20

21
3)describe 查看哪个容器异常
22
root@Master pods# kubectl describe pod troubleshooting-logs
23
Containers:
24
  c1:
25
    State:          Running    # c1 正常
26
    Ready:          True
27
  c2:
28
    State:          Terminated # c2 挂了
29
      Reason:       Error
30
      Exit Code:    1
31
    Last State:     Terminated
32
      Reason:       Error
33
      Exit Code:    1
34
......restarting failed container c2
35
# describe 只能看到 c2 在重启，但不知道具体原因
36
`有个容器一直在重启`
37
root@Master ~# kubectl get pods troubleshooting-logs
38
NAME                   READY   STATUS             RESTARTS        AGE
39
troubleshooting-logs   1/2     CrashLoopBackOff  🔥6 (4m54s ago)  11m
40

41
4)用 logs 查看指定容器日志（-c 指定容器名）
42
root@Master pods# kubectl logs -c c1 troubleshooting-logs
43
# c1 日志正常：nginx 正常启动
44
2026/09/03 01:51:40 [notice] 1#1: start worker processes
45

46
root@Master pods# kubectl logs -c c2 troubleshooting-logs
47
2026/09/03 01:52:00 [emerg] 1#1: bind() to 0.0.0.0:80 failed (98: Address in use)
48
nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address in use)
49
# ⬆️ 真相大白！c2 报 bind() 80 端口被占用

1
root@Master ~# kubectl delete -f /k8s/pods/04-troubleshooting-logs.yaml
2
pod "troubleshooting-logs" deleted from default namespace
3
# 移除重新编辑
4
root@Master pods# vim /k8s/pods/04-troubleshooting-logs.yaml
5
apiVersion: v1
6
kind: Pod
7
metadata:
8
  name: troubleshooting-logs
9
spec:
10
  containers:
11
  - name: c1
12
    image: registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:v1
13
  - name: c2
14
    image: registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:v2
15
    command:  # 相当于替换Dockerfile的ENTRYPOINT（容器中得有这个工具）
16
    - tail
17
    args:    # 相当于替换Dockerfile的CMD
18
    - -f
19
    - /etc/hosts
20
⚠️ 缩进教训：`command`/`args` 必须和 `name` 平级（4空格），多一个空格就报 `did not find expected key`
21
root@Master ~# kubectl apply -f /k8s/pods/04-troubleshooting-logs.yaml
22
pod/troubleshooting-logs created
23

24
2)查看状态（2/2 Running，两个容器都起来了）
25
root@Master ~# kubectl get pods -o wide
26
NAME                   READY   STATUS    RESTARTS   AGE     IP           NODE
27
troubleshooting-logs   2/2     Running   0          2m26s   10.100.2.9   worker02
28

29
3)查看两个容器的启动命令
30
root@Master pods# kubectl exec -c c1 troubleshooting-logs -- ps -ef
31
PID   USER     TIME  COMMAND
32
    1 root      0:00 nginx: master process nginx -g daemon off;   # c1 是 nginx
33
   32 nginx     0:00 nginx: worker process
34
root@Master pods# kubectl exec -c c2 troubleshooting-logs -- ps -ef
35
PID   USER     TIME  COMMAND
36
    1 root      0:00 tail -f /etc/hosts                            # c2 是 tail
37
    7 root      0:00 ps -ef
38

39
4)进 c2 容器手动启动 nginx（复现端口冲突）
40
root@Master ~# kubectl exec -it -c c2 troubleshooting-logs -- sh
41
/ # nginx
42
2026/09/07 08:53:08 [emerg] 19#19: bind() to 0.0.0.0:80 failed (98: Address in use)
43
nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address in use)
44
# ⬆️ 手动启动 nginx 才发现是 80 端口被 c1 占了！
45

46
5)修改端口 80 → 81，再启动 nginx
47
/ # sed -i '/listen/s#80#81#g' /etc/nginx/conf.d/default.conf
48
/ # nginx
49
2026/09/07 08:54:09 [notice] 21#21: nginx/1.20.1
50
/ # 2026/09/07 08:54:09 [notice] 22#22: start worker processes
51
# ✅ 改端口后 nginx 启动成功！
52

53
6)访问验证（同 Pod 共享IP，c1 在80，c2 在81）
54
root@Master ~# curl -s 10.100.2.9:80 | grep h1
55
    <h1 style="color: green">凡人修仙传 v1 </h1>      # c1
56
root@Master ~# curl -s 10.100.2.9:81 | grep h1
57
    <h1 style="color: red">凡人修仙传 v2 </h1>    # c2 ✅
58
'同一个 Pod IP，两个端口，各跑各的'
59

60
7)清理
61
root@Master ~# kubectl delete -f /k8s/pods/04-troubleshooting-logs.yaml
62
pod "troubleshooting-logs" deleted from default namespace

1
'去 worker02 节点（10.0.0.15）用 crictl 查看 Pod 容器关系'
2
2)列出Pod 沙箱（sandbox）
3
# 在 containerd 架构里，一个 Pod 对应一个 sandbox 容器（pause 容器），它先被创建、持有网络和 IPC 命名空间，业务容器再加入进去
4
# crictl pods 只显示沙箱本身，不显示里面的业务容器（那要用 crictl ps 看）
5
root@Worker02 ~# crictl pods --latest
6
--latest, -l  # 查看最新创建的
7
POD ID          CREATED      STATE     NAME                    NAMESPACE     ATTEMPT   RUNTIME
8
cea825bae4001   2 hour ago   Ready     troubleshooting-logs    default       1         (default)
9
'STATE    沙箱状态，Ready 表示沙箱就绪，可以往里放容器（业务容器挂了沙箱也仍是 Ready）'
10
'NAMESPACE  所属命名空间，default'
11
'ATTEMPT  第几次尝试创建该沙箱'
12
=============================================================
13
  在 Kubernetes 的抽象里，Pod 是一组共享网络/IPC 命名空间的容器
14
落到 containerd 这个运行时的实现上，每个 Pod 先创建一个沙箱（sandbox），沙箱在底层就是靠一个 pause 容器实现的；pause 进程几乎什么都不做，只负责“占住”网络命名空间、IPC 命名空间这些资，然后 Pod 里的业务容器都以 join 的方式加入这个 pause 容器的命名空间
15

16
3)列出指定沙箱中的业务容器（不含 pause / init 容器）
17
root@Worker02 ~# crictl ps --pod cea825bae4001
18
'接按沙箱 ID 过滤'
19
CONTAINER      IMAGE               CREATED             STATE      NAME   ATTEMPT  POD ID    POD                     NAMESPACE
20
b1164d69ab22c  f28fd43be4ad4       2 hours ago         Running    c1     1        cea825bae4001       troubleshooting-logs    default
21
56b1ec3d54dbf  d65adc8a2f327       2 hours ago         Running    c2     1        cea825bae4001       troubleshooting-logs    default
22
# ⬆️ 一个沙箱(cea825bae4001) 挂两个业务容器 c1、c2
23

24
4)查看对应的进程ID和命名空间
25
root@Worker02 ~# crictl inspect
26
inspect   inspecti  inspectp
27
`分别对应容器，镜像和沙盒的详细信息`
28
root@Worker02 ~# crictl inspectp cea825bae4001 | jq '.info.pid'
29
1460  # 这里是沙盒的进程ID
30
# 它的 ipc、uts、pid、mount 都没有 path——没有 path 的意思是“新建一个独立命名空间”
31
# pause 是 Pod 里第一个起来的，这些命名空间就是它创建的
32
'下面分别产看两个容器的进程命名空间'
33
root@Worker02 ~# crictl inspect b1164d69ab22c | jq '{pid: .info.pid, ns: .info.runtimeSpec.linux.namespaces}'
34
{
35
  "pid": 1486,
36
  "ns": [
37
    {
38
      "type": "pid"
39
    },
40
    {
41
      "path": "/proc/1460/ns/ipc",
42
      "type": "ipc"
43
    },
44
    {
45
      "path": "/proc/1460/ns/uts",
46
      "type": "uts"
47
    },
48
    {
49
      "type": "mount"
50
    },
51
    {
52
      "path": "/proc/1460/ns/net",
53
      "type": "network"
54
    },
55
    {
56
      "type": "cgroup"
57
    }
58
  ]
59
}
60
root@Worker02 ~# crictl inspect 56b1ec3d54dbf | jq '{pid: .info.pid, ns: .info.runtimeSpec.linux.namespaces}'
61
{
62
  "pid": 1525,
63
  "ns": [
64
    {
65
      "type": "pid"
66
    },
67
    {
68
      "path": "/proc/1460/ns/ipc",
69
      "type": "ipc"
70
    },
71
    {
72
      "path": "/proc/1460/ns/uts",
73
      "type": "uts"
74
    },
75
    {
76
      "type": "mount"
77
    },
78
    {
79
      "path": "/proc/1460/ns/net",
80
      "type": "network"
81
    },
82
    {
83
      "type": "cgroup"
84
    }
85
  ]
86
}
87
# 我们找到了三个进程的 PID
88
  pause 进程  -->  1460
89
  c1 进程    -->  1486
90
  c2 进程    -->  1525
91
root@Worker02 ~# pstree -p
92
containerd-shim(1436)─┬─nginx(1486)─┬─nginx(1548)
93
                      │             └─nginx(1549)
94
                      ├─pause(1460)
95
                      ├─tail(1525)───nginx(11077)─┬─nginx(11078)
96
                      │                           └─nginx(11079)
97
`我们第二个容器的进程是 tail -f 启动的！`
98

99
5)验证三个进程共享网络名称空间
100
root@Worker02 ~# ls -l /proc/1460/ns/net   # pause
101
lrwxrwxrwx 1 xxx 0 Sep  8 08:10 /proc/1460/ns/net -> 'net:[4026532425]'
102
root@Worker02 ~# ls -l /proc/1486/ns/net   # c1 nginx
103
lrwxrwxrwx 1 xxx 0 Sep  8 11:13 /proc/1486/ns/net -> 'net:[4026532425]'
104
root@Worker02 ~# ls -l /proc/1525/ns/net   # c2 tail
105
lrwxrwxrwx 1 xxx 0 Sep  8 08:34 /proc/1525/ns/net -> 'net:[4026532425]'
106
# ⬆️ 三个进程的 net 指向同一个 ns（4026532413）→ 共享网络名称空间！
107
'同理 ipc/time/user 也一致，这就是为什么同Pod容器共享IP和端口'

1
6)实验A：删除业务容器 → 沙箱不动 → 重启后 IP 不变
2
root@Worker02 ~# crictl rm -f b1164d69ab22c && crictl rm -f 56b1ec3d54dbf && sleep 15
3
root@Worker02 ~# crictl ps --pod cea825bae4001  # 指定沙箱ID
4
CONTAINER           IMAGE               CREATED             STATE               NAME
5
a3e62380de657       d65adc8a2f327       41 seconds ago      Running             c2
6
aaf8547f22137       f28fd43be4ad4       41 seconds ago      Running             c1
7
'容器的id已经发生变化，被 kubelet 自动拉起'
8
root@Worker02 ~# kubectl get pods troubleshooting-logs -o wide
9
NAME                   READY   STATUS    RESTARTS        AGE   IP
10
troubleshooting-logs   2/2     Running   4 (10ms ago)   20h   10.100.2.11
11
`IP 不变（pause 没动，Pod 网络不变）RESTARTS 重启次数增加两次`
12
root@Worker02 ~# kubectl exec -c c2 troubleshooting-logs -- sh -c 'sed -i '/listen/s#80#81#g' /etc/nginx/conf.d/default.conf'
13
root@Worker02 ~# kubectl exec -c c2 troubleshooting-logs -- sh -c 'nginx'
14
# 服务依然可用
15
root@Worker02 ~# curl -s 10.100.2.11:80 | grep h1
16
    <h1 style="color: green">凡人修仙传 v1 </h1>
17
root@Worker02 ~# curl -s 10.100.2.11:81 | grep h1
18
    <h1 style="color: red">凡人修仙传 v2 </h1>
19

20
7)实验B（对照组）：删除整个沙箱 → kubelet 重建沙箱 → 观察 IP 是否变化
21
root@Worker02 ~# crictl rmp -f cea825bae4001 && sleep 20
22
root@Worker02 ~# crictl pods -l
23
POD ID              CREATED             STATE               NAME
24
b504f64136d6f       49 seconds ago      Ready               troubleshooting-logs
25
root@Worker02 ~# kubectl get pods troubleshooting-logs -o wide
26
NAME                   READY   STATUS    RESTARTS      AGE   IP            NODE
27
troubleshooting-logs   2/2     Running   4 (53m ago)   20h   10.100.2.12   worker02
28
# kubectl 显示的 RESTARTS 计数器和“53m ago”这个时间戳，记录的是kubelet 亲自统计的“容器死亡→重启”事件：kubelet 每次看到某容器退出、然后按重启策略把它拉起，计数 +1、时间戳更新
29
# 而我们这次的 crictl rmp -f 走的是另一条路：kubelet 轮询时发现的情况不是“容器退出了”，而是“整个沙箱连同容器凭空不存在了”，对 kubelet 来说这属于“实际状态偏离期望状态”，处理方式是做一次全新的创建（新沙箱 + 新容器），而不是把它记为一次“重启”
30
# 新容器创建时，restartCount 沿用了旧容器档案里的数值（4），且没有发生“退出事件”，所以：计数不加 → 还是 4、时间戳不更新 → 还是上一次真实重启的 53m ago

1
# 删除已退出的旧业务容器
2
crictl rm $(crictl ps -aq --state Exited)
3

4

5
# 删除 NotReady 的残留沙箱（先查残留的沙箱）
6
crictl pods --state NotReady
7
crictl rmp $(crictl pods -q --state NotReady)
8

9

10
# 业务容器的启动命令（最常用）：
11
`这就是最终生效的启动命令`
12
root@Worker02 ~# crictl inspect b1164d69ab22c | jq '.info.runtimeSpec.process.args'
13
[
14
  "/docker-entrypoint.sh",
15
  "nginx",
16
  "-g",
17
  "daemon off;"
18
]
19
root@Worker02 ~# crictl inspect 56b1ec3d54dbf | jq '.info.runtimeSpec.process.args'
20
[
21
  "tail",
22
  "-f",
23
  "/etc/hosts"
24
]
25
✅ `process.args 是 runtime 真正 exec 的那一份，镜像的 ENTRYPOINT/CMD 和 Kubernetes 里写的 command/args 都已经合并进去了：`
26
'它只告诉你“最终是什么”，不告诉你“哪来的”'
27

28

29
# kubectl 侧对照（如果 Pod 是 k8s 管的，这是看“用户意图”的地方——镜像之外追加的 command/args）
30
root@Master ~# kubectl get pod troubleshooting-logs -o json | jq '.spec.containers[] | {name, command, args}'
31
{
32
  "name": "c1",
33
  "command": null,
34
  "args": null
35
}
36
{
37
  "name": "c2",
38
  "command": [
39
    "tail"
40
  ],
41
  "args": [
42
    "-f",
43
    "/etc/hosts"
44
  ]
45
}

1
# 环境准备
2
jiuzhao@Ubuntu ~$ docker save mysql:8.0.36 wordpress:7.1.0-php8.5 | gzip > wp-mysql.tar.gz
3
jiuzhao@Ubuntu ~$ scp wp-mysql.tar.gz Worker01:/tmp
4
wp-mysql.tar.gz   100%  436MB 256.2MB/s   00:01
5
root@Worker01 ~# ctr -n k8s.io images import /tmp/wp-mysql.tar.gz
6
`只需要worker01导入即可！指定node节点`
7
docker.io/library/mysql:8.0.36            saved
8
docker.io/library/wordpress:7.1.0 php8.5  saved
9
application/vnd.oci.image.index.v1+json sha256:a532724022429812ec797c285c1b540a644c15e248579c6bfdf12a8fbaab4964
10
application/vnd.oci.image.index.v1+json sha256:397daa8a8816347e724362c2122129601eb0811fbaff0ce9b2b22c7b057a745d
11
Importing  elapsed: 17.3s  total:   0.0 B  (0.0 B/s)
12

13
1)编写资源清单（env 传环境变量，args 指定 MySQL 参数）
14
root@Master pods# vim /k8s/pods/05-pods-env-mysql.yaml
15
apiVersion: v1
16
kind: Pod
17
metadata:
18
  name: db-mysql
19
spec:
20
  # 指定分配至worker01
21
  nodeName: worker01
22
  containers:
23
  - name: c1
24
    image: docker.io/library/mysql:8.0.36
25
    # 向容器传递环境变量
26
    env:
27
    - name: MYSQL_ALLOW_EMPTY_PASSWORD
28
      value: "yes"
29
    - name: MYSQL_DATABASE
30
      value: "wordpress"
31
    - name: MYSQL_USER
32
      value: "kpyun"
33
    - name: MYSQL_PASSWORD
34
      value: "kpyun123"
35
    - name: "TZ"
36
      value: "Asia/Shanghai"
37
    args:
38
    - --character-set-server=utf8mb4
39
    - --collation-server=utf8mb4_bin
40
    - --default-authentication-plugin=mysql_native_password
41
root@Master pods# kubectl apply -f /k8s/pods/05-pods-env-mysql.yaml
42
pod/db-mysql created
43

44
2)等待启动并查看
45
root@Master ~# kubectl get pods -o wide
46
NAME       READY   STATUS    RESTARTS   AGE   IP            NODE
47
db-mysql   1/1     Running   0          8s    10.100.1.18   worker01
48

49
3)查看容器里的环境变量
50
root@Master ~# kubectl exec db-mysql -- env | grep MYSQL
51
root@Master ~# kubectl exec -it db-mysql -- env | grep MYSQL
52
MYSQL_MAJOR=8.0
53
MYSQL_VERSION=8.0.36-1.el8
54
MYSQL_SHELL_VERSION=8.0.36-1.el8
55
MYSQL_ALLOW_EMPTY_PASSWORD=yes
56
MYSQL_DATABASE=wordpress
57
MYSQL_USER=kpyun
58
MYSQL_PASSWORD=kpyun123
59
# ✅ 我们传的变量生效了
60

61
4)连接测试（wordpress 库已自动创建）
62
root@Master pods# kubectl exec -it db-mysql -- mysql wordpress
63
# 在容器内执行的命令：连接 wordpress 数据库
64
Welcome to the MySQL monitor.
65
Server version: 8.0.36 MySQL Community Server - GPL
66
mysql> SHOW DATABASES;
67
+--------------------+
68
| Database           |
69
+--------------------+
70
| information_schema |
71
| mysql              |
72
| performance_schema |
73
| sys                |
74
| wordpress          |
75
+--------------------+
76

77
mysql> SHOW TABLES;
78
Empty set (0.01 sec)
79

80
mysql> SELECT user,host,plugin FROM mysql.user;
81
+------------------+-----------+-----------------------+
82
| user             | host      | plugin                |
83
+------------------+-----------+-----------------------+
84
| kpyun            | %         | mysql_native_password |
85
| root             | %         | mysql_native_password |
86
| mysql.infoschema | localhost | caching_sha2_password |
87
| mysql.session    | localhost | caching_sha2_password |
88
| mysql.sys        | localhost | caching_sha2_password |
89
| root             | localhost | mysql_native_password |
90
+------------------+-----------+-----------------------+
91
# ✅ kpyun 用户自动创建，用兼容插件

1
1)编写资源清单（hostNetwork 让 Pod 直接用宿主机网络）
2
root@Master ~# MYSQLIP=$(kubectl get pod db-mysql -o jsonpath='{.status.podIP}')
3
root@Master ~# echo "MySQL IP: $MYSQLIP"
4
MySQL IP: 10.100.1.18
5
root@Master ~# vim /k8s/pods/05-pods-wordpress-hostNetwork.yaml
6
apiVersion: v1
7
kind: Pod
8
metadata:
9
  name: blog-wp
10
spec:
11
  nodeName: worker01
12
  hostNetwork: true                    # 直接使用宿主机网络，不用Pod网段
13
  containers:
14
  - image: docker.io/library/wordpress:7.1.0-php8.5
15
    name: c1
16
    env:
17
    - name: WORDPRESS_DB_HOST
18
      value: 10.100.1.18:3306          # MySQL Pod 的 IP
19
    - name: WORDPRESS_DB_USER
20
      value: kpyun
21
    - name: WORDPRESS_DB_PASSWORD
22
      value: kpyun123
23
    - name: WORDPRESS_DB_NAME
24
      value: "wordpress"
25
root@Master pods# kubectl apply -f /k8s/pods/05-pods-wordpress-hostNetwork.yaml
26
pod/blog-wp created
27

28
2)查看状态（hostNetwork 的 Pod IP = 宿主机 IP）
29
root@Master ~# kubectl get pods -o wide
30
NAME       READY   STATUS    RESTARTS   AGE     IP            NODE
31
blog-wp    1/1     Running   0          4m45s   10.0.0.14     worker01
32
db-mysql   1/1     Running   0          46m     10.100.1.18   worker01
33
# ⬆️ blog-wp 的 IP 是 10.0.0.14（worker01 宿主机IP），不是 Pod 网段！
34

35
3)访问验证（进入安装页说明连上MySQL了）
36
root@Master ~# curl -s -I http://10.0.0.14/
37
HTTP/1.1 302 Found
38
Date: Tue, 08 Sep 2026 08:16:04 GMT
39
Server: Apache/2.4.68 (Debian)
40
X-Powered-By: PHP/8.5.10
41
root@Master ~# curl -s -L http://10.0.0.14/ | grep -oE "<title>[^<]*</title>"
42
<title>WordPress &rsaquo; Installation</title>   # ✅ 进入安装页

1
1)编写资源清单
2
root@Master ~# vim /k8s/pods/06-deploy-xiuxian.yaml
3
apiVersion: apps/v1                  # ⭐ 首见！Deployment 属 apps 命名API组（Pod 属核心组只写 v1），详见上一节
4
kind: Deployment
5
metadata:
6
  name: deploy-xiuxian
7
spec:
8
  replicas: 3                              # 副本数量3
9
  selector:
10
    matchLabels:                           # 注意：Deployment 用 matchLabels（rc 用 selector）
11
      apps: xiuxian                        # 关联Pod的标签（必须能匹配 template 里的标签）
12
  template:
13
    metadata:
14
      labels:
15
        apps: xiuxian
16
        version: v1
17
    spec:
18
      containers:
19
      - name: c1                           # 后面 set image 要用这个名字定位容器
20
        image: registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:v1
21
root@Master ~# kubectl apply -f /k8s/pods/06-deploy-xiuxian.yaml
22
deployment.apps/deploy-xiuxian created
23

24
2)查看 Deployment、ReplicaSet 和 Pod
25
root@Master ~# kubectl get deploy,rs,po --show-labels -o wide
26
NAME                             READY   UP-TO-DATE   AVAILABLE   AGE   ...   SELECTOR       LABELS
27
deployment.apps/deploy-xiuxian   3/3     3            3           81s   ...   apps=xiuxian
28
......
29
replicaset.apps/deploy-xiuxian-54c5c88868   3   3   3   81s   ...   apps=xiuxian,pod-template-hash=54c5c88868
30
# ⬆️ RS 自动多出 pod-template-hash=54c5c88868 标签——模板内容的指纹
31
# 这个 hash 就是 Deployment 区分"版本"的钥匙：一个版本的模板 = 一个 RS
32
pod/deploy-xiuxian-54c5c88868-tnkcg   1/1   Running   0   81s   10.100.1.19   worker01   apps=xiuxian,pod-template-hash=54c5c88868,version=v1
33
pod/deploy-xiuxian-54c5c88868-tszks   1/1   Running   0   81s   10.100.1.20   worker01   ...（第3个同理，略）
34
# ⬆️ 层级：Deployment → RS → Pod；三个副本落在 worker01×2 + worker02×1
35

36
3)删除 Pod 观察自动重建
37
root@Master ~# kubectl delete pods -l apps=xiuxian
38
pod "deploy-xiuxian-54c5c88868-tnkcg" deleted from default namespace
39
...（3个全删，输出略）
40
# 稍等片刻...
41
root@Master ~# kubectl get deploy,po
42
NAME                             READY   UP-TO-DATE   AVAILABLE   AGE
43
deployment.apps/deploy-xiuxian   3/3     3            3           5m55s
44
pod/deploy-xiuxian-54c5c88868-fjgzw   1/1   Running   0   12s    # ⬅️ 新名字
45
pod/deploy-xiuxian-54c5c88868-sntht   1/1   Running   0   12s
46
pod/deploy-xiuxian-54c5c88868-v6rdt   1/1   Running   0   12s
47
# ⬆️ Pod 名字全变了，但前缀 RS hash（54c5c88868）没变——补副本是 RS 的活，版本没变
48

49
4)扩缩容（一行命令搞定）
50
root@Master ~# kubectl scale deployment deploy-xiuxian --replicas=5
51
deployment.apps/deploy-xiuxian scaled
52
root@Master ~# kubectl get deploy
53
NAME             READY   UP-TO-DATE   AVAILABLE   AGE
54
deploy-xiuxian   5/5     5            5           6m40s
55

56
5)滚动更新：v1 → v2
57
root@Master ~# kubectl set image deployment deploy-xiuxian c1=registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:v2
58
deployment.apps/deploy-xiuxian image updated
59
root@Master ~# kubectl rollout status deployment deploy-xiuxian
60
deployment "deploy-xiuxian" successfully rolled out
61

62
root@Master ~# kubectl get rs,po --show-labels
63
NAME                                        DESIRED   CURRENT   READY   AGE     LABELS
64
replicaset.apps/deploy-xiuxian-54c5c88868   0         0         0       7m26s   apps=xiuxian,pod-template-hash=54c5c88868,version=v1
65
replicaset.apps/deploy-xiuxian-864bdf9885   5         5         5       29s     apps=xiuxian,pod-template-hash=864bdf9885,version=v1
66
# ⬆️ 关键现象：旧 RS（54c5c88868）DESIRED 归 0 但【没有删除】，新 RS（864bdf9885）接管全部 5 个副本
67
NAME                                  READY   STATUS    RESTARTS   AGE   LABELS
68
pod/deploy-xiuxian-864bdf9885-4nljh   1/1     Running   0          29s   apps=xiuxian,pod-template-hash=864bdf9885,version=v1
69
pod/deploy-xiuxian-864bdf9885-kwpvr   1/1     Running   0          28s   apps=xiuxian,pod-template-hash=864bdf9885,version=v1
70
......
71
# ⬆️ 新 Pod 名字前缀全部变成 864bdf9885——旧 RS 缩到 0 却留着 = "后悔药"，这就是秒级回滚的原因
72

73
6)查看版本历史
74
root@Master ~# kubectl rollout history deployment deploy-xiuxian
75
deployment.apps/deploy-xiuxian
76
REVISION  CHANGE-CAUSE
77
1         <none>
78
2         <none>
79
# ⬆️ REVISION 1 = v1 镜像（旧 RS 54c5c88868），REVISION 2 = v2 镜像（当前 RS 864bdf9885）
80

81
7)回滚：v2 → v1（后悔药）
82
root@Master ~# kubectl rollout undo deployment deploy-xiuxian --to-revision=1
83
Warning: resource deployments/deploy-xiuxian was previously managed with 'kubectl apply'.
84
Rolling back will not update the kubectl.kubernetes.io/last-applied-configuration annotation,
85
which may cause unexpected behavior on future 'kubectl apply' operations.
86
Consider using 'kubectl apply' with your previous configuration file instead.
87
deployment.apps/deploy-xiuxian rolled back
88
# ⬆️ 警告解释：你的 Deployment 是 apply 创建的，k8s 在注解里存了"上次 apply 的完整配置"
89
# rollout undo 只改运行时状态、不更新这个注解——如果之后 yaml 里还是 v1 而注解记着别的，可能行为错乱
90
# ⬆️ 正确做法：回滚后立刻把 yaml 改回 apps:v1，再 kubectl apply -f 一次刷新注解，警告即消
91

92
root@Master ~# kubectl get deploy,rs
93
NAME                             READY   UP-TO-DATE   AVAILABLE   AGE
94
deployment.apps/deploy-xiuxian   5/5     5            5           10m
95
......
96
replicaset.apps/deploy-xiuxian-54c5c88868   5   5   5   10m    # ⬅️ 旧RS原地满血复活！
97
replicaset.apps/deploy-xiuxian-864bdf9885   0   0   0   3m7s   # ⬅️ v2的RS缩到0
98
# ⬆️ 回滚 = 两个 RS 的期望值互换，镜像早就在节点上，不用重新拉，所以飞快
99

100
8)删除 Deployment → 拔掉插线板，RS 和 Pod 一起清场
101
root@Master ~# kubectl delete -f /k8s/pods/06-deploy-xiuxian.yaml
102
deployment.apps "deploy-xiuxian" deleted from default namespace
103
root@Master ~# kubectl get deploy,rs,po
104
No resources found in default namespace.
105
# ⬆️ 删的是 Deployment，RS 和 Pod 一并消失
106
# 只想删 Deployment 留下 Pod：kubectl delete deploy deploy-xiuxian --cascade=orphan

1
1)环境准备：部署 Deployment（3个Pod）+ 给每个Pod写入不同首页
2
root@Master ~# kubectl apply -f /k8s/pods/06-deploy-xiuxian.yaml
3
deployment.apps/deploy-xiuxian created
4
root@Master ~# kubectl get pods -o wide -l apps=xiuxian
5
NAME                              READY   STATUS    RESTARTS   AGE   IP            NODE
6
deploy-xiuxian-54c5c88868-277nk   1/1     Running   0          5s    10.100.2.43   worker02
7
deploy-xiuxian-54c5c88868-fkt99   1/1     Running   0          5s    10.100.1.46   worker01
8
deploy-xiuxian-54c5c88868-qr7lq   1/1     Running   0          5s    10.100.1.47   worker01
9

10
# 给3个Pod写入不同首页（写各自Pod名），便于观察负载均衡
11
root@Master ~# kubectl exec deploy-xiuxian-54c5c88868-277nk -- sh -c "echo 111 > /usr/share/nginx/html/index.html"
12
root@Master ~# kubectl exec deploy-xiuxian-54c5c88868-fkt99 -- sh -c "echo 222 > /usr/share/nginx/html/index.html"
13
root@Master ~# kubectl exec deploy-xiuxian-54c5c88868-qr7lq -- sh -c "echo 333 > /usr/share/nginx/html/index.html"
14

15
2)创建 ClusterIP Service
16
root@Master ~# vim /k8s/pods/07-svc-xiuxian.yaml
17
apiVersion: v1
18
kind: Service
19
metadata:
20
  name: svc-xiuxian
21
  labels:
22
    school: kpyun
23
spec:
24
  selector:            # 标签选择器：筛选出带这些标签的 Pod 作为后端
25
    apps: xiuxian
26
    version: v1
27
  ports:
28
  - port: 90           # svc 的端口（客户端访问的端口）
29
    targetPort: 80     # 容器端口（流量最终转发到这里）
30
root@Master ~# kubectl apply -f /k8s/pods/07-svc-xiuxian.yaml
31
service/svc-xiuxian created
32

33
3)查看 svc（详情里的 Endpoints 就是后端 Pod 清单）
34
root@Master ~# kubectl get svc
35
NAME          TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)   AGE
36
kubernetes    ClusterIP   10.200.0.1      <none>        443/TCP   35h
37
svc-xiuxian   ClusterIP   10.200.227.87   <none>        90/TCP    0s
38
# 看 selector、ClusterIP、端口映射、Endpoints 全貌
39
root@Master ~# kubectl describe svc svc-xiuxian
40
Selector:                 apps=xiuxian,version=v1     # ⬅️ 靠它找后端
41
Type:                     ClusterIP
42
IP:                       10.200.227.87
43
Port:                     <unset>  90/TCP
44
TargetPort:               80/TCP
45
Endpoints:                10.100.2.43:80,10.100.1.46:80,10.100.1.47:80
46
# ⬆️ 三个 Endpoints 正好对应第1步三个Pod的IP:容器端口
47

48
4)测试负载均衡（循环访问10次，看轮流分发）
49
root@Master ~# for i in $(seq 10); do curl -s 10.200.227.87:90; done
50
222
51
222
52
111
53
222
54
333
55
222
56
...
57
# 同一个 svc IP:90，10次请求分给了3个后端 → 负载均衡✅
58
# 注意：是"轮询"不是"严格交替"，短时间连接复用可能连到同一后端，次数多了才均匀
59

60
5)验证服务发现（删除Pod后 Endpoints 自动更新，客户端无感知）
61
root@Master ~# kubectl delete pods -l apps=xiuxian
62
root@Master ~# kubectl get pods -l apps=xiuxian -o wide
63
deploy-xiuxian-54c5c88868-m2hsx   1/1   Running   0   11s   10.100.1.48   worker01
64
deploy-xiuxian-54c5c88868-s9lc6   1/1   Running   0   11s   10.100.2.45   worker02
65
deploy-xiuxian-54c5c88868-t6w7b   1/1   Running   0   11s   10.100.2.44   worker02
66
# 新Pod新IP
67
root@Master ~# kubectl get endpoints svc-xiuxian
68
NAME          ENDPOINTS                                       AGE
69
svc-xiuxian   10.100.1.48:80,10.100.2.44:80,10.100.2.45:80    18s
70
# ⬆️ Pod 全换了、IP 全变了，Endpoints 自动跟上 → 服务发现✅（客户端无感知）
71
# ⬆️ 客户端继续 curl 10.200.227.87:90 依然正常（新Pod是默认首页，因为我们只给旧Pod写过自定义内容）
72
`集群内还可以直接用 svc 名字访问（DNS 服务发现，CoreDNS 提供）`
73
root@Master ~# kubectl run -it dns-test --image=registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:v1 --rm -- sh -c "curl -s http://svc-xiuxian:90 | grep h1"
74
'临时测试 Pod 用完即删'
75
    <h1 style="color: green">凡人修仙传 v1 </h1>
76
# ⬆️ 在集群内任意 Pod 里，svc-xiuxian 这个名字会被 DNS 解析成 ClusterIP → 服务发现的另一半
77

78
6)清理实验环境
79
root@Master ~# kubectl delete -f /k8s/pods/07-svc-xiuxian.yaml
80
service "svc-xiuxian" deleted
81
root@Master ~# kubectl get svc
82
# default 命名空间恢复干净（仅剩默认的 kubernetes svc）

1
# 查看svc的TYPE类型
2
root@Master ~# kubectl get svc
3
NAME          TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)   AGE
4
kubernetes    ClusterIP   10.200.0.1       <none>        443/TCP   6d23h
5
svc-xiuxian   ClusterIP   10.200.217.133   <none>        90/TCP    111m
6

7
# kubectl explain：查看 Kubernetes 资源
8
`svc.spec.type：查看 Service 规格中 type 字段的详细说明`
9
root@Master ~# kubectl explain svc.spec.type
10
KIND:       Service
11
VERSION:    v1
12

13
FIELD: type <string>
14
ENUM:
15
    ClusterIP
16
    ExternalName
17
    LoadBalancer
18
    NodePort

1
1)编写资源清单
2
root@Master ~# vim /k8s/pods/08-svc-xiuxian-NodePort.yaml
3
apiVersion: v1
4
kind: Service
5
metadata:
6
  name: svc-xiuxian-nodeport
7
spec:
8
  type: NodePort          # ★ 与 ClusterIP 唯一的区别：多这一行
9
                          # 在 ClusterIP 能力之上，给"所有节点"各开一个 nodePort
10
  selector:               # 标签选择器：筛出带这些标签的 Pod 作为后端
11
    apps: xiuxian
12
    version: v1
13
  ports:
14
  - port: 90              # svc 端口：集群内部走 ClusterIP:90（ClusterIP 能力依然保留）
15
    targetPort: 80        # 容器端口：流量最终转发到 Pod 的 80
16
    # nodePort: 30090     # 节点端口：不写则系统自动从 30000~32767 随机分配
17
                          # 生产建议不写（避免端口冲突），测试要固定时才指定
18
root@Master ~# kubectl apply -f /k8s/pods/08-svc-xiuxian-NodePort.yaml
19
service/svc-xiuxian-nodeport created
20

21
2)查看（NodePort 端口 32099 是自动分配的）
22
root@Master ~# kubectl get svc svc-xiuxian-nodeport
23
NAME                   TYPE       CLUSTER-IP      EXTERNAL-IP   PORT(S)        AGE
24
svc-xiuxian-nodeport   NodePort   10.200.62.199💡 <none>      💡90:30794/TCP   19s
25
# ClusterIP 照样分配  90:30794 表示 ClusterIP:90 + 每个节点:30794 都能访问
26

27
3)路径① 集群内（老入口，ClusterIP 能力）
28
root@Master ~# for i in $(seq 5); do curl -s 10.200.62.199:90; done
29
222
30
333
31
111
32
222
33
222
34

35
4)路径② 集群外（新入口，任意节点IP:nodePort）
36
root@Master ~# NPORT=$(kubectl get svc svc-xiuxian-nodeport -o jsonpath='{.spec.ports[0].nodePort}')
37
root@Master ~# for ip in 10.0.0.13 10.0.0.14 10.0.0.15; do \
38
  echo "$ip:$NPORT => HTTP $(curl -s -o /dev/null -w '%{http_code}' $ip:$NPORT)"; done
39
10.0.0.13:30794 => HTTP 200
40
10.0.0.14:30794 => HTTP 200
41
10.0.0.15:30794 => HTTP 200
42
# ⬆️ 三个节点都能通过 NodePort 访问并转发到后端 Pod！这就是集群外用户访问的方式