1. Kubernetes清单文件基础认知Kubernetes清单文件Manifest是定义集群工作负载的核心配置文件采用YAML或JSON格式编写。这份看似简单的文本文件实际上承载着Kubernetes声明式API的全部精髓——你只需要告诉系统想要什么状态而不是如何达到这个状态。清单文件通常包含以下几个关键部分apiVersion标识API的版本如apps/v1kind资源类型如Deployment、Servicemetadata名称、标签等元信息spec期望状态的详细规格status由系统自动生成当前实际状态一个典型的Deployment清单文件示例apiVersion: apps/v1 kind: Deployment metadata: name: nginx-deployment labels: app: nginx spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: - name: nginx image: nginx:1.14.2 ports: - containerPort: 80注意YAML对缩进极其敏感建议使用2个空格而非Tab进行缩进这是Kubernetes社区的通用约定。2. 清单文件创建全流程详解2.1 环境准备与工具链配置在开始编写清单文件前需要确保具备以下环境已安装kubectl命令行工具版本需与集群版本兼容配置正确的kubeconfig文件通常位于~/.kube/config安装yamllint或VS Code的YAML扩展用于语法检查验证环境配置kubectl version --short kubectl config current-context2.2 资源类型选择策略Kubernetes提供多种资源类型常见选择包括资源类型适用场景典型组合Deployment无状态应用部署配合Service暴露服务StatefulSet有状态应用如数据库配合PVC提供持久化存储DaemonSet每个节点运行一个Pod如日志收集直接使用Host网络或存储Job/CronJob批处理任务独立运行或定时触发选择原则优先使用Deployment满足大多数场景需要稳定网络标识时用StatefulSet节点级任务使用DaemonSet临时任务使用Job/CronJob2.3 清单文件编写实战以部署一个高可用Web应用为例我们需要创建以下资源Deployment应用部署apiVersion: apps/v1 kind: Deployment metadata: name: webapp spec: replicas: 3 strategy: rollingUpdate: maxSurge: 1 maxUnavailable: 0 selector: matchLabels: app: webapp template: metadata: labels: app: webapp spec: containers: - name: web image: myrepo/webapp:v1.2.0 ports: - containerPort: 8080 resources: requests: cpu: 100m memory: 128Mi limits: cpu: 500m memory: 512Mi livenessProbe: httpGet: path: /healthz port: 8080 initialDelaySeconds: 30 periodSeconds: 10Service服务暴露apiVersion: v1 kind: Service metadata: name: webapp-service spec: selector: app: webapp ports: - protocol: TCP port: 80 targetPort: 8080 type: LoadBalancerHorizontalPodAutoscaler自动扩缩容apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: name: webapp-hpa spec: scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: webapp minReplicas: 2 maxReplicas: 10 metrics: - type: Resource resource: name: cpu target: type: Utilization averageUtilization: 502.4 清单文件校验与部署在应用清单文件前建议执行以下验证步骤语法检查kubectl apply --dry-runclient -f deployment.yaml资源验证kubectl get pods -l appwebapp kubectl describe svc webapp-service实时日志监控kubectl logs -f deployment/webapp3. 高级配置与优化技巧3.1 多环境配置管理实际项目中通常需要区分开发、测试、生产环境推荐以下方案使用Kustomize进行配置覆盖base/ deployment.yaml kustomization.yaml overlays/ dev/ kustomization.yaml replica_count.yaml prod/ kustomization.yaml resource_limits.yaml通过Helm模板化配置# values.yaml replicaCount: 1 image: repository: nginx tag: stable resources: limits: cpu: 100m memory: 128Mi3.2 安全加固配置使用SecurityContext限制权限securityContext: runAsNonRoot: true runAsUser: 1000 capabilities: drop: - ALL readOnlyRootFilesystem: true配置NetworkPolicy网络隔离apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: default-deny spec: podSelector: {} policyTypes: - Ingress - Egress3.3 性能优化实践合理设置资源请求与限制resources: requests: cpu: 100m memory: 128Mi limits: cpu: 500m memory: 512Mi配置拓扑分布约束Topology Spread ConstraintstopologySpreadConstraints: - maxSkew: 1 topologyKey: kubernetes.io/hostname whenUnsatisfiable: ScheduleAnyway labelSelector: matchLabels: app: webapp4. 常见问题排查指南4.1 镜像拉取失败问题典型错误现象Failed to pull image private.repo/image:v1: rpc error: code Unknown desc failed to pull and unpack image...排查步骤检查镜像地址是否正确验证镜像拉取密钥是否存在kubectl get secrets手动测试镜像拉取docker pull private.repo/image:v14.2 Pod处于Pending状态可能原因及解决方案现象可能原因解决方案0/3 nodes are available资源不足增加节点或调整资源请求pod has unbound PVC存储卷未就绪检查StorageClass和PVC状态node(s) didnt match selector节点选择器不匹配调整nodeSelector或节点标签诊断命令kubectl describe pod pod-name kubectl get events --sort-by.metadata.creationTimestamp4.3 ConfigMap权限问题当遇到脚本执行权限问题时如标题提到的configmap permission denied解决方案确保脚本具有可执行权限chmod x script.sh通过initContainer设置权限initContainers: - name: set-permissions image: busybox command: [chmod, x, /path/to/script.sh] volumeMounts: - name: config-volume mountPath: /path/to或者直接使用ConfigMap的subPath挂载volumeMounts: - name: config-volume mountPath: /script.sh subPath: script.sh