K8s 进阶概览

spec:
  nodeSelector:
    gpu: "true"                 # 只调度到有 gpu=true 标签的节点

# 管理员给节点打标签:
# kubectl label nodes node-3 gpu=true

spec:
  affinity:
    nodeAffinity:
      # 硬性要求:必须满足(不满足则 Pod 不调度)
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: topology.kubernetes.io/zone
            operator: In
            values: ["us-east-1a", "us-east-1b"]

      # 软性偏好:尽量满足(不满足也可以调度)
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 80               # 权重 1-100
        preference:
          matchExpressions:
          - key: node-type
            operator: In
            values: ["high-memory"]

spec:
  affinity:
    # Pod 亲和:和某些 Pod 放在一起
    podAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
      - labelSelector:
          matchLabels:
            app: cache            # 我要和 cache Pod 在同一节点
        topologyKey: kubernetes.io/hostname

    # Pod 反亲和:和某些 Pod 分开
    podAntiAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchLabels:
              app: web            # 同一个 Deployment 的 Pod 尽量分散
          topologyKey: kubernetes.io/hostname

# Pod 要去 node-gpu,必须声明"我能容忍这个 Taint"
spec:
  tolerations:
  - key: dedicated
    operator: Equal
    value: gpu
    effect: NoSchedule

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: api-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: api-server
  minReplicas: 3                   # 最少 3 个
  maxReplicas: 50                  # 最多 50 个
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70     # 平均 CPU 利用率超过 70% → 扩容
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80

# 定义角色:允许读取 default namespace 的 Pod 和 Service
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: default
rules:
- apiGroups: [""]              # "" = core API group(Pod,Service 等)
  resources: ["pods", "services"]
  verbs: ["get", "list", "watch"]

---
# 把角色绑定给 ServiceAccount
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: default
subjects:
- kind: ServiceAccount
  name: monitoring-sa          # 这个 ServiceAccount
  namespace: default
roleRef:
  kind: Role
  name: pod-reader             # 获得 pod-reader 的权限
  apiGroup: rbac.authorization.k8s.io

# 定义一个新的资源类型:MySQLCluster
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: mysqlclusters.database.example.com
spec:
  group: database.example.com
  versions:
  - name: v1
    served: true
    storage: true
    schema:
      openAPIV3Schema:
        type: object
        properties:
          spec:
            type: object
            properties:
              replicas:
                type: integer
              version:
                type: string
              storage:
                type: string
  scope: Namespaced
  names:
    plural: mysqlclusters
    singular: mysqlcluster
    kind: MySQLCluster

# 创建自定义资源实例
apiVersion: database.example.com/v1
kind: MySQLCluster
metadata:
  name: prod-mysql
spec:
  replicas: 3
  version: "8.0"
  storage: "500Gi"

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-policy
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: api                    # 对哪些 Pod 生效
  policyTypes:
  - Ingress
  - Egress
  ingress:                        # 入站:谁能访问我
  - from:
    - podSelector:
        matchLabels:
          app: frontend           # 只有 frontend Pod 能访问 api
    - namespaceSelector:
        matchLabels:
          env: production         # 且必须在 production namespace
    ports:
    - port: 8080
      protocol: TCP
  egress:                         # 出站:我能访问谁
  - to:
    - podSelector:
        matchLabels:
          app: database           # api 只能访问 database Pod
    ports:
    - port: 5432

apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
  namespace: dev
spec:
  limits:
  - default:                     # 不写 limits 时的默认值
      cpu: 500m
      memory: 512Mi
    defaultRequest:              # 不写 requests 时的默认值
      cpu: 100m
      memory: 128Mi
    type: Container

apiVersion: v1
kind: ResourceQuota
metadata:
  name: dev-quota
  namespace: dev
spec:
  hard:
    requests.cpu: "10"           # namespace 内所有 Pod 的 CPU requests 总和不超过 10 核
    requests.memory: 20Gi
    limits.cpu: "20"
    limits.memory: 40Gi
    pods: "50"                   # 最多 50 个 Pod
    persistentvolumeclaims: "20" # 最多 20 个 PVC