## 1.安装metrics-server插件

```yml
# components.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    k8s-app: metrics-server
  name: metrics-server
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    k8s-app: metrics-server
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
    rbac.authorization.k8s.io/aggregate-to-view: "true"
  name: system:aggregated-metrics-reader
rules:
  - apiGroups:
      - metrics.k8s.io
    resources:
      - pods
      - nodes
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    k8s-app: metrics-server
  name: system:metrics-server
rules:
  - apiGroups:
      - ""
    resources:
      - nodes/metrics
    verbs:
      - get
  - apiGroups:
      - ""
    resources:
      - pods
      - nodes
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    k8s-app: metrics-server
  name: metrics-server-auth-reader
  namespace: kube-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: extension-apiserver-authentication-reader
subjects:
  - kind: ServiceAccount
    name: metrics-server
    namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    k8s-app: metrics-server
  name: metrics-server:system:auth-delegator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
  - kind: ServiceAccount
    name: metrics-server
    namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    k8s-app: metrics-server
  name: system:metrics-server
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:metrics-server
subjects:
  - kind: ServiceAccount
    name: metrics-server
    namespace: kube-system
---
apiVersion: v1
kind: Service
metadata:
  labels:
    k8s-app: metrics-server
  name: metrics-server
  namespace: kube-system
spec:
  ports:
    - name: https
      port: 443
      protocol: TCP
      targetPort: https
  selector:
    k8s-app: metrics-server
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    k8s-app: metrics-server
  name: metrics-server
  namespace: kube-system
spec:
  selector:
    matchLabels:
      k8s-app: metrics-server
  strategy:
    rollingUpdate:
      maxUnavailable: 0
  template:
    metadata:
      labels:
        k8s-app: metrics-server
    spec:
      containers:
        - args:
            - --cert-dir=/tmp
            - --secure-port=4443
            - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
            - --kubelet-use-node-status-port
            - --metric-resolution=15s
            - --kubelet-insecure-tls #修改去掉证书验证
          image: dyrnq/metrics-server:v0.6.2 #修改官方无法下载
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /livez
              port: https
              scheme: HTTPS
            periodSeconds: 10
          name: metrics-server
          ports:
            - containerPort: 4443
              name: https
              protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /readyz
              port: https
              scheme: HTTPS
            initialDelaySeconds: 20
            periodSeconds: 10
          resources:
            requests:
              cpu: 100m
              memory: 200Mi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 1000
          volumeMounts:
            - mountPath: /tmp
              name: tmp-dir
      hostNetwork: true  #必须指定这个才行
      nodeSelector:
        kubernetes.io/os: linux
      priorityClassName: system-cluster-critical
      serviceAccountName: metrics-server
      volumes:
        - emptyDir: {}
          name: tmp-dir
---
apiVersion: apiregistration.k8s.io/v1
kind: APIService
metadata:
  labels:
    k8s-app: metrics-server
  name: v1beta1.metrics.k8s.io
spec:
  group: metrics.k8s.io
  groupPriorityMinimum: 100
  insecureSkipTLSVerify: true
  service:
    name: metrics-server
    namespace: kube-system
  version: v1beta1
  versionPriority: 100
```

## 2.创建一个容器，限制请求内存和最大内存限制。

```yml
apiVersion: v1
kind: Pod
metadata:
  name: nginx-memory-demo
spec:
  containers:
  - name: nginx-memory-demo
    image: nginx:1.19
    resources:
      requests:
        memory: "100Mi" 
      limits:
        memory: "200Mi"
```

## 3.查看pod的使用CPU和内存情况

![image.png](/static/img/2ce900ff468dbab1d2f5c82b801fc408.image.webp)

```js
kubectl top pod
```


## 4.创建一个容器，限制请求CPU和最大CPU限制。

```yml
apiVersion: v1
kind: Pod
metadata:
  name: nginx-cpu-demo
spec:
  containers:
  - name: nginx-cpu-demo
    image: nginx:1.19
    resources:
      limits:
        cpu: "1"
      requests:
        cpu: "0.5"
```

6.容器资源限制

## 1.exec探针

```yml
apiVersion: v1
kind: Pod
metadata:
  name: liveness-exec
  labels:
    exec: exec
spec:
  containers:
  - name: nginx
    image: nginx:1.19
    ports:
    - containerPort: 80
    args:
    - /bin/sh
    - -c
    - sleep 7;nginx -g "daemon off;" #这一步会和初始化同时开始运行，也就是在初始化5s后和7秒之间，会检测出一次失败，7秒后启动后检测正常，所以pod不会重启
    imagePullPolicy: IfNotPresent
    livenessProbe:
      exec:    #这里使用 exec 执行 shell 命令检测容器状态
        command:  
        - ls
        - /var/run/nginx.pid  #查看是否有pid文件
      initialDelaySeconds: 5   #初始化时间5s
      periodSeconds: 4    #检测间隔时间4s
      timeoutSeconds: 1   #默认检测超时时间为1s
      failureThreshold: 3   #默认失败次数为3次，达到3次后重启pod
      successThreshold: 1   #默认成功次数为1次，1 次代表成功
```

```js
该yml配置文件说明：exec探针会去该路径下检查nginx是否有pid文件生成。
 initialDelaySeconds: 5 容器启动五秒后开始检测
 periodSeconds: 4 检测时间为4秒一次
 failureThreshold: 3   检测3次失败将会重启pod
  successThreshold: 1 当1次检测到有pid文件时就会成功
```


## 2.TCP socket 探针

```yml
apiVersion: v1
kind: Pod
metadata:
  name: liveness-tcpsocket
  labels:
    tcpsocket: tcpsocket
spec:
  containers:
  - name: nginx
    image: nginx:1.19
    ports:
    - containerPort: 80
    args:
    - /bin/sh
    - -c
    - sleep 7;nginx -g "daemon off;"  #这一步会和初始化同时开始运行，也就是在初始化5s后和7秒之间，会检测出一次失败，7秒后启动后检测正常，所以pod不会重启
    imagePullPolicy: IfNotPresent
    livenessProbe:
      tcpSocket:
        port: 80
      initialDelaySeconds: 5   #初始化时间5s
      periodSeconds: 4    #检测间隔时间4s
      timeoutSeconds: 1   #默认检测超时时间为1s
      failureThreshold: 3   #默认失败次数为3次，达到3次后重启pod
      successThreshold: 1   #默认成功次数为1次，1 次代表成功
```

```js
tcpSocket探针它会监控你指定的端口是否存活，如配置文件检测80端口是否存活。
```

## 3.HTTP GET 探针

```yml
apiVersion: v1
kind: Pod
metadata:
  name: liveness-httpget
  labels:
    httpget: httpget
spec:
  containers:
  - name: nginx
    image: nginx:1.19
    ports:
    - containerPort: 80
    args:
    - /bin/sh
    - -c
    - sleep 7;nginx -g "daemon off;" #这一步会和初始化同时开始运行，也就是在初始化5s后和7秒之间，会检测出一次失败，7秒后启动后检测正常，所以pod不会重启
    imagePullPolicy: IfNotPresent
    livenessProbe:
      httpGet:     #httpget
        port: 80   #访问的端口
        path: /index.html   #访问的路径
      initialDelaySeconds: 5   #初始化时间5s
      periodSeconds: 4    #检测间隔时间4s
      timeoutSeconds: 1   #默认检测超时时间为1s
      failureThreshold: 3   #默认失败次数为3次，达到3次后重启pod
      successThreshold: 1   #默认成功次数为1次，1 次代表成功
```
```js
HTTP GET 探针会发送一个get请求访问你指定的路径端口，如果返回200-399状态码为成功。
```

## 总结

```txt
‌TCP Socket 探针‌
向容器指定端口发起 TCP 连接（三次握手）。若端口成功打开，则判定为健康示例配置：仅需指定端口号。

‌HTTP GET 探针‌
向容器指定端口和 HTTP 路径发送 GET 请求。若响应状态码为 200-399，则判定为健康示例配置：
需指定端口、路径（如 /healthz），可自定义请求头。

‌Exec 探针‌
在容器内执行指定命令（如脚本或程序）。若命令退出状态码为 0，则判定为健康示例配置：
需定义完整的 Shell 命令（如 check_db.sh）。
```

5.容器的探针


```js
apiVersion: v1
kind: Pod
metadata:
  name: redis
  labels:
    app: redis
spec:
  containers:
    - name: redis
      image: redis:5.0.10
      command: ["redis-server"] #用来指定启动命令
      args: ["--appendonly yes"] # 用来为启动命令传递参数
      #args: ["redis-server","--appendonly yes"] # 单独使用修改启动命令并传递参数
      #args:                                     # 另一种语法格式
      #  - redis-server
      #  - "--appendonly yes"
      imagePullPolicy: IfNotPresent
  restartPolicy: Always
```


4.自定义容器启动命令


```yml
apiVersion: v1
kind: Pod
metadata:
  name: nginx
  labels:
    app: nginx_redis
spec:
  containers:
    - name: nginx
      image: nginx:1.21
      lifecycle:
        postStart: #容器创建过程中执行
          exec:
            command:
               ["/bin/sh", "-c","echo 你好啊 >> /1.txt"]
        preStop:
          exec:
            command:
               ["/bin/sh", "-c","echo 结束咯 >> /1.txt && sleep 20"]
      ports:
        - containerPort: 8080

  restartPolicy: Always

```

```js
执行该yml文件，在创建容器过程中输出一段文字到文本中
```

![image.png](/static/img/0b5c346265f8ec2b95faa311d4737473.image.webp)


```js
当我吧pod删除后，结束前再输出一段文字到文本中
```

![image.png](/static/img/5ad34dde623e6c4e043a51c91154e46b.image.webp)

![image.png](/static/img/2727f32b7aeeb3f87f2af3f81e2eba3d.image.webp)

3.容器的生命周期

## 1.查看默认的命名空间的pod

![image.png](/static/img/25526ff3d20bd1259ea990daa499fdad.image.webp)
```js
kubectl get pod
```
## 2.查看所有的命名空间的pod

![image.png](/static/img/a737c3ea077d0bc3a779568d8c861e3a.image.webp)
```js
kubectl get pod
```
## 3.查看所有命名空间的pod的详细信息

![image.png](/static/img/791f187500b01a6b5a827c206f426c32.image.webp)
```js
kubectl get pod -o wide -A
```

## 4.查看指定命名空间的pod的详细信息

![image.png](/static/img/c0fe44d0fcfc75cdab9a5ef1b25ae73d.image.webp)

```js
kubectl get pod -o wide -n 命名空间的名称
```

## 5.实时监控pod的状态

![image.png](/static/img/454d635e525076d1282bde9cd0a5c81c.image.webp)

```js
kubectl get pod -w -n 命名空间的名称
```


## 6.简单创建一个pod命令

![image.png](/static/img/1e93b5678d5f6815776bc3418f754285.image.webp)
```js
kubectl run pod的名称 --image=nginx
```

## 7.查看pod错误描述信息

![image.png](/static/img/aaa69a2318812ec1dc6eb0a07cbec33b.image.webp)

```js
kubectl describe pod nginx
```
该问题是拉取镜像失败了，需要重新配置一下containerd容器镜像拉取地址

```js
vim /etc/containerd/config.toml
```
```js
disabled_plugins = ["restart"]
[plugins.linux]
shim_debug = true

[plugins.cri.registry.mirrors."docker.io"]
endpoint = [
    "https://docker.m.daocloud.io",
    "https://docker.1panel.live",
    "https://hub.rat.dev",
    "https://registry-1.docker.io"  # 官方源保底
]

[plugins.cri]
sandbox_image = "registry.aliyuncs.com/google_containers/pause:3.2"
```
```js
#重启容器
systemctl restart containerd
```
然后测试一下拉取还是报错，看来是crictl问题

![image.png](/static/img/264a23020221aa72856be3645a1f5de9.image.webp)
需要创建/修改 crictl 配置文件

```js
mkdir -p /etc/crictl
cat <<EOF | sudo tee /etc/crictl/config.yaml
runtime-endpoint: unix:///run/containerd/containerd.sock
image-endpoint: unix:///run/containerd/containerd.sock
timeout: 10
debug: true
EOF
```
再次查看NG镜像已经拉取成功

![image.png](/static/img/b1a7cf9477f80e52b899750383f6fbc0.image.webp)

## 8.以yml文件方式创建pod

![image.png](/static/img/ff69c69b6e10cbf9cbcfae68343afbee.image.webp)

```js
vi k8s.yml
```

```yml
apiVersion: v1
kind: Pod
metadata:
  name: nginx
  labels:
    app: nginx
spec:
  containers:
    - name: nginx
      image: nginx:1.21
      imagePullPolicy: IfNotPresent
  restartPolicy: Always
```

```js
kubectl apply -f k8s.yml
```

## 9.删除pod

```js
kubectl delete pod <pod的名称>
kubectl delete -f k8s.yml
```

## 10.进入pod容器

![image.png](/static/img/fc21030d2ac36624421680530879d498.image.webp)

```js
kubectl exec -it nginx -- bash
```

如果一个pod有多个容器，列如：nginx-container + log-collector

```js
# 进入名为 nginx-container 的容器
kubectl exec -it nginx -c nginx-container -- bash

# 进入名为 log-collector 的容器
kubectl exec -it nginx -c log-collector -- bash
```

## 11.查看pod容器日志

![image.png](/static/img/bc0cf978b1fc52ae70dc3fd78002c687.image.webp)
```js
#查看该pod所有容器的日志
kubectl logs -f <pod名称>

#查看该pod指定容器的日志
kubectl logs -f <pod名称>  -c log-collector
```

## 12.查看pod的标签

![image.png](/static/img/15d1c2565e9deddf833872e3d0c45256.image.webp)

![image.png](/static/img/4cdc64cb6f17b6509d75429a3ab5b359.image.webp)
```js
#查看pod的标签
kubectl get pod --show-labels
```
## 13.添加pod的标签

![image.png](/static/img/15910632cf7d20ef54862986a03ece0a.image.webp)
```js
kubectl label pod nginx-redis01 name=songxuan
```
## 14.修改pod标签值
![](http://songxuan.vip/static/img/15910632cf7d20ef54862986a03ece0a.image.webp)

```js
kubectl label --overwrite pod nginx-redis01 name=xuan
```

## 15.删除pod的标签

![image.png](/static/img/45777d570ccc903475ac08459c31c8c7.image.webp)
```js
kubectl label pod nginx-redis01 name-
```