Kubernetes 面试题

# 所有 kubectl 命令都通过 API Server
kubectl get pods
# 等同于调用 GET /api/v1/namespaces/default/pods

# kubelet 通过 CRI 与容器运行时交互
kubelet → CRI → containerd → 容器

# 查看 kube-proxy 模式
kubectl logs -n kube-system -l k8s-app=kube-proxy | grep "Using"

spec:
  restartPolicy: Always  # 可选：Always、OnFailure、Never

livenessProbe:
  httpGet:
    path: /healthz
    port: 8080
  initialDelaySeconds: 15
  periodSeconds: 10

readinessProbe:
  httpGet:
    path: /ready
    port: 8080
  initialDelaySeconds: 5
  periodSeconds: 5

Deployment
    │
    ├── ReplicaSet (v1) ── Pod, Pod, Pod
    └── ReplicaSet (v2) ── Pod, Pod, Pod  (滚动更新时)

spec:
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 25%        # 最多超出期望数量的比例
      maxUnavailable: 25%   # 最多不可用的比例

# 查看滚动更新状态
kubectl rollout status deployment/nginx

# 回滚到上一版本
kubectl rollout undo deployment/nginx

# 回滚到指定版本
kubectl rollout undo deployment/nginx --to-revision=2

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluentd
spec:
  selector:
    matchLabels:
      name: fluentd
  template:
    spec:
      containers:
      - name: fluentd
        image: fluentd:v1.14

# CronJob 示例
apiVersion: batch/v1
kind: CronJob
metadata:
  name: backup-job
spec:
  schedule: "0 2 * * *"  # 每天凌晨 2 点
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: backup
            image: backup:latest
          restartPolicy: OnFailure

apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  type: NodePort
  selector:
    app: my-app
  ports:
  - port: 80
    targetPort: 8080
    nodePort: 30080  # 30000-32767

# 自动注入的环境变量
MY_SERVICE_SERVICE_HOST=10.96.0.1
MY_SERVICE_SERVICE_PORT=80

# Service DNS 格式
<service-name>.<namespace>.svc.cluster.local

# 示例
curl http://my-service.default.svc.cluster.local

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
spec:
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: my-service
            port:
              number: 80

apiVersion: v1
kind: Service
metadata:
  name: mysql-headless
spec:
  clusterIP: None  # Headless
  selector:
    app: mysql
  ports:
  - port: 3306

# ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  config.yaml: |
    database:
      host: mysql
      port: 3306

# Secret
apiVersion: v1
kind: Secret
metadata:
  name: db-secret
type: Opaque
data:
  password: cGFzc3dvcmQxMjM=  # base64 encoded

# 1. 环境变量
env:
- name: DATABASE_HOST
  valueFrom:
    configMapKeyRef:
      name: app-config
      key: database_host

# 2. 全部注入环境变量
envFrom:
- configMapRef:
    name: app-config

# 3. 挂载为文件
volumes:
- name: config-volume
  configMap:
    name: app-config
volumeMounts:
- name: config-volume
  mountPath: /etc/config

StorageClass (动态供应策略)
      │
      ↓
PersistentVolume (存储资源)
      │
      ↓ (绑定)
PersistentVolumeClaim (存储请求)
      │
      ↓ (挂载)
Pod

# StorageClass
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: fast-storage
provisioner: kubernetes.io/aws-ebs
parameters:
  type: gp3
reclaimPolicy: Delete

# PVC（自动创建 PV）
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: my-pvc
spec:
  accessModes: ["ReadWriteOnce"]
  storageClassName: fast-storage
  resources:
    requests:
      storage: 10Gi

# 给节点打标签
kubectl label nodes node1 disktype=ssd

# Pod 中使用 nodeSelector
spec:
  nodeSelector:
    disktype: ssd

affinity:
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:  # 硬约束
      nodeSelectorTerms:
      - matchExpressions:
        - key: disktype
          operator: In
          values: ["ssd"]
    preferredDuringSchedulingIgnoredDuringExecution:  # 软约束
      - weight: 1
        preference:
          matchExpressions:
          - key: zone
            operator: In
            values: ["zone-a"]

affinity:
  podAntiAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
    - labelSelector:
        matchExpressions:
        - key: app
          operator: In
          values: ["web"]
      topologyKey: "kubernetes.io/hostname"  # 不同节点

# 给节点添加污点
kubectl taint nodes node1 gpu=true:NoSchedule

# Pod 添加容忍
tolerations:
- key: "gpu"
  operator: "Equal"
  value: "true"
  effect: "NoSchedule"

# PriorityClass
apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
  name: high-priority
value: 1000000
globalDefault: false
description: "高优先级任务"

# Pod 使用
spec:
  priorityClassName: high-priority

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: my-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: my-deployment
  minReplicas: 2
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70

# 快速创建 HPA
kubectl autoscale deployment nginx --min=2 --max=10 --cpu-percent=70

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
  namespace: production
spec:
  podSelector: {}  # 应用到所有 Pod
  policyTypes:
  - Ingress
  - Egress
  # 不定义规则 = 拒绝所有

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-web
spec:
  podSelector:
    matchLabels:
      app: api
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: web
    ports:
    - port: 8080

# Role
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]

# RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: default
subjects:
- kind: User
  name: alice
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

# 创建 ServiceAccount
apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-sa
  
# Pod 使用 ServiceAccount
spec:
  serviceAccountName: my-sa

spec:
  securityContext:
    runAsUser: 1000          # 运行用户
    runAsGroup: 3000         # 运行组
    fsGroup: 2000            # 文件系统组
    runAsNonRoot: true       # 禁止 root 运行
  containers:
  - name: app
    securityContext:
      allowPrivilegeEscalation: false  # 禁止提权
      readOnlyRootFilesystem: true     # 只读根文件系统
      capabilities:
        drop: ["ALL"]

# 资源查看
kubectl get pods -o wide
kubectl describe pod nginx
kubectl logs nginx -f --tail=100

# 资源创建
kubectl apply -f deployment.yaml
kubectl create deployment nginx --image=nginx

# 资源编辑
kubectl edit deployment nginx
kubectl patch deployment nginx -p '{"spec":{"replicas":3}}'

# 资源删除
kubectl delete pod nginx
kubectl delete -f deployment.yaml

# 调试命令
kubectl exec -it nginx -- /bin/sh
kubectl port-forward pod/nginx 8080:80
kubectl cp nginx:/var/log/app.log ./app.log

# 集群管理
kubectl get nodes
kubectl cordon node1        # 禁止调度
kubectl drain node1         # 驱逐并禁止调度
kubectl uncordon node1      # 恢复调度

# 1. 查看 Pod 状态
kubectl get pod nginx -o wide

# 2. 查看详细事件
kubectl describe pod nginx

# 3. 查看容器日志
kubectl logs nginx
kubectl logs nginx --previous  # 上一次容器日志

# 4. 进入容器调试
kubectl exec -it nginx -- /bin/sh

# 查看所有事件
kubectl get events --sort-by=.metadata.creationTimestamp

# 查看特定命名空间事件
kubectl get events -n kube-system

# 以 watch 模式查看
kubectl get events -w

Node Exporter  → Prometheus → Grafana
kube-state-metrics ↗
cAdvisor ↗

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluentd
spec:
  template:
    spec:
      containers:
      - name: fluentd
        image: fluentd
        volumeMounts:
        - name: varlog
          mountPath: /var/log
      volumes:
      - name: varlog
        hostPath:
          path: /var/log

spec:
  initContainers:
  - name: wait-mysql
    image: busybox
    command: ['sh', '-c', 'until nc -z mysql 3306; do sleep 2; done']
  containers:
  - name: app
    image: myapp

spec:
  containers:
  - name: app
    image: myapp
  - name: log-collector
    image: fluentd
    volumeMounts:
    - name: logs
      mountPath: /var/log/app

# 添加仓库
helm repo add bitnami https://charts.bitnami.com/bitnami

# 搜索 Chart
helm search repo nginx

# 安装 Chart
helm install my-nginx bitnami/nginx

# 查看 Release
helm list

# 升级
helm upgrade my-nginx bitnami/nginx --set replicaCount=3

# 卸载
helm uninstall my-nginx

mychart/
├── Chart.yaml          # Chart 元数据
├── values.yaml         # 默认配置值
├── charts/             # 依赖的其他 Chart
├── templates/          # K8s 资源模板
│   ├── deployment.yaml
│   ├── service.yaml
│   ├── _helpers.tpl    # 模板助手函数
│   └── NOTES.txt       # 安装后提示
└── .helmignore         # 忽略文件

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: databases.example.com
spec:
  group: example.com
  names:
    kind: Database
    plural: databases
    singular: database
  scope: Namespaced
  versions:
  - name: v1
    served: true
    storage: true
    schema:
      openAPIV3Schema:
        type: object
        properties:
          spec:
            type: object
            properties:
              engine:
                type: string
              version:
                type: string

kubectl describe pod <pod-name>

# 查看日志
kubectl logs <pod-name> --previous

# 查看退出码
kubectl describe pod <pod-name>

resources:
  requests:       # 调度时保证的资源
    memory: "256Mi"
    cpu: "250m"
  limits:         # 运行时的上限
    memory: "512Mi"
    cpu: "500m"

metadata:
  annotations:
    reloader.stakater.com/auto: "true"

kubectl rollout restart deployment my-app

# 禁止调度新 Pod
kubectl cordon <node>

# 驱逐现有 Pod
kubectl drain <node> --ignore-daemonsets --delete-emptydir-data

# 维护完成后恢复
kubectl uncordon <node>

# etcd 备份
ETCDCTL_API=3 etcdctl snapshot save backup.db

# Velero 备份
velero backup create my-backup --include-namespaces=production