1. 生产环境Kubernetes集群部署概述在当今云原生技术生态中Kubernetes已成为容器编排的事实标准。不同于开发测试环境生产环境的Kubernetes集群部署需要考虑高可用性、安全性、性能优化等关键因素。根据CNCF 2022年度调查报告全球已有96%的组织正在使用或评估Kubernetes其中78%已将其用于生产环境。生产级Kubernetes集群与本地开发环境的主要差异体现在必须支持零停机滚动升级需要完善的监控告警体系要求细粒度的资源配额管理必须实现多维度安全防护需要建立灾备恢复机制2. 集群架构设计2.1 高可用拓扑方案典型的生产环境采用多Master节点架构建议至少3个Master节点组成控制平面。以下是两种主流方案对比方案类型优点缺点适用场景堆叠式etcd部署简单资源利用率高故障域耦合度高中小规模集群(≤50节点)外部etcd集群更高可用性独立扩展维护复杂度高大规模集群(50节点)我们选择堆叠式etcd方案使用kubeadm部署工具初始化集群。关键配置参数apiVersion: kubeadm.k8s.io/v1beta3 kind: ClusterConfiguration controlPlaneEndpoint: k8s-api.example.com:6443 etcd: external: endpoints: - https://etcd1:2379 - https://etcd2:2379 - https://etcd3:2379 networking: podSubnet: 10.244.0.0/16 serviceSubnet: 10.96.0.0/122.2 节点规划建议生产环境节点应遵循以下原则Master节点专用物理机或高配VM禁用调度普通PodWorker节点根据业务类型分组如CPU密集型、内存密集型基础设施节点单独部署监控、日志等系统组件推荐节点规格Master节点8核16GB内存起步Worker节点根据业务需求建议16核32GB起步etcd节点SSD存储低延迟网络3. 网络与存储配置3.1 CNI插件选型生产环境常用网络方案对比插件性能功能复杂度Calico高支持NetworkPolicy中Flannel中基础功能低Cilium极高eBPF增强高选择Calico作为网络插件安装命令kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml3.2 存储方案设计生产环境存储需求矩阵存储类型适用场景推荐方案块存储数据库Ceph RBD文件存储共享目录NFS Subdir对象存储媒体文件MinIO配置示例Ceph RBDapiVersion: storage.k8s.io/v1 kind: StorageClass metadata: name: ceph-rbd provisioner: rbd.csi.ceph.com parameters: clusterID: ceph-cluster pool: kube imageFeatures: layering csi.storage.k8s.io/provisioner-secret-name: ceph-secret csi.storage.k8s.io/node-stage-secret-name: ceph-secret reclaimPolicy: Retain allowVolumeExpansion: true4. 安全加固措施4.1 认证与授权实施RBAC最小权限原则创建ServiceAccount示例apiVersion: v1 kind: ServiceAccount metadata: name: ci-deployer namespace: devops --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: namespace: devops name: deployer-role rules: - apiGroups: [apps] resources: [deployments] verbs: [get, list, watch, create, update, patch] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: deployer-binding namespace: devops subjects: - kind: ServiceAccount name: ci-deployer namespace: devops roleRef: kind: Role name: deployer-role apiGroup: rbac.authorization.k8s.io4.2 网络策略配置Calico NetworkPolicy示例apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: frontend-policy namespace: production spec: podSelector: matchLabels: role: frontend policyTypes: - Ingress ingress: - from: - podSelector: matchLabels: role: backend ports: - protocol: TCP port: 805. 监控与日志方案5.1 监控体系搭建推荐组件组合Prometheus指标收集Grafana可视化Alertmanager告警管理使用kube-prometheus-stack部署helm repo add prometheus-community https://prometheus-community.github.io/helm-charts helm install kube-prometheus-stack prometheus-community/kube-prometheus-stack \ --namespace monitoring \ --create-namespace \ --values values-prod.yaml关键监控指标节点资源使用率Pod重启次数API请求延迟etcd写入延迟5.2 日志收集方案EFK架构部署命令helm install elasticsearch elastic/elasticsearch \ --namespace logging \ --set replicas3 helm install fluent-bit fluent/fluent-bit \ --namespace logging \ --set backend.typees helm install kibana elastic/kibana \ --namespace logging日志收集策略建议应用日志使用stdout/stderr输出节点日志收集/var/log目录设置合理的日志保留周期建议7-30天6. 运维最佳实践6.1 升级策略采用蓝绿升级方案步骤部署新版本集群迁移部分流量测试验证监控指标正常全量切换流量保留旧集群48小时关键检查点kubectl get nodes -o wide kubectl get pods -A -o wide kubectl top nodes6.2 故障排查指南常见问题速查表现象可能原因排查命令Pod一直Pending资源不足kubectl describe pod服务无法访问NetworkPolicy限制kubectl get networkpolicy节点NotReadykubelet故障journalctl -u kubeletAPI超时etcd性能问题etcdctl endpoint status7. 扩展功能集成7.1 服务网格方案Istio生产部署建议istioctl install --set profiledefault \ --set values.global.proxy.resources.requests.cpu100m \ --set values.global.proxy.resources.requests.memory128Mi关键配置项启用自动sidecar注入设置合理的资源限制配置出口网关白名单7.2 CI/CD集成GitLab Runner配置示例apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-runner spec: template: spec: containers: - name: runner image: gitlab/gitlab-runner:alpine env: - name: CI_SERVER_URL value: https://gitlab.example.com - name: RUNNER_TOKEN valueFrom: secretKeyRef: name: gitlab-runner-secret key: token部署流程优化建议使用kaniko构建镜像实施分阶段滚动更新集成自动化测试设置部署审批流程生产环境Kubernetes集群的稳定运行需要持续优化和迭代。在实际运维中建议每周审查资源使用情况每月进行故障演练每季度评估架构改进方案。