如何通过kube-vip实现K8S集群高可用及Service LB

AAAAA运维

451人浏览 · 2025-11-17 10:10:10

AAAAA运维 · 2025-11-17 10:10:10 发布

如何通过kube-vip实现K8S集群高可用及Service LB

kube-vip 简介：

kube-vip 是一个云原生的开源项目，运行在群集之内，旨在简化为 Kubernetes 集群提供高可用及负载均衡服务。

kube-vip 为 Kubernetes 集群提供虚拟 IP实现高可用和负载均衡器，用于控制平面（用于构建高可用集群）和 Kubernetes 服务类型，而无需依赖LoadBalancer任何外部硬件或软件。

与传统高可用+负载均衡机制相比较（如nginx/haproxy+keepalived），它属于云原生的高可用以及负载均衡机制，运行在群集之内，配置也更简单

k8s集群节点准备

软件列表及软件版本：

CentOS7U9, docker-ce,cri-dockerd,k8s集群1.28.2

1.1 配置主机名

# hostnamectl set-hostname xxx
修改xxx为当前主机分配的主机名

[root@xxx ~]# cat > /etc/hosts <<EOF
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.8.10 master01
192.168.8.20 master02
192.168.8.30 master03
192.168.8.40 worker01
192.168.8.50 worker02
192.168.8.200 lb.kubetest.com
EOF

1.4 主机安全设置

# systemctl disable --now firewalld

# sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config
# setenforce 0

1.5 更新yum源为阿里云源（已配置，可跳过）

rm -rf /etc/yum.repos.d/*

wget -O /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-7.repo

wget -O /etc/yum.repos.d/epel.repo https://mirrors.aliyun.com/repo/epel-7.repo

yum clean all && yum makecache

1.6 时钟同步

# ntpdate time1.aliyun.com

# crontab -e
0 */1 * * * /usr/sbin/ntpdate time1.aliyun.com

1.7 配置内核路由转发及网桥过滤

所有主机均需要操作。

添加网桥过滤及内核转发配置文件
# cat > /etc/sysctl.d/k8s.conf << EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
vm.swappiness = 0
EOF

加载br_netfilter模块
# modprobe br_netfilter

查看是否加载
# lsmod | grep br_netfilter
br_netfilter 22256 0
bridge 151336 1 br_netfilter

# sysctl --system

1.8 安装ipset及ipvsadm

所有主机均需要操作。

安装ipset及ipvsadm
# yum -y install ipset ipvsadm

配置ipvsadm模块加载方式
添加需要加载的模块
# cat > /etc/sysconfig/modules/ipvs.modules <<EOF
#!/bin/bash
modprobe -- ip_vs
modprobe -- ip_vs_rr
modprobe -- ip_vs_wrr
modprobe -- ip_vs_sh
modprobe -- nf_conntrack
EOF

授权、运行、检查是否加载
# chmod 755 /etc/sysconfig/modules/ipvs.modules && bash /etc/sysconfig/modules/ipvs.modules && lsmod | grep -e ip_vs -e nf_conntrack

1.9 关闭SWAP分区

# swapoff -a

# vim /etc/fstab
......
# /dev/mapper/centos-swap swap swap defaults 0 0

在上一行中行首添加#

1.10 配置ssh免密登录

在master01节点生成证书，并创建authorized_keys文件
[root@master01 ~]# ssh-keygen

[root@master01 ~]# cd /root/.ssh
[root@master01 .ssh]# ls
id_rsa id_rsa.pub

[root@master01 .ssh]# cp id_rsa.pub authorized_keys
[root@master01 .ssh]# ls
authorized_keys id_rsa id_rsa.pub

[root@master01 ~]# for i in 20 30 40 50
do
scp -r /root/.ssh 192.168.8.$i:/root/
done

ssh master01 hostname;ssh master02 hostname;ssh master03 hostname;ssh worker01 hostname;ssh worker02 hostname

需要在每台主机上验证是否可以相互免密登录。

etcd集群部署

本次在master01、master02、master03上进行etcd集群部署(此次使用k8s集群外部署)

2.1 在k8s集群三个master节点上安装etcd

# wget https://github.com/coreos/etcd/releases/download/v3.5.0/etcd-v3.5.0-linux-amd64.tar.gz
# tar xzvf etcd-v3.5.0-linux-amd64.tar.gz
# cd etcd-v3.5.0-linux-amd64/
# mv etcd* /usr/local/bin

2.2 生成etcd配置相关文件

master01:

# tee /usr/lib/systemd/system/etcd.service <<-'EOF'
[Unit]
Description=Etcd Server
After=network.target

[Service]
Type=notify
ExecStart=/usr/local/bin/etcd \
--name=master01 \
--data-dir=/var/lib/etcd/default.etcd \
--listen-peer-urls=http://192.168.8.10:2380 \
--listen-client-urls=http://192.168.8.10:2379,http://127.0.0.1:2379 \
--advertise-client-urls=http://192.168.8.10:2379 \
--initial-advertise-peer-urls=http://192.168.8.10:2380 \
--initial-cluster=master01=http://192.168.8.10:2380,master02=http://192.168.8.20:2380,master03=http://192.168.8.30:2380 \
--initial-cluster-token=smartgo \
--initial-cluster-state=new
Restart=on-failure
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target
EOF

master02:

# tee /usr/lib/systemd/system/etcd.service <<-'EOF'
[Unit]
Description=Etcd Server
After=network.target

[Service]
Type=notify
ExecStart=/usr/local/bin/etcd \
--name=master02 \
--data-dir=/var/lib/etcd/default.etcd \
--listen-peer-urls=http://192.168.8.20:2380 \
--listen-client-urls=http://192.168.8.20:2379,http://127.0.0.1:2379 \
--advertise-client-urls=http://192.168.8.20:2379 \
--initial-advertise-peer-urls=http://192.168.8.20:2380 \
--initial-cluster=master01=http://192.168.8.10:2380,master02=http://192.168.8.20:2380,master03=http://192.168.8.30:2380 \
--initial-cluster-token=smartgo \
--initial-cluster-state=new
Restart=on-failure
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target
EOF

master03:

# tee /usr/lib/systemd/system/etcd.service <<-'EOF'
[Unit]
Description=Etcd Server
After=network.target

[Service]
Type=notify
ExecStart=/usr/local/bin/etcd \
--name=master03 \
--data-dir=/var/lib/etcd/default.etcd \
--listen-peer-urls=http://192.168.8.30:2380 \
--listen-client-urls=http://192.168.8.30:2379,http://127.0.0.1:2379 \
--advertise-client-urls=http://192.168.8.30:2379 \
--initial-advertise-peer-urls=http://192.168.8.30:2380 \
--initial-cluster=master01=http://192.168.8.10:2380,master02=http://192.168.8.20:2380,master03=http://192.168.8.30:2380 \
--initial-cluster-token=smartgo \
--initial-cluster-state=new
Restart=on-failure
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target
EOF

2.3 在k8s集群三个master节点上启动etcd

# systemctl enable --now etcd （尽量同时执行，启动间隔时间不要太长）

2.4 检查etcd集群是否正常

[root@master01 ~]# etcdctl member list

428717c28444017d, started, master03, http://192.168.8.30:2380, http://192.168.8.30:2379, false

7d9ea6eb1730b10e, started, master01, http://192.168.8.10:2380, http://192.168.8.10:2379, false

cf58a978e23eea6e, started, master02, http://192.168.8.20:2380, http://192.168.8.20:2379, false

[root@master01 ~]# etcdctl endpoint health

----------------------------------------------------

如正常请跳过此步骤

注：如果有节点未加入群集，可修改如下参数，重新启动(以master03为例)，

# rm -rf /usr/lib/systemd/system/etcd.service

# tee /usr/lib/systemd/system/etcd.service <<-'EOF'
[Unit]
Description=Etcd Server
After=network.target

[Service]
Type=notify
ExecStart=/usr/local/bin/etcd \
--name=master03 \
--data-dir=/var/lib/etcd/default.etcd \
--listen-peer-urls=http://192.168.8.30:2380 \
--listen-client-urls=http://192.168.8.30:2379,http://127.0.0.1:2379 \
--advertise-client-urls=http://192.168.8.30:2379 \
--initial-advertise-peer-urls=http://192.168.8.30:2380 \
--initial-cluster=master01=http://192.168.8.10:2380,master02=http://192.168.8.20:2380,master03=http://192.168.8.30:2380 \
--initial-cluster-token=smartgo \
--initial-cluster-state=existing
Restart=on-failure
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target
EOF

# systemctl enable --now etcd

---------------------------------------------------------

容器运行时 Docker准备

3.1 docker安装（所有节点）

3.1.1 Docker安装YUM源准备

使用阿里云开源软件镜像站。

# wget https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo -O /etc/yum.repos.d/docker-ce.repo

3.1.2 Docker安装

# yum -y install docker-ce

3.1.3 启动Docker服务

# systemctl enable --now docker

3.1.4 修改cgroup方式

/etc/docker/daemon.json 默认没有此文件，需要单独创建

在/etc/docker/daemon.json添加如下内容

# cat > /etc/docker/daemon.json << EOF
{
"exec-opts": ["native.cgroupdriver=systemd"]
}
EOF

# systemctl restart docker

3.2 cri-dockerd安装

# wget https://github.com/Mirantis/cri-dockerd/releases/download/v0.3.8/cri-dockerd-0.3.8-3.el7.x86_64.rpm

# yum -y install cri-dockerd-0.3.8-3.el7.x86_64.rpm

# vim /usr/lib/systemd/system/cri-docker.service

修改第10行内容
ExecStart=/usr/bin/cri-dockerd --pod-infra-container-image=registry.k8s.io/pause:3.9 --container-runtime-endpoint fd://

# systemctl start cri-docker
# systemctl enable cri-docker

K8S集群软件准备

4.1 K8S软件YUM源准备

# cat > /etc/yum.repos.d/k8s.repo <<EOF
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF

4.2 K8S软件安装

4.2.1 软件安装

所有节点均可安装

查看指定版本
# yum list kubeadm.x86_64 --showduplicates | sort -r
# yum list kubelet.x86_64 --showduplicates | sort -r
# yum list kubectl.x86_64 --showduplicates | sort -r

安装指定版本
# yum -y install kubeadm-1.28.2-0 kubelet-1.28.2-0 kubectl-1.28.2-0

4.2.2 kubelet配置

为了实现docker使用的cgroupdriver与kubelet使用的cgroup的一致性，建议修改如下文件内容。

# vim /etc/sysconfig/kubelet
KUBELET_EXTRA_ARGS="--cgroup-driver=systemd"

设置kubelet为开机自启动即可，由于没有生成配置文件，集群初始化后自动启动
# systemctl enable kubelet

kube-vip准备(三个master节点上)

export VIP=192.168.8.200
export INTERFACE=ens33
export KVVERSION=v0.6.4

docker run -it --rm --net=host ghcr.io/kube-vip/kube-vip:$KVVERSION manifest pod \
--interface $INTERFACE \
--address $VIP \
--controlplane \
--services \
--arp \
--enableLoadBalancer \
--leaderElection | tee /etc/kubernetes/manifests/kube-vip.yaml

# 查看是否生成kube-vip.yaml文件

[root@master01 ~]# cat /etc/kubernetes/manifests/kube-vip.yaml
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
name: kube-vip
namespace: kube-system
spec:
containers:
- args:
    - manager
    env:
    - name: vip_arp
      value: "true"
    - name: port
      value: "6443"
    - name: vip_interface
      value: ens33
    - name: vip_cidr
      value: "32"
    - name: cp_enable
      value: "true"
    - name: cp_namespace
      value: kube-system
    - name: vip_ddns
      value: "false"
    - name: svc_enable
      value: "true"
    - name: svc_leasename
      value: plndr-svcs-lock
    - name: vip_leaderelection
      value: "true"
    - name: vip_leasename
      value: plndr-cp-lock
    - name: vip_leaseduration
      value: "5"
    - name: vip_renewdeadline
      value: "3"
    - name: vip_retryperiod
      value: "1"
    - name: lb_enable
      value: "true"
    - name: lb_port
      value: "6443"
    - name: lb_fwdmethod
      value: local
    - name: address
      value: 192.168.8.200
    - name: prometheus_server
      value: :2112
    image: ghcr.io/kube-vip/kube-vip:v0.6.4
    imagePullPolicy: Always
    name: kube-vip
    resources: {}
    securityContext:
      capabilities:
        add:
        - NET_ADMIN
        - NET_RAW
    volumeMounts:
    - mountPath: /etc/kubernetes/admin.conf
      name: kubeconfig
hostAliases:
- hostnames:
    - kubernetes
    ip: 127.0.0.1
hostNetwork: true
volumes:
- hostPath:
      path: /etc/kubernetes/admin.conf
    name: kubeconfig
status: {}

K8S集群初始化

6.1 k8s集群容器镜像准备（所有节点）

查看v1.28.2版本相关镜像

# kubeadm config images list --kubernetes-version=v1.28.2

可以提前下载镜像，导入本地镜像库：

# docker load -i k8s-1.28.2.tar

~~如果没有提前下载，可以采用下面方法在一台主机上下载后，导出文件，然后复制到其他主机使用~~

~~# kubeadm config images pull --kubernetes-version=v1.28.2 --cri-socket=unix:///var/run/cri-dockerd.sock~~

# docker save -o k8s-1.28.2.tar registry.k8s.io/kube-apiserver:v1.28.2 registry.k8s.io/kube-controller-manager:v1.28.2 registry.k8s.io/kube-scheduler:v1.28.2 registry.k8s.io/kube-proxy:v1.28.2 registry.k8s.io/pause:3.9 registry.k8s.io/etcd:3.5.9-0 registry.k8s.io/coredns/coredns:v1.10.1

6.2 K8S集群初始化配置文件准备

6.2.1 查看不同 kind默认配置

kubeadm config print init-defaults --component-configs KubeletConfiguration
kubeadm config print init-defaults --component-configs InitConfiguration
kubeadm config print init-defaults --component-configs ClusterConfiguration

6.2.2 生成配置文件样例 kubeadm-config.yaml

[root@master01 ~]# kubeadm config print init-defaults --component-configs KubeProxyConfiguration > kubeadm-config.yaml

修改 kubeadm-config.yaml,内容参考下面的配置，也可以直接复制生成新的kubeadm-config.yaml

[root@master01 ~]# cat > kubeadm-config.yaml << EOF
---
apiVersion: kubeadm.k8s.io/v1beta3
bootstrapTokens:
- groups:
- system:bootstrappers:kubeadm:default-node-token
token: abcdef.0123456789abcdef
ttl: 24h0m0s
usages:
- signing
- authentication
kind: InitConfiguration
localAPIEndpoint:
advertiseAddress: 192.168.8.10
bindPort: 6443
nodeRegistration:
criSocket: unix:///var/run/cri-dockerd.sock
imagePullPolicy: IfNotPresent
name: master01
taints: null
---
apiServer:
timeoutForControlPlane: 4m0s
certSANs:
- lb.kubetest.com
- master01
- master02
- master03
- worker01
- worker02
- 192.168.8.10
- 192.168.8.20
- 192.168.8.30
- 192.168.8.40
- 192.168.8.50
controlPlaneEndpoint: lb.kubetest.com:6443
apiVersion: kubeadm.k8s.io/v1beta3
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controllerManager: {}
dns: {}
etcd:
external:
    endpoints:
      - http://192.168.8.10:2379
      - http://192.168.8.20:2379
      - http://192.168.8.30:2379
imageRepository: registry.k8s.io
kind: ClusterConfiguration
kubernetesVersion: 1.28.2
networking:
dnsDomain: cluster.local
serviceSubnet: 10.96.0.0/12
podSubnet: 10.244.0.0/16
scheduler: {}
---
apiVersion: kubeproxy.config.k8s.io/v1alpha1
bindAddress: 0.0.0.0
bindAddressHardFail: false
clientConnection:
acceptContentTypes: ""
burst: 0
contentType: ""
kubeconfig: /var/lib/kube-proxy/kubeconfig.conf
qps: 0
clusterCIDR: ""
configSyncPeriod: 0s
conntrack:
maxPerCore: null
min: null
tcpCloseWaitTimeout: null
tcpEstablishedTimeout: null
detectLocal:
bridgeInterface: ""
interfaceNamePrefix: ""
detectLocalMode: ""
enableProfiling: false
healthzBindAddress: ""
hostnameOverride: ""
iptables:
localhostNodePorts: null
masqueradeAll: false
masqueradeBit: null
minSyncPeriod: 0s
syncPeriod: 0s
ipvs:
excludeCIDRs: null
minSyncPeriod: 0s
scheduler: ""
strictARP: true
syncPeriod: 0s
tcpFinTimeout: 0s
tcpTimeout: 0s
udpTimeout: 0s
kind: KubeProxyConfiguration
logging:
flushFrequency: 0
options:
    json:
      infoBufferSize: "0"
verbosity: 0
metricsBindAddress: ""
mode: "ipvs"
nodePortAddresses: null
oomScoreAdj: null
portRange: ""
showHiddenMetricsForVersion: ""
winkernel:
enableDSR: false
forwardHealthCheckVip: false
networkName: ""
rootHnsEndpointName: ""
sourceVip: ""
EOF

6.3 使用初始化配置文件初始化集群第一个master节点

# kubeadm init --config kubeadm-config.yaml --upload-certs --v=9

--upload-certs：上传证书

--v=9：显示详细的信息

输出以下内容，说明初始化成功。

Your Kubernetes control-plane has initialized successfully!

To start using your cluster, you need to run the following as a regular user:

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

Alternatively, if you are the root user, you can run:

export KUBECONFIG=/etc/kubernetes/admin.conf

You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
https://kubernetes.io/docs/concepts/cluster-administration/addons/

You can now join any number of the control-plane node running the following command on each as root:

kubeadm join lb.kubetest.com:6443 --token abcdef.0123456789abcdef \
        --discovery-token-ca-cert-hash sha256:d2e611304c8f0277c9228378d5d2d1776970f638e90d9482444946a0b2ad3343 \
        --control-plane --certificate-key 7bcb6b9e1571631f2349de1972519120830882b27debaa5de62bbd460bccba37

Please note that the certificate-key gives access to cluster sensitive data, keep it secret!
As a safeguard, uploaded-certs will be deleted in two hours; If necessary, you can use
"kubeadm init phase upload-certs --upload-certs" to reload certs afterward.

Then you can join any number of worker nodes by running the following on each as root:

kubeadm join lb.kubetest.com:6443 --token abcdef.0123456789abcdef \
        --discovery-token-ca-cert-hash sha256:d2e611304c8f0277c9228378d5d2d1776970f638e90d9482444946a0b2ad3343

6.4 准备kubectl配置文件(master01上)

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

6.5 加入其它K8S集群master节点

kubeadm join lb.kubetest.com:6443 --token abcdef.0123456789abcdef \
        --discovery-token-ca-cert-hash sha256:d2e611304c8f0277c9228378d5d2d1776970f638e90d9482444946a0b2ad3343 \
        --control-plane --certificate-key 7bcb6b9e1571631f2349de1972519120830882b27debaa5de62bbd460bccba37 \
        --cri-socket unix:///var/run/cri-dockerd.sock

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

6.6 加入worker节点

[root@master01 ~]# kubectl get nodes
NAME           STATUS     ROLES           AGE    VERSION
master01   NotReady   control-plane   26m    v1.28.2
master02   NotReady   control-plane   5m6s   v1.28.2
master03   NotReady   control-plane   3m2s   v1.28.2
worker01   NotReady   <none>          68s    v1.28.2
worker02   NotReady   <none>          71s    v1.28.2

6.7 网络插件calico部署及验证

应用operator资源清单文件
[root@master01 ~]# kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.25.1/manifests/tigera-operator.yaml

通过自定义资源方式安装
[root@master01 ~]# wget https://raw.githubusercontent.com/projectcalico/calico/v3.25.1/manifests/custom-resources.yaml

修改文件第13行，修改为使用kubeadm init ----pod-network-cidr对应的IP地址段

[root@master01 ~]# vim custom-resources.yaml
......
11     ipPools:
12     - blockSize: 26
13       cidr: 10.244.0.0/16
14       encapsulation: VXLANCrossSubnet
......

可以提前下载相关镜像，导入所有节点镜像库

应用资源清单文件(如果没有提前导入镜像，下载等待running时间较长)

[root@master01 ~]# kubectl create -f custom-resources.yaml

监视calico-sysem命名空间中pod运行情况
[root@master01 ~]# kubectl get pods -n calico-system

NAME READY STATUS RESTARTS AGE

calico-kube-controllers-85955d4f5b-29rtm 1/1 Running 0 55s

calico-node-2756b 1/1 Running 0 56s

calico-node-5wmkm 1/1 Running 0 56s

calico-node-mtmpd 1/1 Running 0 56s

calico-node-rtcns 1/1 Running 0 56s

calico-node-svn4g 1/1 Running 0 56s

calico-typha-865b9f866d-8mzvt 1/1 Running 0 55s

calico-typha-865b9f866d-wlbvz 1/1 Running 0 56s

calico-typha-865b9f866d-z9q89 1/1 Running 0 55s

csi-node-driver-7r8zg 2/2 Running 0 55s

csi-node-driver-fj88w 2/2 Running 0 55s

csi-node-driver-mxkbs 2/2 Running 0 55s

csi-node-driver-vjq8x 2/2 Running 0 55s

csi-node-driver-wlssf 2/2 Running 0 55s

[root@master01 ~]# kubectl get nodes
NAME           STATUS   ROLES           AGE   VERSION
master01   Ready    control-plane   54m   v1.28.2
master02   Ready    control-plane   49m   v1.28.2
master03   Ready    control-plane   48m   v1.28.2
worker01   Ready    <none>          29m   v1.28.2
worker02   Ready    <none>          29m   v1.28.2

此时可验证，群集master中的leader故障时（如关机），集群地址vip漂移到其他master节点，群集仍可用

使用kube-vip实现Service LB

7.1 指定LB注解或使用loadBalancerIP

当 kube-vip 启动后，将在所有匹配类型为 loadBalancer 的服务上启用一个名为 watcher 的监听器。

只有在填充了 metadata.annotations["kube-vip.io/loadbalancerIPs"] 或 spec.loadBalancerIP 的情况下，watcher 才会发布一个 Kubernetes service。

[root@master01 ~]# mkdir kubevip

[root@master01 ~]# cd kubevip

[root@master01 kubevip]# cat > nginx.yaml <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-deployment
labels:
    app: nginx
spec:
replicas: 1
selector:
    matchLabels:
      app: nginx
template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:latest
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
name: nginx
spec:
type: LoadBalancer
loadBalancerIP: 192.168.8.210
selector:
    app: nginx
ports:
    - port: 80
      targetPort: 80
EOF

[root@master01 kubevip]# kubectl apply -f nginx.yaml
deployment.apps/nginx-deployment created
service/nginx created

[root@master01 kubevip]# kubectl get pods
NAME READY STATUS RESTARTS AGE
nginx-deployment-7c79c4bf97-hmnff 1/1 Running 0 51s

[root@master01 kubevip]# kubectl get svc
NAME         TYPE           CLUSTER-IP      EXTERNAL-IP      PORT(S)        AGE
kubernetes   ClusterIP      10.96.0.1       <none>           443/TCP        120m
nginx        LoadBalancer   10.110.91.135   192.168.8.210   80:31037/TCP   20s

[root@master01 kubevip]# curl http://192.168.8.210

可以显示默认网页内容

[root@master01 kubevip]# kubectl delete -f nginx.yaml

[root@master01 kubevip]# cat > nginx.yaml<<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-deployment
labels:
    app: nginx
spec:
replicas: 1
selector:
    matchLabels:
      app: nginx
template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:latest
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
name: nginx
annotations:
    kube-vip.io/loadbalancerIPs: "192.168.8.211"
spec:
type: LoadBalancer
selector:
    app: nginx
ports:
    - port: 80
      targetPort: 80
EOF

[root@master01 kubevip]# kubectl apply -f nginx.yaml
deployment.apps/nginx-deployment created
service/nginx created

[root@master01 kubevip]# kubectl get svc
NAME         TYPE           CLUSTER-IP      EXTERNAL-IP      PORT(S)        AGE
kubernetes   ClusterIP      10.96.0.1       <none>           443/TCP        148m
nginx        LoadBalancer   10.110.15.123   192.168.8.211   80:30756/TCP   4s

[root@master01 kubevip]# curl http://192.168.8.211

可以显示默认网页内容

码道开发者社区

码道开发者社区，聚焦华为云码道 CodeArts 代码智能体，沉淀 Agent、Skill、鸿蒙开发实战内容，供开发者查阅资料、交流技术、分享工程实践

更多推荐

AI 已经能直接改设计稿了:Windows部署Penpot，接入Codex MCP实测

码道开发者社区

【AI 业务流架构师】AI 业务流架构师方法论：Agentic AI 范式转移与业务编排思维

2026 年，Anthropic CEO Dario Amodei 在 Code with Claude 大会上的一个判断广为流传：一个人运营一家十亿美元级公司的概率是 70%–80%。这句话听起来像科幻小说的设定，但它背后是一个正在发生的结构性变化——AI 把"执行"的成本压到了历史低点，同时把"编排"的价值推到了前台。这意味着我们需要一套新的思考框架，来回答两个问题：一个人如何拥有一个公司的产