Kubernetes集群的高可用性设计与实践

键盘鼓手苏苏

1004人浏览 · 2026-04-16 11:14:14

键盘鼓手苏苏 · 2026-04-16 11:14:14 发布

Kubernetes集群的高可用性设计与实践

🔥 硬核开场

各位技术老铁，今天咱们聊聊Kubernetes集群的高可用性设计与实践。别跟我扯那些理论，直接上干货！在生产环境中，Kubernetes集群的高可用性至关重要，它直接关系到应用的稳定性和业务的连续性。不了解Kubernetes集群的高可用设计？那你的生产环境可能随时面临服务中断的风险。

📋 核心概念

高可用性的定义

高可用性（High Availability，HA）是指系统在规定的时间内能够正常运行的概率。对于Kubernetes集群来说，高可用性意味着控制平面和工作节点能够在各种故障场景下保持正常运行，确保应用的持续可用性。

Kubernetes集群的高可用组件

etcd集群：分布式键值存储，保存集群的状态信息
API Server：集群的控制中心，处理所有API请求
Controller Manager：管理各种控制器，确保集群状态与期望状态一致
Scheduler：负责Pod的调度
kubelet：运行在每个节点上，管理容器的生命周期
kube-proxy：负责网络代理，实现服务的负载均衡

🚀 实践指南

1. 控制平面高可用

多Master节点部署

# 部署第一个Master节点
ekubeadm init --control-plane-endpoint "load-balancer.example.com:6443" --upload-certs

# 加入其他Master节点
kubeadm join load-balancer.example.com:6443 --token <token> --discovery-token-ca-cert-hash sha256:<hash> --control-plane --certificate-key <certificate-key>

负载均衡配置

# Nginx负载均衡配置
upstream kubernetes {
    server master1:6443;
    server master2:6443;
    server master3:6443;
    least_conn;
}

server {
    listen 6443;
    server_name load-balancer.example.com;
    
    location / {
        proxy_pass https://kubernetes;
        proxy_ssl_certificate /etc/nginx/ssl/nginx.crt;
        proxy_ssl_certificate_key /etc/nginx/ssl/nginx.key;
        proxy_ssl_verify off;
    }
}

2. etcd集群高可用

etcd集群部署

# 部署etcd集群
etcdctl member add etcd2 --peer-urls=https://etcd2:2380
# 配置etcd集群
cat > /etc/etcd/etcd.conf << EOF
ETCD_NAME="etcd1"
ETCD_DATA_DIR="/var/lib/etcd"
ETCD_LISTEN_CLIENT_URLS="https://0.0.0.0:2379"
ETCD_LISTEN_PEER_URLS="https://0.0.0.0:2380"
ETCD_ADVERTISE_CLIENT_URLS="https://etcd1:2379"
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://etcd1:2380"
ETCD_INITIAL_CLUSTER="etcd1=https://etcd1:2380,etcd2=https://etcd2:2380,etcd3=https://etcd3:2380"
ETCD_INITIAL_CLUSTER_STATE="new"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster-1"
ETCD_CERT_FILE="/etc/etcd/ssl/etcd.pem"
ETCD_KEY_FILE="/etc/etcd/ssl/etcd-key.pem"
ETCD_TRUSTED_CA_FILE="/etc/etcd/ssl/ca.pem"
ETCD_PEER_CERT_FILE="/etc/etcd/ssl/etcd.pem"
ETCD_PEER_KEY_FILE="/etc/etcd/ssl/etcd-key.pem"
ETCD_PEER_TRUSTED_CA_FILE="/etc/etcd/ssl/ca.pem"
EOF

3. 工作节点高可用

节点自动修复

apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: app-pdb
  namespace: default
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app: my-app

节点健康检查

apiVersion: v1
kind: ConfigMap
metadata:
  name: kubelet-config
  namespace: kube-system
data:
  kubelet-config.yaml: |
    healthzBindAddress: 0.0.0.0
    healthzPort: 10248
    nodeStatusUpdateFrequency: 10s
    evictionHard:
      memory.available: "100Mi"
      nodefs.available: "10%"
      nodefs.inodesFree: "5%"
      imagefs.available: "15%"

4. 网络高可用

Calico网络配置

apiVersion: operator.tigera.io/v1
kind: Installation
metadata:
  name: default
spec:
  calicoNetwork:
    ipPools:
    - blockSize: 24
      cidr: 192.168.0.0/16
      encapsulation: VXLANCrossSubnet
      natOutgoing: true
      nodeSelector: all()
  componentResources:
    cni:
      deployments:
        - name: calico-cni
          replicas: 1

Cilium网络配置

apiVersion: cilium.io/v1alpha1
kind: CiliumNetworkPolicy
metadata:
  name: allow-ingress
  namespace: default
spec:
  endpointSelector:
    matchLabels:
      app: my-app
  ingress:
  - fromEndpoints:
    - matchLabels:
        app: frontend
    toPorts:
    - ports:
      - port: "80"
        protocol: TCP

5. 存储高可用

分布式存储配置

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: csi-rbd-sc
provisioner: rbd.csi.ceph.com
parameters:
  clusterID: <cluster-id>
  pool: kubernetes
  imageFormat: "2"
  imageFeatures: layering
  csi.storage.k8s.io/provisioner-secret-name: csi-rbd-secret
  csi.storage.k8s.io/provisioner-secret-namespace: kube-system
  csi.storage.k8s.io/controller-expand-secret-name: csi-rbd-secret
  csi.storage.k8s.io/controller-expand-secret-namespace: kube-system
  csi.storage.k8s.io/node-stage-secret-name: csi-rbd-secret
  csi.storage.k8s.io/node-stage-secret-namespace: kube-system
  csi.storage.k8s.io/fstype: ext4
reclaimPolicy: Delete
allowVolumeExpansion: true
volumeBindingMode: Immediate

6. 监控与告警

Prometheus配置

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: kube-controller-manager
  namespace: monitoring
spec:
  selector:
    matchLabels:
      k8s-app: kube-controller-manager
  endpoints:
  - port: https-metrics
    interval: 15s
    scheme: https
    tlsConfig:
      insecureSkipVerify: true

Grafana仪表板

apiVersion: v1
kind: ConfigMap
metadata:
  name: grafana-dashboards
  namespace: monitoring
data:
  kubernetes-cluster.json: |
    {
      "annotations": {
        "list": []
      },
      "editable": true,
      "gnetId": 10000,
      "graphTooltip": 0,
      "id": null,
      "links": [],
      "panels": [],
      "schemaVersion": 26,
      "style": "dark",
      "tags": [],
      "templating": {
        "list": []
      },
      "time": {
        "from": "now-1h",
        "to": "now"
      },
      "timepicker": {},
      "timezone": "",
      "title": "Kubernetes Cluster",
      "uid": "kubernetes-cluster",
      "version": 1
    }