Kubernetes与微服务的部署与管理：构建高可用的容器编排平台

老马啸西风2025/8/30大约 7 分钟

Kubernetes作为容器编排的事实标准，为微服务架构提供了强大的部署、扩展和管理能力。它不仅解决了容器化应用的部署和管理复杂性问题，还提供了服务发现、负载均衡、自动扩缩容、滚动更新等企业级功能。本文将深入探讨如何使用Kubernetes部署和管理微服务，以及相关的最佳实践。

Kubernetes核心概念

在深入探讨微服务部署之前，让我们先了解Kubernetes的核心概念：

Pod

Pod是Kubernetes中最小的部署单元，可以包含一个或多个容器。Pod中的容器共享网络和存储资源。

# Pod定义示例
apiVersion: v1
kind: Pod
metadata:
  name: user-service-pod
  labels:
    app: user-service
spec:
  containers:
  - name: user-service
    image: ecommerce/user-service:1.0.0
    ports:
    - containerPort: 8080
    env:
    - name: DB_HOST
      value: "mysql-db"
    - name: DB_PORT
      value: "3306"
    resources:
      requests:
        memory: "256Mi"
        cpu: "250m"
      limits:
        memory: "512Mi"
        cpu: "500m"

Service

Service为Pod提供稳定的网络访问入口，实现服务发现和负载均衡。

# Service定义示例
apiVersion: v1
kind: Service
metadata:
  name: user-service
  labels:
    app: user-service
spec:
  selector:
    app: user-service
  ports:
  - port: 80
    targetPort: 8080
  type: ClusterIP

Deployment

Deployment用于管理Pod的部署和更新，支持滚动更新和回滚。

# Deployment定义示例
apiVersion: apps/v1
kind: Deployment
metadata:
  name: user-service
  labels:
    app: user-service
spec:
  replicas: 3
  selector:
    matchLabels:
      app: user-service
  template:
    metadata:
      labels:
        app: user-service
    spec:
      containers:
      - name: user-service
        image: ecommerce/user-service:1.0.0
        ports:
        - containerPort: 8080
        env:
        - name: DB_HOST
          valueFrom:
            configMapKeyRef:
              name: db-config
              key: host
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: password
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"

微服务Kubernetes部署实践

1. 部署配置管理

使用ConfigMap和Secret管理微服务的配置信息。

# ConfigMap示例
apiVersion: v1
kind: ConfigMap
metadata:
  name: user-service-config
data:
  application.yml: |
    server:
      port: 8080
    spring:
      datasource:
        url: jdbc:mysql://${DB_HOST}:${DB_PORT}/${DB_NAME}
        username: ${DB_USERNAME}
      jpa:
        hibernate:
          ddl-auto: update
    logging:
      level:
        com.example.userservice: DEBUG
---
# Secret示例
apiVersion: v1
kind: Secret
metadata:
  name: user-service-secret
type: Opaque
data:
  db-password: cGFzc3dvcmQxMjM=  # base64编码的密码
  jwt-secret: bXlKd3RTZWNyZXQ=   # base64编码的JWT密钥

2. 服务发现与负载均衡

通过Service实现服务发现和负载均衡。

# 用户服务Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: user-service
spec:
  replicas: 3
  selector:
    matchLabels:
      app: user-service
  template:
    metadata:
      labels:
        app: user-service
    spec:
      containers:
      - name: user-service
        image: ecommerce/user-service:1.0.0
        ports:
        - containerPort: 8080
        readinessProbe:
          httpGet:
            path: /actuator/health/readiness
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
        livenessProbe:
          httpGet:
            path: /actuator/health/liveness
            port: 8080
          initialDelaySeconds: 60
          periodSeconds: 30
---
# 用户服务Service
apiVersion: v1
kind: Service
metadata:
  name: user-service
spec:
  selector:
    app: user-service
  ports:
  - port: 80
    targetPort: 8080
  type: ClusterIP

3. 自动扩缩容

使用HorizontalPodAutoscaler实现基于指标的自动扩缩容。

# HorizontalPodAutoscaler示例
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: user-service-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: user-service
  minReplicas: 2
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300
      policies:
      - type: Percent
        value: 10
        periodSeconds: 60
    scaleUp:
      stabilizationWindowSeconds: 0
      policies:
      - type: Percent
        value: 100
        periodSeconds: 15

4. 滚动更新策略

配置Deployment的滚动更新策略，确保服务的连续性。

# 滚动更新配置
apiVersion: apps/v1
kind: Deployment
metadata:
  name: user-service
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1        # 最大额外Pod数量
      maxUnavailable: 0  # 最大不可用Pod数量
  selector:
    matchLabels:
      app: user-service
  template:
    metadata:
      labels:
        app: user-service
    spec:
      containers:
      - name: user-service
        image: ecommerce/user-service:1.1.0  # 新版本镜像
        ports:
        - containerPort: 8080

微服务网络配置

1. Ingress控制器

使用Ingress控制器管理外部访问。

# Ingress示例
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ecommerce-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  rules:
  - host: ecommerce.example.com
    http:
      paths:
      - path: /users
        pathType: Prefix
        backend:
          service:
            name: user-service
            port:
              number: 80
      - path: /orders
        pathType: Prefix
        backend:
          service:
            name: order-service
            port:
              number: 80
      - path: /products
        pathType: Prefix
        backend:
          service:
            name: product-service
            port:
              number: 80

2. 网络策略

使用NetworkPolicy实现网络访问控制。

# NetworkPolicy示例
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: user-service-policy
spec:
  podSelector:
    matchLabels:
      app: user-service
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: api-gateway
    ports:
    - protocol: TCP
      port: 8080
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          name: database-namespace
    ports:
    - protocol: TCP
      port: 3306

微服务监控与日志

1. 健康检查

配置Readiness和Liveness探针。

# 健康检查配置
apiVersion: apps/v1
kind: Deployment
metadata:
  name: user-service
spec:
  template:
    spec:
      containers:
      - name: user-service
        image: ecommerce/user-service:1.0.0
        readinessProbe:
          httpGet:
            path: /actuator/health/readiness
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3
        livenessProbe:
          httpGet:
            path: /actuator/health/liveness
            port: 8080
          initialDelaySeconds: 60
          periodSeconds: 30
          timeoutSeconds: 5
          failureThreshold: 3

2. 资源监控

配置资源请求和限制。

# 资源配置
apiVersion: apps/v1
kind: Deployment
metadata:
  name: user-service
spec:
  template:
    spec:
      containers:
      - name: user-service
        image: ecommerce/user-service:1.0.0
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"

实际案例：电商平台Kubernetes部署

让我们以一个典型的电商平台为例，展示如何在Kubernetes中部署和管理多个微服务。

服务架构

用户服务：管理用户信息和认证
产品服务：管理产品目录和库存
订单服务：处理订单创建和管理
支付服务：处理支付事务
API网关：统一入口和路由

Kubernetes部署配置

命名空间

# 命名空间配置
apiVersion: v1
kind: Namespace
metadata:
  name: ecommerce

数据库部署

# MySQL数据库部署
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mysql-db
  namespace: ecommerce
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mysql-db
  template:
    metadata:
      labels:
        app: mysql-db
    spec:
      containers:
      - name: mysql
        image: mysql:8.0
        env:
        - name: MYSQL_ROOT_PASSWORD
          valueFrom:
            secretKeyRef:
              name: mysql-secret
              key: root-password
        ports:
        - containerPort: 3306
        volumeMounts:
        - name: mysql-storage
          mountPath: /var/lib/mysql
      volumes:
      - name: mysql-storage
        persistentVolumeClaim:
          claimName: mysql-pvc
---
# MySQL Service
apiVersion: v1
kind: Service
metadata:
  name: mysql-db
  namespace: ecommerce
spec:
  selector:
    app: mysql-db
  ports:
  - port: 3306
    targetPort: 3306
  type: ClusterIP
---
# MySQL PersistentVolumeClaim
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mysql-pvc
  namespace: ecommerce
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi

用户服务部署

# 用户服务Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: user-service
  namespace: ecommerce
spec:
  replicas: 3
  selector:
    matchLabels:
      app: user-service
  template:
    metadata:
      labels:
        app: user-service
    spec:
      containers:
      - name: user-service
        image: ecommerce/user-service:1.0.0
        ports:
        - containerPort: 8080
        env:
        - name: DB_HOST
          value: "mysql-db"
        - name: DB_PORT
          value: "3306"
        - name: DB_NAME
          value: "userdb"
        - name: DB_USERNAME
          value: "root"
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: mysql-secret
              key: root-password
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"
        readinessProbe:
          httpGet:
            path: /actuator/health/readiness
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
        livenessProbe:
          httpGet:
            path: /actuator/health/liveness
            port: 8080
          initialDelaySeconds: 60
          periodSeconds: 30
---
# 用户服务Service
apiVersion: v1
kind: Service
metadata:
  name: user-service
  namespace: ecommerce
spec:
  selector:
    app: user-service
  ports:
  - port: 80
    targetPort: 8080
  type: ClusterIP
---
# 用户服务HPA
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: user-service-hpa
  namespace: ecommerce
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: user-service
  minReplicas: 2
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70

API网关部署

# API网关Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-gateway
  namespace: ecommerce
spec:
  replicas: 2
  selector:
    matchLabels:
      app: api-gateway
  template:
    metadata:
      labels:
        app: api-gateway
    spec:
      containers:
      - name: api-gateway
        image: ecommerce/api-gateway:1.0.0
        ports:
        - containerPort: 8080
        env:
        - name: USER_SERVICE_URL
          value: "http://user-service"
        - name: PRODUCT_SERVICE_URL
          value: "http://product-service"
        - name: ORDER_SERVICE_URL
          value: "http://order-service"
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"
        readinessProbe:
          httpGet:
            path: /actuator/health/readiness
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
        livenessProbe:
          httpGet:
            path: /actuator/health/liveness
            port: 8080
          initialDelaySeconds: 60
          periodSeconds: 30
---
# API网关Service
apiVersion: v1
kind: Service
metadata:
  name: api-gateway
  namespace: ecommerce
spec:
  selector:
    app: api-gateway
  ports:
  - port: 80
    targetPort: 8080
  type: LoadBalancer
---
# Ingress配置
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ecommerce-ingress
  namespace: ecommerce
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  rules:
  - host: ecommerce.example.com
    http:
      paths:
      - path: /api/users
        pathType: Prefix
        backend:
          service:
            name: api-gateway
            port:
              number: 80
      - path: /api/products
        pathType: Prefix
        backend:
          service:
            name: api-gateway
            port:
              number: 80
      - path: /api/orders
        pathType: Prefix
        backend:
          service:
            name: api-gateway
            port:
              number: 80

Kubernetes最佳实践

1. 资源管理

合理配置资源请求和限制。

# 资源配置最佳实践
apiVersion: apps/v1
kind: Deployment
metadata:
  name: user-service
spec:
  template:
    spec:
      containers:
      - name: user-service
        image: ecommerce/user-service:1.0.0
        resources:
          requests:
            memory: "256Mi"  # 初始内存请求
            cpu: "250m"      # 初始CPU请求
          limits:
            memory: "512Mi"  # 最大内存限制
            cpu: "500m"      # 最大CPU限制

2. 健康检查

配置适当的健康检查探针。

# 健康检查最佳实践
readinessProbe:
  httpGet:
    path: /actuator/health/readiness
    port: 8080
  initialDelaySeconds: 30  # 初始延迟
  periodSeconds: 10        # 检查周期
  timeoutSeconds: 5        # 超时时间
  failureThreshold: 3      # 失败阈值
livenessProbe:
  httpGet:
    path: /actuator/health/liveness
    port: 8080
  initialDelaySeconds: 60  # 初始延迟
  periodSeconds: 30        # 检查周期
  timeoutSeconds: 5        # 超时时间
  failureThreshold: 3      # 失败阈值

3. 安全配置

使用安全上下文和网络策略。

# 安全配置
apiVersion: apps/v1
kind: Deployment
metadata:
  name: user-service
spec:
  template:
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1001
        fsGroup: 2000
      containers:
      - name: user-service
        image: ecommerce/user-service:1.0.0
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true

Kubernetes为微服务架构提供了强大的容器编排和管理能力。通过合理配置Deployment、Service、ConfigMap、Secret等资源对象，我们可以实现微服务的自动化部署、扩展和管理。结合Ingress控制器、网络策略、自动扩缩容等高级功能，Kubernetes能够构建出高可用、可扩展的微服务系统。在实际项目中，遵循Kubernetes最佳实践，合理配置资源管理、健康检查和安全策略，能够充分发挥Kubernetes在微服务架构中的优势。