健康检查与资源管理

容器启动 ──▶ startupProbe 反复探测 ──成功──▶ livenessProbe + readinessProbe 周期运行
                 │                                   │                 │
            超过 failureThreshold               失败 → 重启容器     失败 → 摘除流量
                 ▼                                                    成功 → 恢复流量
             重启容器

apiVersion: apps/v1
kind: Deployment
metadata:
  name: probe-demo
spec:
  replicas: 2
  selector:
    matchLabels:
      app: probe-demo
  template:
    metadata:
      labels:
        app: probe-demo
    spec:
      containers:
        - name: web
          image: nginx:1.27
          ports:
            - name: http
              containerPort: 80
          startupProbe:            # 最多给 30 × 2 = 60 秒启动时间
            httpGet:
              path: /
              port: http
            periodSeconds: 2
            failureThreshold: 30
          readinessProbe:          # 就绪才接流量
            httpGet:
              path: /
              port: http
            periodSeconds: 5
          livenessProbe:           # 只检查进程自身是否卡死
            tcpSocket:
              port: http
            periodSeconds: 10
            failureThreshold: 3

kubectl apply -f probe-demo.yaml
kubectl get pods -l app=probe-demo -w

resources:
  requests:        # 调度依据：节点上"已承诺"的资源
    cpu: 250m      # 0.25 核，1000m = 1 核
    memory: 128Mi
  limits:          # 运行时上限：由 cgroup 强制执行
    cpu: "1"
    memory: 256Mi

kubectl describe node k8s-journey-worker | grep -A8 "Allocated resources"

apiVersion: v1
kind: Pod
metadata:
  name: cpu-throttle
spec:
  containers:
    - name: burn
      image: busybox:1.36
      command: ["sh", "-c", "while true; do :; done"]   # 死循环吃满一个核
      resources:
        requests:
          cpu: 100m
        limits:
          cpu: 200m

kubectl apply -f cpu-throttle.yaml
sleep 20
kubectl exec cpu-throttle -- cat /sys/fs/cgroup/cpu.max    # 20000 100000：每 100ms 周期只能用 20ms
kubectl exec cpu-throttle -- cat /sys/fs/cgroup/cpu.stat   # nr_throttled、throttled_usec 持续增长

apiVersion: v1
kind: Pod
metadata:
  name: oom-demo
spec:
  containers:
    - name: stress
      image: polinux/stress
      command: ["stress"]
      args: ["--vm", "1", "--vm-bytes", "250M", "--vm-hang", "1"]  # 尝试分配 250M
      resources:
        requests:
          memory: 50Mi
        limits:
          memory: 100Mi

$ kubectl apply -f oom-demo.yaml
$ kubectl get pod oom-demo -w
NAME       READY   STATUS             RESTARTS      AGE
oom-demo   0/1     OOMKilled          0             5s
oom-demo   0/1     CrashLoopBackOff   1 (3s ago)    8s
$ kubectl get pod oom-demo -o jsonpath='{.status.containerStatuses[0].lastState.terminated}'
{"exitCode":137,"reason":"OOMKilled",...}

kubectl get pod cpu-throttle -o jsonpath='{.status.qosClass}'   # Burstable
kubectl get pod oom-demo -o jsonpath='{.status.qosClass}'       # Burstable

apiVersion: v1
kind: LimitRange
metadata:
  name: container-defaults
  namespace: team-a
spec:
  limits:
    - type: Container
      defaultRequest:     # 没写 requests 时补上
        cpu: 100m
        memory: 128Mi
      default:            # 没写 limits 时补上
        cpu: 500m
        memory: 256Mi
      min:
        cpu: 50m
        memory: 64Mi
      max:
        cpu: "2"
        memory: 2Gi

kubectl create namespace team-a
kubectl apply -f limitrange.yaml
kubectl -n team-a run nolimit --image=nginx:1.27
kubectl -n team-a get pod nolimit -o jsonpath='{.spec.containers[0].resources}'
# {"limits":{"cpu":"500m","memory":"256Mi"},"requests":{"cpu":"100m","memory":"128Mi"}}
kubectl -n team-a run toobig --image=nginx:1.27 --overrides='{"spec":{"containers":[{"name":"toobig","image":"nginx:1.27","resources":{"limits":{"memory":"4Gi"}}}]}}'
# Error ... maximum memory usage per Container is 2Gi, but limit is 4Gi

apiVersion: v1
kind: ResourceQuota
metadata:
  name: team-a-quota
  namespace: team-a
spec:
  hard:
    requests.cpu: "4"
    requests.memory: 8Gi
    limits.cpu: "8"
    limits.memory: 16Gi
    pods: "20"
    persistentvolumeclaims: "10"
    requests.storage: 100Gi
    count/deployments.apps: "10"

$ kubectl apply -f quota.yaml
$ kubectl -n team-a describe resourcequota team-a-quota
Resource               Used   Hard
--------               ----   ----
limits.cpu             500m   8
limits.memory          256Mi  16Gi
pods                   1      20
requests.cpu           100m   4
...