调度：亲和性、污点与拓扑分布

待调度 Pod ──▶ 过滤（Filter）            ──▶ 打分（Score）       ──▶ 绑定（Bind）
              资源够吗？nodeSelector？       偏好亲和性、均衡度、    写入 spec.nodeName
              污点能容忍吗？硬性亲和？        镜像是否已存在……
              → 剔除不合格节点               → 选总分最高的节点

kubectl label node k8s-journey-worker  topology.kubernetes.io/zone=zone-a
kubectl label node k8s-journey-worker2 topology.kubernetes.io/zone=zone-b
kubectl label node k8s-journey-worker  disktype=ssd
kubectl get nodes -L topology.kubernetes.io/zone,disktype

apiVersion: v1
kind: Pod
metadata: {name: on-ssd}
spec:
  nodeSelector:
    disktype: ssd
  containers:
    - {name: app, image: nginx:1.27}

apiVersion: apps/v1
kind: Deployment
metadata: {name: affinity-demo}
spec:
  replicas: 4
  selector: {matchLabels: {app: affinity-demo}}
  template:
    metadata: {labels: {app: affinity-demo}}
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:     # 硬约束
            nodeSelectorTerms:
              - matchExpressions:
                  - key: topology.kubernetes.io/zone
                    operator: In
                    values: [zone-a, zone-b]
          preferredDuringSchedulingIgnoredDuringExecution:    # 软偏好
            - weight: 80                                      # 1-100
              preference:
                matchExpressions:
                  - key: disktype
                    operator: In
                    values: [ssd]
      containers:
        - {name: app, image: nginx:1.27}

apiVersion: apps/v1
kind: Deployment
metadata: {name: spread-web}
spec:
  replicas: 3
  selector: {matchLabels: {app: spread-web}}
  template:
    metadata: {labels: {app: spread-web}}
    spec:
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels: {app: spread-web}
              topologyKey: kubernetes.io/hostname    # "同一拓扑域"= 同一节点
      containers:
        - {name: web, image: nginx:1.27}

affinity:
  podAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchLabels: {app: redis-cache}
          topologyKey: kubernetes.io/hostname

kubectl taint nodes k8s-journey-worker2 dedicated=gpu:NoSchedule
kubectl create deployment taint-demo --image=nginx:1.27 --replicas=4
kubectl get pods -l app=taint-demo -o wide     # 全部在 k8s-journey-worker，worker2 被"保留"了

tolerations:   # operator: Equal 需匹配 value；Exists 只看 key
  - {key: dedicated, operator: Equal, value: gpu, effect: NoSchedule}

tolerations:   # 对故障切换敏感的服务可以缩短
  - {key: node.kubernetes.io/unreachable, operator: Exists, effect: NoExecute, tolerationSeconds: 60}

apiVersion: apps/v1
kind: Deployment
metadata: {name: zone-spread}
spec:
  replicas: 6
  selector: {matchLabels: {app: zone-spread}}
  template:
    metadata: {labels: {app: zone-spread}}
    spec:
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: DoNotSchedule      # 硬约束；ScheduleAnyway 为软
          labelSelector:
            matchLabels: {app: zone-spread}
          matchLabelKeys: ["pod-template-hash"] # 只和同一版本的 Pod 比较
      containers:
        - {name: app, image: nginx:1.27}

kubectl apply -f topology-spread.yaml
kubectl get pods -l app=zone-spread -o wide --no-headers | awk '{print $7}' | sort | uniq -c
#   3 k8s-journey-worker
#   3 k8s-journey-worker2

apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata: {name: high}
value: 100000
globalDefault: false        # 为 true 时作为未指定优先级 Pod 的默认值
description: "在线核心服务"
---
apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata: {name: low}
value: 1000
# preemptionPolicy: Never   # 设置后本类 Pod 排队时优先，但不会抢占别人

apiVersion: apps/v1
kind: Deployment
metadata: {name: low-batch}
spec:
  replicas: 2
  selector: {matchLabels: {app: low-batch}}
  template:
    metadata: {labels: {app: low-batch}}
    spec:
      priorityClassName: low
      nodeSelector: {kubernetes.io/hostname: k8s-journey-worker}
      containers:
        - {name: pause, image: registry.k8s.io/pause:3.10, resources: {requests: {cpu: REQ}}}
---
apiVersion: v1
kind: Pod
metadata: {name: vip}
spec:
  priorityClassName: high
  nodeSelector: {kubernetes.io/hostname: k8s-journey-worker}
  containers:
    - {name: pause, image: registry.k8s.io/pause:3.10, resources: {requests: {cpu: REQ}}}

kubectl apply -f priority.yaml
CPU=$(kubectl get node k8s-journey-worker -o jsonpath='{.status.allocatable.cpu}')   # 例如 8
REQ="$((CPU * 400))m"
sed "s/REQ/${REQ}/" preempt-demo.yaml | kubectl apply -f -
kubectl get pods -o wide -w
# vip 先 Pending，随后一个 low-batch Pod 被删除，vip 调度成功；
# 被删的 low-batch 重建后因资源不足而 Pending
kubectl get events --field-selector reason=Preempted

kubectl cordon k8s-journey-worker2        # 标记不可调度，已有 Pod 不受影响
kubectl get nodes                         # STATUS: Ready,SchedulingDisabled
kubectl drain k8s-journey-worker2 --ignore-daemonsets --delete-emptydir-data
# drain = cordon + 逐个驱逐（Eviction）节点上的 Pod
# ... 维护完成 ...
kubectl uncordon k8s-journey-worker2

apiVersion: policy/v1
kind: PodDisruptionBudget
metadata: {name: spread-web}
spec:
  minAvailable: 2                # 或 maxUnavailable: 1
  selector: {matchLabels: {app: spread-web}}

controller:
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
          - matchExpressions:
              - key: node-role.kubernetes.io/control-plane
                operator: Exists
  tolerations:
    - {operator: Exists, effect: NoSchedule}