1、 k8s对象yaml的结构

image.png
在上述的 .yaml 文件中，如下字段是必须填写的：

  • apiVersion 用来创建对象时所使用的Kubernetes API版本
  • kind 被创建对象的类型
  • metadata 用于唯一确定该对象的元数据：包括 name 和 namespace ，如果 namespace 为空， 则默认值为 default
  • spec 描述您对该对象的期望状态

apiVersion查看技巧

image.png

不同类型的 Kubernetes，其 spec 对象的格式不同（含有不同的内嵌字段），通过 API 手册 可 以查看 Kubernetes 对象的字段和描述。例如，假设您想了解 Pod 的 spec 定义，可以在 这里找 到，Deployment 的 spec 定义可以在 这里 找到

https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/ 这就是我们以后要完全参照的 文档。

2、认识kubectl和kubelet

kubeadm安装的集群。二进制后来就是 yum install etcd api-server
认识核心文件夹 /etc/kubernetes . 以Pod方式安装的核心组件。
etcd，api-server，scheduler。（安装k8s的时候，yum kubeadm kubelet kubectl）
/etc/sysconfig/kubelet；kubelet配置位置 /var/lib/kubelet/config.yaml

kubectl的所有命令参考：
命令参考：https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands pdf
命令实战：https://github.com/dennyzhang/cheatsheet-kubernetes-A4/blob/master/cheatsheet-kuber netes-A4.pdf

3、容器

思考：我们在k8s里面的容器和docker的容器有什么异同？

k8s的Pod是最小单位，Pod中容器的配置需要注意以下常用的 

  1. FIELDS:
  2.    activeDeadlineSeconds    <integer>
  3.      Optional duration in seconds the pod may be active on the node relative to
  4.      StartTime before the system will actively try to mark it failed and kill
  5.      associated containers. Value must be a positive integer.
  7.    affinity    <Object>
  8.      If specified, the pod's scheduling constraints
  10.    automountServiceAccountToken    <boolean>
  11.      AutomountServiceAccountToken indicates whether a service account token
  12.      should be automatically mounted.
  14.    containers    <[]Object> -required-
  15.      List of containers belonging to the pod. Containers cannot currently be
  16.      added or removed. There must be at least one container in a Pod. Cannot be
  17.      updated.
  19.    dnsConfig    <Object>
  20.      Specifies the DNS parameters of a pod. Parameters specified here will be
  21.      merged to the generated DNS configuration based on DNSPolicy.
  23.    dnsPolicy    <string>
  24.      Set DNS policy for the pod. Defaults to "ClusterFirst". Valid values are
  25.      'ClusterFirstWithHostNet', 'ClusterFirst', 'Default' or 'None'. DNS
  26.      parameters given in DNSConfig will be merged with the policy selected with
  27.      DNSPolicy. To have DNS options set along with hostNetwork, you have to
  28.      specify DNS policy explicitly to 'ClusterFirstWithHostNet'.
  30.    enableServiceLinks    <boolean>
  31.      EnableServiceLinks indicates whether information about services should be
  32.      injected into pod's environment variables, matching the syntax of Docker
  33.      links. Optional: Defaults to true.
  35.    ephemeralContainers    <[]Object>
  36.      List of ephemeral containers run in this pod. Ephemeral containers may be
  37.      run in an existing pod to perform user-initiated actions such as debugging.
  38.      This list cannot be specified when creating a pod, and it cannot be
  39.      modified by updating the pod spec. In order to add an ephemeral container
  40.      to an existing pod, use the pod's ephemeralcontainers subresource. This
  41.      field is alpha-level and is only honored by servers that enable the
  42.      EphemeralContainers feature.
  44.    hostAliases    <[]Object>
  45.      HostAliases is an optional list of hosts and IPs that will be injected into
  46.      the pod's hosts file if specified. This is only valid for non-hostNetwork
  47.      pods.
  49.    hostIPC    <boolean>
  50.      Use the host's ipc namespace. Optional: Default to false.
  52.    hostNetwork    <boolean>
  53.      Host networking requested for this pod. Use the host's network namespace.
  54.      If this option is set, the ports that will be used must be specified.
  55.      Default to false.
  57.    hostPID    <boolean>
  58.      Use the host's pid namespace. Optional: Default to false.
  60.    hostname    <string>
  61.      Specifies the hostname of the Pod If not specified, the pod's hostname will
  62.      be set to a system-defined value.
  64.    imagePullSecrets    <[]Object>
  65.      ImagePullSecrets is an optional list of references to secrets in the same
  66.      namespace to use for pulling any of the images used by this PodSpec. If
  67.      specified, these secrets will be passed to individual puller
  68.      implementations for them to use. For example, in the case of docker, only
  69.      DockerConfig type secrets are honored. More info:
  70.      https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod
  72.    initContainers    <[]Object>
  73.      List of initialization containers belonging to the pod. Init containers are
  74.      executed in order prior to containers being started. If any init container
  75.      fails, the pod is considered to have failed and is handled according to its
  76.      restartPolicy. The name for an init container or normal container must be
  77.      unique among all containers. Init containers may not have Lifecycle
  78.      actions, Readiness probes, Liveness probes, or Startup probes. The
  79.      resourceRequirements of an init container are taken into account during
  80.      scheduling by finding the highest request/limit for each resource type, and
  81.      then using the max of of that value or the sum of the normal containers.
  82.      Limits are applied to init containers in a similar fashion. Init containers
  83.      cannot currently be added or removed. Cannot be updated. More info:
  84.      https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
  86.    nodeName    <string>
  87.      NodeName is a request to schedule this pod onto a specific node. If it is
  88.      non-empty, the scheduler simply schedules this pod onto that node, assuming
  89.      that it fits resource requirements.
  91.    nodeSelector    <map[string]string>
  92.      NodeSelector is a selector which must be true for the pod to fit on a node.
  93.      Selector which must match a node's labels for the pod to be scheduled on
  94.      that node. More info:
  95.      https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
  97.    overhead    <map[string]string>
  98.      Overhead represents the resource overhead associated with running a pod for
  99.      a given RuntimeClass. This field will be autopopulated at admission time by
  100.      the RuntimeClass admission controller. If the RuntimeClass admission
  101.      controller is enabled, overhead must not be set in Pod create requests. The
  102.      RuntimeClass admission controller will reject Pod create requests which
  103.      have the overhead already set. If RuntimeClass is configured and selected
  104.      in the PodSpec, Overhead will be set to the value defined in the
  105.      corresponding RuntimeClass, otherwise it will remain unset and treated as
  106.      zero. More info:
  107.      https://git.k8s.io/enhancements/keps/sig-node/20190226-pod-overhead.md This
  108.      field is alpha-level as of Kubernetes v1.16, and is only honored by servers
  109.      that enable the PodOverhead feature.
  111.    preemptionPolicy    <string>
  112.      PreemptionPolicy is the Policy for preempting pods with lower priority. One
  113.      of Never, PreemptLowerPriority. Defaults to PreemptLowerPriority if unset.
  114.      This field is beta-level, gated by the NonPreemptingPriority feature-gate.
  116.    priority    <integer>
  117.      The priority value. Various system components use this field to find the
  118.      priority of the pod. When Priority Admission Controller is enabled, it
  119.      prevents users from setting this field. The admission controller populates
  120.      this field from PriorityClassName. The higher the value, the higher the
  121.      priority.
  123.    priorityClassName    <string>
  124.      If specified, indicates the pod's priority. "system-node-critical" and
  125.      "system-cluster-critical" are two special keywords which indicate the
  126.      highest priorities with the former being the highest priority. Any other
  127.      name must be defined by creating a PriorityClass object with that name. If
  128.      not specified, the pod priority will be default or zero if there is no
  129.      default.
  131.    readinessGates    <[]Object>
  132.      If specified, all readiness gates will be evaluated for pod readiness. A
  133.      pod is ready when all its containers are ready AND all conditions specified
  134.      in the readiness gates have status equal to "True" More info:
  135.      https://git.k8s.io/enhancements/keps/sig-network/0007-pod-ready%2B%2B.md
  137.    restartPolicy    <string>
  138.      Restart policy for all containers within the pod. One of Always, OnFailure,
  139.      Never. Default to Always. More info:
  140.      https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy
  142.    runtimeClassName    <string>
  143.      RuntimeClassName refers to a RuntimeClass object in the node.k8s.io group,
  144.      which should be used to run this pod. If no RuntimeClass resource matches
  145.      the named class, the pod will not be run. If unset or empty, the "legacy"
  146.      RuntimeClass will be used, which is an implicit class with an empty
  147.      definition that uses the default runtime handler. More info:
  148.      https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md This is a
  149.      beta feature as of Kubernetes v1.14.
  151.    schedulerName    <string>
  152.      If specified, the pod will be dispatched by specified scheduler. If not
  153.      specified, the pod will be dispatched by default scheduler.
  155.    securityContext    <Object>
  156.      SecurityContext holds pod-level security attributes and common container
  157.      settings. Optional: Defaults to empty. See type description for default
  158.      values of each field.
  160.    serviceAccount    <string>
  161.      DeprecatedServiceAccount is a depreciated alias for ServiceAccountName.
  162.      Deprecated: Use serviceAccountName instead.
  164.    serviceAccountName    <string>
  165.      ServiceAccountName is the name of the ServiceAccount to use to run this
  166.      pod. More info:
  167.      https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
  169.    setHostnameAsFQDN    <boolean>
  170.      If true the pod's hostname will be configured as the pod's FQDN, rather
  171.      than the leaf name (the default). In Linux containers, this means setting
  172.      the FQDN in the hostname field of the kernel (the nodename field of struct
  173.      utsname). In Windows containers, this means setting the registry value of
  174.      hostname for the registry key
  175.      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters to
  176.      FQDN. If a pod does not have FQDN, this has no effect. Default to false.
  178.    shareProcessNamespace    <boolean>
  179.      Share a single process namespace between all of the containers in a pod.
  180.      When this is set containers will be able to view and signal processes from
  181.      other containers in the same pod, and the first process in each container
  182.      will not be assigned PID 1. HostPID and ShareProcessNamespace cannot both
  183.      be set. Optional: Default to false.
  185.    subdomain    <string>
  186.      If specified, the fully qualified Pod hostname will be
  187.      "<hostname>.<subdomain>.<pod namespace>.svc.<cluster domain>". If not
  188.      specified, the pod will not have a domainname at all.
  190.    terminationGracePeriodSeconds    <integer>
  191.      Optional duration in seconds the pod needs to terminate gracefully. May be
  192.      decreased in delete request. Value must be non-negative integer. The value
  193.      zero indicates stop immediately via the kill signal (no opportunity to shut
  194.      down). If this value is nil, the default grace period will be used instead.
  195.      The grace period is the duration in seconds after the processes running in
  196.      the pod are sent a termination signal and the time when the processes are
  197.      forcibly halted with a kill signal. Set this value longer than the expected
  198.      cleanup time for your process. Defaults to 30 seconds.
  200.    tolerations    <[]Object>
  201.      If specified, the pod's tolerations.
  203.    topologySpreadConstraints    <[]Object>
  204.      TopologySpreadConstraints describes how a group of pods ought to spread
  205.      across topology domains. Scheduler will schedule pods in a way which abides
  206.      by the constraints. All topologySpreadConstraints are ANDed.
  208.    volumes    <[]Object>
  209.      List of volumes that can be mounted by containers belonging to the pod.
  210.      More info: https://kubernetes.io/docs/concepts/storage/volumes

1、镜像

在 Kubernetes 的 Pod 中使用容器镜像之前，我们必须将其推送到一个镜像仓库（或者使用仓库中已经 有的容器镜像）。在 Kubernetes 的 Pod 定义中定义容器时，必须指定容器所使用的镜像，容器中的 image 字段支持与 docker 命令一样的语法，包括私有镜像仓库和标签。
image.png
如果使用 hub.dokcer.com Registry 中的镜像，可以省略 registry 地址和 registry 端口。例如： nginx:latest
Kubernetes中，默认的镜像抓取策略是 IfNotPresent ，使用此策略，kubelet在发现本机有镜像的情 况下，不会向镜像仓库抓取镜像。如果您期望每次启动 Pod 时，都强制从镜像仓库抓取镜像，可以尝试 如下方式：

  • 设置 container 中的 imagePullPolicy 为 Always
  • 省略 imagePullPolicy 字段，并使用 :latest tag 的镜像
  • 省略 imagePullPolicy 字段和镜像的 tag
  • 激活 AlwaysPullImages 管理控制器

    使用私有仓库下载镜像

    1. #这个秘钥默认在hello名称空间
    2. kubectl create secret -n hello docker-registry my-aliyun \
    3. --docker-server=registry.cn-hangzhou.aliyuncs.com \
    4. --docker-username=lshady \
    5. --docker-password=dyxxx
    6. #注意点 各个名称空间的秘钥不共享 如果要在别的名称空间使用需要重新创建secret
    1. kind: Pod
    2. apiVersion: v1
    3. metadata:
    4. name: my-container-test02
    5. namespace: hello
    6. labels:
    7.   aa: bb
    8.   bb: dd
    9. spec:
    10. imagePullSecrets:  #镜像的下载秘钥,公有仓是默认的
    11.  - name: my-aliyun   # 是kubectl create secrete 搞来的 registry.cn-hangzhou.aliyuncs.com
    12.  - name: qingcloud 
    13. ##   私仓从 registry.cn-hangzhou.aliyuncs.com直接区分
    14. containers:
    15.  - image: registry.cn-hangzhou.aliyuncs.com/lfy/java-devops-demo:v1.0
    16.    name: my-container-01
    17.    imagePullPolicy: Always
    18.    #生产环境，镜像在私有仓库，下载需要秘钥
    19.  - image: nginx #  默认从docker hub来的
    20.    name: my-container-02
    21.    imagePullPolicy: Always

2、环境变量

说明： 通过 env 或 envFrom 字段设置的环境变量将覆盖容器镜像中指定的所有环境变量。
在制作流水线脚本整合k8s的时候，环境变量及其重要，该环境变量可以直接替换DockerFile文件中定义的ENV环境变量，对镜像做增强

环境变量赋值简单玩法

创建 Pod 时，可以为其下的容器设置环境变量。通过配置文件的 env 或者 envFrom 字段来设置环境变量。
本示例中，将创建一个只包含单个容器的 Pod。Pod 的配置文件中设置环境变量的名称为 DEMO_GREETING， 其值为 “Hello from the environment”。下面是 Pod 的配置清单
kubectl exec envar-demo — printenv 获取当前pod所有环境变量信息

  1. apiVersion: v1
  2. kind: Pod
  3. metadata:
  4.   name: envar-demo
  5.   labels:
  6.     purpose: demonstrate-envars
  7. spec:
  8.   containers:
  9.   - name: envar-demo-container
  10.     image: gcr.io/google-samples/node-hello:1.0
  11.     env:
  12.     - name: DEMO_GREETING
  13.       value: "Hello from the environment"
  14.     - name: DEMO_FAREWELL
  15.       value: "Such a sweet sorrow"

高级玩法

环境变量可以互相引用，但是顺序很重要。 使用在相同上下文中定义的其他变量的变量必须在列表的后面。 同样，请避免使用循环引用。

1、用 Pod 字段作为环境变量的值

  1. apiVersion: v1
  2. kind: Pod
  3. metadata:
  4.   name: dapi-envars-fieldref
  5. spec:
  6.   containers:
  7.     - name: test-container
  8.       image: k8s.gcr.io/busybox
  9.       env:
  10.         - name: MY_NODE_NAME
  11.           valueFrom:
  12.             fieldRef:
  13.               fieldPath: spec.nodeName
  14.         - name: MY_POD_NAME
  15.           valueFrom:
  16.             fieldRef:
  17.               fieldPath: metadata.name
  18.         - name: MY_POD_IP
  19.           valueFrom:
  20.             fieldRef:
  21.               fieldPath: status.podIP

2、使用Secret作为环境变量读取或者cm文件读取

使用场景：早boot项目里面读取mysql的用户名和密码可以写成环境变量从env里面读取

  1. apiVersion: v1
  2. kind: Pod
  3. metadata:
  4.   name: secret-env-pod
  5. spec:
  6.   containers:
  7.   - name: mycontainer
  8.     image: redis
  9.     env:
  10.       - name: SECRET_USERNAME
  11.         valueFrom:
  12.           secretKeyRef:
  13.             name: mysecret
  14.             key: username
  15.           - name: DB_HOST
  16.              valueFrom:
  17.             configMapKeyRef:
  18.               name: MYAPP
  19.               key: DB_HOST
  20.       - name: SECRET_PASSWORD
  21.         valueFrom:
  22.           secretKeyRef:
  23.             name: mysecret
  24.             key: password
  25. ---
  26. apiVersion: v1
  27. data:
  28.   username: YWRtaW4=
  29.   password: MWYyZDFlMmU2N2Rm
  30. kind: Secret
  31. metadata:
  32.   annotations:
  33.     kubectl.kubernetes.io/last-applied-configuration: { ... }
  34.   creationTimestamp: 2020-01-22T18:41:56Z
  35.   name: mysecret
  36.   namespace: default
  37.   resourceVersion: "164619"
  38.   uid: cfee02d6-c137-11e5-8d73-42010af00002
  39. type: Opaque

使用 envFrom 来将 Secret 的所有数据定义为容器的环境变量。 来自 Secret 的主键成为 Pod 中的环境变量名称

  1. apiVersion: v1
  2. kind: Pod
  3. metadata:
  4.   name: secret-test-pod
  5. spec:
  6.   containers:
  7.     - name: test-container
  8.       image: registry.k8s.io/busybox
  9.       command: [ "/bin/sh", "-c", "env" ]
  10.       envFrom:
  11.       - secretRef:
  12.           name: mysecret
  13.   restartPolicy: Never

3、 生命周期容器钩子

Kubernetes中为容器提供了两个 hook（钩子函数）：
PostStart 此钩子函数在容器创建后将立刻执行。但是，并不能保证该钩子函数在容器的 ENTRYPOINT 之前 执行。该钩子函数没有输入参数。
PreStop 此钩子函数在容器被 terminate（终止）之前执行，例如： 通过接口调用删除容器所在 Pod 某些管理事件的发生：健康检查失败、资源紧缺等 如果容器已经被关闭或者进入了 completed 状态，preStop 钩子函数的调用将失败。该函数的执 行是同步的，即，kubernetes 将在该函数完成执行之后才删除容器。该钩子函数没有输入参数。 

  1. kind: Pod
  2. apiVersion: v1
  3. metadata:
  4.   name: my-life
  5.   namespace: hello
  6.   labels:
  7.      aa: bb
  8.      bb: dd
  9. spec:  # 指定规格信息
  10.   containers:  # 指定要启动一个什么样的容器
  11.   - image: nginx  #指定镜像
  12.     name: nginx  #容器的名字 数据就在容器里面  docker run mysql.
  13.     lifecycle:
  14.       postStart:
  15.         # httpGet:
  16.         #   port: 80
  17.         #   path: "http://192.168.169.160/postStart"
  18.         httpGet: 
  19.            host: "192.168.169.160"
  20.            path: "/postStart"
  21.            port: 80
  22.            scheme: HTTP
  23.         # exec:  容器创建之后，这个钩子程序执行一个命令  echo 1111
  24.         # httpGet: 容器创建之后，这个钩子程序发送一个httpGet 请求
  25.         # tcpSocket： 容器创建之后，这个钩子程序连上一个TCP端口
  26.       preStop:  ## 
  27.         httpGet: 
  28.            host: "192.168.169.160"
  29.            path: "/preStop"
  30.            port: 80
  31.            scheme: HTTP

4、配置存活、就绪和启动探针

针对运行中的容器，kubelet 可以选择是否执行以下三种探针，以及如何针对探测结果作出反应：
livenessProbe
指示容器是否正在运行。如果存活态探测失败，则 kubelet 会杀死容器， 并且容器将根据其重启策略决定未来。如果容器不提供存活探针， 则默认状态为 Success。
readinessProbe
指示容器是否准备好为请求提供服务。如果就绪态探测失败， 端点控制器将从与 Pod 匹配的所有服务的端点列表中删除该 Pod 的 IP 地址。 初始延迟之前的就绪态的状态值默认为 Failure。 如果容器不提供就绪态探针，则默认状态为 Success。
startupProbe
指示容器中的应用是否已经启动。如果提供了启动探针，则所有其他探针都会被 禁用，直到此探针成功为止。如果启动探测失败，kubelet 将杀死容器，而容器依其 重启策略进行重启。 如果容器没有提供启动探测，则默认状态为 Success。

Probe配置项

  • initialDelaySeconds：容器启动后要等待多少秒后存活和就绪探测器才被初始化，默认是 0 秒，最小值是 0。这是针对以前没有
  • periodSeconds：执行探测的时间间隔（单位是秒）。默认是 10 秒。最小值是 1。
  • successThreshold：探测器在失败后，被视为成功的最小连续成功数。默认值是 1。
    • 存活和启动探针的这个值必须是 1。最小值是 1。
  • failureThreshold：当探测失败时，Kubernetes 的重试次数。 存活探测情况下的放弃就意味着重新启动容器。 就绪探测情况下的放弃 Pod 会被打上未就绪的标签。默认值是 3。最小值是 1。
  • timeoutSeconds：探测的超时后等待多少秒。默认值是 1 秒。最小值是 1。
  1. apiVersion: v1
  2. kind: Pod
  3. metadata:
  4.   name: "nginx-start-probe02"
  5.   namespace: default
  6.   labels:
  7.     app: "nginx-start-probe02"
  8. spec:
  9.   volumes:
  10.   - name: nginx-vol
  11.     hostPath: 
  12.       path: /app
  13.   - name: nginx-html
  14.     hostPath: 
  15.       path: /html
  16.   containers:
  17.   - name: nginx
  18.     image: "nginx"
  19.     ports:
  20.     - containerPort: 80
  21.     startupProbe:
  22.       exec:
  23.         command:  ["/bin/sh","-c","cat /app/abc"]  ## 返回不是0，那就是探测失败
  24.       # initialDelaySeconds: 20 ## 指定的这个秒以后才执行探测
  25.       periodSeconds: 5  ## 每隔几秒来运行这个
  26.       timeoutSeconds: 5  ##探测超时，到了超时时间探测还没返回结果说明失败
  27.       successThreshold: 1 ## 成功阈值，连续几次成才算成功
  28.       failureThreshold: 3 ## 失败阈值，连续几次失败才算真失败
  29.     volumeMounts:
  30.     - name: nginx-vol
  31.       mountPath: /app
  32.     - name: nginx-html
  33.       mountPath: /usr/share/nginx/html
  34.     livenessProbe:   ## nginx容器有没有 /abc.html，就绪探针
  35.       # httpGet:
  36.       #   host: 127.0.0.1
  37.       #   path: /abc.html
  38.       #   port: 80
  39.       #   scheme: HTTP
  40.       # periodSeconds: 5  ## 每隔几秒来运行这个
  41.       # successThreshold: 1 ## 成功阈值，连续几次成才算成功
  42.       # failureThreshold: 5 ## 失败阈值，连续几次失败才算真失败
  43.       exec:
  44.         command:  ["/bin/sh","-c","cat /usr/share/nginx/html/abc.html"]  ## 返回不是0，那就是探测失败
  45.       # initialDelaySeconds: 20 ## 指定的这个秒以后才执行探测
  46.       periodSeconds: 5  ## 每隔几秒来运行这个
  47.       timeoutSeconds: 5  ##探测超时，到了超时时间探测还没返回结果说明失败
  48.       successThreshold: 1 ## 成功阈值，连续几次成才算成功
  49.       failureThreshold: 3 ## 失败阈值，连续几次失败才算真失败
  50.     readinessProbe: ##就绪检测，都是http
  51.       httpGet:  
  52.         # host: 127.0.0.1  ###不行
  53.         path: /abc.html  ## 给容器发请求
  54.         port: 80
  55.         scheme: HTTP ## 返回不是0，那就是探测失败
  56.       initialDelaySeconds: 2 ## 指定的这个秒以后才执行探测
  57.       periodSeconds: 5  ## 每隔几秒来运行这个
  58.       timeoutSeconds: 5  ##探测超时，到了超时时间探测还没返回结果说明失败
  59.       successThreshold: 3 ## 成功阈值，连续几次成才算成功
  60.       failureThreshold: 5 ## 失败阈值，连续几次失败才算真失败
  62.     # livenessProbe:
  63.     #   exec: ["/bin/sh","-c","sleep 30;abc "]  ## 返回不是0，那就是探测失败
  64.     #   initialDelaySeconds: 20 ## 指定的这个秒以后才执行探测
  65.     #   periodSeconds: 5  ## 每隔几秒来运行这个
  66.     #   timeoutSeconds: 5  ##探测超时，到了超时时间探测还没返回结果说明失败
  67.     #   successThreshold: 5 ## 成功阈值，连续几次成才算成功
  68.     #   failureThreshold: 5 ## 失败阈值，连续几次失败才算真失败

5、 资源限制

  1. apiVersion: v1
  2. kind: Pod
  3. metadata:
  4.   name: "MYAPP"
  5.   namespace: default
  6.   labels:
  7.     app: "MYAPP"
  8. spec:
  9.   containers:
  10.   - name: MYAPP
  11.     image: "debian-slim:latest"
  12.     resources:
  13.       limits: #最大可用资源
  14.         cpu: 200m
  15.         memory: 500Mi
  16.       requests: #启动需要的最小资源
  17.         cpu: 100m
  18.         memory: 200Mi