Какие компоненты настраивал в Kubernetes?

Компоненты Kubernetes, которые я настраивал

Как Python Developer с опытом DevOps, я настраивал несколько ключевых компонентов Kubernetes для развертывания и управления приложениями в контейнерах.

1. Deployments

Основной способ запуска приложений в Kubernetes:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-deployment
spec:
  replicas: 3
  selector:
    matchLabels:
      app: api
  template:
    metadata:
      labels:
        app: api
    spec:
      containers:
      - name: api
        image: myapp:1.0.0
        ports:
        - containerPort: 8000
        env:
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: url
        resources:
          requests:
            memory: "256Mi"
            cpu: "100m"
          limits:
            memory: "512Mi"
            cpu: "500m"
        livenessProbe:
          httpGet:
            path: /health
            port: 8000
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /ready
            port: 8000
          initialDelaySeconds: 5
          periodSeconds: 5

2. Services

Обеспечивают доступ к приложениям:

apiVersion: v1
kind: Service
metadata:
  name: api-service
spec:
  type: ClusterIP  # или LoadBalancer, NodePort
  selector:
    app: api
  ports:
  - protocol: TCP
    port: 80
    targetPort: 8000
---
apiVersion: v1
kind: Service
metadata:
  name: api-nodeport
spec:
  type: NodePort
  selector:
    app: api
  ports:
  - protocol: TCP
    port: 80
    targetPort: 8000
    nodePort: 30000

3. ConfigMaps

Хранят конфигурацию приложения:

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  APP_DEBUG: "false"
  APP_TIMEZONE: "UTC"
  LOG_LEVEL: "INFO"
  settings.ini: |
    [database]
    host=localhost
    port=5432
---
# Использование в Deployment
spec:
  containers:
  - name: api
    image: myapp:1.0.0
    envFrom:
    - configMapRef:
        name: app-config
    volumeMounts:
    - name: config
      mountPath: /etc/config
  volumes:
  - name: config
    configMap:
      name: app-config

4. Secrets

Хранят конфиденциальные данные:

apiVersion: v1
kind: Secret
metadata:
  name: db-secret
type: Opaque
stringData:
  username: admin
  password: secretpassword123
  DATABASE_URL: postgresql://admin:secretpassword123@db:5432/myapp
---
# Альтернатива через base64
apiVersion: v1
kind: Secret
metadata:
  name: db-secret-b64
type: Opaque
data:
  username: YWRtaW4=  # base64 encoded
  password: c2VjcmV0cGFzc3dvcmQxMjM=

5. Persistent Volumes (PV) и Persistent Volume Claims (PVC)

Управление хранилищем данных:

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-postgres
spec:
  capacity:
    storage: 10Gi
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: fast-ssd
  hostPath:
    path: /mnt/data
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc-postgres
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: fast-ssd
  resources:
    requests:
      storage: 5Gi
---
# Использование в Deployment
spec:
  containers:
  - name: postgres
    volumeMounts:
    - name: postgres-data
      mountPath: /var/lib/postgresql/data
  volumes:
  - name: postgres-data
    persistentVolumeClaim:
      claimName: pvc-postgres

6. StatefulSets

Для приложений, требующих стабильных имен и упорядоченного развертывания:

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: postgres-statefulset
spec:
  serviceName: postgres-headless
  replicas: 1
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      containers:
      - name: postgres
        image: postgres:14
        ports:
        - containerPort: 5432
        env:
        - name: POSTGRES_PASSWORD
          valueFrom:
            secretKeyRef:
              name: postgres-secret
              key: password
        volumeMounts:
        - name: postgres-data
          mountPath: /var/lib/postgresql/data
  volumeClaimTemplates:
  - metadata:
      name: postgres-data
    spec:
      accessModes: [ "ReadWriteOnce" ]
      resources:
        requests:
          storage: 10Gi

7. Ingress

Управление внешним доступом к сервисам:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-ingress
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - api.example.com
    secretName: api-tls
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80

8. HorizontalPodAutoscaler (HPA)

Автоматическое масштабирование Pods:

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: api-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: api-deployment
  minReplicas: 2
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80

9. NetworkPolicies

Управление сетевым трафиком между Pods:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress
spec:
  podSelector: {}
  policyTypes:
  - Ingress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-api
spec:
  podSelector:
    matchLabels:
      app: api
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8000

10. DaemonSets

Для запуска Pod на каждом узле кластера:

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: filebeat-daemonset
spec:
  selector:
    matchLabels:
      app: filebeat
  template:
    metadata:
      labels:
        app: filebeat
    spec:
      containers:
      - name: filebeat
        image: docker.elastic.co/beats/filebeat:8.0.0
        volumeMounts:
        - name: varlog
          mountPath: /var/log
        - name: varlibdockercontainers
          mountPath: /var/lib/docker/containers
      volumes:
      - name: varlog
        hostPath:
          path: /var/log
      - name: varlibdockercontainers
        hostPath:
          path: /var/lib/docker/containers

11. Jobs и CronJobs

Для одноразовых и периодических задач:

apiVersion: batch/v1
kind: Job
metadata:
  name: db-migration
spec:
  template:
    spec:
      containers:
      - name: migration
        image: myapp:1.0.0
        command: ["python", "manage.py", "migrate"]
      restartPolicy: Never
  backoffLimit: 3
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: daily-backup
spec:
  schedule: "0 2 * * *"  # Каждый день в 2:00 AM
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: backup
            image: myapp:1.0.0
            command: ["python", "manage.py", "backup"]
          restartPolicy: OnFailure

Практические примеры настройки:

Развертывание полной систeмы:

1. ConfigMap для конфигурации
2. Secrets для чувствительных данных
3. PersistentVolume для БД
4. StatefulSet для PostgreSQL
5. Deployment для API
6. Service для доступа к API
7. Ingress для HTTP маршрутизации
8. HPA для автомасштабирования
9. NetworkPolicy для безопасности

Это обеспечивает полный цикл управления контейнеризированными приложениями в production-среде.