🚀 K8s 集群部署与 KubeSphere 可视化管理平台安装

☸️ K8s 集群部署流程

部署流程图

步骤 1: 执行系统检查

# 赋予脚本执行权限
chmod +x k8s_deploy.sh

# 执行系统检查
./k8s_deploy.sh check

# 输出示例：
[INFO] 2026-03-13 14:30:00 - === 开始前置检查 ===
[INFO] 2026-03-13 14:30:00 - 操作系统：Ubuntu 22.04.3 LTS
[INFO] 2026-03-13 14:30:00 - CPU 核心数：8
[INFO] 2026-03-13 14:30:00 - 可用内存：32GB
[INFO] 2026-03-13 14:30:00 - 可用磁盘空间：500GB
[SUCCESS] 2026-03-13 14:30:01 - 前置检查完成

步骤 2: 系统优化与依赖安装

# 执行系统优化
./k8s_deploy.sh optimize

# 安装系统依赖
./k8s_deploy.sh deps

# 安装 Docker
./k8s_deploy.sh docker

# 验证 Docker 安装
docker --version
docker info

步骤 3: 安装 KubeKey

# 安装 KubeKey (Kubernetes 安装器)
./k8s_deploy.sh kubekey

# 验证安装
kk version

# 输出示例：
KubeKey version: v3.0.13
Kubernetes version: v1.28.7
KubeSphere version: v3.4.1

步骤 4: 创建集群配置

# 生成集群配置文件
./k8s_deploy.sh config

# 编辑配置文件
vim k8s_cluster_config.yaml

# 关键配置项：
# - hosts: 所有节点信息
# - roleGroups: 角色分组
# - controlPlaneEndpoint: 负载均衡配置
# - network: 网络插件配置
# - storage: 存储类配置

步骤 5: 部署集群

# 开始部署 Kubernetes 集群
./k8s_deploy.sh deploy

# 部署成功后验证
kubectl cluster-info
kubectl get nodes
kubectl get pods -n kube-system

# 输出示例：
Kubernetes control plane is running at https://192.168.10.100:6443
CoreDNS is running at https://192.168.10.100:6443/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy

NAME              STATUS   ROLES           AGE   VERSION
master-node-1     Ready    control-plane   10m   v1.28.7
master-node-2     Ready    control-plane   10m   v1.28.7
master-node-3     Ready    control-plane   10m   v1.28.7
worker-node-1     Ready    worker          8m    v1.28.7
worker-node-2     Ready    worker          8m    v1.28.7
worker-node-3     Ready    worker          8m    v1.28.7

🔮 KubeSphere 可视化管理平台安装

安装流程图

步骤 1: 执行安装

# 赋予脚本执行权限
chmod +x kubesphere_install.sh

# 一键安装 KubeSphere (包含所有步骤)
./kubesphere_install.sh all

# 或分步执行：
# ./kubesphere_install.sh check      # 前置检查
# ./kubesphere_install.sh backup     # 创建备份
# ./kubesphere_install.sh install    # 安装核心组件
# ./kubesphere_install.sh monitor    # 监控安装进度
# ./kubesphere_install.sh verify     # 验证安装
# ./kubesphere_install.sh access     # 获取访问信息

步骤 2: 监控安装日志

# 实时查看安装日志
INSTALLER_POD=$(kubectl get pod -n kubesphere-system -l 'app in (ks-install, ks-installer)' -o jsonpath='{.items[0].metadata.name}')
kubectl logs -n kubesphere-system $INSTALLER_POD -f

# 等待所有组件就绪
watch kubectl get pods -n kubesphere-system

步骤 3: 获取访问信息

已启用的核心组件

🔄 CI/CD 流水线集成

端到端研发自动化流程

Jenkins 流水线配置示例

pipeline {
    agent {
        kubernetes {
            yaml '''
apiVersion: v1
kind: Pod
metadata:
  name: jenkins-agent
spec:
  containers:
  - name: maven
    image: maven:3.8-openjdk-17
    command:
    - cat
    tty: true
  - name: docker
    image: docker:24.0
    command:
    - cat
    tty: true
'''
        }
    }
    
    environment {
        REGISTRY = 'harbor.research-automation.local'
        IMAGE_NAME = 'myapp-backend'
        KUBECONFIG = credentials('kubeconfig')
    }
    
    stages {
        stage('Checkout') {
            steps {
                git branch: 'main', 
                    url: 'https://gitlab.research-automation.local/team/myapp.git'
            }
        }
        
        stage('Code Quality') {
            steps {
                sh 'mvn sonar:sonar -Dsonar.host.url=http://sonarqube:9000'
            }
        }
        
        stage('Unit Test') {
            steps {
                sh 'mvn test'
            }
            post {
                always {
                    junit '**/target/surefire-reports/*.xml'
                }
            }
        }
        
        stage('Build & Push Image') {
            steps {
                script {
                    docker.withRegistry("https://${REGISTRY}", 'harbor-credentials') {
                        def image = docker.build("${IMAGE_NAME}:${BUILD_ID}")
                        image.push()
                        image.push('latest')
                    }
                }
            }
        }
        
        stage('Deploy to K8s') {
            steps {
                sh '''
                kubectl set image deployment/${IMAGE_NAME} \
                    ${IMAGE_NAME}=${REGISTRY}/${IMAGE_NAME}:${BUILD_ID} \
                    -n production
                kubectl rollout status deployment/${IMAGE_NAME} -n production
                '''
            }
        }
        
        stage('UI Auto Test') {
            steps {
                sh 'npm run e2e:test'
            }
        }
    }
    
    post {
        success {
            echo 'Pipeline completed successfully!'
        }
        failure {
            echo 'Pipeline failed!'
        }
    }
}

🔒 安全加固与最佳实践

集群安全配置

Pod 安全策略

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restricted
spec:
  privileged: false
  allowPrivilegeEscalation: false
  requiredDropCapabilities:
    - ALL
  volumes:
    - 'configMap'
    - 'emptyDir'
    - 'projected'
    - 'secret'
    - 'downwardAPI'
    - 'persistentVolumeClaim'
  hostNetwork: false
  hostIPC: false
  hostPID: false
  runAsUser:
    rule: 'MustRunAsNonRoot'
  seLinux:
    rule: 'RunAsAny'
  fsGroup:
    rule: 'RunAsAny'
  readOnlyRootFilesystem: true

审计日志配置

# Kubernetes 审计策略
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
# 记录所有写操作
- level: RequestResponse
  verbs: ["create", "update", "patch", "delete"]
  
# 记录敏感资源的读操作
- level: Metadata
  resources:
  - group: ""
    resources: ["secrets", "configmaps"]
  
# 默认级别
- level: Metadata
  omitStages:
    - "RequestReceived"

📊 监控与日志系统

监控架构

核心监控指标

日志查询示例

# 查询特定 Pod 的日志
kubectl logs -f  -n 

# 查询包含错误信息的日志
kubectl logs  | grep -i error

# 查询最近 1 小时的日志
kubectl logs --since=1h 

# 查询多容器 Pod 中指定容器的日志
kubectl logs  -c 

# 使用 stern 实时查看所有匹配 Pod 的日志
stern -n  

🔧 故障排查指南

常见问题与解决方案

kubectl describe pod 
kubectl get events --sort-by='.lastTimestamp'
kubectl top nodes
kubectl get pvc

kubectl logs  --previous
kubectl describe pod 
kubectl get events
kubectl exec  -- env

kubectl get endpoints 
kubectl describe service 
kubectl get networkpolicy
kubectl get pods -l 

kubectl get pods -n kubesphere-system
kubectl get svc ks-console -n kubesphere-system
kubectl logs -n kubesphere-system -l app=ks-console
iptables -L -n | grep 30880

诊断工具集合

#!/bin/bash
# K8s 集群健康诊断脚本

echo "=== 节点状态 ==="
kubectl get nodes -o wide

echo -e "\n=== 系统 Pod 状态 ==="
kubectl get pods -n kube-system

echo -e "\n=== KubeSphere 组件 ==="
kubectl get pods -n kubesphere-system

echo -e "\n=== 资源使用情况 ==="
kubectl top nodes
kubectl top pods --all-namespaces

echo -e "\n=== 最近事件 ==="
kubectl get events --sort-by='.lastTimestamp' | tail -20

echo -e "\n=== PVC 状态 ==="
kubectl get pvc --all-namespaces

echo -e "\n=== 证书有效期 ==="
kubeadm certs check-expiration 2>/dev/null || echo "非 kubeadm 部署"

📎 附录：文件清单