kubernetes节点控制和namespace

2603_95724287

219人浏览 · 2026-06-23 17:06:26

2603_95724287 · 2026-06-23 17:06:26 发布

Node and Cluster

查看节点

# 查看节点清单
[root@master30 ~ 16:32:06]# kubectl get nodes
NAME       STATUS   ROLES           AGE     VERSION
master30   Ready    control-plane   24h     v1.30.2
worker31   Ready    <none>          6h20m   v1.30.2
worker32   Ready    <none>          6h20m   v1.30.2

# 查看特定节点详细信息
[root@master30 ~ 16:32:52]# kubectl describe node worker31
Name:               worker31
Roles:              <none>
Labels:             beta.kubernetes.io/arch=amd64
                    beta.kubernetes.io/os=linux
                    kubernetes.io/arch=amd64
                    kubernetes.io/hostname=worker31
                    kubernetes.io/os=linux
Annotations:        kubeadm.alpha.kubernetes.io/cri-socket: unix:///var/run/containerd/containerd.sock
                    node.alpha.kubernetes.io/ttl: 0
                    projectcalico.org/IPv4Address: 10.1.8.31/24
                    projectcalico.org/IPv4IPIPTunnelAddr: 10.224.137.0
                    volumes.kubernetes.io/controller-managed-attach-detach: true
CreationTimestamp:  Tue, 23 Jun 2026 10:12:03 +0800
Taints:             <none>
Unschedulable:      false
Lease:
  HolderIdentity:  worker31
  AcquireTime:     <unset>
  RenewTime:       Tue, 23 Jun 2026 16:33:11 +0800
Conditions:
  Type                 Status  LastHeartbeatTime                 LastTransitionTime                Reason                       Message
  ----                 ------  -----------------                 ------------------                ------                       -------
  NetworkUnavailable   False   Tue, 23 Jun 2026 16:30:43 +0800   Tue, 23 Jun 2026 16:30:43 +0800   CalicoIsUp                   Calico is running on this node
  MemoryPressure       False   Tue, 23 Jun 2026 16:30:38 +0800   Tue, 23 Jun 2026 10:12:03 +0800   KubeletHasSufficientMemory   kubelet has sufficient memory available
  DiskPressure         False   Tue, 23 Jun 2026 16:30:38 +0800   Tue, 23 Jun 2026 10:12:03 +0800   KubeletHasNoDiskPressure     kubelet has no disk pressure
  PIDPressure          False   Tue, 23 Jun 2026 16:30:38 +0800   Tue, 23 Jun 2026 10:12:03 +0800   KubeletHasSufficientPID      kubelet has sufficient PID available
  Ready                True    Tue, 23 Jun 2026 16:30:38 +0800   Tue, 23 Jun 2026 10:12:06 +0800   KubeletReady                 kubelet is posting ready status
Addresses:
  InternalIP:  10.1.8.31
  Hostname:    worker31
Capacity:
  cpu:                2
  ephemeral-storage:  101590008Ki
  hugepages-1Gi:      0
  hugepages-2Mi:      0
  memory:             3961096Ki
  pods:               110
Allocatable:
  cpu:                2
  ephemeral-storage:  93625351218
  hugepages-1Gi:      0
  hugepages-2Mi:      0
  memory:             3858696Ki
  pods:               110
System Info:
  Machine ID:                 be40cf2bd39d478b8b04226c160ece31
  System UUID:                2dd14d56-8c1a-97e1-8d48-cf63e9682de5
  Boot ID:                    9af04e2b-1793-4b78-a5dd-c79c24fc899c
  Kernel Version:             6.8.0-31-generic
  OS Image:                   Ubuntu 24.04 LTS
  Operating System:           linux
  Architecture:               amd64
  Container Runtime Version:  containerd://1.7.20
  Kubelet Version:            v1.30.2
  Kube-Proxy Version:         v1.30.2
.......

删除节点

以 worker31 节点为例。

# 设置节点为维护模式
[root@master30 ~ 16:34:52]# kubectl drain worker31 --ignore-daemonsets 
node/worker31 cordoned
Warning: ignoring DaemonSet-managed Pods: kube-system/calico-node-gcz8k, kube-system/kube-proxy-7z8tj
node/worker31 drained

[root@master30 ~ 16:35:00]# kubectl get nodes
NAME       STATUS                     ROLES           AGE     VERSION
master30   Ready                      control-plane   24h     v1.30.2
worker31   Ready,SchedulingDisabled   <none>          6h23m   v1.30.2
worker32   Ready                      <none>          6h23m   v1.30.2

# 删除 worker31 节点
[root@master30 ~ 16:35:23]# kubectl delete node worker31
node "worker31" deleted
# 查看节点
[root@master30 ~ 16:35:52]# kubectl get nodes 
NAME       STATUS   ROLES           AGE     VERSION
master30   Ready    control-plane   24h     v1.30.2
worker32   Ready    <none>          6h24m   v1.30.2
## 31节点被删除了

# 重置删除的 worker31 节点
[root@worker31 ~ 16:32:08]# kubeadm reset -f
[preflight] Running pre-flight checks
W0623 16:36:56.179317    4834 removeetcdmember.go:106] [reset] No kubeadm config, using etcd pod spec to get data directory
[reset] Deleted contents of the etcd data directory: /var/lib/etcd
[reset] Stopping the kubelet service
[reset] Unmounting mounted directories in "/var/lib/kubelet"
[reset] Deleting contents of directories: [/etc/kubernetes/manifests /var/lib/kubelet /etc/kubernetes/pki]
[reset] Deleting files: [/etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf /etc/kubernetes/kubelet.conf /etc/kubernetes/bootstrap-kubelet.conf /etc/kubernetes/controller-manager.conf /etc/kubernetes/scheduler.conf]

The reset process does not clean CNI configuration. To do so, you must remove /etc/cni/net.d

The reset process does not reset or clean up iptables rules or IPVS tables.
If you wish to reset iptables, you must do so manually by using the "iptables" command.

If your cluster was setup to utilize IPVS, run ipvsadm --clear (or similar)
to reset your system's IPVS tables.

The reset process does not clean your kubeconfig files and you must remove them manually.
Please, check the contents of the $HOME/.kube/config file.

删除集群

删除集群流程：

删除所有 node
删除所有 master

具体步骤：

删除所有node节点

[root@master30 ~ 16:41:09]# kubectl drain worker31 --ignore-daemonsets --force 
node/worker31 cordoned
Warning: ignoring DaemonSet-managed Pods: kube-system/calico-node-gcz8k, kube-system/kube-proxy-7z8tj
node/worker31 drained
[root@master30 ~ 16:41:47]# kubectl drain worker32 --ignore-daemonsets --force 
node/worker32 cordoned
Warning: ignoring DaemonSet-managed Pods: kube-system/calico-node-sgw6l, kube-system/kube-proxy-vmgpt
node/worker32 drained
[root@master30 ~ 16:41:53]# kubectl delete node worker31 worker32 
node "worker31" deleted
node "worker32" deleted

# 重置节点，注意执行位置
[root@worker31 ~ 16:42:37]# kubeadm reset -f
[root@worker32 ~ 16:42:37]# kubeadm reset -f

删除master节点

# 删除集群前获取集群配置
[root@master30 ~ 16:42:07]# kubectl get cm kubeadm-config -n kube-system -o yaml > kubeadm.yml

# 修改kubeadm.yml内容如下：
[root@master30 ~ 16:43:08]# vim kubeadm.yml
# 删除1-3和22-28行，效果如下
apiServer:
  timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta3
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controllerManager: {}
dns: {}
etcd:
  local:
    dataDir: /var/lib/etcd
imageRepository: registry.k8s.io
kind: ClusterConfiguration
kubernetesVersion: v1.30.2
networking:
  dnsDomain: cluster.local
  podSubnet: 10.224.0.0/16
  serviceSubnet: 10.96.0.0/12
scheduler: {}

[root@master30 ~ 16:43:08]# kubectl delete node master30
[root@master30 ~ 16:43:09]# kubeadm reset -f
[root@master30 ~ 16:43:09]# rm -fr .kube/

重建集群

# 初始化集群
[root@master30 ~ 16:43:10]# kubeadm init --config kubeadm.yml

# 也可以使用之前的命令
[root@master30 ~ 16:43:11]# kubeadm init --kubernetes-version=v1.30.2 --pod-network-cidr=10.224.0.0/16

# 配置凭据
[root@master30 ~ 16:43:11]# mkdir -p $HOME/.kube
[root@master30 ~ 16:43:11]# sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
[root@master30 ~ 16:43:11]# sudo chown $(id -u):$(id -g) $HOME/.kube/config

# 配置网络
[root@master30 ~ 16:43:12]# kubectl apply -f calico.yaml

# 节点加入集群
[root@master31 ~ 16:43:12]# kubeadm join 10.1.8.30:6443 --token ky95b9.sjg0fn21pdi1m0xz    --discovery-token-ca-cert-hash sha256xxxxxxx
[root@master32 ~ 16:43:12]# kubeadm join 10.1.8.30:6443 --token ky95b9.sjg0fn21pdi1m0xz    --discovery-token-ca-cert-hash sha256xxxxxxx

Namespace and Contexts

Namespace 介绍

Namespace，简写ns，也称之为 project，代表资源集合，用于分组集群资源。Kubernetes 使用 Namespace 可以将一个物理的 Cluster 逻辑上划分成多个资源集合，每个集合就是一个Namespace。不同Namespace 里的资源是完全隔离的。

Kubernetes 默认创建以下Namespace：

default：创建资源时如果不指定Namespace，将被放到这个Namespace中。
kube-system： Kubernetes 自己创建的系统资源将放到这个Namespace中。
kube-public：该命名空间中所有对象可以被所有用户（包括未验证身份的用户）读取。
kube-node-lease：该命名空间含有与每个节点关联的Lease对象。节点租用允许kubelet发送heartbeat（心跳），以便控制平面能检测节点故障。

大多数Kubernetes资源（例如 pod、services、pvc等）都属于某个Namespace，但 Namespace 资源本身并不在 Namespace 中，更低级别资源（如Node和persistentVolumes）也不在任何Namespace中。

Namespace 管理

# 查看Namespace清单
[root@master30 ~ 16:46:33]# kubectl get namespaces
NAME              STATUS   AGE
default           Active   24h
kube-node-lease   Active   24h
kube-public       Active   24h
kube-system       Active   24h

# 获取Namespace资源yaml格式定义文件
[root@master30 ~ 16:46:49]# kubectl get namespace default -o yaml
apiVersion: v1
kind: Namespace
metadata:
  creationTimestamp: "2026-06-22T08:27:51Z"
  labels:
    kubernetes.io/metadata.name: default
  name: default
  resourceVersion: "45"
  uid: af325da3-1315-4c49-b9e6-6b8ab45c4a56
spec:
  finalizers:
  - kubernetes
status:
  phase: Active


# 创建Namespace
[root@master30 ~ 16:47:18]# kubectl create namespace temp
namespace/temp created
[root@master30 ~ 16:47:53]# kubectl get namespaces 
NAME              STATUS   AGE
default           Active   24h
kube-node-lease   Active   24h
kube-public       Active   24h
kube-system       Active   24h
temp              Active   11s
# 注意：命名空间名称满足正则表达式[a-z0-9]([-a-z0-9]*[a-z0-9])?，最大长度为63位


# 直接编辑Namespace
[root@master30 ~ 16:48:04]# kubectl edit namespace temp
##会进入vim编辑界面进行编辑


# 查看Namespace详细信息
[root@master30 ~ 16:48:35]# kubectl describe namespace temp
Name:         temp
Labels:       kubernetes.io/metadata.name=temp
Annotations:  <none>
Status:       Active

No resource quota.

No LimitRange resource.

# 删除Namespace
[root@master30 ~ 16:49:18]# kubectl delete namespace temp
namespace "temp" deleted
# 注意：
# 删除一个namespace会自动删除该namespace中所有资源。
# default和kube-system命名空间不可删除。

Namespace 还可以通过 yaml 文件创建。

[root@master30 ~ 16:49:46]# vim temp.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: temp
[root@master30 ~ 16:49:47]# kubectl apply -f temp.yaml 
namespace/temp created

操作特定ns中对象，需要使用选项-n指定ns，例如：

[root@master30 ~]# kubectl run web --image=nginx -n temp
pod/temp created

[root@master30 ~]# kubectl get pod -n temp -o wide
NAME   READY   STATUS    RESTARTS   AGE     IP               NODE                   NOMINATED NODE   READINESS GATES
web    1/1     Running   0          39s   10.224.113.129   worker32.laoma.cloud   <none>           <none>

Namespace 切换

查看当前所在ns

[root@master30 ~ 16:49:46]# kubectl config get-contexts 
CURRENT   NAME                          CLUSTER      AUTHINFO           NAMESPACE
*         kubernetes-admin@kubernetes   kubernetes   kubernetes-admin

此时NAMESPACE列对应的属性为空，不属于任何NAMESPACE。

设置默认ns

[root@master30 ~]# kubectl config set-context --current --namespace=temp
Context "kubernetes-admin@kubernetes" modified.
[root@master30 ~]# kubectl config get-contexts 
CURRENT   NAME                          CLUSTER      AUTHINFO        NAMESPACE
*         kubernetes-admin@kubernetes   kubernetes   kubernetes-admin   temp

此时，NAMESPACE 列对应的属性为 temp。

Cluster 切换

~/.kube/config 详解

单集群配置

获取凭据文件内容（不显示敏感信息）：

[root@master30 ~ 16:52:39]# kubectl config view 
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://10.1.8.30:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate-data: DATA+OMITTED
    client-key-data: DATA+OMITTED

配置文件示例：

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMvakNDQWVhZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQ..........lM5MTBXMUNtYTJWUTFCYnprY1h0YzJZOUdDSS9Cd3h2a0labWFSYy9ETFY1M0YxSmxXCnluNmovZEpvdmd6SGZqaVhheUxoekpaUDhMaG9ULzFacFQ2K214Uml0SHVMM2RVRW9oL2ttSzZqclBjZlFUWlMKTnRrPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
    server: https://10.1.8.30:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURJVENDQWdtZ0F3SUJBZ0lJYm9pOWR1alB4dEF3RFFZS.......HpWCm5WTVFnMUsvUmhRSGV5TnY2SGtycTJXSFhoUjh1L2M3Ukw3WGwyeDlzcWhPWmR3cGRrUlBXK0RENEs4TFMwYjAKUnhwdGxraW44UFE5QkZEOExuNxQWluOUE2M3RydWZLTzJMTEF0YUVJeDRMUzJWZ09veG5odWEKQlh6UGp4SHF5TTR1WFRqQVlOMk44K2wxWXRBeSs0VTg2ZzVEMEZZeUpSTE5NMU5VL2c9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
    client-key-data: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBeFJtaHoySmNYbzdGY0hvVENHenR5MkRqZ........x3YzMzSWRHd0xsWU9KUmFNdRnZzBLNnpORUpkKzZaYVo2cUQyVVhRCnY3WUVFzS0huSDBnUXNwWVZpN3NFRzRDdWtZSDQ2MUNCM0dET0N0b3c9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=

说明：

certificate-authority-data 指定CA证书，通过base64编码。
client-certificate-data 指定用户证书，同样是 base64 编码。
client-key-data 指定用户私钥，同样是 base64 编码。

多集群配置

示例：/root/multi-cluster-config

##查看.kube/config 文件，使用里面的证书
[root@master30 ~ 16:55:10]# cat .kube/config 
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURCVENDQWUyZ0F3SUJBZ0lJWUpGRUNDSDlHdHN3RFFZS。。。。wT25OYUdxTnh4NWNpQksrOS8vCnJPM3c2eHNYb0svYTNXZHBuTU1UeXRLTlkwcTRpTUw4OXFRelpzR1NDNXRMSGlVa2RWaDdpUU1qV3dINkZpd0IKWUduRUlTbjV6SkU5Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
    server: https://10.1.8.30:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLVENDQWhHZ0F3SUJBZ0lJV3NVejY5YVRmQU13RFFZS。。。TFJaeXpVQlR1NnRJZ201Wng0am81RzBYNCt5eisKUkpIUDR6TWU3di8xa1ppSkczNXgwWEpNZFIzNmh3QnRSeDM0VTNGL3ora2JENjl1cVN4bE0rYXF0YitwCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
    client-key-data: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBc0cvYjVLUlRrNTkrQzVGN1RjcjBKOUViODJuM2tnSkYxVjRjc3VpUDBiSUpZd3BTClhvNnBaSXZpbUxidTVkUlJCNHFqMUVOZzc3MHpITG。。。pMVzhHMW03cXhGYUR0QytnOWxNSzB4bFRCb3hZWW9BZ1hpUlBWWApnWVRubVVCT1l0M2V0eDVlcDBQTmVHNVg1QmFiK0dITUlmU1kxV0RvS0FJbERnVUpEQ1R3Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==

将证书替换到下面的凭证文件

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED ##这边
    server: https://10.1.8.30:6443
  name: cluster1
- cluster:
    certificate-authority-data: DATA+OMITTED  ##这边
    server: https://10.1.8.150:6443
  name: cluster2
contexts:
- context:
    cluster: cluster1
    namespace: default
    user: cluster1-admin
  name: cluster1-context
- context:
    cluster: cluster2
    namespace: default
    user: cluster2-admin
  name: cluster2-context
current-context: cluster1-context
kind: Config
preferences: {}
users:
- name: cluster1-admin
  user:
    client-certificate-data: DATA+OMITTED ##这边
    client-key-data: DATA+OMITTED  ##这边
- name: cluster2-admin
  user:
    client-certificate-data: DATA+OMITTED  ##这边
    client-key-data: DATA+OMITTED  ##这边

配置文件定义了以下资源：

clusters：集群信息，包括集群名、authority、地址和端口。
users：用户信息，包括用户名、certificate和key。
contexts：上下文信息，包括上下文名称、集群名、用户名和namespace。

多集群切换

kubernetes 自带工具

环境准备：

[root@master30 ~]# cp .kube/config .kube/config.ori
[root@master30 ~]# cp multi-cluster-config .kube/config

查看集群清单

[root@master30 ~]# kubectl config get-clusters
NAME
cluster1
cluster2

查看上下文清单

[root@master30 ~]# kubectl config get-contexts
CURRENT   NAME               CLUSTER    AUTHINFO         NAMESPACE
*         cluster1-context   cluster1   cluster1-admin   default
          cluster2-context   cluster2   cluster2-admin   default

* 代表当前使用的上下文

切换上下文

[root@master30 ~]# kubectl config use-context cluster2-context
[root@master30 ~]# kubectl config get-contexts
CURRENT   NAME               CLUSTER    AUTHINFO         NAMESPACE
          cluster1-context   cluster1   cluster1-admin   default
*         cluster2-context   cluster2   cluster2-admin   default

AI硬件创业社区

智能硬件社区聚焦AI智能硬件技术生态，汇聚嵌入式AI、物联网硬件开发者，打造交流分享平台，同步全国赛事资讯、开展 OPC 核心人才招募，助力技术落地与开发者成长。

更多推荐

AI 硬件编程避坑指南：从“跑通代码”到“验证闭环”的验证工程实战

AI 硬件编程的核心痛点并非代码生成，而是“构建通过即成功”的完成幻觉——传统 TDD 无法覆盖硬件物理层验证，AI 生成的代码常因屏幕显示、串口通信等物理环节异常导致项目返工。本文结合 ESP32-S3 开发板实战，拆解验证工程的核心逻辑，提供可落地的闭环方案，帮你避开 AI 硬件开发的 80% 收尾陷阱。

AI硬件创业社区

Docker Namespace 原理：容器为什么能“以为自己是台独立的机器“

先想想之后到底发生了什么。你进到了一个 shell，里面有自己的一套、自己的进程列表、自己的网卡，看起来像一台独立的机器。容器里的进程就是跑在宿主机上的普通进程，它只是被"加了层滤镜"，看不到自己外面的世界。这层"滤镜"就是 Linux 内核的Namespace（命名空间）机制。它是内核提供的一种资源视图隔离手段：给不同进程组提供不同的"系统资源视图"。