Namespace and Contexts

学习参考：Namespace

Namespace 介绍

**问题：**多个用户共用同一套 Kubernetes 集群时，如何实现各自创建资源的逻辑隔离？

答案：Namespace，简写 ns，也可称作 project，代表一组资源集合，用于对集群资源做分组管理。借助 Namespace，Kubernetes 能够将单套物理集群从逻辑上切分为多组独立资源集合，每一组集合对应一个 Namespace，不同 Namespace 内的资源完全相互隔离。

Kubernetes 集群默认预置四类命名空间：

  • default：创建资源时若未手动指定 Namespace，资源会默认归入该命名空间。
  • kube-system：集群自身运行所需的系统组件资源，统一存放于此。
  • kube-public：该命名空间下的所有对象，可供集群内全部用户（含未完成身份校验的匿名用户）读取访问。
  • kube-node-lease：存储各节点对应的 Lease 租约对象，节点依靠租约机制向控制平面持续发送心跳，用于集群检测节点运行故障。

思考：是否所有 Kubernetes 资源都归属于某一个 Namespace？

**答：**绝大多数资源（例如 Pod、Service、PVC 等）都隶属于命名空间，但 Namespace 资源本身不属于任何命名空间；Node 节点、持久卷 PersistentVolume 这类底层资源，同样不存在所属 Namespace。

Namespace 管理

# 查看Namespace清单
root@master30 ~ 15:54:51# kubectl get ns
NAME              STATUS   AGE
default           Active   56m
kube-node-lease   Active   56m
kube-public       Active   56m
kube-system       Active   56m


# 获取Namespace资源yaml格式定义文件
root@master30 ~ 16:49:53# kubectl get ns default -o yaml
apiVersion: v1
kind: Namespace
metadata:
  creationTimestamp: "2026-08-05T07:53:30Z"
  labels:
    kubernetes.io/metadata.name: default
  name: default
  resourceVersion: "42"
  uid: 2087a5ee-1aa8-4122-a2dd-3800309b2e26
spec:
  finalizers:
  - kubernetes
status:
  phase: Active


# 创建Namespace
root@master30 ~ 16:50:24# kubectl create ns liu
namespace/liu created

# 注意：命名空间名称满足正则表达式[a-z0-9]([-a-z0-9]*[a-z0-9])?，最大长度为63位

# 直接编辑Namespace
root@master30 ~ 16:50:41# kubectl edit ns liu

# 查看Namespace详细信息
root@master30 ~ 16:51:16# kubectl describe ns liu
Name:         liu
Labels:       kubernetes.io/metadata.name=liu
Annotations:  <none>
Status:       Active

No resource quota.

No LimitRange resource.


# 删除Namespace
root@master30 ~ 16:51:22# kubectl delete ns liu
namespace "liu" deleted

# 注意：
# 删除一个namespace会自动删除该namespace中所有资源。
# default和kube-system命名空间不可删除。

Namespace 也可通过 YAML 配置文件完成创建。

root@master30 ~ 16:53:09# touch  ns-liu.yaml
root@master30 ~ 16:53:50# vim ns-liu.yaml 
# ns-liu.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: liu

root@master30 ~ 16:56:41# kubectl apply -f ns-liu.yaml 
namespace/liu created

操作指定命名空间内的资源对象时，需通过-n参数声明目标命名空间，示例如下：

root@master30 ~ 16:57:03# kubectl run web --image=nginx -n liu
pod/web created

root@master30 ~ 16:58:53# kubectl get pod -n liu -o wide
NAME   READY   STATUS    RESTARTS   AGE     IP              NODE                 NOMINATED NODE   READINESS GATES
web    1/1     Running   0          3m15s   10.224.133.65   worker31.liu.cloud   <none>           <none>

root@master30 ~ 17:00:44# curl -s 10.224.133.65 | grep nginx
<title>Welcome to nginx!</title>
<h1>Welcome to nginx!</h1>
<p>If you see this page, nginx is successfully installed and working.
<a href="https://nginx.org/">nginx.org</a>.<br/>
<a href="https://community.nginx.org/">community.nginx.org</a>.<br/>
<a href="https://f5.com/nginx">f5.com/nginx</a>.</p>
<p><em>Thank you for using nginx.</em></p>

Namespace 切换

kubernetes 自带工具

查看当前上下文绑定的命名空间

root@master30 ~ 09:14:17# kubectl config get-contexts 
CURRENT   NAME                          CLUSTER      AUTHINFO           NAMESPACE
*         kubernetes-admin@kubernetes   kubernetes   kubernetes-admin

输出结果中NAMESPACE列无内容，代表当前上下文未绑定任何命名空间。

为当前上下文设置默认命名空间

root@master30 ~ 09:23:23# kubectl config set-context --current --namespace=liu
Context "kubernetes-admin@kubernetes" modified.

此时，NAMESPACE 列对应的属性为 liu

kubens-第三方工具

kubens 安装

root@master30 ~ 09:23:51# wget http://192.168.46.200/class/course-materials/softwares/stage03/kubens -O /usr/local/bin/kubens
--2026-08-06 09:24:01--  http://192.168.46.200/class/course-materials/softwares/stage03/kubens
Connecting to 192.168.46.200:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 5703 (5.6K) [application/octet-stream]
Saving to: ‘/usr/local/bin/kubens’

/usr/local/bin/kubens         100%[==============================================>]   5.57K  --.-KB/s    in 0s      

2026-08-06 09:24:01 (1.35 GB/s) - ‘/usr/local/bin/kubens’ saved [5703/5703]

root@master30 ~ 09:24:01# chmod +x /usr/local/bin/kubens 


# 配置补全
root@master30 ~ 09:24:12# wget http://192.168.46.200/class/course-materials/softwares/stage03/kubens.bash -O /etc/bash_completion.d/kubens.bash
--2026-08-06 09:24:23--  http://192.168.46.200/class/course-materials/softwares/stage03/kubens.bash
Connecting to 192.168.46.200:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 254 [application/octet-stream]
Saving to: ‘/etc/bash_completion.d/kubens.bash’

/etc/bash_completion.d/kubens 100%[==============================================>]     254  --.-KB/s    in 0s      

2026-08-06 09:24:23 (58.4 MB/s) - ‘/etc/bash_completion.d/kubens.bash’ saved [254/254]

root@master30 ~ 09:24:23# source /etc/bash_completion.d/kubens.bash

kubens 常用操作命令

root@master30 ~ 09:24:44# kubens 
default
kube-node-lease
kube-public
kube-system
liu
root@master30 ~ 09:24:51# kubens kube-system 
Context "kubernetes-admin@kubernetes" modified.
Active namespace is "kube-system".
root@master30 ~ 09:25:04# kubectl config get-contexts 
CURRENT   NAME                          CLUSTER      AUTHINFO           NAMESPACE
*         kubernetes-admin@kubernetes   kubernetes   kubernetes-admin   kube-system
root@master30 ~ 09:25:18# kubectl get pods 
NAME                                         READY   STATUS    RESTARTS      AGE
calico-kube-controllers-585df69d45-p5fsp     1/1     Running   1 (25m ago)   17h
calico-node-7plmg                            1/1     Running   1 (25m ago)   17h
calico-node-k5hk6                            1/1     Running   1 (25m ago)   17h
calico-node-ql64b                            1/1     Running   1 (25m ago)   17h
coredns-7db6d8ff4d-4l7rh                     1/1     Running   1 (25m ago)   17h
coredns-7db6d8ff4d-b4pn5                     1/1     Running   1 (25m ago)   17h
etcd-master30.liu.cloud                      1/1     Running   1 (25m ago)   17h
kube-apiserver-master30.liu.cloud            1/1     Running   1 (25m ago)   17h
kube-controller-manager-master30.liu.cloud   1/1     Running   1 (25m ago)   17h
kube-proxy-dnl6s                             1/1     Running   1 (25m ago)   17h
kube-proxy-glbf6                             1/1     Running   1 (25m ago)   17h
kube-proxy-s7bpm                             1/1     Running   1 (25m ago)   17h
kube-scheduler-master30.liu.cloud            1/1     Running   1 (25m ago)   17h

自定义脚本

#!/bin/bash
function usage(){
  echo "$0 [namespace]
1. 未传入命名空间参数时，打印集群全部命名空间列表
2. 传入的命名空间必须是集群内已存在的资源"
}
# 获取当前上下文绑定的命名空间
namespace=$(kubectl config get-contexts | awk '/\*/{print $5}')
if [ -z "$namespace" ];then
  namespace=default
fi
# 展示命名空间列表
if [ $# -eq 0 ];then
  kubectl get ns | awk '{print "  "$1}' | sed "s/^  $namespace/\* $namespace/"
  exit 1
fi
# 切换指定命名空间
if [ $# -eq 1 ];then
  if kubectl get ns | awk '$1 !~ "NAME" {print $1}' | grep -qx "$1" &>/dev/null;then
    kubectl config set-context --current --namespace $1 > /dev/null
    echo "当前命名空间已切换为：$1"
  else
    usage  
  fi
fi

Cluster 切换

~/.kube/config 详解

单集群配置

查看凭据配置文件内容（敏感数据自动隐藏）：

root@master30 ~ 18:43:39# kubectl config view 

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://10.1.8.30:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    namespace: kube-system
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate-data: DATA+OMITTED
    client-key-data: DATA+OMITTED

完整配置文件示例：

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURCVENDQWUyZ0F3SUJBZ0lJZVRSVHJQVXhFWEV3RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TmpBNE1EVXdOelE0TWpaYUZ3MHpOakE0TURJd056VXpNalphTUJVeApFekFSQmdOVkJBTVRDbXQxWW1WeWJtVjBaWE13Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLCkFvSUJBUURONHovN1NONzBDYUNjanhOYTdzQ2JTeU5XY3JSSVZBMWFUK0VKaGduMlphRWc5WVBBa3J6eUp3T0QKNWJtbFdVaTRZMTV3Vnlvc0NsN2xWdFBXcllKUVhkQncvWGlzUFNJcFkvQzRxcFR5RkgzQm5DYlJOeUlyaHFtLwp1SDNqSVBBMFYwOVVSbysxTStYNStKNzMvZ1RsSXFNc1BpZXJzNGNqMGEzNDhhL1VVUXhqdW53YW5uZlZENVRDCjV3cExLNnZmYkJQTjJScGw4NTM4b0R3RldweG1yQ1FoODNqRFpCSDRSbTFqbGpxc0Z3WVNudkZRS1RJd1dKRnMKd3pIdWNtUjZYcU96dGpiNjJZYnBjWlBHYkVrYXduYklOb20xOE80VXRTc1E0bk1MSHEwdTFqeDNOUDh2SmVJZwpISy9JaFA4TS80NHBqN1ZCNnpXY0pydzRWT3FMQWdNQkFBR2pXVEJYTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUIwR0ExVWREZ1FXQkJRVWJjdG0rWUd6bjZlS21CTWNQYU5GV0lCWW1qQVYKQmdOVkhSRUVEakFNZ2dwcmRXSmxjbTVsZEdWek1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQU81b01PSEZyNwp3QmhGNnFTNmtwbHo3WVphV3dqVHdISmVKMm1zdzFaNFV3aHFKYlhLWThyREhHRXk3L0YwRUpVNTZWZVdYVVlxCnZGNDROWFRGeG00czU0bEsrUlE5K3RzTmM0VHh3cHNoTU9EUVNFM1NTSWNJN25jUGpER2xINm83UjVGOEk5WHUKWXJQRmE2Z1N2aXcrUTY1Zk94VlJ2dnhOblFndzR0TzQ1eWxZMFB0S1RyNm5RRW95WDNjWnhRbk1SMkczdE5IcAo0NkZIODZUbFdMTUpEbDVGVkY5aDcrekFnMC9yS0h5V0N2bUxGd050R2J2NEJGclc3MFo5STgxYURha0VUczkxCjN3aGFxa2tweXdUYnpQcC9yc3V2Q3Npb0hBWERlcUJtZldGYUR0SUc3bmV2MXlhNXdHM3RXcEdvN1AxTnNhWVEKK1NOUS9DQWlnaG5qCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
    server: https://10.1.8.30:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    namespace: kube-system
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLVENDQWhHZ0F3SUJBZ0lJZnROelNrckpMTG93RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TmpBNE1EVXdOelE0TWpaYUZ3MHlOekE0TURVd056VXpNamRhTUR3eApIekFkQmdOVkJBb1RGbXQxWW1WaFpHMDZZMngxYzNSbGNpMWhaRzFwYm5NeEdUQVhCZ05WQkFNVEVHdDFZbVZ5CmJtVjBaWE10WVdSdGFXNHdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDKytLeHcKWWtjNXZWb2NicmJ5Z09EaWorc1lockxaTkwwODJNRGdkKzMvazZONXFpUlcySzB4MWlSRlNxd1FuQXlyR2RBeAozK3ByTlBHVmordkRZMjhjUnZiRzMvUDBRSytmaU9qNUpOQmY1WkJ1V3ZvZDRJT2ZPbGlvYlZPSWN6M1cyU294ClFFZTkrUHFFQzh0aXUrVHZ4VEdjRE1UMTYweXlZd2MwOHhyL2RZNzhGRW4rM1BweUFLRGZoNlVldXcvS0V5TmYKSUpKUW1TbTdFL2pHd3pMTWFpVzZmbkltTEhyYXdvZTJuc1lCclkvR210NkxQODZJdy9NS0RwMjgvSmxTWVhQTwpZQkdCbzRiSDR2aHZDLzN0SkcwUzQ3empQSlhSYTBiK0piS0czVzRTQ2ZnMzBhR2FqZVozVldkcVYxSkVaWDlLCnhySVV6R2l5YWlPa1ViMkRBZ01CQUFHalZqQlVNQTRHQTFVZER3RUIvd1FFQXdJRm9EQVRCZ05WSFNVRUREQUsKQmdnckJnRUZCUWNEQWpBTUJnTlZIUk1CQWY4RUFqQUFNQjhHQTFVZEl3UVlNQmFBRkJSdHkyYjVnYk9mcDRxWQpFeHc5bzBWWWdGaWFNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUNJam40MGV6WEhxZnZ1VmlFMDJmZTJkNTVQCmNxb2JBSmM2cXU5WVB4SFdKZE00WEhHaXdEVGpDZll4dzRmQ3J6OFVNZGFIRFJoWkQ4eWoydXVBWWtWWmJrV1UKbTRGUytVeEZ3TGlCRU1aRFozN1drRTZ5QmEwWC9VSWFvUU9EaDhBdGxwMDJMaUJ2dTZ5bUdyQk85WEU2SUh3dAo5elRuVXVJWXpJZER4REhPQ1JUQWRXNk1qVHplNytZVExZVTlzVmFWL0tKV1VwUllGQWt3MUxkSjVCZDllcHM5CnpSazdOaVZvYk9KUUk3R1VUYUxSUnB3UUk0N0Z5TTV3OEhCcXZiclkyaytScjVrSGM4K0VpMUZsbXBqOG1Zb2QKa3I5QkRINFllbjJlOU5LN1lpakl5bXlwOHNNWGc3OGJacjdFYUR1RUw5NlBNVUpISS9sWWhDUktZQ05kCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
    client-key-data: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBdnZpc2NHSkhPYjFhSEc2MjhvRGc0by9yR0lheTJUUzlQTmpBNEhmdC81T2plYW9rClZ0aXRNZFlrUlVxc0VKd01xeG5RTWQvcWF6VHhsWS9ydzJOdkhFYjJ4dC96OUVDdm40am8rU1RRWCtXUWJscjYKSGVDRG56cFlxRzFUaUhNOTF0a3FNVUJIdmZqNmhBdkxZcnZrNzhVeG5BekU5ZXRNc21NSE5QTWEvM1dPL0JSSgovdHo2Y2dDZzM0ZWxIcnNQeWhNalh5Q1NVSmtwdXhQNHhzTXl6R29sdW41eUppeDYyc0tIdHA3R0FhMlB4cHJlCml6L09pTVB6Q2c2ZHZQeVpVbUZ6em1BUmdhT0d4K0w0Ynd2OTdTUnRFdU84NHp5VjBXdEcvaVd5aHQxdUVnbjQKTjlHaG1vM21kMVZuYWxkU1JHVi9Tc2F5Rk14b3Ntb2pwRkc5Z3dJREFRQUJBb0lCQUZYY0JlTk5QRXFvYUZBcQpNdFNhdndEOXhhdzBPMHJPbkZvejladTJMK25kWGYxQVVyQTlJTGtzVndoVVIwSDhkdkdpWEdsZ0M4d0JkTEJTCmthUTZHMlZ5UGxjeHIwUGNwVmtydTlyd0EwTnFPZUp6d3NvVisvZGx5eUNHYnEwRmF3TWloZ2E0cU1pdm5Tb3IKQjFrdnN3RmQvaXp6ek1YbjhZYXVZVG9jSnNJOU9JS3BNTUJtK3Fhd0VmcHRtYTJsaURVYVRiYXppY1o1NmlQeQpDblkrZTluZEh1MzJTUUw3OFVEcFN6ZjY2dnhnSGpQNTFHRXY2Y3h3NUphMzFycEd6MHBaY2xxbXFKMDJYQ251CkFoVDlwQzlVUmRUeFdEMDJSdVhuS0w0c2JqaVp6Wk1MZHdiSS9UYVhnbHZLNDRPM3p1VmJ0bExTM0ozdnNZV24KSWVKVmQva0NnWUVBMU9qYjAwTDdGNlpGMnB4b1J4T3NmL3BTL01BdURBMWMrUmVNdWpUdDROemxsZWcwOVpKQgpsRkpySE9CVkQ5Vmt1T2E3eFpQN2JTaG02b216bkxhRGwzQVhVRzEyVFFvVkxtNWZuYTY0Snl3ZTU0ZVExem9mCkpYVmUvbGpsWlJXSkY4RVZYQUYwQkRBYzlBVm0yNE9OcWFTaEl6L0hMS01pWC9Bak9nS3hXRlVDZ1lFQTVaOHEKU2lZei81TUQxQkJEMlRiM01Rc0NSUzF4Q2ZvTU8rclpTTVJvZjZSQVpUamI1Sm1rdjlQZEo2R0JaMXZ1SElLYwplejljSUNSTG5PcjVhZGJ4Y3E2emJ4aVZTZitMall1aVh4emduUXYyYi9waWJoOWJvT3pxYi9VQ0RtaXpwNXJrCmN3dU85S1FaVi9jRVE3Yk1zYnBiUnhMUTR6RTJQZG1VK3hVQTluY0NnWUVBdkJmRUxNMmQyblRRZmFOMEZHYnoKSEZUZi85OGdUeEYzTTdCMGFRVGRxcXc4UDhWWEZDUlR2MTlZdGJnU0xkek9FUFAycTBSaStUcWFRVlhKMGdjRQpGa08ydFIwZlNFeENEalVBVCtQTldQNEhoM0FpcTZIelpqcGM0OE5SVlk1REFUTlpWV0VMUjYvaHhFc0paYURCCkJFQW5BMmNTNVFKeUdlT2ltMXRKcGNrQ2dZQjJZdXFOMGthSzVVUmJDSXZDcVFrbld2S3ZzZThPNHNGOS91WksKRXlHQmRiRFJ2MC8zKzVNcVo5UWxBNnJSSEYrV2lXeWVTcHQzNHQ2dEo2U3lBZVQ0YU1RUWFrOUdHSi9kdVhsYwpxbW5QN29QL1ZjdDcxV1VMZ2pxWXdHeHYrMkZzNzNvTEtwRm81bFkrdVJlVXhlR2hYR0NGTTFsSldXMEsxR3h3ClMzTDBud0tCZ0hKVEo4bUQxcFRwUGgxaVEwakc2THliem9MeVU2UHBmZmpya2JJY3VCa0xBYjhkclJudzVPWEIKWE5pTmF1Q1orZ0pkQVFtRGlCVitQNTVqamhRSzVqSzVOQXE4dTNoaEpJcVNWQWIwREwyTmJlcTRKeEJTbDgyTApObnZVRTNOdWJ0c0VvdVVjMXMxTVZFa1FLaktqdXVQS1cwa1h1Vndwa0hIL1Q2VFhsbktzCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
多集群配置

示例文件路径：/root/multi-cluster-config

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://10.1.8.30:6443
  name: kubernetes-1
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://10.1.8.30:6443
  name: kubernetes-2
contexts:
- context:
    cluster: kubernetes-1
    namespace: default
    user: kubernetes-1-admin
  name: kubernetes-1-admin@kubernetes-1
- context:
    cluster: kubernetes-2
    namespace: webapp
    user: kubernetes-2-admin
  name: kubernetes-2-admin@kubernetes-2
current-context: kubernetes-1-admin@kubernetes-1
kind: Config
preferences: {}
users:
- name: kubernetes-1-admin
  user:
    client-certificate-data: DATA+OMITTED
    client-key-data: DATA+OMITTED
- name: kubernetes-2-admin
  user:
    client-certificate-data: DATA+OMITTED
    client-key-data: DATA+OMITTED

配置文件包含三类核心资源定义：

  • clusters：集群信息，包含集群标识、根证书、API 服务地址与端口。
  • users：用户身份信息，包含用户名、客户端证书与私钥。
  • contexts：上下文关联信息，绑定上下文名称、目标集群、操作用户以及默认命名空间。

多集群切换

kubernetes 自带工具

环境配置操作：

root@master30 ~ 18:35:28# vim .kube/config
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURCVENDQWUyZ0F3SUJBZ0lJZVRSVHJQVXhFWEV3RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TmpBNE1EVXdOelE0TWpaYUZ3MHpOakE0TURJd056VXpNalphTUJVeApFekFSQmdOVkJBTVRDbXQxWW1WeWJtVjBaWE13Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLCkFvSUJBUURONHovN1NONzBDYUNjanhOYTdzQ2JTeU5XY3JSSVZBMWFUK0VKaGduMlphRWc5WVBBa3J6eUp3T0QKNWJtbFdVaTRZMTV3Vnlvc0NsN2xWdFBXcllKUVhkQncvWGlzUFNJcFkvQzRxcFR5RkgzQm5DYlJOeUlyaHFtLwp1SDNqSVBBMFYwOVVSbysxTStYNStKNzMvZ1RsSXFNc1BpZXJzNGNqMGEzNDhhL1VVUXhqdW53YW5uZlZENVRDCjV3cExLNnZmYkJQTjJScGw4NTM4b0R3RldweG1yQ1FoODNqRFpCSDRSbTFqbGpxc0Z3WVNudkZRS1RJd1dKRnMKd3pIdWNtUjZYcU96dGpiNjJZYnBjWlBHYkVrYXduYklOb20xOE80VXRTc1E0bk1MSHEwdTFqeDNOUDh2SmVJZwpISy9JaFA4TS80NHBqN1ZCNnpXY0pydzRWT3FMQWdNQkFBR2pXVEJYTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUIwR0ExVWREZ1FXQkJRVWJjdG0rWUd6bjZlS21CTWNQYU5GV0lCWW1qQVYKQmdOVkhSRUVEakFNZ2dwcmRXSmxjbTVsZEdWek1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQU81b01PSEZyNwp3QmhGNnFTNmtwbHo3WVphV3dqVHdISmVKMm1zdzFaNFV3aHFKYlhLWThyREhHRXk3L0YwRUpVNTZWZVdYVVlxCnZGNDROWFRGeG00czU0bEsrUlE5K3RzTmM0VHh3cHNoTU9EUVNFM1NTSWNJN25jUGpER2xINm83UjVGOEk5WHUKWXJQRmE2Z1N2aXcrUTY1Zk94VlJ2dnhOblFndzR0TzQ1eWxZMFB0S1RyNm5RRW95WDNjWnhRbk1SMkczdE5IcAo0NkZIODZUbFdMTUpEbDVGVkY5aDcrekFnMC9yS0h5V0N2bUxGd050R2J2NEJGclc3MFo5STgxYURha0VUczkxCjN3aGFxa2tweXdUYnpQcC9yc3V2Q3Npb0hBWERlcUJtZldGYUR0SUc3bmV2MXlhNXdHM3RXcEdvN1AxTnNhWVEKK1NOUS9DQWlnaG5qCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
    server: https://10.1.8.30:6443
  name: kubernetes-1
- cluster:
    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURCVENDQWUyZ0F3SUJBZ0lJZVRSVHJQVXhFWEV3RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TmpBNE1EVXdOelE0TWpaYUZ3MHpOakE0TURJd056VXpNalphTUJVeApFekFSQmdOVkJBTVRDbXQxWW1WeWJtVjBaWE13Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLCkFvSUJBUURONHovN1NONzBDYUNjanhOYTdzQ2JTeU5XY3JSSVZBMWFUK0VKaGduMlphRWc5WVBBa3J6eUp3T0QKNWJtbFdVaTRZMTV3Vnlvc0NsN2xWdFBXcllKUVhkQncvWGlzUFNJcFkvQzRxcFR5RkgzQm5DYlJOeUlyaHFtLwp1SDNqSVBBMFYwOVVSbysxTStYNStKNzMvZ1RsSXFNc1BpZXJzNGNqMGEzNDhhL1VVUXhqdW53YW5uZlZENVRDCjV3cExLNnZmYkJQTjJScGw4NTM4b0R3RldweG1yQ1FoODNqRFpCSDRSbTFqbGpxc0Z3WVNudkZRS1RJd1dKRnMKd3pIdWNtUjZYcU96dGpiNjJZYnBjWlBHYkVrYXduYklOb20xOE80VXRTc1E0bk1MSHEwdTFqeDNOUDh2SmVJZwpISy9JaFA4TS80NHBqN1ZCNnpXY0pydzRWT3FMQWdNQkFBR2pXVEJYTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUIwR0ExVWREZ1FXQkJRVWJjdG0rWUd6bjZlS21CTWNQYU5GV0lCWW1qQVYKQmdOVkhSRUVEakFNZ2dwcmRXSmxjbTVsZEdWek1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQU81b01PSEZyNwp3QmhGNnFTNmtwbHo3WVphV3dqVHdISmVKMm1zdzFaNFV3aHFKYlhLWThyREhHRXk3L0YwRUpVNTZWZVdYVVlxCnZGNDROWFRGeG00czU0bEsrUlE5K3RzTmM0VHh3cHNoTU9EUVNFM1NTSWNJN25jUGpER2xINm83UjVGOEk5WHUKWXJQRmE2Z1N2aXcrUTY1Zk94VlJ2dnhOblFndzR0TzQ1eWxZMFB0S1RyNm5RRW95WDNjWnhRbk1SMkczdE5IcAo0NkZIODZUbFdMTUpEbDVGVkY5aDcrekFnMC9yS0h5V0N2bUxGd050R2J2NEJGclc3MFo5STgxYURha0VUczkxCjN3aGFxa2tweXdUYnpQcC9yc3V2Q3Npb0hBWERlcUJtZldGYUR0SUc3bmV2MXlhNXdHM3RXcEdvN1AxTnNhWVEKK1NOUS9DQWlnaG5qCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
    server: https://10.1.8.30:6443
  name: kubernetes-2
contexts:
- context:
    cluster: kubernetes-1
    namespace: default
    user: kubernetes-1-admin
  name: kubernetes-1-admin@kubernetes-1
- context:
    cluster: kubernetes-2
    namespace: webapp
    user: kubernetes-2-admin
  name: kubernetes-2-admin@kubernetes-2
current-context: kubernetes-1-admin@kubernetes-1
kind: Config
preferences: {}
users:
- name: kubernetes-1-admin
  user:
    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLVENDQWhHZ0F3SUJBZ0lJZnROelNrckpMTG93RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TmpBNE1EVXdOelE0TWpaYUZ3MHlOekE0TURVd056VXpNamRhTUR3eApIekFkQmdOVkJBb1RGbXQxWW1WaFpHMDZZMngxYzNSbGNpMWhaRzFwYm5NeEdUQVhCZ05WQkFNVEVHdDFZbVZ5CmJtVjBaWE10WVdSdGFXNHdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDKytLeHcKWWtjNXZWb2NicmJ5Z09EaWorc1lockxaTkwwODJNRGdkKzMvazZONXFpUlcySzB4MWlSRlNxd1FuQXlyR2RBeAozK3ByTlBHVmordkRZMjhjUnZiRzMvUDBRSytmaU9qNUpOQmY1WkJ1V3ZvZDRJT2ZPbGlvYlZPSWN6M1cyU294ClFFZTkrUHFFQzh0aXUrVHZ4VEdjRE1UMTYweXlZd2MwOHhyL2RZNzhGRW4rM1BweUFLRGZoNlVldXcvS0V5TmYKSUpKUW1TbTdFL2pHd3pMTWFpVzZmbkltTEhyYXdvZTJuc1lCclkvR210NkxQODZJdy9NS0RwMjgvSmxTWVhQTwpZQkdCbzRiSDR2aHZDLzN0SkcwUzQ3empQSlhSYTBiK0piS0czVzRTQ2ZnMzBhR2FqZVozVldkcVYxSkVaWDlLCnhySVV6R2l5YWlPa1ViMkRBZ01CQUFHalZqQlVNQTRHQTFVZER3RUIvd1FFQXdJRm9EQVRCZ05WSFNVRUREQUsKQmdnckJnRUZCUWNEQWpBTUJnTlZIUk1CQWY4RUFqQUFNQjhHQTFVZEl3UVlNQmFBRkJSdHkyYjVnYk9mcDRxWQpFeHc5bzBWWWdGaWFNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUNJam40MGV6WEhxZnZ1VmlFMDJmZTJkNTVQCmNxb2JBSmM2cXU5WVB4SFdKZE00WEhHaXdEVGpDZll4dzRmQ3J6OFVNZGFIRFJoWkQ4eWoydXVBWWtWWmJrV1UKbTRGUytVeEZ3TGlCRU1aRFozN1drRTZ5QmEwWC9VSWFvUU9EaDhBdGxwMDJMaUJ2dTZ5bUdyQk85WEU2SUh3dAo5elRuVXVJWXpJZER4REhPQ1JUQWRXNk1qVHplNytZVExZVTlzVmFWL0tKV1VwUllGQWt3MUxkSjVCZDllcHM5CnpSazdOaVZvYk9KUUk3R1VUYUxSUnB3UUk0N0Z5TTV3OEhCcXZiclkyaytScjVrSGM4K0VpMUZsbXBqOG1Zb2QKa3I5QkRINFllbjJlOU5LN1lpakl5bXlwOHNNWGc3OGJacjdFYUR1RUw5NlBNVUpISS9sWWhDUktZQ05kCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
    client-key-data: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBdnZpc2NHSkhPYjFhSEc2MjhvRGc0by9yR0lheTJUUzlQTmpBNEhmdC81T2plYW9rClZ0aXRNZFlrUlVxc0VKd01xeG5RTWQvcWF6VHhsWS9ydzJOdkhFYjJ4dC96OUVDdm40am8rU1RRWCtXUWJscjYKSGVDRG56cFlxRzFUaUhNOTF0a3FNVUJIdmZqNmhBdkxZcnZrNzhVeG5BekU5ZXRNc21NSE5QTWEvM1dPL0JSSgovdHo2Y2dDZzM0ZWxIcnNQeWhNalh5Q1NVSmtwdXhQNHhzTXl6R29sdW41eUppeDYyc0tIdHA3R0FhMlB4cHJlCml6L09pTVB6Q2c2ZHZQeVpVbUZ6em1BUmdhT0d4K0w0Ynd2OTdTUnRFdU84NHp5VjBXdEcvaVd5aHQxdUVnbjQKTjlHaG1vM21kMVZuYWxkU1JHVi9Tc2F5Rk14b3Ntb2pwRkc5Z3dJREFRQUJBb0lCQUZYY0JlTk5QRXFvYUZBcQpNdFNhdndEOXhhdzBPMHJPbkZvejladTJMK25kWGYxQVVyQTlJTGtzVndoVVIwSDhkdkdpWEdsZ0M4d0JkTEJTCmthUTZHMlZ5UGxjeHIwUGNwVmtydTlyd0EwTnFPZUp6d3NvVisvZGx5eUNHYnEwRmF3TWloZ2E0cU1pdm5Tb3IKQjFrdnN3RmQvaXp6ek1YbjhZYXVZVG9jSnNJOU9JS3BNTUJtK3Fhd0VmcHRtYTJsaURVYVRiYXppY1o1NmlQeQpDblkrZTluZEh1MzJTUUw3OFVEcFN6ZjY2dnhnSGpQNTFHRXY2Y3h3NUphMzFycEd6MHBaY2xxbXFKMDJYQ251CkFoVDlwQzlVUmRUeFdEMDJSdVhuS0w0c2JqaVp6Wk1MZHdiSS9UYVhnbHZLNDRPM3p1VmJ0bExTM0ozdnNZV24KSWVKVmQva0NnWUVBMU9qYjAwTDdGNlpGMnB4b1J4T3NmL3BTL01BdURBMWMrUmVNdWpUdDROemxsZWcwOVpKQgpsRkpySE9CVkQ5Vmt1T2E3eFpQN2JTaG02b216bkxhRGwzQVhVRzEyVFFvVkxtNWZuYTY0Snl3ZTU0ZVExem9mCkpYVmUvbGpsWlJXSkY4RVZYQUYwQkRBYzlBVm0yNE9OcWFTaEl6L0hMS01pWC9Bak9nS3hXRlVDZ1lFQTVaOHEKU2lZei81TUQxQkJEMlRiM01Rc0NSUzF4Q2ZvTU8rclpTTVJvZjZSQVpUamI1Sm1rdjlQZEo2R0JaMXZ1SElLYwplejljSUNSTG5PcjVhZGJ4Y3E2emJ4aVZTZitMall1aVh4emduUXYyYi9waWJoOWJvT3pxYi9VQ0RtaXpwNXJrCmN3dU85S1FaVi9jRVE3Yk1zYnBiUnhMUTR6RTJQZG1VK3hVQTluY0NnWUVBdkJmRUxNMmQyblRRZmFOMEZHYnoKSEZUZi85OGdUeEYzTTdCMGFRVGRxcXc4UDhWWEZDUlR2MTlZdGJnU0xkek9FUFAycTBSaStUcWFRVlhKMGdjRQpGa08ydFIwZlNFeENEalVBVCtQTldQNEhoM0FpcTZIelpqcGM0OE5SVlk1REFUTlpWV0VMUjYvaHhFc0paYURCCkJFQW5BMmNTNVFKeUdlT2ltMXRKcGNrQ2dZQjJZdXFOMGthSzVVUmJDSXZDcVFrbld2S3ZzZThPNHNGOS91WksKRXlHQmRiRFJ2MC8zKzVNcVo5UWxBNnJSSEYrV2lXeWVTcHQzNHQ2dEo2U3lBZVQ0YU1RUWFrOUdHSi9kdVhsYwpxbW5QN29QL1ZjdDcxV1VMZ2pxWXdHeHYrMkZzNzNvTEtwRm81bFkrdVJlVXhlR2hYR0NGTTFsSldXMEsxR3h3ClMzTDBud0tCZ0hKVEo4bUQxcFRwUGgxaVEwakc2THliem9MeVU2UHBmZmpya2JJY3VCa0xBYjhkclJudzVPWEIKWE5pTmF1Q1orZ0pkQVFtRGlCVitQNTVqamhRSzVqSzVOQXE4dTNoaEpJcVNWQWIwREwyTmJlcTRKeEJTbDgyTApObnZVRTNOdWJ0c0VvdVVjMXMxTVZFa1FLaktqdXVQS1cwa1h1Vndwa0hIL1Q2VFhsbktzCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
- name: kubernetes-2-admin
  user:
    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLVENDQWhHZ0F3SUJBZ0lJZnROelNrckpMTG93RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TmpBNE1EVXdOelE0TWpaYUZ3MHlOekE0TURVd056VXpNamRhTUR3eApIekFkQmdOVkJBb1RGbXQxWW1WaFpHMDZZMngxYzNSbGNpMWhaRzFwYm5NeEdUQVhCZ05WQkFNVEVHdDFZbVZ5CmJtVjBaWE10WVdSdGFXNHdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDKytLeHcKWWtjNXZWb2NicmJ5Z09EaWorc1lockxaTkwwODJNRGdkKzMvazZONXFpUlcySzB4MWlSRlNxd1FuQXlyR2RBeAozK3ByTlBHVmordkRZMjhjUnZiRzMvUDBRSytmaU9qNUpOQmY1WkJ1V3ZvZDRJT2ZPbGlvYlZPSWN6M1cyU294ClFFZTkrUHFFQzh0aXUrVHZ4VEdjRE1UMTYweXlZd2MwOHhyL2RZNzhGRW4rM1BweUFLRGZoNlVldXcvS0V5TmYKSUpKUW1TbTdFL2pHd3pMTWFpVzZmbkltTEhyYXdvZTJuc1lCclkvR210NkxQODZJdy9NS0RwMjgvSmxTWVhQTwpZQkdCbzRiSDR2aHZDLzN0SkcwUzQ3empQSlhSYTBiK0piS0czVzRTQ2ZnMzBhR2FqZVozVldkcVYxSkVaWDlLCnhySVV6R2l5YWlPa1ViMkRBZ01CQUFHalZqQlVNQTRHQTFVZER3RUIvd1FFQXdJRm9EQVRCZ05WSFNVRUREQUsKQmdnckJnRUZCUWNEQWpBTUJnTlZIUk1CQWY4RUFqQUFNQjhHQTFVZEl3UVlNQmFBRkJSdHkyYjVnYk9mcDRxWQpFeHc5bzBWWWdGaWFNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUNJam40MGV6WEhxZnZ1VmlFMDJmZTJkNTVQCmNxb2JBSmM2cXU5WVB4SFdKZE00WEhHaXdEVGpDZll4dzRmQ3J6OFVNZGFIRFJoWkQ4eWoydXVBWWtWWmJrV1UKbTRGUytVeEZ3TGlCRU1aRFozN1drRTZ5QmEwWC9VSWFvUU9EaDhBdGxwMDJMaUJ2dTZ5bUdyQk85WEU2SUh3dAo5elRuVXVJWXpJZER4REhPQ1JUQWRXNk1qVHplNytZVExZVTlzVmFWL0tKV1VwUllGQWt3MUxkSjVCZDllcHM5CnpSazdOaVZvYk9KUUk3R1VUYUxSUnB3UUk0N0Z5TTV3OEhCcXZiclkyaytScjVrSGM4K0VpMUZsbXBqOG1Zb2QKa3I5QkRINFllbjJlOU5LN1lpakl5bXlwOHNNWGc3OGJacjdFYUR1RUw5NlBNVUpISS9sWWhDUktZQ05kCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
    client-key-data: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBdnZpc2NHSkhPYjFhSEc2MjhvRGc0by9yR0lheTJUUzlQTmpBNEhmdC81T2plYW9rClZ0aXRNZFlrUlVxc0VKd01xeG5RTWQvcWF6VHhsWS9ydzJOdkhFYjJ4dC96OUVDdm40am8rU1RRWCtXUWJscjYKSGVDRG56cFlxRzFUaUhNOTF0a3FNVUJIdmZqNmhBdkxZcnZrNzhVeG5BekU5ZXRNc21NSE5QTWEvM1dPL0JSSgovdHo2Y2dDZzM0ZWxIcnNQeWhNalh5Q1NVSmtwdXhQNHhzTXl6R29sdW41eUppeDYyc0tIdHA3R0FhMlB4cHJlCml6L09pTVB6Q2c2ZHZQeVpVbUZ6em1BUmdhT0d4K0w0Ynd2OTdTUnRFdU84NHp5VjBXdEcvaVd5aHQxdUVnbjQKTjlHaG1vM21kMVZuYWxkU1JHVi9Tc2F5Rk14b3Ntb2pwRkc5Z3dJREFRQUJBb0lCQUZYY0JlTk5QRXFvYUZBcQpNdFNhdndEOXhhdzBPMHJPbkZvejladTJMK25kWGYxQVVyQTlJTGtzVndoVVIwSDhkdkdpWEdsZ0M4d0JkTEJTCmthUTZHMlZ5UGxjeHIwUGNwVmtydTlyd0EwTnFPZUp6d3NvVisvZGx5eUNHYnEwRmF3TWloZ2E0cU1pdm5Tb3IKQjFrdnN3RmQvaXp6ek1YbjhZYXVZVG9jSnNJOU9JS3BNTUJtK3Fhd0VmcHRtYTJsaURVYVRiYXppY1o1NmlQeQpDblkrZTluZEh1MzJTUUw3OFVEcFN6ZjY2dnhnSGpQNTFHRXY2Y3h3NUphMzFycEd6MHBaY2xxbXFKMDJYQ251CkFoVDlwQzlVUmRUeFdEMDJSdVhuS0w0c2JqaVp6Wk1MZHdiSS9UYVhnbHZLNDRPM3p1VmJ0bExTM0ozdnNZV24KSWVKVmQva0NnWUVBMU9qYjAwTDdGNlpGMnB4b1J4T3NmL3BTL01BdURBMWMrUmVNdWpUdDROemxsZWcwOVpKQgpsRkpySE9CVkQ5Vmt1T2E3eFpQN2JTaG02b216bkxhRGwzQVhVRzEyVFFvVkxtNWZuYTY0Snl3ZTU0ZVExem9mCkpYVmUvbGpsWlJXSkY4RVZYQUYwQkRBYzlBVm0yNE9OcWFTaEl6L0hMS01pWC9Bak9nS3hXRlVDZ1lFQTVaOHEKU2lZei81TUQxQkJEMlRiM01Rc0NSUzF4Q2ZvTU8rclpTTVJvZjZSQVpUamI1Sm1rdjlQZEo2R0JaMXZ1SElLYwplejljSUNSTG5PcjVhZGJ4Y3E2emJ4aVZTZitMall1aVh4emduUXYyYi9waWJoOWJvT3pxYi9VQ0RtaXpwNXJrCmN3dU85S1FaVi9jRVE3Yk1zYnBiUnhMUTR6RTJQZG1VK3hVQTluY0NnWUVBdkJmRUxNMmQyblRRZmFOMEZHYnoKSEZUZi85OGdUeEYzTTdCMGFRVGRxcXc4UDhWWEZDUlR2MTlZdGJnU0xkek9FUFAycTBSaStUcWFRVlhKMGdjRQpGa08ydFIwZlNFeENEalVBVCtQTldQNEhoM0FpcTZIelpqcGM0OE5SVlk1REFUTlpWV0VMUjYvaHhFc0paYURCCkJFQW5BMmNTNVFKeUdlT2ltMXRKcGNrQ2dZQjJZdXFOMGthSzVVUmJDSXZDcVFrbld2S3ZzZThPNHNGOS91WksKRXlHQmRiRFJ2MC8zKzVNcVo5UWxBNnJSSEYrV2lXeWVTcHQzNHQ2dEo2U3lBZVQ0YU1RUWFrOUdHSi9kdVhsYwpxbW5QN29QL1ZjdDcxV1VMZ2pxWXdHeHYrMkZzNzNvTEtwRm81bFkrdVJlVXhlR2hYR0NGTTFsSldXMEsxR3h3ClMzTDBud0tCZ0hKVEo4bUQxcFRwUGgxaVEwakc2THliem9MeVU2UHBmZmpya2JJY3VCa0xBYjhkclJudzVPWEIKWE5pTmF1Q1orZ0pkQVFtRGlCVitQNTVqamhRSzVqSzVOQXE4dTNoaEpJcVNWQWIwREwyTmJlcTRKeEJTbDgyTApObnZVRTNOdWJ0c0VvdVVjMXMxTVZFa1FLaktqdXVQS1cwa1h1Vndwa0hIL1Q2VFhsbktzCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==

查看集群列表

root@master30 ~ 18:38:30# kubectl config get-clusters 
NAME
kubernetes-2
kubernetes-1

查看上下文列表

root@master30 ~ 18:39:24# kubectl config get-contexts 
CURRENT   NAME                              CLUSTER        AUTHINFO             NAMESPACE
*         kubernetes-1-admin@kubernetes-1   kubernetes-1   kubernetes-1-admin   default
          kubernetes-2-admin@kubernetes-2   kubernetes-2   kubernetes-2-admin   webapp

列表中*标记代表当前正在使用的上下文。

切换上下文

root@master30 ~ 18:39:38# kubectl config use-context kubernetes-2-admin@kubernetes-2 
Switched to context "kubernetes-2-admin@kubernetes-2".
root@master30 ~ 18:40:28# kubectl config get-contexts 
CURRENT   NAME                              CLUSTER        AUTHINFO             NAMESPACE
          kubernetes-1-admin@kubernetes-1   kubernetes-1   kubernetes-1-admin   default
*         kubernetes-2-admin@kubernetes-2   kubernetes-2   kubernetes-2-admin   webapp
kubectx - 第三方工具

kubectx 安装步骤

root@master30 ~ 18:50:27# wget https://codeload.github.com/ahmetb/kubectx/zip/refs/heads/master -O kubectx.zip
root@master30 ~ 18:51:22# unzip kubectx.zip
root@master30 ~ 18:51:31# ls kubectx-master/
CONTRIBUTING.md  LICENSE  README.md  cmd  completion  go.mod  go.sum  img  internal  kubectx  kubens  test
root@master30 ~ 18:51:51# cp kubectx-master/kubectx /usr/local/bin/
root@master30 ~ 18:52:26# chmod +x /usr/local/bin/kubectx 
# 配置命令自动补全
root@master30 ~ 18:52:41# cp kubectx-master/completion/kubectx.bash /etc/bash_completion.d/
root@master30 ~ 18:53:00# source /etc/bash_completion.d/kubectx.bash

kubectx 帮助文档

root@master30 ~ 18:53:23# kubectx -h
Manage and switch between kubectl contexts.
USAGE:
  kubectx                       : list the contexts
  kubectx <NAME>                : switch to context <NAME>
  kubectx -                     : switch to the previous context
  kubectx -c, --current         : show the current context name
  kubectx <NEW_NAME>=<NAME>     : rename context <NAME> to <NEW_NAME>
  kubectx <NEW_NAME>=.          : rename current-context to <NEW_NAME>
  kubectx -d <NAME> [<NAME...>] : delete context <NAME> ('.' for current-context)
                                  (this command won't delete the user/cluster entry
                                  that is used by the context)
  kubectx -u, --unset           : unset the current context
  kubectx -h,--help             : show this message
  (This executable is the legacy bash-based implementation, consider upgrading to Go-based implementation.)

kubectx 常用操作命令

root@master30 ~ 18:53:38# kubectx 
kubernetes-1-admin@kubernetes-1
kubernetes-2-admin@kubernetes-2
root@master30 ~ 18:53:58# kubectx -c
kubernetes-1-admin@kubernetes-1
root@master30 ~ 18:54:10# kubectx kubernetes-1-admin@kubernetes-1 
Switched to context "kubernetes-1-admin@kubernetes-1".
root@master30 ~ 18:54:34# kubectx -c
kubernetes-1-admin@kubernetes-1
root@master30 ~ 18:54:51# kubectx -u
Unsetting current context.
Property "current-context" unset.
root@master30 ~ 18:55:09# kubectx -c
error: current-context is not set

Kubernetes Pod

学习参考：Pod

环境准备

root@master30 ~ 10:19:36# kubectl create ns pods
root@master30 ~ 10:20:04# kubectl config set-context --current --namespace pods

Pod 介绍

Pod 是 Kubernetes 中的基础调度单元，官方定义为：a single instance of an application in Kubernetes。

Kubernetes 通过定义 Pod 资源，并在其内部运行容器；容器需指定镜像，用于承载具体业务服务。Pod 代表集群中一组正在运行的进程，单个 Pod 可封装一个或多个容器，Pod 内所有容器共享存储、网络等核心资源。我们可以将 Pod 类比为一台独立虚拟机，而容器则是运行在这台虚拟机内部的业务进程。

  • 单容器 Pod：将 Pod 视作单个容器的封装载体，Kubernetes 直接管理 Pod，而非底层容器。
  • **多容器 Pod：**Pod 可封装一组协同工作的业务容器，这些容器会被调度至集群同一台物理机或虚拟机上运行。Pod 内部容器共享资源与依赖，支持相互通信，生命周期同步启停。Pod 将多容器、网络资源、存储资源封装为统一的可管理实体。同一 Pod 内所有容器共享网络与存储资源。
  • 集群会为每个 Pod 分配唯一 IP 地址，Pod 内全部容器共用同一个网络命名空间，共享 IP 与端口空间，容器之间可通过 localhost直接通信；Pod 与集群内其他 Pod 通信时，则依托自身统一网络资源完成。Pod 可挂载多组数据卷，卷资源对 Pod 内所有容器可见。

通俗解释： 可以把 Pod 理解为一个豌豆荚，荚内的每一颗豌豆对应一个容器。同一豌豆荚内的豌豆共用水分、养分等资源，同理，Pod 内部所有容器共享 Pod 层面的网络、存储资源。

在这里插入图片描述

例如：web容器提供文件共享，另外一个容器负责更新文件内容。

在这里插入图片描述

pod 基本管理

创建 pod

# 空运行，只生成yaml文件
root@master30 ~ 10:25:18# kubectl run web --image=hub.liu.cloud/library/nginx --dry-run=client -o yaml

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: web
  name: web
spec:
  containers:
  - image: docker.io/library/nginx
    name: web
    resources: {}
  dnsPolicy: ClusterFirst
  restartPolicy: Always
status: {}

# 直接创建pod
root@master30 ~ 10:38:01# kubectl run web --image=hub.liu.cloud/library/nginx --dry-run=client -o yaml
apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: web
  name: web
spec:
  containers:
  - image: hub.laoma.cloud/library/nginx
    name: web
    resources: {}
  dnsPolicy: ClusterFirst
  restartPolicy: Always
status: {}


root@master30 ~ 10:39:27# kubectl get pod
NAME   READY   STATUS    RESTARTS      AGE
web    1/1     Running   2 (43m ago)   17h
root@master30 ~ 10:40:25# kubectl get pod -o wide 
NAME   READY   STATUS    RESTARTS      AGE   IP              NODE                 NOMINATED NODE   READINESS GATES
web    1/1     Running   2 (43m ago)   17h   10.224.133.67   worker31.liu.cloud   <none>           <none>
root@master30 ~ 10:40:43# ssh root@worker31 nerdctl ps --namespace k8s.io |grep web
1e705e3958eb    docker.io/library/nginx:latest                   "/docker-entrypoint.…"    44 minutes ago    Up                 k8s://liu/web/web
c04def71cc52    hub.laoma.cloud/kubernetes/pause:3.9             "/pause"                  44 minutes ago    Up                 k8s://liu/web
root@master30 ~ 10:41:35# ssh root@worker31 nerdctl images --namespace k8s.io |grep nginx
nginx                                    latest     8541484afbc9    18 hours ago    linux/amd64    166.5 MiB    60.2 MiB
nginx                                    <none>     21f8c0e3416b    18 hours ago    linux/amd64    166.5 MiB    60.2 MiB
nginx                                    <none>     8541484afbc9    2 hours ago     linux/amd64    166.5 MiB    60.2 MiB

查看 pod

# 以yaml格式查看pod
root@master30 ~ 10:41:53# kubectl get pod web -o yaml
apiVersion: v1
kind: Pod
metadata:
  annotations:
    cni.projectcalico.org/containerID: c04def71cc5254672d97d01ce807a1bfbd01eb3a98aa3fba1c72e5ff5525f0c7
    cni.projectcalico.org/podIP: 10.224.133.67/32
    cni.projectcalico.org/podIPs: 10.224.133.67/32
  creationTimestamp: "2026-08-05T08:57:29Z"
  labels:
    run: web
  name: web
  namespace: liu
  resourceVersion: "27513"
  uid: 8ef41379-2057-4f6d-b612-3e93c0a9fc7e
spec:
  containers:
  - image: nginx
    imagePullPolicy: Always
    name: web
    resources: {}
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: kube-api-access-srbzb
      readOnly: true
  dnsPolicy: ClusterFirst
  enableServiceLinks: true
  nodeName: worker31.liu.cloud
  preemptionPolicy: PreemptLowerPriority
  priority: 0
  restartPolicy: Always
  schedulerName: default-scheduler
  securityContext: {}
  serviceAccount: default
  serviceAccountName: default
  terminationGracePeriodSeconds: 30
  tolerations:
  - effect: NoExecute
    key: node.kubernetes.io/not-ready
    operator: Exists
    tolerationSeconds: 300
  - effect: NoExecute
    key: node.kubernetes.io/unreachable
    operator: Exists
    tolerationSeconds: 300
  volumes:
  - name: kube-api-access-srbzb
    projected:
      defaultMode: 420
      sources:
      - serviceAccountToken:
          expirationSeconds: 3607
          path: token
      - configMap:
          items:
          - key: ca.crt
            path: ca.crt
          name: kube-root-ca.crt
      - downwardAPI:
          items:
          - fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
            path: namespace
status:
  conditions:
  - lastProbeTime: null
    lastTransitionTime: "2026-08-06T01:57:24Z"
    status: "True"
    type: PodReadyToStartContainers
  - lastProbeTime: null
    lastTransitionTime: "2026-08-05T08:57:29Z"
    status: "True"
    type: Initialized
  - lastProbeTime: null
    lastTransitionTime: "2026-08-06T01:57:24Z"
    status: "True"
    type: Ready
  - lastProbeTime: null
    lastTransitionTime: "2026-08-06T01:57:24Z"
    status: "True"
    type: ContainersReady
  - lastProbeTime: null
    lastTransitionTime: "2026-08-05T08:57:29Z"
    status: "True"
    type: PodScheduled
  containerStatuses:
  - containerID: containerd://1e705e3958eb7df99b7785ce52b099304e554fc626e3e5f234c4846e966b0cf0
    image: docker.io/library/nginx:latest
    imageID: docker.io/library/nginx@sha256:21f8c0e3416b84eeec895c80077da69e2d25938cb0fc4bcc6a2ea33699b75703
    lastState:
      terminated:
        containerID: containerd://2765385237f1b8245f3aa0eaea7e94d66549039849eacdd786f2f343ad2310d8
        exitCode: 255
        finishedAt: "2026-08-06T01:56:47Z"
        reason: Unknown
        startedAt: "2026-08-06T01:00:27Z"
    name: web
    ready: true
    restartCount: 2
    started: true
    state:
      running:
        startedAt: "2026-08-06T01:57:24Z"
  hostIP: 10.1.8.31
  hostIPs:
  - ip: 10.1.8.31
  phase: Running
  podIP: 10.224.133.67
  podIPs:
  - ip: 10.224.133.67
  qosClass: BestEffort
  startTime: "2026-08-05T08:57:29Z"


# 查看pod
root@master30 ~ 10:42:15# kubectl describe pod web 
Name:             web
Namespace:        liu
Priority:         0
Service Account:  default
Node:             worker31.liu.cloud/10.1.8.31
Start Time:       Wed, 05 Aug 2026 16:57:29 +0800
Labels:           run=web
Annotations:      cni.projectcalico.org/containerID: c04def71cc5254672d97d01ce807a1bfbd01eb3a98aa3fba1c72e5ff5525f0c7
                  cni.projectcalico.org/podIP: 10.224.133.67/32
                  cni.projectcalico.org/podIPs: 10.224.133.67/32
Status:           Running
IP:               10.224.133.67
IPs:
  IP:  10.224.133.67
Containers:
  web:
    Container ID:   containerd://1e705e3958eb7df99b7785ce52b099304e554fc626e3e5f234c4846e966b0cf0
    Image:          nginx
    Image ID:       docker.io/library/nginx@sha256:21f8c0e3416b84eeec895c80077da69e2d25938cb0fc4bcc6a2ea33699b75703
    Port:           <none>
    Host Port:      <none>
    State:          Running
      Started:      Thu, 06 Aug 2026 09:57:24 +0800
    Last State:     Terminated
      Reason:       Unknown
      Exit Code:    255
      Started:      Thu, 06 Aug 2026 09:00:27 +0800
      Finished:     Thu, 06 Aug 2026 09:56:47 +0800
    Ready:          True
    Restart Count:  2
    Environment:    <none>
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-srbzb (ro)
Conditions:
  Type                        Status
  PodReadyToStartContainers   True 
  Initialized                 True 
  Ready                       True 
  ContainersReady             True 
  PodScheduled                True 
Volumes:
  kube-api-access-srbzb:
    Type:                    Projected (a volume that contains injected data from multiple sources)
    TokenExpirationSeconds:  3607
    ConfigMapName:           kube-root-ca.crt
    ConfigMapOptional:       <nil>
    DownwardAPI:             true
QoS Class:                   BestEffort
Node-Selectors:              <none>
Tolerations:                 node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                             node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
  Type    Reason          Age                  From     Message
  ----    ------          ----                 ----     -------
  Normal  SandboxChanged  102m (x2 over 102m)  kubelet  Pod sandbox changed, it will be killed and re-created.
  Normal  Pulling         102m                 kubelet  Pulling image "nginx"
  Normal  Pulled          102m                 kubelet  Successfully pulled image "nginx" in 6.199s (6.199s including waiting). Image size: 63135215 bytes.
  Normal  Created         102m                 kubelet  Created container web
  Normal  Started         102m                 kubelet  Started container web
  Normal  SandboxChanged  45m (x2 over 45m)    kubelet  Pod sandbox changed, it will be killed and re-created.
  Normal  Pulling         45m                  kubelet  Pulling image "nginx"
  Normal  Pulled          45m                  kubelet  Successfully pulled image "nginx" in 1.04s (1.04s including waiting). Image size: 63135215 bytes.
  Normal  Created         45m                  kubelet  Created container web
  Normal  Started         45m                  kubelet  Started container web


# 查看pod标准输出，可以是哟个选项-f动态查看pod输出
root@master30 ~ 10:42:29# kubectl logs -f web 
/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
...

编辑 pod

root@master30 ~ 10:42:47# kubectl edit pod web

提示：并不是所有属性都可以编辑，例如pod名称。如果非要编辑特定属性，可以先删除pod，然后修改pod对的yaml文件，重新创建。

pod 中执行命令

root@master30 ~ 10:43:49# kubectl exec web -- hostname
web
root@master30 ~ 10:44:16# kubectl exec web -- pwd
/
root@master30 ~ 10:46:20# kubectl exec web -- id
uid=0(root) gid=0(root) groups=0(root)

cp 文件给 pod

root@master30 ~ 10:46:25# kubectl cp /etc/hosts web:/new-hosts
root@master30 ~ 10:47:22# kubectl exec web -- ls /new-hosts
/new-hosts

删除 pod

root@master30 ~ 10:51:20# kubectl delete pod web
pod "web" deleted

删除时间

root@master30 ~ 10:51:40# kubectl get pod web -o yaml|grep 'terminationGracePeriodSeconds'
terminationGracePeriodSeconds: 30

yaml 文件创建 pod

# web.yaml
apiVersion: v1
kind: Pod
metadata:
  labels:
    run: web
  name: web
spec:
  containers:
  - image: docker.io/library/nginx
    name: web

root@master30 ~ 11:14:23# kubectl delete pod web
pod "web" deleted
# 或者
root@master30 ~ 11:14:35# kubectl apply -f web.yaml

综合实验：构建 wordpreess

  1. 创建 pod-mysql 数据库
  2. 创建 pod-wordpress 博客

参考步骤：

# 创建 pod-mysql 数据库
root@master30 ~ 11:15:25# kubectl run wordpress-db --image=hub.laoma.cloud/library/mysql --env MYSQL_ROOT_PASSWORD=123
pod/wordpress-db created

# 创建 pod-wordpress 博客
root@master30 ~ 11:16:09#  kubectl run wordpress-app --image=hub.laoma.cloud/library/wordpress
pod/wordpress-app created


# 实现集群外访问集群内pod
root@master30 ~ 11:16:32# kubectl port-forward pods/wordpress-app --address 10.1.8.30 80:80
Forwarding from 10.1.8.30:80 -> 80

Handling connection for 80
...
# 该命令窗口不要关闭

# 查看 IP
root@master30 ~ 11:17:26# kubectl get pods -o wide | awk '{print $1" "$6}'
NAME IP
web 10.224.133.69
wordpress-app 10.224.133.70
wordpress-db 10.224.218.132

# 创建数据库
root@master30 ~ 11:20:07# kubectl exec -it wordpress-db -- mysql -uroot -p123
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 9
Server version: 9.6.0 MySQL Community Server - GPL

Copyright (c) 2000, 2026, Oracle and/or its affiliates.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> create database wordpress;
Query OK, 1 row affected (0.005 sec)

mysql> create user wordpress identified by '123';
Query OK, 0 rows affected (0.008 sec)

mysql> grant all privileges on wordpress.* to wordpress;
Query OK, 0 rows affected (0.003 sec)

mysql> flush privileges;
Query OK, 0 rows affected, 1 warning (0.004 sec)

访问web页面 http://10.1.8.30:80，配置站点。

多容器 pod

示例文件：blog.yaml

root@master30 ~ 11:30:26# vim pod-blog.yaml

apiVersion: v1
kind: Pod
metadata:
  name: bbs
  labels:
    run: bbs
spec:
  containers:
  - image: hub.laoma.cloud/library/mysql:latest
    imagePullPolicy: IfNotPresent
    name: mysql
    env:
    - name: MYSQL_ROOT_PASSWORD
      value: "123"
    - name: MYSQL_USER
      value: tom
    - name: MYSQL_PASSWORD
      value: "123"
    - name: MYSQL_DATABASE
      value: bbs
    ports:
    - containerPort: 3306
      name: mysql
      protocol: TCP
  - image: hub.laoma.cloud/library/wordpress:latest
    imagePullPolicy: IfNotPresent
    name: wordpress
    env:
    - name: WORDPRESS_DB_USER
      value: tom
    - name: WORDPRESS_DB_PASSWORD
      value: "123"
    - name: WORDPRESS_DB_NAME
      value: bbs
    - name: WORDPRESS_DB_HOST
      value: 127.0.0.1
    ports:
    - containerPort: 80
      name: wordpress
      protocol: TCP
      hostPort: 80

root@master30 ~ 11:39:20# kubectl apply -f pod-blog.yaml 
pod/bbs created

# 查看 pod 运行节点
root@master30 ~ 11:39:33# kubectl get pods -o wide 
NAME   READY   STATUS    RESTARTS   AGE   IP              NODE                 NOMINATED NODE   READINESS GATES
bbs    2/2     Running   0          18s   10.224.133.71   worker31.liu.cloud   <none>           <none>

# 多容器pod中执行命令，通过-c指定容器
root@master30 ~ 11:39:51# kubectl exec bbs -c wordpress -- hostname
bbs
root@master30 ~ 11:40:07# 
root@master30 ~ 11:40:07# kubectl cp /etc/hosts bbs:/new-hosts -c wordpress
root@master30 ~ 11:40:17# kubectl exec bbs -c wordpress -- ls /new-hosts
/new-hosts

数据库访问测试

root@master30 ~ 11:40:28# kubectl exec bbs -c mysql -it -- mysql -utom -p123 -e 'show databases;'
mysql: [Warning] Using a password on the command line interface can be insecure.
+--------------------+
| Database           |
+--------------------+
| bbs                |
| information_schema |
| performance_schema |
+--------------------+

root@master30 ~ 11:40:40# kubectl port-forward pod/bbs --address 10.1.8.30 80:80
Forwarding from 10.1.8.30:80 -> 80
Handling connection for 80
Handling connection for 80
Handling connection for 80

使用所在宿主机的80端口访问：http://10.1.8.30/

在这里插入图片描述

pod 关键属性

root@master30 ~ 13:51:29# kubectl explain pod | grep '^  [a-zA-Z]'
  apiVersion	<string>
  kind	<string>
  metadata	<ObjectMeta>
  spec	<PodSpec>
  status	<PodStatus>

pod.metadata

root@master30 ~ 13:52:24# kubectl explain pod.metadata | grep '^  [a-zA-Z]'
   annotations	<map[string]string>
   clusterName	<string>
   creationTimestamp	<string>
   deletionGracePeriodSeconds	<integer>
   deletionTimestamp	<string>
   finalizers	<[]string>
   generateName	<string>
   generation	<integer>
   labels	<map[string]string>
   managedFields	<[]Object>
   name	<string>
   namespace	<string>
   ownerReferences	<[]Object>
   resourceVersion	<string>
   selfLink	<string>
   uid	<string>

需要关注的属性：labels，name，namespace。

pod.spec

root@master30 ~ 13:52:32# kubectl explain pod.spec | grep '^  [a-zA-Z]'
  activeDeadlineSeconds	<integer>
  affinity	<Affinity>
  automountServiceAccountToken	<boolean>
  containers	<[]Container> -required-
  dnsConfig	<PodDNSConfig>
  dnsPolicy	<string>
  enum: ClusterFirst, ClusterFirstWithHostNet, Default, None
  enableServiceLinks	<boolean>
  ephemeralContainers	<[]EphemeralContainer>
  hostAliases	<[]HostAlias>
  hostIPC	<boolean>
  hostNetwork	<boolean>
  hostPID	<boolean>
  hostUsers	<boolean>
  hostname	<string>
  imagePullSecrets	<[]LocalObjectReference>
  initContainers	<[]Container>
  nodeName	<string>
  nodeSelector	<map[string]string>
  os	<PodOS>
  overhead	<map[string]Quantity>
  preemptionPolicy	<string>
  enum: Never, PreemptLowerPriority
  priority	<integer>
  priorityClassName	<string>
  readinessGates	<[]PodReadinessGate>
  resourceClaims	<[]PodResourceClaim>
  restartPolicy	<string>
  enum: Always, Never, OnFailure
  runtimeClassName	<string>
  schedulerName	<string>
  schedulingGates	<[]PodSchedulingGate>
  securityContext	<PodSecurityContext>
  serviceAccount	<string>
  serviceAccountName	<string>
  setHostnameAsFQDN	<boolean>
  shareProcessNamespace	<boolean>
  subdomain	<string>
  terminationGracePeriodSeconds	<integer>
  tolerations	<[]Toleration>
  topologySpreadConstraints	<[]TopologySpreadConstraint>
  volumes	<[]Volume>

重点关注：containers、nodeName、volumes等。

pod.spec.containers
root@master30 ~ 13:53:06# kubectl explain pod.spec.containers | grep '^  [a-zA-Z]'
  args	<[]string>
  command	<[]string>
  env	<[]EnvVar>
  envFrom	<[]EnvFromSource>
  image	<string>
  imagePullPolicy	<string>
  enum: Always, IfNotPresent, Never
  lifecycle	<Lifecycle>
  livenessProbe	<Probe>
  name	<string> -required-
  ports	<[]ContainerPort>
  readinessProbe	<Probe>
  resizePolicy	<[]ContainerResizePolicy>
  resources	<ResourceRequirements>
  restartPolicy	<string>
  securityContext	<SecurityContext>
  startupProbe	<Probe>
  stdin	<boolean>
  stdinOnce	<boolean>
  terminationMessagePath	<string>
  terminationMessagePolicy	<string>
  enum: FallbackToLogsOnError, File
  tty	<boolean>
  volumeDevices	<[]VolumeDevice>
  volumeMounts	<[]VolumeMount>
  workingDir	<string>

重点关注：command、env、image、imagePullPolicy、volumeMounts等。

pod.spec.containers.ImagePullPolicy
  • Always，总是从仓库下载镜像。
  • Never，只使用本地镜像，不下载。
  • IfNotPresent，优先使用本地镜像，如果没有才从仓库下载镜像。
pod lifecycle 和 status
pod lifecycle
  • pod的生命周期取决于pod中所有容器的生命周期。
  • 容器的生命周期取决于容器中进程的生命周期。
Pod status

常见 pod 状态如下：

  • ContainerCreating 正在创建
  • Running 正在运行
  • Completed 运行完成
  • Error/RunContainerError 运行错误
  • CrashLoopBackOff 重新创建
  • ErrImagePull 获取镜像错误
  • ImagePullBackOff 重新获取镜像
  • Terminating，正在终止（删除）

实验1：pod中包含1个容器，验证pod状态

监控命令： watch -n 1 kubectl get pod

示例1：

apiVersion: v1
kind: Pod
metadata:
  name: busybox
  labels:
    app: busybox
spec:
  restartPolicy: Never
  containers:
  - name: busybox
    image: docker.io/library/busybox
    imagePullPolicy: IfNotPresent
    command: ['sh', '-c', 'echo Hello Kubernetes! && sleep 10']

command命令可以改写如下：

command:
- sh
- -c
- echo OK! && sleep 10

或者

args:
- sh
- -c
- echo OK! && sleep 10

观察pod状态为：ContainerCreating–>Running–>Completed

示例2：

apiVersion: v1
kind: Pod
metadata:
  name: busybox
  labels:
    app: busybox
spec:
  restartPolicy: Never
  containers:
  - name: busybox
    image: docker.io/library/busybox
    imagePullPolicy: IfNotPresent
    command: ['sh', '-c', 'echoxxx Hello Kubernetes! && sleep 5']

实验2：pod中包含2个容器，验证pod状态

apiVersion: v1
kind: Pod
metadata:
  name: busybox
  labels:
    app: busybox
spec:
  restartPolicy: Never
  containers:
  - name: busybox1
    image: docker.io/library/busybox
    imagePullPolicy: IfNotPresent
    command: ['sh', '-c', 'echo Hello Kubernetes! && sleep 5']
  - name: busybox2
    image: docker.io/library/busybox
    imagePullPolicy: IfNotPresent
    command: ['sh', '-c', 'echo Hello Kubernetes! && sleep 10']

观察pod状态为：ContainerCreating–>Running–>NotReady–>Completed

apiVersion: v1
kind: Pod
metadata:
  name: busybox
  labels:
    app: busybox
spec:
  restartPolicy: Never
  containers:
  - name: busybox1
    image: docker.io/library/busybox
    imagePullPolicy: IfNotPresent
    command: ['sh', '-c', 'echoxx Hello Kubernetes! && sleep 5']
  - name: busybox2
    image: docker.io/library/busybox
    imagePullPolicy: IfNotPresent
    command: ['sh', '-c', 'echo Hello Kubernetes! && sleep 20']

观察pod状态为：ContainerCreating–>Error

pod.spec.restartPolicy

示例：

  restartPolicy: Never
  containers:
  - name: myapp-container
    image: docker.io/library/busybox
    command: ['sh', '-c', 'echo The app is running! && sleep 5']

restartPolicy，针对pod中所有容器生效。

  • Always，除了 Running 状态，其他状态总是重启，默认值。
  • OnFailure，失败了才重启。
  • Never，从不重启。

实验1：验证pod中含有单个容器重启策略。

更改pod重启策略，直接apply会报错，需要删除重建。

第一个yaml验证Always/OnFailure/Never重启策略

apiVersion: v1
kind: Pod
metadata:
  name: busybox
  labels:
    app: busybox
spec:
  restartPolicy: Always/OnFailure/Never
  containers:
  - name: busybox
    image: docker.io/library/busybox
    imagePullPolicy: IfNotPresent
    command: ['sh', '-c', 'echo Hello Kubernetes! && sleep 5']

第二个yaml验证OnFailure

apiVersion: v1
kind: Pod
metadata:
  name: busybox
  labels:
    app: busybox
spec:
  restartPolicy: OnFailure
  containers:
  - name: busybox
    image: docker.io/library/busybox
    imagePullPolicy: IfNotPresent
    command: ['sh', '-c', 'echoxxx Hello Kubernetes! && sleep 5']

第三个yaml验证 Never 重启策略

apiVersion: v1
kind: Pod
metadata:
  name: busybox
  labels:
    app: busybox
spec:
  restartPolicy: Never
  containers:
  - name: busybox
    image: docker.io/library/busybox
    imagePullPolicy: IfNotPresent
    command: ['sh', '-c', 'echoxxx Hello Kubernetes! && sleep 5']

实验2：验证pod中含有多个容器重启策略。

验证结果：只要有一个容器满足重启策略条件，就会重启。

示例1：

apiVersion: v1
kind: Pod
metadata:
  name: busybox
  labels:
    app: busybox
spec:
  restartPolicy: Always/OnFailure/Never
  containers:
  - name: busybox1
    image: docker.io/library/busybox
    imagePullPolicy: IfNotPresent
    command: ['sh', '-c', 'echo Hello Kubernetes! && sleep 5']
  - name: busybox2
    image: docker.io/library/busybox
    imagePullPolicy: IfNotPresent
    command: ['sh', '-c', 'echo Hello Kubernetes! && sleep 5']

使用Always重启策略时，当容器busybox1状态为Completed时，容器busybox2还未创建成功，此时会根据重启策略重启pod。当然也可以将容器的生命周期延长，sleep 5改为sleep 50，运行50s之后还会重启pod。

使用OnFailure/Never重启策略就不会出现这种情况。

示例2：第二个command是错误的。

apiVersion: v1
kind: Pod
metadata:
  name: busybox
  labels:
    app: busybox
spec:
  restartPolicy: Always/OnFailure/Never
  containers:
  - name: busybox1
    image: docker.io/library/busybox
    imagePullPolicy: IfNotPresent
    command: ['sh', '-c', 'echo Hello Kubernetes! && sleep 5']
  - name: busybox2
    image: docker.io/library/busybox
    imagePullPolicy: IfNotPresent
    command: ['sh', '-c', 'echoxxx Hello Kubernetes! && sleep 5']

Always和OnFailure重启策略总是会重启pod；Never重启策略就不会重启pod。

Init Containers

一个pod可以有多个容器在其中运行应用程序，也可以有一个或多个initContainers。initContainers中容器状态必须是complete，containers容器才能运行。

如果pod的initContainers fail，kubernetes根据restartpolicy重启pod，直到initContainers状态为complete。

如果pod中initContainers有多个容器，那么会按顺序创建和执行。按顺序执行的initContainers必须成功才能执行下一个initContainers。所有init全部成功执行完成后，才开始执行pod中常规容器。

使用场景：

1、等待某个服务创建成功。

for i in {1..100}; do sleep 1; if dig myservice; then exit 0; fi; done; exit 1

2、等待固定时间后再运行app容器。

sleep 60

3、Clone a git repository into a volume

示例1：

vim pod-myapp.yaml

# myservice
---
apiVersion: v1
kind: Service
metadata:
  name: myservice
spec:
  ports:
  - protocol: TCP
    port: 80
    targetPort: 9376

# mydb
---
apiVersion: v1
kind: Service
metadata:
  name: mydb
spec:
  ports:
  - protocol: TCP
    port: 80
    targetPort: 9377

# myapp
---
apiVersion: v1
kind: Pod
metadata:
  name: myapp-pod
  labels:
    app: myapp
spec:
  initContainers:
  - name: init-myservice
    image: docker.io/library/busybox
    command: ['sh', '-c', 'until nslookup myservice; do echo waiting for myservice; sleep 2; done;sleep 3;']
  - name: init-mydb
    image: docker.io/library/busybox
    command: ['sh', '-c', 'until nslookup mydb; do echo waiting for mydb; sleep 2; done;sleep 3;']
  containers:
  - name: myapp-container
    image: docker.io/library/busybox
    command: ['sh', '-c', 'echo The app is running! && sleep 3600']

首先创建2个service，然后创建pod，观察pod状态变化。

示例2：

vim pod-myapp.yaml

apiVersion: v1
kind: Pod
metadata:
  name: myapp-pod
  labels:
    app: myapp
spec:
  volumes:
  - name: workdir
    emptyDir: {}
  containers:
  - name: myapp-container
    image: docker.io/library/busybox
    command: ['sh', '-c', 'echo The app is running! && sleep 3600']
    volumeMounts:
    - name: workdir
      mountPath: "/work-dir"
  initContainers:
  - name: init-poda
    image: docker.io/library/busybox
    command: ['sh', '-c', 'touch /work-dir/aa.txt && sleep 10']
    volumeMounts:
    - name: workdir
      mountPath: "/work-dir"

在app容器中查看文件

root@master30:~# kubectl exec myapp-pod -c myapp-container -- ls /xx

pod的状态变化：Init:0/1->PodInitializing->Running

将初始化容器command变更为以下内容再测试：

command: ['sh', '-c', 'touchxx /work-dir/aa.txt']

pod的状态变化：

Init:0/1->Init:Error->Init:CrashLoopBackOff，然后Init:Error->Init:CrashLoopBackOff循环。

静态 Pod

**疑问：**常规 Pod 由 Master 节点组件统一调度管理，但 Master 节点上 kube-apiserver、kube-scheduler、kube-controller-manager 等核心组件自身也以 Pod 形式运行，这类组件由谁管理？

**答案：**由节点本地的 kubelet 进程直接管理。Master 节点集群组件均以静态 Pod 方式运行，完全依托本地 kubelet 管控，无法通过 API Server 执行常规管理操作，不能关联 Deployment、DaemonSet 等控制器，kubelet 也不会为静态 Pod 提供就绪、存活健康检查能力。

我们查看 kubelet 服务配置分析原理：

root@master30 ~ 18:55:18# systemctl status kubelet.service |cat
● kubelet.service - kubelet: The Kubernetes Node Agent
     Loaded: loaded (/usr/lib/systemd/system/kubelet.service; enabled; preset: enabled)
    Drop-In: /usr/lib/systemd/system/kubelet.service.d
             └─10-kubeadm.conf
     Active: active (running) since Thu 2026-08-06 18:31:31 CST; 31min ago
       Docs: https://kubernetes.io/docs/
   Main PID: 1154 (kubelet)
      Tasks: 11 (limit: 4557)
     Memory: 109.1M (peak: 109.8M)
        CPU: 34.813s
     CGroup: /system.slice/kubelet.service
             └─1154 /usr/bin/kubelet --bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf --config=/var/lib/kubelet/config.yaml --container-runtime-endpoint=unix:///var/run/containerd/containerd.sock --pod-infra-container-image=registry.k8s.io/pause:3.9
...


root@master30 ~ 19:03:14# cat /usr/lib/systemd/system/kubelet.service
[Unit]
Description=kubelet: The Kubernetes Node Agent
Documentation=https://kubernetes.io/docs/
Wants=network-online.target
After=network-online.target

[Service]
ExecStart=/usr/bin/kubelet
Restart=always
StartLimitInterval=0
RestartSec=10

[Install]
WantedBy=multi-user.target

# kubelet.service服务启动参数通过 Drop-In 文件 10-kubeadm.conf 配置
root@master30 ~ 19:03:16# cat /usr/lib/systemd/system/kubelet.service.d/10-kubeadm.conf 
# Note: This dropin only works with kubeadm and kubelet v1.11+
[Service]
Environment="KUBELET_KUBECONFIG_ARGS=--bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf"
Environment="KUBELET_CONFIG_ARGS=--config=/var/lib/kubelet/config.yaml"
# This is a file that "kubeadm init" and "kubeadm join" generates at runtime, populating the KUBELET_KUBEADM_ARGS variable dynamically
EnvironmentFile=-/var/lib/kubelet/kubeadm-flags.env
# This is a file that the user can use for overrides of the kubelet args as a last resort. Preferably, the user should use
# the .NodeRegistration.KubeletExtraArgs object in the configuration files instead. KUBELET_EXTRA_ARGS should be sourced from this file.
EnvironmentFile=-/etc/default/kubelet
ExecStart=
ExecStart=/usr/bin/kubelet $KUBELET_KUBECONFIG_ARGS $KUBELET_CONFIG_ARGS $KUBELET_KUBEADM_ARGS $KUBELET_EXTRA_ARGS

# 以下参数定义了kubelet配置文件位置
# KUBELET_CONFIG_ARGS=--config=/var/lib/kubelet/config.yaml
# 该文件中的 staticPodPath 参数定义了一个目录
# kubelet会定期扫描该目录中pod文件，并根据目标中文件变动创建和删除pod
root@master30 ~ 19:03:43# grep staticPodPath /var/lib/kubelet/config.yaml
staticPodPath: /etc/kubernetes/manifests

root@master30 ~ 19:04:05# ls -1 /etc/kubernetes/manifests
etcd.yaml
kube-apiserver.yaml
kube-controller-manager.yaml
kube-scheduler.yaml

**注意：**不要修改 staticPodPath 参数配置，否则需要将集群组件4个yaml文件也要复制过去。

我们还可以通过参数 --pod-manifest-path设置，该目录下所有 pod 也是静态 pod。

root@master30 ~ 19:04:13# kubelet --help|grep pod-manifest-path
      --pod-manifest-path string                                 Path to the directory containing static pod files to run, or the path to a single static pod file. Files starting with dots will be ignored. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)

思考

Kubernetes 中 Pod 与容器的区别

答：

容器属于运行时层面概念，是承载业务进程的隔离运行环境。

Kubernetes 中的 Pod 是 K8s 体系独有的抽象概念，是集群内最小调度、管理、自愈单元，可理解为容器的封装载体与统一运行环境。

  • 可针对 Pod 独立配置健康检查、重启策略、资源配额等集群管控能力；
  • Pod 拥有独立集群 IP，内部所有容器共享该 IP；
  • Pod 可挂载独立数据卷，内部容器共享卷存储；
  • 单个 Pod 内可运行一个或多个容器，Pod 内所有容器具备以下特性：
    • 调度至同一节点，共享网络、存储资源；
    • 生命周期同步创建、同步销毁。

在这里插入图片描述

特性 容器 Pod
K8s 最小调度单位 ❌ 不是 ✅ 是
独立 IP ❌ 无 ✅ 有
多容器支持 ❌ 不支持 ✅ 天然支持
网络/存储共享 ❌ 不能 ✅ 内部容器可共享
生命周期管理 ❌ 弱 ✅ 完整（重启、自愈）
属于谁 运行时（Docker/containerd） Kubernetes

Kubernetes 为何直接管理 Pod，而非底层容器

  1. **容器抽象粒度太细，无法直接作为调度对象。**K8s 需要一套完整、独立、可调度、带完整标识的标准化资源载体，也就是 Pod。
  • 容器仅代表单一进程隔离环境，由 containerd、Docker 等运行时管控；
  • Pod 是容器封装层，整合网络、存储、配置、生命周期等全部集群管控能力。集群调度、扩缩容、故障自愈、服务发现、监控告警等所有核心能力，全部以 Pod 为操作单位。

  1. Pod 原生支持多容器协同部署（核心设计优势）

    大量业务场景需要多个容器协同运行、共享资源：

  • 业务主容器 + Sidecar 辅助容器（日志采集、链路监控、流量代理）

  • 业务主容器 + Init 初始化容器（前置依赖校验、资源预处理）

  • 业务容器 + 网络 / 安全代理容器

    这类组合有统一诉求：

  • 共享 Network Namespace，共用同一个 IP 与端口空间；

  • 共享数据卷，实现文件互通；

  • 必须调度至同一台节点，生命周期同步启停。

  1. Pod 提供统一标准化生命周期与自愈机制

    集群需要实现容器自动重启、故障节点实例重建、滚动更新、弹性扩缩容等能力，这些操作必须作用于统一、稳定的资源单元：

  • 若直接管控底层容器，多容器组合应用的生命周期会出现管理混乱；
  • 以 Pod 为最小单元，集群管理逻辑统一、语义清晰一致。

  1. 屏蔽底层容器运行时，实现解耦

    Pod 作为上层抽象，隔离底层容器实现差异，集群无需绑定某一款容器引擎：

  • Docker

  • containerd

  • cri-o

  • 其他兼容 CRI 标准的运行时

    Kubernetes 仅通过 CRI 接口与 Pod 资源交互，底层容器实现可无缝替换。

详解 Pod 内 pause 容器的作用

在 Kubernetes 集群中，每一个 Pod 创建时都会自动启动 pause 容器（又称 infra 基础设施容器），它是 Pod 内第一个启动、最后销毁的容器，是 Pod 正常运行的基础。

  1. pause 容器核心定位

    pause 容器的核心作用是预先占用并持续持有 Pod 的网络、各类命名空间资源。

  2. 三大核心功能

    ① 创建并持续持有 Pod 的 Linux Namespace

    Pod 内所有容器需要共享：

  • Network namespace（统一 IP、端口空间）

  • PID namespace（可选配置开启）

  • IPC namespace

    这类共享隔离空间必须由一个长期存活的容器持有，一旦持有容器退出，共享空间会直接销毁，这个承载容器就是 pause。

② 保障 Pod 生命周期与业务容器解耦

  • 业务容器崩溃后会按照重启策略重建；

  • pause 容器持续运行不退出 → Pod 本身不会销毁；

  • Pod 绑定的 IP、网络配置、挂载数据卷全部保留不变。

    若无 pause 容器，业务容器一旦退出，Pod 网络环境会直接销毁，重启容器也无法恢复原有网络。

③ 实现多容器共享网络通信

Nginx、业务程序、Sidecar 等容器全部加入 pause 的网络命名空间：

  • 共用同一个 Pod IP；
  • 容器之间可通过 127.0.0.1 互相访问；
  • 同一 Pod 内容器端口不能冲突。
  1. 通俗类比

  • pause 容器 = 房屋房东

  • Pod = 整套房屋

  • 业务容器 = 租住的租客

    房东（pause）提前占用整套房屋对应的网络、命名空间资源，租客（业务容器）入驻其中。租客即便更换多轮，房屋本身、配套网络地址始终保持不变。

  1. Pod 内部标准结构

    Pod
├── pause 基础设施容器（优先启动）
│    持有：网络命名空间、PodIP、IPC隔离空间
└── 业务容器1、2、3...
     全部加入pause持有的共享命名空间

  2. 精简总结

    pause 容器是 Pod 的底层基石

  • 核心职责：持续持有各类 Linux Namespace；
  • 核心价值：保证 Pod 网络、IP、生命周期环境稳定不丢失。
# kubernetes # 贪心算法 # 容器
Logo
AI硬件创业社区

智能硬件社区聚焦AI智能硬件技术生态，汇聚嵌入式AI、物联网硬件开发者，打造交流分享平台，同步全国赛事资讯、开展 OPC 核心人才招募，助力技术落地与开发者成长。

更多推荐

cover

【proteus仿真】基于STM32单片机矿井环境监测系统设计（仿真图+程序）

avatar AI硬件创业社区

技术框架设计全链路方法论：从基础原理到工程实践（三）

设计模式不是背诵的套路，而是从变化类型推导出的必然解法。责任链 Chain of Responsibility。工厂方法 Factory Method。接口定义契约 + 抽象类复用共性。解释器 Interpreter。📐 Step 3：选择设计结构。📋 Step 1：识别变化点。✅ Step 4：验证与评估。接口定义契约 + 运行时路由。装饰器 Decorator。策略 + 模板 + 注册表。

avatar AI硬件创业社区
cover

100.STM32低功耗设计实战：从原理到代码实现

avatar AI硬件创业社区