Kubernetes on Youqing Han - DevOps Engineer

Understanding kubectl apply Workflow

ihanyouqing#gmail.com (#->@) (Youqing Han) — Sun, 21 Sep 2025 10:00:00 +0800

Understanding kubectl apply Workflow

Kubernetes, as the de facto standard for container orchestration, has become the core infrastructure for modern cloud-native applications. This article provides an in-depth analysis of the kubectl apply workflow, core concepts, common production environment issues, and best practices to help DevOps engineers and SRE teams better understand and apply Kubernetes.

Deep Analysis of Kubernetes Workflows

kubectl apply Command Execution Flow

When executing the kubectl apply command, a series of complex interactions occur within Kubernetes. Let’s understand this process through a detailed sequence diagram:

Kubernetes Probes 解析：Liveness、Readiness 和 Startup Probes

ihanyouqing#gmail.com (#->@) (Youqing Han) — Mon, 15 Sep 2025 10:00:00 +0800

Kubernetes Probes 解析：Liveness、Readiness 和 Startup Probes

Kubernetes 探针（Probes）是确保容器健康运行的关键机制。正确配置和使用 Liveness、Readiness 和 Startup 探针对于生产环境的稳定性和可靠性至关重要。本文深入分析这三种探针的区别、应用场景以及检测成功和失败后的行为。

探针概述

Kubernetes 提供了三种类型的探针来监控容器的健康状态：

Liveness Probe（存活探针）：检测容器是否正在运行
Readiness Probe（就绪探针）：检测容器是否准备好接收流量
Startup Probe（启动探针）：检测容器应用是否已经启动

这三种探针可以独立配置，也可以组合使用，以满足不同应用场景的需求。

Liveness Probe 详解

定义与目的

Liveness Probe 用于检测容器是否仍在正常运行。如果容器处于运行状态但应用已经死锁或无法响应，Liveness Probe 会检测到这种情况并触发容器重启。

检测失败后的行为

当 Liveness Probe 失败时：

Kubernetes 会杀死容器
根据 Pod 的 restartPolicy 重启容器
如果 restartPolicy 为 Always 或 OnFailure，容器会被重启
如果 restartPolicy 为 Never，容器不会被重启

适用场景

应用可能进入死锁状态，需要重启恢复
应用可能因为内存泄漏或其他问题导致无响应
需要确保应用始终处于可用状态

配置示例

apiVersion: v1
kind: Pod
metadata:
  name: liveness-example
spec:
  containers:
  - name: app
    image: myapp:latest
    livenessProbe:
      httpGet:
        path: /healthz
        port: 8080
      initialDelaySeconds: 30  # 容器启动后30秒开始检测
      periodSeconds: 10        # 每10秒检测一次
      timeoutSeconds: 5       # 检测超时时间5秒
      successThreshold: 1      # 连续1次成功视为成功
      failureThreshold: 3      # 连续3次失败视为失败

Readiness Probe 详解

定义与目的

Readiness Probe 用于检测容器是否准备好接收流量。只有当 Readiness Probe 成功时，Pod 才会被添加到 Service 的端点列表中，从而接收流量。

Complete Kubernetes Cluster Management on Alibaba Cloud with IaC

ihanyouqing#gmail.com (#->@) (Youqing Han) — Fri, 22 Aug 2025 00:00:00 +0000

Introduction

Alibaba Cloud Container Service for Kubernetes (ACK) provides a managed Kubernetes service that simplifies cluster management while maintaining full control over your containerized applications. In this comprehensive guide, we’ll explore how to build production-ready Kubernetes clusters on Alibaba Cloud using Infrastructure as Code (IaC) principles.

We’ll cover the complete journey from VPC creation to production deployment, including essential components like monitoring, logging, ingress controllers, and certificate management.

Why Alibaba Cloud for Kubernetes?

Alibaba Cloud offers several advantages for Kubernetes deployments:

Complete Kubernetes Monitoring Guide for DevOps Engineers

ihanyouqing#gmail.com (#->@) (Youqing Han) — Fri, 22 Aug 2025 00:00:00 +0000

Introduction

Kubernetes has become the de facto standard for container orchestration, but with great power comes great responsibility. Monitoring and observability are crucial for maintaining healthy, performant Kubernetes clusters in production environments.

In this comprehensive guide, we’ll explore the essential monitoring strategies, tools, and best practices that every DevOps engineer should implement for Kubernetes clusters.

Why Kubernetes Monitoring Matters

Before diving into implementation details, let’s understand why monitoring Kubernetes is critical:

Kubernetes Best Practices for Production

ihanyouqing#gmail.com (#->@) (Youqing Han) — Fri, 22 Aug 2025 00:00:00 +0000

Introduction

Kubernetes has become the de facto standard for container orchestration in production environments. However, running Kubernetes in production requires careful planning, proper configuration, and adherence to best practices. This comprehensive guide covers essential practices for deploying and managing Kubernetes clusters in production environments.

Security Best Practices

1. RBAC and Access Control

Implement proper Role-Based Access Control (RBAC) to ensure least privilege access.

# ClusterRole for application developers
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: app-developer
rules:
  - apiGroups: [""]
    resources: ["pods", "services", "configmaps", "secrets"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["apps"]
    resources: ["deployments", "replicasets"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

---
# ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: app-developer-binding
subjects:
  - kind: ServiceAccount
    name: app-developer
    namespace: production
roleRef:
  kind: ClusterRole
  name: app-developer
  apiGroup: rbac.authorization.k8s.io

---
# ServiceAccount
apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-developer
  namespace: production

2. Network Policies

Implement network policies to control pod-to-pod communication.

Kubernetes on Youqing Han - DevOps Engineer

Understanding kubectl apply Workflow

Understanding kubectl apply Workflow

Table of Contents

Deep Analysis of Kubernetes Workflows

kubectl apply Command Execution Flow

Kubernetes Probes 解析：Liveness、Readiness 和 Startup Probes

Kubernetes Probes 解析：Liveness、Readiness 和 Startup Probes

目录

探针概述

Liveness Probe 详解

定义与目的

检测失败后的行为

适用场景

配置示例

Readiness Probe 详解

定义与目的

Complete Kubernetes Cluster Management on Alibaba Cloud with IaC

Introduction

Why Alibaba Cloud for Kubernetes?

Complete Kubernetes Monitoring Guide for DevOps Engineers

Introduction

Why Kubernetes Monitoring Matters

Kubernetes Best Practices for Production

Introduction

Security Best Practices

1. RBAC and Access Control

2. Network Policies