深入浅出Kubernetes (it-ebooks) (Z-Library)

# 深入浅出Kubernetes — Reading Guide ## 【One-Line Pitch】 A practical, troubleshooting-oriented deep dive into Kubernetes internals—controllers, networking, scheduling, authentication, and real-world cluster failure diagnosis—written for engineers who operate Kubernetes clusters on Alibaba Cloud and want to understand *why* things break, not just how to fix them. ## 【Book Arc】 - **Opening (~0%–13%)**: Builds the conceptual foundation—cluster controllers explained through a refrigerator analogy, followed by a detailed walkthrough of cluster networking (CIDR allocation, flannel, pod communication) and the principles of cluster scaling (node addition/removal via ESS, Cluster Autoscaler, and kubeadm join trust establishment). - **Early (~13%–33%)**: Covers authentication and scheduling—decoding KubeConfig certificates, the two-step scheduling algorithm (preselection and scoring), and how kube-scheduler logs can reveal decision-making. Then shifts to service implementation via iptables/netfilter, using a water-filter analogy to explain the five netfilter hooks and DNAT rules. - **Early (~33%–40%)**: Explains private image pulling through the lens of OAuth 2.0—why the protocol exists, how docker login works, and how Kubernetes automates credential management via imagePullSecrets and admission controllers. - **Middle (~40%–60%)**: Transitions to real-world troubleshooting. The first case study dissects a node NotReady issue traced from kubelet/PLEG through docker daemon, dbus, and systemd—ultimately finding a cookie overflow bug in systemd's dbus1 handling. The second case follows a different NotReady cause: Terway (CNI plugin) hanging on netlink operations, blocking pod network setup. - **Late (~60%–67%)**: Continues with namespace deletion failures—analyzing API Server behavior and the Terminating state stuck problem, showing how to approach control-plane-level debugging. ## 【Key Takeaways】 - **Controllers are the "brain" of Kubernetes** (Early): The refrigerator analogy clarifies that controllers monitor state and drive actual state toward desired state; SharedInformer reduces API Server load by acting as a proxy for controller watch operations. Understanding this pattern is essential for grasping how kube-controller-manager, route controllers, and service controllers operate. - **Cluster networking is a three-level IP allocation problem** (Early): The cluster CIDR is subdivided into per-node podCIDRs, then into per-pod IPs. Flanneld and CNI plugins (like flannel or Terway) build the virtual bridges and routes that enable four types of pod communication—local, same-node, cross-node, and external. - **Node scaling involves four cooperating components** (Early): Cluster Autoscaler, ESS (Auto Scaling), the control plane, and the node itself (preparation/cleanup scripts). When debugging scaling issues, check each component's logs separately—Cluster Autoscaler is just a Pod, ESS has its own console, and node scripts can be traced directly. - **Scheduling is a two-step filter-and-score process** (Early): Preselection removes nodes that don't meet hard constraints; scoring then ranks remaining nodes by resource balance, affinity, and pod dispersion for high availability. Use `--v=10` on kube-scheduler to see the full decision trail. - **Services are implemented as per-node reverse-proxy Sidecars** (Early): Unlike LVS-style dedicated load balancers, kube-proxy runs on every node. The iptables implementation uses netfilter's five hooks (PREROUTING, FORWARD, POSTROUTING, INPUT, OUTPUT) with DNAT rules in KUBE-SERVICE chains to rewrite packet destinations before routing. - **Private image pulling is an OAuth 2.0 flow** (Early): Docker acts as a trusted intermediary—it holds your credentials, fetches a temporary token from the auth server, and uses that token to pull manifests and layers. Kubernetes automates this via imagePullSecrets, and admission controllers can inject credentials automatically per-namespace. - **Node NotReady diagnosis requires tracing the full stack** (Middle): The first case study shows a systemd dbus cookie overflow (32-bit counter wrapping after months of Unit churn) that blocks runC operations. The second reveals Terwayd holding a netlink socket lock for 1595 minutes, blocking all pod network creation. Both required goroutine/thread dumps and careful stack analysis. - **PLEG is the heartbeat of node readiness** (Middle): PLEG (Pod Lifecycle Events Generator) periodically checks pod states and feeds events to kubelet's syncLoop. When PLEG can't run (e.g., blocked on a gRPC call to the container runtime), NodeStatus marks the node NotReady after a 3-minute threshold. ## 【Reading Tips】 - **Skim the theory chapters lightly** (0%–33%): The refrigerator and water-filter analogies are helpful for intuition, but you can move quickly through them. Focus instead on the concrete details—CIDR allocation steps, netfilter hook names, and the OAuth flow diagram. - **Deep-read the troubleshooting chapters** (40%–67%): These are the book's real value. Pay attention to the *methodology*—how the authors use `kill -USR1` for docker daemon stacks, `SIGABRT` for kubelet goroutine dumps, `busctl` for dbus inspection, and `gdb` for systemd debugging. These techniques transfer to any Kubernetes troubleshooting scenario. - **Expect Alibaba Cloud specificity**: Many examples reference ACK (Alibaba Cloud Container Service), Terway (their CNI plugin), and ESS. If you're on another cloud, the principles still apply, but you'll need to map components to your environment. - **Don't skip the code analysis sections**: The systemd cookie overflow fix and the Terway lock analysis are excellent examples of how to approach "impossible" production bugs. Even if you never debug at this depth, understanding the reasoning pattern is valuable. - **Use the book as a reference, not a cover-to-cover read**: Each chapter is self-contained. When you hit a real cluster problem, jump to the relevant chapter—the structure supports this well. ## 【Coverage Limits】 This guide covers the theory chapters (controllers, networking, scaling, auth/scheduling, services, image pulling) and the first two troubleshooting case studies (node NotReady issues). The later chapters on namespace deletion failures, ACK security group configuration, microservices, and CA certificate expiration are not covered in the sampled excerpts. ##