Kubernetes DaemonSet深度解析：管理集群守护进程的最佳实践
Kubernetes DaemonSet深度解析：管理集群守护进程的最佳实践
一、DaemonSet概述
DaemonSet是Kubernetes中用于在集群的每个节点上运行一个Pod副本的控制器。它确保所有节点（或满足特定条件的节点）都运行该Pod的一个实例。
1.1 DaemonSet应用场景
| 场景 | 说明 | 示例 |
|---|---|---|
| 日志收集 | 每个节点运行日志收集器 | Fluentd、Filebeat |
| 监控代理 | 每个节点运行监控采集器 | Prometheus Node Exporter |
| 网络插件 | 每个节点运行网络组件 | Calico、Flannel |
| 存储代理 | 每个节点运行存储驱动 | CSI节点插件 |
| 安全代理 | 每个节点运行安全组件 | 入侵检测系统 |
1.2 DaemonSet vs Deployment
| 特性 | DaemonSet | Deployment |
|---|---|---|
| 副本数 | 每个节点一个 | 任意数量 |
| 调度 | 节点级别 | Pod级别 |
| 更新策略 | 滚动更新/替换 | 滚动更新/重建 |
| 适用场景 | 节点守护进程 | 应用服务 |
二、DaemonSet核心配置
2.1 基本DaemonSet配置
apiVersion: apps/v1 kind: DaemonSet metadata: name: fluentd namespace: kube-system labels: k8s-app: fluentd-logging spec: selector: matchLabels: name: fluentd template: metadata: labels: name: fluentd spec: tolerations: - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoSchedule containers: - name: fluentd image: fluentd:v1.12 resources: limits: memory: 200Mi requests: cpu: 100m memory: 200Mi volumeMounts: - name: varlog mountPath: /var/log - name: varlibdockercontainers mountPath: /var/lib/docker/containers readOnly: true volumes: - name: varlog hostPath: path: /var/log - name: varlibdockercontainers hostPath: path: /var/lib/docker/containers2.2 节点选择器配置
apiVersion: apps/v1 kind: DaemonSet metadata: name: node-exporter spec: selector: matchLabels: app: node-exporter template: metadata: labels: app: node-exporter spec: nodeSelector: kubernetes.io/os: linux node-role.kubernetes.io/worker: "" containers: - name: node-exporter image: prom/node-exporter:v1.2.02.3 污点容忍配置
apiVersion: apps/v1 kind: DaemonSet metadata: name: calico-node spec: selector: matchLabels: k8s-app: calico-node template: metadata: labels: k8s-app: calico-node spec: tolerations: - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoSchedule - key: node-role.kubernetes.io/master operator: Exists effect: NoSchedule - key: node.kubernetes.io/not-ready operator: Exists effect: NoExecute三、DaemonSet更新策略
3.1 滚动更新
apiVersion: apps/v1 kind: DaemonSet metadata: name: fluentd spec: updateStrategy: type: RollingUpdate rollingUpdate: maxUnavailable: 1 maxSurge: 03.2 替换更新
apiVersion: apps/v1 kind: DaemonSet metadata: name: legacy-daemon spec: updateStrategy: type: OnDelete四、DaemonSet部署与管理
4.1 部署DaemonSet
kubectl apply -f daemonset.yaml # 查看DaemonSet状态 kubectl get daemonset # 查看Pod分布 kubectl get pods -l name=fluentd -o wide # 查看DaemonSet详情 kubectl describe daemonset fluentd4.2 滚动更新操作
# 更新镜像版本 kubectl set image daemonset/fluentd fluentd=fluentd:v1.13 # 查看更新状态 kubectl rollout status daemonset/fluentd # 暂停更新 kubectl rollout pause daemonset/fluentd # 恢复更新 kubectl rollout resume daemonset/fluentd # 回滚更新 kubectl rollout undo daemonset/fluentd4.3 查看历史版本
kubectl rollout history daemonset/fluentd kubectl rollout history daemonset/fluentd --revision=2五、DaemonSet最佳实践
5.1 日志收集DaemonSet
apiVersion: apps/v1 kind: DaemonSet metadata: name: filebeat namespace: logging spec: selector: matchLabels: app: filebeat template: metadata: labels: app: filebeat annotations: co.elastic.logs/module: docker spec: serviceAccountName: filebeat terminationGracePeriodSeconds: 30 containers: - name: filebeat image: elastic/filebeat:7.15.0 args: - -e - -c - /etc/filebeat.yml env: - name: ELASTICSEARCH_HOSTS value: "elasticsearch:9200" securityContext: runAsUser: 0 volumeMounts: - name: config mountPath: /etc/filebeat.yml subPath: filebeat.yml - name: data mountPath: /usr/share/filebeat/data - name: varlibdockercontainers mountPath: /var/lib/docker/containers readOnly: true - name: varlog mountPath: /var/log readOnly: true volumes: - name: config configMap: name: filebeat-config - name: data hostPath: path: /var/lib/filebeat-data type: DirectoryOrCreate - name: varlibdockercontainers hostPath: path: /var/lib/docker/containers - name: varlog hostPath: path: /var/log5.2 节点监控DaemonSet
apiVersion: apps/v1 kind: DaemonSet metadata: name: node-exporter namespace: monitoring spec: selector: matchLabels: app: node-exporter template: metadata: labels: app: node-exporter annotations: prometheus.io/scrape: "true" prometheus.io/port: "9100" spec: hostNetwork: true hostPID: true containers: - name: node-exporter image: prom/node-exporter:v1.2.0 args: - --path.procfs=/host/proc - --path.sysfs=/host/sys - --collector.filesystem.ignored-mount-points=^/(dev|proc|sys|var/lib/docker/.+|var/lib/kubelet/.+)($|/) resources: limits: cpu: 100m memory: 100Mi requests: cpu: 100m memory: 100Mi volumeMounts: - name: proc mountPath: /host/proc readOnly: true - name: sys mountPath: /host/sys readOnly: true volumes: - name: proc hostPath: path: /proc - name: sys hostPath: path: /sys5.3 网络插件DaemonSet
apiVersion: apps/v1 kind: DaemonSet metadata: name: flannel namespace: kube-system spec: selector: matchLabels: app: flannel template: metadata: labels: app: flannel spec: hostNetwork: true tolerations: - operator: Exists containers: - name: kube-flannel image: quay.io/coreos/flannel:v0.14.0 command: - /opt/bin/flanneld args: - --ip-masq - --kube-subnet-mgr securityContext: privileged: true env: - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace volumeMounts: - name: run mountPath: /run/flannel - name: cni mountPath: /etc/cni/net.d - name: etc-flannel mountPath: /etc/flannel volumes: - name: run hostPath: path: /run/flannel - name: cni hostPath: path: /etc/cni/net.d - name: etc-flannel hostPath: path: /etc/flannel六、DaemonSet监控与调试
6.1 状态检查
# 查看DaemonSet状态 kubectl get ds # 查看DaemonSet详情 kubectl describe ds <name> # 查看Pod状态 kubectl get pods -l <label> -o wide # 查看节点上的Pod分布 kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.addresses[0].address}{"\n"}{end}'6.2 日志查看
# 查看所有Pod日志 kubectl logs -l app=node-exporter # 查看特定节点的Pod日志 kubectl logs -l app=node-exporter -n monitoring --field-selector spec.nodeName=node-1 # 流式日志 kubectl logs -f <pod-name>6.3 调试命令
# 在特定节点上执行命令 kubectl exec <pod-name> -- cat /var/log/messages # 查看节点信息 kubectl describe node <node-name> # 查看节点污点 kubectl get node <node-name> -o jsonpath='{.spec.taints}'七、性能优化
7.1 资源限制配置
apiVersion: apps/v1 kind: DaemonSet metadata: name: optimized-daemon spec: template: spec: containers: - name: daemon image: my-daemon resources: requests: cpu: "100m" memory: "200Mi" limits: cpu: "500m" memory: "500Mi"7.2 优先级配置
apiVersion: scheduling.k8s.io/v1 kind: PriorityClass metadata: name: system-node-critical value: 2000001000 description: "Priority class for system node critical components." --- apiVersion: apps/v1 kind: DaemonSet metadata: name: critical-daemon spec: template: spec: priorityClassName: system-node-critical containers: - name: daemon image: critical-component7.3 调度约束
apiVersion: apps/v1 kind: DaemonSet metadata: name: constrained-daemon spec: template: spec: affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: topology.kubernetes.io/zone operator: In values: - zone-a - zone-b containers: - name: daemon image: zone-aware-daemon八、常见问题与解决方案
8.1 Pod无法调度到节点
问题：DaemonSet Pod在某些节点上Pending
原因分析：
- 节点有污点且DaemonSet没有相应的容忍
- 节点资源不足
- 节点选择器不匹配
解决方案：
kubectl describe node <node-name> | grep Taints kubectl get ds <name> -o yaml | grep tolerations8.2 更新卡住
问题：滚动更新卡在某个节点
原因分析：
- 节点不可用
- Pod健康检查失败
- 资源不足
解决方案：
kubectl rollout status ds <name> kubectl describe pod <pod-name> kubectl rollout pause ds <name>8.3 镜像拉取失败
问题：DaemonSet无法拉取镜像
原因分析：
- 镜像仓库不可达
- 镜像名称或标签错误
- 认证配置问题
解决方案：
kubectl describe pod <pod-name> | grep -A 5 Events kubectl get secret regcred -o yaml九、总结
DaemonSet是管理集群级守护进程的核心控制器，适用于需要在每个节点上运行的系统级服务。通过合理配置，可以实现：
- 节点级部署：确保每个节点都运行守护进程
- 自动扩展：新节点加入时自动部署Pod
- 滚动更新：安全地更新守护进程版本
- 节点隔离：通过污点和容忍控制Pod部署位置
建议在部署日志收集、监控代理、网络插件等系统服务时使用DaemonSet，并结合资源限制和优先级配置确保系统稳定性。
参考资料：
- Kubernetes DaemonSet官方文档
- DaemonSet更新策略
- 污点与容忍文档