clusters:
- cluster:
    certificate-authority-data: <Base64 编码的 CA 证书>
    server: https://control-plane.minikube.internal:8443
  name: mk

users:
- name: kubernetes-admin
  user:
    client-certificate-data: <Base64 编码的客户端证书>
    client-key-data: <Base64 编码的客户端私钥>

contexts:
- context:
    cluster: mk
    user: kubernetes-admin
  name: kubernetes-admin@mk
current-context: kubernetes-admin@mk

# docker run -it --net host --pid host --userns host --cap-add audit_control \
#     -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \
#     -v /etc:/etc:ro \
#     -v /lib/systemd/system:/lib/systemd/system:ro \
#     -v /usr/bin/containerd:/usr/bin/containerd:ro \
#     -v /usr/bin/runc:/usr/bin/runc:ro \
#     -v /usr/lib/systemd:/usr/lib/systemd:ro \
#     -v /var/lib:/var/lib:ro \
#     -v /var/run/docker.sock:/var/run/docker.sock:ro \
#     --label docker_bench_security \
#     docker/docker-bench-security
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: docker-bench-security
  labels:
    name: docker-bench
spec:
  selector:
    matchLabels:
      name: docker-bench
  template:
    metadata:
      labels:
        name: docker-bench
    spec:
      hostPID: true
      hostIPC: true
      hostNetwork: true
      securityContext:
        runAsUser: 0
      # Init container to ensure container runtime socket is available
      initContainers:
      - name: verify-runtime-socket
        image: busybox:latest
        command:
        - sh
        - -c
        - |
          echo "Checking for container runtime socket..."
          if [ -S /host-root/var/run/docker.sock ]; then
            echo "✓ Docker socket found at /var/run/docker.sock"
          elif [ -S /host-root/run/docker.sock ]; then
            echo "✓ Docker socket found at /run/docker.sock"
          elif [ -S /host-root/run/containerd/containerd.sock ]; then
            echo "✓ Containerd socket found at /run/containerd/containerd.sock"
          else
            echo "⚠ No container runtime socket found!"
            echo "  This may cause docker-bench-security to fail"
          fi
        volumeMounts:
        - name: host-root
          mountPath: /host-root
          readOnly: true
        securityContext:
          privileged: true
      containers:
        - name: docker-bench
          image: madhuakula/hacker-container
          imagePullPolicy: Always
          command: ["/bin/sh", "-c", "sleep infinity"]
          resources:
            requests:
              cpu: 20m
              memory: 50Mi
            limits:
              cpu: 50m
              memory: 80Mi
          securityContext:
            privileged: true
            capabilities:
              add: ["AUDIT_CONTROL"]
          volumeMounts:
            - name: var-lib-vol
              mountPath: /var/lib
              readOnly: true
            - name: usr-lib-systemd-vol
              mountPath: /usr/lib/systemd
              readOnly: true
            - name: etc-vol
              mountPath: /etc
              readOnly: true
            - name: lib-systemd-system-vol
              mountPath: /lib/systemd/system
              readOnly: true
            - name: usr-bin-contained-vol
              mountPath: /usr/bin/containerd
              readOnly: true
            - name: usr-bin-runc-vol
              mountPath: /usr/bin/runc
              readOnly: true
            # Try Docker socket first (common path)
            - name: docker-sock-volume
              mountPath: /var/run/docker.sock
              readOnly: true
            # Fallback Docker socket path
            - name: docker-sock-fallback
              mountPath: /run/docker.sock
              readOnly: true
            # Containerd socket (for environments using containerd)
            - name: containerd-sock-volume
              mountPath: /run/containerd/containerd.sock
              readOnly: true
      volumes:
        - name: host-root
          hostPath:
            path: /
            type: Directory
        - name: var-lib-vol
          hostPath:
            path: /var/lib
        - name: usr-lib-systemd-vol
          hostPath:
            path: /usr/lib/systemd
        - name: etc-vol
          hostPath:
            path: /etc
        - name: lib-systemd-system-vol
          hostPath:
              path: /lib/systemd/system
        - name: usr-bin-contained-vol
          hostPath:
              path: /usr/bin/containerd
        - name: usr-bin-runc-vol
          hostPath:
              path: /usr/bin/runc
        - name: docker-sock-volume
          hostPath:
            path: /var/run/docker.sock
            type: DirectoryOrCreate
        - name: docker-sock-fallback
          hostPath:
            path: /run/docker.sock
            type: DirectoryOrCreate
        - name: containerd-sock-volume
          hostPath:
            path: /run/containerd/containerd.sock
            type: DirectoryOrCreate

apiVersion: v1
kind: Service
metadata:
  name: my-app-service
spec:
  type: ClusterIP  # 可省略，默认类型
  selector:
    app: nginx # 选择拥有 app=my-app 标签的 Pod
  ports:
  - name: http     # 端口名称
    port: 80       # Service 端口
    targetPort: 80  # Pod 端口
    protocol: TCP   # 协议

apiVersion: v1
kind: Service
metadata:
  name: headless-service
spec:
  type: ClusterIP # 可省略，默认类型
  clusterIP: None#与普通service的区别
  selector:
    app: nginx # 选择拥有 app=nginx 标签的 Pod
  ports:
  - name: http     # 端口名称
    port: 90       # Service 端口, 在headless中，port字段是不生效的
    targetPort: 80  # Pod 端口
    protocol: TCP   # 协议

apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-deploy
spec:
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: test-container
        image: nginx
        imagePullPolicy: IfNotPresent
        volumeMounts:
        - name: cache-volume
          mountPath: /cache
        - name: hostpath-volume
          mountPath: /hostpath
      volumes:
      - name: cache-volume
        emptyDir: {}  # 临时空目录，Pod 删除时清理
      - name: hostpath-volume
        hostPath:
          path: / # 节点上的目录
          type: DirectoryOrCreate  # 目录不存在时创建

- name: cache-volume
        emptyDir: {}  # 临时空目录，Pod 删除时清理

- name: hostpath-volume
  hostPath:
  path: / # 节点上的目录
  type: DirectoryOrCreate  # 目录不存在时创建

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
  namespace: default
data:
  # 键值对形式
  name: zhangsan
  mode: production
  
  # 文件形式
  config.json: |
    {
      "database": {
        "host": "localhost",
        "port": 5432
      }
    }

env:
- name: LOG_LEVEL
  valueFrom:
    configMapKeyRef:
      name: app-config
      key: LOG_LEVEL

envFrom:
- configMapRef:
    name: app-config

volumes:
- name: config-vol
  configMap:
    name: app-config
containers:
- name: app
  volumeMounts:
  - name: config-vol
    mountPath: /etc/config

apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
type: Opaque
data:
  username: ZGIxdXNlcg==        # db1user
  password: cGFzc3dvcmQxMjM=    # password123
  host: ZGIuZXhhbXBsZS5jb20=    # db.example.com
  port: MzMwNg==                # 3306
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: webapp
spec:
  replicas: 1
  selector:
    matchLabels:
      app: webapp
  template:
    metadata:
      labels:
        app: webapp
    spec:
      containers:
        - name: webapp
          image: nginx:latest
          env:
            - name: DB_USER
              valueFrom:
                secretKeyRef:
                  name: db-credentials
                  key: username
          envFrom:
            - secretRef:
                name: db-credentials
          volumeMounts:
            - name: db-credentials
              mountPath: /etc/db-credentials
              readOnly: true

      volumes:
        - name: db-credentials
          secret:
            secretName: db-credentials

spec:
  imagePullSecrets:
  - name: regcred

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-ebs-001
spec:
  capacity:#容量
    storage: 100Gi
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: standard
  awsElasticBlockStore:      # 具体存储实现
    volumeID: vol-0abc123
    fsType: ext4

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mysql-data
  namespace: default
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 50Gi
  storageClassName: standard

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: fast-ssd
provisioner: ebs.csi.aws.com        # 用哪个 CSI 驱动
parameters:                          # 传给驱动的参数
  type: gp3
  iops: "3000"
  throughput: "125"
reclaimPolicy: Delete                # 默认 Delete
volumeBindingMode: WaitForFirstConsumer
allowVolumeExpansion: true           # 允许扩容 PVC

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mysql-data
spec:
  accessModes: [ReadWriteOnce]
  storageClassName: fast-ssd      # 指定模板
  resources:
    requests:
      storage: 50Gi

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 3  # 指定期望的 Pod 副本数
  selector:
    matchLabels:
      app: nginx  # 选择器，用于匹配和管理哪些 Pod 属于这个 Deployment
  strategy:
    type: RollingUpdate  # 默认策略
    rollingUpdate:
      maxUnavailable: 1  # 在更新过程中，最多有多少个 Pod 不可用
      maxSurge: 1        # 在更新过程中，最多可以创建多少个超出期望副本数的 Pod
  template:      # Pod 模板，定义了每个 Pod 长什么样
    metadata:
      labels:
        app: nginx  # 给 Pod 打上标签，必须与上面的 selector.matchLabels 一致
    spec:
      containers:
      - name: nginx
        image: nginx
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 80

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: web
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  podManagementPolicy: Parallel
  updateStrategy:
    type: RollingUpdate # 或 OnDelete
    rollingUpdate:
      partition: 1  # 用于金丝雀发布
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.18
        ports:
        - containerPort: 80
          name: web

spec:
  updateStrategy:
    rollingUpdate:
      partition: 1  # 用于金丝雀发布

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: ssd-monitor
spec:
  selector:
    matchLabels:
      name: ssd-monitor
  template:
    metadata:
      labels:
        name: ssd-monitor
    spec:
      containers:
      - name: monitor
        image: nginx
        imagePullPolicy: IfNotPresent

apiVersion: batch/v1
kind: Job
metadata:
  name: pi
spec:
  completionMode: Indexed
  completions: 1
  parallelism: 3   #并行度，允许多个pod一起跑
  ttlSecondsAfterFinished: 5   #删除时间，效果为完成5秒后删除
  successPolicy:
    rules:
    - succeededCount: 1
      succeededIndexes: "0,1"
  template:
    spec:
      containers:
      - name: pi
        image: perl:5.34.0
        command: ["perl",  "-Mbignum=bpi", "-wle", "print bpi(2000)"]
      restartPolicy: Never # 对于 Job，此策略推荐设置为 Never 或 OnFailure
  backoffLimit: 4 # 设定失败重试次数

apiVersion: batch/v1
kind: CronJob
metadata:
  name: cron-pi
spec:
  schedule: "0 2 * * *"         # 每天凌晨2点执行
  timeZone: "Asia/Shanghai"       # 使用上海时区
  concurrencyPolicy: Forbid       # 禁止并发，确保任务不重叠
  startingDeadlineSeconds: 600    # 10分钟内必须启动，否则跳过
  successfulJobsHistoryLimit: 5   # 保留5个成功备份记录；默认3个
  failedJobsHistoryLimit: 3       # 保留3个失败记录用于排查；默认1个
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: pi
            image: perl:5.34.0
            command: ["perl",  "-Mbignum=bpi", "-wle", "print bpi(2000)"]

apiVersion: v1
kind: Pod
metadata:
  name: btop251
spec:
  nodeSelector:
    kubernetes.io/hostname: minikube
  containers:
  - name: btop251
    image: alpine
    command: ["/bin/sh"]
    stdin: true
    tty: true                       

apiVersion: v1
kind: Pod
metadata:
  name: btop251
spec:
  nodeSelector:
    kubernetes.io/hostname: minikube
  tolerations:
  - key: "kubernetes.io/hostname"
    operator: "Equal"
    value: "minikube"
    effect: "NoSchedule"
  containers:
  - name: btop251
    image: alpine
    command: ["/bin/sh"]
    stdin: true
    tty: true

apiVersion: v1
kind: Pod
metadata:
  name: btop251
spec:
  nodeSelector:
    kubernetes.io/hostname: minikube
  tolerations:
  - key: "kubernetes.io/hostname"
    operator: "Equal"
    value: "minikube"
    effect: "NoExecute"
    tolerationSeconds: 5
  containers:
  - name: btop251
    image: alpine
    command: ["/bin/sh"]
    stdin: true
    tty: true
~                      

# 只能精确匹配,多个规则之间是and关系
nodeSelector:
  disktype: ssd
  environment: production

# 必须满足规则, 不满足则不调度
# 同一matchExpressions中是and关系
# 不同matchExpressions之间是or关系
affinity:
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
      nodeSelectorTerms:
      - matchExpressions: 
        - key: disktype
          operator: In
          values: 
          - ssd
          - hdd
      - matchExpressions:
        - key: environment
          operator: NotIn
          values: [staging, test]
      - matchExpressions:
        - key: environment
          operator: Exists
      - matchExpressions:
        - key: environment
          operator: DoesNotExist
      - matchExpressions:
        - key: memory
          operator: Gt # 大于, Lt 小于
          values:
          - "16"

      - matchFields: # 节点元数据
        - key: metadata.name              # 节点名称
          operator: In
          values: [node1, node2, node3]
        - key: metadata.uid               # 节点唯一ID
          operator: In
          values: ["uid-value"]
        # 节点规格
        - key: spec.unschedulable        # 节点是否可调度
          operator: NotIn
          values: ["true"]
        # 节点状态
        - key: status.allocatable.cpu    # 可分配CPU
          operator: Gt
          values: ["4"]
        - key: status.allocatable.memory # 可分配内存
          operator: Gt
          values: ["8Gi"]

apiVersion: v1
kind: Pod
metadata:
  name: preferred-affinity-pod
spec:
  affinity:
    nodeAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 80
        preference:
          matchExpressions:
          - key: zone
            operator: In
            values:
            - us-west-2a
      - weight: 20
        preference:
          matchExpressions:
          - key: instance-type
            operator: In
            values:
            - c5.large
  containers:
  - name: web-app
    image: nginx

affinity:
  podAffinity:  # 亲和性, podAntiAffinity: 亲和性
    requiredDuringSchedulingIgnoredDuringExecution: # 同节点亲和性配置
    - labelSelector:
        matchExpressions:
        - key: app
          operator: In
          values:
          - web
      topologyKey: kubernetes.io/hostname  # 不同节点 # 根据节点标签

apiVersion: v1
kind: Pod
metadata:
  name: my-app-pod
  namespace: default
  labels:
    app: my-app
    tier: backend
    version: "1.0"
  annotations:
    description: "This is a sample application pod"
    maintainer: "devops-team"
spec:
  # 重启策略
  restartPolicy: Always

  # 容器定义
  containers:
  - name: main-container
    image: nginx
    imagePullPolicy: IfNotPresent

    # 容器启动命令
    command: ["nginx"]
    args: ["-g", "daemon off;"]

    # 端口配置
    ports:
    - name: http
      containerPort: 80
      protocol: TCP
    - name: https
      containerPort: 443
      protocol: TCP

    # 环境变量
    env:
    - name: ENVIRONMENT
      value: "production"
    - name: LOG_LEVEL
      value: "info"

    # 资源限制
    resources:
      requests:
        memory: "128Mi"
        cpu: "250m"
      limits:
        memory: "256Mi"
        cpu: "500m"

    # 健康检查
    livenessProbe:
      httpGet:
        path: /
        port: 80
      initialDelaySeconds: 30
      periodSeconds: 10
      timeoutSeconds: 5
      failureThreshold: 3

    #livenessProbe:
      #exec:
        #command:
          #- cat
          #- /tmp/healthy

    readinessProbe:
      httpGet:
        path: /
        port: 80
      initialDelaySeconds: 5
      periodSeconds: 5
      timeoutSeconds: 3
      failureThreshold: 1

name: btop251
namespace: default
uid: ac987043-77fb-49e6-ae26-2b1a337462ae
resourceVersion: "6287"
creationTimestamp: "2026-10-14T06:46:26Z"

spec:
  replicas: 3

apiVersion: v1 # 用哪个 API 版本
kind: Pod# 是什么资源
metadata:# 元数据（名字、标签、命名空间）
  name: btop251
spec:# 期望状态（这个资源长什么样）
  containers:
  - name: btop251
    image: alpine
    command: ["/bin/sh"]
    stdin: true  #对应docker -i保持容器的stdin开启（非必须
    tty: true #对应docker -t开启伪终端（非必须