中小規(guī)模K8s集群監(jiān)控輕量化落地方案技術棧Kubernetes v1.32.13 Rocky Linux 8.6 監(jiān)控告警系統(tǒng) Containerd 1.7.x操作環(huán)境 / 對接原理 / 詳細步驟 / 完整命令 / 配置文件 / 驗證流程 / 排錯方案中小規(guī)模K8s集群監(jiān)控輕量化落地方案操作環(huán)境K8s 集群 3 節(jié)點k8s-master(192.168.1.10), k8s-node1(192.168.1.11), k8s-node2(192.168.1.12)K8s 版本 v1.32.13監(jiān)控組件監(jiān)控告警系統(tǒng)通用已部署對應監(jiān)控組件 PodPrometheus 已配置服務發(fā)現(xiàn)Grafana 已對接數據源操作系統(tǒng) Rocky Linux 8.6容器運行時 Containerd 1.7.x已配置監(jiān)控專用命名空間 monitoring監(jiān)控數據持久化已配置 PVC 綁定數據留存策略已規(guī)劃監(jiān)控組件資源限制已設置已配置 RBAC 權限監(jiān)控組件具備集群資源讀取權限網絡策略已放行監(jiān)控通信端口對接原理中小規(guī)模K8s集群監(jiān)控輕量化落地方案是 K8s 集群監(jiān)控告警系統(tǒng)運維中的核心操作場景。K8s 監(jiān)控體系通過指標采集Exporter、數據存儲Prometheus TSDB、可視化展示Grafana、告警管理Alertmanager四大核心組件實現(xiàn)全鏈路監(jiān)控。監(jiān)控告警系統(tǒng)通用作為監(jiān)控體系的具體組件負責指標采集、數據存儲、可視化展示或告警分發(fā)。運維操作的核心目標是確保監(jiān)控系統(tǒng)的可用性、數據質量、告警精準度和性能穩(wěn)定性通過規(guī)范化的部署配置確保監(jiān)控組件穩(wěn)定運行通過精細化的指標采集確保數據完整準確通過合理的告警規(guī)則確保故障及時發(fā)現(xiàn)不誤報通過性能調優(yōu)確保監(jiān)控系統(tǒng)不成為瓶頸通過高可用和容災備份確保監(jiān)控不中斷。所有操作需遵循業(yè)務無感知原則對監(jiān)控系統(tǒng)的變更采用灰度和滾動方式避免影響業(yè)務監(jiān)控。詳細步驟1. 監(jiān)控現(xiàn)狀盤點與組件狀態(tài)檢查# 1. 檢查集群節(jié)點狀態(tài) kubectl get nodes -o wide kubectl get pods -n monitoring -o wide 2/dev/null || kubectl get pods -A | grep -E prometheus|grafana|alertmanager|exporter ? # 2. 檢查監(jiān)控組件狀態(tài) kubectl get pods -n monitoring -o wide 2/dev/null kubectl get svc -n monitoring -o wide 2/dev/null kubectl get pvc -n monitoring -o wide 2/dev/null ? # 3. 檢查 Prometheus 狀態(tài) kubectl get pods -n monitoring -l appprometheus -o wide 2/dev/null kubectl logs -n monitoring -l appprometheus --tail30 2/dev/null | tail -20 ? # 4. 檢查 Grafana 狀態(tài) kubectl get pods -n monitoring -l appgrafana -o wide 2/dev/null kubectl logs -n monitoring -l appgrafana --tail20 2/dev/null | tail -10 ? # 5. 檢查 Alertmanager 狀態(tài) kubectl get pods -n monitoring -l appalertmanager -o wide 2/dev/null kubectl logs -n monitoring -l appalertmanager --tail20 2/dev/null | tail -10 ? # 6. 檢查 Exporter 狀態(tài) kubectl get pods -A | grep -E node-exporter|cadvisor|kube-state-metrics kubectl get svc -A | grep -E node-exporter|cadvisor|kube-state-metrics ? # 7. 檢查監(jiān)控數據采集狀態(tài) # Prometheus Targets 狀態(tài) # kubectl port-forward -n monitoring svc/prometheus 9090:9090 # curl -s http://localhost:9090/api/v1/targets | jq .data.activeTargets[] | {job, health, lastError} | head -50 ? # 8. 導出監(jiān)控配置備份 kubectl get cm -n monitoring -o yaml /tmp/monitor_cm_backup_$(date %Y%m%d).yaml 2/dev/null kubectl get secret -n monitoring -o yaml /tmp/monitor_secret_backup_$(date %Y%m%d).yaml 2/dev/null kubectl get pvc -n monitoring -o yaml /tmp/monitor_pvc_backup_$(date %Y%m%d).yaml 2/dev/null echo 監(jiān)控配置已備份到 /tmp/ ?2. 制定操作方案與備份防護# 1. 備份監(jiān)控配置操作前必做 kubectl get cm -n monitoring -o yaml /tmp/monitor_cm_backup_$(date %Y%m%d_%H%M%S).yaml 2/dev/null kubectl get secret -n monitoring -o yaml /tmp/monitor_secret_backup_$(date %Y%m%d_%H%M%S).yaml 2/dev/null kubectl get deployment,statefulset,daemonset -n monitoring -o yaml /tmp/monitor_workload_backup_$(date %Y%m%d_%H%M%S).yaml 2/dev/null kubectl get pvc -n monitoring -o yaml /tmp/monitor_pvc_backup_$(date %Y%m%d_%H%M%S).yaml 2/dev/null ? # 2. 記錄當前監(jiān)控狀態(tài) echo 監(jiān)控狀態(tài)記錄 $(date) /tmp/monitor_status_$(date %Y%m%d).txt echo --- 監(jiān)控組件 Pod --- /tmp/monitor_status_$(date %Y%m%d).txt kubectl get pods -n monitoring -o wide 2/dev/null /tmp/monitor_status_$(date %Y%m%d).txt echo --- 監(jiān)控 Service --- /tmp/monitor_status_$(date %Y%m%d).txt kubectl get svc -n monitoring -o wide 2/dev/null /tmp/monitor_status_$(date %Y%m%d).txt echo --- 監(jiān)控 PVC --- /tmp/monitor_status_$(date %Y%m%d).txt kubectl get pvc -n monitoring -o wide 2/dev/null /tmp/monitor_status_$(date %Y%m%d).txt cat /tmp/monitor_status_$(date %Y%m%d).txt ? # 3. 制定操作方案 cat /tmp/monitor_operation_plan.md EOF # 監(jiān)控操作方案 ## 一、操作目標 ## 二、影響范圍評估 ## 三、操作步驟與時間窗口 ## 四、回滾方案 ## 五、驗證標準 ## 六、風險點與應對措施 EOF echo 操作方案模板已創(chuàng)建 ? # 4. 確認業(yè)務窗口 echo 當前時間: $(date) echo 建議在業(yè)務低峰期執(zhí)行監(jiān)控操作避免影響業(yè)務監(jiān)控 ? # 5. 通知相關業(yè)務方 # echo 監(jiān)控運維操作通知 | mail -s 監(jiān)控運維通知 adminexample.com ?3. 執(zhí)行監(jiān)控組件配置操作# 1. 檢查監(jiān)控組件配置 # Prometheus 配置 kubectl get cm -n monitoring prometheus-config -o yaml 2/dev/null | head -80 # Grafana 配置 kubectl get cm -n monitoring grafana-config -o yaml 2/dev/null | head -50 # Alertmanager 配置 kubectl get cm -n monitoring alertmanager-config -o yaml 2/dev/null | head -50 ? # 2. 檢查監(jiān)控組件日志 # Prometheus 日志 kubectl logs -n monitoring -l appprometheus --tail50 2/dev/null | tail -30 # Grafana 日志 kubectl logs -n monitoring -l appgrafana --tail30 2/dev/null | tail -20 # Alertmanager 日志 kubectl logs -n monitoring -l appalertmanager --tail30 2/dev/null | tail -20 ? # 3. 檢查 Prometheus 配置語法 # kubectl exec -n monitoring prometheus-0 -- promtool check config /etc/prometheus/prometheus.yml ? # 4. 檢查 Alertmanager 配置語法 # kubectl exec -n monitoring alertmanager-0 -- amtool check-config /etc/alertmanager/alertmanager.yml ? # 5. 執(zhí)行具體監(jiān)控配置操作根據標題調整 echo 執(zhí)行監(jiān)控組件具體配置操作... echo 請根據操作方案執(zhí)行具體步驟 ? # 6. 應用監(jiān)控配置變更 # kubectl apply -f /tmp/monitor_config.yaml # kubectl rollout restart deployment/prometheus -n monitoring # kubectl rollout restart deployment/grafana -n monitoring # kubectl rollout restart statefulset/alertmanager -n monitoring ? # 7. 等待監(jiān)控組件重啟完成 kubectl rollout status deployment/prometheus -n monitoring --timeout120s 2/dev/null kubectl rollout status deployment/grafana -n monitoring --timeout120s 2/dev/null kubectl rollout status statefulset/alertmanager -n monitoring --timeout120s 2/dev/null echo 監(jiān)控組件重啟完成 ?4. 驗證監(jiān)控數據采集與業(yè)務無感知# 1. 驗證監(jiān)控組件狀態(tài) kubectl get pods -n monitoring -o wide 2/dev/null # 預期所有監(jiān)控組件 Pod RunningREADY 正常 ? # 2. 驗證 Prometheus 數據采集 # 檢查 Targets 狀態(tài) # kubectl port-forward -n monitoring svc/prometheus 9090:9090 # sleep 5 # curl -s http://localhost:9090/api/v1/targets | jq .data.activeTargets[] | select(.health!up) | {job, health, lastError} # 預期所有 Targets 狀態(tài)為 up無異常 ? # 3. 驗證 Prometheus 查詢 # curl -s http://localhost:9090/api/v1/query?queryup | jq .data.result[] | {metric: .metric.job, value: .value[1]} | head -20 # 預期查詢返回正常數據 ? # 4. 驗證 Grafana 訪問 # kubectl port-forward -n monitoring svc/grafana 3000:3000 # sleep 5 # curl -s http://admin:adminlocalhost:3000/api/health # 預期Grafana 健康檢查正常 ? # 5. 驗證 Grafana 數據源 # curl -s http://admin:adminlocalhost:3000/api/datasources | jq .[].name # 預期Prometheus 數據源已配置 ? # 6. 驗證 Alertmanager 狀態(tài) # kubectl port-forward -n monitoring svc/alertmanager 9093:9093 # sleep 5 # curl -s http://localhost:9093/api/v2/status | jq .cluster # 預期Alertmanager 集群狀態(tài)正常 ? # 7. 驗證告警規(guī)則 # curl -s http://localhost:9090/api/v1/rules | jq .data.groups[] | {name, rules: [.rules[] | {name, health}]} | head -50 # 預期告警規(guī)則已加載狀態(tài)健康 ? # 8. 清理 port-forward # pkill -f port-forward 2/dev/null echo 驗證完成 ?5. 監(jiān)控告警規(guī)則與面板配置# 1. 配置監(jiān)控告警規(guī)則 # 檢查現(xiàn)有告警規(guī)則 # kubectl get cm -n monitoring prometheus-rules -o yaml 2/dev/null | head -100 ? # 2. 配置 Alertmanager 告警路由 # 檢查 Alertmanager 配置 # kubectl get cm -n monitoring alertmanager-config -o yaml 2/dev/null ? # 3. 配置監(jiān)控告警渠道 # 企業(yè)微信/釘釘/郵件/短信告警渠道配置 # 檢查 Secret 中的告警渠道配置 # kubectl get secret -n monitoring alertmanager-secret -o yaml 2/dev/null ? # 4. 配置監(jiān)控面板 # 檢查 Grafana 數據源和面板 # kubectl get cm -n monitoring grafana-dashboards -o yaml 2/dev/null | head -50 ? # 5. 配置監(jiān)控數據持久化 # 檢查 PVC 綁定狀態(tài) kubectl get pvc -n monitoring -o wide 2/dev/null # 預期PVC 已 Bound數據持久化正常 ? # 6. 配置監(jiān)控組件資源限制 # 檢查 Deployment/StatefulSet 資源限制 kubectl get deployment -n monitoring -o jsonpath{.items[*].spec.template.spec.containers[*].resources} 2/dev/null kubectl get statefulset -n monitoring -o jsonpath{.items[*].spec.template.spec.containers[*].resources} 2/dev/null ? # 7. 配置監(jiān)控組件高可用 # 檢查副本數和反親和性 kubectl get deployment -n monitoring -o jsonpath{.items[*].spec.replicas} 2/dev/null kubectl get statefulset -n monitoring -o jsonpath{.items[*].spec.replicas} 2/dev/null ? # 8. 配置監(jiān)控組件日志輪轉 # 檢查日志配置 kubectl get cm -n monitoring -o name 2/dev/null | head -20 ?6. 驗證操作結果與生成報告# 1. 驗證監(jiān)控組件狀態(tài) kubectl get pods -n monitoring -o wide 2/dev/null # 預期所有監(jiān)控組件 Pod RunningREADY 正常 ? # 2. 驗證監(jiān)控數據采集 # 檢查 Prometheus Targets # kubectl port-forward -n monitoring svc/prometheus 9090:9090 # sleep 5 # curl -s http://localhost:9090/api/v1/targets | jq .data.activeTargets | length # 預期Targets 數量符合預期 ? # 3. 驗證告警規(guī)則 # curl -s http://localhost:9090/api/v1/rules | jq .data.groups | length # 預期告警規(guī)則組已加載 ? # 4. 驗證 Grafana 面板 # curl -s http://admin:adminlocalhost:3000/api/search | jq .[].title | head -20 # 預期監(jiān)控面板已配置 ? # 5. 驗證 Alertmanager 告警 # curl -s http://localhost:9093/api/v2/alerts | jq length # 預期告警狀態(tài)正常 ? # 6. 驗證監(jiān)控數據持久化 kubectl get pvc -n monitoring -o wide 2/dev/null # 預期PVC Bound數據持久化正常 ? # 7. 驗證監(jiān)控組件資源使用 kubectl top pods -n monitoring 2/dev/null # 預期資源使用在合理范圍內 ? # 8. 生成操作報告 echo 監(jiān)控操作報告 /tmp/monitor_operation_report.txt echo 操作時間: $(date) /tmp/monitor_operation_report.txt echo 監(jiān)控組件 Pod 數: $(kubectl get pods -n monitoring --no-headers 2/dev/null | wc -l) /tmp/monitor_operation_report.txt echo 異常 Pod: $(kubectl get pods -n monitoring --no-headers 2/dev/null | grep -v Running | grep -v NAME | wc -l) /tmp/monitor_operation_report.txt echo PVC 數: $(kubectl get pvc -n monitoring --no-headers 2/dev/null | wc -l) /tmp/monitor_operation_report.txt echo Service 數: $(kubectl get svc -n monitoring --no-headers 2/dev/null | wc -l) /tmp/monitor_operation_report.txt echo ConfigMap 數: $(kubectl get cm -n monitoring --no-headers 2/dev/null | wc -l) /tmp/monitor_operation_report.txt cat /tmp/monitor_operation_report.txt ? # 9. 清理 port-forward # pkill -f port-forward 2/dev/null ?驗證流程# 1. 監(jiān)控組件狀態(tài)驗證 kubectl get pods -n monitoring -o wide 2/dev/null # 預期所有監(jiān)控組件 Pod RunningREADY 正常 ? # 2. Prometheus 數據采集驗證 # kubectl port-forward -n monitoring svc/prometheus 9090:9090 # sleep 5 # curl -s http://localhost:9090/api/v1/targets | jq .data.activeTargets[] | select(.health!up) | {job, health} # 預期所有 Targets 狀態(tài) up ? # 3. Prometheus 查詢驗證 # curl -s http://localhost:9090/api/v1/query?queryup | jq .data.result | length # 預期查詢返回正常數據 ? # 4. Grafana 訪問驗證 # curl -s http://admin:adminlocalhost:3000/api/health # 預期Grafana 健康 ? # 5. Alertmanager 狀態(tài)驗證 # curl -s http://localhost:9093/api/v2/status | jq .cluster.status # 預期Alertmanager 集群正常 ? # 6. 監(jiān)控數據持久化驗證 kubectl get pvc -n monitoring -o wide 2/dev/null # 預期PVC Bound ? # 7. 監(jiān)控組件資源驗證 kubectl top pods -n monitoring 2/dev/null # 預期資源使用合理 ? # 8. 操作報告驗證 cat /tmp/monitor_operation_report.txt # 預期報告包含操作前后對比 ?排錯方案監(jiān)控系統(tǒng)整體可用性問題檢查組件狀態(tài)、網絡連通性、資源限制、存儲、配置、高可用、故障自愈監(jiān)控數據質量問題檢查采集精度、完整性、時效性、一致性、降噪、去重、校驗、治理告警質量問題檢查誤報、漏報、遲報、重復告警、告警風暴、分級、閾值、靜默、抑制、路由監(jiān)控性能瓶頸檢查采集性能、存儲性能、查詢性能、網絡帶寬、資源限制、高基數、優(yōu)化、擴容監(jiān)控安全合規(guī)檢查 RBAC 權限、數據加密、訪問審計、敏感數據、合規(guī)基線、漏洞修復、最小權限監(jiān)控高可用容災檢查組件冗余、數據備份、故障切換、容災演練、跨機房、多集群、恢復機制監(jiān)控自動化運維檢查自動部署、自動發(fā)現(xiàn)、自動告警、自動自愈、自動清理、腳本、CI/CD、SOP監(jiān)控成本優(yōu)化檢查資源利用率、存儲成本、指標精簡、采集頻率、冷熱分層、降配、歸檔、清理