k8s——亲和&反亲和 整理

k8s pod亲和性与反亲和性的梳理

举几个栗子:

node亲和性栗子

apiVersion: v1
kind: Pod
metadata:
  name: with-node-affinity
spec:
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: kubernetes.io/e2e-az-name
            operator: In
            values:
            - e2e-az1
            - e2e-az2
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 1
        preference:
          matchExpressions:
          - key: another-node-label-key
            operator: In
            values:
            - another-node-label-value
  containers:
  - name: with-node-affinity

以上规则表达的意思是，该 Pod 只能被调度到拥有 kubernetes.io/e2e-az-name=e2e-az1 或者 kubernetes.io/e2e-az-name=e2e-az2 标签的节点上，其中在满足之前标签条件的同时更倾向于调度在拥有 another-node-label-key =another-node-label-value 标签的节点上

pod亲和性 与 反亲和性 结合栗子

apiVersion: v1
kind: Pod
metadata:
  name: with-pod-affinity
spec:
  affinity:
    podAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
      - labelSelector:
          matchExpressions:
          - key: security
            operator: In
            values:
            - S1
        topologyKey: failure-domain.beta.kubernetes.io/zone
    podAntiAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchExpressions:
            - key: security
              operator: In
              values:
              - S2
          topologyKey: kubernetes.io/hostname
  containers:
  - name: with-pod-affinity
    image: k8s.gcr.io/pause:2.0

以上示例表示，这个 pod 可以运行在节点 N 上，如果该节点有标签 key 为 failure-domain.beta.kubernetes.io/zone，而且运行着标签为 security=S1 的实例。另外，反亲和规则表明这个节点拥有标签 key 为 failure-domain.beta.kubernetes.io/zone，但运行有 security=S2 标签的 pod，那么这个节点就不会被优先选择调度.