在 Azure Kubernetes 服务 (AKS) 中管理系统节点池Manage system node pools in Azure Kubernetes Service (AKS)

在 Azure Kubernetes 服务 (AKS) 中,采用相同配置的节点分组成节点池。In Azure Kubernetes Service (AKS), nodes of the same configuration are grouped together into node pools. 节点池包含运行应用程序的底层 VM。Node pools contain the underlying VMs that run your applications. 系统节点池和用户节点池是 AKS 群集的两种不同的节点池模式。System node pools and user node pools are two different node pool modes for your AKS clusters. 系统节点池主要用于托管关键系统 Pod(例如 CoreDNS 和 tunnelfront)。System node pools serve the primary purpose of hosting critical system pods such as CoreDNS and tunnelfront. 用户节点池主要用于托管应用程序 Pod。User node pools serve the primary purpose of hosting your application pods. 但是,如果希望在 AKS 群集中只有一个池,可以在系统节点池上计划应用程序 Pod。However, application pods can be scheduled on system node pools if you wish to only have one pool in your AKS cluster. 每个 AKS 群集必须至少包含一个系统节点池,该池至少包含一个节点。Every AKS cluster must contain at least one system node pool with at least one node.

重要

如果在生产环境中为 AKS 群集运行单个系统节点池,则建议至少将三个节点用作节点池。If you run a single system node pool for your AKS cluster in a production environment, we recommend you use at least three nodes for the node pool.

准备阶段Before you begin

  • 需要安装并配置 Azure CLI 2.3.1 或更高版本。You need the Azure CLI version 2.3.1 or later installed and configured. 运行 az --version 即可查找版本。Run az --version to find the version. 如果需要进行安装或升级,请参阅安装 Azure CLIIf you need to install or upgrade, see Install Azure CLI.

限制Limitations

创建和管理支持系统节点池的 AKS 群集时存在以下限制。The following limitations apply when you create and manage AKS clusters that support system node pools.

  • 请参阅 Azure Kubernetes 服务 (AKS) 中可用的配额、虚拟机大小限制和区域See Quotas, virtual machine size restrictions, and region availability in Azure Kubernetes Service (AKS).
  • 必须将虚拟机规模集用作 VM 类型并使用标准 SKU 负载均衡器来生成 AKS 群集。The AKS cluster must be built with virtual machine scale sets as the VM type and the Standard SKU load balancer.
  • 节点池的名称只能包含小写字母数字字符,且必须以小写字母开头。The name of a node pool may only contain lowercase alphanumeric characters and must begin with a lowercase letter. 对于 Linux 节点池,长度必须为 1 到 12 个字符。For Linux node pools, the length must be between 1 and 12 characters. 对于 Windows 节点池,长度必须在 1 到 6 个字符之间。For Windows node pools, the length must be between 1 and 6 characters.
  • 必须使用 2020-03-01 版或更高版的 API 版本设置节点池模式。An API version of 2020-03-01 or greater must be used to set a node pool mode. 在 2020-03-01 之前的 API 版本上创建的集群仅包含用户节点池,但可以按照更新池模式步骤进行迁移,通过这种方式包含系统节点池。Clusters created on API versions older than 2020-03-01 contain only user node pools, but can be migrated to contain system node pools by following update pool mode steps.
  • 节点池模式是必需属性,当使用 ARM 模板或直接 API 调用时,必须显式设置该属性。The mode of a node pool is a required property and must be explicitly set when using ARM templates or direct API calls.

系统节点池和用户节点池System and user node pools

对于系统节点池,AKS 会自动为其节点分配“kubernetes.azure.com/mode: system”标签。For a system node pool, AKS automatically assigns the label kubernetes.azure.com/mode: system to its nodes. 这使 AKS 倾向于在包含此标签的节点池上计划系统 Pod。This causes AKS to prefer scheduling system pods on node pools that contain this label. 此标签不会阻止你在系统节点池上计划应用程序 Pod。This label does not prevent you from scheduling application pods on system node pools. 但是,我们建议将关键系统 Pod 与应用程序 Pod 隔离,以防配置错误或未授权的应用程序 Pod 意外终止系统 Pod。However, we recommend you isolate critical system pods from your application pods to prevent misconfigured or rogue application pods from accidentally killing system pods. 可以通过创建专用系统节点池来强制执行此行为。You can enforce this behavior by creating a dedicated system node pool. 使用 CriticalAddonsOnly=true:NoSchedule 污点可防止在系统节点池上计划应用程序 Pod。Use the CriticalAddonsOnly=true:NoSchedule taint to prevent application pods from being scheduled on system node pools.

系统节点池存在以下限制:System node pools have the following restrictions:

  • 系统池 osType 必须为 Linux。System pools osType must be Linux.
  • 用户节点池 osType 可以是 Linux 或 Windows。User node pools osType may be Linux or Windows.
  • 系统池必须至少包含一个节点,而用户节点池则可能包含零个或零个以上的节点。System pools must contain at least one node, and user node pools may contain zero or more nodes.
  • 系统节点池需要一个至少具有 2 个 vCPU 和 4GB 内存的 VM SKU。System node pools require a VM SKU of at least 2 vCPUs and 4GB memory.
  • 系统节点池必须支持至少 30 个 Pod,如 Pod 的最小值和最大值公式中所述。System node pools must support at least 30 pods as described by the minimum and maximum value formula for pods.
  • 现成节点池需要用户节点池。Spot node pools require user node pools.

对于节点池,可以执行以下操作:You can do the following operations with node pools:

  • 创建专用系统节点池(优先将系统 Pod 计划到 mode:system 的节点池)Create a dedicated system node pool (prefer scheduling of system pods to node pools of mode:system)
  • 将系统节点池更改为用户节点池,但前提是 AKS 群集中有另一个可以取代它的系统节点池。Change a system node pool to be a user node pool, provided you have another system node pool to take its place in the AKS cluster.
  • 将用户节点池更改为系统节点池。Change a user node pool to be a system node pool.
  • 删除用户节点池。Delete user node pools.
  • 可以删除系统节点池,前提是在 AKS 群集中有另一个可取代它的系统节点池。You can delete system node pools, provided you have another system node pool to take its place in the AKS cluster.
  • 一个 AKS 群集可以包含多个系统节点池,并且至少需要一个系统节点池。An AKS cluster may have multiple system node pools and requires at least one system node pool.
  • 如果希望更改现有节点池上的各种不可变设置,可以新建节点池将其替换。If you want to change various immutable settings on existing node pools, you can create new node pools to replace them. 例如,添加具有全新 maxPods 设置的全新节点池,然后删除旧节点池。One example is to add a new node pool with a new maxPods setting and delete the old node pool.

创建包含系统节点池的新 AKS 群集Create a new AKS cluster with a system node pool

创建新的 AKS 群集时,会自动创建包含单个节点的系统节点池。When you create a new AKS cluster, you automatically create a system node pool with a single node. 初始节点池默认为某种类型模式的系统。The initial node pool defaults to a mode of type system. 使用 az aks nodepool add 创建新节点池时,除非显式指定模式参数,否则这些节点池为用户节点池。When you create new node pools with az aks nodepool add, those node pools are user node pools unless you explicitly specify the mode parameter.

以下示例在 chinaeast2 区域创建名为 myResourceGroup 的资源组。The following example creates a resource group named myResourceGroup in the chinaeast2 region.

az group create --name myResourceGroup --location chinaeast2

使用 az aks create 命令创建 AKS 群集。Use the az aks create command to create an AKS cluster. 以下示例创建包含一个专用系统池(包含一个节点)的名为 myAKSCluster 的群集。The following example creates a cluster named myAKSCluster with one dedicated system pool containing one node. 对于生产工作负荷,请确保使用至少包含三个节点的系统节点池。For your production workloads, ensure you are using system node pools with at least three nodes. 此操作可能需要几分钟才能完成。This operation may take several minutes to complete.

# Create a new AKS cluster with a single system pool
az aks create -g myResourceGroup --name myAKSCluster --node-count 1 --generate-ssh-keys

将专用系统节点池添加到现有 AKS 群集Add a dedicated system node pool to an existing AKS cluster

重要

创建节点池后,无法通过 CLI 更改节点污点。You can't change node taints through the CLI after the node pool is created.

可将一个或多个系统节点池添加到现有 AKS 群集。You can add one or more system node pools to existing AKS clusters. 建议在用户节点池上计划应用程序 Pod,并将系统节点池专用于关键系统 Pod。It's recommended to schedule your application pods on user node pools, and dedicate system node pools to only critical system pods. 这样可防止非授权应用程序 Pod 意外终止系统 Pod。This prevents rogue application pods from accidentally killing system pods. 通过 CriticalAddonsOnly=true:NoSchedule 污点为系统节点池强制执行此行为。Enforce this behavior with the CriticalAddonsOnly=true:NoSchedule taint for your system node pools.

以下命令添加模式类型系统的专用节点池,其默认计数为三个节点。The following command adds a dedicated node pool of mode type system with a default count of three nodes.

az aks nodepool add \
    --resource-group myResourceGroup \
    --cluster-name myAKSCluster \
    --name systempool \
    --node-count 3 \
    --node-taints CriticalAddonsOnly=true:NoSchedule \
    --mode System

显示节点池的详细信息Show details for your node pool

可以使用以下命令查看节点池的详细信息。You can check the details of your node pool with the following command.

az aks nodepool show -g myResourceGroup --cluster-name myAKSCluster -n systempool

将为系统节点池定义“系统”类型的模式,并为用户节点池定义“用户”类型的模式。 A mode of type System is defined for system node pools, and a mode of type User is defined for user node pools. 对于系统池,请验证污点是否设置为 CriticalAddonsOnly=true:NoSchedule,这将防止在此节点池上计划应用程序 Pod。For a system pool, verify the taint is set to CriticalAddonsOnly=true:NoSchedule, which will prevent application pods from beings scheduled on this node pool.

{
  "agentPoolType": "VirtualMachineScaleSets",
  "availabilityZones": null,
  "count": 1,
  "enableAutoScaling": null,
  "enableNodePublicIp": false,
  "id": "/subscriptions/yourSubscriptionId/resourcegroups/myResourceGroup/providers/Microsoft.ContainerService/managedClusters/myAKSCluster/agentPools/systempool",
  "maxCount": null,
  "maxPods": 110,
  "minCount": null,
  "mode": "System",
  "name": "systempool",
  "nodeImageVersion": "AKSUbuntu-1604-2020.06.30",
  "nodeLabels": {},
  "nodeTaints": [
    "CriticalAddonsOnly=true:NoSchedule"
  ],
  "orchestratorVersion": "1.16.10",
  "osDiskSizeGb": 128,
  "osType": "Linux",
  "provisioningState": "Failed",
  "proximityPlacementGroupId": null,
  "resourceGroup": "myResourceGroup",
  "scaleSetEvictionPolicy": null,
  "scaleSetPriority": null,
  "spotMaxPrice": null,
  "tags": null,
  "type": "Microsoft.ContainerService/managedClusters/agentPools",
  "upgradeSettings": {
    "maxSurge": null
  },
  "vmSize": "Standard_DS2_v2",
  "vnetSubnetId": null
}

更新现有的群集系统和用户节点池Update existing cluster system and user node pools

备注

必须使用 2020-03-01 或更高版本的 API 版本设置系统节点池模式。An API version of 2020-03-01 or greater must be used to set a system node pool mode. 而在 2020-03-01 之前的 API 版本上创建的集群仅包含用户节点池。Clusters created on API versions older than 2020-03-01 contain only user node pools as a result. 若要在较旧的群集上获得系统节点池功能和权益,请在最新的 Azure CLI 版本上,用以下命令更新现有节点池的模式。To receive system node pool functionality and benefits on older clusters, update the mode of existing node pools with the following commands on the latest Azure CLI version.

可以更改系统节点池和用户节点池的模式。You can change modes for both system and user node pools. 仅当 AKS 群集上已存在另一个系统节点池时,才能将系统节点池更改为用户池。You can change a system node pool to a user pool only if another system node pool already exists on the AKS cluster.

此命令将系统节点池更改为用户节点池。This command changes a system node pool to a user node pool.

az aks nodepool update -g myResourceGroup --cluster-name myAKSCluster -n mynodepool --mode user

此命令将用户节点池更改为系统节点池。This command changes a user node pool to a system node pool.

az aks nodepool update -g myResourceGroup --cluster-name myAKSCluster -n mynodepool --mode system

删除系统节点池Delete a system node pool

备注

若要在 API 版本 2020-03-02 之前的 AKS 群集上使用系统节点池,请添加新的系统节点池,并删除原始的默认节点池。To use system node pools on AKS clusters before API version 2020-03-02, add a new system node pool, then delete the original default node pool.

以前无法删除系统节点池,它是 AKS 群集中的初始默认节点池。Previously you could not delete the system node pool, which was the initial default node pool in an AKS cluster. 现在可以灵活地从群集中删除任何节点池。You now have the flexibility to delete any node pool from your clusters. 由于 AKS 群集至少需要一个系统节点池,因此 AKS 群集上必须至少包含两个系统节点池,才能删除其中的一个。Since AKS clusters require at least one system node pool, you must have at least two system node pools on your AKS cluster before you can delete one of them.

az aks nodepool delete -g myResourceGroup --cluster-name myAKSCluster -n mynodepool

清理资源Clean up resources

若要删除群集,请使用 az group delete 命令删除 AKS 资源组:To delete the cluster, use the az group delete command to delete the AKS resource group:

az group delete --name myResourceGroup --yes --no-wait

后续步骤Next steps

本文介绍了如何在 AKS 群集中创建和管理系统节点池。In this article, you learned how to create and manage system node pools in an AKS cluster. 若要详细了解如何使用多个节点池,请参阅使用多个节点池For more information about how to use multiple node pools, see use multiple node pools.