KubeDB 面试题

KubeDB 核心 CRD:
├── 数据库实例 CRD（引擎特定）
│   ├── MySQL (mysqldbs.kubedb.com)
│   ├── PostgreSQL (postgreses.kubedb.com)
│   ├── MongoDB (mongodbs.kubedb.com)
│   ├── Redis (redises.kubedb.com)
│   ├── Elasticsearch (elasticsearches.kubedb.com)
│   ├── MariaDB (mariadbs.kubedb.com)
│   └── ProxySQL (proxysqls.kubedb.com) / PgBouncer (pgbouncers.kubedb.com)
├── 版本管理
│   └── Version (mysqlversions / pgversions / mongodbversions ...)
├── Schema 管理
│   └── Schema (mysqlschemas / pgschemas / ...)
│   └── Database (mysqldatabases / pgdatabases / ...)
├── 备份与恢复
│   └── BackupConfiguration
│   └── BackupSession（Stash CRD）
├── 配置管理
│   └── ConfigMap / Secret 注入
├── 连接池代理
│   └── ProxySQL / PgBouncer
└── 外部数据库导入
    └── ExternalDB（引用非 KubeDB 管理的现有数据库）

apiVersion: kubedb.com/v1
kind: MySQL
metadata:
  name: my-cluster
  namespace: prod
spec:
  version: "8.0.36"
  replicas: 3
  topology:
    mode: GroupReplication
    group:
      name: "dc1"
  storageType: Durable
  storage:
    storageClassName: gp3
    accessModes: [ReadWriteOnce]
    resources:
      requests:
        storage: 100Gi
  podTemplate:
    spec:
      resources:
        requests:
          cpu: 4
          memory: 8Gi
  monitor:
    agent: prometheus.io/operator
    prometheus:
      serviceMonitor:
        labels:
          release: kube-prometheus-stack
  deletionPolicy: Halt

apiVersion: kubedb.com/v1
kind: MySQL
metadata:
  name: prod-mysql-gr
spec:
  version: "8.0.36"
  replicas: 3
  topology:
    mode: GroupReplication
    group:
      name: "dc1-gr"
  podTemplate:
    spec:
      containers:
        - name: mysql
          resources:
            requests:
              cpu: 4
              memory: 8Gi
            limits:
              cpu: 8
              memory: 16Gi
  storageType: Durable
  storage:
    storageClassName: gp3
    accessModes: [ReadWriteOnce]
    resources:
      requests:
        storage: 500Gi

spec:
  topology:
    mode: InnoDBCluster
    innoDBCluster:
      router:
        replicas: 2

apiVersion: kubedb.com/v1
kind: PostgreSQL
metadata:
  name: prod-pg
spec:
  version: "16.2"
  replicas: 3
  standbyMode: Hot
  streamingMode: synchronous
  clientAuthMode: md5
  podTemplate:
    spec:
      containers:
        - name: postgres
          resources:
            requests:
              cpu: 4
              memory: 8Gi
            limits:
              cpu: 8
              memory: 16Gi
  storageType: Durable
  storage:
    storageClassName: gp3
    accessModes: [ReadWriteOnce]
    resources:
      requests:
        storage: 200Gi
  monitor:
    agent: prometheus.io/operator

apiVersion: kubedb.com/v1
kind: MongoDB
metadata:
  name: prod-mongo-rs
spec:
  version: "7.0.8"
  replicas: 5
  replicaSet:
    name: rs0
  podTemplate:
    spec:
      resources:
        requests:
          cpu: 4
          memory: 8Gi
        limits:
          cpu: 8
          memory: 16Gi
  storageType: Durable
  storage:
    storageClassName: gp3
    accessModes: [ReadWriteOnce]
    resources:
      requests:
        storage: 500Gi

apiVersion: kubedb.com/v1
kind: MongoDB
metadata:
  name: prod-mongo-sharded
spec:
  version: "7.0.8"
  shardTopology:
    configServer:
      replicas: 3
      storage:
        storageClassName: gp3
        resources:
          requests:
            storage: 50Gi
    mongos:
      replicas: 2
    shard:
      replicas: 3
      shards: 2
      storage:
        storageClassName: gp3
        resources:
          requests:
            storage: 500Gi

graph TD
    Mongos["mongos x 2<br/>(请求路由层，无状态)"]
    ConfigSvr["Config Server RS<br/>(x3)<br/>集群元数据"]
    Shard0["Shard-0 RS (x3)<br/>数据分片 0"]
    Shard1["Shard-1 RS (x3)<br/>数据分片 1"]

    Mongos --> ConfigSvr
    Mongos --> Shard0
    Mongos --> Shard1

apiVersion: kubedb.com/v1
kind: Redis
metadata:
  name: cache-redis
spec:
  version: "7.2.4"
  mode: Standalone
  storageType: Durable
  storage:
    storageClassName: gp3
    accessModes: [ReadWriteOnce]
    resources:
      requests:
        storage: 20Gi

apiVersion: kubedb.com/v1
kind: Redis
metadata:
  name: redis-cluster
spec:
  version: "7.2.4"
  mode: Cluster
  cluster:
    master: 3
    replicas: 1
  storageType: Durable
  storage:
    storageClassName: gp3
    accessModes: [ReadWriteOnce]
    resources:
      requests:
        storage: 100Gi
  podTemplate:
    spec:
      resources:
        requests:
          cpu: 2
          memory: 4Gi

apiVersion: kubedb.com/v1
kind: RedisSentinel
metadata:
  name: redis-sentinel
spec:
  version: "7.2.4"
  replicas: 3
  storageType: Durable
  podTemplate:
    spec:
      resources:
        requests:
          cpu: 200m
          memory: 256Mi
apiVersion: kubedb.com/v1
kind: Redis
metadata:
  name: redis-ha
spec:
  version: "7.2.4"
  mode: Sentinel
  replicas: 3
  sentinelRef:
    name: redis-sentinel
    namespace: prod

apiVersion: kubedb.com/v1
kind: Elasticsearch
metadata:
  name: es-prod-cluster
spec:
  version: "8.12.2"
  enableSSL: true
  topology:
    master:
      replicas: 3
      storage:
        storageClassName: gp3
        accessModes: [ReadWriteOnce]
        resources:
          requests:
            storage: 20Gi
    dataHot:
      replicas: 6
      storage:
        storageClassName: gp3
        accessModes: [ReadWriteOnce]
        resources:
          requests:
            storage: 1Ti
    dataWarm:
      replicas: 3
      storage:
        storageClassName: st1
        accessModes: [ReadWriteOnce]
        resources:
          requests:
            storage: 2Ti
    ingest:
      replicas: 2
      storage:
        storageClassName: gp3
        accessModes: [ReadWriteOnce]
        resources:
          requests:
            storage: 20Gi
  podTemplate:
    spec:
      resources:
        requests:
          cpu: 8
          memory: 32Gi

graph TD
    PROV["Provisioning（创建）<br/>创建 CR 实例<br/>Operator 创建 StatefulSet + PVC + Service"]
    SCALE["Scaling（扩缩容）<br/>修改 replicas / storage 字段<br/>Operator 调整 StatefulSet 副本数或 PV 容量"]
    UPGR["Upgrading（升级）<br/>修改 version 字段<br/>Operator 滚动更新各 Pod，按顺序完成数据迁移"]
    BACKUP["Backup（备份）<br/>创建 BackupConfiguration<br/>Stash 执行备份"]
    RESTORE["Restore（恢复）<br/>创建新 CR 实例<br/>引用 BackupSession，Stash 恢复数据"]
    DELETE["Deletion（删除）<br/>删除 CR 实例<br/>TerminationPolicy 控制 PVC 清理策略"]

    PROV --> SCALE
    PROV --> UPGR
    PROV --> BACKUP
    PROV --> RESTORE
    PROV --> DELETE

KubeDB MySQL CR                    Stash CRD
      │                               │
      │   spec.backupConfig           │
      ├──────────────────────────────►│
      │                               ├── BackupConfiguration
      │   spec.init.restore           │   └── schedule + retentionPolicy + repository
      ├──────────────────────────────►│
                                      ├── BackupSession（每次备份执行）
                                      │   └── 快照信息 + 状态
                                      ├── RestoreSession（恢复执行）
                                      │   └── 目标 + 数据源
                                      └── Repository（后端存储）
                                          └── S3 / GCS / Azure / NFS / PVC

apiVersion: kubedb.com/v1
kind: MySQL
metadata:
  name: prod-mysql
spec:
  version: "8.0.36"
  replicas: 3
  topology:
    mode: GroupReplication
  backupConfig:
    schedule: "0 2 * * *"
    retentionPolicy:
      name: keep-last-7
      keepLast: 7
      prune: true
    repository:
      name: s3-backup-repo

apiVersion: stash.appscode.com/v1alpha1
kind: Repository
metadata:
  name: s3-backup-repo
spec:
  backend:
    s3:
      endpoint: s3.amazonaws.com
      bucket: kubedb-backups
      region: us-east-1
      prefix: mysql/prod-mysql
    storageSecretName: s3-credentials

apiVersion: kubedb.com/v1
kind: MySQL
metadata:
  name: mysql-restored
spec:
  version: "8.0.36"
  init:
    archiver:
      encryptionSecret:
        name: encrypt-secret
    restore:
      repository:
        name: s3-backup-repo
        namespace: prod
      snapshot: prod-mysql-daily-20250101

备份流程:
  1. BackupConfiguration CronJob 触发
  2. Stash 创建 BackupSession
  3. Sidecar 执行 mysqldump / pg_dump / mongodump（逻辑备份）或文件系统快照（物理备份）
  4. 数据加密并上传至 Repository 后端
  5. BackupSession 记录快照元数据
  6. retentionPolicy 触发过期快照清理

恢复流程:
  1. 创建新 MySQL CR，指定 init.restore.snapshot
  2. Init Container 从 Repository 拉取快照数据
  3. 数据解密并导入数据库
  4. Operator 启动主容器
  5. Status.Phase 变为 Ready

1. cert-manager Issuer / ClusterIssuer 注册
       │
2. KubeDB 创建 Certificate CR（<db-name>-client-cert / <db-name>-server-cert）
       │
3. cert-manager 通过 ACME / CA / SelfSigned 签发证书
       │
4. 证书存入 Secret（<db-name>-client-cert / <db-name>-server-cert）
       │
5. KubeDB Sidecar 将证书挂载到 Pod 指定路径
       │
6. 数据库启动时加载证书，启用 TLS
       │
7. cert-manager 到期前自动续期并滚动更新 Pod

apiVersion: kubedb.com/v1
kind: MySQL
metadata:
  name: tls-mysql
spec:
  version: "8.0.36"
  enableSSL: true
  tls:
    issuerRef:
      apiGroup: cert-manager.io
      kind: Issuer
      name: mysql-ca-issuer
    certificates:
      - alias: server
        subject:
          organizations:
            - kubedb
        dnsNames:
          - localhost
          - tls-mysql.prod.svc
        ipAddresses:
          - "127.0.0.1"
      - alias: client
        subject:
          organizations:
            - kubedb

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: mysql-ca-issuer
  namespace: prod
spec:
  ca:
    secretName: mysql-ca-key-pair

graph TD
    subgraph Pod["KubeDB MySQL Pod"]
        MySQL["mysql<br/>容器"]
        Exporter["mysqld_exporter (sidecar)<br/>端口 9104"]
    end

    MySQL --> Exporter
    Exporter --> Svc["Service (metrics 端口)"]
    Svc --> SvcMonitor["ServiceMonitor<br/>(Prometheus Operator)"]
    SvcMonitor --> Prometheus["Prometheus 抓取指标"]
    Prometheus --> Grafana["Grafana Dashboard"]

apiVersion: kubedb.com/v1
kind: MySQL
metadata:
  name: monitored-mysql
spec:
  version: "8.0.36"
  monitor:
    agent: prometheus.io/operator
    prometheus:
      serviceMonitor:
        labels:
          release: kube-prometheus-stack
        interval: 30s

MySQL CR                            MySQLVersion CR
  spec.version: "8.0.36"     ──►    metadata.name: 8.0.36
                                     spec.version: 8.0.36
                                     spec.db:
                                       image: kubedb/mysql:8.0.36
                                     spec.exporter:
                                       image: kubedb/mysqld-exporter:v0.15.0
                                     spec.initContainer:
                                       image: kubedb/mysql-init:8.0.36

升级 MySQL 8.0.35 → 8.0.36:
  1. 修改 MySQL CR spec.version: "8.0.36"
  2. Operator 校验目标 Version CR 存在且有效
  3. Operator 计算升级路径（小版本 vs 大版本）
  4. 逐 Pod 执行滚动升级:
     a. 对当前 Pod 执行 pre-upgrade 检查
     b. 创建升级前快照（可选）
     c. 更新 Init Container 和主容器镜像
     d. 启动新版本数据库，执行 mysql_upgrade
     e. 等待 Pod Ready
  5. 全部 Pod 升级完成，Status.Phase 更新

# 升级示例
apiVersion: kubedb.com/v1
kind: MySQL
metadata:
  name: my-mysql
spec:
  version: "8.0.36"  # 从 8.0.35 修改为此版本

1. 确认目标 Version CR 已存在于集群中
2. 确认升级路径被 Operator 支持
3. 创建完整备份（BackupSession）
4. 确认磁盘空间足够（升级可能产生临时文件）
5. 在维护窗口内执行升级
6. 监控升级过程中应用连接状态

spec:
  storageType: Ephemeral

spec:
  storageType: Durable
  storage:
    storageClassName: gp3
    accessModes:
      - ReadWriteOnce
    resources:
      requests:
        storage: 200Gi

apiVersion: kubedb.com/v1
kind: MySQL
metadata:
  name: external-mysql
spec:
  version: "8.0.36"
  externallyManaged: true
  externalDatabase:
    host: mysql-legacy.prod.internal
    port: 3306
    authSecret:
      name: external-mysql-auth
apiVersion: v1
kind: Secret
metadata:
  name: external-mysql-auth
type: kubernetes.io/basic-auth
data:
  username: <base64-encoded>
  password: <base64-encoded>

1. 创建包含自定义配置内容的 Secret / ConfigMap
2. 在 CR 中通过 spec.configSecret 引用
3. Operator 将配置挂载到 Pod 内对应路径
4. 数据库启动时加载自定义配置
5. Pod 重启后仍使用原配置（配置持久化于 Secret）

apiVersion: v1
kind: Secret
metadata:
  name: mysql-custom-config
stringData:
  my.cnf: |
    [mysqld]
    max_connections = 500
    innodb_buffer_pool_size = 8G
    innodb_log_file_size = 2G
    slow_query_log = ON
    long_query_time = 2
    max_allowed_packet = 256M
    character-set-server = utf8mb4
    collation-server = utf8mb4_unicode_ci
    innodb_flush_log_at_trx_commit = 1
    sync_binlog = 1    
apiVersion: kubedb.com/v1
kind: MySQL
metadata:
  name: tuned-mysql
spec:
  version: "8.0.36"
  configSecret:
    name: mysql-custom-config

apiVersion: v1
kind: Secret
metadata:
  name: pg-custom-config
stringData:
  postgresql.conf: |
    max_connections = 300
    shared_buffers = 8GB
    effective_cache_size = 24GB
    maintenance_work_mem = 2GB
    checkpoint_completion_target = 0.9
    wal_buffers = 256MB
    default_statistics_target = 100
    random_page_cost = 1.1
    effective_io_concurrency = 200
    work_mem = 32MB    

# MySQL Group Replication 从 3 节点扩展到 5 节点
spec:
  replicas: 5  # 原值 3

# 原地扩容 CPU 和内存
spec:
  podTemplate:
    spec:
      resources:
        requests:
          cpu: 8    # 原值 4
          memory: 16Gi  # 原值 8Gi
        limits:
          cpu: 16   # 原值 8
          memory: 32Gi  # 原值 16Gi

spec:
  storage:
    resources:
      requests:
        storage: 500Gi  # 原值 200Gi

spec:
  halted: true

1. 非工作时间暂停开发/测试环境数据库，降低云资源成本
2. 维护窗口期间暂停业务数据库，避免连接干扰
3. 临时释放集群计算资源给高优先级业务
4. 数据库迁移前暂停写入，执行最终数据一致性校验

apiVersion: kubedb.com/v1
kind: MySQL
metadata:
  name: prod-mysql
spec:
  version: "8.0.36"
  deletionPolicy: Halt  # 默认 DoNotTerminate

1. 生产环境默认使用 DoNotTerminate，防止误删除
2. 确认下线前改为 Halt，删除 CR 但保留数据
3. 数据确认不再需要后，手动清理 PVC 和 Secret
4. WipeOut 仅用于 CI/CD 测试环境，自动清理临时资源
5. Halt 删除前确保已有有效备份

apiVersion: kubedb.com/v1
kind: MySQL
metadata:
  name: mysql-with-init
spec:
  version: "8.0.36"
  init:
    script:
      configMap:
        name: mysql-init-scripts
apiVersion: v1
kind: ConfigMap
metadata:
  name: mysql-init-scripts
data:
  init.sql: |
    CREATE DATABASE IF NOT EXISTS orders;
    CREATE USER 'app_user'@'%' IDENTIFIED BY 'SecurePass123';
    GRANT ALL PRIVILEGES ON orders.* TO 'app_user'@'%';
    FLUSH PRIVILEGES;

    USE orders;
    CREATE TABLE IF NOT EXISTS items (
      id BIGINT AUTO_INCREMENT PRIMARY KEY,
      name VARCHAR(255) NOT NULL,
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
    );    

spec:
  init:
    archiver:
      encryptionSecret:
        name: backup-encrypt-secret
    restore:
      repository:
        name: s3-backup-repo
        namespace: prod
      snapshot: prod-mysql-backup-20250101

1. Pod 启动 Init Container
2. Init Container 校验 init.script 或 init.restore 配置
3. 若为 script：复制 SQL 文件到共享卷
4. 若为 restore：从 Repository 拉取快照并解压
5. 数据库主容器启动
6. 数据库进程执行 /docker-entrypoint-initdb.d/ 下脚本
7. 脚本执行完成，Operator 标记 Status.Phase: Ready

1. StatefulSet 按序启动 Pod（mysql-0, mysql-1, mysql-2）
       │
2. mysql-0 作为 Bootstrap 节点启动
   ├── 创建 replication_user
   ├── SET GLOBAL group_replication_bootstrap_group=ON
   ├── START GROUP_REPLICATION
   └── 成为 Group 中第一个成员
       │
3. mysql-1 启动
   ├── 等待 mysql-0 的 Group Replication 就绪
   ├── 通过 Headless Service 发现 mysql-0
   ├── CHANGE MASTER TO ... FOR CHANNEL 'group_replication_recovery'
   ├── START GROUP_REPLICATION
   └── 加入 Group，数据同步开始
       │
4. mysql-2 重复 mysql-1 流程
       │
5. Group 成员达到 replicas 数量，Operator 标记 Ready

1. Primary 节点 Pod 异常（Crash / Node NotReady）
2. Group Replication 自动检测 Primary 失联（member_expel_timeout）
3. 剩余节点中选新 Primary（基于 member_weight 或 UUID）
4. KubeDB Operator 更新 Service Label Selector 指向新 Primary
5. <name> Service 流量自动切换到新 Primary
6. 原 Primary 恢复后以 Secondary 身份重新加入 Group

KubeDB Operator Deployment
  replicas: 2
  ├── kubedb-operator-xxxxx (Leader)
  │   ├── 持有 Lease Lock
  │   ├── Watch CRD 变更
  │   └── 执行 Reconcile Loop
  │
  └── kubedb-operator-yyyyy (Standby)
      ├── 等待 Lease Lock
      ├── 不执行 Reconcile
      └── Leader 失效后竞选

apiVersion: apps/v1
kind: Deployment
metadata:
  name: kubedb-operator
  namespace: kubedb
spec:
  replicas: 2
  selector:
    matchLabels:
      app: kubedb
  template:
    metadata:
      labels:
        app: kubedb
    spec:
      serviceAccountName: kubedb-operator
      containers:
        - name: operator
          image: kubedb/operator:v2024.4.27
          args:
            - --leader-elect=true
            - --lease-duration=15s
            - --renew-deadline=10s
            - --retry-period=2s
          resources:
            requests:
              cpu: 500m
              memory: 1Gi
            limits:
              cpu: 2000m
              memory: 2Gi

graph TD
    App["App Pod<br/>写操作 → mysql.prod:3306<br/>读操作 → mysql-replicas:3306"]
    MysqlSvc["mysql Service<br/>(ClusterIP)<br/>→ Primary Pod"]
    ReplicasSvc["mysql-replicas Service<br/>→ Secondary Pods"]
    HeadlessSvc["mysql-pods (Headless Service)<br/>DNS: mysql-pods.prod.svc<br/>→ mysql-0.prod.pod, mysql-1..."]

    App --> MysqlSvc
    App --> ReplicasSvc
    MysqlSvc --> HeadlessSvc
    ReplicasSvc --> HeadlessSvc

# Primary 读写
mysql.prod.svc.cluster.local:3306

# 只读（负载均衡到所有 Secondary）
mysql-replicas.prod.svc.cluster.local:3306

# 直连特定 Pod
mysql-0.mysql-pods.prod.svc.cluster.local:3306

# Group Replication 内部发现
mysql-0.mysql-gvr.prod.svc.cluster.local:33061

Primary Pod Label: kubedb.com/role: primary
Secondary Pod Label: kubedb.com/role: secondary

mysql Service Selector:
  kubedb.com/role: primary    → 仅路由到 Primary

mysql-replicas Service Selector:
  kubedb.com/role: secondary  → 路由到所有 Secondary

# 声明式创建数据库
apiVersion: schema.kubedb.com/v1alpha1
kind: MySQLDatabase
metadata:
  name: orders-db
  namespace: prod
spec:
  database:
    serverRef:
      name: prod-mysql
      namespace: prod
    config:
      name: orders
# 声明式创建用户
apiVersion: schema.kubedb.com/v1alpha1
kind: MySQLUser
metadata:
  name: app-user
  namespace: prod
spec:
  database:
    serverRef:
      name: prod-mysql
      namespace: prod
  authentication:
    password:
      secretRef:
        name: app-user-password
  privileges:
    - database: orders
      scope: ALL
# 声明式初始化表结构
apiVersion: schema.kubedb.com/v1alpha1
kind: MySQLSchema
metadata:
  name: orders-schema
  namespace: prod
spec:
  database:
    serverRef:
      name: prod-mysql
      namespace: prod
  schema:
    configMap:
      name: orders-schema-sql
apiVersion: v1
kind: ConfigMap
metadata:
  name: orders-schema-sql
data:
  schema.sql: |
    USE orders;
    CREATE TABLE items (
      id BIGINT AUTO_INCREMENT PRIMARY KEY,
      name VARCHAR(255) NOT NULL,
      price DECIMAL(10,2) NOT NULL,
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
    );
    CREATE TABLE orders (
      id BIGINT AUTO_INCREMENT PRIMARY KEY,
      user_id BIGINT NOT NULL,
      status ENUM('pending','shipped','delivered') DEFAULT 'pending',
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
    );    

1. GitOps 集成：Schema 变更记录于 Git，可追溯、可回滚
2. 一致性保障：环境间 Schema 一致，消除手动变更导致的漂移
3. 权限控制：通过 RBAC 控制谁可以修改数据库 Schema
4. 审计追踪：每次 Schema 变更记录在 Kubernetes Events 和 Status 中

graph LR
    subgraph RegionA["Region A (Primary)"]
        subgraph PrimaryCluster["KubeDB MySQL Group Replication"]
            Primary["mysql-primary (3 nodes)"]
        end
    end

    subgraph RegionB["Region B (Standby / DR)"]
        subgraph StandbyCluster["KubeDB MySQL Standby Cluster"]
            Standby["mysql-standby (3 nodes)"]
        end
    end

    Primary -->|"Binlog Replication (WAN/VPN)"| Standby

# Primary 集群
apiVersion: kubedb.com/v1
kind: MySQL
metadata:
  name: mysql-primary
  namespace: prod
spec:
  version: "8.0.36"
  replicas: 3
  topology:
    mode: GroupReplication

# DR 集群 KubeDB >= v2024.x Enterprise
apiVersion: kubedb.com/v1
kind: MySQL
metadata:
  name: mysql-standby
  namespace: dr
spec:
  version: "8.0.36"
  replicas: 3
  topology:
    mode: GroupReplication
  init:
    standby:
      sourceRef:
        name: mysql-primary
        namespace: prod
      sourceCluster:
        host: mysql-primary.prod.svc.cluster.local
        port: 3306

graph TD
    subgraph Cluster["Redis Cluster (6 nodes min)<br/>Hash Slot: CRC16(key) % 16384"]
        subgraph SG0["Shard Group 0"]
            M0["Master-0<br/>Slots 0-5460<br/>key: user:1001<br/>key: order:5001"]
            S0["Slave-0<br/>key: user:1001<br/>key: order:5001"]
        end
        subgraph SG1["Shard Group 1"]
            M1["Master-1<br/>Slots 5461-10922<br/>key: user:2001<br/>key: order:6001"]
            S1["Slave-1<br/>key: user:2001<br/>key: order:6001"]
        end
        subgraph SG2["Shard Group 2"]
            M2["Master-2<br/>Slots 10923-16383<br/>key: user:3001<br/>key: order:7001"]
            S2["Slave-2<br/>key: user:3001<br/>key: order:7001"]
        end
    end

    M0 --> S0
    M1 --> S1
    M2 --> S2

apiVersion: kubedb.com/v1
kind: Redis
metadata:
  name: redis-cluster
spec:
  version: "7.2.4"
  mode: Cluster
  cluster:
    master: 3
    replicas: 1
  storageType: Durable
  storage:
    storageClassName: gp3
    accessModes: [ReadWriteOnce]
    resources:
      requests:
        storage: 50Gi

初始化:
  Master-0: Slots 0-5460    (5461 个)
  Master-1: Slots 5461-10922 (5462 个)
  Master-2: Slots 10923-16383 (5461 个)

扩容（master: 3 → 4）:
  Master-3 加入集群，无 Slot
  redis-cli --cluster reshard → 从现有 Master 迁移 Slot
  Master-3: Slots 0-1365, 5461-6826, 10923-12288

缩容（master: 4 → 3）:
  Master-3 的 Slot 迁移到其他 Master
  Master-3 从集群移除
  StatefulSet replicas 缩减

1. Master-0 宕机
2. Slave-0 通过集群 Gossip 协议检测 Master-0 失效
3. Slave-0 发起选举（Slave 之间的 Raft 子协议）
4. Slave-0 当选为新 Master，接管 Slots 0-5460
5. KubeDB Operator 更新 Service 指向新 Master
6. 原 Master-0 恢复后以 Slave 身份重新加入

# 查看 Operator 日志
kubectl logs -n kubedb deploy/kubedb-operator --tail=100 -f

# 关键日志模式
# "Reconciling MySQL"  → 每个 Reconcile 循环入口
# "error syncing"      → Reconcile 失败
# "successfully synced" → Reconcile 成功

# 查看 Webhook 是否正常
kubectl get validatingwebhookconfigurations,mutatingwebhookconfigurations | grep kubedb

spec:
  enableSSL: true
  tls:
    issuerRef:
      apiGroup: cert-manager.io
      kind: Issuer
      name: mysql-ca-issuer
    certificates:
      - alias: server
        dnsNames:
          - mysql-secure.prod.svc
      - alias: client
        subject:
          organizations:
            - prod-apps
  requireSSL: true

# KubeDB 自动生成根密码并存入 Secret
apiVersion: v1
kind: Secret
metadata:
  name: db-auth
type: kubernetes.io/basic-auth
data:
  username: cm9vdA==
  password: <auto-generated-base64>

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: mysql-deny-all
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: mysql
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: authorized-app
      ports:
        - protocol: TCP
          port: 3306

# 推荐资源规格
spec:
  podTemplate:
    spec:
      resources:
        requests:
          cpu: 4
          memory: 8Gi
        limits:
          cpu: 8
          memory: 16Gi
      # 绑定内核，减少 CPU 争抢
      cpuPolicy:
        cpuManagerPolicy: static

spec:
  backupConfig:
    schedule: "0 2 * * *"      # 每日凌晨 2 点全量备份
    retentionPolicy:
      name: keep-last-30
      keepLast: 30
      keepDaily: 7
      keepWeekly: 4
      keepMonthly: 3
      prune: true
    repository:
      name: s3-prod-backup     # 跨区域 S3 存储

1. enableSSL: true 启用 TLS 加密传输
2. deletionPolicy: DoNotTerminate 防止误删除
3. NetworkPolicy 限制数据库端口仅允许授权 Pod 访问
4. configSecret 中关闭不必要的数据库特性（如 LOAD DATA LOCAL）
5. PodSecurityContext 以非 root 用户运行
6. 定期轮换数据库根密码（通过 Secret 更新）
7. 启用审计日志（MySQL Enterprise Audit / pgAudit）
8. 敏感字段（password）不打印在 CR Status 中

1. 数据库 CR 纳入 Git 版本管理（GitOps）
2. 任何 CR 变更前先在 Staging 集群验证
3. 大版本升级前创建完整备份，并测试恢复流程
4. 存储扩容在业务低峰期执行（需 StorageClass 支持在线扩容）
5. 副本数变更（水平扩缩）在维护窗口内执行
6. 每月演练备份恢复流程，验证 RPO/RTO
7. Operator 升级前阅读 Release Notes，确认数据库引擎兼容性
8. 禁止在 Kubernetes Dashboard 或 kubectl edit 中直接修改 StatefulSet（应通过 KubeDB CR 操作）
9. 定期审计 Secret 访问记录
10. 节点维护前将 Pod 驱逐到其他节点（kubectl drain --ignore-daemonsets --delete-emptydir-data）

spec:
  podTemplate:
    spec:
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  app.kubernetes.io/name: mysql
                  app.kubernetes.io/instance: prod-mysql
              topologyKey: kubernetes.io/hostname

spec:
  podTemplate:
    spec:
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: mysql