如何利用Kubernetes StatefulSet的ID匹配节点选择器与可用区？

你想要实现的pod-0绑定zone-1、pod-1绑定zone-2这类固定编号与可用区的绑定，Kubernetes原生配置不支持直接在affinity里使用{{ id +1 }}这类模板语法，以下是两种可行的实现方案：

方案一：Kustomize批量生成固定规则（适合固定副本数场景） #

如果你的StatefulSet副本数量固定（比如3个），可以用Kustomize的补丁功能，为每个编号的Pod单独配置节点亲和规则。

1. 先编写基础的StatefulSet配置（base/statefulset.yaml）：

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: my-statefulset
spec:
  serviceName: "my-service"
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
      - name: my-container
        image: nginx:alpine

2. 编写Kustomization文件，为每个Pod编号添加对应的节点亲和规则：

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- base/statefulset.yaml

# 为pod-0绑定zone-1
patches:
- target:
    kind: StatefulSet
    name: my-statefulset
  patch: |-
    - op: add
      path: /spec/template/spec/affinity
      value:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: topology.kubernetes.io/zone
                operator: In
                values:
                - zone-1
# 为pod-1绑定zone-2
- target:
    kind: StatefulSet
    name: my-statefulset
  patch: |-
    - op: replace
      path: /spec/template/spec/affinity/nodeAffinity/requiredDuringSchedulingIgnoredDuringExecution/nodeSelectorTerms/0/matchExpressions/0/values
      value: ["zone-2"]
# 为pod-2绑定zone-3
- target:
    kind: StatefulSet
    name: my-statefulset
  patch: |-
    - op: replace
      path: /spec/template/spec/affinity/nodeAffinity/requiredDuringSchedulingIgnoredDuringExecution/nodeSelectorTerms/0/matchExpressions/0/values
      value: ["zone-3"]

执行kustomize build . | kubectl apply -f -即可生成带有对应亲和规则的StatefulSet。

方案二：自定义准入控制器（适合动态副本数场景） #

如果StatefulSet副本数会动态调整，推荐用Mutating Admission Webhook，在Pod创建时自动根据编号修改节点亲和规则：

1. 编写Webhook核心逻辑（示例用Python实现）：

import base64
import json
from flask import Flask, request, jsonify

app = Flask(__name__)

@app.route('/mutate', methods=['POST'])
def mutate_pod():
    req = request.get_json()
    pod = req['request']['object']
    
    # 从Pod名称提取编号（StatefulSet的Pod命名格式为<name>-<ordinal>）
    if '-' not in pod['metadata']['name']:
        return jsonify({'response': {'allowed': True}})
    
    ordinal = int(pod['metadata']['name'].split('-')[-1])
    target_zone = f"zone-{ordinal + 1}"
    
    # 构造节点亲和规则
    affinity = {
        'nodeAffinity': {
            'requiredDuringSchedulingIgnoredDuringExecution': {
                'nodeSelectorTerms': [
                    {
                        'matchExpressions': [
                            {
                                'key': 'topology.kubernetes.io/zone',
                                'operator': 'In',
                                'values': [target_zone]
                            }
                        ]
                    }
                ]
            }
        }
    }
    
    # 生成JSON Patch
    patch = [
        {
            'op': 'replace' if 'affinity' in pod['spec'] else 'add',
            'path': '/spec/affinity',
            'value': affinity
        }
    ]
    
    return jsonify({
        'apiVersion': 'admission.k8s.io/v1',
        'kind': 'AdmissionReview',
        'response': {
            'allowed': True,
            'patchType': 'JSONPatch',
            'patch': base64.b64encode(json.dumps(patch).encode()).decode()
        }
    })

if __name__ == '__main__':
    # 需配置SSL证书，Kubernetes要求Webhook使用HTTPS
    app.run(host='0.0.0.0', port=443, ssl_context=('cert.pem', 'key.pem'))

2. 将Webhook部署到集群，并配置MutatingWebhookConfiguration，让它拦截StatefulSet类型的Pod创建请求，确保Pod在调度前被修改为对应可用区的亲和规则。

内容的提问来源于stack exchange，提问作者Pieter