Kubernetes集群中Spring Boot应用Pod卡住无法启动问题咨询

Spring Boot Pod无报错卡住启动失败排查方案 #

• 先执行kubectl describe pod <对应Pod名称>，查看Events字段，确认是否存在镜像拉取失败、PVC挂载异常、Secret/ConfigMap不存在、权限不足类问题：你当前Deployment配置了runAsUser为3000，需确认挂载的heapdump PV目录是否开放了3000用户的读写权限，避免权限不足导致启动卡住。
• 临时注释掉Deployment中的livenessProbe和readinessProbe配置后重新发布，避免探针超时误杀未完成启动的Pod：待Pod状态变为Running后，执行kubectl exec -it <Pod名称> -- /bin/bash进入容器，查看应用运行日志，或执行jstack <Java进程ID>查看线程栈，确认是否卡在外部依赖调用环节。
• 验证所有外部依赖连通性：你配置的数据库、Splunk、安全审计相关服务都需做连通性测试，若这些服务网络不通、鉴权失败，Spring Boot初始化对应客户端时会陷入无限重试，无明显报错但启动卡住。
• 确认JVM参数配置合理性：当前容器内存限额为4Gi，需检查应用启动脚本中JVM堆内存配置（Xmx/Xms）是否超过3.5Gi，避免JVM占用内存超出容器限额被OOM Kill，建议增加-XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/<app-name>heapdump参数，出现OOM时可留存dump文件用于分析。
• 本地验证镜像可用性：使用相同的环境变量配置在本地启动对应镜像，确认本地是否可以正常启动，排除应用本身代码逻辑问题。

你提供的Deployment配置格式化后如下：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: <deployement-name>
spec:
  selector:
    matchLabels:
      app: <app-name>
  replicas: 1
  template:
    metadata:
      labels:
        app: <app-name>
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "8090"
        prometheus.io/path: "/app/actuator/prometheus"
    spec:
      securityContext:
        runAsGroup: 3000
        runAsUser: 3000
      containers:
      - name: <app-name>
        image: <url>/REPLACE_ME
        imagePullPolicy: Always
        env:
        - name: DB_USER
          valueFrom:
            secretKeyRef:
              name: <random>-db-secret
              key: db-user
        - name: DB_PASS
          valueFrom:
            secretKeyRef:
              name: <random>-db-secret
              key: db-pass
        - name: spring-profile
          valueFrom:
            configMapKeyRef:
              name: spring-profile-stage
              key: ENV
        - name: securityaudit.hostname
          valueFrom:
            configMapKeyRef:
              name: securityaudit-config
              key: securityaudit.hostname
        - name: securityaudit.ipaddress
          valueFrom:
            configMapKeyRef:
              name: securityaudit-config
              key: securityaudit.ipaddress
        - name: securityaudit.product
          valueFrom:
            configMapKeyRef:
              name: securityaudit-config
              key: securityaudit.product
        - name: splunkurl
          valueFrom:
            configMapKeyRef:
              name: splunk-config
              key: splunkurl
        - name: splunktoken
          valueFrom:
            secretKeyRef:
              name: hec-token-secret
              key: hec-token
        - name: splunkindex
          valueFrom:
            configMapKeyRef:
              name: splunk-config
              key: splunkindex
        - name: splunkCertValidDisable
          valueFrom:
            configMapKeyRef:
              name: splunk-config
              key: splunkDisableCertValidation
        - name: MY_POD_ID
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        resources:
          limits:
            memory: 4Gi
            cpu: 1
          requests:
            memory: 4Gi
            cpu: 1
        securityContext:
          privileged: false
        ports:
        - containerPort: 8090
        livenessProbe:
           httpGet:
             path: /<app-name>/actuator/health/liveness
             port: 8090
           initialDelaySeconds: 180
        readinessProbe:
           httpGet:
             path: /<app-name>/actuator/health/readiness
             port: 8090
           initialDelaySeconds: 180
           periodSeconds: 10
        volumeMounts:
        - name: <app-name>-heapdump
          mountPath: /<app-name>heapdump
      volumes:
      - name: <app-name>-heapdump
        persistentVolumeClaim:
          claimName: <app-name>heap-dump-stage

内容的提问来源于stack exchange，提问作者lucky