Skill Seekers 的 Kubernetes 部署实战Helm 一键部署与手动清单双路径详解【免费下载链接】Skill_SeekersConvert documentation websites, GitHub repositories, and PDFs into Claude AI skills with automatic conflict detection项目地址: https://gitcode.com/gh_mirrors/sk/Skill_Seekers导读本文是 Skill Seekers 项目在 Kubernetes 上的完整部署指南涵盖 Helm Chart 一键安装与原生 Kubernetes 清单Secret/ConfigMap/Deployment/Service手动部署两条路径并深入讲解资源配额、HPA/VPA 弹性伸缩、高可用调度、Prometheus 监控、Ingress TLS、持久化存储、NetworkPolicy 与 RBAC 安全加固等生产级配置。读完本文你将能够把 Skill Seekers 的 MCP Server 及其配套向量数据库Weaviate / Qdrant / Chroma稳定运行在自有集群中并掌握与仓库内 helm/skill-seekers 实际模板逐项对应的参数语义。前置条件1. Kubernetes 集群最低要求Kubernetes v1.21已配置好 kubectl至少 2 个节点总计 4 个 CPU 核心总计 8 GB 内存云厂商选项AWSEKSElastic Kubernetes ServiceGCPGKEGoogle Kubernetes EngineAzureAKSAzure Kubernetes Service本地开发Minikube、kind、k3s说明以上为项目部署文档给出的基线实际生产环境应结合下方「资源请求与限制」章节根据并发抓取任务量与向量库数据规模评估更精确的容量。2. 必需工具# kubectl curl -LO https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl # Helm 3 curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash # 验证安装 kubectl version --client helm version3. 集群访问# 验证集群连接 kubectl cluster-info kubectl get nodes # 创建命名空间 kubectl create namespace skillseekers kubectl config set-context --current --namespaceskillseekersHelm 快速部署仓库自带一个完整的 Helm Charthelm/skill-seekersChart.yaml声明其apiVersion: v2、type: application版本1.0.0、appVersion: 2.9.0并预置了appCLI与mcpServerMCP Server两个工作负载以及 Weaviate、Qdrant、Chroma 三个向量数据库组件的可选开关。1. 使用默认值安装# 添加 Helm 仓库仓库对外发布后可用 helm repo add skillseekers https://charts.skillseekers.io helm repo update # 安装 release helm install skillseekers skillseekers/skillseekers \ --namespace skillseekers \ --create-namespace # 或直接从仓库本地 Chart 安装 helm install skillseekers ./helm/skill-seekers \ --namespace skillseekers \ --create-namespace使用默认 values 时values.yaml 会启用mcpServer默认 2 副本、端口 8765、开启 HPA、配置好存活/就绪探针以及全部三个向量数据库并默认开启podDisruptionBudgetminAvailable: 1与rbac.create: true。2. 使用自定义 values 安装# 创建 values 文件 cat values-prod.yaml EOF replicaCount: 3 secrets: anthropicApiKey: sk-ant-... githubToken: ghp_... openaiApiKey: sk-... resources: limits: cpu: 2000m memory: 4Gi requests: cpu: 1000m memory: 2Gi ingress: enabled: true className: nginx hosts: - host: api.skillseekers.example.com paths: - path: / pathType: Prefix tls: - secretName: skillseekers-tls hosts: - api.skillseekers.example.com autoscaling: enabled: true minReplicas: 2 maxReplicas: 10 targetCPUUtilizationPercentage: 70 EOF # 使用自定义 values 安装 helm install skillseekers ./helm/skill-seekers \ --namespace skillseekers \ --create-namespace \ --values values-prod.yaml与仓库模板的对应关系上述secrets字段由 secret.yaml 渲染仅当对应 key 非空时才生成ANTHROPIC_API_KEY、GOOGLE_API_KEY、OPENAI_API_KEY、GITHUB_TOKEN四个条目并做b64enc编码autoscaling字段由 hpa.yaml 消费。注意 Chart 中 HPA 还额外支持targetMemoryUtilizationPercentage默认 80CPU 与内存双指标可同时生效——这比单 CPU 阈值更能贴合文档抓取任务的突发特征。3. Helm 常用命令# 列出 release helm list -n skillseekers # 查看状态 helm status skillseekers -n skillseekers # 升级 release helm upgrade skillseekers ./helm/skill-seekers \ --namespace skillseekers \ --values values-prod.yaml # 回滚 helm rollback skillseekers 1 -n skillseekers # 卸载 helm uninstall skillseekers -n skillseekers值得注意的一个实现细节MCP Server 的 mcp-deployment.yaml 模板在 Pod annotations 中注入了checksum/config与checksum/secret即把 ConfigMap 与 Secret 内容做sha256sum作为注解。这意味着当你仅修改 values 中的配置或密钥并执行helm upgrade时模板会自动触发 Pod 滚动重启而无需手动 rollout。手动部署原生 Kubernetes 清单若不使用 Helm也可以按以下步骤用原生清单部署。以下清单与文档保持一致并结合仓库实现补充说明。1. Secrets为 API Key 创建 Secret# secrets.yaml apiVersion: v1 kind: Secret metadata: name: skillseekers-secrets namespace: skillseekers type: Opaque stringData: ANTHROPIC_API_KEY: sk-ant-... GITHUB_TOKEN: ghp_... OPENAI_API_KEY: sk-... VOYAGE_API_KEY: ...kubectl apply -f secrets.yaml说明stringData会在写入时由 API Server 自动 base64 编码便于人类可读维护。仓库 Helm 模板则采用data字段 b64enc管道的方式两种写法等价。VOYAGE_API_KEY属于可选增强项Chart 默认仅内置 Anthropic / Google / OpenAI / GitHub 四类密钥。2. ConfigMap# configmap.yaml apiVersion: v1 kind: ConfigMap metadata: name: skillseekers-config namespace: skillseekers data: MCP_TRANSPORT: http MCP_PORT: 8765 LOG_LEVEL: INFO CACHE_TTL: 86400kubectl apply -f configmap.yaml与仓库模板的对应关系Helm 的 configmap.yaml 会把values.env下所有键值对渲染进 ConfigMap并额外注入两个路径型变量SKILL_SEEKERS_HOME: /data与SKILL_SEEKERS_OUTPUT: /output同时设置了PYTHONUNBUFFERED1、PYTHONDONTWRITEBYTECODE1。手动部署时若希望路径语义与 Chart 一致建议在 ConfigMap 中同样补充SKILL_SEEKERS_HOME与SKILL_SEEKERS_OUTPUT两个变量挂载路径见下文 Deployment。3. Deployment# deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: skillseekers-mcp namespace: skillseekers labels: app: skillseekers component: mcp-server spec: replicas: 3 selector: matchLabels: app: skillseekers component: mcp-server template: metadata: labels: app: skillseekers component: mcp-server spec: containers: - name: mcp-server image: yusyuss/skill-seekers-mcp:latest imagePullPolicy: IfNotPresent ports: - containerPort: 8765 name: http protocol: TCP env: - name: MCP_TRANSPORT valueFrom: configMapKeyRef: name: skillseekers-config key: MCP_TRANSPORT - name: MCP_PORT valueFrom: configMapKeyRef: name: skillseekers-config key: MCP_PORT - name: ANTHROPIC_API_KEY valueFrom: secretKeyRef: name: skillseekers-secrets key: ANTHROPIC_API_KEY - name: GITHUB_TOKEN valueFrom: secretKeyRef: name: skillseekers-secrets key: GITHUB_TOKEN resources: requests: cpu: 1000m memory: 2Gi limits: cpu: 2000m memory: 4Gi livenessProbe: httpGet: path: /health port: 8765 initialDelaySeconds: 30 periodSeconds: 10 timeoutSeconds: 5 failureThreshold: 3 readinessProbe: httpGet: path: /health port: 8765 initialDelaySeconds: 10 periodSeconds: 5 timeoutSeconds: 3 failureThreshold: 2 volumeMounts: - name: data mountPath: /app/data - name: cache mountPath: /app/cache volumes: - name: data persistentVolumeClaim: claimName: skillseekers-data - name: cache emptyDir: {}kubectl apply -f deployment.yaml源码印证/health端点并非虚构——在 server_fastmcp.py 中可以看到健康检查路由的实现app.routes.insert(0, Route(/health, health_check, methods[GET]))启动日志也会输出 Health Check: http://{host}:{port}/health。因此存活/就绪探针的httpGet.path/health与该实现严格对应。路径差异提示文档中的手动清单将数据挂载到/app/data、缓存挂载到/app/cache而仓库 Helm 模板mcp-deployment.yaml默认将三个 PVC 分别挂载到/data、/output、/configs后者readOnly: true并在 ConfigMap 中通过SKILL_SEEKERS_HOME/data、SKILL_SEEKERS_OUTPUT/output告知应用。手动部署时务必保持挂载路径与上述两个环境变量一致避免应用写错目录。4. Service# service.yaml apiVersion: v1 kind: Service metadata: name: skillseekers-mcp namespace: skillseekers labels: app: skillseekers component: mcp-server spec: type: ClusterIP ports: - port: 8765 targetPort: 8765 protocol: TCP name: http selector: app: skillseekers component: mcp-serverkubectl apply -f service.yaml仓库的 service.yaml 模板与该清单结构一致其selector使用 Helm 的selectorLabelsapp.kubernetes.io/nameapp.kubernetes.io/instance并叠加app.kubernetes.io/component: mcp-server。若你完全手写清单请务必保证 Service 的 selector 与 Deployment 的 pod labels 完全匹配否则 endpoints 为空、流量无法到达。5. 验证部署# 检查 Pod kubectl get pods -n skillseekers # 检查 Service kubectl get svc -n skillseekers # 检查日志 kubectl logs -n skillseekers -l appskillseekers --tail100 -f # 端口转发测试 kubectl port-forward -n skillseekers svc/skillseekers-mcp 8765:8765 # 测试端点 curl http://localhost:8765/health配置详解1. 资源请求与限制resources: requests: cpu: 500m # 保证的 CPU memory: 1Gi # 保证的内存 limits: cpu: 2000m # CPU 上限 memory: 4Gi # 内存上限仓库 values.yaml 中的默认值可作为参考基线appCLI 工作负载requestscpu: 500m / memory: 1Gilimitscpu: 2000m / memory: 4GimcpServerMCP 服务requestscpu: 250m / memory: 512Milimitscpu: 1000m / memory: 2Gi需要说明的是requests与limits是调度与 OOM 保护的关键。Kubernetes 调度器按 requests 计算节点容量当容器内存超过 limits 时会被 OOM Kill。文档抓取类任务通常突发性强建议为mcpServer保留memory余量并把 limits 设为 requests 的 24 倍。2. 环境变量注入方式env: # 来自 ConfigMap - name: LOG_LEVEL valueFrom: configMapKeyRef: name: skillseekers-config key: LOG_LEVEL # 来自 Secret - name: ANTHROPIC_API_KEY valueFrom: secretKeyRef: name: skillseekers-secrets key: ANTHROPIC_API_KEY # 直接值 - name: MCP_TRANSPORT value: http更省事的替代方案Helm 模板在容器定义中使用的是envFromconfigMapRefsecretRef各引用一次见 mcp-deployment.yaml即把整个 ConfigMap/Secret 的键值对整体注入环境变量无需逐条声明valueFrom。如果你喜欢这种「一份配置、全局注入」的方式手动清单里也可以改用envFrom精简。3. 多环境部署# 开发环境 helm install skillseekers-dev ./helm/skill-seekers \ --namespace skillseekers-dev \ --values values-dev.yaml # 预发布环境 helm install skillseekers-staging ./helm/skill-seekers \ --namespace skillseekers-staging \ --values values-staging.yaml # 生产环境 helm install skillseekers-prod ./helm/skill-seekers \ --namespace skillseekers-prod \ --values values-prod.yamlChart 的global.environment字段默认production用于区分环境配合不同 values 文件可以在同一集群中隔离运行多套实例。注意_helpers.tpl中的fullname规则release 名不同生成的资源名前缀也不同如skillseekers-dev-mcp天然避免资源名冲突。弹性伸缩1. 手动扩缩容# 扩容 Deployment kubectl scale deployment skillseekers-mcp -n skillseekers --replicas5 # 验证 kubectl get pods -n skillseekers2. Horizontal Pod AutoscalerHPA# hpa.yaml apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: name: skillseekers-mcp namespace: skillseekers spec: scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: skillseekers-mcp minReplicas: 2 maxReplicas: 10 metrics: - type: Resource resource: name: cpu target: type: Utilization averageUtilization: 70 - type: Resource resource: name: memory target: type: Utilization averageUtilization: 80 behavior: scaleDown: stabilizationWindowSeconds: 300 policies: - type: Percent value: 50 periodSeconds: 60 scaleUp: stabilizationWindowSeconds: 0 policies: - type: Percent value: 100 periodSeconds: 15 - type: Pods value: 2 periodSeconds: 15 selectPolicy: Maxkubectl apply -f hpa.yaml # 监控自动伸缩 kubectl get hpa -n skillseekers --watch源码印证仓库 hpa.yaml 模板与上述清单一致且 Chart 默认autoscaling.enabled: true、minReplicas: 2、maxReplicas: 10、CPU 70% / 内存 80%。另外注意 mcp-deployment.yaml当 HPA 启用时模板会省略 Deployment 的replicas字段把副本数完全交给 HPA 管理避免两者打架——这是 Helm 官方推荐做法。3. Vertical Pod AutoscalerVPA# vpa.yaml apiVersion: autoscaling.k8s.io/v1 kind: VerticalPodAutoscaler metadata: name: skillseekers-mcp namespace: skillseekers spec: targetRef: apiVersion: apps/v1 kind: Deployment name: skillseekers-mcp updatePolicy: updateMode: Auto resourcePolicy: containerPolicies: - containerName: mcp-server minAllowed: cpu: 500m memory: 1Gi maxAllowed: cpu: 4000m memory: 8Gi注意事项VPA 要求集群已安装 VPA 组件autoscaling.k8s.ioAPI。且 VPA 的Auto模式会通过驱逐 Pod 来调整资源建议与 HPA 错开使用官方不推荐两者对同一 Deployment 同时开启 CPU 指标。高可用1. Pod 中断预算PDB# pdb.yaml apiVersion: policy/v1 kind: PodDisruptionBudget metadata: name: skillseekers-mcp namespace: skillseekers spec: minAvailable: 2 selector: matchLabels: app: skillseekers component: mcp-server仓库 values.yaml 默认podDisruptionBudget.enabled: true, minAvailable: 1可根据副本数上调。2. Pod 反亲和spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 100 podAffinityTerm: labelSelector: matchExpressions: - key: app operator: In values: - skillseekers topologyKey: kubernetes.io/hostname反亲和保证不同副本尽量分布到不同节点避免单节点故障导致全部副本同时下线。3. 节点亲和spec: affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: node-role operator: In values: - worker preferredDuringSchedulingIgnoredDuringExecution: - weight: 1 preference: matchExpressions: - key: node-type operator: In values: - high-cpu4. 多可用区部署spec: topologySpreadConstraints: - maxSkew: 1 topologyKey: topology.kubernetes.io/zone whenUnsatisfiable: DoNotSchedule labelSelector: matchLabels: app: skillseekersmaxSkew: 1表示各可用区 Pod 数量差不超过 1whenUnsatisfiable: DoNotSchedule表示不满足则不可调度——多区集群下可显著提升容灾能力。监控1. Prometheus 指标# servicemonitor.yaml apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: skillseekers-mcp namespace: skillseekers spec: selector: matchLabels: app: skillseekers endpoints: - port: metrics interval: 30s path: /metricsChart 提供了serviceMonitor开关默认enabled: false开启后以 30s 间隔、/metrics路径抓取scrapeTimeout默认 10s可通过 values 调整。前提是集群已安装 Prometheus Operator。2. Grafana Dashboard# 导入 Dashboard kubectl apply -f grafana/dashboard.json3. Fluentd 日志采集# fluentd-configmap.yaml apiVersion: v1 kind: ConfigMap metadata: name: fluentd-config data: fluent.conf: | source type tail path /var/log/containers/skillseekers*.log pos_file /var/log/fluentd-skillseekers.pos tag kubernetes.* format json /source match ** type elasticsearch host elasticsearch port 9200 /matchFluentd 以 DaemonSet 方式在每个节点上 tail/var/log/containers/skillseekers*.log将 JSON 格式的容器日志转发到 Elasticsearch可配合 Kibana 完成集中检索。Ingress 与负载均衡1. Nginx Ingress# ingress.yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: skillseekers namespace: skillseekers annotations: kubernetes.io/ingress.class: nginx cert-manager.io/cluster-issuer: letsencrypt-prod nginx.ingress.kubernetes.io/rate-limit: 100 nginx.ingress.kubernetes.io/ssl-redirect: true spec: tls: - hosts: - api.skillseekers.example.com secretName: skillseekers-tls rules: - host: api.skillseekers.example.com http: paths: - path: / pathType: Prefix backend: service: name: skillseekers-mcp port: number: 8765与仓库模板的对应关系Chart 的 ingress.yaml 使用ingressClassName字段默认nginx并默认在 values 中预置了一条/mcp前缀路由指向mcp-server服务 8765 端口。若你的 MCP 客户端如 Cursor、Windsurf 的 HTTP transport 配置需要访问根路径覆盖ingress.hosts[].paths[].path即可。2. cert-manager 自动签发 TLS# 安装 cert-manager kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.0/cert-manager.yaml # 创建 ClusterIssuer cat EOF | kubectl apply -f - apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: letsencrypt-prod spec: acme: server: https://acme-v02.api.letsencrypt.org/directory email: adminexample.com privateKeySecretRef: name: letsencrypt-prod solvers: - http01: ingress: class: nginx EOFcert-manager 通过 HTTP-01 校验域名所有权后自动签发 Lets Encrypt 证书并写入 Ingress 引用的skillseekers-tlsSecret。Chart values 中已预置cert-manager.io/cluster-issuer: letsencrypt-prod注解与ssl-redirect: true开启 ingress 后即生效。存储1. PersistentVolumePV# pv.yaml apiVersion: v1 kind: PersistentVolume metadata: name: skillseekers-data spec: capacity: storage: 50Gi accessModes: - ReadWriteOnce persistentVolumeReclaimPolicy: Retain storageClassName: standard hostPath: path: /mnt/skillseekers-data注意hostPath仅适用于单节点测试环境多节点生产集群应使用云厂商的块存储/文件存储 StorageClass如 EBS、Persistent Disk、Azure Disk由动态供给自动创建 PV。2. PersistentVolumeClaimPVC# pvc.yaml apiVersion: v1 kind: PersistentVolumeClaim metadata: name: skillseekers-data namespace: skillseekers spec: accessModes: - ReadWriteOnce resources: requests: storage: 50Gi storageClassName: standard与仓库模板的对应关系Chart 的 pvc.yaml 会为三个目录各生成一个 PVC-data默认 10GiReadWriteOnce工作数据-output默认 20GiReadWriteOnce生成产物-configs默认 1GiReadOnlyMany配置输入同时为每个启用的向量数据库生成独立 PVCWeaviate 50Gi、Qdrant 50Gi、Chroma 30Gi均可通过 values 调整。storageClass: 表示使用集群默认 StorageClass。3. StatefulSet有状态工作负载apiVersion: apps/v1 kind: StatefulSet metadata: name: skillseekers-cache spec: serviceName: skillseekers-cache replicas: 3 volumeClaimTemplates: - metadata: name: data spec: accessModes: [ ReadWriteOnce ] resources: requests: storage: 10GiStatefulSet 的volumeClaimTemplates会为每个副本自动创建独立 PVCdata-sts-ordinal适合缓存类或需要稳定网络标识的有状态组件。安全1. NetworkPolicy# networkpolicy.yaml apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: skillseekers-mcp namespace: skillseekers spec: podSelector: matchLabels: app: skillseekers policyTypes: - Ingress - Egress ingress: - from: - namespaceSelector: matchLabels: name: skillseekers ports: - protocol: TCP port: 8765 egress: - to: - namespaceSelector: {} ports: - protocol: TCP port: 443 # HTTPS - protocol: TCP port: 80 # HTTP前提NetworkPolicy 需要集群启用支持它的 CNI如 Calico、Cilium。Chart 提供了networkPolicy开关默认关闭其模板语义与该清单一致仅放行同命名空间的 8765 入站出站仅允许 80/443。2. Pod 安全PSP / Pod Security# psp.yaml apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: skillseekers-restricted spec: privileged: false allowPrivilegeEscalation: false requiredDropCapabilities: - ALL volumes: - configMap - emptyDir - projected - secret - persistentVolumeClaim runAsUser: rule: MustRunAsNonRoot seLinux: rule: RunAsAny fsGroup: rule: RunAsAny现代替代方案PSP 已在 Kubernetes 1.21 弃用、1.25 移除。当前更推荐 Pod Security Admission 或第三方准入控制器。仓库 Chart 从容器层面做了等同约束podSecurityContext默认runAsNonRoot: true, runAsUser: 1000, fsGroup: 1000securityContext默认drop: [ALL]、allowPrivilegeEscalation: false见 values.yaml与 PSP 的MustRunAsNonRoot、requiredDropCapabilities: ALL目标一致。3. RBAC# rbac.yaml apiVersion: v1 kind: ServiceAccount metadata: name: skillseekers namespace: skillseekers --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: skillseekers namespace: skillseekers rules: - apiGroups: [] resources: [configmaps, secrets] verbs: [get, list] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: skillseekers namespace: skillseekers roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: skillseekers subjects: - kind: ServiceAccount name: skillseekers namespace: skillseekersChart 默认rbac.create: true并自动创建 ServiceAccountserviceAccount.create: true可通过serviceAccount.name覆盖如果应用需要读写其他集群资源如 Git 仓库 Secret、ConfigMap在rbac.rules中追加规则即可。故障排查常见问题1. Pod 无法启动# 检查 Pod 状态 kubectl get pods -n skillseekers # 查看 Pod 详情 kubectl describe pod pod-name -n skillseekers # 查看事件 kubectl get events -n skillseekers --sort-by.lastTimestamp # 查看日志 kubectl logs pod-name -n skillseekersdescribe输出中的 Events 是定位镜像拉取失败、探针失败、调度失败的第一手信息若事件显示FailedScheduling多半是资源不足或亲和/反亲和约束无法满足。2. 镜像拉取失败# 查看镜像拉取 Secret kubectl get secrets -n skillseekers # 创建私有仓库拉取 Secret kubectl create secret docker-registry regcred \ --docker-serverregistry.example.com \ --docker-usernameuser \ --docker-passwordpassword \ -n skillseekers # 在 Pod spec 中使用 spec: imagePullSecrets: - name: regcred3. 资源不足# 查看节点资源 kubectl top nodes # 查看 Pod 资源 kubectl top pods -n skillseekers # 调整资源 kubectl edit deployment skillseekers-mcp -n skillseekers4. Service 无法访问# 检查 Service kubectl get svc -n skillseekers kubectl describe svc skillseekers-mcp -n skillseekers # 检查 Endpoints kubectl get endpoints -n skillseekers # 端口转发 kubectl port-forward svc/skillseekers-mcp 8765:8765 -n skillseekersendpoints为空通常意味着 Service 的 selector 与 Pod 标签不匹配是手工清单最常见的坑。调试命令# 进入 Pod 执行命令 kubectl exec -it pod-name -n skillseekers -- /bin/bash # 从 Pod 拷贝文件 kubectl cp skillseekers/pod-name:/app/data ./data # 检查 Pod 网络连通性 kubectl exec pod-name -n skillseekers -- nslookup google.com # 查看完整 Pod spec kubectl get pod pod-name -n skillseekers -o yaml # 滚动重启 Deployment kubectl rollout restart deployment skillseekers-mcp -n skillseekerskubectl cp与kubectl exec组合可以在不改动应用代码的情况下导出 PVC 中的抓取产物或向量数据用于诊断。最佳实践始终设置资源 requests 与 limits调度与 OOM 保护的基础使用命名空间做环境隔离dev / staging / prod 分命名空间部署为波动负载开启自动伸缩结合 HPACPU内存双指标应对抓取任务突发实现健康检查liveness readiness与/health端点对齐readiness 决定流量接入liveness 决定自动重启用 Secret 保存敏感数据API Key 严禁写入镜像或明文 ConfigMap开启监控与日志ServiceMonitor Fluentd/EFK 栈为高可用配置 PodDisruptionBudget保证节点维护时服务不中断使用 RBAC 做访问控制最小权限原则启用 NetworkPolicy默认拒绝 白名单放行定期备份持久卷PVC 中的抓取数据与向量库数据需要周期性快照下一步查看 PRODUCTION_DEPLOYMENT.md 获取通用生产部署规范查看 DOCKER_DEPLOYMENT.md 了解容器化构建细节仓库根目录的 Dockerfile 与 Dockerfile.mcp 分别对应 CLI 与 MCP Server 镜像查看 TROUBLESHOOTING.md 排查常见问题如果需要进一步了解 MCP HTTP 传输模式下客户端如何接入端口、路径与健康检查端点可参阅 MCP_SETUP.md 与 HTTP_TRANSPORT.md。【免费下载链接】Skill_SeekersConvert documentation websites, GitHub repositories, and PDFs into Claude AI skills with automatic conflict detection项目地址: https://gitcode.com/gh_mirrors/sk/Skill_Seekers创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考