Kubernetes Pod 生命周期源码解析：从 Pending 到 Running 到底经历了什么？¶

kubectl run nginx --image=nginx --restart=Never

NAME    READY   STATUS              RESTARTS   AGE
nginx   0/1     ContainerCreating   0          2s

kubectl run crash-test --image=m.daocloud.io/docker.io/busybox --restart=Always --command -- sh -c "exit 1"

kubectl get pod crash-test

NAME         READY   STATUS             RESTARTS        AGE
crash-test   0/1     CrashLoopBackOff   6 (2m46s ago)   8m23s

kubectl get pod crash-test -o jsonpath='{.status.phase}{"\n"}{.status.containerStatuses[0].state}'

Running
{"terminated":{"containerID":"containerd://d6347011...","exitCode":1,"finishedAt":"2026-08-04T03:06:26Z","reason":"Error",...}}

status:
  phase: Pending
  conditions:
    - type: PodScheduled
      status: "False"

kubectl run nginx-test --image=m.daocloud.io/docker.io/library/nginx:alpine --restart=Never
# 立刻执行（手速要快，或者用 --watch）
kubectl get pod nginx-test -o yaml

status:
  phase: Running
  podIP: 10.244.5.6
  hostIP: 192.168.114.148
  nodeName: worker01
  containerStatuses:
  - containerID: containerd://67aca40f558b6b47bb0b2841709e96ee98c49d73e68f99fe5e2251d628068be3
    image: m.daocloud.io/docker.io/library/nginx:alpine
    state:
      running:
        startedAt: "2026-08-04T03:32:37Z"
    ready: true
    restartCount: 0
  conditions:
  - type: PodScheduled
    status: "True"
    lastTransitionTime: "2026-08-04T03:32:36Z"
  - type: Ready
    status: "True"
    lastTransitionTime: "2026-08-04T03:32:37Z"

# 调度前
spec:
  nodeName: ""        # 空
status:
  phase: Pending
  conditions:
    - type: PodScheduled
      status: "False"

# 调度后
spec:
  nodeName: "worker01"  # 有了
status:
  phase: Pending        # 还是 Pending
  conditions:
    - type: PodScheduled
      status: "True"    # 变成 True

pkg/scheduler/
├── scheduler.go          # 入口，scheduleOne() 循环
├── framework/
│   ├── runtime/
│   │   └── framework.go  # 调度框架
│   └── plugins/          # 内置插件（NodeResourcesFit、InterPodAffinity 等）
└── cache/                # 调度缓存

kubectl get pod nginx-test -o wide

NAME         READY   STATUS    RESTARTS   AGE   IP           NODE       NOMINATED NODE   READINESS GATES
nginx-test   1/1     Running   0          74s   10.244.5.6   worker01   <none>           <none>

kubectl describe pod nginx-test | grep -A5 Events

Events:
  Type    Reason     Age   From               Message
  ----    ------     ----  ----               -------
  Normal  Scheduled  89s   default-scheduler  Successfully assigned default/nginx-test to worker01
  Normal  Pulled     88s   kubelet            spec.containers{nginx-test}: Container image "m.daocloud.io/docker.io/library/nginx:alpine" already present on machine and can be accessed by the pod
  Normal  Created    88s   kubelet            spec.containers{nginx-test}: Container created

// Source: pkg/kubelet/kuberuntime/kuberuntime_manager.go L1450
func (m *kubeGenericRuntimeManager) SyncPod(
    ctx context.Context,
    pod *v1.Pod,
    podStatus *kubecontainer.PodStatus,
    pullSecrets []v1.Secret,
    backOff *flowcontrol.Backoff,
    restartAllContainers bool,
) (result kubecontainer.PodSyncResult) {
    // Step 1: Compute sandbox and container changes.
    podContainerChanges := m.computePodActions(ctx, pod, podStatus, restartAllContainers)

    // Step 2: Kill the pod if the sandbox has changed.
    if podContainerChanges.KillPod {
        killResult := m.killPodWithSyncResult(ctx, pod, ...)
        // ...
        if podContainerChanges.CreateSandbox {
            m.purgeInitContainers(ctx, pod, podStatus)
        }
    } else {
        // Step 3: Kill any running containers which are not to keep.
        for containerID, containerInfo := range podContainerChanges.ContainersToKill {
            m.killContainer(ctx, pod, containerID, containerInfo.name, ...)
        }
    }

    // Step 4: Create a sandbox for the pod if necessary.
    podSandboxID := podContainerChanges.SandboxID
    if podContainerChanges.CreateSandbox {
        podSandboxID, msg, err = m.createPodSandbox(ctx, pod, podContainerChanges.Attempt)
        // ...
    }

    // Step 5: start init containers (if any).
    // Step 6: start regular containers.
    // (后续步骤在 startContainer() 中实现)
}

// Source: pkg/kubelet/kuberuntime/kuberuntime_manager.go L1175
func (m *kubeGenericRuntimeManager) computePodActions(
    ctx context.Context,
    pod *v1.Pod,
    podStatus *kubecontainer.PodStatus,
    restartAllContainers bool,
) podActions {
    // 判断 Sandbox 是否需要重建
    createPodSandbox, attempt, sandboxID := runtimeutil.PodSandboxChanged(pod, podStatus)
    changes := podActions{
        KillPod:           createPodSandbox,
        CreateSandbox:     createPodSandbox,
        SandboxID:         sandboxID,
        Attempt:           attempt,
        ContainersToStart: []int{},
        ContainersToKill:  make(map[kubecontainer.ContainerID]containerToKillInfo),
    }

    // 如果需要重建 Sandbox，所有容器都要重来
    if createPodSandbox {
        // 返回需要启动的容器列表
        // ...
        return changes
    }

    // Sandbox 没变，逐个检查容器
    for idx, container := range pod.Spec.Containers {
        containerStatus := podStatus.FindContainerStatusByName(container.Name)
        // 容器变了？需要重启？
        expectedHash, currentHash, changed := containerChanged(container, containerStatus)
        if changed {
            changes.ContainersToKill[containerStatus.ID] = containerToKillInfo{...}
            changes.ContainersToStart = append(changes.ContainersToStart, idx)
        }
    }

    return changes
}

// Source: pkg/kubelet/kuberuntime/kuberuntime_container.go L199
// startContainer starts a container and returns a message indicates why it is failed on error.
// It starts the container through the following steps:
// * pull the image
// * create the container
// * start the container
// * run the post start lifecycle hooks (if applicable)
func (m *kubeGenericRuntimeManager) startContainer(
    ctx context.Context,
    podSandboxID string,
    podSandboxConfig *runtimeapi.PodSandboxConfig,
    spec *startSpec,
    pod *v1.Pod,
    podStatus *kubecontainer.PodStatus,
    pullSecrets []v1.Secret,
    podIP string,
    podIPs []string,
    imageVolumes kubecontainer.ImageVolumes,
) (string, error) {
    container := spec.container

    // Step 1: pull the image.
    imageRef, msg, err := m.imagePuller.EnsureImageExists(
        ctx, ref, pod, container.Image, pullSecrets, podSandboxConfig, ...)
    if err != nil {
        return msg, err
    }

    // Step 2: create the container.
    containerConfig, cleanupAction, err := m.generateContainerConfig(
        ctx, container, pod, restartCount, podIP, imageRef, podIPs, ...)
    if err != nil {
        return s.Message(), ErrCreateContainerConfig
    }

    containerID, err := m.runtimeService.CreateContainer(
        ctx, podSandboxID, containerConfig, podSandboxConfig)
    if err != nil {
        return s.Message(), ErrCreateContainer
    }
    m.recordContainerEvent(ctx, pod, container, containerID,
        v1.EventTypeNormal, events.CreatedContainer, "Container created")

    // Step 3: start the container.
    err = m.runtimeService.StartContainer(ctx, containerID)
    if err != nil {
        return s.Message(), kubecontainer.ErrRunContainer
    }
    m.recordContainerEvent(ctx, pod, container, containerID,
        v1.EventTypeNormal, events.StartedContainer, "Container started")

    // Step 4: execute the post start hook.
    if container.Lifecycle != nil && container.Lifecycle.PostStart != nil {
        msg, handlerErr := m.runner.Run(ctx, kubeContainerID, pod, container,
            container.Lifecycle.PostStart)
        if handlerErr != nil {
            // PostStart 失败，杀掉容器
            m.killContainer(ctx, pod, kubeContainerID, container.Name,
                "FailedPostStartHook", reasonFailedPostStartHook, nil, nil)
            return msg, ErrPostStartHook
        }
    }

    return "", nil
}

// Source: pkg/kubelet/kuberuntime/kuberuntime_sandbox.go L38
func (m *kubeGenericRuntimeManager) createPodSandbox(
    ctx context.Context,
    pod *v1.Pod,
    attempt uint32,
) (string, string, error) {
    // 1. 生成 Sandbox 配置
    podSandboxConfig, err := m.generatePodSandboxConfig(ctx, pod, attempt)
    if err != nil {
        return "", message, err
    }

    // 2. 创建 Pod 日志目录
    err = m.osInterface.MkdirAll(podSandboxConfig.LogDirectory, 0755)

    // 3. 查找 RuntimeClass handler
    runtimeHandler := ""
    if m.runtimeClassManager != nil {
        runtimeHandler, err = m.runtimeClassManager.LookupRuntimeHandler(
            pod.Spec.RuntimeClassName)
    }

    // 4. 调用 CRI RunPodSandbox
    podSandBoxID, err := m.runtimeService.RunPodSandbox(ctx, podSandboxConfig, runtimeHandler)
    if err != nil {
        return "", message, err
    }

    return podSandBoxID, "", nil
}

kubectl run nginx-test --image=m.daocloud.io/docker.io/library/nginx:alpine --restart=Never
kubectl get events --sort-by='.lastTimestamp' --field-selector involvedObject.name=nginx-test

LAST SEEN   TYPE     REASON      OBJECT           MESSAGE
102s        Normal   Scheduled   pod/nginx-test   Successfully assigned default/nginx-test to worker01
101s        Normal   Pulled      pod/nginx-test   Container image "m.daocloud.io/docker.io/library/nginx:alpine" already present on machine and can be accessed by the pod
101s        Normal   Created     pod/nginx-test   Container created
101s        Normal   Started     pod/nginx-test   Container started

sudo crictl pods | grep nginx-test
sudo crictl ps | grep nginx-test

# crictl pods 输出
POD ID              CREATED         STATE    NAME          NAMESPACE    ATTEMPT   RUNTIME
5bf1e11f42767       2 minutes ago   Ready    nginx-test    default      0         (default)

# crictl ps 输出
CONTAINER           IMAGE          CREATED         STATE      NAME          ATTEMPT   POD ID              POD NAME
67aca40f558b6       ea51152ef8c48  2 minutes ago  Running    nginx-test    0         5bf1e11f42767       nginx-test

sudo crictl inspect 67aca40f558b6 | jq .info.runtimeSpec.linux.namespaces

[
  { "type": "pid" },
  { "path": "/proc/2568950/ns/ipc", "type": "ipc" },
  { "path": "/proc/2568950/ns/uts", "type": "uts" },
  { "path": "/proc/2568950/ns/net", "type": "network" },
  { "type": "mount" },
  { "type": "cgroup" }
]

status:
  phase: Running
  podIP: 10.244.1.25
  containerStatuses:
    - name: nginx
      state:
        running:
          startedAt: "2026-08-04T01:23:45Z"
      ready: true

// Source: pkg/kubelet/kuberuntime/kuberuntime_container.go L860
func (m *kubeGenericRuntimeManager) killContainer(
    ctx context.Context,
    pod *v1.Pod,
    containerID kubecontainer.ContainerID,
    containerName string,
    message string,
    reason containerKillReason,
    gracePeriodOverride *int64,
    ordering *terminationOrdering,
) error {
    // 1. 获取 grace period（来自 Pod 的 terminationGracePeriodSeconds）
    gracePeriod := setTerminationGracePeriod(ctx, pod, containerSpec, ...)

    if gracePeriodOverride != nil {
        gracePeriod = *gracePeriodOverride
    }

    // 2. 执行 PreStop Hook（如果有且时间允许）
    if containerSpec.Lifecycle != nil && containerSpec.Lifecycle.PreStop != nil && gracePeriod > 0 {
        gracePeriod = gracePeriod - m.executePreStopHook(ctx, pod, containerID, ...)
    }

    // 3. 最低保留 2 秒 grace period
    if gracePeriod < minimumGracePeriodInSeconds {
        gracePeriod = minimumGracePeriodInSeconds
    }

    // 4. 调 CRI StopContainer——先 SIGTERM，超时后 SIGKILL
    err := m.runtimeService.StopContainer(ctx, containerID.ID, gracePeriod)
    if err != nil && !crierror.IsNotFound(err) {
        return err
    }

    return nil
}

// Source: pkg/kubelet/kuberuntime/kuberuntime_manager.go L1953
func (m *kubeGenericRuntimeManager) killPodWithSyncResult(
    ctx context.Context,
    pod *v1.Pod,
    runningPod kubecontainer.Pod,
    gracePeriodOverride *int64,
) (result kubecontainer.PodSyncResult) {
    // 1. 杀所有容器（含 PreStop Hook + grace period）
    killContainerResults := m.killContainersWithSyncResult(ctx, pod, runningPod, gracePeriodOverride)

    // 2. 停止 Sandbox（Sandbox 会在 GarbageCollect 时被真正删除）
    for _, podSandbox := range runningPod.Sandboxes {
        if err := m.runtimeService.StopPodSandbox(ctx, podSandbox.ID.ID); err != nil && !crierror.IsNotFound(err) {
            killSandboxResult.Fail(kubecontainer.ErrKillPodSandbox, err.Error())
        }
    }

    return
}

kubectl run nginx-delete --image=m.daocloud.io/docker.io/library/nginx:alpine --restart=Never
# 等 Running 后删除
kubectl delete pod nginx-delete
# 立刻看 kubelet 日志
sudo journalctl -u kubelet --since "30 sec ago" | grep -E "RemoveContainer|orphaned|Killing"

Aug 04 11:37:47 worker01 kubelet[2972481]: I0804 11:37:47.884828 2972481 scope.go:122] "RemoveContainer" containerID="4e0a84699c70ba4816ab95e88d76f542372267dea2203666ea863c5b0b3759de"
Aug 04 11:37:47 worker01 kubelet[2972481]: I0804 11:37:47.892342 2972481 scope.go:122] "RemoveContainer" containerID="4e0a84699c70ba4816ab95e88d76f542372267dea2203666ea863c5b0b3759de"
Aug 04 11:37:48 worker01 kubelet[2972481]: I0804 11:37:48.623933 2972481 kubelet_volumes.go:161] "Cleaned up orphaned pod volumes dir" podUID="67dc4cfb-813d-4188-973e-6c359d435d2c" path="/var/lib/kubelet/pods/67dc4cfb-813d-4188-973e-6c359d435d2c/volumes"

kubectl describe pod <pod-name> | tail -20

kubectl describe pod <pod-name> | grep -A10 Events

sudo journalctl -u kubelet --since "5 min ago" | grep -i error

kubectl get pod <pod-name> -o jsonpath='{.metadata.finalizers}'

kubectl patch pod <pod-name> -p '{"metadata":{"finalizers":[]}}' --type=merge