Ansible vs Terraform vs Pulumi：面向K8s基础设施即代码的三款工具深度横向对比

Ansible vs Terraform vs Pulumi：面向K8s基础设施即代码的三款工具深度横向对比

在选择 K8s 基础设施即代码工具时，运维团队常常陷入"Ansible 熟悉但声明式能力弱，Terraform 声明式强但学习曲线陡，Pulumi 现代化但社区生态还不够成熟"的三难困境。本文不做泛泛之谈，从实际生产使用数据出发，给出有据可依的选型建议。

一、三款工具的核心定位与设计哲学

1.1 设计理念差异

graph TB subgraph "Ansible - 过程式自动化" A1[Playbook<br/>YAML定义步骤] --> A2[任务执行引擎<br/>按顺序执行模块] A2 --> A3[目标主机<br/>SSH连接] A2 --> A4[K8s API<br/>kubectl封装] A5[无状态<br/>幂等性靠模块保证] end subgraph "Terraform - 声明式基础设施" T1[HCL配置<br/>声明期望状态] --> T2[状态管理<br/>terraform.tfstate] T2 --> T3[Provider插件<br/>aws/k8s/helm] T3 --> T4[资源编排<br/>依赖图并行执行] T5[有状态<br/>State文件管理生命周期] end subgraph "Pulumi - 编程语言基础设施" P1[编程语言<br/>TS/Python/Go] --> P2[声明式资源模型<br/>ComponentResource] P2 --> P3[Provider<br/>同Terraform生态] P3 --> P4[云端状态存储<br/>Pulumi Cloud/S3] P5[有状态<br/>抽象和复用能力强] end style A2 fill:#409EFF,color:#fff style T2 fill:#E6A23C,color:#fff style P2 fill:#67C23A,color:#fff

1.2 面向K8s的能力矩阵

二、同一场景的三种实现对比

2.1 场景描述

在三个环境中部署一套完整的微服务栈：

• 环境：dev / staging / prod
• 组件：Nginx Ingress、Redis、应用Deployment（3副本）、HPA、Service、NetworkPolicy
• 配置差异：各环境副本数、资源限制、域名不同

2.2 Ansible实现

# ansible/deploy-app.yml # Ansible Playbook: 部署K8s微服务到多环境 --- - name: 部署微服务到Kubernetes hosts: localhost connection: local gather_facts: no vars: # 环境变量（通过 -e env=prod 传入） env: "{{ env | default('dev') }}" # 环境特定配置映射 env_configs: dev: namespace: app-dev replicas: 1 cpu_request: "100m" mem_request: "128Mi" cpu_limit: "500m" mem_limit: "256Mi" domain: dev.example.com ingress_class: nginx-internal staging: namespace: app-staging replicas: 2 cpu_request: "200m" mem_request: "256Mi" cpu_limit: "1000m" mem_limit: "512Mi" domain: staging.example.com ingress_class: nginx-internal prod: namespace: app-prod replicas: 3 cpu_request: "500m" mem_request: "512Mi" cpu_limit: "2000m" mem_limit: "2Gi" domain: api.example.com ingress_class: nginx-external # 获取当前环境配置 config: "{{ env_configs[env] }}" tasks: # ===== 1. 创建命名空间 ===== - name: 确保命名空间存在 kubernetes.core.k8s: state: present definition: apiVersion: v1 kind: Namespace metadata: name: "{{ config.namespace }}" labels: environment: "{{ env }}" managed-by: ansible register: ns_result # 错误处理：命名空间创建失败时终止 - name: 验证命名空间创建结果 fail: msg: "命名空间 {{ config.namespace }} 创建失败" when: ns_result is failed # ===== 2. 部署Redis ===== - name: 部署Redis（StatefulSet + Service） kubernetes.core.k8s: state: present namespace: "{{ config.namespace }}" definition: apiVersion: apps/v1 kind: StatefulSet metadata: name: redis spec: serviceName: redis replicas: 1 selector: matchLabels: app: redis template: metadata: labels: app: redis spec: containers: - name: redis image: redis:7.2-alpine ports: - containerPort: 6379 resources: requests: cpu: "100m" memory: "128Mi" limits: cpu: "200m" memory: "256Mi" readinessProbe: tcpSocket: port: 6379 initialDelaySeconds: 5 periodSeconds: 10 # ===== 3. 部署应用Deployment ===== - name: 部署应用Deployment kubernetes.core.k8s: state: present namespace: "{{ config.namespace }}" definition: apiVersion: apps/v1 kind: Deployment metadata: name: app-server labels: app: app-server spec: replicas: "{{ config.replicas }}" selector: matchLabels: app: app-server strategy: type: RollingUpdate rollingUpdate: maxSurge: 1 maxUnavailable: 0 # 零停机部署 template: metadata: labels: app: app-server spec: containers: - name: app image: registry.example.com/app:{{ env }} ports: - containerPort: 8080 resources: requests: cpu: "{{ config.cpu_request }}" memory: "{{ config.mem_request }}" limits: cpu: "{{ config.cpu_limit }}" memory: "{{ config.mem_limit }}" env: - name: REDIS_HOST value: redis.{{ config.namespace }}.svc.cluster.local - name: ENVIRONMENT value: "{{ env }}" readinessProbe: httpGet: path: /healthz port: 8080 initialDelaySeconds: 10 periodSeconds: 5 livenessProbe: httpGet: path: /healthz port: 8080 initialDelaySeconds: 30 periodSeconds: 15 # ===== 4. 创建HPA ===== - name: 创建HorizontalPodAutoscaler kubernetes.core.k8s: state: present namespace: "{{ config.namespace }}" definition: apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: name: app-server-hpa spec: scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: app-server minReplicas: "{{ config.replicas }}" maxReplicas: "{{ config.replicas * 3 }}" metrics: - type: Resource resource: name: cpu target: type: Utilization averageUtilization: 70 # ===== 5. 部署验证 ===== - name: 等待Deployment就绪 kubernetes.core.k8s_info: kind: Deployment name: app-server namespace: "{{ config.namespace }}" register: deploy_status until: | deploy_status.resources[0].status.readyReplicas is defined and deploy_status.resources[0].status.readyReplicas == "{{ config.replicas }}" retries: 30 delay: 10

2.3 Terraform实现

# terraform/main.tf # Terraform: 声明式管理多环境K8s资源 terraform { required_version = ">= 1.5" required_providers { kubernetes = { source = "hashicorp/kubernetes" version = "~> 2.30" } helm = { source = "hashicorp/helm" version = "~> 2.14" } } # 远程状态存储（团队协作必需） backend "s3" { bucket = "terraform-state-ops" key = "k8s/app-stack/terraform.tfstate" region = "cn-north-1" # 使用DynamoDB实现状态锁 dynamodb_table = "terraform-state-lock" encrypt = true } } # ===== 变量定义 ===== variable "environment" { description = "部署环境: dev/staging/prod" type = string validation { condition = contains(["dev", "staging", "prod"], var.environment) error_message = "环境必须是 dev、staging 或 prod" } } # ===== 本地变量：环境特定配置 ===== locals { env_config = { dev = { replicas = 1 cpu_request = "100m" mem_request = "128Mi" cpu_limit = "500m" mem_limit = "256Mi" domain = "dev.example.com" ingress_class = "nginx-internal" namespaces = ["app-dev", "monitoring-dev"] } staging = { replicas = 2 cpu_request = "200m" mem_request = "256Mi" cpu_limit = "1000m" mem_limit = "512Mi" domain = "staging.example.com" ingress_class = "nginx-internal" namespaces = ["app-staging", "monitoring-staging"] } prod = { replicas = 3 cpu_request = "500m" mem_request = "512Mi" cpu_limit = "2000m" mem_limit = "2Gi" domain = "api.example.com" ingress_class = "nginx-external" namespaces = ["app-prod", "monitoring-prod"] } } config = local.env_config[var.environment] } # ===== 资源定义 ===== # namespace模块：批量创建命名空间 resource "kubernetes_namespace_v1" "app_namespaces" { for_each = toset(local.config.namespaces) metadata { name = each.key labels = { environment = var.environment managed-by = "terraform" } } } # Redis StatefulSet + Service resource "kubernetes_stateful_set_v1" "redis" { metadata { name = "redis" namespace = "app-${var.environment}" } spec { service_name = "redis" replicas = 1 selector { match_labels = { app = "redis" } } template { metadata { labels = { app = "redis" } } spec { container { name = "redis" image = "redis:7.2-alpine" port { container_port = 6379 } resources { requests = { cpu = "100m" memory = "128Mi" } limits = { cpu = "200m" memory = "256Mi" } } readiness_probe { tcp_socket { port = 6379 } initial_delay_seconds = 5 period_seconds = 10 } } } } } depends_on = [kubernetes_namespace_v1.app_namespaces] } # 应用Deployment resource "kubernetes_deployment_v1" "app" { metadata { name = "app-server" namespace = "app-${var.environment}" labels = { app = "app-server" } } spec { replicas = local.config.replicas selector { match_labels = { app = "app-server" } } strategy { type = "RollingUpdate" rolling_update { max_surge = "1" max_unavailable = "0" } } template { metadata { labels = { app = "app-server" } } spec { container { name = "app" image = "registry.example.com/app:${var.environment}" port { container_port = 8080 } resources { requests = { cpu = local.config.cpu_request memory = local.config.mem_request } limits = { cpu = local.config.cpu_limit memory = local.config.mem_limit } } env { name = "REDIS_HOST" value = "redis.app-${var.environment}.svc.cluster.local" } env { name = "ENVIRONMENT" value = var.environment } readiness_probe { http_get { path = "/healthz" port = 8080 } initial_delay_seconds = 10 period_seconds = 5 } liveness_probe { http_get { path = "/healthz" port = 8080 } initial_delay_seconds = 30 period_seconds = 15 } } } } } depends_on = [ kubernetes_stateful_set_v1.redis, kubernetes_namespace_v1.app_namespaces ] } # HPA自动伸缩 resource "kubernetes_horizontal_pod_autoscaler_v2" "app" { metadata { name = "app-server-hpa" namespace = "app-${var.environment}" } spec { scale_target_ref { api_version = "apps/v1" kind = "Deployment" name = kubernetes_deployment_v1.app.metadata[0].name } min_replicas = local.config.replicas max_replicas = local.config.replicas * 3 metric { type = "Resource" resource { name = "cpu" target { type = "Utilization" average_utilization = 70 } } } } }

2.4 Pulumi实现

// pulumi/index.ts // Pulumi: TypeScript编写K8s基础设施 import * as k8s from "@pulumi/kubernetes"; import * as pulumi from "@pulumi/pulumi"; // ===== 环境配置 ===== const config = new pulumi.Config(); const environment = config.require("environment"); // 环境特定配置映射 interface EnvironmentConfig { replicas: number; cpuRequest: string; memRequest: string; cpuLimit: string; memLimit: string; domain: string; ingressClass: string; namespaces: string[]; } const envConfigs: Record<string, EnvironmentConfig> = { dev: { replicas: 1, cpuRequest: "100m", memRequest: "128Mi", cpuLimit: "500m", memLimit: "256Mi", domain: "dev.example.com", ingressClass: "nginx-internal", namespaces: ["app-dev", "monitoring-dev"], }, staging: { replicas: 2, cpuRequest: "200m", memRequest: "256Mi", cpuLimit: "1000m", memLimit: "512Mi", domain: "staging.example.com", ingressClass: "nginx-internal", namespaces: ["app-staging", "monitoring-staging"], }, prod: { replicas: 3, cpuRequest: "500m", memRequest: "512Mi", cpuLimit: "2000m", memLimit: "2Gi", domain: "api.example.com", ingressClass: "nginx-external", namespaces: ["app-prod", "monitoring-prod"], }, }; const envConfig = envConfigs[environment]; // ===== 创建命名空间 ===== const namespaces = envConfig.namespaces.map(nsName => { return new k8s.core.v1.Namespace(nsName, { metadata: { name: nsName, labels: { environment: environment, "managed-by": "pulumi", }, }, }); }); // ===== Redis部署 ===== const redisLabels = { app: "redis" }; const redis = new k8s.apps.v1.StatefulSet("redis", { metadata: { name: "redis", namespace: `app-${environment}`, }, spec: { serviceName: "redis", replicas: 1, selector: { matchLabels: redisLabels }, template: { metadata: { labels: redisLabels }, spec: { containers: [{ name: "redis", image: "redis:7.2-alpine", ports: [{ containerPort: 6379 }], resources: { requests: { cpu: "100m", memory: "128Mi", }, limits: { cpu: "200m", memory: "256Mi", }, }, readinessProbe: { tcpSocket: { port: 6379 }, initialDelaySeconds: 5, periodSeconds: 10, }, }], }, }, }, }); // ===== 应用Deployment ===== const appLabels = { app: "app-server" }; const appDeployment = new k8s.apps.v1.Deployment("app-server", { metadata: { name: "app-server", namespace: `app-${environment}`, labels: appLabels, }, spec: { replicas: envConfig.replicas, selector: { matchLabels: appLabels }, strategy: { type: "RollingUpdate", rollingUpdate: { maxSurge: "1", maxUnavailable: "0", }, }, template: { metadata: { labels: appLabels }, spec: { containers: [{ name: "app", image: `registry.example.com/app:${environment}`, ports: [{ containerPort: 8080 }], resources: { requests: { cpu: envConfig.cpuRequest, memory: envConfig.memRequest, }, limits: { cpu: envConfig.cpuLimit, memory: envConfig.memLimit, }, }, env: [ { name: "REDIS_HOST", value: `redis.app-${environment}.svc.cluster.local`, }, { name: "ENVIRONMENT", value: environment }, ], readinessProbe: { httpGet: { path: "/healthz", port: 8080 }, initialDelaySeconds: 10, periodSeconds: 5, }, livenessProbe: { httpGet: { path: "/healthz", port: 8080 }, initialDelaySeconds: 30, periodSeconds: 15, }, }], }, }, }, }); // ===== HPA自动伸缩 ===== const hpa = new k8s.autoscaling.v2.HorizontalPodAutoscaler("app-server-hpa", { metadata: { name: "app-server-hpa", namespace: `app-${environment}`, }, spec: { scaleTargetRef: { apiVersion: "apps/v1", kind: "Deployment", name: appDeployment.metadata.name, }, minReplicas: envConfig.replicas, maxReplicas: envConfig.replicas * 3, metrics: [{ type: "Resource", resource: { name: "cpu", target: { type: "Utilization", averageUtilization: 70, }, }, }], }, }); // ===== 导出输出 ===== export const namespaceNames = namespaces.map(ns => ns.metadata.name); export const deploymentName = appDeployment.metadata.name; export const redisEndpoint = pulumi.interpolate `redis.app-${environment}.svc.cluster.local:6379`;

三、深度横向对比

3.1 多维度评分

3.2 适用场景地图

根据实际生产经验，给出以下选型建议：

需要批量管理现有服务器配置？ → Ansible 需要从零创建云资源+K8s集群？ → Terraform 需要深度K8s定制+团队已掌握编程语言？ → Pulumi 需要混合管理服务器+云资源？ → Ansible + Terraform 需要严格的类型安全和代码复用？ → Pulumi 需要在受限环境中（无外网）操作？ → Ansible（离线安装） 需要完整的审计和合规能力？ → Terraform（审计日志成熟）

四、生产环境最佳实践

4.1 通用最佳实践清单

无论选择哪款工具，以下实践都应该遵守：

1. GitOps化：IaC代码必须通过 Git PR 流程，禁止手动修改生产资源；
2. 环境隔离：dev/staging/prod 使用独立的 State 文件和配置；
3. 漂移检测：定期运行terraform plan或pulumi refresh检测配置漂移；
4. Plan/Preview审核：所有变更在 apply 前必须运行 plan/preview 并经过 Peer Review；
5. Secret管理：敏感信息使用 Vault/SealedSecrets/云KMS，禁止明文提交；
6. 备份与回滚：State 文件必须启用版本控制和定时备份。

4.2 最终推荐

对于面向 K8s 的基础设施即代码场景，我的推荐优先级为：

1. Pulumi（适合有较强编程能力的团队）：类型安全 + 强大的代码复用 + 现代化的开发体验；
2. Terraform（适合需要跨云多Provider的场景）：生态最丰富 + Providence成熟度最高；
3. Ansible（适合运维团队已有Ansible资产的场景）：学习成本最低 + 可与其他工具互补使用。

五、总结

三款工具没有绝对的优劣，只有场景的适配。对于面向 K8s 的基础设施即代码，Pulumi 在类型安全、代码复用和 K8s 深度集成方面表现出色；Terraform 在多云管理和 Provider 生态方面最为成熟；Ansible 则在配置管理和简单场景中最为轻量便捷。

建议的策略是"工具组合而非工具单一化"：用 Terraform/Pulumi 管理集群层面的基础设施（节点池、网络、RBAC），用 Helm/Kustomize 管理应用层面的部署，用 Ansible 处理节点级别的配置管理。三者各司其职，才能真正发挥 IaC 的最大价值。