114 lines
4.4 KiB
YAML
114 lines
4.4 KiB
YAML
|
# UAT 环境的部署清单。这是三个环境里的"基准版本"——
|
|||
|
|
# deployment-dev.yaml / deployment-prod.yaml 与它的差别只有 namespace、副本数和镜像 tag，
|
|||
|
|
# 其余（探针、优雅停机、securityContext、资源）三份完全一致，
|
|||
|
|
# 避免出现"UAT 好好的、生产漏配了一项"这类问题（见 07-config-governance.md）。
|
|||
|
|
#
|
|||
|
|
# 内容来源：09-build-deploy.md「Deployment 清单」+ 08-observability.md「K8s 探针配置」
|
|||
|
|
# + 07-config-governance.md「ConfigMap / Secret 示例」，三处合并成同一份可 apply 的清单。
|
|||
|
|
apiVersion: apps/v1
|
|||
|
|
kind: Deployment
|
|||
|
|
metadata:
|
|||
|
|
name: conti-backend
|
|||
|
|
namespace: retailapp-uat
|
|||
|
|
labels:
|
|||
|
|
app: conti-backend
|
|||
|
|
spec:
|
|||
|
|
replicas: 2
|
|||
|
|
selector:
|
|||
|
|
matchLabels:
|
|||
|
|
app: conti-backend
|
|||
|
|
strategy:
|
|||
|
|
type: RollingUpdate
|
|||
|
|
rollingUpdate:
|
|||
|
|
maxUnavailable: 0 # 更新期间不允许可用副本数低于 replicas，先起新的再停旧的
|
|||
|
|
maxSurge: 1 # 同时只有一个新 Pod 启动，配合 Flyway 表级锁，不会并发迁移
|
|||
|
|
template:
|
|||
|
|
metadata:
|
|||
|
|
labels:
|
|||
|
|
app: conti-backend
|
|||
|
|
spec:
|
|||
|
|
# Pod 要能读所在 namespace 的 ConfigMap（spring-cloud-kubernetes 走 K8s API），
|
|||
|
|
# 权限见同目录的 rbac.yaml
|
|||
|
|
serviceAccountName: conti-backend
|
|||
|
|
terminationGracePeriodSeconds: 45 # 必须 > preStop 等待(10) + 应用 graceful 超时(25)
|
|||
|
|
securityContext:
|
|||
|
|
runAsNonRoot: true # 镜像里 USER 写的是数字 10001，这条才校验得过
|
|||
|
|
seccompProfile:
|
|||
|
|
type: RuntimeDefault
|
|||
|
|
containers:
|
|||
|
|
- name: conti-backend
|
|||
|
|
# 初始占位；实际版本由流水线的 `kubectl set image` 覆盖，
|
|||
|
|
# 部署的永远是 cut-release 打出来的那个不可变 tag（见 09-build-deploy.md 阶段三）
|
|||
|
|
image: registry.example.com/conti-backend:__TAG__
|
|||
|
|
ports:
|
|||
|
|
- name: http
|
|||
|
|
containerPort: 8080
|
|||
|
|
env:
|
|||
|
|
- name: SPRING_PROFILES_ACTIVE
|
|||
|
|
value: uat
|
|||
|
|
envFrom:
|
|||
|
|
# 非敏感的环境变量（DB_HOST / DB_USERNAME / F6_BASE_URL ...）
|
|||
|
|
- configMapRef:
|
|||
|
|
name: conti-backend-env
|
|||
|
|
# 敏感值（DB_PASSWORD / SECURITY_JWT_SECRET），由流水线从 Key Vault 现取现渲染
|
|||
|
|
- secretRef:
|
|||
|
|
name: conti-backend-secret
|
|||
|
|
# 注：07 文档的示例里还把 conti-backend-config 挂成了 /app/config 卷。
|
|||
|
|
# 这里没有挂——应用已经通过 spring.cloud.kubernetes.config.sources 直接读同一个
|
|||
|
|
# ConfigMap，两条路都开着等于同一份配置有两个来源，出问题时说不清以谁为准；
|
|||
|
|
# 而且热更新只有走 spring-cloud-kubernetes 这条路才生效。
|
|||
|
|
securityContext:
|
|||
|
|
allowPrivilegeEscalation: false
|
|||
|
|
readOnlyRootFilesystem: true
|
|||
|
|
capabilities:
|
|||
|
|
drop: ["ALL"]
|
|||
|
|
resources:
|
|||
|
|
requests:
|
|||
|
|
cpu: "500m"
|
|||
|
|
memory: "1Gi"
|
|||
|
|
limits:
|
|||
|
|
memory: "2Gi" # 只限内存，不限 CPU：cfs 限流会让延迟毫无规律地抖动
|
|||
|
|
startupProbe: # 启动阶段专用，跑通之前 liveness/readiness 都不生效
|
|||
|
|
httpGet:
|
|||
|
|
path: /actuator/health/liveness
|
|||
|
|
port: 8080
|
|||
|
|
periodSeconds: 5
|
|||
|
|
failureThreshold: 30 # 最多给 150 秒完成 JVM 启动 + Flyway 迁移
|
|||
|
|
livenessProbe:
|
|||
|
|
httpGet:
|
|||
|
|
path: /actuator/health/liveness
|
|||
|
|
port: 8080
|
|||
|
|
periodSeconds: 10
|
|||
|
|
readinessProbe:
|
|||
|
|
httpGet:
|
|||
|
|
path: /actuator/health/readiness
|
|||
|
|
port: 8080
|
|||
|
|
periodSeconds: 5
|
|||
|
|
lifecycle:
|
|||
|
|
preStop:
|
|||
|
|
exec:
|
|||
|
|
# 把 SIGTERM 推迟 10 秒，等 Endpoints 摘除在各节点生效，
|
|||
|
|
# 否则滚动更新期间会有零星 502（见 09-build-deploy.md）
|
|||
|
|
command: ["sh", "-c", "sleep 10"]
|
|||
|
|
volumeMounts:
|
|||
|
|
- name: tmp
|
|||
|
|
mountPath: /tmp # readOnlyRootFilesystem 的必需配套：内嵌 Tomcat 要可写的临时目录
|
|||
|
|
volumes:
|
|||
|
|
- name: tmp
|
|||
|
|
emptyDir: {}
|
|||
|
|
---
|
|||
|
|
apiVersion: v1
|
|||
|
|
kind: Service
|
|||
|
|
metadata:
|
|||
|
|
name: conti-backend
|
|||
|
|
namespace: retailapp-uat
|
|||
|
|
labels:
|
|||
|
|
app: conti-backend
|
|||
|
|
spec:
|
|||
|
|
selector:
|
|||
|
|
app: conti-backend
|
|||
|
|
ports:
|
|||
|
|
- name: http
|
|||
|
|
port: 80
|
|||
|
|
targetPort: 8080
|