📘 第35课：毕业项目：微服务全栈部署

Kubernetes

🎓 毕业项目：微服务全栈部署

综合前面所有知识，从零部署一个完整的微服务应用到Kubernetes集群。

📋 项目架构

📝 完整部署配置

# namespace.yaml ✅
apiVersion: v1
kind: Namespace
metadata:
  name: ecommerce

---
# frontend-deployment.yaml ✅
apiVersion: apps/v1
kind: Deployment
metadata:
  name: frontend
  namespace: ecommerce
spec:
  replicas: 2
  selector:
    matchLabels:
      app: frontend
  template:
    metadata:
      labels:
        app: frontend
    spec:
      containers:
      - name: frontend
        image: myregistry.com/ecommerce/frontend:v1.0
        ports:
        - containerPort: 80
        resources:
          limits: { cpu: 200m, memory: 128Mi }
          requests: { cpu: 50m, memory: 64Mi }
        livenessProbe:
          httpGet: { path: /, port: 80 }
          initialDelaySeconds: 10
        readinessProbe:
          httpGet: { path: /, port: 80 }
          initialDelaySeconds: 5

---
apiVersion: v1
kind: Service
metadata:
  name: frontend-service
  namespace: ecommerce
spec:
  selector:
    app: frontend
  ports:
  - port: 80
    targetPort: 80

---
# api-deployment.yaml ✅
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-gateway
  namespace: ecommerce
spec:
  replicas: 3
  selector:
    matchLabels:
      app: api-gateway
  template:
    metadata:
      labels:
        app: api-gateway
    spec:
      containers:
      - name: api
        image: myregistry.com/ecommerce/api-gateway:v1.0
        ports:
        - containerPort: 8000
        env:
        - name: USER_SERVICE_URL
          value: "http://user-service:8001"
        - name: PRODUCT_SERVICE_URL
          value: "http://product-service:8002"
        - name: ORDER_SERVICE_URL
          value: "http://order-service:8003"
        - name: JWT_SECRET
          valueFrom:
            secretKeyRef:
              name: app-secrets
              key: jwt-secret
        resources:
          limits: { cpu: 500m, memory: 256Mi }
          requests: { cpu: 100m, memory: 128Mi }
        livenessProbe:
          httpGet: { path: /health, port: 8000 }
        readinessProbe:
          httpGet: { path: /ready, port: 8000 }

---
# ingress.yaml ✅
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ecommerce-ingress
  namespace: ecommerce
  annotations:
    nginx.ingress.kubernetes.io/rate-limit: "100"
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: nginx
  tls:
  - hosts: [app.example.com, api.example.com]
    secretName: ecommerce-tls
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: frontend-service
            port: { number: 80 }
  - host: api.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-gateway-service
            port: { number: 8000 }

🚀 部署流程

# 1. 创建命名空间 ✅
kubectl apply -f namespace.yaml

# 2. 创建Secret ✅
kubectl create secret generic app-secrets \
  --namespace ecommerce \
  --from-literal=jwt-secret=$(openssl rand -base64 32) \
  --from-literal=db-password=$(openssl rand -base64 16)

# 3. 部署数据库（使用Helm）✅
helm install postgres bitnami/postgresql \
  --namespace ecommerce \
  --set auth.username=app \
  --set auth.password=$(kubectl get secret app-secrets -n ecommerce -o jsonpath='{.data.db-password}' | base64 -d) \
  --set primary.persistence.size=10Gi

# 4. 部署应用 ✅
kubectl apply -f frontend-deployment.yaml
kubectl apply -f api-deployment.yaml
kubectl apply -f user-service.yaml
kubectl apply -f product-service.yaml
kubectl apply -f order-service.yaml
kubectl apply -f ingress.yaml

# 5. 验证 ✅
kubectl get pods -n ecommerce
kubectl get ingress -n ecommerce

# 6. 测试 ✅
curl https://app.example.com
curl https://api.example.com/health

📊 CI/CD流水线

# GitHub Actions完整流水线 ✅
name: Deploy
on:
  push:
    branches: [main]
jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # 构建并推送镜像
      - name: Build & Push
        run: |
          docker build -t myregistry.com/ecommerce/api:${{ github.sha }} ./api
          docker push myregistry.com/ecommerce/api:${{ github.sha }}

      # 安全扫描
      - name: Security Scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myregistry.com/ecommerce/api:${{ github.sha }}'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'

      # 部署到K8s
      - name: Deploy
        run: |
          kubectl set image deployment/api-gateway \
            api=myregistry.com/ecommerce/api:${{ github.sha }} \
            -n ecommerce
          kubectl rollout status deployment/api-gateway -n ecommerce --timeout=300s

🏆 课程总结

35课的旅程到此结束。回顾一下我们学到的：

🎉 恭喜完成全部35课！你已经掌握了从Docker基础到Kubernetes生产部署的完整知识体系。

继续学习的方向：服务网格（Istio）、GitOps（ArgoCD）、平台工程、混沌工程。容器化的世界永无止境！

❓ 常见问题

📚 深度补充：毕业项目：微服务全栈部署进阶要点

【Kubernetes入门阶段】生产环境注意事项

常见误区与避坑指南

1. 过度配置：不是所有服务都需要高可用，根据实际需求选择架构复杂度，避免过度工程
2. 忽略日志：日志是排障的关键，确保日志格式统一、级别合理、采集完整
3. 资源超卖：容器资源限制不是摆设，超卖会导致性能下降甚至OOM Kill
4. 安全忽视：默认配置不等于安全配置，生产环境必须加固（非root、只读FS、最小能力）
5. 监控缺失：没有监控等于盲飞，至少要有基础的健康检查和资源监控
6. 手动运维：能自动化的绝不手动，手动操作容易出错且不可追溯
7. 忽略网络策略：默认所有容器互通不安全，应按最小权限原则配置网络

进阶阅读与参考

• Docker官方文档：https://docs.docker.com/
• Docker最佳实践指南：Dev Best Practices
• CIS Docker Benchmark：容器安全基线检查标准
• 12-Factor App方法论：https://12factor.net/
• Google SRE Book：运维可靠性工程实践
• Kubernetes官方文档：https://kubernetes.io/docs/

Docker命令速查卡

# 容器生命周期
docker create/start/stop/restart/rm/pause/unpause
docker logs/top/stats/inspect/exec diff

# 镜像构建
docker build/pull/push/tag/rmi/images/history
docker save/load/import/manifest

# 网络与存储
docker network create/ls/inspect/connect/disconnect/rm/prune
docker volume create/ls/inspect/rm/prune

# Docker Compose
docker compose up/down/ps/logs/build/exec
docker compose config/stop/start/scale/top/cp

# 系统维护
docker system df/prune/info
docker builder prune
docker container/prune/image prune

# K8s常用命令
kubectl get/describe/logs/exec/apply/delete
kubectl rollout status/undo/history
kubectl scale/autoscale/set

本阶段知识脉络