deployment.yaml
10.8 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
apiVersion: apps/v1
kind: Deployment
metadata:
name: user-service
namespace: ecommerce
labels:
app: user-service
app.kubernetes.io/name: user-service
app.kubernetes.io/part-of: ecommerce
spec:
replicas: 1
revisionHistoryLimit: 3
selector:
matchLabels:
app: user-service
strategy:
type: RollingUpdate
rollingUpdate:
maxSurge: 1
maxUnavailable: 0
template:
metadata:
labels:
app: user-service
app.kubernetes.io/name: user-service
app.kubernetes.io/part-of: ecommerce
app.kubernetes.io/version: $(APP_VERSION) # 动态版本标签
version: $(APP_VERSION) # 动态版本标签
annotations:
prometheus.io/scrape: "true"
prometheus.io/port: "8080"
prometheus.io/path: "/actuator/prometheus"
spec:
# 数据库初始化容器
initContainers:
- name: wait-for-database
image: postgres:15
command:
- /bin/sh
- -c
- |
set -e
echo "Waiting for PostgreSQL service to be ready..."
until pg_isready -h postgresql-service -U admin; do
echo "PostgreSQL service not ready yet, waiting..."
sleep 2
done
echo "PostgreSQL service is ready."
echo "Waiting for database ecommerce_users to be created..."
until psql -h postgresql-service -U admin -d postgres -c "SELECT 1 FROM pg_database WHERE datname='ecommerce_users'" | grep -q 1; do
echo "Database ecommerce_users not created yet, waiting..."
sleep 2
done
echo "Waiting for database ecommerce_users to be ready for connections..."
until pg_isready -h postgresql-service -U admin -d ecommerce_users; do
echo "Database ecommerce_users not ready yet, waiting..."
sleep 2
done
echo "Database ecommerce_users is ready for connections"
env:
- name: PGPASSWORD
valueFrom:
secretKeyRef:
name: postgresql-secret
key: password
affinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 100
podAffinityTerm:
labelSelector:
matchExpressions:
- key: app
operator: In
values:
- user-service
topologyKey: kubernetes.io/hostname
containers:
- name: user-service
image: 319998871902.dkr.ecr.us-east-1.amazonaws.com/ecommerce-user-service:$(APP_VERSION) # 动态镜像版本
imagePullPolicy: Always
ports:
- containerPort: 8080
name: http
protocol: TCP
- containerPort: 8081
name: metrics
protocol: TCP
env:
# 版本信息 - 从 ConfigMap 动态获取
- name: APP_VERSION
valueFrom:
configMapKeyRef:
name: app-version-info
key: service.user-service.version
- name: APPLICATION_VERSION
valueFrom:
configMapKeyRef:
name: app-version-info
key: application.version
- name: SERVICE_DESCRIPTION
valueFrom:
configMapKeyRef:
name: app-version-info
key: service.user-service.description
# 应用配置
- name: SPRING_PROFILES_ACTIVE
value: "production"
- name: SPRING_APPLICATION_NAME
value: "user-service"
# 服务器配置
- name: SERVER_PORT
value: "8080"
- name: SERVER_SERVLET_CONTEXT_PATH
value: "/api"
# 数据库配置
- name: SPRING_DATASOURCE_URL
value: "jdbc:postgresql://postgresql-service:5432/ecommerce_users"
- name: SPRING_DATASOURCE_USERNAME
valueFrom:
secretKeyRef:
name: postgresql-secret
key: username
- name: SPRING_DATASOURCE_PASSWORD
valueFrom:
secretKeyRef:
name: postgresql-secret
key: password
- name: SPRING_DATASOURCE_DRIVER_CLASS_NAME
value: "org.postgresql.Driver"
- name: SPRING_DATASOURCE_HIKARI_MAXIMUM_POOL_SIZE
value: "10"
- name: SPRING_DATASOURCE_HIKARI_MINIMUM_IDLE
value: "2"
- name: SPRING_DATASOURCE_HIKARI_CONNECTION_TIMEOUT
value: "30000"
- name: SPRING_DATASOURCE_HIKARI_IDLE_TIMEOUT
value: "600000"
- name: SPRING_DATASOURCE_HIKARI_MAX_LIFETIME
value: "1800000"
# JPA 配置
- name: SPRING_JPA_HIBERNATE_DDL_AUTO
value: "validate"
- name: SPRING_JPA_HIBERNATE_NAMING_PHYSICAL_STRATEGY
value: "org.hibernate.boot.model.naming.PhysicalNamingStrategyStandardImpl"
- name: SPRING_JPA_SHOW_SQL
value: "false"
- name: SPRING_JPA_PROPERTIES_HIBERNATE_DIALECT
value: "org.hibernate.dialect.PostgreSQLDialect"
- name: SPRING_JPA_PROPERTIES_HIBERNATE_FORMAT_SQL
value: "true"
- name: SPRING_JPA_PROPERTIES_HIBERNATE_JDBC_BATCH_SIZE
value: "20"
- name: SPRING_JPA_PROPERTIES_HIBERNATE_JDBC_ORDER_INSERTS
value: "true"
- name: SPRING_JPA_PROPERTIES_HIBERNATE_JDBC_ORDER_UPDATES
value: "true"
# 兼容旧配置（可选）
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
name: postgresql-secret
key: password
- name: DB_HOST
value: "postgresql-service"
- name: DB_PORT
value: "5432"
- name: DB_NAME
value: "ecommerce_users"
- name: DB_USERNAME
valueFrom:
secretKeyRef:
name: postgresql-secret
key: username
# Redis 缓存配置
- name: SPRING_REDIS_HOST
value: "redis-service"
- name: SPRING_REDIS_PORT
value: "6379"
- name: SPRING_REDIS_PASSWORD
valueFrom:
secretKeyRef:
name: redis-secret
key: password
- name: SPRING_REDIS_TIMEOUT
value: "2000"
- name: SPRING_REDIS_LETTUCE_POOL_MAX_ACTIVE
value: "10"
- name: SPRING_REDIS_LETTUCE_POOL_MAX_IDLE
value: "5"
- name: SPRING_REDIS_LETTUCE_POOL_MIN_IDLE
value: "2"
- name: SPRING_REDIS_LETTUCE_POOL_MAX_WAIT
value: "1000"
# 兼容旧 Redis 配置
- name: REDIS_PASSWORD
valueFrom:
secretKeyRef:
name: redis-secret
key: password
- name: REDIS_HOST
value: "redis-service"
- name: REDIS_PORT
value: "6379"
- name: REDIS_SESSION_TTL
value: "1800"
# JWT 安全配置
- name: JWT_SECRET
valueFrom:
secretKeyRef:
name: jwt-secret
key: secret
- name: JWT_EXPIRATION
value: "86400000"
- name: JWT_REFRESH_EXPIRATION
value: "2592000000"
- name: JWT_ISSUER
value: "ecommerce-platform"
# 用户业务配置
- name: PASSWORD_MIN_LENGTH
value: "8"
- name: PASSWORD_MAX_LENGTH
value: "128"
- name: MAX_LOGIN_ATTEMPTS
value: "5"
- name: ACCOUNT_LOCKOUT_DURATION
value: "900000"
- name: REQUIRE_EMAIL_VERIFICATION
value: "true"
- name: REQUIRE_PHONE_VERIFICATION
value: "false"
# 安全配置
- name: BCRYPT_STRENGTH
value: "12"
- name: SESSION_TIMEOUT
value: "1800"
- name: ENABLE_CSRF_PROTECTION
value: "true"
# 通知配置
- name: NOTIFICATION_SERVICE_URL
value: "http://notification-service:8080"
- name: SEND_WELCOME_EMAIL
value: "true"
# Flyway 配置
- name: SPRING_FLYWAY_ENABLED
value: "true"
- name: SPRING_FLYWAY_VALIDATE_ON_MIGRATE
value: "true"
- name: SPRING_FLYWAY_BASELINE_ON_MIGRATE
value: "true"
- name: SPRING_FLYWAY_LOCATIONS
value: "classpath:db/migration"
# Actuator 配置 - 修复健康检查问题
- name: MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE
value: "health,info,metrics,prometheus"
- name: MANAGEMENT_ENDPOINT_HEALTH_SHOW_DETAILS
value: "always"
- name: MANAGEMENT_ENDPOINT_HEALTH_PROBES_ENABLED
value: "true"
- name: MANAGEMENT_HEALTH_DB_ENABLED
value: "true"
- name: MANAGEMENT_HEALTH_REDIS_ENABLED
value: "true"
# Actuator 安全配置 - 新增
- name: MANAGEMENT_SECURITY_ENABLED
value: "false"
- name: MANAGEMENT_ENDPOINT_HEALTH_ACCESS
value: "permit-all"
- name: SPRING_SECURITY_IGNORED
value: "/api/actuator/**,/actuator/**"
# Eureka 配置
- name: EUREKA_CLIENT_ENABLED
value: "false"
- name: EUREKA_CLIENT_REGISTER_WITH_EUREKA
value: "false"
- name: EUREKA_CLIENT_FETCH_REGISTRY
value: "false"
# 日志配置
- name: LOGGING_LEVEL_COM_ECOMMERCE_USER
value: "DEBUG"
- name: LOGGING_LEVEL_ORG_HIBERNATE_SQL
value: "WARN"
- name: LOGGING_LEVEL_ORG_HIBERNATE_TYPE_DESCRIPTOR_SQL_BASICBINDER
value: "WARN"
- name: LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_SECURITY
value: "WARN"
# 可选：构建信息
- name: BUILD_VERSION
value: "$(BUILD_VERSION)"
- name: GIT_COMMIT
value: "$(GIT_COMMIT)"
resources:
requests:
memory: "256Mi"
cpu: "200m"
limits:
memory: "512Mi"
cpu: "500m"
# 修复健康检查探针 - 使用 TCP 探针避免路径和安全问题
livenessProbe:
tcpSocket:
port: 8080
initialDelaySeconds: 120
periodSeconds: 30
timeoutSeconds: 5
failureThreshold: 3
readinessProbe:
tcpSocket:
port: 8080
initialDelaySeconds: 60
periodSeconds: 15
timeoutSeconds: 5
failureThreshold: 3
startupProbe:
tcpSocket:
port: 8080
initialDelaySeconds: 90
periodSeconds: 15
timeoutSeconds: 5
failureThreshold: 30
securityContext:
runAsNonRoot: true
runAsUser: 1000
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
securityContext:
runAsNonRoot: true
runAsUser: 1000
fsGroup: 1000
imagePullSecrets:
- name: regcred