第 100 课·综合实战高级

综合项目

kubernetescapstoneprojectproduction

综合项目

学习目标

  1. 综合运用所学知识构建完整项目
  2. 体验生产级别的 Kubernetes 部署
  3. 掌握从开发到运维的全流程

项目概述

项目架构

┌─────────────────────────────────────────────────────────┐
│                  电商平台架构                            │
│                                                         │
│  ┌──────────────────────────────────────────────────┐  │
│  │              Ingress Controller                   │  │
│  │    (Nginx / Traefik)                              │  │
│  └───────────────────────┬──────────────────────────┘  │
│                          │                              │
│  ┌───────────────────────┼──────────────────────────┐  │
│  │                       ▼                           │  │
│  │  ┌─────────┐ ┌─────────┐ ┌─────────┐           │  │
│  │  │ 前端   │ │ 用户   │ │ 商品   │           │  │
│  │  │ Web    │ │ User   │ │ Product│           │  │
│  │  │ Service│ │ Service│ │ Service│           │  │
│  │  └────┬────┘ └────┬────┘ └────┬────┘           │  │
│  │       │           │           │                 │  │
│  │       └───────────┼───────────┘                 │  │
│  │                   │                             │  │
│  │       ┌───────────┼───────────┐                 │  │
│  │       ▼           ▼           ▼                 │  │
│  │  ┌─────────┐ ┌─────────┐ ┌─────────┐         │  │
│  │  │ Redis   │ │ MySQL   │ │ MongoDB │         │  │
│  │  │ Cache   │ │ Users  │ │ Products│         │  │
│  │  └─────────┘ └─────────┘ └─────────┘         │  │
│  │                                                │  │
│  │  ┌─────────────────────────────────────────┐  │  │
│  │  │           Monitoring Stack               │  │  │
│  │  │  Prometheus + Grafana + EFK + Jaeger    │  │  │
│  │  └─────────────────────────────────────────┘  │  │
│  └────────────────────────────────────────────────┘  │
└─────────────────────────────────────────────────────────┘

功能模块

模块功能技术栈
前端用户界面React/Vue + Nginx
用户服务注册、登录、用户管理Go/Java + MySQL
商品服务商品列表、详情、搜索Python + MongoDB
订单服务下单、支付、订单管理Go/Java + MySQL
缓存层会话、热点数据Redis
消息队列异步处理RabbitMQ/Kafka

实践练习

练习 1：项目初始化

# 1. 创建命名空间
kubectl create namespace ecommerce

# 2. 创建 RBAC
kubectl apply -f - <<EOF
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ecommerce-sa
  namespace: ecommerce
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: ecommerce-role
  namespace: ecommerce
rules:
- apiGroups: [""]
  resources: ["pods", "services", "configmaps"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: ecommerce-rolebinding
  namespace: ecommerce
subjects:
- kind: ServiceAccount
  name: ecommerce-sa
roleRef:
  kind: Role
  name: ecommerce-role
  apiGroup: rbac.authorization.k8s.io
EOF

# 3. 创建资源配额
kubectl apply -f - <<EOF
apiVersion: v1
kind: ResourceQuota
metadata:
  name: ecommerce-quota
  namespace: ecommerce
spec:
  hard:
    requests.cpu: "10"
    requests.memory: 20Gi
    limits.cpu: "20"
    limits.memory: 40Gi
    pods: "50"
EOF

练习 2：部署数据库

# mysql.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mysql
  namespace: ecommerce
spec:
  serviceName: mysql
  replicas: 1
  selector:
    matchLabels:
      app: mysql
  template:
    metadata:
      labels:
        app: mysql
    spec:
      containers:
      - name: mysql
        image: mysql:8.0
        env:
        - name: MYSQL_ROOT_PASSWORD
          valueFrom:
            secretKeyRef:
              name: mysql-secret
              key: root-password
        ports:
        - containerPort: 3306
        volumeMounts:
        - name: mysql-data
          mountPath: /var/lib/mysql
  volumeClaimTemplates:
  - metadata:
      name: mysql-data
    spec:
      accessModes: ["ReadWriteOnce"]
      resources:
        requests:
          storage: 10Gi
---
apiVersion: v1
kind: Service
metadata:
  name: mysql
  namespace: ecommerce
spec:
  selector:
    app: mysql
  ports:
  - port: 3306
    targetPort: 3306
  clusterIP: None

练习 3：部署应用服务

# user-service.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: user-service
  namespace: ecommerce
spec:
  replicas: 2
  selector:
    matchLabels:
      app: user-service
  template:
    metadata:
      labels:
        app: user-service
    spec:
      containers:
      - name: user-service
        image: my-registry/user-service:v1.0.0
        ports:
        - containerPort: 8080
        envFrom:
        - configMapRef:
            name: user-service-config
        - secretRef:
            name: user-service-secret
        resources:
          requests:
            cpu: "100m"
            memory: "128Mi"
          limits:
            cpu: "500m"
            memory: "512Mi"
        readinessProbe:
          httpGet:
            path: /healthz
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 5
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
---
apiVersion: v1
kind: Service
metadata:
  name: user-service
  namespace: ecommerce
spec:
  selector:
    app: user-service
  ports:
  - port: 80
    targetPort: 8080

练习 4：配置 Ingress

# ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ecommerce-ingress
  namespace: ecommerce
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - ecommerce.example.com
    secretName: ecommerce-tls
  rules:
  - host: ecommerce.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-frontend
            port:
              number: 80
      - path: /api/users
        pathType: Prefix
        backend:
          service:
            name: user-service
            port:
              number: 80
      - path: /api/products
        pathType: Prefix
        backend:
          service:
            name: product-service
            port:
              number: 80

练习 5：部署监控栈

# 1. 安装 Prometheus + Grafana
helm install prometheus prometheus-community/kube-prometheus-stack \
  --namespace monitoring \
  --create-namespace

# 2. 安装 EFK Stack
helm install elasticsearch elastic/elasticsearch \
  --namespace logging \
  --create-namespace

helm install kibana elastic/kibana \
  --namespace logging

helm install fluentd fluent/fluentd \
  --namespace logging

# 3. 安装 Jaeger
helm install jaeger jaegertracing/jaeger \
  --namespace tracing \
  --create-namespace

练习 6：配置告警规则

# alerts.yaml
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: ecommerce-alerts
  namespace: monitoring
spec:
  groups:
  - name: ecommerce
    rules:
    - alert: HighErrorRate
      expr: |
        sum(rate(http_requests_total{namespace="ecommerce", code=~"5.."}[5m]))
        /
        sum(rate(http_requests_total{namespace="ecommerce"}[5m]))
        > 0.05
      for: 5m
      labels:
        severity: critical
      annotations:
        summary: "高错误率告警"
        
    - alert: HighLatency
      expr: |
        histogram_quantile(0.95, 
          sum(rate(http_request_duration_seconds_bucket{namespace="ecommerce"}[5m])) by (le)
        ) > 1
      for: 5m
      labels:
        severity: warning
      annotations:
        summary: "高延迟告警"

练习 7：配置 Horizontal Pod Autoscaler

# hpa.yaml
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: user-service-hpa
  namespace: ecommerce
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: user-service
  minReplicas: 2
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300
      policies:
      - type: Pods
        value: 1
        periodSeconds: 60

练习 8：压力测试

# 使用 k6 进行压力测试
# 安装 k6
brew install k6

# 创建测试脚本
cat <<EOF > load-test.js
import http from 'k6/http';
import { check, sleep } from 'k6';

export const options = {
  stages: [
    { duration: '2m', target: 100 },
    { duration: '5m', target: 100 },
    { duration: '2m', target: 200 },
    { duration: '5m', target: 200 },
    { duration: '2m', target: 0 },
  ],
  thresholds: {
    http_req_duration: ['p(95)<500'],
    http_req_failed: ['rate<0.01'],
  },
};

export default function () {
  const res = http.get('https://ecommerce.example.com/api/products');
  check(res, {
    'status is 200': (r) => r.status === 200,
    'response time < 500ms': (r) => r.timings.duration < 500,
  });
  sleep(1);
}
EOF

# 运行测试
k6 run load-test.js

练习 9：备份和恢复

# 数据库备份 CronJob
kubectl apply -f - <<EOF
apiVersion: batch/v1
kind: CronJob
metadata:
  name: mysql-backup
  namespace: ecommerce
spec:
  schedule: "0 2 * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: backup
            image: mysql:8.0
            command:
            - /bin/sh
            - -c
            - |
              mysqldump -h mysql -u root -p\$MYSQL_ROOT_PASSWORD \
                --all-databases > /backup/dump-\$(date +%Y%m%d).sql
            env:
            - name: MYSQL_ROOT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: mysql-secret
                  key: root-password
            volumeMounts:
            - name: backup-storage
              mountPath: /backup
          restartPolicy: OnFailure
          volumes:
          - name: backup-storage
            persistentVolumeClaim:
              claimName: backup-pvc
EOF

项目交付清单

功能完整性

□ 所有微服务正常运行
□ 服务间通信正常
□ 数据持久化正常
□ 缓存工作正常
□ 消息队列工作正常

运维就绪

□ 健康检查配置完成
□ 资源限制设置合理
□ HPA 配置完成
□ PDB 配置完成
□ 备份策略就绪

可观测性

□ Prometheus 指标收集
□ Grafana 仪表盘
□ 日志集中收集
□ 链路追踪
□ 告警规则配置

安全合规

□ RBAC 配置
□ Network Policy
□ Secret 管理
□ 镜像安全扫描
□ 非 root 运行

评分标准

维度权重评分项
架构设计20%微服务拆分、通信设计
功能实现30%业务功能完整性
运维就绪25%健康检查、扩缩容、备份
可观测性15%监控、日志、追踪
文档质量10%README、部署文档

小结

要点说明
项目目标综合运用 K8s 知识
架构模式微服务 + 云原生
关键能力部署、监控、运维、安全
交付物可运行的完整系统
学习价值端到端实战经验

练习编辑器

bash
Loading...

继续学习

完成本课后，建议继续学习下一课「课程总结」 以巩固所学知识。