feat(infra): k8s Helm Chart 演化与备份脚本测试
- 新增 edu-platform 平台级 chart（namespace/configmap/secret/ingress/hpa） - 新增 api-gateway 服务级 chart（完整迁移自原 manifest） - 新增 6 个业务服务 chart 桩（iam/core-edu/content/msg/data-ana/ai） - 删除原 api-gateway-deployment.yaml（已迁移至 helm chart） - 更新 infra/k8s/README.md 为 Helm Chart 管理说明 - 新增 backup-mysql.sh dry-run 测试脚本（17 断言）
This commit is contained in:
SpecialX
11
infra/k8s/helm/ai/Chart.yaml
Normal file
11
infra/k8s/helm/ai/Chart.yaml
Normal file
@@ -0,0 +1,11 @@
|
||||
apiVersion: v2
|
||||
name: ai
|
||||
description: ai 服务级 Helm Chart
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.0.0"
|
||||
keywords:
|
||||
- edu
|
||||
- ai
|
||||
maintainers:
|
||||
- name: edu-arch
|
||||
29
infra/k8s/helm/ai/templates/_helpers.tpl
Normal file
29
infra/k8s/helm/ai/templates/_helpers.tpl
Normal file
@@ -0,0 +1,29 @@
|
||||
{{- define "ai.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "ai.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "ai.labels" -}}
|
||||
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
{{ include "ai.selectorLabels" . }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
app.kubernetes.io/part-of: edu-platform
|
||||
app.kubernetes.io/component: ai-gateway
|
||||
{{- end -}}
|
||||
|
||||
{{- define "ai.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "ai.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end -}}
|
||||
77
infra/k8s/helm/ai/templates/deployment.yaml
Normal file
77
infra/k8s/helm/ai/templates/deployment.yaml
Normal file
@@ -0,0 +1,77 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "ai.name" . }}
|
||||
namespace: {{ .Values.namespace }}
|
||||
labels:
|
||||
{{- include "ai.labels" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "ai.selectorLabels" . | nindent 6 }}
|
||||
strategy:
|
||||
type: {{ .Values.strategy.type }}
|
||||
rollingUpdate:
|
||||
maxSurge: {{ .Values.strategy.maxSurge }}
|
||||
maxUnavailable: {{ .Values.strategy.maxUnavailable }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "ai.selectorLabels" . | nindent 8 }}
|
||||
app.kubernetes.io/part-of: edu-platform
|
||||
app.kubernetes.io/component: ai-gateway
|
||||
{{- if .Values.metrics.enabled }}
|
||||
annotations:
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/port: {{ .Values.metrics.port | quote }}
|
||||
prometheus.io/path: {{ .Values.metrics.path | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
containers:
|
||||
- name: {{ include "ai.name" . }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: {{ .Values.service.targetPort }}
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.liveness.path }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.readiness.path }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
env:
|
||||
{{- if .Values.configMap.enabled }}
|
||||
{{- range $k, $v := .Values.configMap.data }}
|
||||
- name: {{ $k }}
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ include "ai.name" $ }}-config
|
||||
key: {{ $k }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $secret := .Values.secretRefs }}
|
||||
{{- range $key := $secret.keys }}
|
||||
- name: {{ $key }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ $secret.name }}
|
||||
key: {{ $key }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
16
infra/k8s/helm/ai/templates/service.yaml
Normal file
16
infra/k8s/helm/ai/templates/service.yaml
Normal file
@@ -0,0 +1,16 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "ai.name" . }}
|
||||
namespace: {{ .Values.namespace }}
|
||||
labels:
|
||||
{{- include "ai.labels" . | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
selector:
|
||||
{{- include "ai.selectorLabels" . | nindent 4 }}
|
||||
ports:
|
||||
- name: http
|
||||
port: {{ .Values.service.port }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
85
infra/k8s/helm/ai/values.yaml
Normal file
85
infra/k8s/helm/ai/values.yaml
Normal file
@@ -0,0 +1,85 @@
|
||||
# ai 服务默认值（AI 网关 - 业务领域 D6）
|
||||
|
||||
# 副本数（生产建议 ≥ 2）
|
||||
replicaCount: 2
|
||||
|
||||
image:
|
||||
repository: edu/ai
|
||||
tag: latest # 生产请固定 tag，避免 latest
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# 服务端口
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 3006
|
||||
targetPort: 3006
|
||||
|
||||
# 命名空间（默认 edu-services，由 edu-platform chart 创建）
|
||||
namespace: edu-services
|
||||
|
||||
# 探针配置
|
||||
probes:
|
||||
liveness:
|
||||
path: /healthz
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 3
|
||||
readiness:
|
||||
path: /readyz
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 2
|
||||
|
||||
# 资源配额
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 1Gi
|
||||
|
||||
# 滚动更新策略
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
maxSurge: 1
|
||||
maxUnavailable: 0
|
||||
|
||||
# Prometheus 指标采集
|
||||
metrics:
|
||||
enabled: true
|
||||
port: 3006
|
||||
path: /metrics
|
||||
|
||||
# 安全上下文
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
|
||||
# 服务级 ConfigMap（非敏感配置）
|
||||
configMap:
|
||||
enabled: true
|
||||
data:
|
||||
NODE_ENV: production
|
||||
LOG_LEVEL: info
|
||||
|
||||
# HPA
|
||||
hpa:
|
||||
enabled: true
|
||||
minReplicas: 2
|
||||
maxReplicas: 10
|
||||
targetCPUUtilizationPercentage: 70
|
||||
targetMemoryUtilizationPercentage: 80
|
||||
|
||||
# 敏感配置（从 Secret 引用，Secret 由 edu-platform chart 或 ExternalSecrets 管理）
|
||||
secretRefs:
|
||||
- name: edu-platform-secret
|
||||
keys:
|
||||
- MYSQL_PASSWORD
|
||||
- JWT_SECRET
|
||||
- REDIS_PASSWORD
|
||||
12
infra/k8s/helm/api-gateway/Chart.yaml
Normal file
12
infra/k8s/helm/api-gateway/Chart.yaml
Normal file
@@ -0,0 +1,12 @@
|
||||
apiVersion: v2
|
||||
name: api-gateway
|
||||
description: api-gateway 服务级 Helm Chart（从 infra/k8s/api-gateway-deployment.yaml 迁移）
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.0.0"
|
||||
keywords:
|
||||
- edu
|
||||
- gateway
|
||||
- api
|
||||
maintainers:
|
||||
- name: edu-arch
|
||||
29
infra/k8s/helm/api-gateway/templates/_helpers.tpl
Normal file
29
infra/k8s/helm/api-gateway/templates/_helpers.tpl
Normal file
@@ -0,0 +1,29 @@
|
||||
{{- define "api-gateway.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "api-gateway.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "api-gateway.labels" -}}
|
||||
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
{{ include "api-gateway.selectorLabels" . }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
app.kubernetes.io/part-of: edu-platform
|
||||
app.kubernetes.io/component: gateway
|
||||
{{- end -}}
|
||||
|
||||
{{- define "api-gateway.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "api-gateway.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end -}}
|
||||
13
infra/k8s/helm/api-gateway/templates/configmap.yaml
Normal file
13
infra/k8s/helm/api-gateway/templates/configmap.yaml
Normal file
@@ -0,0 +1,13 @@
|
||||
{{- if .Values.configMap.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "api-gateway.name" . }}-config
|
||||
namespace: {{ .Values.namespace }}
|
||||
labels:
|
||||
{{- include "api-gateway.labels" . | nindent 4 }}
|
||||
data:
|
||||
{{- range $k, $v := .Values.configMap.data }}
|
||||
{{ $k }}: {{ $v | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
77
infra/k8s/helm/api-gateway/templates/deployment.yaml
Normal file
77
infra/k8s/helm/api-gateway/templates/deployment.yaml
Normal file
@@ -0,0 +1,77 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "api-gateway.name" . }}
|
||||
namespace: {{ .Values.namespace }}
|
||||
labels:
|
||||
{{- include "api-gateway.labels" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "api-gateway.selectorLabels" . | nindent 6 }}
|
||||
strategy:
|
||||
type: {{ .Values.strategy.type }}
|
||||
rollingUpdate:
|
||||
maxSurge: {{ .Values.strategy.maxSurge }}
|
||||
maxUnavailable: {{ .Values.strategy.maxUnavailable }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "api-gateway.selectorLabels" . | nindent 8 }}
|
||||
app.kubernetes.io/part-of: edu-platform
|
||||
app.kubernetes.io/component: gateway
|
||||
{{- if .Values.metrics.enabled }}
|
||||
annotations:
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/port: {{ .Values.metrics.port | quote }}
|
||||
prometheus.io/path: {{ .Values.metrics.path | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
containers:
|
||||
- name: {{ include "api-gateway.name" . }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: {{ .Values.service.targetPort }}
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.liveness.path }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.readiness.path }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
env:
|
||||
{{- if .Values.configMap.enabled }}
|
||||
{{- range $k, $v := .Values.configMap.data }}
|
||||
- name: {{ $k }}
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ include "api-gateway.name" $ }}-config
|
||||
key: {{ $k }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $secret := .Values.secretRefs }}
|
||||
{{- range $key := $secret.keys }}
|
||||
- name: {{ $key }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ $secret.name }}
|
||||
key: {{ $key }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
29
infra/k8s/helm/api-gateway/templates/hpa.yaml
Normal file
29
infra/k8s/helm/api-gateway/templates/hpa.yaml
Normal file
@@ -0,0 +1,29 @@
|
||||
{{- if .Values.hpa.enabled }}
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "api-gateway.name" . }}-hpa
|
||||
namespace: {{ .Values.namespace }}
|
||||
labels:
|
||||
{{- include "api-gateway.labels" . | nindent 4 }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{ include "api-gateway.name" . }}
|
||||
minReplicas: {{ .Values.hpa.minReplicas }}
|
||||
maxReplicas: {{ .Values.hpa.maxReplicas }}
|
||||
metrics:
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.hpa.targetCPUUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.hpa.targetMemoryUtilizationPercentage }}
|
||||
{{- end }}
|
||||
16
infra/k8s/helm/api-gateway/templates/service.yaml
Normal file
16
infra/k8s/helm/api-gateway/templates/service.yaml
Normal file
@@ -0,0 +1,16 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "api-gateway.name" . }}
|
||||
namespace: {{ .Values.namespace }}
|
||||
labels:
|
||||
{{- include "api-gateway.labels" . | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
selector:
|
||||
{{- include "api-gateway.selectorLabels" . | nindent 4 }}
|
||||
ports:
|
||||
- name: http
|
||||
port: {{ .Values.service.port }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
86
infra/k8s/helm/api-gateway/values.yaml
Normal file
86
infra/k8s/helm/api-gateway/values.yaml
Normal file
@@ -0,0 +1,86 @@
|
||||
# api-gateway 服务默认值
|
||||
|
||||
# 副本数（生产建议 ≥ 2）
|
||||
replicaCount: 2
|
||||
|
||||
image:
|
||||
repository: edu/api-gateway
|
||||
tag: latest # 生产请固定 tag，避免 latest
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# 服务端口
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 8080
|
||||
targetPort: 8080
|
||||
|
||||
# 命名空间（默认 edu-services，由 edu-platform chart 创建）
|
||||
namespace: edu-services
|
||||
|
||||
# 探针配置
|
||||
probes:
|
||||
liveness:
|
||||
path: /healthz
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 3
|
||||
readiness:
|
||||
path: /readyz
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 2
|
||||
|
||||
# 资源配额
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 1Gi
|
||||
|
||||
# 滚动更新策略
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
maxSurge: 1
|
||||
maxUnavailable: 0
|
||||
|
||||
# Prometheus 指标采集
|
||||
metrics:
|
||||
enabled: true
|
||||
port: 8080
|
||||
path: /metrics
|
||||
|
||||
# 安全上下文
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
|
||||
# 服务级 ConfigMap（非敏感配置）
|
||||
configMap:
|
||||
enabled: true
|
||||
data:
|
||||
NODE_ENV: production
|
||||
LOG_LEVEL: info
|
||||
MYSQL_HOST: mysql.edu-system.svc.cluster.local
|
||||
|
||||
# HPA
|
||||
hpa:
|
||||
enabled: true
|
||||
minReplicas: 2
|
||||
maxReplicas: 10
|
||||
targetCPUUtilizationPercentage: 70
|
||||
targetMemoryUtilizationPercentage: 80
|
||||
|
||||
# 敏感配置（从 Secret 引用，Secret 由 edu-platform chart 或 ExternalSecrets 管理）
|
||||
secretRefs:
|
||||
- name: edu-platform-secret
|
||||
keys:
|
||||
- MYSQL_PASSWORD
|
||||
- JWT_SECRET
|
||||
- REDIS_PASSWORD
|
||||
11
infra/k8s/helm/content/Chart.yaml
Normal file
11
infra/k8s/helm/content/Chart.yaml
Normal file
@@ -0,0 +1,11 @@
|
||||
apiVersion: v2
|
||||
name: content
|
||||
description: content 服务级 Helm Chart
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.0.0"
|
||||
keywords:
|
||||
- edu
|
||||
- content
|
||||
maintainers:
|
||||
- name: edu-arch
|
||||
29
infra/k8s/helm/content/templates/_helpers.tpl
Normal file
29
infra/k8s/helm/content/templates/_helpers.tpl
Normal file
@@ -0,0 +1,29 @@
|
||||
{{- define "content.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "content.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "content.labels" -}}
|
||||
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
{{ include "content.selectorLabels" . }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
app.kubernetes.io/part-of: edu-platform
|
||||
app.kubernetes.io/component: content
|
||||
{{- end -}}
|
||||
|
||||
{{- define "content.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "content.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end -}}
|
||||
77
infra/k8s/helm/content/templates/deployment.yaml
Normal file
77
infra/k8s/helm/content/templates/deployment.yaml
Normal file
@@ -0,0 +1,77 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "content.name" . }}
|
||||
namespace: {{ .Values.namespace }}
|
||||
labels:
|
||||
{{- include "content.labels" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "content.selectorLabels" . | nindent 6 }}
|
||||
strategy:
|
||||
type: {{ .Values.strategy.type }}
|
||||
rollingUpdate:
|
||||
maxSurge: {{ .Values.strategy.maxSurge }}
|
||||
maxUnavailable: {{ .Values.strategy.maxUnavailable }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "content.selectorLabels" . | nindent 8 }}
|
||||
app.kubernetes.io/part-of: edu-platform
|
||||
app.kubernetes.io/component: content
|
||||
{{- if .Values.metrics.enabled }}
|
||||
annotations:
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/port: {{ .Values.metrics.port | quote }}
|
||||
prometheus.io/path: {{ .Values.metrics.path | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
containers:
|
||||
- name: {{ include "content.name" . }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: {{ .Values.service.targetPort }}
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.liveness.path }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.readiness.path }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
env:
|
||||
{{- if .Values.configMap.enabled }}
|
||||
{{- range $k, $v := .Values.configMap.data }}
|
||||
- name: {{ $k }}
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ include "content.name" $ }}-config
|
||||
key: {{ $k }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $secret := .Values.secretRefs }}
|
||||
{{- range $key := $secret.keys }}
|
||||
- name: {{ $key }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ $secret.name }}
|
||||
key: {{ $key }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
16
infra/k8s/helm/content/templates/service.yaml
Normal file
16
infra/k8s/helm/content/templates/service.yaml
Normal file
@@ -0,0 +1,16 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "content.name" . }}
|
||||
namespace: {{ .Values.namespace }}
|
||||
labels:
|
||||
{{- include "content.labels" . | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
selector:
|
||||
{{- include "content.selectorLabels" . | nindent 4 }}
|
||||
ports:
|
||||
- name: http
|
||||
port: {{ .Values.service.port }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
85
infra/k8s/helm/content/values.yaml
Normal file
85
infra/k8s/helm/content/values.yaml
Normal file
@@ -0,0 +1,85 @@
|
||||
# content 服务默认值（内容资源 - 业务领域 D4）
|
||||
|
||||
# 副本数（生产建议 ≥ 2）
|
||||
replicaCount: 2
|
||||
|
||||
image:
|
||||
repository: edu/content
|
||||
tag: latest # 生产请固定 tag，避免 latest
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# 服务端口
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 3003
|
||||
targetPort: 3003
|
||||
|
||||
# 命名空间（默认 edu-services，由 edu-platform chart 创建）
|
||||
namespace: edu-services
|
||||
|
||||
# 探针配置
|
||||
probes:
|
||||
liveness:
|
||||
path: /healthz
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 3
|
||||
readiness:
|
||||
path: /readyz
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 2
|
||||
|
||||
# 资源配额
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 1Gi
|
||||
|
||||
# 滚动更新策略
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
maxSurge: 1
|
||||
maxUnavailable: 0
|
||||
|
||||
# Prometheus 指标采集
|
||||
metrics:
|
||||
enabled: true
|
||||
port: 3003
|
||||
path: /metrics
|
||||
|
||||
# 安全上下文
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
|
||||
# 服务级 ConfigMap（非敏感配置）
|
||||
configMap:
|
||||
enabled: true
|
||||
data:
|
||||
NODE_ENV: production
|
||||
LOG_LEVEL: info
|
||||
|
||||
# HPA
|
||||
hpa:
|
||||
enabled: true
|
||||
minReplicas: 2
|
||||
maxReplicas: 10
|
||||
targetCPUUtilizationPercentage: 70
|
||||
targetMemoryUtilizationPercentage: 80
|
||||
|
||||
# 敏感配置（从 Secret 引用，Secret 由 edu-platform chart 或 ExternalSecrets 管理）
|
||||
secretRefs:
|
||||
- name: edu-platform-secret
|
||||
keys:
|
||||
- MYSQL_PASSWORD
|
||||
- JWT_SECRET
|
||||
- REDIS_PASSWORD
|
||||
11
infra/k8s/helm/core-edu/Chart.yaml
Normal file
11
infra/k8s/helm/core-edu/Chart.yaml
Normal file
@@ -0,0 +1,11 @@
|
||||
apiVersion: v2
|
||||
name: core-edu
|
||||
description: core-edu 服务级 Helm Chart
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.0.0"
|
||||
keywords:
|
||||
- edu
|
||||
- core-edu
|
||||
maintainers:
|
||||
- name: edu-arch
|
||||
29
infra/k8s/helm/core-edu/templates/_helpers.tpl
Normal file
29
infra/k8s/helm/core-edu/templates/_helpers.tpl
Normal file
@@ -0,0 +1,29 @@
|
||||
{{- define "core-edu.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "core-edu.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "core-edu.labels" -}}
|
||||
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
{{ include "core-edu.selectorLabels" . }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
app.kubernetes.io/part-of: edu-platform
|
||||
app.kubernetes.io/component: teaching
|
||||
{{- end -}}
|
||||
|
||||
{{- define "core-edu.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "core-edu.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end -}}
|
||||
77
infra/k8s/helm/core-edu/templates/deployment.yaml
Normal file
77
infra/k8s/helm/core-edu/templates/deployment.yaml
Normal file
@@ -0,0 +1,77 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "core-edu.name" . }}
|
||||
namespace: {{ .Values.namespace }}
|
||||
labels:
|
||||
{{- include "core-edu.labels" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "core-edu.selectorLabels" . | nindent 6 }}
|
||||
strategy:
|
||||
type: {{ .Values.strategy.type }}
|
||||
rollingUpdate:
|
||||
maxSurge: {{ .Values.strategy.maxSurge }}
|
||||
maxUnavailable: {{ .Values.strategy.maxUnavailable }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "core-edu.selectorLabels" . | nindent 8 }}
|
||||
app.kubernetes.io/part-of: edu-platform
|
||||
app.kubernetes.io/component: teaching
|
||||
{{- if .Values.metrics.enabled }}
|
||||
annotations:
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/port: {{ .Values.metrics.port | quote }}
|
||||
prometheus.io/path: {{ .Values.metrics.path | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
containers:
|
||||
- name: {{ include "core-edu.name" . }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: {{ .Values.service.targetPort }}
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.liveness.path }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.readiness.path }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
env:
|
||||
{{- if .Values.configMap.enabled }}
|
||||
{{- range $k, $v := .Values.configMap.data }}
|
||||
- name: {{ $k }}
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ include "core-edu.name" $ }}-config
|
||||
key: {{ $k }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $secret := .Values.secretRefs }}
|
||||
{{- range $key := $secret.keys }}
|
||||
- name: {{ $key }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ $secret.name }}
|
||||
key: {{ $key }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
16
infra/k8s/helm/core-edu/templates/service.yaml
Normal file
16
infra/k8s/helm/core-edu/templates/service.yaml
Normal file
@@ -0,0 +1,16 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "core-edu.name" . }}
|
||||
namespace: {{ .Values.namespace }}
|
||||
labels:
|
||||
{{- include "core-edu.labels" . | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
selector:
|
||||
{{- include "core-edu.selectorLabels" . | nindent 4 }}
|
||||
ports:
|
||||
- name: http
|
||||
port: {{ .Values.service.port }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
85
infra/k8s/helm/core-edu/values.yaml
Normal file
85
infra/k8s/helm/core-edu/values.yaml
Normal file
@@ -0,0 +1,85 @@
|
||||
# core-edu 服务默认值（教学核心 - 业务领域 D2+D3）
|
||||
|
||||
# 副本数（生产建议 ≥ 2）
|
||||
replicaCount: 2
|
||||
|
||||
image:
|
||||
repository: edu/core-edu
|
||||
tag: latest # 生产请固定 tag，避免 latest
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# 服务端口
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 3002
|
||||
targetPort: 3002
|
||||
|
||||
# 命名空间（默认 edu-services，由 edu-platform chart 创建）
|
||||
namespace: edu-services
|
||||
|
||||
# 探针配置
|
||||
probes:
|
||||
liveness:
|
||||
path: /healthz
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 3
|
||||
readiness:
|
||||
path: /readyz
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 2
|
||||
|
||||
# 资源配额
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 1Gi
|
||||
|
||||
# 滚动更新策略
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
maxSurge: 1
|
||||
maxUnavailable: 0
|
||||
|
||||
# Prometheus 指标采集
|
||||
metrics:
|
||||
enabled: true
|
||||
port: 3002
|
||||
path: /metrics
|
||||
|
||||
# 安全上下文
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
|
||||
# 服务级 ConfigMap（非敏感配置）
|
||||
configMap:
|
||||
enabled: true
|
||||
data:
|
||||
NODE_ENV: production
|
||||
LOG_LEVEL: info
|
||||
|
||||
# HPA
|
||||
hpa:
|
||||
enabled: true
|
||||
minReplicas: 2
|
||||
maxReplicas: 10
|
||||
targetCPUUtilizationPercentage: 70
|
||||
targetMemoryUtilizationPercentage: 80
|
||||
|
||||
# 敏感配置（从 Secret 引用，Secret 由 edu-platform chart 或 ExternalSecrets 管理）
|
||||
secretRefs:
|
||||
- name: edu-platform-secret
|
||||
keys:
|
||||
- MYSQL_PASSWORD
|
||||
- JWT_SECRET
|
||||
- REDIS_PASSWORD
|
||||
11
infra/k8s/helm/data-ana/Chart.yaml
Normal file
11
infra/k8s/helm/data-ana/Chart.yaml
Normal file
@@ -0,0 +1,11 @@
|
||||
apiVersion: v2
|
||||
name: data-ana
|
||||
description: data-ana 服务级 Helm Chart
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.0.0"
|
||||
keywords:
|
||||
- edu
|
||||
- data-ana
|
||||
maintainers:
|
||||
- name: edu-arch
|
||||
29
infra/k8s/helm/data-ana/templates/_helpers.tpl
Normal file
29
infra/k8s/helm/data-ana/templates/_helpers.tpl
Normal file
@@ -0,0 +1,29 @@
|
||||
{{- define "data-ana.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "data-ana.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "data-ana.labels" -}}
|
||||
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
{{ include "data-ana.selectorLabels" . }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
app.kubernetes.io/part-of: edu-platform
|
||||
app.kubernetes.io/component: analytics
|
||||
{{- end -}}
|
||||
|
||||
{{- define "data-ana.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "data-ana.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end -}}
|
||||
77
infra/k8s/helm/data-ana/templates/deployment.yaml
Normal file
77
infra/k8s/helm/data-ana/templates/deployment.yaml
Normal file
@@ -0,0 +1,77 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "data-ana.name" . }}
|
||||
namespace: {{ .Values.namespace }}
|
||||
labels:
|
||||
{{- include "data-ana.labels" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "data-ana.selectorLabels" . | nindent 6 }}
|
||||
strategy:
|
||||
type: {{ .Values.strategy.type }}
|
||||
rollingUpdate:
|
||||
maxSurge: {{ .Values.strategy.maxSurge }}
|
||||
maxUnavailable: {{ .Values.strategy.maxUnavailable }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "data-ana.selectorLabels" . | nindent 8 }}
|
||||
app.kubernetes.io/part-of: edu-platform
|
||||
app.kubernetes.io/component: analytics
|
||||
{{- if .Values.metrics.enabled }}
|
||||
annotations:
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/port: {{ .Values.metrics.port | quote }}
|
||||
prometheus.io/path: {{ .Values.metrics.path | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
containers:
|
||||
- name: {{ include "data-ana.name" . }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: {{ .Values.service.targetPort }}
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.liveness.path }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.readiness.path }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
env:
|
||||
{{- if .Values.configMap.enabled }}
|
||||
{{- range $k, $v := .Values.configMap.data }}
|
||||
- name: {{ $k }}
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ include "data-ana.name" $ }}-config
|
||||
key: {{ $k }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $secret := .Values.secretRefs }}
|
||||
{{- range $key := $secret.keys }}
|
||||
- name: {{ $key }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ $secret.name }}
|
||||
key: {{ $key }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
16
infra/k8s/helm/data-ana/templates/service.yaml
Normal file
16
infra/k8s/helm/data-ana/templates/service.yaml
Normal file
@@ -0,0 +1,16 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "data-ana.name" . }}
|
||||
namespace: {{ .Values.namespace }}
|
||||
labels:
|
||||
{{- include "data-ana.labels" . | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
selector:
|
||||
{{- include "data-ana.selectorLabels" . | nindent 4 }}
|
||||
ports:
|
||||
- name: http
|
||||
port: {{ .Values.service.port }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
85
infra/k8s/helm/data-ana/values.yaml
Normal file
85
infra/k8s/helm/data-ana/values.yaml
Normal file
@@ -0,0 +1,85 @@
|
||||
# data-ana 服务默认值（数据分析 - 业务领域 D6）
|
||||
|
||||
# 副本数（生产建议 ≥ 2）
|
||||
replicaCount: 2
|
||||
|
||||
image:
|
||||
repository: edu/data-ana
|
||||
tag: latest # 生产请固定 tag，避免 latest
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# 服务端口
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 3005
|
||||
targetPort: 3005
|
||||
|
||||
# 命名空间（默认 edu-services，由 edu-platform chart 创建）
|
||||
namespace: edu-services
|
||||
|
||||
# 探针配置
|
||||
probes:
|
||||
liveness:
|
||||
path: /healthz
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 3
|
||||
readiness:
|
||||
path: /readyz
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 2
|
||||
|
||||
# 资源配额
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 1Gi
|
||||
|
||||
# 滚动更新策略
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
maxSurge: 1
|
||||
maxUnavailable: 0
|
||||
|
||||
# Prometheus 指标采集
|
||||
metrics:
|
||||
enabled: true
|
||||
port: 3005
|
||||
path: /metrics
|
||||
|
||||
# 安全上下文
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
|
||||
# 服务级 ConfigMap（非敏感配置）
|
||||
configMap:
|
||||
enabled: true
|
||||
data:
|
||||
NODE_ENV: production
|
||||
LOG_LEVEL: info
|
||||
|
||||
# HPA
|
||||
hpa:
|
||||
enabled: true
|
||||
minReplicas: 2
|
||||
maxReplicas: 10
|
||||
targetCPUUtilizationPercentage: 70
|
||||
targetMemoryUtilizationPercentage: 80
|
||||
|
||||
# 敏感配置（从 Secret 引用，Secret 由 edu-platform chart 或 ExternalSecrets 管理）
|
||||
secretRefs:
|
||||
- name: edu-platform-secret
|
||||
keys:
|
||||
- MYSQL_PASSWORD
|
||||
- JWT_SECRET
|
||||
- REDIS_PASSWORD
|
||||
12
infra/k8s/helm/edu-platform/Chart.yaml
Normal file
12
infra/k8s/helm/edu-platform/Chart.yaml
Normal file
@@ -0,0 +1,12 @@
|
||||
apiVersion: v2
|
||||
name: edu-platform
|
||||
description: Edu 平台级 Helm Chart（命名空间 / 全局 ConfigMap / Secret / Ingress / HPA 模板）
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.0.0"
|
||||
keywords:
|
||||
- edu
|
||||
- platform
|
||||
- infrastructure
|
||||
maintainers:
|
||||
- name: edu-arch
|
||||
42
infra/k8s/helm/edu-platform/templates/_helpers.tpl
Normal file
42
infra/k8s/helm/edu-platform/templates/_helpers.tpl
Normal file
@@ -0,0 +1,42 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "edu-platform.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Fully qualified app name.
|
||||
*/}}
|
||||
{{- define "edu-platform.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Common labels.
|
||||
*/}}
|
||||
{{- define "edu-platform.labels" -}}
|
||||
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
{{ include "edu-platform.selectorLabels" . }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- with .Values.global.labels }}
|
||||
{{ toYaml . }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Selector labels.
|
||||
*/}}
|
||||
{{- define "edu-platform.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "edu-platform.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end -}}
|
||||
13
infra/k8s/helm/edu-platform/templates/configmap.yaml
Normal file
13
infra/k8s/helm/edu-platform/templates/configmap.yaml
Normal file
@@ -0,0 +1,13 @@
|
||||
{{- if .Values.configMap.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ .Values.configMap.name }}
|
||||
namespace: edu-system
|
||||
labels:
|
||||
{{- include "edu-platform.labels" . | nindent 4 }}
|
||||
data:
|
||||
{{- range $k, $v := .Values.configMap.data }}
|
||||
{{ $k }}: {{ $v | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
34
infra/k8s/helm/edu-platform/templates/hpa.yaml
Normal file
34
infra/k8s/helm/edu-platform/templates/hpa.yaml
Normal file
@@ -0,0 +1,34 @@
|
||||
{{/*
|
||||
全局 HPA 模板示例（参考用）。
|
||||
实际 HPA 应在各服务自身的 chart 中定义，以便针对服务特性调参。
|
||||
本模板在 edu-platform 中默认不渲染（hpa.targetService 为空时跳过）。
|
||||
*/}}
|
||||
{{- if and .Values.hpa.enabled .Values.hpa.targetService }}
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ .Values.hpa.targetService }}-hpa
|
||||
namespace: edu-services
|
||||
labels:
|
||||
{{- include "edu-platform.labels" . | nindent 4 }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{ .Values.hpa.targetService }}
|
||||
minReplicas: {{ .Values.hpa.minReplicas }}
|
||||
maxReplicas: {{ .Values.hpa.maxReplicas }}
|
||||
metrics:
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.hpa.targetCPUUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.hpa.targetMemoryUtilizationPercentage }}
|
||||
{{- end }}
|
||||
35
infra/k8s/helm/edu-platform/templates/ingress.yaml
Normal file
35
infra/k8s/helm/edu-platform/templates/ingress.yaml
Normal file
@@ -0,0 +1,35 @@
|
||||
{{- if .Values.ingress.enabled }}
|
||||
{{- range .Values.ingress.hosts }}
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $.Release.Name }}-ingress
|
||||
namespace: edu-ingress
|
||||
labels:
|
||||
{{- include "edu-platform.labels" $ | nindent 4 }}
|
||||
{{- with $.Values.ingress.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
ingressClassName: {{ $.Values.ingress.className }}
|
||||
{{- with $.Values.ingress.tls }}
|
||||
tls:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- host: {{ .host }}
|
||||
http:
|
||||
paths:
|
||||
{{- range .paths }}
|
||||
- path: {{ .path }}
|
||||
pathType: {{ .pathType }}
|
||||
backend:
|
||||
service:
|
||||
name: {{ .service }}
|
||||
port:
|
||||
number: {{ .port }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
10
infra/k8s/helm/edu-platform/templates/namespace.yaml
Normal file
10
infra/k8s/helm/edu-platform/templates/namespace.yaml
Normal file
@@ -0,0 +1,10 @@
|
||||
{{- range .Values.namespaces }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: {{ .name }}
|
||||
labels:
|
||||
{{- include "edu-platform.labels" $ | nindent 4 }}
|
||||
app.kubernetes.io/component: {{ .component }}
|
||||
{{- end }}
|
||||
26
infra/k8s/helm/edu-platform/templates/secret.yaml
Normal file
26
infra/k8s/helm/edu-platform/templates/secret.yaml
Normal file
@@ -0,0 +1,26 @@
|
||||
{{- if .Values.secret.enabled }}
|
||||
{{- /*
|
||||
⚠️ 生产环境警告：不要在 values.yaml 中硬编码真实密钥！
|
||||
推荐方案：使用 External Secrets Operator 对接 Vault / KMS / 云 KMS
|
||||
本模板仅作骨架；空字符串字段不会被渲染（避免覆盖已存在的 Secret）。
|
||||
*/ -}}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ .Values.secret.name }}
|
||||
namespace: edu-system
|
||||
labels:
|
||||
{{- include "edu-platform.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": pre-install
|
||||
"helm.sh/hook-delete-policy": before-hook-creation
|
||||
type: Opaque
|
||||
data:
|
||||
{{- range $k, $v := .Values.secret.data }}
|
||||
{{- if $v }}
|
||||
{{ $k }}: {{ $v }}
|
||||
{{- else }}
|
||||
{{ $k }}: "" # 占位：部署时通过 --set 或 ExternalSecrets 注入
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
24
infra/k8s/helm/edu-platform/values-dev.yaml
Normal file
24
infra/k8s/helm/edu-platform/values-dev.yaml
Normal file
@@ -0,0 +1,24 @@
|
||||
# 开发环境覆盖
|
||||
global:
|
||||
labels:
|
||||
app.kubernetes.io/part-of: edu-platform
|
||||
app.kubernetes.io/environment: dev
|
||||
|
||||
configMap:
|
||||
data:
|
||||
NODE_ENV: development
|
||||
LOG_LEVEL: debug
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- host: edu-dev.local
|
||||
paths:
|
||||
- path: /api
|
||||
pathType: Prefix
|
||||
service: api-gateway
|
||||
port: 8080
|
||||
tls: [] # 开发环境不强制 TLS
|
||||
|
||||
hpa:
|
||||
enabled: false # 开发环境单副本即可
|
||||
35
infra/k8s/helm/edu-platform/values-prod.yaml
Normal file
35
infra/k8s/helm/edu-platform/values-prod.yaml
Normal file
@@ -0,0 +1,35 @@
|
||||
# 生产环境覆盖
|
||||
global:
|
||||
labels:
|
||||
app.kubernetes.io/part-of: edu-platform
|
||||
app.kubernetes.io/environment: prod
|
||||
imagePullSecrets:
|
||||
- name: registry-credentials
|
||||
|
||||
configMap:
|
||||
data:
|
||||
NODE_ENV: production
|
||||
LOG_LEVEL: warn
|
||||
|
||||
ingress:
|
||||
hosts:
|
||||
- host: edu.example.com
|
||||
paths:
|
||||
- path: /api
|
||||
pathType: Prefix
|
||||
service: api-gateway
|
||||
port: 8080
|
||||
- path: /auth
|
||||
pathType: Prefix
|
||||
service: api-gateway
|
||||
port: 8080
|
||||
tls:
|
||||
- secretName: edu-tls
|
||||
hosts:
|
||||
- edu.example.com
|
||||
|
||||
hpa:
|
||||
minReplicas: 3
|
||||
maxReplicas: 20
|
||||
targetCPUUtilizationPercentage: 60
|
||||
targetMemoryUtilizationPercentage: 70
|
||||
23
infra/k8s/helm/edu-platform/values-staging.yaml
Normal file
23
infra/k8s/helm/edu-platform/values-staging.yaml
Normal file
@@ -0,0 +1,23 @@
|
||||
# 预发布环境覆盖
|
||||
global:
|
||||
labels:
|
||||
app.kubernetes.io/part-of: edu-platform
|
||||
app.kubernetes.io/environment: staging
|
||||
|
||||
configMap:
|
||||
data:
|
||||
NODE_ENV: staging
|
||||
LOG_LEVEL: info
|
||||
|
||||
ingress:
|
||||
hosts:
|
||||
- host: edu-staging.example.com
|
||||
paths:
|
||||
- path: /api
|
||||
pathType: Prefix
|
||||
service: api-gateway
|
||||
port: 8080
|
||||
|
||||
hpa:
|
||||
minReplicas: 2
|
||||
maxReplicas: 5
|
||||
72
infra/k8s/helm/edu-platform/values.yaml
Normal file
72
infra/k8s/helm/edu-platform/values.yaml
Normal file
@@ -0,0 +1,72 @@
|
||||
# Edu 平台全局默认值
|
||||
# 环境覆盖文件：values-dev.yaml / values-staging.yaml / values-prod.yaml
|
||||
|
||||
# 全局标签（自动注入到所有资源）
|
||||
global:
|
||||
labels:
|
||||
app.kubernetes.io/part-of: edu-platform
|
||||
# 镜像拉取凭证（生产建议使用 Secret + serviceAccount）
|
||||
imagePullSecrets: []
|
||||
|
||||
# 命名空间规划
|
||||
namespaces:
|
||||
- name: edu-system
|
||||
component: system
|
||||
- name: edu-services
|
||||
component: services
|
||||
- name: edu-monitoring
|
||||
component: monitoring
|
||||
- name: edu-ingress
|
||||
component: ingress
|
||||
|
||||
# 全局 ConfigMap（非敏感配置）
|
||||
configMap:
|
||||
enabled: true
|
||||
name: edu-platform-config
|
||||
data:
|
||||
NODE_ENV: production
|
||||
LOG_LEVEL: info
|
||||
MYSQL_HOST: mysql.edu-system.svc.cluster.local
|
||||
REDIS_HOST: redis.edu-system.svc.cluster.local
|
||||
KAFKA_BROKERS: kafka.edu-system.svc.cluster.local:9092
|
||||
|
||||
# 全局 Secret（仅骨架；生产请使用 External Secrets Operator 对接 Vault/KMS）
|
||||
secret:
|
||||
enabled: true
|
||||
name: edu-platform-secret
|
||||
# 真实部署时通过 --set secret.data.MYSQL_PASSWORD=<base64> 注入
|
||||
# 或通过 externalSecrets 引用
|
||||
data:
|
||||
MYSQL_PASSWORD: ""
|
||||
JWT_SECRET: ""
|
||||
REDIS_PASSWORD: ""
|
||||
|
||||
# 全局 Ingress
|
||||
ingress:
|
||||
enabled: true
|
||||
className: nginx
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
hosts:
|
||||
- host: edu.example.com
|
||||
paths:
|
||||
- path: /api
|
||||
pathType: Prefix
|
||||
service: api-gateway
|
||||
port: 8080
|
||||
- path: /auth
|
||||
pathType: Prefix
|
||||
service: api-gateway
|
||||
port: 8080
|
||||
tls:
|
||||
- secretName: edu-tls
|
||||
hosts:
|
||||
- edu.example.com
|
||||
|
||||
# HPA 全局默认策略（各服务可在自身 chart 中覆盖）
|
||||
hpa:
|
||||
enabled: true
|
||||
minReplicas: 2
|
||||
maxReplicas: 10
|
||||
targetCPUUtilizationPercentage: 70
|
||||
targetMemoryUtilizationPercentage: 80
|
||||
11
infra/k8s/helm/iam/Chart.yaml
Normal file
11
infra/k8s/helm/iam/Chart.yaml
Normal file
@@ -0,0 +1,11 @@
|
||||
apiVersion: v2
|
||||
name: iam
|
||||
description: iam 服务级 Helm Chart
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.0.0"
|
||||
keywords:
|
||||
- edu
|
||||
- iam
|
||||
maintainers:
|
||||
- name: edu-arch
|
||||
29
infra/k8s/helm/iam/templates/_helpers.tpl
Normal file
29
infra/k8s/helm/iam/templates/_helpers.tpl
Normal file
@@ -0,0 +1,29 @@
|
||||
{{- define "iam.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "iam.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "iam.labels" -}}
|
||||
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
{{ include "iam.selectorLabels" . }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
app.kubernetes.io/part-of: edu-platform
|
||||
app.kubernetes.io/component: identity
|
||||
{{- end -}}
|
||||
|
||||
{{- define "iam.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "iam.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end -}}
|
||||
77
infra/k8s/helm/iam/templates/deployment.yaml
Normal file
77
infra/k8s/helm/iam/templates/deployment.yaml
Normal file
@@ -0,0 +1,77 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "iam.name" . }}
|
||||
namespace: {{ .Values.namespace }}
|
||||
labels:
|
||||
{{- include "iam.labels" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "iam.selectorLabels" . | nindent 6 }}
|
||||
strategy:
|
||||
type: {{ .Values.strategy.type }}
|
||||
rollingUpdate:
|
||||
maxSurge: {{ .Values.strategy.maxSurge }}
|
||||
maxUnavailable: {{ .Values.strategy.maxUnavailable }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "iam.selectorLabels" . | nindent 8 }}
|
||||
app.kubernetes.io/part-of: edu-platform
|
||||
app.kubernetes.io/component: identity
|
||||
{{- if .Values.metrics.enabled }}
|
||||
annotations:
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/port: {{ .Values.metrics.port | quote }}
|
||||
prometheus.io/path: {{ .Values.metrics.path | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
containers:
|
||||
- name: {{ include "iam.name" . }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: {{ .Values.service.targetPort }}
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.liveness.path }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.readiness.path }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
env:
|
||||
{{- if .Values.configMap.enabled }}
|
||||
{{- range $k, $v := .Values.configMap.data }}
|
||||
- name: {{ $k }}
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ include "iam.name" $ }}-config
|
||||
key: {{ $k }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $secret := .Values.secretRefs }}
|
||||
{{- range $key := $secret.keys }}
|
||||
- name: {{ $key }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ $secret.name }}
|
||||
key: {{ $key }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
16
infra/k8s/helm/iam/templates/service.yaml
Normal file
16
infra/k8s/helm/iam/templates/service.yaml
Normal file
@@ -0,0 +1,16 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "iam.name" . }}
|
||||
namespace: {{ .Values.namespace }}
|
||||
labels:
|
||||
{{- include "iam.labels" . | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
selector:
|
||||
{{- include "iam.selectorLabels" . | nindent 4 }}
|
||||
ports:
|
||||
- name: http
|
||||
port: {{ .Values.service.port }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
85
infra/k8s/helm/iam/values.yaml
Normal file
85
infra/k8s/helm/iam/values.yaml
Normal file
@@ -0,0 +1,85 @@
|
||||
# iam 服务默认值（身份认证 - 业务领域 D1）
|
||||
|
||||
# 副本数（生产建议 ≥ 2）
|
||||
replicaCount: 2
|
||||
|
||||
image:
|
||||
repository: edu/iam
|
||||
tag: latest # 生产请固定 tag，避免 latest
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# 服务端口
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 3001
|
||||
targetPort: 3001
|
||||
|
||||
# 命名空间（默认 edu-services，由 edu-platform chart 创建）
|
||||
namespace: edu-services
|
||||
|
||||
# 探针配置
|
||||
probes:
|
||||
liveness:
|
||||
path: /healthz
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 3
|
||||
readiness:
|
||||
path: /readyz
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 2
|
||||
|
||||
# 资源配额
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 1Gi
|
||||
|
||||
# 滚动更新策略
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
maxSurge: 1
|
||||
maxUnavailable: 0
|
||||
|
||||
# Prometheus 指标采集
|
||||
metrics:
|
||||
enabled: true
|
||||
port: 3001
|
||||
path: /metrics
|
||||
|
||||
# 安全上下文
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
|
||||
# 服务级 ConfigMap（非敏感配置）
|
||||
configMap:
|
||||
enabled: true
|
||||
data:
|
||||
NODE_ENV: production
|
||||
LOG_LEVEL: info
|
||||
|
||||
# HPA
|
||||
hpa:
|
||||
enabled: true
|
||||
minReplicas: 2
|
||||
maxReplicas: 10
|
||||
targetCPUUtilizationPercentage: 70
|
||||
targetMemoryUtilizationPercentage: 80
|
||||
|
||||
# 敏感配置（从 Secret 引用，Secret 由 edu-platform chart 或 ExternalSecrets 管理）
|
||||
secretRefs:
|
||||
- name: edu-platform-secret
|
||||
keys:
|
||||
- MYSQL_PASSWORD
|
||||
- JWT_SECRET
|
||||
- REDIS_PASSWORD
|
||||
11
infra/k8s/helm/msg/Chart.yaml
Normal file
11
infra/k8s/helm/msg/Chart.yaml
Normal file
@@ -0,0 +1,11 @@
|
||||
apiVersion: v2
|
||||
name: msg
|
||||
description: msg 服务级 Helm Chart
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.0.0"
|
||||
keywords:
|
||||
- edu
|
||||
- msg
|
||||
maintainers:
|
||||
- name: edu-arch
|
||||
29
infra/k8s/helm/msg/templates/_helpers.tpl
Normal file
29
infra/k8s/helm/msg/templates/_helpers.tpl
Normal file
@@ -0,0 +1,29 @@
|
||||
{{- define "msg.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "msg.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "msg.labels" -}}
|
||||
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
{{ include "msg.selectorLabels" . }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
app.kubernetes.io/part-of: edu-platform
|
||||
app.kubernetes.io/component: messaging
|
||||
{{- end -}}
|
||||
|
||||
{{- define "msg.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "msg.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end -}}
|
||||
77
infra/k8s/helm/msg/templates/deployment.yaml
Normal file
77
infra/k8s/helm/msg/templates/deployment.yaml
Normal file
@@ -0,0 +1,77 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "msg.name" . }}
|
||||
namespace: {{ .Values.namespace }}
|
||||
labels:
|
||||
{{- include "msg.labels" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "msg.selectorLabels" . | nindent 6 }}
|
||||
strategy:
|
||||
type: {{ .Values.strategy.type }}
|
||||
rollingUpdate:
|
||||
maxSurge: {{ .Values.strategy.maxSurge }}
|
||||
maxUnavailable: {{ .Values.strategy.maxUnavailable }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "msg.selectorLabels" . | nindent 8 }}
|
||||
app.kubernetes.io/part-of: edu-platform
|
||||
app.kubernetes.io/component: messaging
|
||||
{{- if .Values.metrics.enabled }}
|
||||
annotations:
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/port: {{ .Values.metrics.port | quote }}
|
||||
prometheus.io/path: {{ .Values.metrics.path | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
containers:
|
||||
- name: {{ include "msg.name" . }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: {{ .Values.service.targetPort }}
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.liveness.path }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.readiness.path }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
env:
|
||||
{{- if .Values.configMap.enabled }}
|
||||
{{- range $k, $v := .Values.configMap.data }}
|
||||
- name: {{ $k }}
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ include "msg.name" $ }}-config
|
||||
key: {{ $k }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $secret := .Values.secretRefs }}
|
||||
{{- range $key := $secret.keys }}
|
||||
- name: {{ $key }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ $secret.name }}
|
||||
key: {{ $key }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
16
infra/k8s/helm/msg/templates/service.yaml
Normal file
16
infra/k8s/helm/msg/templates/service.yaml
Normal file
@@ -0,0 +1,16 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "msg.name" . }}
|
||||
namespace: {{ .Values.namespace }}
|
||||
labels:
|
||||
{{- include "msg.labels" . | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
selector:
|
||||
{{- include "msg.selectorLabels" . | nindent 4 }}
|
||||
ports:
|
||||
- name: http
|
||||
port: {{ .Values.service.port }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
85
infra/k8s/helm/msg/values.yaml
Normal file
85
infra/k8s/helm/msg/values.yaml
Normal file
@@ -0,0 +1,85 @@
|
||||
# msg 服务默认值（消息通知 - 业务领域 D5）
|
||||
|
||||
# 副本数（生产建议 ≥ 2）
|
||||
replicaCount: 2
|
||||
|
||||
image:
|
||||
repository: edu/msg
|
||||
tag: latest # 生产请固定 tag，避免 latest
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# 服务端口
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 3004
|
||||
targetPort: 3004
|
||||
|
||||
# 命名空间（默认 edu-services，由 edu-platform chart 创建）
|
||||
namespace: edu-services
|
||||
|
||||
# 探针配置
|
||||
probes:
|
||||
liveness:
|
||||
path: /healthz
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 3
|
||||
readiness:
|
||||
path: /readyz
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 2
|
||||
|
||||
# 资源配额
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 1Gi
|
||||
|
||||
# 滚动更新策略
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
maxSurge: 1
|
||||
maxUnavailable: 0
|
||||
|
||||
# Prometheus 指标采集
|
||||
metrics:
|
||||
enabled: true
|
||||
port: 3004
|
||||
path: /metrics
|
||||
|
||||
# 安全上下文
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
|
||||
# 服务级 ConfigMap（非敏感配置）
|
||||
configMap:
|
||||
enabled: true
|
||||
data:
|
||||
NODE_ENV: production
|
||||
LOG_LEVEL: info
|
||||
|
||||
# HPA
|
||||
hpa:
|
||||
enabled: true
|
||||
minReplicas: 2
|
||||
maxReplicas: 10
|
||||
targetCPUUtilizationPercentage: 70
|
||||
targetMemoryUtilizationPercentage: 80
|
||||
|
||||
# 敏感配置（从 Secret 引用，Secret 由 edu-platform chart 或 ExternalSecrets 管理）
|
||||
secretRefs:
|
||||
- name: edu-platform-secret
|
||||
keys:
|
||||
- MYSQL_PASSWORD
|
||||
- JWT_SECRET
|
||||
- REDIS_PASSWORD
|
||||
Reference in New Issue
Block a user