feat(infra): k8s Helm Chart 演化与备份脚本测试

- 新增 edu-platform 平台级 chart（namespace/configmap/secret/ingress/hpa） - 新增 api-gateway 服务级 chart（完整迁移自原 manifest） - 新增 6 个业务服务 chart 桩（iam/core-edu/content/msg/data-ana/ai） - 删除原 api-gateway-deployment.yaml（已迁移至 helm chart） - 更新 infra/k8s/README.md 为 Helm Chart 管理说明 - 新增 backup-mysql.sh dry-run 测试脚本（17 断言）
2026-07-08 12:50:56 +08:00
parent 9b33303195
commit d831915f06
51 changed files with 2111 additions and 165 deletions
--- a/infra/k8s/helm/edu-platform/Chart.yaml
+++ b/infra/k8s/helm/edu-platform/Chart.yaml
@@ -0,0 +1,12 @@
+apiVersion: v2
+name: edu-platform
+description: Edu 平台级 Helm Chart（命名空间 / 全局 ConfigMap / Secret / Ingress / HPA 模板）
+type: application
+version: 0.1.0
+appVersion: "1.0.0"
+keywords:
+  - edu
+  - platform
+  - infrastructure
+maintainers:
+  - name: edu-arch
--- a/infra/k8s/helm/edu-platform/templates/_helpers.tpl
+++ b/infra/k8s/helm/edu-platform/templates/_helpers.tpl
@@ -0,0 +1,42 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "edu-platform.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Fully qualified app name.
+*/}}
+{{- define "edu-platform.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Common labels.
+*/}}
+{{- define "edu-platform.labels" -}}
+helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+{{ include "edu-platform.selectorLabels" . }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- with .Values.global.labels }}
+{{ toYaml . }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Selector labels.
+*/}}
+{{- define "edu-platform.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "edu-platform.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
--- a/infra/k8s/helm/edu-platform/templates/configmap.yaml
+++ b/infra/k8s/helm/edu-platform/templates/configmap.yaml
@@ -0,0 +1,13 @@
+{{- if .Values.configMap.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Values.configMap.name }}
+  namespace: edu-system
+  labels:
+    {{- include "edu-platform.labels" . | nindent 4 }}
+data:
+{{- range $k, $v := .Values.configMap.data }}
+  {{ $k }}: {{ $v | quote }}
+{{- end }}
+{{- end }}
--- a/infra/k8s/helm/edu-platform/templates/hpa.yaml
+++ b/infra/k8s/helm/edu-platform/templates/hpa.yaml
@@ -0,0 +1,34 @@
+{{/*
+  全局 HPA 模板示例（参考用）。
+  实际 HPA 应在各服务自身的 chart 中定义，以便针对服务特性调参。
+  本模板在 edu-platform 中默认不渲染（hpa.targetService 为空时跳过）。
+*/}}
+{{- if and .Values.hpa.enabled .Values.hpa.targetService }}
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ .Values.hpa.targetService }}-hpa
+  namespace: edu-services
+  labels:
+    {{- include "edu-platform.labels" . | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ .Values.hpa.targetService }}
+  minReplicas: {{ .Values.hpa.minReplicas }}
+  maxReplicas: {{ .Values.hpa.maxReplicas }}
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.hpa.targetCPUUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: memory
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.hpa.targetMemoryUtilizationPercentage }}
+{{- end }}
--- a/infra/k8s/helm/edu-platform/templates/ingress.yaml
+++ b/infra/k8s/helm/edu-platform/templates/ingress.yaml
@@ -0,0 +1,35 @@
+{{- if .Values.ingress.enabled }}
+{{- range .Values.ingress.hosts }}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ $.Release.Name }}-ingress
+  namespace: edu-ingress
+  labels:
+    {{- include "edu-platform.labels" $ | nindent 4 }}
+  {{- with $.Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  ingressClassName: {{ $.Values.ingress.className }}
+  {{- with $.Values.ingress.tls }}
+  tls:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    - host: {{ .host }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ .service }}
+                port:
+                  number: {{ .port }}
+          {{- end }}
+{{- end }}
+{{- end }}
--- a/infra/k8s/helm/edu-platform/templates/namespace.yaml
+++ b/infra/k8s/helm/edu-platform/templates/namespace.yaml
@@ -0,0 +1,10 @@
+{{- range .Values.namespaces }}
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .name }}
+  labels:
+    {{- include "edu-platform.labels" $ | nindent 4 }}
+    app.kubernetes.io/component: {{ .component }}
+{{- end }}
--- a/infra/k8s/helm/edu-platform/templates/secret.yaml
+++ b/infra/k8s/helm/edu-platform/templates/secret.yaml
@@ -0,0 +1,26 @@
+{{- if .Values.secret.enabled }}
+{{- /*
+  ⚠️ 生产环境警告：不要在 values.yaml 中硬编码真实密钥！
+  推荐方案：使用 External Secrets Operator 对接 Vault / KMS / 云 KMS
+  本模板仅作骨架；空字符串字段不会被渲染（避免覆盖已存在的 Secret）。
+*/ -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.secret.name }}
+  namespace: edu-system
+  labels:
+    {{- include "edu-platform.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-delete-policy": before-hook-creation
+type: Opaque
+data:
+{{- range $k, $v := .Values.secret.data }}
+{{- if $v }}
+  {{ $k }}: {{ $v }}
+{{- else }}
+  {{ $k }}: ""  # 占位：部署时通过 --set 或 ExternalSecrets 注入
+{{- end }}
+{{- end }}
+{{- end }}
--- a/infra/k8s/helm/edu-platform/values-dev.yaml
+++ b/infra/k8s/helm/edu-platform/values-dev.yaml
@@ -0,0 +1,24 @@
+# 开发环境覆盖
+global:
+  labels:
+    app.kubernetes.io/part-of: edu-platform
+    app.kubernetes.io/environment: dev
+
+configMap:
+  data:
+    NODE_ENV: development
+    LOG_LEVEL: debug
+
+ingress:
+  enabled: true
+  hosts:
+    - host: edu-dev.local
+      paths:
+        - path: /api
+          pathType: Prefix
+          service: api-gateway
+          port: 8080
+  tls: []  # 开发环境不强制 TLS
+
+hpa:
+  enabled: false  # 开发环境单副本即可
--- a/infra/k8s/helm/edu-platform/values-prod.yaml
+++ b/infra/k8s/helm/edu-platform/values-prod.yaml
@@ -0,0 +1,35 @@
+# 生产环境覆盖
+global:
+  labels:
+    app.kubernetes.io/part-of: edu-platform
+    app.kubernetes.io/environment: prod
+  imagePullSecrets:
+    - name: registry-credentials
+
+configMap:
+  data:
+    NODE_ENV: production
+    LOG_LEVEL: warn
+
+ingress:
+  hosts:
+    - host: edu.example.com
+      paths:
+        - path: /api
+          pathType: Prefix
+          service: api-gateway
+          port: 8080
+        - path: /auth
+          pathType: Prefix
+          service: api-gateway
+          port: 8080
+  tls:
+    - secretName: edu-tls
+      hosts:
+        - edu.example.com
+
+hpa:
+  minReplicas: 3
+  maxReplicas: 20
+  targetCPUUtilizationPercentage: 60
+  targetMemoryUtilizationPercentage: 70
--- a/infra/k8s/helm/edu-platform/values-staging.yaml
+++ b/infra/k8s/helm/edu-platform/values-staging.yaml
@@ -0,0 +1,23 @@
+# 预发布环境覆盖
+global:
+  labels:
+    app.kubernetes.io/part-of: edu-platform
+    app.kubernetes.io/environment: staging
+
+configMap:
+  data:
+    NODE_ENV: staging
+    LOG_LEVEL: info
+
+ingress:
+  hosts:
+    - host: edu-staging.example.com
+      paths:
+        - path: /api
+          pathType: Prefix
+          service: api-gateway
+          port: 8080
+
+hpa:
+  minReplicas: 2
+  maxReplicas: 5
--- a/infra/k8s/helm/edu-platform/values.yaml
+++ b/infra/k8s/helm/edu-platform/values.yaml
@@ -0,0 +1,72 @@
+# Edu 平台全局默认值
+# 环境覆盖文件：values-dev.yaml / values-staging.yaml / values-prod.yaml
+
+# 全局标签（自动注入到所有资源）
+global:
+  labels:
+    app.kubernetes.io/part-of: edu-platform
+  # 镜像拉取凭证（生产建议使用 Secret + serviceAccount）
+  imagePullSecrets: []
+
+# 命名空间规划
+namespaces:
+  - name: edu-system
+    component: system
+  - name: edu-services
+    component: services
+  - name: edu-monitoring
+    component: monitoring
+  - name: edu-ingress
+    component: ingress
+
+# 全局 ConfigMap（非敏感配置）
+configMap:
+  enabled: true
+  name: edu-platform-config
+  data:
+    NODE_ENV: production
+    LOG_LEVEL: info
+    MYSQL_HOST: mysql.edu-system.svc.cluster.local
+    REDIS_HOST: redis.edu-system.svc.cluster.local
+    KAFKA_BROKERS: kafka.edu-system.svc.cluster.local:9092
+
+# 全局 Secret（仅骨架；生产请使用 External Secrets Operator 对接 Vault/KMS）
+secret:
+  enabled: true
+  name: edu-platform-secret
+  # 真实部署时通过 --set secret.data.MYSQL_PASSWORD=<base64> 注入
+  # 或通过 externalSecrets 引用
+  data:
+    MYSQL_PASSWORD: ""
+    JWT_SECRET: ""
+    REDIS_PASSWORD: ""
+
+# 全局 Ingress
+ingress:
+  enabled: true
+  className: nginx
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+  hosts:
+    - host: edu.example.com
+      paths:
+        - path: /api
+          pathType: Prefix
+          service: api-gateway
+          port: 8080
+        - path: /auth
+          pathType: Prefix
+          service: api-gateway
+          port: 8080
+  tls:
+    - secretName: edu-tls
+      hosts:
+        - edu.example.com
+
+# HPA 全局默认策略（各服务可在自身 chart 中覆盖）
+hpa:
+  enabled: true
+  minReplicas: 2
+  maxReplicas: 10
+  targetCPUUtilizationPercentage: 70
+  targetMemoryUtilizationPercentage: 80