feat(infra): k8s Helm Chart 演化与备份脚本测试

- 新增 edu-platform 平台级 chart(namespace/configmap/secret/ingress/hpa)
- 新增 api-gateway 服务级 chart(完整迁移自原 manifest)
- 新增 6 个业务服务 chart 桩(iam/core-edu/content/msg/data-ana/ai)
- 删除原 api-gateway-deployment.yaml(已迁移至 helm chart)
- 更新 infra/k8s/README.md 为 Helm Chart 管理说明
- 新增 backup-mysql.sh dry-run 测试脚本(17 断言)
This commit is contained in:
SpecialX
2026-07-08 12:50:56 +08:00
parent 9b33303195
commit d831915f06
51 changed files with 2111 additions and 165 deletions

View File

@@ -0,0 +1,72 @@
# Edu 平台全局默认值
# 环境覆盖文件values-dev.yaml / values-staging.yaml / values-prod.yaml
# 全局标签(自动注入到所有资源)
global:
labels:
app.kubernetes.io/part-of: edu-platform
# 镜像拉取凭证(生产建议使用 Secret + serviceAccount
imagePullSecrets: []
# 命名空间规划
namespaces:
- name: edu-system
component: system
- name: edu-services
component: services
- name: edu-monitoring
component: monitoring
- name: edu-ingress
component: ingress
# 全局 ConfigMap非敏感配置
configMap:
enabled: true
name: edu-platform-config
data:
NODE_ENV: production
LOG_LEVEL: info
MYSQL_HOST: mysql.edu-system.svc.cluster.local
REDIS_HOST: redis.edu-system.svc.cluster.local
KAFKA_BROKERS: kafka.edu-system.svc.cluster.local:9092
# 全局 Secret仅骨架生产请使用 External Secrets Operator 对接 Vault/KMS
secret:
enabled: true
name: edu-platform-secret
# 真实部署时通过 --set secret.data.MYSQL_PASSWORD=<base64> 注入
# 或通过 externalSecrets 引用
data:
MYSQL_PASSWORD: ""
JWT_SECRET: ""
REDIS_PASSWORD: ""
# 全局 Ingress
ingress:
enabled: true
className: nginx
annotations:
nginx.ingress.kubernetes.io/ssl-redirect: "true"
hosts:
- host: edu.example.com
paths:
- path: /api
pathType: Prefix
service: api-gateway
port: 8080
- path: /auth
pathType: Prefix
service: api-gateway
port: 8080
tls:
- secretName: edu-tls
hosts:
- edu.example.com
# HPA 全局默认策略(各服务可在自身 chart 中覆盖)
hpa:
enabled: true
minReplicas: 2
maxReplicas: 10
targetCPUUtilizationPercentage: 70
targetMemoryUtilizationPercentage: 80