微服务如何实现DevOps

# Tekton 1.x — 微服务 CI Pipeline
apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: microservice-ci
spec:
  params:
    - name: repo-url
    - name: image-name
    - name: image-tag
  workspaces:
    - name: shared-workspace
  tasks:
    - name: checkout
      taskRef:
        name: git-clone
      params:
        - name: url
          value: $(params.repo-url)
        - name: revision
          value: main
      workspaces:
        - name: output
          workspace: shared-workspace

    - name: lint
      taskRef:
        name: golangci-lint
      runAfter:
        - checkout
      params:
        - name: args
          value: ["run", "--timeout=5m"]

    - name: unit-test
      taskRef:
        name: go-test
      runAfter:
        - lint
      params:
        - name: args
          value: ["-race", "-coverprofile=coverage.out"]

    - name: build-image
      taskRef:
        name: kaniko
      runAfter:
        - unit-test
      params:
        - name: IMAGE
          value: $(params.image-name):$(params.image-tag)
        - name: DOCKERFILE
          value: ./Dockerfile
      workspaces:
        - name: source
          workspace: shared-workspace

    - name: trivy-scan
      taskRef:
        name: trivy-scanner
      runAfter:
        - build-image
      params:
        - name: image
          value: $(params.image-name):$(params.image-tag)

    - name: sign-image
      taskRef:
        name: cosign-sign
      runAfter:
        - trivy-scan
      params:
        - name: image
          value: $(params.image-name):$(params.image-tag)

# Argo Rollouts 1.7+ — 金丝雀发布
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: user-service
spec:
  replicas: 20
  selector:
    matchLabels:
      app: user-service
  template:
    spec:
      containers:
        - name: user-service
          image: registry.example.com/user-service:v2.1.0
  strategy:
    canary:
      canaryService: user-service-canary
      stableService: user-service-stable
      trafficRouting:
        istio:
          virtualService:
            name: user-service
            routes:
              - primary
      steps:
        - setWeight: 5
        - pause: {duration: 2m}
        - analysis:
            templates:
              - templateName: success-rate
                clusterScope: true
            args:
              - name: service-name
                value: user-service-canary
        - setWeight: 25
        - pause: {duration: 5m}
        - analysis:
            templateName: latency-p95
        - setWeight: 50
        - pause: {duration: 5m}
        - setWeight: 100

---
# AnalysisTemplate — 金丝雀分析指标
apiVersion: argoproj.io/v1alpha1
kind: AnalysisTemplate
metadata:
  name: success-rate
spec:
  args:
    - name: service-name
  metrics:
    - name: success-rate
      initialDelay: 30s
      interval: 10s
      failureLimit: 3
      successCondition: result[0] >= 0.99
      provider:
        prometheus:
          address: http://prometheus.monitoring:9090
          query: |
            sum(rate(
              istio_requests_total{
                destination_service=~"{{args.service-name}}.*",
                response_code!~"5.."
              }[2m]
            )) / sum(rate(
              istio_requests_total{
                destination_service=~"{{args.service-name}}.*"
              }[2m]
            ))
    - name: latency-p95
      initialDelay: 30s
      interval: 10s
      failureLimit: 3
      successCondition: result[0] < 500
      provider:
        prometheus:
          address: http://prometheus.monitoring:9090
          query: |
            histogram_quantile(0.95,
              sum(rate(
                istio_request_duration_milliseconds_bucket{
                  destination_service=~"{{args.service-name}}.*"
                }[2m]
              )) by (le)
            )

# ArgoCD ApplicationSet — 每个 PR 自动创建预览环境
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: preview-environments
spec:
  generators:
    - pullRequest:
        github:
          owner: my-org
          repo: user-service
          tokenRef:
            secretName: github-token
            key: token
  template:
    metadata:
      name: "pr-{{number}}-user-service"
      labels:
        env: preview
    spec:
      project: default
      source:
        repoURL: https://github.com/my-org/user-service
        targetRevision: "PR-{{number}}"
        path: k8s/overlays/preview
      destination:
        server: https://kubernetes.default.svc
        namespace: preview-pr-{{number}}
      syncPolicy:
        automated:
          prune: true
          selfHeal: true
        syncOptions:
          - CreateNamespace=true