环境隔离与资源配额

# team-a Namespace 的资源配额
apiVersion: v1
kind: ResourceQuota
metadata:
  name: team-a-quota
  namespace: team-a
spec:
  hard:
    # 计算资源
    requests.cpu: "32"
    requests.memory: "64Gi"
    limits.cpu: "48"
    limits.memory: "96Gi"
 
    # 对象数量
    count/pods: "100"
    count/services: "50"
    count/deployments: "30"
    count/replicasets: "60"
    count/statefulsets: "10"
    count/jobs: "20"
 
    # 存储
    requests.storage: "500Gi"
    persistentvolumeclaims: "20"
 
    # 网络与安全
    count/ingresses: "10"
    count/secrets: "50"
    count/configmaps: "100"
---
# LimitRange: 定义 Pod 的资源范围
apiVersion: v1
kind: LimitRange
metadata:
  name: team-a-limits
  namespace: team-a
spec:
  limits:
    - type: Container
      default:
        cpu: "500m"
        memory: "512Mi"
      defaultRequest:
        cpu: "100m"
        memory: "128Mi"
      max:
        cpu: "4"
        memory: "8Gi"
      min:
        cpu: "50m"
        memory: "64Mi"
    - type: Pod
      max:
        cpu: "8"
        memory: "16Gi"

# team-a 的网络隔离策略
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: team-a-isolation
  namespace: team-a
spec:
  podSelector: {}    # 应用到 Namespace 内所有 Pod
  policyTypes:
    - Ingress
    - Egress
  ingress:
    # 允许同 Namespace 内的通信
    - from:
        - namespaceSelector:
            matchLabels:
              name: team-a
    # 允许 platform Namespace 的通信（Ingress、监控等）
    - from:
        - namespaceSelector:
            matchLabels:
              name: platform
    # 允许集群内 DNS 解析
    - from:
        - namespaceSelector:
            matchLabels:
              name: kube-system
        ports:
          - port: 53
            protocol: UDP
  egress:
    # 允许同 Namespace 内的通信
    - to:
        - namespaceSelector:
            matchLabels:
              name: team-a
    # 允许访问 platform Namespace
    - to:
        - namespaceSelector:
            matchLabels:
              name: platform
    # 允许 DNS 解析
    - to:
        - namespaceSelector:
            matchLabels:
              name: kube-system
        ports:
          - port: 53
            protocol: UDP
    # 允许访问外部服务（数据库、第三方 API）
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 10.0.0.0/8      # 阻止访问其他 Namespace 的 Pod IP

# vcluster 部署配置
apiVersion: vcluster.example.com/v1
kind: VirtualCluster
metadata:
  name: compliance-env
  namespace: vcluster-system
spec:
  # 虚拟集群的控制平面资源
  apiServer:
    replicas: 1
    resources:
      requests:
        cpu: "500m"
        memory: "512Mi"
  controllerManager:
    replicas: 1
    resources:
      requests:
        cpu: "250m"
        memory: "256Mi"
  etcd:
    replicas: 1
    resources:
      requests:
        cpu: "500m"
        memory: "1Gi"
    storage:
      size: "5Gi"
 
  # 虚拟集群的配额限制
  limits:
    namespaces: 50
    pods: 200
    services: 100
 
  # 网络模式
  networking:
    mode: host    # 使用宿主集群的网络
 
  # 同步策略：哪些资源从虚拟集群同步到宿主集群
  sync:
    pods: enabled
    services: enabled
    ingresses: enabled
    configmaps: enabled
    secrets: enabled
    persistentvolumeclaims: enabled

# Kubecost 部署配置（Helm Values）
kubecost:
  # 成本归集标签
  productConfigs:
    labelMapping:
      # 将团队标签映射为成本归属维度
      team: "app.kubernetes.io/team"
      service: "app.kubernetes.io/name"
      environment: "app.kubernetes.io/environment"
      cost-center: "cost-center"
 
  # 云服务定价配置（AWS 示例）
  aws:
    spotLabel: "k8s-spot"
    spotLabelValue: "true"
 
  # 告警配置：预算超限告警
  alerts:
    enabled: true
    config:
      - name: Team Budget Alert
        type: budget
        threshold: 5000       # 月预算 $5000
        window: monthly
        ownerLabel: team
        ownerLabelValues:
          - team-a
          - team-b
        slackWebhookUrl: "${SLACK_WEBHOOK_URL}"
 
      - name: Spend Rate Alert
        type: spendRate
        threshold: 20         # 每小时超过 $20 告警
        window: hourly

# Namespace 规范示例
apiVersion: v1
kind: Namespace
metadata:
  name: team-a-staging
  labels:
    name: team-a-staging
    team: team-a
    environment: staging
    cost-center: "CC-001"
  annotations:
    owner: "team-a@example.com"
    purpose: "team-a staging environment for feature validation"

# KEDA 事件驱动伸缩示例
apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
  name: orders-service-scaler
  namespace: team-a
spec:
  scaleTargetRef:
    name: orders-service
  minReplicaCount: 2
  maxReplicaCount: 20
  cooldownPeriod: 60
  triggers:
    - type: prometheus
      metadata:
        serverAddress: http://prometheus.monitoring:9090
        metricName: http_requests_per_second
        threshold: "100"
        query: "sum(rate(http_requests_total{service='orders-service'}[2m]))"