环境策略：开发、测试、预发布、生产

# ============================================================
# 开发环境 Namespace 及其资源配额
# ============================================================
apiVersion: v1
kind: Namespace
metadata:
  name: dev
  labels:
    env: dev
    team: platform
    cost-center: "cc-dev-001"
 
---
# 开发环境资源配额：限制总资源消耗
apiVersion: v1
kind: ResourceQuota
metadata:
  name: dev-quota
  namespace: dev
spec:
  hard:
    # 计算资源限制
    requests.cpu: "8"
    requests.memory: 16Gi
    limits.cpu: "16"
    limits.memory: 32Gi
    # 对象数量限制
    pods: "30"
    services: "10"
    persistentvolumeclaims: "10"
    # 存储限制
    requests.storage: 50Gi
  scopes:
    - Terminating    # 限制会终止的 Pod
    - NotTerminating # 限制不会终止的 Pod
 
---
# 开发环境默认资源限制
apiVersion: v1
kind: LimitRange
metadata:
  name: dev-limits
  namespace: dev
spec:
  limits:
  - type: Container
    default:          # 默认 limit（未指定时使用）
      cpu: "500m"
      memory: "512Mi"
    defaultRequest:   # 默认 request（未指定时使用）
      cpu: "100m"
      memory: "128Mi"
    max:              # 最大允许值
      cpu: "2"
      memory: "2Gi"
    min:              # 最小允许值
      cpu: "50m"
      memory: "64Mi"
 
---
# ============================================================
# 测试环境 Namespace 及其资源配额
# ============================================================
apiVersion: v1
kind: Namespace
metadata:
  name: test
  labels:
    env: test
    team: platform
    cost-center: "cc-test-001"
 
---
apiVersion: v1
kind: ResourceQuota
metadata:
  name: test-quota
  namespace: test
spec:
  hard:
    requests.cpu: "16"
    requests.memory: 32Gi
    limits.cpu: "32"
    limits.memory: 64Gi
    pods: "50"
    services: "20"
    persistentvolumeclaims: "20"
    requests.storage: 100Gi
 
---
# ============================================================
# 预发布环境 Namespace 及其资源配额
# ============================================================
apiVersion: v1
kind: Namespace
metadata:
  name: staging
  labels:
    env: staging
    team: platform
    cost-center: "cc-staging-001"
 
---
apiVersion: v1
kind: ResourceQuota
metadata:
  name: staging-quota
  namespace: staging
spec:
  hard:
    requests.cpu: "32"
    requests.memory: 64Gi
    limits.cpu: "64"
    limits.memory: 128Gi
    pods: "100"
    services: "30"
    persistentvolumeclaims: "30"
    requests.storage: 200Gi
 
---
# ============================================================
# 环境间网络隔离策略
# ============================================================
# 开发环境：允许内部通信，禁止访问 staging/prod
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: dev-isolation
  namespace: dev
spec:
  podSelector: {}  # 应用于命名空间内所有 Pod
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          env: dev  # 只允许来自 dev 命名空间的入站流量
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          env: dev  # 只允许访问 dev 命名空间
  - to:             # 允许访问外部 DNS
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53
 
---
# 预发布环境：允许来自 test 的流量，禁止访问 prod
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: staging-isolation
  namespace: staging
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          env: staging
    - namespaceSelector:
        matchLabels:
          env: test  # 允许测试环境访问预发布环境
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          env: staging
  - to:
    - namespaceSelector:
        matchLabels:
          env: test
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53

#!/bin/bash
# ============================================================
# ephemeral-env.sh - 按需创建临时环境
# 用法: ./ephemeral-env.sh create <branch-name> <ttl-hours>
#       ./ephemeral-env.sh destroy <env-name>
#       ./ephemeral-env.sh list
# ============================================================
 
set -euo pipefail
 
CLUSTER="production-k8s"
BASE_DOMAIN="internal.example.com"
ENV_TEMPLATE_DIR="./env-templates"
 
# 创建临时环境
create_env() {
    local branch_name="$1"
    local ttl_hours="${2:-4}"  # 默认 4 小时后自动回收
    local env_name="pr-$(echo "$branch_name" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9]/-/g' | cut -c1-40)"
    local namespace="ephemeral-${env_name}"
 
    echo "=== 创建临时环境: ${namespace} ==="
    echo "分支: ${branch_name}"
    echo "TTL: ${ttl_hours} 小时"
 
    # 检查环境是否已存在
    if kubectl get namespace "$namespace" &>/dev/null; then
        echo "环境 ${namespace} 已存在，跳过创建"
        return 0
    fi
 
    # 创建 Namespace
    kubectl create namespace "$namespace"
 
    # 添加环境标签
    kubectl label namespace "$namespace" \
        env=ephemeral \
        branch="$branch_name" \
        ttl-hours="$ttl_hours" \
        created-at="$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
        created-by="$(whoami)"
 
    # 应用资源配额
    cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: ResourceQuota
metadata:
  name: ephemeral-quota
  namespace: ${namespace}
spec:
  hard:
    requests.cpu: "4"
    requests.memory: 8Gi
    limits.cpu: "8"
    limits.memory: 16Gi
    pods: "20"
    services: "5"
    persistentvolumeclaims: "5"
    requests.storage: 20Gi
EOF
 
    # 应用默认资源限制
    cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: LimitRange
metadata:
  name: ephemeral-limits
  namespace: ${namespace}
spec:
  limits:
  - type: Container
    default:
      cpu: "500m"
      memory: "512Mi"
    defaultRequest:
      cpu: "100m"
      memory: "128Mi"
    max:
      cpu: "1"
      memory: "1Gi"
EOF
 
    # 应用网络隔离策略
    cat <<EOF | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: ephemeral-isolation
  namespace: ${namespace}
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          env: ephemeral
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          env: ephemeral
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53
EOF
 
    # 部署应用（使用 Helm 或 kustomize）
    if [ -d "${ENV_TEMPLATE_DIR}/base" ]; then
        kubectl apply -k "${ENV_TEMPLATE_DIR}/base" -n "$namespace"
    fi
 
    # 设置 TTL 标签用于自动回收
    local expire_at
    expire_at=$(date -u -v+${ttl_hours}H +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || \
                date -u -d "+${ttl_hours} hours" +%Y-%m-%dT%H:%M:%SZ)
    kubectl label namespace "$namespace" expire-at="$expire_at" --overwrite
 
    echo ""
    echo "=== 临时环境创建完成 ==="
    echo "命名空间: ${namespace}"
    echo "访问地址: https://${env_name}.${BASE_DOMAIN}"
    echo "过期时间: ${expire_at}"
    echo ""
    echo "使用以下命令查看环境状态:"
    echo "  kubectl get all -n ${namespace}"
    echo ""
    echo "使用以下命令销毁环境:"
    echo "  ./ephemeral-env.sh destroy ${env_name}"
}
 
# 销毁临时环境
destroy_env() {
    local env_name="$1"
    local namespace="ephemeral-${env_name}"
 
    echo "=== 销毁临时环境: ${namespace} ==="
 
    if ! kubectl get namespace "$namespace" &>/dev/null; then
        echo "环境 ${namespace} 不存在"
        return 1
    fi
 
    # 删除 Namespace（级联删除所有资源）
    kubectl delete namespace "$namespace" --grace-period=30
 
    echo "临时环境 ${namespace} 已销毁"
}
 
# 列出所有临时环境
list_envs() {
    echo "=== 当前临时环境列表 ==="
    echo ""
    printf "%-40s %-20s %-10s %-25s\n" "NAMESPACE" "BRANCH" "TTL(h)" "EXPIRE-AT"
    echo "------------------------------------------------------------------------------------------------"
 
    kubectl get namespaces -l env=ephemeral -o json | \
        jq -r '.items[] | "\(.metadata.name)\t\(.metadata.labels.branch // "N/A")\t\(.metadata.labels.ttl-hours // "N/A")\t\(.metadata.labels.expire-at // "N/A")"' | \
        while IFS=$'\t' read -r ns branch ttl expire; do
            printf "%-40s %-20s %-10s %-25s\n" "$ns" "$branch" "$ttl" "$expire"
        done
}
 
# 主入口
case "${1:-}" in
    create)
        if [ -z "${2:-}" ]; then
            echo "用法: $0 create <branch-name> [ttl-hours]"
            exit 1
        fi
        create_env "$2" "${3:-4}"
        ;;
    destroy)
        if [ -z "${2:-}" ]; then
            echo "用法: $0 destroy <env-name>"
            exit 1
        fi
        destroy_env "$2"
        ;;
    list)
        list_envs
        ;;
    *)
        echo "用法: $0 {create|destroy|list}"
        echo "  create <branch-name> [ttl-hours]  - 创建临时环境"
        echo "  destroy <env-name>                - 销毁临时环境"
        echo "  list                              - 列出所有临时环境"
        exit 1
        ;;
esac

# ============================================================
# 临时环境自动回收 CronJob
# 每小时检查一次，删除已过期的临时环境
# ============================================================
apiVersion: batch/v1
kind: CronJob
metadata:
  name: ephemeral-env-cleaner
  namespace: kube-system
spec:
  schedule: "0 * * * *"  # 每小时执行一次
  concurrencyPolicy: Forbid
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: env-cleaner
          containers:
          - name: cleaner
            image: bitnami/kubectl:1.28
            command:
            - /bin/bash
            - -c
            - |
              #!/bin/bash
              set -euo pipefail
 
              NOW=$(date -u +%Y-%m-%dT%H:%M:%SZ)
              echo "=== 临时环境回收检查 - ${NOW} ==="
 
              # 获取所有临时环境
              EXPIRED_NS=$(kubectl get namespaces -l env=ephemeral -o json | \
                jq -r ".items[] | select(.metadata.labels.expire-at != null) | select(.metadata.labels.expire-at < \"${NOW}\") | .metadata.name")
 
              if [ -z "$EXPIRED_NS" ]; then
                echo "没有需要回收的临时环境"
                exit 0
              fi
 
              for ns in $EXPIRED_NS; do
                echo "回收过期环境: ${ns}"
                kubectl delete namespace "$ns" --grace-period=30
                echo "环境 ${ns} 已回收"
              done
          restartPolicy: OnFailure
---
# 清理器所需的 RBAC 权限
apiVersion: v1
kind: ServiceAccount
metadata:
  name: env-cleaner
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: env-cleaner
rules:
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["get", "list", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: env-cleaner
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: env-cleaner
subjects:
- kind: ServiceAccount
  name: env-cleaner
  namespace: kube-system

env-templates/
├── base/                    # 基础配置（所有环境共享）
│   ├── kustomization.yaml
│   ├── deployment.yaml
│   ├── service.yaml
│   └── configmap.yaml
├── overlays/
│   ├── dev/                 # 开发环境覆盖
│   │   ├── kustomization.yaml
│   │   └── patches/
│   │       └── resource-limits.yaml
│   ├── test/                # 测试环境覆盖
│   │   ├── kustomization.yaml
│   │   └── patches/
│   │       └── resource-limits.yaml
│   ├── staging/             # 预发布环境覆盖
│   │   ├── kustomization.yaml
│   │   └── patches/
│   │       └── resource-limits.yaml
│   └── production/          # 生产环境覆盖
│       ├── kustomization.yaml
│       └── patches/
│           ├── resource-limits.yaml
│           └── replicas.yaml