弹力设计篇之"隔离设计" - [2026重制版]

# namespace-tenant-a.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: tenant-a
  labels:
    purpose: production
    tenant: premium  # 高价值客户
---
# resource-quota-tenant-a.yaml
apiVersion: v1
kind: ResourceQuota
metadata:
  name: compute-quota
  namespace: tenant-a
spec:
  hard:
    requests.cpu: "20"
    requests.memory: 40Gi
    limits.cpu: "40"
    limits.memory: 80Gi
    persistentvolumeclaims: "10"
    pods: "50"
    services: "20"
    secrets: "100"
    configmaps: "100"
---
# limit-range-tenant-a.yaml
apiVersion: v1
kind: LimitRange
metadata:
  name: limit-range
  namespace: tenant-a
spec:
  limits:
  - default:  # 默认Limit
      cpu: 500m
      memory: 512Mi
    defaultRequest:  # 默认Request
      cpu: 100m
      memory: 128Mi
    max:  # 最大限制
      cpu: "2"
      memory: 2Gi
    min:  # 最小保证
      cpu: 50m
      memory: 64Mi
    type: Container
---
# network-policy-tenant-a.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress
  namespace: tenant-a
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress: []  # 默认拒绝所有入站流量
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-same-namespace
  namespace: tenant-a
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector: {}  # 允许同一Namespace内的Pod通信

# priority-class.yaml
apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
  name: high-priority
value: 1000000
globalDefault: false
description: "高优先级类 - 用于核心业务"
preemptionPolicy: PreemptLowerPriority
---
apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
  name: medium-priority
value: 100000
globalDefault: true
description: "中优先级类 - 用于普通业务"
---
apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
  name: low-priority
value: 1000
globalDefault: false
description: "低优先级类 - 用于批处理任务"
preemptionPolicy: Never  # 不抢占其他Pod
---
# 使用示例
apiVersion: apps/v1
kind: Deployment
metadata:
  name: payment-service-critical
spec:
  template:
    metadata:
      labels:
        app: payment-service
    spec:
      priorityClassName: high-priority  # 使用高优先级
      containers:
      - name: payment
        image: payment-service:v2.0
        resources:
          requests:
            cpu: 500m
            memory: 512Mi
          limits:
            cpu: "2"
            memory: 2Gi

apiVersion: apps/v1
kind: Deployment
metadata:
  name: order-service
spec:
  replicas: 6
  template:
    spec:
      topologySpreadConstraints:
      - maxSkew: 1  # 最大不均衡度为1
        topologyKey: kubernetes.io/hostname  # 按节点分布
        whenUnsatisfiable: DoNotSchedule  # 不满足时不调度
        labelSelector:
          matchLabels:
            app: order-service
      - maxSkew: 1
        topologyKey: topology.kubernetes.io/zone  # 按可用区分布
        whenUnsatisfiable: ScheduleAnyway  # 尽力而为
        labelSelector:
          matchLabels:
            app: order-service
      containers:
      - name: order
        image: order-service:v1.0

# istio-destination-rule-bulkhead.yaml
# 目标规则：定义连接池和异常检测
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: inventory-service-bulkhead
  namespace: production
spec:
  host: inventory-service
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100       # TCP最大连接数
        connectTimeout: 2s        # 连接超时
        tcpKeepalive:
          time: 7200s            # Keepalive间隔
          interval: 75s
      http:
        http1MaxPendingRequests: 50   # HTTP1最大等待请求数
        http2MaxRequests: 1000        # HTTP2最大并发请求数
        idleTimeout: 300s             # 空闲超时
        requestTimeout: 10s           # 请求超时
        maxRequestsPerConnection: 10  # 每连接最大请求数
    outlierDetection:  # 异常实例检测（自动隔离故障实例）
      consecutive5xxErrors: 5         # 连续5个5xx错误
      interval: 30s                   # 检测间隔
      baseEjectionTime: 30s           # 基础驱逐时间
      maxEjectionPercent: 50          # 最大驱逐比例50%
      minHealthPercent: 50            # 最小健康实例比例50%
      consecutiveGatewayErrors: 5     # 连续网关错误数
      consecutiveLocalOriginFailure: 5 # 本地连续失败数
---
# istio-sidecar-resource.yaml
# Sidecar资源配置（控制Sidecar的资源使用）
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
  name: default
  namespace: production
spec:
  resources:
    requests:
      cpu: 100m
      memory: 128Mi
    limits:
      cpu: 200m
      memory: 256Mi
  workloadSelector:
    labels:
      app: payment-service
---
# istio-authorization-policy.yaml
# 授权策略：服务间访问控制
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-payment-to-inventory
  namespace: production
spec:
  selector:
    matchLabels:
      app: inventory-service
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/production/sa/payment-service-account"]
    to:
    - operation:
        methods: ["GET", "POST"]
        paths: ["/api/inventory/*"]

// Java代码示例：信号量隔离
@Service
public class InventoryService {

    private final BulkheadRegistry bulkheadRegistry;

    public InventoryService(BulkheadRegistry bulkheadRegistry) {
        this.bulkheadRegistry = bulkheadRegistry;
    }

    /**
     * 使用注解方式的信号量隔离
     * maxConcurrentCalls: 最大并发数
     * maxWaitDuration: 最大等待时间
     */
    @Bulkhead(name = "inventoryBackend", type = Bulkhead.Type.SEMAPHORE,
              fallbackMethod = "fallbackCheckInventory")
    public InventoryResult checkInventory(String productId) {
        // 调用库存后端服务
        return inventoryClient.checkStock(productId);
    }

    /**
     * 降级方法
     */
    public InventoryResult fallbackCheckInventory(String productId,
                                                  BulkheadFullException ex) {
        log.warn("Inventory service bulkhead full for product: {}", productId);
        // 返回缓存数据或默认值
        return InventoryResult.fromCache(productId);
    }
}

resilience4j:
  bulkhead:
    instances:
      inventoryBackend:
        maxConcurrentCalls: 10        # 最大并发调用量
        maxWaitDuration: 0            # 0表示不等待，直接拒绝
        # maxWaitDuration: 100ms      # 或者设置等待时间
        writableStackTraceEnabled: false  # 生产环境关闭堆栈跟踪以提升性能

/**
 * 线程池隔离示例
 * 适用场景：I/O密集型操作、可能阻塞的操作
 */
@Service
public class PaymentService {

    /**
     * 使用线程池隔离
     */
    @Bulkhead(name = "paymentProcessing", type = Bulkhead.Type.THREADPOOL,
              fallbackMethod = "fallbackProcessPayment")
    public CompletableFuture<PaymentResult> processPayment(PaymentRequest request) {
        // 这个操作会在独立的线程池中执行
        // 不会占用主线程池的资源
        return CompletableFuture.supplyAsync(() -> {
            return paymentGateway.charge(request);
        });
    }

    public CompletableFuture<PaymentResult> fallbackProcessPayment(
            PaymentRequest request, BulkheadFullException ex) {

        log.error("Payment processing thread pool exhausted");
        return CompletableFuture.completedFuture(
            PaymentResult.rejected("System busy, please try later")
        );
    }
}

resilience4j:
  bulkhead:
    instances:
      paymentProcessing:
        maxConcurrentCalls: 20         # 线程池最大线程数
        maxWaitDuration: 100ms         # 最大等待时间
        keepAliveDuration: 20ms        # 空闲线程存活时间

# multi-tenant-architecture.yaml
# Kubernetes命名空间级别的租户隔离
apiVersion: v1
kind: Namespace
metadata:
  name: tenant-enterprise
  labels:
    tier: enterprise
    isolation-level: high
---
# 企业级租户：完全独立资源
apiVersion: v1
kind: ResourceQuota
metadata:
  name: enterprise-quota
  namespace: tenant-enterprise
spec:
  hard:
    requests.cpu: "50"
    requests.memory: 100Gi
    limits.cpu: "100"
    limits.memory: 200Gi
    pods: "200"
    persistentvolumeclaims: "50"
---
apiVersion: v1
kind: Namespace
  name: tenant-standard
  labels:
    tier: standard
    isolation-level: medium
---
# 标准级租户：共享计算，独立存储
apiVersion: v1
kind: ResourceQuota
metadata:
  name: standard-quota
  namespace: tenant-standard
spec:
  hard:
    requests.cpu: "5"
    requests.memory: 10Gi
    limits.cpu: "20"
    limits.memory: 40Gi
    pods: "50"
---
# 数据库层面：Schema隔离
-- SQL示例
-- 为每个租户创建独立的Schema
CREATE SCHEMA IF NOT EXISTS tenant_enterprise_001;
CREATE SCHEMA IF NOT EXISTS tenant_standard_001;

-- 在应用层通过TenantContext动态切换Schema
-- Spring Boot + MyBatis示例
@Interceptor({TenantInterceptor.class})
public class TenantInterceptor implements Interceptor {

    @Override
    public Object intercept(Invocation invocation) throws Throwable {
        String tenantId = TenantContextHolder.getTenantId();
        if (tenantId != null) {
            StatementHandler handler = (StatementHandler) invocation.getTarget();
            MetaObject metaObject = SystemMetaObject.forObject(handler);
            BoundSql boundSql = handler.getBoundSql();
            String sql = boundSql.getSql();

            // 动态替换Schema
            sql = sql.replace("public.", tenantId + ".");
            Field field = boundSql.getClass().getDeclaredField("sql");
            field.setAccessible(true);
            field.set(boundSql, sql);
        }
        return invocation.proceed();
    }
}

# premium-tenant-config.yaml
# Premium租户：独立Namespace + 专属资源
apiVersion: v1
kind: Namespace
metadata:
  name: tenant-premium-001
  labels:
    tenant-tier: premium
    sla-guarantee: "99.99"
---
apiVersion: v1
kind: ResourceQuota
metadata:
  name: premium-resources
  namespace: tenant-premium-001
spec:
  hard:
    cpu: "20"
    memory: 40Gi
    pods: "50"
    services.loadbalancers: "2"
---
# Standard租户：共享资源 + 配额限制
apiVersion: v1
kind: ResourceQuota
metadata:
  name: standard-resources
  namespace: default
spec:
  hard:
    cpu: "100"
    memory: 200Gi
    pods: "500"
  scopeSelector:
    matchExpression:
      scopeName: Tier
      operator: In
      values: ["standard"]

# gvisor-runtimeclass.yaml
apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
  name: gvisor
handler: runsc
---
# 使用gVisor运行不可信的工作负载
apiVersion: batch/v1
kind: Job
metadata:
  name: untrusted-job
  namespace: sandbox
spec:
  template:
    spec:
      runtimeClassName: gvisor  # 使用gVisor运行时
      containers:
      - name: untrusted-workload
        image: user-code:v1.0
        resources:
          limits:
            cpu: "1"
            memory: 1Gi
        securityContext:
          readOnlyRootFilesystem: true
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
      restartPolicy: Never

# cilium-network-policy.yaml
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: tenant-isolation
  namespace: production
specs:
  - endpointSelector:
      matchLabels:
        app: payment-service
    ingress:
    - fromEndpoints:
      - matchLabels:
          tenant: enterprise-001
      toPorts:
      - ports:
        - port: "8080"
          protocol: TCP
        rules:
          http:
            method: "POST"
            path: "/api/pay/*"
    egress:
    - toEndpoints:
      - matchLabels:
          app: database
      toPorts:
      - ports:
        - port: "5432"
          protocol: TCP