管理设计篇之"配置中心" [2026重制版]

┌─────────────────────────────────────────────────────────────┐
│                      应用程序 (Code)                         │
│              不包含任何运行时配置信息                          │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│                     配置 (Config)                            │
│  ┌───────────┬───────────┬───────────┬───────────────────┐   │
│  │ 静态配置   │ 动态配置   │ 敏感配置   │   特征开关         │   │
│  │ 端口/线程池│ 日志级别   │ 密码/Token│  Feature Flag     │   │
│  │ 启动参数   │ 限流阈值   │ 证书/Key  │  灰度/A-B Test    │   │
│  └───────────┴───────────┴───────────┴───────────────────┘   │
└─────────────────────────────────────────────────────────────┘

# docker-compose-apollo.yml
version: '3.8'

services:
  apollo-configdb:
    image: mysql:8.0
    container_name: apollo-configdb
    environment:
      TZ: Asia/Shanghai
      MYSQL_ROOT_PASSWORD: root
    ports:
      - "13306:3306"
    volumes:
      - ./sql:/docker-entrypoint-initdb.d
    command: --character-set-server=utf8mb4 --collation-server=utf8mb4_bin

  apollo-portal:
    image: apolloconfig/apollo-portal:2.1.0
    container_name: apollo-portal
    depends_on:
      - apollo-configdb
    ports:
      - "8070:8070"
    environment:
      APOLLO_PORTAL_ENVS: dev
      APOLLO_PORTAL_METASERVERS: http://apollo-configservice:8080

  apollo-configservice:
    image: apolloconfig/apollo-configservice:2.1.0
    container_name: apollo-configservice
    depends_on:
      - apollo-configdb
    ports:
      - "8080:8080"
    environment:
      APOLLO_SERVICE_NAME: apollo-configservice
      SERVER_PORT: 8080
      DS_SERVER: apollo-configdb:3306
      DS_USER_NAME: root
      DS_PASSWORD: root

  apollo-adminservice:
    image: apolloconfig/apollo-adminservice:2.1.0
    container_name: apollo-adminservice
    depends_on:
      - apollo-configdb
      - apollo-configservice
    ports:
      - "8090:8090"
    environment:
      APOLLO_SERVICE_NAME: apollo-adminservice
      SERVER_PORT: 8090
      DS_SERVER: apollo-configdb:3306
      DS_USER_NAME: root
      DS_PASSWORD: root

<dependency>
    <groupId>com.ctrip.framework.apollo</groupId>
    <artifactId>apollo-client</artifactId>
    <version>2.2.0</version>
</dependency>

<!-- Spring Boot Starter -->
<dependency>
    <groupId>com.ctrip.framework.apollo</groupId>
    <artifactId>apollo-bootstrap-spring-boot-starter</artifactId>
    <version>2.2.0</version>
</dependency>

# Apollo 配置
app:
  id: my-application          # 应用ID（与Apollo中一致）
apollo:
  bootstrap:
    enabled: true
    namespaces: application,redis-config,database-config  # 加载的命名空间
    eagerLoad:
      enabled: true  # 启动时预加载配置
  meta: http://localhost:8080  # Config Service 地址
  cache-dir: ./apollo-cache     # 本地缓存目录
  cluster: default              # 集群名称

@RestController
@RequestMapping("/api/demo")
public class DemoController {

    // 方式一：使用 @Value 注解
    @Value("${server.port:8080}")
    private int serverPort;

    // 方式二：使用 Apollo 注解（支持自动刷新）
    @ApolloConfig
    private Config config;

    // 方式三：监听配置变更
    @ApolloConfigChangeListener({"application", "redis-config"})
    private void onChange(ConfigChangeEvent event) {
        for (String key : event.changedKeys()) {
            ConfigChange change = event.getChange(key);
            log.info("配置变更 - Key: {}, Old: {}, New: {}, Type: {}",
                    key, change.getOldValue(), change.getNewValue(), change.getChangeType());
        }
    }

    @GetMapping("/config")
    public Map<String, String> getConfig() {
        Map<String, String> result = new HashMap<>();
        result.put("serverPort", String.valueOf(serverPort));
        result.put("redisHost", config.getProperty("redis.host", "localhost"));
        result.put("redisPort", config.getProperty("redis.port", "6379"));
        return result;
    }

    // 动态调整日志级别（通过配置中心）
    @PostMapping("/log-level")
    public String setLogLevel(@RequestParam String level) {
        LoggerContext loggerContext = (LoggerContext) LoggerFactory.getILoggerFactory();
        loggerContext.getLogger("root").setLevel(Level.valueOf(level));
        return "日志级别已设置为: " + level;
    }
}

# 单机模式启动 Nacos 2.3.0
docker run -d \
  --name nacos-server \
  -e MODE=standalone \
  -e SPRING_DATASOURCE_PLATFORM=mysql \
  -e MYSQL_SERVICE_HOST=192.168.1.100 \
  -e MYSQL_SERVICE_PORT=3306 \
  -e MYSQL_SERVICE_DB_NAME=nacos_config \
  -e MYSQL_SERVICE_USER=root \
  -e MYSQL_SERVICE_PASSWORD=your_password \
  -p 8848:8848 \
  -p 9848:9848 \
  nacos/nacos-server:v2.3.0

// Nacos 配置类
@Configuration
@RefreshScope  // 支持配置动态刷新
public class NacosConfig {

    @Value("${nacos.config.timeout:3000}")
    private int timeout;

    @Bean
    public RestTemplate restTemplate() {
        SimpleClientHttpRequestFactory factory = new SimpleClientHttpRequestFactory();
        factory.setConnectTimeout(timeout);
        factory.setReadTimeout(timeout);
        return new RestTemplate(factory);
    }
}

# bootstrap.yml
spring:
  cloud:
    nacos:
      discovery:
        server-addr: localhost:8848
        namespace: prod
        group: DEFAULT_GROUP
      config:
        server-addr: localhost:8848
        namespace: prod
        group: DEFAULT_GROUP
        file-extension: yaml
        shared-configs:
          - data-id: common.yaml
            group: COMMON_GROUP
            refresh: true

# 写入配置
consul kv put config/my-app/database/host localhost
consul kv put config/my-app/database/port 3306
consul kv put config/my-app/database/password secret123

# 读取配置
consul kv get config/my-app/database/host

# 监听配置变化
consul watch -type=key -key=config/my-app/database "echo 'Config changed!'"

# config.ctmpl
{{ with consulKV "config/my-app/database" }}
database {
  host = "{{ .Value.host }}"
  port = {{ .Value.port }}
  password = "{{ .Value.password }}"
}
{{ end }}

# 运行 Consul Template
consul-template \
  -template "/etc/templates/config.ctmpl:/etc/app/config.yml" \
  -retry 30s \
  -once=false

# 安装 ArgoCD 到 Kubernetes
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# 获取初始密码
kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d

# app-config.yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app-config
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/org/app-config.git
    targetRevision: main
    path: configs/prod
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
      allowEmpty: false
    syncOptions:
      - CreateNamespace=true
      - PruneLast=true

# kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: production

configMapGenerator:
  - name: app-config
    files:
      - application.yml
    options:
      labels:
        app.kubernetes.io/name: my-app

secretGenerator:
  - name: db-credentials
    type: Opaque
    literals:
      - username=admin
      - password=${DB_PASSWORD}  # 从 SealedSecret 或外部密钥管理获取

# 安装 Flux CLI
curl -s https://fluxcd.io/install.sh | sudo bash

# Bootstrap GitOps 仓库
flux bootstrap github \
  --owner=my-org \
  --repository=app-infra \
  --path=clusters/my-cluster \
  --personal=true

# 推荐的命名空间设计
AppID: order-service

Namespaces:
  ├── application           # 公共配置（线程池、超时时间）
  ├── datasource.{env}      # 数据库连接配置
  ├── redis.{env}           # Redis 缓存配置
  ├── mq.{env}              # 消息队列配置
  ├── feature-flag.{env}    # 特征开关
  └── business.{env}        # 业务相关配置

# 配置项命名规范
{组件}.{模块}.{属性}.{环境}
例：
spring.datasource.prod.url
thread.pool.core.size
feature.flag.new-checkout.enabled
cache.redis.ttl.seconds

# Vault 配置（vault-server.hcl）
storage "file" {
  path = "./vault/data"
}

listener "tcp" {
  address     = "0.0.0.0:8200"
 tls_disable = true
}

ui = true
disable_mlock = true

# 启用 KV 引擎
vault secrets enable -path=secret kv-v2

# 存储数据库密码
vault kv put secret/db-credentials username="admin" password="SuperSecret123"

# 创建 AppRole 认证策略
vault policy write app-policy - <<EOF
path "secret/data/db-credentials" {
  capabilities = ["read"]
}
EOF