程序员练级攻略：容器化和自动化运维-[2026重制版]

# ========== 多阶段构建（推荐）==========
# Stage 1: 构建
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

# Stage 2: 运行（最小镜像）
FROM node:20-alpine AS runtime
WORKDIR /app
RUN addgroup -g 1001 appgroup && \
    adduser -u 1001 -G appgroup -s /bin/sh -d/app appuser
COPY --from=builder /app/node_modules ./node_modules
COPY --chown=appuser:appgroup . .
USER appuser
EXPOSE 3000
CMD ["node", "server.js"]

# api-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-server
  labels:
    app: api
spec:
  replicas: 3  # 副本数
  selector:
    matchLabels:
      app: api
  template:
    metadata:
      labels:
        app: api
    spec:
      containers:
      - name: api
        image: registry.example.com/api:v1.2.0
        ports:
        - containerPort: 8080
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8080
          initialDelaySeconds: 15
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /ready
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 5
        env:
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: url
---
apiVersion: v1
kind: Service
metadata:
  name: api-service
spec:
  selector:
    app: api
  ports:
  - protocol: TCP
    port: 80
    targetPort: 8080
  type: ClusterIP

my-app/
├── Chart.yaml           # Chart元信息
├── values.yaml          # 默认值
├── charts/              # 依赖的子Chart
│   └── postgresql/
├── templates/           # YAML模板
│   ├── deployment.yaml
│   ├── service.yaml
│   ├── ingress.yaml
│   ├── configmap.yaml
│   ├── _helpers.tpl     # 公共模板函数
│   └── NOTES.txt        # 安装后提示信息
└── README.md

# 安装 Helm Chart
helm install my-app ./my-chart \
  --namespace production \
  --set image.tag=v1.3.0 \
  --set replicaCount=5 \
  -f values-prod.yaml

# 升级（无缝滚动）
helm upgrade my-app ./my-chart \
  --set image.tag=v1.4.0

# 回滚到上一版本
helm rollback my-app 1

# 查看历史版本
helm history my-app

# main.tf - 创建 VPC + EKS 集群
provider "aws" {
  region = "ap-northeast-1"
}

# VPC
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true
  
  tags = {
    Environment = "production"
    ManagedBy   = "terraform"
  }
}

# EKS Cluster
resource "aws_eks_cluster" "main" {
  name     = "production-cluster"
  role_arn = aws_iam_role.cluster.arn
  version  = "1.31"

  vpc_config {
    subnet_ids = aws_subnet.private[*].id
  }

  depends_on = [
    aws_iam_role_policy_attachment.cluster_AmazonEKSClusterPolicy
  ]
}

# 输出
output "cluster_endpoint" {
  value = aws_eks_cluster.main.endpoint
}

# argocd-application.yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: production-apps
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/org/infra-repo.git
    targetRevision: HEAD
    path: k8s/overlays/production
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true       # 自动删除Git中没有的资源
      selfHeal: true     # 自动修复漂移
    syncOptions:
    - CreateNamespace=true
    - PrunePropagationPolicy=foreground

# CPU使用率 > 80%
rate(container_cpu_usage_seconds_total{container!="POD"}[5m]) * 100 > 80

# 内存使用率
container_memory_working_set_bytes{container!="POD"} 
  / container_spec_memory_limit_bytes{container!="POD"} * 100 > 85

# HTTP错误率 (5xx)
sum(rate(http_requests_total{status=~"5.."}[5m])) 
  / sum(rate(http_requests_total[5m])) * 100 > 1

# P99延迟直方图
histogram_quantile(0.99, 
  rate(http_request_duration_seconds_bucket[5m])
)