环境自描述与可观测性

# 标准标签体系
metadata:
  labels:
    # 身份标签
    app.kubernetes.io/name: orders-service
    app.kubernetes.io/version: "2.3.1"
    app.kubernetes.io/component: api
    app.kubernetes.io/part-of: ecommerce-platform

    # 归属标签
    app.kubernetes.io/team: team-a
    app.kubernetes.io/managed-by: argocd

    # 环境标签
    environment: staging
    cost-center: "CC-001"

    # 可观测性标签
    observability.enabled: "true"
    tracing.sampling-rate: "0.1"

# catalog-info.yaml
apiVersion: backstage.io/v1alpha1
kind: Component
metadata:
  name: orders-service
  description: 订单管理微服务，处理订单创建、查询和状态流转
  annotations:
    # Kubernetes 集成
    backstage.io/kubernetes-id: orders-service
    backstage.io/kubernetes-namespace: team-a

    # ArgoCD 集成
    argocd/app-name: orders-service-staging

    # 文档集成
    backstage.io/techdocs-ref: dir:./docs

    # 监控集成
    grafana/dashboard-url: https://grafana.example.com/d/orders-service

    # 代码集成
    github.com/project-slug: team-a/orders-service
  tags:
    - go
    - microservice
    - api
  links:
    - url: https://orders-service.staging.example.com/health
      title: Health Check
      icon: health
    - url: https://orders-service.staging.example.com/swagger
      title: API Documentation
      icon: doc
    - url: https://grafana.example.com/d/orders-service
      title: Monitoring Dashboard
      icon: dashboard

spec:
  type: service
  lifecycle: production
  owner: team-a
  system: ecommerce-platform

  # 依赖关系声明
  dependsOn:
    - component:payment-service
    - component:inventory-service
    - resource:redis-cache
    - resource:orders-database

  # 提供的 API
  providesApis:
    - orders-api

  # 消费的 API
  consumesApis:
    - payment-api
    - inventory-api

# ArgoCD Application: 同时包含声明与实际状态
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: orders-service-staging
  namespace: argocd
  labels:
    team: team-a
    environment: staging
  annotations:
    # 自定义通知：漂移检测
    notifications.argoproj.io/subscribe.on-sync-status-unknown.slack: team-a-alerts
    notifications.argoproj.io/subscribe.on-health-degraded.slack: team-a-alerts
spec:
  project: team-a

  source:
    repoURL: https://github.com/team-a/orders-service.git
    targetRevision: main
    path: k8s/overlays/staging

  destination:
    server: https://kubernetes.default.svc
    namespace: team-a-staging

  syncPolicy:
    automated:
      prune: true
      selfHeal: true      # 自动修复漂移
      allowEmpty: false
    syncOptions:
      - CreateNamespace=true
      - PrunePropagationPolicy=foreground
      - ServerSideApply=true

    # 状态检查与回滚
    retry:
      limit: 3
      backoff:
        duration: 5s
        factor: 2
        maxDuration: 3m

# OpenTelemetry Collector 配置
apiVersion: opentelemetry.io/v1beta1
kind: OpenTelemetryCollector
metadata:
  name: otel-collector
  namespace: monitoring
spec:
  config:
    receivers:
      otlp:
        protocols:
          grpc:
            endpoint: 0.0.0.0:4317
          http:
            endpoint: 0.0.0.0:4318

    processors:
      # 资源属性注入：为所有遥测数据附加环境信息
      # 注：deployment.environment 自 semconv v1.29.0 起废弃，改用 deployment.environment.name
      resource:
        attributes:
          - key: deployment.environment.name
            value: staging
            action: upsert
          - key: service.namespace
            value: team-a
            action: upsert
          - key: k8s.cluster.name
            value: prod-cluster-01
            action: upsert

      # K8s 属性注入：自动从 Pod 元数据提取
      k8sattributes:
        extract:
          metadata:
            - k8s.namespace.name
            - k8s.pod.name
            - k8s.pod.uid
            - k8s.deployment.name
            - k8s.node.name
          labels:
            - key: app.kubernetes.io/name
              from: pod
            - key: app.kubernetes.io/version
              from: pod
            - key: environment
              from: pod
        passthrough: false

    exporters:
      otlp:
        endpoint: tempo.monitoring:4317
        tls:
          insecure: true
      prometheus:
        endpoint: 0.0.0.0:8889

    service:
      pipelines:
        traces:
          receivers: [otlp]
          processors: [resource, k8sattributes]
          exporters: [otlp]
        metrics:
          receivers: [otlp]
          processors: [resource, k8sattributes]
          exporters: [prometheus]

# Kyverno 策略：强制标准标签
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-standard-labels
spec:
  # Kyverno 1.13+ 使用 failurePolicy（旧字段 validationFailureAction 已废弃）
  failurePolicy: enforce
  rules:
    - name: check-standard-labels
      match:
        resources:
          kinds:
            - Pod
            - Deployment
            - Service
      validate:
        message: "资源必须包含 app.kubernetes.io/name 和 environment 标签"
        pattern:
          metadata:
            labels:
              app.kubernetes.io/name: "?*"
              environment: "?*"