云原生运维

# 多阶段构建：builder + distroless 运行时
FROM rust:1.82-slim AS builder
 
WORKDIR /app
COPY Cargo.toml Cargo.lock ./
COPY crates/ ./crates/
 
# 静态链接：消除对系统库的依赖
RUN rustup target add x86_64-unknown-linux-musl
RUN apt-get update && apt-get install -y musl-tools
RUN cargo build --release --target x86_64-unknown-linux-musl
 
# 最终镜像：无 shell、无包管理器、仅二进制
FROM gcr.io/distroless/static-debian12
COPY --from=builder /app/target/x86_64-unknown-linux-musl/release/api /api
EXPOSE 3001
ENTRYPOINT ["/api"]

# k8s/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: taskforge-api
spec:
  replicas: 3
  selector:
    matchLabels:
      app: taskforge-api
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0       # 零停机滚动发布
  template:
    metadata:
      labels:
        app: taskforge-api
      annotations:
        prometheus.io/scrape: "true"   # 自动发现 metrics
        prometheus.io/port: "9090"
    spec:
      containers:
      - name: api
        image: ghcr.io/myorg/taskforge-api:v1.2.3
        ports:
        - containerPort: 3001
        - containerPort: 9090  # Prometheus metrics 端口
        env:
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: taskforge-secrets
              key: database-url
        resources:
          requests:
            memory: "32Mi"
            cpu: "50m"
          limits:
            memory: "128Mi"
            cpu: "500m"
        livenessProbe:
          httpGet:
            path: /health
            port: 3001
          initialDelaySeconds: 5
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /ready
            port: 3001

[dependencies]
prometheus = "0.13"
axum-prometheus = "0.6"

use axum_prometheus::PrometheusMetricLayer;
use prometheus::{Counter, Histogram, register_counter, register_histogram};
 
lazy_static::lazy_static! {
    static ref HTTP_REQUESTS_TOTAL: Counter = register_counter!(
        "http_requests_total",
        "Total HTTP requests"
    ).unwrap();
 
    static ref HTTP_REQUEST_DURATION: Histogram = register_histogram!(
        "http_request_duration_seconds",
        "HTTP request duration"
    ).unwrap();
 
    static ref ACTIVE_WS_CONNECTIONS: prometheus::Gauge = prometheus::register_gauge!(
        "active_websocket_connections",
        "Number of active WebSocket connections"
    ).unwrap();
}
 
pub fn metrics_router() -> Router {
    Router::new()
        .route("/metrics", get(prometheus_metrics_handler))
}
 
// 自动为所有路由添加 HTTP 指标
let (prometheus_layer, metric_handle) = PrometheusMetricLayer::pair();
let app = Router::new()
    .merge(api_router())
    .layer(prometheus_layer);

[dependencies]
opentelemetry = "0.22"
opentelemetry-jaeger = "0.21"
tracing-opentelemetry = "0.23"
tracing = "0.1"

use opentelemetry::global;
use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt};
 
fn init_tracing() {
    let tracer = opentelemetry_jaeger::new_agent_pipeline()
        .with_service_name("taskforge-api")
        .install_batch(opentelemetry::runtime::Tokio)
        .unwrap();
 
    tracing_subscriber::registry()
        .with(tracing_opentelemetry::layer().with_tracer(tracer))
        .with(tracing_subscriber::fmt::layer())
        .init();
}
 
// 在 handler 中创建 span
#[tracing::instrument(skip(pool), fields(board_id = %id))]
async fn get_board(
    Path(id): Path<Uuid>,
    State(pool): State<PgPool>,
) -> Result<Json<Board>, StatusCode> {
    let board = sqlx::query_as!(Board, "SELECT * FROM boards WHERE id = $1", id)
        .fetch_one(&pool)
        .await
        .map_err(|_| StatusCode::NOT_FOUND)?;
    Ok(Json(board))
}

# k8s/hpa.yaml
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: taskforge-api-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: taskforge-api
  minReplicas: 2
  maxReplicas: 20
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 60
  - type: Pods
    pods:
      metric:
        name: active_websocket_connections  # 自定义指标
      target:
        type: AverageValue
        averageValue: "500"   # 每个 Pod 最多 500 个 WS 连接

# 使用 kubectl 实现蓝绿部署
# 当前 production 指向 blue deployment
 
# 1. 部署 green 版本（新版本）
kubectl apply -f k8s/deployment-green.yaml
 
# 2. 等待 green 就绪
kubectl rollout status deployment/taskforge-api-green
 
# 3. 运行冒烟测试
./scripts/smoke-test.sh green
 
# 4. 切换流量到 green
kubectl patch service taskforge-api \
  -p '{"spec":{"selector":{"version":"green"}}}'
 
# 5. 观察 30 秒，无异常则删除 blue
kubectl delete deployment taskforge-api-blue