云原生系统全流程落地：容器化、Kubernetes编排、服务网格与可观测性联动实现JZIT

order-service/
├── cmd/main.go
├── internal/
│   ├── handler/       # HTTP/gRPC 入口
│   ├── service/       # 业务逻辑
│   └── repository/    # 数据访问
├── configs/config.yaml
├── Dockerfile
├── .dockerignore
└── go.mod

# 阶段1：构建
FROM golang:1.21-alpine AS builder
WORKDIR /build
COPY go.mod go.sum ./
RUN go mod download -x  # -x 打印下载细节，便于排查网络问题
COPY . .
# 强制静态编译，避免 alpine 缺少 glibc；-s -w 去除调试符号，减小二进制体积
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
    -ldflags="-s -w -extldflags '-static'" \
    -o order-service cmd/main.go

# 阶段2：运行时
FROM alpine:3.18
# 时区处理：使用 tzdata 并复制到系统位置，避免依赖外部挂载
RUN apk add --no-cache tzdata && \
    cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime && \
    echo "Asia/Shanghai" > /etc/timezone && \
    apk del tzdata  # 删除安装包，仅保留时区文件

# 创建非 root 用户：固定 UID 10001，便于与 PodSecurityPolicy 或 OPA 策略对齐
RUN addgroup -g 10001 -S appgroup && \
    adduser -S -u 10001 -G appgroup appuser

WORKDIR /app
COPY --from=builder /build/order-service .
COPY --from=builder /build/configs/config.yaml ./configs/

# 切换用户
USER appuser:appgroup
EXPOSE 8080
ENTRYPOINT ["./order-service"]

resources:
  requests:
    memory: "256Mi"   # 调度器依据此值决定节点分配，略低于平均值以提升装箱率
    cpu: "250m"       # 保证基本 CPU 时间片
  limits:
    memory: "512Mi"   # 超过此值会触发 OOMKill，设为 P95 的 1.35 倍，留有余量
    cpu: "500m"       # 上限限制，防止 noisy neighbor

apiVersion: apps/v1
kind: Deployment
metadata:
  name: order-service
  namespace: prod
  labels:
    app: order-service
    version: v1
spec:
  replicas: 3
  strategy:
    rollingUpdate:
      maxSurge: 1        # 滚动更新时最多多起 1 个 Pod
      maxUnavailable: 0  # 保证更新期间无 Pod 不可用（配合 PDB 实现严格数量）
  selector:
    matchLabels:
      app: order-service
  template:
    metadata:
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "8080"
        prometheus.io/path: "/metrics"
    spec:
      # 拓扑分布：强制 Pod 分布在不同的节点，提升故障域容错
      topologySpreadConstraints:
      - maxSkew: 1
        topologyKey: kubernetes.io/hostname
        whenUnsatisfiable: DoNotSchedule  # 若无法满足则阻塞调度，避免单节点过载
        labelSelector:
          matchLabels:
            app: order-service
      containers:
      - name: order
        image: registry.example.com/order:v1.0.0
        ports:
        - containerPort: 8080
          name: http
        env:
        - name: POD_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        - name: ENV
          value: "prod"
        # 就绪探针：只有 /health/ready 返回 200 时才进入 Service Endpoint
        readinessProbe:
          httpGet:
            path: /health/ready
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 5
          failureThreshold: 3
        # 存活探针：检测死锁（如 goroutine 泄漏导致无响应）
        livenessProbe:
          httpGet:
            path: /health/live
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: order-service-pdb
  namespace: prod
spec:
  minAvailable: 2        # 确保任何时刻至少有 2 个 Pod 可用，与 maxUnavailable:0 协同
  selector:
    matchLabels:
      app: order-service

# Headless Service：用于 StatefulSet 或自定义服务发现（本案例中为 Istio 提供稳定 DNS）
apiVersion: v1
kind: Service
metadata:
  name: order-service
  namespace: prod
spec:
  clusterIP: None
  selector:
    app: order-service
  ports:
  - port: 8080
    targetPort: 8080
---
# 普通 ClusterIP：供内部调用（如 payment-service 调用 order-service）
apiVersion: v1
kind: Service
metadata:
  name: order-service-lb
  namespace: prod
spec:
  type: ClusterIP
  selector:
    app: order-service
  ports:
  - port: 8080

kubectl label namespace prod istio-injection=enabled --overwrite
kubectl rollout restart deployment -n prod

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: order-service-dr
  namespace: prod
spec:
  host: order-service
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100      # 连接数上限，防止下游过载
    loadBalancer:
      simple: LEAST_REQUEST      # 最少请求负载均衡，适用于长连接场景

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: order-service-vs
  namespace: prod
spec:
  hosts:
  - order-service
  http:
  # 匹配头部 canary: true 的请求全部路由到 v2（用于内部测试）
  - match:
    - headers:
        canary:
          exact: "true"
    route:
    - destination:
        host: order-service
        subset: v2
      weight: 100
  # 常规流量：90% 到 v1，10% 到 v2
  - route:
    - destination:
        host: order-service
        subset: v1
      weight: 90
    - destination:
        host: order-service
        subset: v2
      weight: 10

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: order-service-fault
  namespace: prod
spec:
  hosts:
  - order-service
  http:
  - route:
    - destination:
        host: order-service
        subset: v1
    timeout: 3s                     # 请求端超时，应小于客户端总超时
    retries:
      attempts: 2                   # 最多重试 2 次（总请求数 3）
      perTryTimeout: 2s             # 每次重试的超时
      retryOn: gateway-error,connect-failure,refused-stream
    fault:
      abort:
        percentage:
          value: 0.1                # 0.1% 概率返回 500
        httpStatus: 500

order-chart/
├── Chart.yaml          # 元数据
├── values.yaml         # 默认值
├── values-prod.yaml    # 生产环境覆盖
├── templates/
│   ├── deployment.yaml
│   ├── service.yaml
│   ├── virtualservice.yaml
│   └── configmap.yaml
└── _helpers.tpl

replicaCount: 3
image:
  repository: registry.example.com/order
  tag: v1.0.0
  pullPolicy: IfNotPresent
resources:
  requests:
    memory: 256Mi
    cpu: 250m
  limits:
    memory: 512Mi
    cpu: 500m
istio:
  enabled: true
  canaryWeight: 10
  timeout: 3s
config:
  databaseHost: "postgres-prod.prod.svc.cluster.local"
  redisHost: "redis-prod.prod.svc.cluster.local"

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: order-service
  namespace: argocd
spec:
  project: default
  source:
    repoURL: git@github.com:myorg/microservices-charts.git
    path: charts/order-chart
    targetRevision: main
    helm:
      valueFiles:
      - values-prod.yaml
  destination:
    server: https://kubernetes.default.svc
    namespace: prod
  syncPolicy:
    automated:
      prune: true        # 自动删除不再存在于 Git 中的资源
      selfHeal: true     # 自动修复集群手动更改（漂移）
    syncOptions:
    - CreateNamespace=true
    - ApplyOutOfSyncOnly=true   # 仅同步差异资源，提升性能
  revisionHistoryLimit: 5       # 保留最近 5 个版本，便于回滚

package main

import (
    "time"
    "github.com/prometheus/client_golang/prometheus"
    "github.com/prometheus/client_golang/prometheus/promauto"
)

var (
    orderTotal = promauto.NewCounterVec(
        prometheus.CounterOpts{
            Name: "order_total",
            Help: "Total number of orders processed",
        },
        []string{"status"}, // success, failure
    )
    orderDuration = promauto.NewHistogramVec(
        prometheus.HistogramOpts{
            Name:    "order_duration_seconds",
            Help:    "Order processing latency",
            Buckets: []float64{0.01, 0.05, 0.1, 0.5, 1, 2, 5},
        },
        []string{"method"},
    )
)

func CreateOrder(ctx context.Context, req *pb.OrderRequest) error {
    start := time.Now()
    defer func() {
        orderDuration.WithLabelValues("create").Observe(time.Since(start).Seconds())
    }()
    // 业务逻辑...
    if err != nil {
        orderTotal.WithLabelValues("failure").Inc()
        return err
    }
    orderTotal.WithLabelValues("success").Inc()
    return nil
}

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: order-service-monitor
  namespace: prod
spec:
  selector:
    matchLabels:
      app: order-service
  endpoints:
  - port: http
    path: /metrics
    interval: 15s
    scrapeTimeout: 10s

- alert: HighOrderErrorRate
  expr: rate(order_total{status="failure"}[5m]) / rate(order_total[5m]) > 0.01
  for: 2m
  annotations:
    summary: "Order error rate > 1%"

import "github.com/sirupsen/logrus"

logger := logrus.New()
logger.SetFormatter(&logrus.JSONFormatter{
    FieldMap: logrus.FieldMap{
        logrus.FieldKeyTime:  "timestamp",
        logrus.FieldKeyLevel: "level",
        logrus.FieldKeyMsg:   "message",
    },
})

// 在请求上下文中提取 trace_id
func logWithTrace(ctx context.Context, msg string) {
    span := trace.SpanFromContext(ctx)
    sc := span.SpanContext()
    logger.WithFields(logrus.Fields{
        "trace_id": sc.TraceID().String(),
        "span_id":  sc.SpanID().String(),
        "order_id": orderID,
    }).Info(msg)
}

{namespace="prod", app="order-service"} |= "error" | json | trace_id="xxx"

import (
    "go.opentelemetry.io/otel"
    "go.opentelemetry.io/otel/exporters/otlp/otlptrace"
    "go.opentelemetry.io/otel/sdk/trace"
)

func initTracer() func() {
    ctx := context.Background()
    exporter, err := otlptrace.New(ctx, otlptrace.WithInsecure())
    if err != nil {
        log.Fatal(err)
    }
    tp := trace.NewTracerProvider(
        trace.WithBatcher(exporter),
        trace.WithSampler(trace.ParentBased(trace.TraceIDRatioBased(0.1))),
    )
    otel.SetTracerProvider(tp)
    return func() { _ = tp.Shutdown(ctx) }
}

handler := otelhttp.NewHandler(http.HandlerFunc(handleOrder), "order-handler")