erp-java/services/admin-service/k8s/deployment.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: erp-prod
  labels:
    name: erp-prod
    environment: production
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-service
  namespace: erp-prod
  labels:
    app: admin-service
---
# ============================================================
# Secret - 使用外部密钥管理时替换为真实密钥
# ============================================================
apiVersion: v1
kind: Secret
metadata:
  name: admin-service-secrets
  namespace: erp-prod
type: Opaque
stringData:
  DB_PASSWORD: "REPLACE_WITH_DB_PASSWORD"
  REDIS_PASSWORD: "REPLACE_WITH_REDIS_PASSWORD"
  JWT_SECRET: "REPLACE_WITH_STRONG_JWT_SECRET_MIN_32_CHARS"
---
# ============================================================
# ConfigMap - 应用配置
# ============================================================
apiVersion: v1
kind: ConfigMap
metadata:
  name: admin-service-config
  namespace: erp-prod
data:
  SPRING_PROFILES_ACTIVE: "prod"
  JAVA_OPTS: "-Xms512m -Xmx1024m -XX:+UseG1GC -XX:+HeapDumpOnOutOfMemoryError"
  NACOS_HOST: "nacos"
  NACOS_NAMESPACE: "prod"
  NACOS_PORT: "8848"
  DB_HOST: "mysql"
  DB_PORT: "3306"
  DB_NAME: "erp_java"
  DB_USERNAME: "erp_user"
  REDIS_HOST: "redis"
  REDIS_PORT: "6379"
  REDIS_DB: "0"
  SERVER_PORT: "8081"
---
# ============================================================
# Deployment
# ============================================================
apiVersion: apps/v1
kind: Deployment
metadata:
  name: admin-service
  namespace: erp-prod
  labels:
    app: admin-service
    version: v1
    tier: backend
spec:
  replicas: 2
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: admin-service
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    metadata:
      labels:
        app: admin-service
        version: v1
        tier: backend
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "8081"
        prometheus.io/path: "/actuator/prometheus"
    spec:
      serviceAccountName: admin-service
      securityContext:
        runAsNonRoot: true
        runAsUser: 1001
        fsGroup: 1001
      containers:
        - name: admin-service
          image: registry.erpzbbh.cn/erp/admin-service:1.0.0
          imagePullPolicy: Always
          ports:
            - name: http
              containerPort: 8081
              protocol: TCP
          envFrom:
            - configMapRef:
                name: admin-service-config
            - secretRef:
                name: admin-service-secrets
          env:
            - name: POD_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
          resources:
            requests:
              memory: "512Mi"
              cpu: "250m"
            limits:
              memory: "1Gi"
              cpu: "1000m"
          livenessProbe:
            httpGet:
              path: /actuator/health/liveness
              port: http
            initialDelaySeconds: 60
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
            successThreshold: 1
          readinessProbe:
            httpGet:
              path: /actuator/health/readiness
              port: http
            initialDelaySeconds: 30
            periodSeconds: 5
            timeoutSeconds: 3
            failureThreshold: 3
            successThreshold: 1
          startupProbe:
            httpGet:
              path: /actuator/health/liveness
              port: http
            initialDelaySeconds: 10
            periodSeconds: 5
            timeoutSeconds: 3
            failureThreshold: 30
          lifecycle:
            preStop:
              exec:
                command: ["sh", "-c", "sleep 10"]
          volumeMounts:
            - name: app-logs
              mountPath: /app/logs
      volumes:
        - name: app-logs
          emptyDir: {}
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: ScheduleAnyway
          labelSelector:
            matchLabels:
              app: admin-service
---
# ============================================================
# Service
# ============================================================
apiVersion: v1
kind: Service
metadata:
  name: admin-service
  namespace: erp-prod
  labels:
    app: admin-service
  annotations:
    prometheus.io/scrape: "true"
spec:
  type: ClusterIP
  ports:
    - name: http
      port: 8081
      targetPort: http
      protocol: TCP
  selector:
    app: admin-service
---
# ============================================================
# Ingress
# ============================================================
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: admin-service-ingress
  namespace: erp-prod
  labels:
    app: admin-service
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "60"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "60"
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - admin-service.erpzbbh.cn
      secretName: admin-service-tls
  rules:
    - host: admin-service.erpzbbh.cn
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: admin-service
                port:
                  name: http
---
# ============================================================
# HorizontalPodAutoscaler
# ============================================================
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: admin-service-hpa
  namespace: erp-prod
  labels:
    app: admin-service
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: admin-service
  minReplicas: 2
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 80
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300
      policies:
        - type: Percent
          value: 10
          periodSeconds: 60
    scaleUp:
      stabilizationWindowSeconds: 0
      policies:
        - type: Percent
          value: 100
          periodSeconds: 15
        - type: Pods
          value: 4
          periodSeconds: 15
      selectPolicy: Max
---
# ============================================================
# PodDisruptionBudget
# ============================================================
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: admin-service-pdb
  namespace: erp-prod
  labels:
    app: admin-service
spec:
  minAvailable: 1
  selector:
    matchLabels:
      app: admin-service