22. Java 容器化最佳实践与 Kubernetes 部署

# ❌ 反模式：所有内容在一个层
FROM openjdk:17
COPY . /app
RUN ./mvnw package
COPY target/*.jar app.jar
ENTRYPOINT ["java", "-jar", "/app.jar"]
# 问题:
# 1. 构建上下文太大，每次拷贝所有源码
# 2. 依赖没有缓存层，微小改动也会重新下载依赖
# 3. 最终镜像包含 Maven、源码、.git 等无关内容

# === 阶段一：依赖缓存层 ===
FROM eclipse-temurin:17-jdk AS builder
WORKDIR /workspace

# 先只拷贝 pom.xml，利用 Docker 缓存
COPY pom.xml .
COPY .mvn .mvn
COPY mvnw .

# 下载依赖（只要 pom.xml 不变，这层就缓存）
RUN ./mvnw dependency:go-offline -B

# 再拷贝源码并构建
COPY src src
RUN ./mvnw clean package -DskipTests -B && \
    mkdir -p target/dependency && \
    (cd target/dependency; jar -xf ../*.jar)

# === 阶段二：生产镜像（最小化） ===
FROM eclipse-temurin:17-jre-alpine

# 安全：非 root 用户
RUN addgroup -S appgroup && adduser -S appuser -G appgroup

WORKDIR /app

# 分层拷贝，ClassPath 顺序优化
COPY --from=builder /workspace/target/dependency/BOOT-INF/lib /app/lib
COPY --from=builder /workspace/target/dependency/META-INF /app/META-INF
COPY --from=builder /workspace/target/dependency/BOOT-INF/classes /app/classes

# Spring Boot 2.3+ 支持分层 Jar
# java -Djarmode=layertools -jar app.jar extract

USER appuser:appgroup

EXPOSE 8080

# 容器感知 JVM 参数（见第2节）
ENTRYPOINT ["java", "-cp", "app:app/lib/*", \
    "-XX:+UseContainerSupport", \
    "-XX:MaxRAMPercentage=75.0", \
    "org.springframework.boot.loader.launch.JarLauncher"]

<!-- pom.xml -->
<build>
    <plugins>
        <plugin>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-maven-plugin</artifactId>
            <configuration>
                <layers>
                    <enabled>true</enabled>
                </layers>
            </configuration>
        </plugin>
    </plugins>
</build>

FROM eclipse-temurin:17-jre AS builder
WORKDIR /app
COPY target/*.jar app.jar
RUN java -Djarmode=layertools -jar app.jar extract

FROM eclipse-temurin:17-jre
WORKDIR /app
COPY --from=builder /app/dependencies/ ./
COPY --from=builder /app/spring-boot-loader/ ./
COPY --from=builder /app/snapshot-dependencies/ ./
COPY --from=builder /app/application/ ./
ENTRYPOINT ["java", "org.springframework.boot.loader.launch.JarLauncher"]

# JDK 8u191+ 引入的实验性参数（JDK 10+ 默认开启）
-XX:+UseContainerSupport         # 从 cgroup 读取容器限制
-XX:MaxRAMPercentage=75.0         # 容器内存的 75% 作为最大堆
-XX:InitialRAMPercentage=50.0     # 初始堆分配

# 替代旧的、不感知容器的参数:
# ❌ -Xmx1g  # 硬编码，不灵活
# ✅ -XX:MaxRAMPercentage=75.0  # 随容器大小自适应

ENTRYPOINT ["java",
    # === 容器感知 ===
    "-XX:+UseContainerSupport",
    "-XX:MaxRAMPercentage=75.0",
    "-XX:InitialRAMPercentage=50.0",

    # === 内存优化 ===
    "-XX:+UseG1GC",
    "-XX:MaxGCPauseMillis=200",
    "-XX:+UseStringDeduplication",   # G1 字符串去重

    # === OOM 处理 ===
    "-XX:+HeapDumpOnOutOfMemoryError",
    "-XX:HeapDumpPath=/tmp/heapdump.hprof",
    "-XX:OnOutOfMemoryError=kill -9 %p",

    # === 性能优化 ===
    "-XX:+AlwaysPreTouch",           # 启动时预分配，避免运行时停顿
    "-Djava.security.egd=file:/dev/./urandom",  # 加速启动

    # === 调试 (可选) ===
    "-XX:+PrintFlagsFinal",

    "-jar", "/app.jar"]

# 在容器中运行，验证 JVM 读取了正确的内存限制
docker run --memory=1g --rm myapp \
    java -XX:+PrintFlagsFinal -version | grep MaxHeapSize
# 期望输出约为 750MB (75% of 1GB)

apiVersion: apps/v1
kind: Deployment
metadata:
  name: order-service
  labels:
    app: order-service
spec:
  replicas: 3
  selector:
    matchLabels:
      app: order-service
  template:
    metadata:
      labels:
        app: order-service
    spec:
      # 调度策略
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app
                  operator: In
                  values: ["order-service"]
              topologyKey: kubernetes.io/hostname

      containers:
      - name: order-service
        image: registry/myapp/order-service:v1.2.0

        resources:
          requests:
            memory: "512Mi"    # 调度依据
            cpu: "250m"
          limits:
            memory: "1Gi"      # 硬限制，超过 OOMKill
            cpu: "1000m"       # CPU 限流（非硬性）

        ports:
        - name: http
          containerPort: 8080
          protocol: TCP
        - name: management
          containerPort: 8081

        env:
        - name: JAVA_TOOL_OPTIONS
          value: "-XX:MaxRAMPercentage=75.0 -XX:+UseContainerSupport"
        - name: SPRING_PROFILES_ACTIVE
          value: "production"

        # === 探针配置 ===
        startupProbe:
          httpGet:
            path: /actuator/health/liveness
            port: management
          failureThreshold: 30
          periodSeconds: 10   # 最大等待 5 分钟启动

        livenessProbe:
          httpGet:
            path: /actuator/health/liveness
            port: management
          initialDelaySeconds: 60
          periodSeconds: 10
          failureThreshold: 3

        readinessProbe:
          httpGet:
            path: /actuator/health/readiness
            port: management
          initialDelaySeconds: 30
          periodSeconds: 5
          failureThreshold: 3

        # 优雅关闭
        lifecycle:
          preStop:
            exec:
              command: ["sh", "-c", "sleep 15"]  # 等待 Service 摘除

      terminationGracePeriodSeconds: 60
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 1000

@Component
public class CustomHealthIndicator implements HealthIndicator {

    @Autowired private DataSource dataSource;
    @Autowired private RabbitTemplate rabbitTemplate;

    @Override
    public Health health() {
        // 就绪: 依赖服务可访问
        try (Connection conn = dataSource.getConnection()) {
            if (!conn.isValid(3)) {
                return Health.down()
                    .withDetail("database", "connection invalid")
                    .build();
            }
        } catch (Exception e) {
            return Health.down()
                .withDetail("database", e.getMessage())
                .build();
        }
        return Health.up().build();
    }
}

# application.yml
management:
  endpoint:
    health:
      probes:
        enabled: true  # 为 K8s 启用 liveness/readiness 分组
  health:
    livenessstate:
      enabled: true
    readinessstate:
      enabled: true

# 日志采集 Sidecar
spec:
  containers:
  - name: order-service
    image: order-service:v1
    volumeMounts:
    - name: logs
      mountPath: /app/logs

  - name: filebeat
    image: docker.elastic.co/beats/filebeat:8.11
    volumeMounts:
    - name: logs
      mountPath: /app/logs
      readOnly: true
    - name: filebeat-config
      mountPath: /usr/share/filebeat/filebeat.yml
      subPath: filebeat.yml

  volumes:
  - name: logs
    emptyDir: {}

# 配置热重载 Sidecar (Consul / Nacos)
spec:
  containers:
  - name: app
    image: myapp:v1
    env:
    - name: CONFIG_PATH
      value: /config

  - name: config-reloader
    image: config-reloader:v1
    volumeMounts:
    - name: shared-config
      mountPath: /config

# Istio 自动注入 sidecar
metadata:
  labels:
    app: order-service
  annotations:
    sidecar.istio.io/inject: "true"

# Sidecar 资源限制
spec:
  containers:
  - name: istio-proxy
    resources:
      requests:
        cpu: "100m"
        memory: "128Mi"
      limits:
        cpu: "500m"
        memory: "256Mi"

# Chart.yaml
apiVersion: v2
name: order-service
description: Order Service Helm Chart
type: application
version: 1.2.0
appVersion: "1.2.0"

# values.yaml
replicaCount: 3

image:
  repository: registry/myapp/order-service
  tag: "v1.2.0"
  pullPolicy: IfNotPresent

resources:
  requests:
    memory: 512Mi
    cpu: 250m
  limits:
    memory: 1Gi
    cpu: 1000m

java:
  opts: "-XX:MaxRAMPercentage=75.0 -XX:+UseG1GC"

autoscaling:
  enabled: true
  minReplicas: 3
  maxReplicas: 10
  targetCPUUtilizationPercentage: 70

ingress:
  enabled: true
  className: nginx
  hosts:
  - host: api.mycompany.com
    paths:
    - path: /orders
      pathType: Prefix

# 安装/升级
helm upgrade --install order-service ./chart \
  --namespace production \
  --set image.tag=v1.2.1 \
  --set replicaCount=5

# === 阶段一：基于 GraalVM JDK 的 Native 编译 ===
FROM ghcr.io/graalvm/graalvm-ce:java17 AS builder
WORKDIR /workspace

COPY .mvn .mvn
COPY mvnw pom.xml ./
RUN ./mvnw dependency:go-offline -B

COPY src src
RUN ./mvnw -Pnative -DskipTests native:compile -B

# === 阶段二：最小化运行时（scratch 或 distroless） ===
FROM gcr.io/distroless/static-debian11:nonroot
WORKDIR /app

# Native Image 产物是静态链接的可执行文件，无需 JRE
COPY --from=builder /workspace/target/myapp ./myapp

EXPOSE 8080
USER nonroot:nonroot

ENTRYPOINT ["./myapp"]

// Native Image 反射配置（src/main/resources/META-INF/native-image/reflect-config.json）
[
  {
    "name": "com.example.dto.UserDTO",
    "allDeclaredFields": true,
    "allDeclaredMethods": true,
    "allDeclaredConstructors": true
  },
  {
    "name": "com.example.controller.OrderController",
    "methods": [{"name": "createOrder", "parameterTypes": ["com.example.dto.OrderRequest"]}]
  }
]

// 或使用 @RegisterForReflection 注解自动收集
@RegisterForReflection(UserDTO.class)
public class NativeConfig { }

# .github/workflows/container-security.yml
name: Container Security Pipeline

on:
  push:
    branches: [main]

jobs:
  build-and-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # 1. 构建镜像
      - name: Build image
        run: docker build -t app:${{ github.sha }} .

      # 2. 多维度安全扫描
      - name: Trivy vulnerability scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: app:${{ github.sha }}
          format: sarif
          output: trivy-results.sarif

      - name: Hadolint Dockerfile lint
        uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: Dockerfile

      # 3. 镜像签名
      - name: Sign image with Cosign
        uses: sigstore/cosign-installer@v3
      - run: cosign sign --yes app:${{ github.sha }}

      # 4. SBOM 生成
      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          image: app:${{ github.sha }}
          format: spdx-json
          output-file: sbom.spdx.json

      # 5. 门禁：QUALITY GATE
      - name: Quality Gate
        run: |
          CRITICAL=$(jq '.runs[0].results | map(select(.level == "error")) | length' trivy-results.sarif)
          if [ "$CRITICAL" -gt 0 ]; then
            echo "❌ Found $CRITICAL CRITICAL vulnerabilities"
            exit 1
          fi
          echo "✅ All security checks passed"

# ArgoCD Application 声明式配置
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: order-service
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/mycompany/k8s-manifests.git
    targetRevision: HEAD
    path: apps/order-service/overlays/production
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true        # 自动删除不再存在的资源
      selfHeal: true     # 自动同步漂移
    syncOptions:
      - CreateNamespace=true
      - PrunePropagationPolicy=foreground
  # 图片自动更新
trackImages: []

# Karmada / ArgoCD ApplicationSet 实现多集群分发
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: order-service
spec:
  generators:
    - clusters:
        selector:
          matchLabels:
            env: production
  template:
    metadata:
      name: '{{name}}-order-service'
    spec:
      source:
        repoURL: https://github.com/mycompany/k8s-manifests.git
        targetRevision: HEAD
        path: 'apps/order-service/overlays/{{metadata.labels.region}}'
      destination:
        server: '{{server}}'
        namespace: production

# VPA 配置示例
apiVersion: autoscaling.k8s.io/v1
kind: VerticalPodAutoscaler
metadata:
  name: order-service-vpa
spec:
  targetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: order-service
  updatePolicy:
    updateMode: "Auto"  # 自动调整 Pod 资源
  resourcePolicy:
    containerPolicies:
      - containerName: order-service
        minAllowed:
          cpu: 50m
          memory: 128Mi
        maxAllowed:
          cpu: 2000m
          memory: 2Gi
        controlledResources: ["cpu", "memory"]