Kubernetes 生产级集群运维与加固完全指南 2026：Cilium eBPF + Gateway API + HPA + 灾备实战

1
apiVersion: cert-manager.io/v1
2
kind: ClusterIssuer
3
metadata:
4
  name: letsencrypt-prod
5
spec:
6
  acme:
7
    server: https://acme-v02.api.letsencrypt.org/directory
8
    email: admin@971918.xyz
9
    privateKeySecretRef:
10
      name: letsencrypt-prod-account-key
11
    solvers:
12
      - http01:
13
          gatewayHTTPRoute:
14
            parentRefs:
15
              - name: prod-gateway
16
                namespace: default

1
# 1. 声明 Gateway 网关实例（运维角色负责）
2
apiVersion: gateway.networking.k8s.io/v1
3
kind: Gateway
4
metadata:
5
  name: prod-gateway
6
  namespace: default
7
  annotations:
8
    cert-manager.io/cluster-issuer: letsencrypt-prod
9
spec:
10
  gatewayClassName: cilium # 使用 Cilium 作为 GatewayClass
11
  listeners:
12
    - name: http
13
      protocol: HTTP
14
      port: 80
15
      allowedRoutes:
16
        namespaces:
17
          from: Same
18
    - name: https
19
      protocol: HTTPS
20
      port: 443
21
      tls:
22
        mode: Terminate
23
        certificateRefs:
24
          - name: prod-tls-cert # Cert-Manager 自动生成的证书 Secret
25
      allowedRoutes:
26
        namespaces:
27
          from: All
28

29
---
30
# 2. 声明 HTTPRoute 业务路由（开发角色负责）
31
apiVersion: gateway.networking.k8s.io/v1
32
kind: HTTPRoute
33
metadata:
34
  name: app-routes
35
  namespace: default
36
spec:
37
  parentRefs:
38
    - name: prod-gateway
39
  hostnames:
40
    - "api.example.com"
41
  rules:
42
    # 灰度发布：80% 流量给 v1，20% 流量给 v2
43
    - matches:
44
        - path:
45
            type: PathPrefix
46
            value: /api/v1
47
      backendRefs:
48
        - name: order-service-v1
49
          port: 8080
50
          weight: 80
51
        - name: order-service-v2
52
          port: 8080
53
          weight: 20

1
apiVersion: apps/v1
2
kind: Deployment
3
metadata:
4
  name: api-service
5
  namespace: default
6
  labels:
7
    app: api-service
8
spec:
9
  replicas: 3
10
  strategy:
11
    type: RollingUpdate
12
    rollingUpdate:
13
      maxSurge: 25% # 允许额外创建 25% 副本用于预热
14
      maxUnavailable: 0 # 严禁在更新期间销毁超过容量的副本
15
  selector:
16
    matchLabels:
17
      app: api-service
18
  template:
19
    metadata:
20
      labels:
21
        app: api-service
22
    spec:
23
      terminationGracePeriodSeconds: 60 # 给予充分优雅停机时间
24
      containers:
25
        - name: app
26
          image: myapp:v1.2.0
27
          imagePullPolicy: IfNotPresent
28
          lifecycle:
29
            preStop:
30
              exec:
31
                command: ["/bin/sh", "-c", "sleep 5"] # 核心：先 sleep 等网关路由摘除
32
          ports:
33
            - containerPort: 8080
34
          # 资源配额限制
35
          resources:
36
            requests:
37
              cpu: "200m"
38
              memory: "256Mi"
39
            limits:
40
              cpu: "1000m"
41
              memory: "512Mi"
42
          # 存活探针（失败则重启容器）
43
          livenessProbe:
44
            httpGet:
45
              path: /health/liveness
46
              port: 8080
47
            initialDelaySeconds: 15
48
            periodSeconds: 10
49
            failureThreshold: 3
50
          # 就绪探针（成功后才允许流量接入）
51
          readinessProbe:
52
            httpGet:
53
              path: /health/readiness
54
              port: 8080
55
            initialDelaySeconds: 5
56
            periodSeconds: 5
57
            successThreshold: 1
58
            failureThreshold: 2