部署前准备

部署的项目地址：https://github.com/opsre/version_manager

1. 修改密码（02-secret.yaml）

生产环境务必替换默认密码，或使用 Sealed Secrets / External Secrets 等方案管理。

2. 初始化 SQL（如需要）

如果项目需要初始化数据库表结构，将 version_test.sql 导入

3. TLS 证书

创建名为 version-manager-tls 的 Secret，包含 TLS 证书和私钥：

使用 cert-manager（推荐）：

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: version-manager-tls
  namespace: version-manager
spec:
  secretName: version-manager-tls
  issuerRef:
    name: letsencrypt-prod    # 替换为你的 Issuer
    kind: ClusterIssuer
  dnsNames:
    - version-manager.example.com

手动创建自签证书：

openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout tls.key -out tls.crt \
  -subj "/CN=version-manager.example.com"

kubectl create secret tls version-manager-tls \
  --cert=tls.crt --key=tls.key \
  -n version-manager

4. 修改 Gateway 配置（07-gateway.yaml）

• gatewayClassName：填写集群实际的 GatewayClass（如 istio、eg）
• hostnames：改为实际域名

5. CORS 配置（01-configmap.yaml）

将 CORS_ORIGINS 更新为前端实际访问地址，例如：

CORS_ORIGINS: "https://version-manager.example.com"

部署

1.文件结构介绍

00-namespace.yaml   # Namespace
01-configmap.yaml   # 应用配置
02-secret.yaml      # 敏感信息（密码）
04-vsftpd.yaml      # vsftpd PVC + Deployment + Service（LoadBalancer）
05-backend.yaml     # 后端 Deployment + Service
06-frontend.yaml    # 前端 Deployment + Service
07-gateway.yaml     # Gateway + HTTPRoute（Kubernetes Gateway API）

2. 文件内容

[root@k8s-master01 version_manager]# cat 00-namespace.yaml 
apiVersion: v1
kind: Namespace
metadata:
  name: version-manager
[root@k8s-master01 version_manager]# cat 01-configmap.yaml 
apiVersion: v1
kind: ConfigMap
metadata:
  name: version-manager-config
  namespace: version-manager
data:
  DB_HOST: "192.168.51.51"
  DB_PORT: "13306"
  DB_NAME: "version_test"
  DB_USERNAME: "devops"
  FTP_HOST: "vsftpd"
  FTP_PORT: "21"
  FTP_USERNAME: "team01"
  FTP_DIRECTORY: "file"
  # 根据实际域名修改，逗号分隔多个来源
  CORS_ORIGINS: "http://localhost:5173,http://127.0.0.1:5173,https://version-manager.zzppjj.top,https://192.168.51.110:443"
[root@k8s-master01 version_manager]# cat 02-secret.yaml 
apiVersion: v1
kind: Secret
metadata:
  name: version-manager-secret
  namespace: version-manager
type: Opaque
stringData:
  DB_PASSWORD: "Admin123456"        # 生产环境请修改
  MYSQL_ROOT_PASSWORD: "2023W#@qGhsd" # 生产环境请修改
  FTP_PASSWORD: "ftp_password"          # 生产环境请修改
[root@k8s-master01 version_manager]# cat 04-vsftpd.yaml 
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: ftp-data-pvc
  namespace: version-manager
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 20Gi
  storageClassName: "nfs-version"  # 按需指定 StorageClass
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: vsftpd
  namespace: version-manager
  labels:
    app: vsftpd
spec:
  replicas: 1
  selector:
    matchLabels:
      app: vsftpd
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: vsftpd
    spec:
      containers:
        - name: vsftpd
          image: docker.cnb.cool/zzppjj/docker-images/vsftpd:latest
          ports:
            - containerPort: 20
              name: ftp-data
            - containerPort: 21
              name: ftp-ctrl
            - containerPort: 21100
              name: pasv-0
            - containerPort: 21101
              name: pasv-1
            - containerPort: 21102
              name: pasv-2
            - containerPort: 21103
              name: pasv-3
            - containerPort: 21104
              name: pasv-4
            - containerPort: 21105
              name: pasv-5
            - containerPort: 21106
              name: pasv-6
            - containerPort: 21107
              name: pasv-7
            - containerPort: 21108
              name: pasv-8
            - containerPort: 21109
              name: pasv-9
            - containerPort: 21110
              name: pasv-10
          env:
            - name: FTP_USER
              valueFrom:
                configMapKeyRef:
                  name: version-manager-config
                  key: FTP_USERNAME
            - name: FTP_PASS
              valueFrom:
                secretKeyRef:
                  name: version-manager-secret
                  key: FTP_PASSWORD
          volumeMounts:
            - name: ftp-data
              mountPath: /home/vsftpd
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 256Mi
      volumes:
        - name: ftp-data
          persistentVolumeClaim:
            claimName: ftp-data-pvc
---
# vsftpd 需要 LoadBalancer 暴露端口（FTP 协议不适合经过 HTTP Gateway 路由）
# 如果集群没有 LoadBalancer，可改为 NodePort
apiVersion: v1
kind: Service
metadata:
  name: vsftpd
  namespace: version-manager
  labels:
    app: vsftpd
spec:
  selector:
    app: vsftpd
  type: LoadBalancer   # FTP 控制+数据端口需要 L4 直通，不走 HTTPRoute
  ports:
    - name: ftp-ctrl
      port: 21
      targetPort: 21
    - name: ftp-data
      port: 20
      targetPort: 20
    - name: pasv-21100
      port: 21100
      targetPort: 21100
    - name: pasv-21101
      port: 21101
      targetPort: 21101
    - name: pasv-21102
      port: 21102
      targetPort: 21102
    - name: pasv-21103
      port: 21103
      targetPort: 21103
    - name: pasv-21104
      port: 21104
      targetPort: 21104
    - name: pasv-21105
      port: 21105
      targetPort: 21105
    - name: pasv-21106
      port: 21106
      targetPort: 21106
    - name: pasv-21107
      port: 21107
      targetPort: 21107
    - name: pasv-21108
      port: 21108
      targetPort: 21108
    - name: pasv-21109
      port: 21109
      targetPort: 21109
    - name: pasv-21110
      port: 21110
      targetPort: 21110
[root@k8s-master01 version_manager]# cat 05-backend.yaml 
apiVersion: apps/v1
kind: Deployment
metadata:
  name: backend
  namespace: version-manager
  labels:
    app: backend
spec:
  replicas: 2
  selector:
    matchLabels:
      app: backend
  template:
    metadata:
      labels:
        app: backend
    spec:
      containers:
        - name: backend
          image: docker.cnb.cool/zzppjj/docker-images/version_manager:v1
          ports:
            - containerPort: 5000
          envFrom:
            - configMapRef:
                name: version-manager-config
          env:
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: version-manager-secret
                  key: DB_PASSWORD
            - name: FTP_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: version-manager-secret
                  key: FTP_PASSWORD
          resources:
            requests:
              cpu: 200m
              memory: 256Mi
            limits:
              cpu: 1000m
              memory: 512Mi
          readinessProbe:
            tcpSocket:
              port: 5000
            initialDelaySeconds: 15
            periodSeconds: 10
          livenessProbe:
            tcpSocket:
              port: 5000
            initialDelaySeconds: 30
            periodSeconds: 15
            failureThreshold: 3
---
apiVersion: v1
kind: Service
metadata:
  name: backend
  namespace: version-manager
  labels:
    app: backend
spec:
  selector:
    app: backend
  ports:
    - port: 5000
      targetPort: 5000
  type: ClusterIP
[root@k8s-master01 version_manager]# cat 06-frontend.yaml 
apiVersion: apps/v1
kind: Deployment
metadata:
  name: frontend
  namespace: version-manager
  labels:
    app: frontend
spec:
  replicas: 2
  selector:
    matchLabels:
      app: frontend
  template:
    metadata:
      labels:
        app: frontend
    spec:
      containers:
        - name: frontend
          image: docker.cnb.cool/zzppjj/docker-images/version_manager_ui:v1
          ports:
            - containerPort: 80
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 256Mi
          readinessProbe:
            httpGet:
              path: /
              port: 80
            initialDelaySeconds: 10
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /
              port: 80
            initialDelaySeconds: 15
            periodSeconds: 15
---
apiVersion: v1
kind: Service
metadata:
  name: frontend
  namespace: version-manager
  labels:
    app: frontend
spec:
  selector:
    app: frontend
  ports:
    - port: 80
      targetPort: 80
  type: ClusterIP
[root@k8s-master01 version_manager]# cat 07-gateway.yaml 
# -------------------------------------------------------
# Gateway (Kubernetes Gateway API)
# 前提：集群已安装 GatewayClass，如 Istio / Envoy Gateway
# 若使用 Istio，gatewayClassName 填 "istio"
# 若使用 Envoy Gateway，填 "eg" 或按实际情况填写
# -------------------------------------------------------
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: version-manager-gateway
  namespace: version-manager
spec:
  gatewayClassName: istio          # ← 按实际 GatewayClass 修改
  listeners:
    - name: http
      protocol: HTTP
      port: 80
      # 自动重定向到 HTTPS，由下方 HTTPRoute 处理
      allowedRoutes:
        namespaces:
          from: Same
    - name: https
      protocol: HTTPS
      port: 443
      tls:
        mode: Terminate
        certificateRefs:
          - name: version-manager-tls   # ← Secret 名称，见下方说明
            kind: Secret
      allowedRoutes:
        namespaces:
          from: Same
---
# -------------------------------------------------------
# HTTP → HTTPS 重定向
# -------------------------------------------------------
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: http-to-https-redirect
  namespace: version-manager
spec:
  parentRefs:
    - name: version-manager-gateway
      sectionName: http
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301
---
# -------------------------------------------------------
# HTTPS 路由：前端（/） + 后端 API（/api/）
# 修改 hostnames 为实际域名
# -------------------------------------------------------
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: version-manager-route
  namespace: version-manager
spec:
  parentRefs:
    - name: version-manager-gateway
      sectionName: https
  hostnames:
    - "version-manager.zzppjj.top"   # ← 修改为实际域名
  rules:
    # 后端 API 路由（优先匹配，放前面）
    - matches:
        - path:
            type: PathPrefix
            value: /api/
      backendRefs:
        - name: backend
          port: 5000
    # 前端路由（兜底）
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: frontend
          port: 80

FTP 说明

vsftpd 使用 LoadBalancer 类型的 Service（FTP 协议为 TCP，无法通过 HTTP Gateway 路由）。

若集群无 LoadBalancer（如裸金属），可改为 NodePort，或使用 MetalLB。

vsftpd 被动模式端口范围为 21100–21110，需要确保防火墙/安全组放行这些端口。

---

后端健康检查

05-backend.yaml 中配置了 /health 健康检查端点。如果该项目没有此端点，请将 readinessProbe / livenessProbe 改为 TCP 检查：

readinessProbe:
  tcpSocket:
    port: 5000
  initialDelaySeconds: 15
  periodSeconds: 10