[{"data":1,"prerenderedAt":376},["ShallowReactive",2],{"site-data":3,"article-45":143,"article-show-hot-45":172,"article-show-new-45":282},{"settings":4,"categorys":35,"tree":97,"models":118,"search_model_select":128,"nav_list":130},{"changefreq":5,"changyan_app_id":6,"changyan_app_key":6,"copy":7,"description":8,"editor":9,"file":6,"guest_feedback":10,"head_html":6,"icp":11,"index_banner":12,"index_banner_bg":13,"is_excel":14,"is_watermark":10,"keywords":15,"links":16,"logo":17,"lzcms_banner":6,"lzcms_banner_link":18,"qq_app_id":6,"qq_app_key":6,"qr_code":6,"search_model":19,"site_closedreason":6,"site_idea":6,"site_idea1":20,"site_idea2":21,"site_idea3":22,"site_name":23,"site_statistice":6,"site_status":14,"site_url":18,"sitemap_model":19,"stationmaster_motto":24,"stationmaster_name":25,"stationmaster_occupation":26,"stationmaster_qq":27,"stationmaster_qqnet":28,"stationmaster_qqnet_code":29,"threshold":14,"title_add":30,"watermark":6,"watermark_alpha":31,"watermark_height":32,"watermark_locate":33,"watermark_width":34},"weekly","","版权所有 © \u003Ca class=\"site_url\" href=\"https://zhl123.com\">2026 zhl123.com\u003C/a>","linux、Python、mysql、docker、k8s技术交流","layedit","0","粤ICP备15054664号-1","/uploads/images/20181109/7a86191de8b8bb60e9c6b54d8b27c5cc.jpg","#xe604","1","linux、Python、mysql、docker、k8s","{\"1\":{\"id\":\"1\",\"name\":\"linux\\u4e2d\\u56fd\",\"link_url\":\"http:\\/\\/linux.cn\",\"sort\":\"1\"}}","/uploads/images/20181109/e7305012448aed257176dd591846f50a.png","https://zhl123.com","2","学无止境\n学习，探索，研究，从不了解到了解，从无知到掌握，到灵活运用，在不断的学习中加深认识。由浅入深，由表及里。","业精于勤\n“业精于勤荒于嬉”，精深的业技靠的是勤学、刻苦努力，靠的是争分夺秒的勤学苦练才会有精深的技术。得在认真，失在随便。","工匠精神\n精益求精，注重细节，追求完美和极致，不惜花费时间精力，孜孜不倦，反复改进产品，把99%提高到99.99%。","linux","业精于勤、学无止境、工匠精神","廖地金","高级Linux运维工程师","1256636645","592958303","\u003Ca target=\"_blank\" href=\"//shang.qq.com/wpa/qunwpa?idkey=09be7d1a682073783fd636102e666393169b8a8aac8f3393da1de57bcaa821a0\">\u003Cimg border=\"0\" src=\"//pub.idqqimg.com/wpa/images/group.png\" alt=\"Linux技术\" title=\"Linux技术\">\u003C/a>"," | Python | mysql | docker | k8s 技术交流","100","300","9","500",{"0":36,"17":51,"18":60,"19":63,"20":67,"21":71,"22":76,"25":80,"26":83,"27":89,"29":94},{"children":37},{"0":38,"25":43,"26":48},[39,40,41,42],25,21,22,26,[44,45,46,47],17,18,19,20,[49,50],27,29,{"create_time":6,"description":6,"id":44,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":23,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":53,"subtitle":6,"update_time":6,"url":59},"index",1,"list","article",2,"文章模型","show","/article/lists?category_id=17",{"create_time":6,"description":6,"id":45,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":61,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":56,"subtitle":6,"update_time":6,"url":62},"python","/article/lists?category_id=18",{"create_time":6,"description":6,"id":46,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":64,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":65,"subtitle":6,"update_time":6,"url":66},"容器技术",3,"/article/lists?category_id=19",{"create_time":6,"description":6,"id":47,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":68,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":69,"subtitle":6,"update_time":6,"url":70},"负载均衡",4,"/article/lists?category_id=20",{"create_time":6,"description":6,"id":40,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":72,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":74,"subtitle":6,"update_time":6,"url":75},"分享无价",0,5,"/article/lists?category_id=21",{"create_time":6,"description":6,"id":41,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":77,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":78,"subtitle":6,"update_time":6,"url":79},"随笔",6,"/article/lists?category_id=22",{"create_time":6,"description":6,"id":39,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":81,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":73,"subtitle":6,"update_time":6,"url":82},"学无止境","/article/lists?category_id=25",{"create_time":6,"description":6,"id":42,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":84,"model_id":65,"model_name":85,"name":86,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":87,"subtitle":6,"update_time":6,"url":88},"picture","图集模型","关于",8,"/picture/lists?category_id=26",{"create_time":6,"description":6,"id":49,"image_url":6,"index_template":52,"is_cover":53,"is_menu":73,"keywords":6,"list_template":54,"model_code":90,"model_id":53,"model_name":91,"name":92,"parent_id":42,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":47,"subtitle":6,"update_time":6,"url":93},"page","单页模型","关于博主","/page/27",{"create_time":6,"description":6,"id":50,"image_url":6,"index_template":52,"is_cover":73,"is_menu":73,"keywords":6,"list_template":54,"model_id":73,"name":95,"parent_id":42,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":47,"subtitle":6,"update_time":6,"url":96},"留言","/feedback",[98,108,110,112],{"children":99,"create_time":6,"description":6,"id":39,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":81,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":73,"subtitle":6,"update_time":6,"url":82},[100,102,104,106],{"children":101,"create_time":6,"description":6,"id":44,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":23,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":53,"subtitle":6,"update_time":6,"url":59},[],{"children":103,"create_time":6,"description":6,"id":45,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":61,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":56,"subtitle":6,"update_time":6,"url":62},[],{"children":105,"create_time":6,"description":6,"id":46,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":64,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":65,"subtitle":6,"update_time":6,"url":66},[],{"children":107,"create_time":6,"description":6,"id":47,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":68,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":69,"subtitle":6,"update_time":6,"url":70},[],{"children":109,"create_time":6,"description":6,"id":40,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":72,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":74,"subtitle":6,"update_time":6,"url":75},[],{"children":111,"create_time":6,"description":6,"id":41,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":77,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":78,"subtitle":6,"update_time":6,"url":79},[],{"children":113,"create_time":6,"description":6,"id":42,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":84,"model_id":65,"model_name":85,"name":86,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":87,"subtitle":6,"update_time":6,"url":88},[114,116],{"children":115,"create_time":6,"description":6,"id":49,"image_url":6,"index_template":52,"is_cover":53,"is_menu":73,"keywords":6,"list_template":54,"model_code":90,"model_id":53,"model_name":91,"name":92,"parent_id":42,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":47,"subtitle":6,"update_time":6,"url":93},[],{"children":117,"create_time":6,"description":6,"id":50,"image_url":6,"index_template":52,"is_cover":73,"is_menu":73,"keywords":6,"list_template":54,"model_id":73,"name":95,"parent_id":42,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":47,"subtitle":6,"update_time":6,"url":96},[],{"1":119,"2":120,"3":121,"4":122,"5":125},{"id":53,"index_template":52,"list_template":54,"name":91,"show_template":58,"status":73,"tablename":90},{"id":56,"index_template":52,"list_template":54,"name":57,"show_template":58,"status":73,"tablename":55},{"id":65,"index_template":52,"list_template":54,"name":85,"show_template":58,"status":73,"tablename":84},{"id":69,"index_template":52,"list_template":54,"name":123,"show_template":58,"status":73,"tablename":124},"链接模型","link",{"id":74,"index_template":52,"list_template":54,"name":126,"show_template":58,"status":73,"tablename":127},"下载模型","download",[129],{"id":56,"name":57,"tablename":55},[131,137,139,141],{"children":132,"create_time":6,"description":6,"id":39,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":81,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":73,"subtitle":6,"update_time":6,"url":82},[133,134,135,136],{"create_time":6,"description":6,"id":44,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":23,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":53,"subtitle":6,"update_time":6,"url":59},{"create_time":6,"description":6,"id":45,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":61,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":56,"subtitle":6,"update_time":6,"url":62},{"create_time":6,"description":6,"id":46,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":64,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":65,"subtitle":6,"update_time":6,"url":66},{"create_time":6,"description":6,"id":47,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":68,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":69,"subtitle":6,"update_time":6,"url":70},{"children":138,"create_time":6,"description":6,"id":40,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":72,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":74,"subtitle":6,"update_time":6,"url":75},[],{"children":140,"create_time":6,"description":6,"id":41,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":77,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":78,"subtitle":6,"update_time":6,"url":79},[],{"children":142,"create_time":6,"description":6,"id":42,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":84,"model_id":65,"model_name":85,"name":86,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":87,"subtitle":6,"update_time":6,"url":88},[],{"article":144,"breadcrumb":155,"category":159,"next":160,"prev":163,"second_categorys":166,"seo":171},{"id":145,"category_id":44,"title":146,"keywords":147,"description":148,"image_url":6,"content":149,"content_md":150,"url":151,"hits":152,"is_recommend":73,"is_top":73,"create_time":153,"update_time":154},45,"MySQL高可用，数据之船不再翻 ","数据,不再","前言 上篇文章我们介绍了使用pacemkaer+corosync实现简单的nginx高可用， 这篇文章我们介绍如何使用pacemaker+corosync实现MySQL高可用， 并且此次我们手动编辑配置文件来实现corosync的配置。 实验拓扑 实验环境 主机                    IP       &nbsp","\u003Cp>\u003Cfont size=\"4\">\u003Cb>前言\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>上篇文章我们介绍了使用pacemkaer+corosync实现简单的nginx高可用， 这篇文章我们介绍如何使用pacemaker+corosync实现MySQL高可用， 并且此次我们手动编辑配置文件来实现corosync的配置。\u003C/span>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cfont size=\"4\">\u003Cb>实验拓扑\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cfont size=\"4\">\u003Cb>实验环境\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>主机                    IP                功用 \u003Cbr>node1.anyisalin.com        172.16.1.2        MySQL服务, HA节点 \u003Cbr>node2.anyisalin.com        172.16.1.3      MySQL服务, HA节点 \u003Cbr>nfs.anyisalin.com        172.16.1.4        提供nfs服务，数据库文件\u003C/span>\u003Cspan> \u003C/span>\u003Cbr>\u003Cspan>注意: 本文实验中所有主机SElinux和iptables都是关闭的\u003C/span>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cfont size=\"4\">\u003Cb>实验步骤\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cfont size=\"3\">\u003Cb>准备工作\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>高可用集群必须保证所有节点主机互信, 主机名解析一致, 时间同步\u003C/span>\u003Cspan> \u003C/span>\u003Cbr>\u003Cspan>配置hosts文件同步\u003C/span>\u003Cspan> \u003C/span>\u003Cbr>\u003Cspan>\u003C/span>\u003Cspan>\u003C/span>\u003Cbr>\u003Cspan>配置互信\u003C/span>\u003Cspan> \u003C/span>\u003Cbr>\u003Cspan>\u003C/span>\u003Cspan>\u003C/span>\u003Cbr>\u003Cspan>\u003C/span>\u003Cspan>\u003C/span>\u003Cbr>\u003Cspan>时间同步\u003C/span>\u003Cspan> \u003C/span>\u003Cbr>\u003Cspan>\u003C/span>\u003Cspan>\u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cfont size=\"3\">\u003Cb>安装HA组件并配置\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>我们这次直接安装并手动配置pacemaker+corosync\u003C/span>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>安装corosync+pacemaker在两个节点上 \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>[root@node1 ~]# yum install corosync pacemaker -y &> /dev/null && echo success \u003C/span>\u003Cbr>\u003Cspan>success \u003C/span>\u003Cbr>\u003Cspan>[root@node1 ~]# ssh node2.anyisalin.com \"yum install corosync pacemaker -y &> /dev/null && echo success\" \u003C/span>\u003Cbr>\u003Cspan>success \u003C/span>\u003Cbr>\u003Cspan>\u003Cb>编辑配置文件\u003C/b>\u003C/span>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>[root@node1 corosync]# vim corosync.conf \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>        totem { \u003C/span>\u003Cbr>\u003Cspan>            version: 2 \u003C/span>\u003Cbr>\u003Cspan>        crypto_cipher: none \u003C/span>\u003Cbr>\u003Cspan>        crypto_hash: none \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cspan>            interface { \u003C/span>\u003Cbr>\u003Cspan>                ringnumber: 0 \u003C/span>\u003Cbr>\u003Cspan>                bindnetaddr: 172.16.1.0 \u003C/span>\u003Cbr>\u003Cspan>                mcastaddr: 239.185.1.31 \u003C/span>\u003Cbr>\u003Cspan>                mcastport: 5405 \u003C/span>\u003Cbr>\u003Cspan>                ttl: 1 \u003C/span>\u003Cbr>\u003Cspan>            } \u003C/span>\u003Cbr>\u003Cspan>        } \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>        nodelist { \u003C/span>\u003Cbr>\u003Cspan>                node { \u003C/span>\u003Cbr>\u003Cspan>                        ring0_addr: 172.16.1.2 \u003C/span>\u003Cbr>\u003Cspan>                        nodeid: 1 \u003C/span>\u003Cbr>\u003Cspan>                } \u003C/span>\u003Cbr>\u003Cspan>                node { \u003C/span>\u003Cbr>\u003Cspan>                        ring0_addr: 172.16.1.3 \u003C/span>\u003Cbr>\u003Cspan>                        nodeid: 2 \u003C/span>\u003Cbr>\u003Cspan>                } \u003C/span>\u003Cbr>\u003Cspan>        } \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>        logging { \u003C/span>\u003Cbr>\u003Cspan>            fileline: off \u003C/span>\u003Cbr>\u003Cspan>            to_stderr: no \u003C/span>\u003Cbr>\u003Cspan>            to_logfile: yes \u003C/span>\u003Cbr>\u003Cspan>            logfile: /var/log/cluster/corosync.log \u003C/span>\u003Cbr>\u003Cspan>            to_syslog: no \u003C/span>\u003Cbr>\u003Cspan>            debug: off \u003C/span>\u003Cbr>\u003Cspan>            timestamp: on \u003C/span>\u003Cbr>\u003Cspan>            logger_subsys { \u003C/span>\u003Cbr>\u003Cspan>                subsys: QUORUM \u003C/span>\u003Cbr>\u003Cspan>                debug: off \u003C/span>\u003Cbr>\u003Cspan>            } \u003C/span>\u003Cbr>\u003Cspan>        } \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>        quorum { \u003C/span>\u003Cbr>\u003Cspan>            provider: corosync_votequorum \u003C/span>\u003Cbr>\u003Cspan>        } \u003C/span>\u003Cbr>\u003Cspan>\u003Cb>启动corosync和pacemaker\u003C/b>\u003C/span>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>[root@node1 corosync]# scp corosync.conf node2.anyisalin.com:/etc/corosync/ \u003C/span>\u003Cbr>\u003Cspan>[root@node1 corosync]# systemctl start corosync pacemkaer \u003C/span>\u003Cbr>\u003Cspan>[root@node1 corosync]# ssh node2.anyisalin.com \"systemctl start corosync pacemkaer\" \u003C/span>\u003Cbr>\u003Cspan>\u003Cb>查看集群节点状态\u003C/b>\u003C/span>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>[root@node1 corosync]# crm status   #各节点都在线 \u003C/span>\u003Cbr>\u003Cspan>Last updated: Sun Apr 10 22:23:13 2016      Last change: Sun Apr 10 22:16:43 2016 by root via cibadmin on node1.anyisalin.com \u003C/span>\u003Cbr>\u003Cspan>Stack: corosync \u003C/span>\u003Cbr>\u003Cspan>Current DC: node1.anyisalin.com (version 1.1.13-10.el7_2.2-44eb2dd) - partition with quorum \u003C/span>\u003Cbr>\u003Cspan>2 nodes and 0 resources configured \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>Online: [ node1.anyisalin.com node2.anyisalin.com ] \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cfont size=\"3\">\u003Cb>配置NFS\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>对于NFS配置这次比较复杂\u003C/span>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>[root@nfs ~]# vim /etc/exports \u003C/span>\u003Cbr>\u003Cspan>/datadir    172.16.1.0/24(rw,no_root_squash) \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>[root@nfs ~]# useradd -u 3306 mysql  #创建mysql用户 \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>[root@nfs ~]# mkdir /datadir \u003C/span>\u003Cbr>\u003Cspan>[root@nfs ~]# setfacl -m u:mysql:rwx /datadir/  #赋予mysql用户权限 \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>[root@nfs ~]# exportfs -rv   #重新导出目录 \u003C/span>\u003Cbr>\u003Cspan>exporting 172.16.1.0/24:/datadir \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cfont size=\"3\">\u003Cb>配置MySQL\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>MySQL我们使用通用二进制的包安装, 安装过程有疑问的可以看我以前的LAMP安装的文章\u003C/span>\u003Cspan> \u003C/span>\u003Cbr>\u003Cspan>在node1上操作\u003C/span>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>[root@node1 corosync]# tar xf mysql-5.5.33-linux2.6-x86_64.tar.gz -C /usr/src/ \u003C/span>\u003Cbr>\u003Cspan>[root@node1 corosync]# cd /usr/src/mysql-5.5.33-linux2.6-x86_64/ \u003C/span>\u003Cbr>\u003Cspan>[root@node1 mysql-5.5.33-linux2.6-x86_64]# groupadd -g 3306 -r mysql \u003C/span>\u003Cbr>\u003Cspan>[root@node1 mysql-5.5.33-linux2.6-x86_64]# useradd -u 3306 -g mysql mysql \u003C/span>\u003Cbr>\u003Cspan>[root@node1 mysql-5.5.33-linux2.6-x86_64]# mkdir /datadir \u003C/span>\u003Cbr>\u003Cspan>[root@node1 mysql-5.5.33-linux2.6-x86_64]# mount -t nfs 172.16.1.4:/datadir /datadir/ #挂载nfs到本地 \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>[root@node1 mysql-5.5.33-linux2.6-x86_64]# ./scripts/mysql_install_db --user=mysql --datadir=/datadir #初始化MySQL生成数据库文件 \u003C/span>\u003Cbr>\u003Cspan>[root@node1 mysql-5.5.33-linux2.6-x86_64]# ls /datadir/ \u003C/span>\u003Cbr>\u003Cspan>mysql  performance_schema  test \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>[root@node1 mysql-5.5.33-linux2.6-x86_64]# cp support-files/my-large.cnf /etc/my.cnf \u003C/span>\u003Cbr>\u003Cspan>[root@node1 mysql-5.5.33-linux2.6-x86_64]# vim /etc/my.cnf #添加以下几行 \u003C/span>\u003Cbr>\u003Cspan>datadir=/datadir \u003C/span>\u003Cbr>\u003Cspan>innodb_file_per_table = on \u003C/span>\u003Cbr>\u003Cspan>skip_name_resolve = on \u003C/span>\u003Cbr>\u003Cspan>[root@node1 mysql-5.5.33-linux2.6-x86_64]# cp support-files/mysql.server /etc/init.d/mysqld \u003C/span>\u003Cbr>\u003Cspan>[root@node1 mysql-5.5.33-linux2.6-x86_64]# cd /usr/local/ \u003C/span>\u003Cbr>\u003Cspan>[root@node1 local]# ln -sv /usr/src/mysql-5.5.33-linux2.6-x86_64/ mysql  #创建软链接 \u003C/span>\u003Cbr>\u003Cspan>[root@node1 ~]# service mysqld start  #启动mysql \u003C/span>\u003Cbr>\u003Cspan>Starting MySQL.. SUCCESS! \u003C/span>\u003Cbr>\u003Cspan>[root@node1 ~]# /usr/local/mysql/bin/mysql  #登录成功 \u003C/span>\u003Cbr>\u003Cspan>mysql> \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cspan>在node2上操作 \u003C/span>\u003Cbr>\u003Cspan>[root@node2 ~]# tar xf mysql-5.5.33-linux2.6-x86_64.tar.gz  -C /usr/src/ \u003C/span>\u003Cbr>\u003Cspan>[root@node2 ~]# mkdir /datadir \u003C/span>\u003Cbr>\u003Cspan>[root@node2 ~]# mount -t nfs 172.16.1.4:/datadir /datadir/ \u003C/span>\u003Cbr>\u003Cspan>[root@node2 ~]# ls /datadir/ \u003C/span>\u003Cbr>\u003Cspan>ibdata1  ib_logfile0  ib_logfile1  mysql  mysql-bin.000001  mysql-bin.000002  mysql-bin.index  node1.anyisalin.com.err  node1.anyisalin.com.pid  performance_schema  test \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>[root@node2 ~]# scp node1.anyisalin.com:/etc/my.cnf /etc/ \u003C/span>\u003Cbr>\u003Cspan>[root@node2 ~]# scp node1.anyisalin.com:/etc/init.d/mysqld /etc/init.d/ \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cspan>[root@node2 ~]# cd /usr/local/ \u003C/span>\u003Cbr>\u003Cspan>[root@node2 local]# groupadd -g 3306 -r mysql \u003C/span>\u003Cbr>\u003Cspan>[root@node2 local]# useradd -g mysql -u  3306 mysql \u003C/span>\u003Cbr>\u003Cspan>[root@node2 local]# ln -sv /usr/src/mysql-5.5.33-linux2.6-x86_64/ mysql \u003C/span>\u003Cbr>\u003Cspan>‘mysql’ -> ‘/usr/src/mysql-5.5.33-linux2.6-x86_64/’ \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>[root@node2 ~]# service mysqld start #因为node1在运行所以不能运行 \u003C/span>\u003Cbr>\u003Cspan>Starting MySQL........ \u003C/span>\u003Cbr>\u003Cspan>[root@node2 ~]# ssh node1.anyisalin.com \"service mysqld stop\" \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>[root@node2 local]# service mysqld start  #启动成功 \u003C/span>\u003Cbr>\u003Cspan>Starting MySQL SUCCESS! \u003C/span>\u003Cbr>\u003Cspan>[root@node2 local]# /usr/local/mysql/bin/mysql  #能够登录 \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>mysql> \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cspan>#测试完成后将mysql服务停止并卸载nfs \u003C/span>\u003Cbr>\u003Cspan>[root@node2 local]# service mysqld stop \u003C/span>\u003Cbr>\u003Cspan>Shutting down MySQL. SUCCESS! \u003C/span>\u003Cbr>\u003Cspan>[root@node2 local]# umount /datadir/ \u003C/span>\u003Cbr>\u003Cspan>[root@node1 ~]# umount /datadir/ \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cfont size=\"3\">\u003Cb>配置HA资源\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>配置HA资源\u003C/span>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>crm(live)# configure \u003C/span>\u003Cbr>\u003Cspan>crm(live)configure# primitive dataip ocf:heartbeat:IPaddr params ip=172.16.1.8 \u003C/span>\u003Cbr>\u003Cspan>crm(live)configure# primitive datastore ocf:heartbeat:Filesystem params device=\"172.16.1.4:/datadir\" fstype=\"nfs\" directory=\"/datadir\" op \u003C/span>\u003Cbr>\u003Cspan>crm(live)configure# primitive mysql service:mysqld   \u003C/span>\u003Cbr>\u003Cspan>crm(live)configure# property stonith-enabled=false \u003C/span>\u003Cbr>\u003Cspan>colocation dataip_with_datastore inf: mysql ( dataip datastore ) #设置排列约束 \u003C/span>\u003Cbr>\u003Cspan>order dataip_then_webstore Mandatory: dataip datastore  #设置顺序约束 \u003C/span>\u003Cbr>\u003Cspan>order datastore_then_mysql Mandatory: datastore mysql \u003C/span>\u003Cbr>\u003Cspan>crm(live)configure# commit \u003C/span>\u003C/p>","**前言**\n\n \n\n上篇文章我们介绍了使用pacemkaer+corosync实现简单的nginx高可用， 这篇文章我们介绍如何使用pacemaker+corosync实现MySQL高可用， 并且此次我们手动编辑配置文件来实现corosync的配置。\n\n \n\n**实验拓扑**\n\n \n\n**实验环境**\n\n \n\n主机                    IP                功用 \nnode1.anyisalin.com        172.16.1.2        MySQL服务, HA节点 \nnode2.anyisalin.com        172.16.1.3      MySQL服务, HA节点 \nnfs.anyisalin.com        172.16.1.4        提供nfs服务，数据库文件\n\n \n\n注意: 本文实验中所有主机SElinux和iptables都是关闭的\n\n \n\n**实验步骤**\n\n \n\n**准备工作**\n\n \n\n高可用集群必须保证所有节点主机互信, 主机名解析一致, 时间同步\n\n \n\n配置hosts文件同步\n\n \n\n配置互信\n\n \n\n时间同步\n\n \n\n**安装HA组件并配置**\n\n \n\n我们这次直接安装并手动配置pacemaker+corosync\n\n \n\n安装corosync+pacemaker在两个节点上 \n\n[root@node1 ~]# yum install corosync pacemaker -y &> /dev/null && echo success \n\nsuccess \n\n[root@node1 ~]# ssh node2.anyisalin.com \"yum install corosync pacemaker -y &> /dev/null && echo success\" \n\nsuccess \n\n**编辑配置文件**\n\n \n\n[root@node1 corosync]# vim corosync.conf \n\n        totem { \n\n            version: 2 \n\n        crypto_cipher: none \n\n        crypto_hash: none \n\n            interface { \n\n                ringnumber: 0 \n\n                bindnetaddr: 172.16.1.0 \n\n                mcastaddr: 239.185.1.31 \n\n                mcastport: 5405 \n\n                ttl: 1 \n\n            } \n\n        } \n\n        nodelist { \n\n                node { \n\n                        ring0_addr: 172.16.1.2 \n\n                        nodeid: 1 \n\n                } \n\n                node { \n\n                        ring0_addr: 172.16.1.3 \n\n                        nodeid: 2 \n\n                } \n\n        } \n\n        logging { \n\n            fileline: off \n\n            to_stderr: no \n\n            to_logfile: yes \n\n            logfile: /var/log/cluster/corosync.log \n\n            to_syslog: no \n\n            debug: off \n\n            timestamp: on \n\n            logger_subsys { \n\n                subsys: QUORUM \n\n                debug: off \n\n            } \n\n        } \n\n        quorum { \n\n            provider: corosync_votequorum \n\n        } \n\n**启动corosync和pacemaker**\n\n \n\n[root@node1 corosync]# scp corosync.conf node2.anyisalin.com:/etc/corosync/ \n\n[root@node1 corosync]# systemctl start corosync pacemkaer \n\n[root@node1 corosync]# ssh node2.anyisalin.com \"systemctl start corosync pacemkaer\" \n\n**查看集群节点状态**\n\n \n\n[root@node1 corosync]# crm status   #各节点都在线 \n\nLast updated: Sun Apr 10 22:23:13 2016      Last change: Sun Apr 10 22:16:43 2016 by root via cibadmin on node1.anyisalin.com \n\nStack: corosync \n\nCurrent DC: node1.anyisalin.com (version 1.1.13-10.el7_2.2-44eb2dd) - partition with quorum \n\n2 nodes and 0 resources configured \n\nOnline: [ node1.anyisalin.com node2.anyisalin.com ] \n\n**配置NFS**\n\n \n\n对于NFS配置这次比较复杂\n\n \n\n[root@nfs ~]# vim /etc/exports \n\n/datadir    172.16.1.0/24(rw,no_root_squash) \n\n[root@nfs ~]# useradd -u 3306 mysql  #创建mysql用户 \n\n[root@nfs ~]# mkdir /datadir \n\n[root@nfs ~]# setfacl -m u:mysql:rwx /datadir/  #赋予mysql用户权限 \n\n[root@nfs ~]# exportfs -rv   #重新导出目录 \n\nexporting 172.16.1.0/24:/datadir \n\n**配置MySQL**\n\n \n\nMySQL我们使用通用二进制的包安装, 安装过程有疑问的可以看我以前的LAMP安装的文章\n\n \n\n在node1上操作\n\n \n\n[root@node1 corosync]# tar xf mysql-5.5.33-linux2.6-x86_64.tar.gz -C /usr/src/ \n\n[root@node1 corosync]# cd /usr/src/mysql-5.5.33-linux2.6-x86_64/ \n\n[root@node1 mysql-5.5.33-linux2.6-x86_64]# groupadd -g 3306 -r mysql \n\n[root@node1 mysql-5.5.33-linux2.6-x86_64]# useradd -u 3306 -g mysql mysql \n\n[root@node1 mysql-5.5.33-linux2.6-x86_64]# mkdir /datadir \n\n[root@node1 mysql-5.5.33-linux2.6-x86_64]# mount -t nfs 172.16.1.4:/datadir /datadir/ #挂载nfs到本地 \n\n[root@node1 mysql-5.5.33-linux2.6-x86_64]# ./scripts/mysql_install_db --user=mysql --datadir=/datadir #初始化MySQL生成数据库文件 \n\n[root@node1 mysql-5.5.33-linux2.6-x86_64]# ls /datadir/ \n\nmysql  performance_schema  test \n\n[root@node1 mysql-5.5.33-linux2.6-x86_64]# cp support-files/my-large.cnf /etc/my.cnf \n\n[root@node1 mysql-5.5.33-linux2.6-x86_64]# vim /etc/my.cnf #添加以下几行 \n\ndatadir=/datadir \n\ninnodb_file_per_table = on \n\nskip_name_resolve = on \n\n[root@node1 mysql-5.5.33-linux2.6-x86_64]# cp support-files/mysql.server /etc/init.d/mysqld \n\n[root@node1 mysql-5.5.33-linux2.6-x86_64]# cd /usr/local/ \n\n[root@node1 local]# ln -sv /usr/src/mysql-5.5.33-linux2.6-x86_64/ mysql  #创建软链接 \n\n[root@node1 ~]# service mysqld start  #启动mysql \n\nStarting MySQL.. SUCCESS! \n\n[root@node1 ~]# /usr/local/mysql/bin/mysql  #登录成功 \n\nmysql> \n\n在node2上操作 \n\n[root@node2 ~]# tar xf mysql-5.5.33-linux2.6-x86_64.tar.gz  -C /usr/src/ \n\n[root@node2 ~]# mkdir /datadir \n\n[root@node2 ~]# mount -t nfs 172.16.1.4:/datadir /datadir/ \n\n[root@node2 ~]# ls /datadir/ \n\nibdata1  ib_logfile0  ib_logfile1  mysql  mysql-bin.000001  mysql-bin.000002  mysql-bin.index  node1.anyisalin.com.err  node1.anyisalin.com.pid  performance_schema  test \n\n[root@node2 ~]# scp node1.anyisalin.com:/etc/my.cnf /etc/ \n\n[root@node2 ~]# scp node1.anyisalin.com:/etc/init.d/mysqld /etc/init.d/ \n\n[root@node2 ~]# cd /usr/local/ \n\n[root@node2 local]# groupadd -g 3306 -r mysql \n\n[root@node2 local]# useradd -g mysql -u  3306 mysql \n\n[root@node2 local]# ln -sv /usr/src/mysql-5.5.33-linux2.6-x86_64/ mysql \n\n‘mysql’ -> ‘/usr/src/mysql-5.5.33-linux2.6-x86_64/’ \n\n[root@node2 ~]# service mysqld start #因为node1在运行所以不能运行 \n\nStarting MySQL........ \n\n[root@node2 ~]# ssh node1.anyisalin.com \"service mysqld stop\" \n\n[root@node2 local]# service mysqld start  #启动成功 \n\nStarting MySQL SUCCESS! \n\n[root@node2 local]# /usr/local/mysql/bin/mysql  #能够登录 \n\nmysql> \n\n#测试完成后将mysql服务停止并卸载nfs \n\n[root@node2 local]# service mysqld stop \n\nShutting down MySQL. SUCCESS! \n\n[root@node2 local]# umount /datadir/ \n\n[root@node1 ~]# umount /datadir/ \n\n**配置HA资源**\n\n \n\n配置HA资源\n\n \n\ncrm(live)# configure \n\ncrm(live)configure# primitive dataip ocf:heartbeat:IPaddr params ip=172.16.1.8 \n\ncrm(live)configure# primitive datastore ocf:heartbeat:Filesystem params device=\"172.16.1.4:/datadir\" fstype=\"nfs\" directory=\"/datadir\" op \n\ncrm(live)configure# primitive mysql service:mysqld   \n\ncrm(live)configure# property stonith-enabled=false \n\ncolocation dataip_with_datastore inf: mysql ( dataip datastore ) #设置排列约束 \n\norder dataip_then_webstore Mandatory: dataip datastore  #设置顺序约束 \n\norder datastore_then_mysql Mandatory: datastore mysql \n\ncrm(live)configure# commit ","/article/45",4805,"2016-06-27 17:12:53","2018-10-18 17:13:50",[156,157,158],{"id":39,"name":81,"url":82},{"id":44,"name":23,"url":59},{"id":145,"name":146,"url":151},{"create_time":6,"description":6,"id":44,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":23,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":53,"subtitle":6,"update_time":6,"url":59},{"title":161,"url":162},"15 个有用的 MySQL/MariaDB 性能调整和优化技巧 ","/article/46",{"title":164,"url":165},"CentOS7.2 调整mysql数据库最大连接数及最大文件打开数 ","/article/43",[167,168,169,170],{"create_time":6,"description":6,"id":44,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":23,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":53,"subtitle":6,"update_time":6,"url":59},{"create_time":6,"description":6,"id":45,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":61,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":56,"subtitle":6,"update_time":6,"url":62},{"create_time":6,"description":6,"id":46,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":64,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":65,"subtitle":6,"update_time":6,"url":66},{"create_time":6,"description":6,"id":47,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":68,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":69,"subtitle":6,"update_time":6,"url":70},{"description":148,"keywords":147,"title":146},[173,184,195,206,217,228,239,250,261,271],{"id":174,"category_id":44,"title":175,"keywords":176,"description":177,"image_url":6,"content":178,"content_md":179,"url":180,"hits":181,"is_recommend":73,"is_top":73,"create_time":182,"update_time":183},101,"开启 HTTPS 并获得 ssllabs 满分的过程","开启,获得,满分,过程","准备工作确保你要申请证书的域名都解析到了这台服务器上，且能直接通过域名访问。使用官网推荐的CertBot获取证书。在CertBot官网选择一下环境(比如我选Nginx on Ubuntu 17.04)就可以看到入门教程了。安装CertBot12345apt-get updateapt-get install software-properties-commonadd-apt-repository ppa:certbot/certbotapt-get updateapt-get","\u003Cp style=\"text-align: justify;\">\u003Cb>一、准备工作\u003C/b>\u003C/p>\u003Cp style=\"text-align: justify;\">确保你要申请证书的域名都解析到了这台服务器上，且能直接通过域名访问。\u003C/p>\u003Cp style=\"text-align: justify;\">使用官网推荐的CertBot获取证书。\u003C/p>\u003Cp style=\"text-align: justify;\">在CertBot官网选择一下环境(比如我选Nginx on Ubuntu 17.04)就可以看到入门教程了。\u003C/p>\u003Cp style=\"text-align: justify;\">安装CertBot\u003C/p>\u003Cp style=\"text-align: justify;\">[root@zhl123.cn ~]# apt-get update\u003C/p>\u003Cp style=\"text-align: justify;\">[root@zhl123.cn ~]# apt-get install software-properties-common\u003C/p>\u003Cp style=\"text-align: justify;\">[root@zhl123.cn ~]# add-apt-repository ppa:certbot/certbot\u003C/p>\u003Cp style=\"text-align: justify;\">[root@zhl123.cn ~]# apt-get update\u003C/p>\u003Cp style=\"text-align: justify;\">[root@zhl123.cn ~]# apt-get install python-certbot-nginx\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cb>二、获取证书\u003C/b>\u003C/p>\u003Cp style=\"text-align: justify;\">我是把几个域名都放到一张证书里的，这样可以支持一些比较旧的，不支持SNI的浏览器\u003C/p>\u003Cp style=\"text-align: justify;\">[root@zhl123.cn ~]# certbot certonly --must-staple --rsa-key-size 4096 -d 域名1 -d 域名2...\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">这步的-rsa-key-size 4096是为了ssllabs满分，如果你不想弄这个可以不加，能略微提升网站访问速度。\u003C/p>\u003Cp style=\"text-align: justify;\">每个-d后面跟一个域名，有多少个域名跟多少个\u003C/p>\u003Cp style=\"text-align: justify;\">运行后它会让你选验证模式，我这里已经开启了nginx，因此选2，自己设置webroot\u003C/p>\u003Cp style=\"text-align: justify;\">选1然后输入你的网站静态文件所在的目录，如我的Nginx默认是/var/www/html\u003C/p>\u003Cp style=\"text-align: justify;\">之后每一个域名都需要设置，如果你所有域名都在一个目录，直接选2使用第一次输入的路径即可\u003C/p>\u003Cp style=\"text-align: justify;\">输入完最后一个域名后，它会提示你申请结果，如果失败请检查失败原因后重试，如果成功继续下一步\u003C/p>\u003Cp style=\"text-align: justify;\">我一开始因为用了国内的NS服务商，然后Let’s Encrypt访问不到就失败了，这货不会信任任何DNS服务器给出的服务器地址，必须要直接访问权威NS服务器查询的结果才可以，因此如果你因为这个失败了，建议更换一些国外的免费NS服务商。\u003C/p>\u003Cp style=\"text-align: justify;\">如果成功会告诉你申请成功，并给出你的证书路径，比如我的：/etc/letsencrypt/live/zhl123.cn/fullchain.pem\u003C/p>\u003Cp style=\"text-align: justify;\">记下这个路径(不包括fullchain.pem的部分，稍后用得着)\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cb>三、配置 DNS CAA\u003C/b>\u003C/p>\u003Cp style=\"text-align: justify;\">DNS CAA 可限制你的域名只有特定的证书签发机构可以签发证书，且无权签发的签发机构收到签发证书申请时会给你发邮件提醒\u003C/p>\u003Cp style=\"text-align: justify;\">这步不影响ssllabs评分，可不做\u003C/p>\u003Cp style=\"text-align: justify;\">你需要找一家支持CAA记录的NS服务商，国内似乎没有。。。\u003C/p>\u003Cp style=\"text-align: justify;\">我找了半天找到一家国外的：https://www.1984hosting.com/\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">通过修改域名的NS记录接入到你选择的NS服务商\u003C/p>\u003Cp style=\"text-align: justify;\">添加CAA记录，比如我的：\u003C/p>\u003Cp style=\"text-align: justify;\">issue \"letsencrypt.org\"\u003C/p>\u003Cp style=\"text-align: justify;\">iodef \"root@zhl123.cn\"\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">issue是允许哪家证书签发机构签发证书，iodef是你的邮箱地址\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">完成后可以通过dig caa 你的域名来验证是否添加成功\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cb>四、配置 nginx\u003C/b>\u003C/p>\u003Cp style=\"text-align: justify;\">编辑你每一个申请证书的域名的server配置，设置http直接跳到https\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">server {\u003C/p>\u003Cp style=\"text-align: justify;\">  listen 80;\u003C/p>\u003Cp style=\"text-align: justify;\">  server_name 域名;\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">  return 301 https://$host$request_uri;\u003C/p>\u003Cp style=\"text-align: justify;\">}\u003C/p>\u003Cp style=\"text-align: justify;\">配置每一个域名的 https\u003C/p>\u003Cp style=\"text-align: justify;\">server {\u003C/p>\u003Cp style=\"text-align: justify;\">  # 如果 http2 报错说明你的 nginx 版本比较低不支持，删掉即可\u003C/p>\u003Cp style=\"text-align: justify;\">  listen 443 ssl http2;\u003C/p>\u003Cp style=\"text-align: justify;\">  server_name 域名;\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">  ssl_certificate 证书路径/fullchain.pem;\u003C/p>\u003Cp style=\"text-align: justify;\">  ssl_certificate_key 证书路径/privkey.pem;\u003C/p>\u003Cp style=\"text-align: justify;\">  ssl_trusted_certificate 证书路径/chain.pem;\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">  # 强制域名使用 HTTPS 打开，且在证书不被信任时不允许用户跳过，这里设置的时间是 182.5 天\u003C/p>\u003Cp style=\"text-align: justify;\">  # includeSubDomains 表示包含子域名\u003C/p>\u003Cp style=\"text-align: justify;\">  # preload 表示允许被加入浏览器内置的强制 HTTPS 列表中\u003C/p>\u003Cp style=\"text-align: justify;\">  add_header Strict-Transport-Security \"max-age=15768000; includeSubDomains; preload\";\u003C/p>\u003Cp style=\"text-align: justify;\">  # 在检测到 XSS 时阻止网页加载\u003C/p>\u003Cp style=\"text-align: justify;\">  add_header X-XSS-Protection \"1; mode=block\";\u003C/p>\u003Cp style=\"text-align: justify;\">  # 禁止网页被嵌入 frame(算是避免运营商劫持的办法之一)\u003C/p>\u003Cp style=\"text-align: justify;\">  add_header X-Frame-Options DENY;\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">  # 后面可以写你的网站之前的代码，如 root /var/www/html;\u003C/p>\u003Cp style=\"text-align: justify;\">}\u003C/p>\u003Cp style=\"text-align: justify;\">配置 nginx.conf，删掉自带的 SSL 配置，用下面的覆盖\u003C/p>\u003Cp style=\"text-align: justify;\"># 只支持 TLS1.2，如果`openssl`在`1.1.1`以上，且`nginx`在`1.13`以上，可再加入`TLSv1.3`\u003C/p>\u003Cp style=\"text-align: justify;\">ssl_protocols TLSv1.2;\u003C/p>\u003Cp style=\"text-align: justify;\">ssl_prefer_server_ciphers on;\u003C/p>\u003Cp style=\"text-align: justify;\">ssl_session_timeout 1d;\u003C/p>\u003Cp style=\"text-align: justify;\">ssl_session_cache shared:SSL:10m;\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">ssl_buffer_size 4k;\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA';\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">ssl_ecdh_curve sect571r1:secp521r1:brainpoolP512r1:secp384r1:brainpoolP384r1:sect571k1;\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">ssl_stapling on;\u003C/p>\u003Cp style=\"text-align: justify;\">ssl_stapling_verify on;\u003C/p>\u003Cp style=\"text-align: justify;\">开启session_ticket\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">在 nginx 配置目录下执行\u003C/p>\u003Cp style=\"text-align: justify;\">[root@zhl123.cn ~]# mkdir ssl\u003C/p>\u003Cp style=\"text-align: justify;\">[root@zhl123.cn ~]# openssl rand 80 > ssl/ticket.key\u003C/p>\u003Cp style=\"text-align: justify;\">编辑nginx.conf，在SSL配置后面加入下面两行\u003C/p>\u003Cp style=\"text-align: justify;\">ssl_session_ticket_key ssl/ticket.key;\u003C/p>\u003Cp style=\"text-align: justify;\">ssl_session_tickets on;\u003C/p>\u003Cp style=\"text-align: justify;\">使用4096位加密\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">在 nginx 配置目录下执行\u003C/p>\u003Cp style=\"text-align: justify;\">openssl dhparam -out ssl/dhparam.pem 4096\u003C/p>\u003Cp style=\"text-align: justify;\">编辑nginx.conf，在SSL配置后面加入下面两行\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">ssl_dhparam ssl/dhparam.pem;\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cb>五、一些额外的配置\u003C/b>\u003C/p>\u003Cp style=\"text-align: justify;\">开启 HPKP\u003C/p>\u003Cp style=\"text-align: justify;\">HPKP可以检查你的证书是不是指定的证书签发机构签的，如果不是会阻止访问，也可配置出现问题时向指定地址报告等\u003C/p>\u003Cp style=\"text-align: justify;\">在你的浏览器访问https://www.ssllabs.com/ssltest/analyze.html?d=你的域名\u003C/p>\u003Cp style=\"text-align: justify;\">等测试结束后，在页面搜索Certification Paths\u003C/p>\u003Cp style=\"text-align: justify;\">点击下面的展开\u003C/p>\u003Cp style=\"text-align: justify;\">把第一行不是你的域名的Pin SHA256的值记录下来\u003C/p>\u003Cp style=\"text-align: justify;\">换一个免费证书，再来一次，比如腾讯云可以申请赛门特克的免费证书\u003C/p>\u003Cp style=\"text-align: justify;\">把你刚刚记下来的几个值(至少4个，无顺序要求)，按下面的格式写入你每一个域名的server配置中\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\"># 如果有更多按照格式加就行\u003C/p>\u003Cp style=\"text-align: justify;\">add_header Public-Key-Pins 'pin-sha256=\"第一个值\"; pin-sha256=\"第二个值\"; pin-sha256=\"第三个值\"; pin-sha256=\"第四个值\"; max-age=15768000; includeSubDomains';\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">申请浏览器内置HSTS\u003C/p>\u003Cp style=\"text-align: justify;\">HSTS可以要求用户访问你的网站必须用HTTPS协议，然而需要至少访问一次才会生效，这一次仍然有可能被劫持，而且有可能被一些更无良的运营商给HTTPS强转HTTP，用户永远不会把你加进HSTS名单\u003C/p>\u003Cp style=\"text-align: justify;\">为了解决这个尴尬的问题，浏览器商们推出了一个申请地址，符合要求的域名可以申请把自己加入浏览器的源代码中，这样用户首次访问的时候也会强制用HTTPS访问\u003C/p>\u003Cp style=\"text-align: justify;\">请一定注意，一旦申请成功，就没有回头路了，如果哪天你不想用HTTPS了，那就只能换个域名了。\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">确保你申请证书的时候包含你的主域名，如我的是zhl123.cn，不能带任何子域名，如www.zhl123.cn无效\u003C/p>\u003Cp style=\"text-align: justify;\">确保你照做了上面的4.2\u003C/p>\u003Cp style=\"text-align: justify;\">访问申请页面，输入你的主域名，提交即可，稍后的提示确认，打勾后再提交即可\u003C/p>\u003Cp style=\"text-align: justify;\">耐心等待审核，一般一个月内可审核完成，审核完成之前请不要修改网站配置。\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cb>六、自动重新签发证书\u003C/b>\u003C/p>\u003Cp style=\"text-align: justify;\">Let’s Encrypt申请的证书只有3个月有效期，每隔3个月都手动来重新签发一次。\u003C/p>\u003Cp style=\"text-align: justify;\">通过crontab在每月1号自动重新签发证书\u003C/p>\u003Cp style=\"text-align: justify;\">执行crontab -e,添加下面一行保存即可\u003C/p>\u003Cp style=\"text-align: justify;\">0 0 1 * * certbot renew --force-renew && /etc/init.d/nginx reload\u003C/p>\u003Col style=\"text-align: justify;\">\u003Cli>\u003Cfigure class=\"highlight plain\">\u003C/figure>\u003C/li>\u003C/ol>","**一、准备工作**\n\n确保你要申请证书的域名都解析到了这台服务器上，且能直接通过域名访问。\n\n使用官网推荐的CertBot获取证书。\n\n在CertBot官网选择一下环境(比如我选Nginx on Ubuntu 17.04)就可以看到入门教程了。\n\n安装CertBot\n\n[root@zhl123.cn ~]# apt-get update\n\n[root@zhl123.cn ~]# apt-get install software-properties-common\n\n[root@zhl123.cn ~]# add-apt-repository ppa:certbot/certbot\n\n[root@zhl123.cn ~]# apt-get update\n\n[root@zhl123.cn ~]# apt-get install python-certbot-nginx\n\n**二、获取证书**\n\n我是把几个域名都放到一张证书里的，这样可以支持一些比较旧的，不支持SNI的浏览器\n\n[root@zhl123.cn ~]# certbot certonly --must-staple --rsa-key-size 4096 -d 域名1 -d 域名2...\n\n这步的-rsa-key-size 4096是为了ssllabs满分，如果你不想弄这个可以不加，能略微提升网站访问速度。\n\n每个-d后面跟一个域名，有多少个域名跟多少个\n\n运行后它会让你选验证模式，我这里已经开启了nginx，因此选2，自己设置webroot\n\n选1然后输入你的网站静态文件所在的目录，如我的Nginx默认是/var/www/html\n\n之后每一个域名都需要设置，如果你所有域名都在一个目录，直接选2使用第一次输入的路径即可\n\n输入完最后一个域名后，它会提示你申请结果，如果失败请检查失败原因后重试，如果成功继续下一步\n\n我一开始因为用了国内的NS服务商，然后Let’s Encrypt访问不到就失败了，这货不会信任任何DNS服务器给出的服务器地址，必须要直接访问权威NS服务器查询的结果才可以，因此如果你因为这个失败了，建议更换一些国外的免费NS服务商。\n\n如果成功会告诉你申请成功，并给出你的证书路径，比如我的：/etc/letsencrypt/live/zhl123.cn/fullchain.pem\n\n记下这个路径(不包括fullchain.pem的部分，稍后用得着)\n\n**三、配置 DNS CAA**\n\nDNS CAA 可限制你的域名只有特定的证书签发机构可以签发证书，且无权签发的签发机构收到签发证书申请时会给你发邮件提醒\n\n这步不影响ssllabs评分，可不做\n\n你需要找一家支持CAA记录的NS服务商，国内似乎没有。。。\n\n我找了半天找到一家国外的：https://www.1984hosting.com/\n\n通过修改域名的NS记录接入到你选择的NS服务商\n\n添加CAA记录，比如我的：\n\nissue \"letsencrypt.org\"\n\niodef \"root@zhl123.cn\"\n\nissue是允许哪家证书签发机构签发证书，iodef是你的邮箱地址\n\n完成后可以通过dig caa 你的域名来验证是否添加成功\n\n**四、配置 nginx**\n\n编辑你每一个申请证书的域名的server配置，设置http直接跳到https\n\nserver {\n\n  listen 80;\n\n  server_name 域名;\n\n  return 301 https://$host$request_uri;\n\n}\n\n配置每一个域名的 https\n\nserver {\n\n  # 如果 http2 报错说明你的 nginx 版本比较低不支持，删掉即可\n\n  listen 443 ssl http2;\n\n  server_name 域名;\n\n  ssl_certificate 证书路径/fullchain.pem;\n\n  ssl_certificate_key 证书路径/privkey.pem;\n\n  ssl_trusted_certificate 证书路径/chain.pem;\n\n  # 强制域名使用 HTTPS 打开，且在证书不被信任时不允许用户跳过，这里设置的时间是 182.5 天\n\n  # includeSubDomains 表示包含子域名\n\n  # preload 表示允许被加入浏览器内置的强制 HTTPS 列表中\n\n  add_header Strict-Transport-Security \"max-age=15768000; includeSubDomains; preload\";\n\n  # 在检测到 XSS 时阻止网页加载\n\n  add_header X-XSS-Protection \"1; mode=block\";\n\n  # 禁止网页被嵌入 frame(算是避免运营商劫持的办法之一)\n\n  add_header X-Frame-Options DENY;\n\n  # 后面可以写你的网站之前的代码，如 root /var/www/html;\n\n}\n\n配置 nginx.conf，删掉自带的 SSL 配置，用下面的覆盖\n\n# 只支持 TLS1.2，如果`openssl`在`1.1.1`以上，且`nginx`在`1.13`以上，可再加入`TLSv1.3`\n\nssl_protocols TLSv1.2;\n\nssl_prefer_server_ciphers on;\n\nssl_session_timeout 1d;\n\nssl_session_cache shared:SSL:10m;\n\nssl_buffer_size 4k;\n\nssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA';\n\nssl_ecdh_curve sect571r1:secp521r1:brainpoolP512r1:secp384r1:brainpoolP384r1:sect571k1;\n\nssl_stapling on;\n\nssl_stapling_verify on;\n\n开启session_ticket\n\n在 nginx 配置目录下执行\n\n[root@zhl123.cn ~]# mkdir ssl\n\n[root@zhl123.cn ~]# openssl rand 80 > ssl/ticket.key\n\n编辑nginx.conf，在SSL配置后面加入下面两行\n\nssl_session_ticket_key ssl/ticket.key;\n\nssl_session_tickets on;\n\n使用4096位加密\n\n在 nginx 配置目录下执行\n\nopenssl dhparam -out ssl/dhparam.pem 4096\n\n编辑nginx.conf，在SSL配置后面加入下面两行\n\nssl_dhparam ssl/dhparam.pem;\n\n**五、一些额外的配置**\n\n开启 HPKP\n\nHPKP可以检查你的证书是不是指定的证书签发机构签的，如果不是会阻止访问，也可配置出现问题时向指定地址报告等\n\n在你的浏览器访问https://www.ssllabs.com/ssltest/analyze.html?d=你的域名\n\n等测试结束后，在页面搜索Certification Paths\n\n点击下面的展开\n\n把第一行不是你的域名的Pin SHA256的值记录下来\n\n换一个免费证书，再来一次，比如腾讯云可以申请赛门特克的免费证书\n\n把你刚刚记下来的几个值(至少4个，无顺序要求)，按下面的格式写入你每一个域名的server配置中\n\n# 如果有更多按照格式加就行\n\nadd_header Public-Key-Pins 'pin-sha256=\"第一个值\"; pin-sha256=\"第二个值\"; pin-sha256=\"第三个值\"; pin-sha256=\"第四个值\"; max-age=15768000; includeSubDomains';\n\n申请浏览器内置HSTS\n\nHSTS可以要求用户访问你的网站必须用HTTPS协议，然而需要至少访问一次才会生效，这一次仍然有可能被劫持，而且有可能被一些更无良的运营商给HTTPS强转HTTP，用户永远不会把你加进HSTS名单\n\n为了解决这个尴尬的问题，浏览器商们推出了一个申请地址，符合要求的域名可以申请把自己加入浏览器的源代码中，这样用户首次访问的时候也会强制用HTTPS访问\n\n请一定注意，一旦申请成功，就没有回头路了，如果哪天你不想用HTTPS了，那就只能换个域名了。\n\n确保你申请证书的时候包含你的主域名，如我的是zhl123.cn，不能带任何子域名，如www.zhl123.cn无效\n\n确保你照做了上面的4.2\n\n访问申请页面，输入你的主域名，提交即可，稍后的提示确认，打勾后再提交即可\n\n耐心等待审核，一般一个月内可审核完成，审核完成之前请不要修改网站配置。\n\n**六、自动重新签发证书**\n\nLet’s Encrypt申请的证书只有3个月有效期，每隔3个月都手动来重新签发一次。\n\n通过crontab在每月1号自动重新签发证书\n\n执行crontab -e,添加下面一行保存即可\n\n0 0 1 * * certbot renew --force-renew && /etc/init.d/nginx reload\n\n1.","/article/101",18546,"2019-11-26 16:12:11","2019-11-26 16:23:16",{"id":185,"category_id":44,"title":186,"keywords":187,"description":188,"image_url":6,"content":189,"content_md":190,"url":191,"hits":192,"is_recommend":73,"is_top":73,"create_time":193,"update_time":194},113,"在CentOS 7中添加命令自动补全功能","命令自动补全,centos","在CentOS 7中，默认情况下并不会安装命令补全包，需要手动安装才能使用命令补全功能。以下是在CentOS 7中安装命令补全包的方法：1. bash-completion：这是一个针对Bash shell的命令补全软件包，可以提供对系统命令、用户自定义命令和文件路径的自动补全功能。可以通过以下命令安装：```sudo yum install bash-completion```安装完成后，需要在/etc/profile配置文件中添加以下内容：```if [ -f /etc/bash_compl","\u003Cp>在CentOS 7中，默认情况下并不会安装命令补全包，需要手动安装才能使用命令补全功能。以下是在CentOS 7中安装命令补全包的方法：\u003C/p>\u003Cp>\u003Cbr>\u003C/p>\u003Cp>1. bash-completion：这是一个针对Bash shell的命令补全软件包，可以提供对系统命令、用户自定义命令和文件路径的自动补全功能。可以通过以下命令安装：\u003C/p>\u003Cp>\u003Cbr>\u003C/p>\u003Cp>```\u003C/p>\u003Cp>sudo yum install bash-completion\u003C/p>\u003Cp>```\u003C/p>\u003Cp>\u003Cbr>\u003C/p>\u003Cp>安装完成后，需要在/etc/profile配置文件中添加以下内容：\u003C/p>\u003Cp>\u003Cbr>\u003C/p>\u003Cp>```\u003C/p>\u003Cp>\u003Cbr>\u003C/p>\u003Cp>if [ -f /etc/bash_completion ]; then\u003C/p>\u003Cp>    . /etc/bash_completion\u003C/p>\u003Cp>fi\u003C/p>\u003Cp>```\u003C/p>\u003Cp>\u003Cbr>\u003C/p>\u003Cp>2. yum-utils：这是一个包管理工具，在安装软件包时可以提供命令补全功能。可以通过以下命令安装：\u003C/p>\u003Cp>\u003Cbr>\u003C/p>\u003Cp>```\u003C/p>\u003Cp>sudo yum install yum-utils\u003C/p>\u003Cp>```\u003C/p>\u003Cp>\u003Cbr>\u003C/p>\u003Cp>安装完成后，即可使用yum命令的自动补全功能。\u003C/p>\u003Cp>\u003Cbr>\u003C/p>\u003Cp>安装完成后，可以在命令行中输入部分命令，然后按下Tab键进行自动补全。此外，在输入文件路径时，也可以按下Tab键进行自动补全。\u003C/p>\u003Cp>\u003Cbr>\u003C/p>\u003Cp>\u003Cimg src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABfEAAADmCAYAAAB1T89oAAAgAElEQVR4nO3dv24a2/c34M/31e8uaJCT5tSU7pCiVOEKhpIiTZSOdlq6ozSnoIQrIFUUiY6S+jQnEQ3X4bcAbMDYZrCxx87zSFvKn+1hz8yaAdZsr50kV4dbcTVaLq+WO212NRrNrpbL5dWouOnbKmd7/fbarLxq3dp+66qc3e67vV1N+3Paa7zeNtscXRUP9C1G94x5b7zF6Pj9Ona7jz9ms6uy9fh9q3pcRweOxf45O7xvh2On2vG94/wWo/XPPHze69te2fXWKq9md73+qHj4nG1+fqfv6fF76JjctW9V+mpvtb2y6+36HnfTZqPRgWuo2r16uz18XRzep0PvR9XeA44/F1Va1fehap8fjomFave+1/WZwPXmejt87fiMqGmapml/Xvt/udM43U4/w8Vi/fdFpv3L/P1r9edf/979k8eZp/zSz/R6+/Ane9vX27h7mU5/mt2XX2Qx7afzpcx8p2/jdt/FNP29flW3W90833+uN7z4me93bOycY/jR7Wd6vd1Fpv1OuuO9UZaX6Qynuek2zbCziZ1D4z3++N6xgXSGiyTtDEbF8TtTK6/sepuX+dLZ3946xvYDoqJT4vdWzN079OP78la9suvt+h63spj2c3nXDXXtmHv1toevi3nKy07608VOn8Vimn7nMuXWhVntPeDQufhy5/vFsaq+D1Xx6PesJ/PynwmO43rb99autw2fEQHgz1Qp6796Qn/3DBRN056uud7+xHb8DEXtaZvrTdOer73+6829Wns9zfX2VprjoGmapml/crtnJn5SlKOURev6761ilM/t3DsDBTiN6w2ej+sNno/rDZ6P6w0A4G36v3v/9107vV47vcHuP0//ee5fYYU/gOsNno/rDZ6P6w2ej+sNAOBNuncm/vjvfobTraJ4i4frDgKncb3B83G9wfNxvcHzcb0BALxN/8uqrg4AAAAAAFAz987EBwAAAAAAXo4kPgAAAAAA1JQkPgAAAAAA1NQRSfwio+Uyy+s2SnH+cdVDq8xsZ9+XWc7KtF56XHepNN5Wytkfdj7vVT3OW+Vs6/iufn5WPnN0FKMsX+J1AQAAAIBn8fZm4m8S2SOp6VflFZ63v941k9//ZZ4krfe5yCI/v89feliHvcLjCwAAAABUSeIvhuk0Gmk0uhmfcUDPqlWkHM12Zq/PZqMUm0nN8zKXjUYajUYajX6mLzrYI7y28dbKON1GI41GJ8PFMf2LfGwni1//rv7617s08zv/PXcOf9xNo9HIZVnThwcAAAAAwKO8vZn4xypGmU0G+ZB/8mWT+O708zPtDCazqE7CvfZm3herjH7+feFhAQAAAABvyxMm8XdrrLfK0fUM99mo2KvL3kpx3wz4yn03r73MctJLM0nag53a8DtVRFplZoN2MuzksjvO9Rzm+TjlZT/TNNP7emrZkSr7lrSKUWaz7Rr2h/u2WkVGs9nWPs0yKveP66laKUezre3etdXHnbflbJRyp3PF8/biturmT3ppppneZPX3QTtJs5fJY9ZNaBUpZ1vnoWit6u7fOg5bx21zHg6es3Mf3yrX/OFY97AMAAAAAO53lpn478tZJr32KmmYpNn+nE/XybpWytkkg3bz+v+TpNk8NAO+St/jFV97aS6G+bIuQdIqtpOPH5NFkov3JyRiq423GC0zGbTT3OnczuDbfhK4yNfJIO3djmn3Bpk8QZb742iSXvv6bKXd+3bg2Fbdt9t902ynN/hqId2Diowmg/SaW+dh8C1f373ooI52/zWfFKPZwVjvTWY1e1ADAAAAAPVyhiT+RT58SIb9zro2eyOd/s/8t/nv4mt6zSSLafqdTf32TvrDRZJmetsJ7KP7zlNebkriDLNIkmn/+vUbjUa6m0L+rTKf28ni5/f1gqRlvq1n5TcajXz5dZH2Tua5gkr7NlrN3s5i51g1Ov0Mf9/e9K/pMP3Obr9pkrQ/P3I2czvti816B530p0nSzIdP+1n5Cvu2rhefTDPsNHb3bfpra6MVzlst7NbNX6xjptGfJlnc7OtlmaoV6lvl56zCYXh9fDv932kfDMat49a/b+WD5zq+D13zowzazb3YaaTTnyZppv35xN9cAAAAAIA/wBmS+M38/ucy5fgmjTkfl9n8tfjYTrLI8Es3N13mGZdfVguKNt/lr1Tve7S/3qWZ5Pd6BdLiay/NTPPPelb+vPzn5AVhq+9bMu3vHqvMxym7+0ng1b+N57v9/l4n0N9VPgjbFhl+2bzePOO/V8ne5t5GTzsXF3n3qUxRFGm1bvbt/Hn5Voqt0i7L5WxV3mXrt0GK0SNKubQ+5UNzvx7+z3x/xNqyf71rZnMuNsd3Pv77yEV2X9op13wyH3dXD42aH7L/zAgAAAAAWPm/p9/kIr/uXN2zlfcXSfI7/91KeM7z3+8kzYu8byWZV+l7/Oha7y+2xrh+jZ0FSf/Nr0VWs6IrOWXfpvlxZEa7VZT5+vnDXkmdp3BovLdeveK5GKfb/5jZoJ12r7c+loNkMc3wSzflI5LdR2l9yuet0i5JM832IJP2YKvTIsO/q2y0yGg52ImL3mSZ3s3fMln2ksUwncoz8e86vvN8/7lIr/fU5/ypHXPNN/eOFwAAAABwjDPMxD8mKUwlxSiTQe8MCfwzGndz2Wik0++nP5xmusiqBvqtev/n8XvYX5cI2pT9meZmUvsi0+GX8z9M+GO45gEAAADgXM6ysO3d1rO2s561vWN/NnKVvo8cz04pmL/y7qRc+Sn71s7HBxf1bKX8vC5Hsl07v9FI59lqrZx+LubjccZlN93LzuklkKqal+mW463Z8POMy9VDhdWxu0y3cgb/fPXw7z6+rXz68Ioe3By02bdp+luxu9suPVABAAAAgDs8cxI/Gf9YLWbZ+zZKsVOj/Nt64dSb0jZV+t5y8XHrZ27MV1n76zryqxrw7XxeF0i/XmD0llWZnTQ/5NOhDZ+0b0l7MEu5vb1WkXL08Gz1VlHm271lVh4ebxWVzkWrzGhUpmht79enHJWPvuO81cfqIc9mTYXW+4tH18NPkn9/3SwQvNn/VvH1uGNWxQsc31XstDOYlXuv3UqrGGV2RLwDAAAAwJ/q2ZP42SzW2WxnMNksPDrJoH2zsOf8lL4b8+/5eetnlhltZryPf2Sa5GIz5Xle5kt/mvQmWS6X+fbu96r0yy2r+uRJM73B5PZ2K+/belHPve0tJ4P0Lh5+3cngQ34fHujx462i4rm4aPcymGzvV29Vo3764/DCtg+dt7ooPqa9VQP+r1VG/4TZ97uuF1Ru9q73fzK4OHiOW+Xs5rgOVo+cmr2tYz07kBR/yeM77qY/Xezs2yZ+JoN2mhcPbwIAAAAA/lTPn8TPPOVlJ/3pItvpycVimn5nv6xGlb5bP/Oln+nirgT3OD+mSbP3NZv85Xx8U2rlsttN9/JwWZR5eZnOTm31x+xbMu420ulPszPUxTT9vYT4rdddTDPsXObvX3cO5MjxVlFh3+ZlvnT2z8Eii2k/ne5dK/k+dN7qYXfmfZGP7WRx96quFYzT7fQzvN7/Rab9zTm+b+HYY73s8R13L2/H+iYmDj2MAwAAAACSJP9LcnV/lyKj5WCrxMw0/Ub38GzqV2O9T+uksgQidY3zYrTMoL3I8M6HVgAAAADAW/YCM/HrYJxuZ5hFe5DJbFTzGuz8KYpytLM+QqsYZbWm8eNr7gMAAAAAr9MRM/HfslaK8ms+f2ineb2A6DT9TjdjSVOe2WrW/e1/n/YbubMKEQAAAADwpv3hSXyokVaR8uvn9NrrJ0qLRab/fEnXEyUAAAAA+GNJ4gMAAAAAQE39oTXxAQAAAACg/iTxAQAAAACgpiTxAQAAAACgpp45id9KOVtmuRyleN4XhqO1ilFmy2WW6zYrW+v/KHf+fblcZjkr03rZ4fLWPCbOitFuzD5uIO7XAPdyn+QEPk/C61flOnbNA/BEzMSHbcUok0E7zZceB8CfZPMFdyQVCgB/NJ8JOJXY4TUTvxxBEh+2tN5fJEmm/U4ajUYajUYuy/nqP+dlLtf/1mj0M33BcfKGPSbOxt3dmAUA6sXnSXj9qlzHrnkAnogkPmz5610zySK//pUEBQAAAABe3gNJ/N1an63yplb4bFTcquPWKkaZzbZrvY1yd2nmIqPrvrOMisMdW60io9lsq4bcLKPy9mtvxluMZrs152ajlHdtu9J4qYczxOS6jvhyucygnSTN9CYHauKfON79mJzNRjkYkq0i5XWsr66JVrn6u9+oqrNz3iervP5DMbs9zlbK0VasVRnAVl3Pp6m9z9N76pjc2t5mzZBZmdZWHM1G+7Vdj7n3bcXupLcqY9Ye7MTyoXuf9+7X6IwxuXMPfKrPk4fHcMemD/yw+2T9vXxMVhrtGePXPbUuzvR58qjvF3es7/FAaYfjY+eY7+infSZ4WJVr87Tj8Had6zvOU+dszhU71M/Tx2QxuitG7l73qEqsPzxe8Us1R8/Ef1/OMund1Apvtj/n01agFqPZqpb4djHxZju9yexg0H0cDdK+7ttMezA50K/I18kg7d2Npt0bZHJgo8VokkG7uVvPvNlOb/D11oVXdbzUz1PH5NNrpZzdjslms53BZLZ3oy8ymgzSux5sM+3Bt3x99xzj5KnUPyZXPo4m6bW3Yq337bgv7K0ys/WHi8Wwo2zPK/C0MdnOYLNmSLOXb7Nv13HUbPfydScZcOy9r5q6XEOc7uk/T07Se/LPk8uDYxh8O2IhQvfJV+dlYrKK88Wve2o9PV1Mnu/7RZXYqfId/Zye/tr8czzlfVLOhqfwVDE5/rEqcNX+uB+oX1f3i+mPjLf/+cSYfGi8cKwjk/gX+fAhGW7VCe/0f+a/zX8XowzazWQxTb/T2OozTdJM+/P+h8Z22hfDdHb65UC/5Nd0mH7n5nUbnXUdufbnW0nQj+0kmWa4NYZGp5/h9NfuRiuPl/p5wphc1xFvNBpZheJiJ4ZO/gK+ufHvjKGT/nCRpJne1pepVvk57SRZDK/7dvq/024379w8dfPU98ljzVNerrfXP6bK5vb9t7OO+WY+PPQpohhdJ6amfYmp1+GpY3J9b+wMs0jSbP5OfyvuLt6vex9979uK3fU2M+3fvH83Gunufmr23v3qvYLPk8Vo/Vt5i51xNjr9DH8/sHvuk6/Qy8VkFWeJX/fUmnq6mNz+fnETk0/w/aJS7Bz7Hb3iZ4LKznNt/hme8j55jpzNuWOH+nnKXNCP9fvpx52HSMUqUDP9sRU8J79v3jde8Ut1V3e31lU5W14tl8urUXF3v2K0vFouZ1dl66H/22xvv+9d/364tcrZgTEVV6PlahujsrwqiuKqdce2jh+vVr/21DF56vlfx9usvGpVHsNmH0ZXxb19j9tX7aXbOWPy4TjbacXoarlcXs3K1j3j3HudVnk1Wy6vlqPijv6jq3K93eVyJhZfRTvXe/fmnrUXl3sxVOXe93AcnjJerX7t9XyeXL3Ose+77pOvt9UlJiu+z2+1x8ave2rd2tN/njz++8Ud7893vDdXi53jv6M/9LqPO67HXJvVjsNNq3Idn37Nv4WYPHvO5kljR6tfO8/37tvvnZs43b0XVI/Jivkc8asd0f4vR1nk1793/V8r7y+STR3x3lHb+53/diYnzfP95yK9Az/cKsp8/fxh71dIDxmn2/+Y2aCddq+3mnWQQbKYZvilm5vJUKeMl/p56ph8apsx7Md6kszz3+8kzYu8byWZ39V3c12Yjf861D0mNw7F5H3a6Q1ufvaHmQCvyEvEZJV73ynbrcM1xOnq/nlyM4ZpxXud++Tr9XIxWcXTx697an09VUye6/tF1dg59jv6aWMpZ9slcrKawXpw2up5rs0/w1PeJ+VseApP+949/jHNoN1eldQZj5Pi4yo2d0rpPCYm7xsvVHNkOZ2qSZ8nUowyGfSOSOCvjbu5bDTS6ffTH04zXWRVn+qYGqa8Mi8Uk3CntxyTi0yniyTtDBSgfEXeckzyOr2Sz5MncZ98nV7BffJZ4pf6eAUxWZXv6K/cE8ekeODRnjom/85wkeuSOgdL6TzKG7yv82KOnIl/n83Mumn6jW6OC/P9WXitfPrQTFYVoK7/rfzczqqm45eU45uob5WzTO6ZPTAfjzPPOONy83T+Xf66frlTxsvrUodzfN+M0/2ZMXf13VwXvH51iMlTLTLsXKacr++n7UFm5b9qPb9654rJKve+U7b7Gq8hjlOHz5ObMbSzmYx1HPfJt+lcMVnFueLXPfV1qnLenuD7xV/vcrvn6bFz/3f0U6xqSZdH9X3EtXnwOLByrnhwj+JUp8TO5jdz2vlYFFlPw9/7rTYxST0cORP/fqsVndsZzMoUO49PW2kVo8xG+09V9xb1vF4E72e+P/Au3irKfDuUwG+VGY3KFK2tV2p9yqHPKNXHy2tz/nP8b34tkjQ/5FNxeEurMTTT+zbaGkMrxejbOt5/ZfNbVf/+ulnwcdO3VXw9GL+8TqfF5MNxdn43D5vKy9VCes3et72FxXmNznWfrHLvu+XiY+4Kde/db18dPk+uxpC0B7OU24NoFSnvjDH3ybfq/DF52vv8U8Sve+rrVOW8bX+/uBWTO9bJqbTzubz+IrJ+gPS4MVT5jn7LPZ8Jqjvm2qx2HG5UuY7r8Nn+aZ0rHh51j3rS2OG1OSV25t9/ZpGkPRgcKKVz+nZPIn65x5Mk8TPupj9dJM1eBpNllstNm2QyaKd5sf8D00x/9zJZ95sM1r+u8k+59SR+9TQsaaY3mFxvczL4kN/Tw0/ML9q9DCY3fZeT3uqp+f4FWHm8vDpnP8eH43PnN+g3v5bVbG+NYbJa0TyLDL/cxPu8/Ge1KvrWeCeDiztjnVfopJh8OM5a5exmW+t7abO3dR+cPeWX8HG6/XWCdjKKghGv3LnukxXufdfm3/Pz1s/s31O9d795dfg8Oe6mv3pD3um/nAzSOyrG3CfflLPE5LaH3ufPGL/uqa9ThfO2/f3iJiYv1qW/9ja7fgB0/RlyMsiH39PD89Qrxs7R39GvB37EZ4LKjrs2Kx2HmwE//L3wpL6vxLni4ZR71Flih1fnMbGTJFlk+PeBu9O53zfFL0d4miR+knH3Mp3+NIudd7hFFtN+Oge+sP/odlZf8tf9pv1O9tegmZeX6Qy33jQX0ww7l/n714EBzMt86fQz3RnA+vUPLG5Tdby8Puc+x7fi83aPlJed9KeLnT6LxTT9zuXeQk7jdDv9DK8Hu8i0v4l1C6G8FafE5MNx9szG3XSG6j6/Fee5T1a59239zJf99/DnGi91Uv3zZD/Tp/w8mWTcbdwew2Ka/rEx5j75ppwjJrc99D5/zvh1T32djj9v932/uLXR9X1r3XPaz+VdQVZlDBW/o69/6KjPBFUddW1WPA4bVT6v1+6z/RM4VzxUv0edJ3Z4fU6Jne+bLP49v9F53vdN8ctxrjRNq2crRsur5XJ2VbZefiyapmmaVo/Wuipny6vlcnRVvPhYNC1XYlJ7Ta1Vzq6Wy+XVqHj5sZy/uTY1TdO0t9OebCY+8DhFOdqpX9oqRlmtZfZwbV8AAAAA4G36v5ceALD2rp1er53eYPef766jCgAAAAC8dWbiQ02M/+5nuL3Q1OLhOqoAAAAAwNv2v6zq6gAAAAAAADWjnA5QD1UeJ/7vbKMAAAAAgFpRTgcAAAAAAGpKEh8AAAAAAGrqiCR+kdFymeV1G6U4/7jqoVVmtrPvyyxnZVovPa67VBpvK+XsDzuf96oe561ytnV8Vz8/K585OopRli/xugAAAADAs3h7M/E3ieyR1PSr8grP21/vmsnv/zJPktb7XGSRn9/nLz2sw17h8QUAAAAAqiTxF8N0Go00Gt2MzzigZ9UqUo5mO7PXZ7NRis2k5nmZy0YjjUYjjUY/0xcd7BFe23hrZZxuo5FGo5Ph4pj+RT62k8Wvf1d//etdmvmd/547hz/uptFo5LKs6cMDAAAAAOBR3t5M/GMVo8wmg3zIP/mySXx3+vmZdgaTWVQn4V57M++LVUY//77wsAAAAACAt+UJk/i7NdZb5eh6hvtsVOzVZW+luG8GfOW+m9deZjnppZkk7cFObfidKiKtMrNBOxl2ctkd53oO83yc8rKfaZrpfT217EiVfUtaxSiz2XYN+8N9W60io9lsa59mGZX7x/VUrZSj2dZ279rq487bcjZKudO54nl7cVt18ye9NNNMb7L6+6CdpNnL5DHrJrSKlLOt81C0VnX3bx2HreO2OQ8Hz9m5j2+Va/5wrHtYBgAAAAD3O8tM/PflLJNee5U0TNJsf86n62RdK+VskkG7ef3/SdJsHpoBX6Xv8YqvvTQXw3xZlyBpFdvJx4/JIsnF+xMSsdXGW4yWmQzaae50bmfwbT8JXOTrZJD2bse0e4NMniDL/XE0Sa99fbbS7n07cGyr7tvtvmm20xt8tZDuQUVGk0F6za3zMPiWr+9edFBHu/+aT4rR7GCs9yazmj2oAQAAAIB6OUMS/yIfPiTDfmddm72RTv9n/tv8d/E1vWaSxTT9zqZ+eyf94SJJM73tBPbRfecpLzclcYZZJMm0f/36jUYj3U0h/1aZz+1k8fP7ekHSMt/Ws/IbjUa+/LpIeyfzXEGlfRutZm9nsXOsGp1+hr9vb/rXdJh+Z7ffNEnanx85m7md9sVmvYNO+tMkaebDp/2sfIV9W9eLT6YZdhq7+zb9tbXRCuetFnbr5i/WMdPoT5Msbvb1skzVCvWt8nNW4TC8Pr6d/u+0Dwbj1nHr37fywXMd34eu+VEG7eZe7DTS6U+TNNP+fOJvLgAAAADAH+AMSfxmfv9zmXJ8k8acj8ts/lp8bCdZZPilm5su84zLL6sFRZvv8leq9z3aX+/STPJ7vQJp8bWXZqb5Zz0rf17+c/KCsNX3LZn2d49V5uOU3f0k8OrfxvPdfn+vE+jvKh+EbYsMv2xeb57x36tkb3Nvo6edi4u8+1SmKIq0Wjf7dv68fCvFVmmX5XK2Ku+y9dsgxegRpVxan/KhuV8P/2e+P2Jt2b/eNbM5F5vjOx//feQiuy/tlGs+mY+7q4dGzQ/Zf2YEAAAAAKz839NvcpFfd67u2cr7iyT5nf9uJTzn+e93kuZF3reSzKv0PX50rfcXW2Ncv8bOgqT/5tciq1nRlZyyb9P8ODKj3SrKfP38Ya+kzlM4NN5br17xXIzT7X/MbNBOu9dbH8tBsphm+KWb8hHJ7qO0PuXzVmmXpJlme5BJe7DVaZHh31U2WmS0HOzERW+yTO/mb5kse8limE7lmfh3Hd95vv9cpNd76nP+1I655pt7xwsAAAAAOMYZZuIfkxSmkmKUyaB3hgT+GY27uWw00un30x9OM11kVQP9Vr3/8/g97K9LBG3K/kxzM6l9kenwy/kfJvwxXPMAAAAAcC5nWdj2butZ21nP2t6xPxu5St9HjmenFMxfeXdSrvyUfWvn44OLerZSfl6XI9mund9opPNstVZOPxfz8TjjspvuZef0EkhVzct0y/HWbPh5xuXqocLq2F2mWzmDf756+Hcf31Y+fXhFD24O2uzbNP2t2N1tlx6oAAAAAMAdnjmJn4x/rBaz7H0bpdipUf5tvXDqTWmbKn1vufi49TM35qus/XUd+VUN+HY+rwukXy8wesuqzE6aH/Lp0IZP2rekPZil3N5eq0g5eni2eqso8+3eMisPj7eKSueiVWY0KlO0tvfrU47KR99x3upj9ZBns6ZC6/3Fo+vhJ8m/v24WCN7sf6v4etwxq+IFju8qdtoZzMq9126lVYwyOyLeAQAAAOBP9exJ/GwW62y2M5hsFh6dZNC+Wdhzfkrfjfn3/Lz1M8uMNjPexz8yTXKxmfI8L/OlP016kyyXy3x793tV+uWWVX3ypJneYHJ7u5X3bb2o5972lpNBehcPv+5k8CG/Dw/0+PFWUfFcXLR7GUy296u3qlE//XF4YduHzltdFB/T3qoB/9cqo3/C7Ptd1wsqN3vX+z8ZXBw8x61ydnNcB6tHTs3e1rGeHUiKv+TxHXfTny529m0TP5NBO82LhzcBAAAAAH+q50/iZ57yspP+dJHt9ORiMU2/s19Wo0rfrZ/50s90cVeCe5wf06TZ+5pN/nI+vim1ctntpnt5uCzKvLxMZ6e2+mP2LRl3G+n0p9kZ6mKa/l5C/NbrLqYZdi7z9687B3LkeKuosG/zMl86++dgkcW0n073rpV8Hzpv9bA7877Ix3ayuHtV1wrG6Xb6GV7v/yLT/uYc37dw7LFe9viOu5e3Y30TE4cexgEAAAAASZL/Jbm6v0uR0XKwVWJmmn6je3g29aux3qd1UlkCkbrGeTFaZtBeZHjnQ6s35IE70Y7/nW0UAAAAAFArLzATvw7G6XaGWbQHmcxGNa/Bzp+iKEc76yO0ilFWaxo/vuY+AAAAAPA6HTET/y1rpSi/5vOHdprXC4hO0+90M5Y05ZmtZt3f/vdpv5E7qxC9JWbiAwAAAMAtf3gSH2qkVaT8+jm99vqJ0mKR6T9f0v1TnihJ4gMAAADALZL4AAAAAABQU39oTXwAAAAAAKg/SXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAEWEvKEAAARtSURBVKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKip/w9X01Uh2hywmwAAAABJRU5ErkJggg==\" alt=\"\">\u003C/p>","在CentOS 7中，默认情况下并不会安装命令补全包，需要手动安装才能使用命令补全功能。以下是在CentOS 7中安装命令补全包的方法：\n\n1. bash-completion：这是一个针对Bash shell的命令补全软件包，可以提供对系统命令、用户自定义命令和文件路径的自动补全功能。可以通过以下命令安装：\n\n```\n\nsudo yum install bash-completion\n\n```\n\n安装完成后，需要在/etc/profile配置文件中添加以下内容：\n\n```\n\nif [ -f /etc/bash_completion ]; then\n\n    . /etc/bash_completion\n\nfi\n\n```\n\n2. yum-utils：这是一个包管理工具，在安装软件包时可以提供命令补全功能。可以通过以下命令安装：\n\n```\n\nsudo yum install yum-utils\n\n```\n\n安装完成后，即可使用yum命令的自动补全功能。\n\n安装完成后，可以在命令行中输入部分命令，然后按下Tab键进行自动补全。此外，在输入文件路径时，也可以按下Tab键进行自动补全。\n\n![](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABfEAAADmCAYAAAB1T89oAAAgAElEQVR4nO3dv24a2/c34M/31e8uaJCT5tSU7pCiVOEKhpIiTZSOdlq6ozSnoIQrIFUUiY6S+jQnEQ3X4bcAbMDYZrCxx87zSFvKn+1hz8yaAdZsr50kV4dbcTVaLq+WO212NRrNrpbL5dWouOnbKmd7/fbarLxq3dp+66qc3e67vV1N+3Paa7zeNtscXRUP9C1G94x5b7zF6Pj9Ona7jz9ms6uy9fh9q3pcRweOxf45O7xvh2On2vG94/wWo/XPPHze69te2fXWKq9md73+qHj4nG1+fqfv6fF76JjctW9V+mpvtb2y6+36HnfTZqPRgWuo2r16uz18XRzep0PvR9XeA44/F1Va1fehap8fjomFave+1/WZwPXmejt87fiMqGmapml/Xvt/udM43U4/w8Vi/fdFpv3L/P1r9edf/979k8eZp/zSz/R6+/Ane9vX27h7mU5/mt2XX2Qx7afzpcx8p2/jdt/FNP29flW3W90833+uN7z4me93bOycY/jR7Wd6vd1Fpv1OuuO9UZaX6Qynuek2zbCziZ1D4z3++N6xgXSGiyTtDEbF8TtTK6/sepuX+dLZ3946xvYDoqJT4vdWzN079OP78la9suvt+h63spj2c3nXDXXtmHv1toevi3nKy07608VOn8Vimn7nMuXWhVntPeDQufhy5/vFsaq+D1Xx6PesJ/PynwmO43rb99autw2fEQHgz1Qp6796Qn/3DBRN056uud7+xHb8DEXtaZvrTdOer73+6829Wns9zfX2VprjoGmapml/crtnJn5SlKOURev6761ilM/t3DsDBTiN6w2ej+sNno/rDZ6P6w0A4G36v3v/9107vV47vcHuP0//ee5fYYU/gOsNno/rDZ6P6w2ej+sNAOBNuncm/vjvfobTraJ4i4frDgKncb3B83G9wfNxvcHzcb0BALxN/8uqrg4AAAAAAFAz987EBwAAAAAAXo4kPgAAAAAA1JQkPgAAAAAA1NQRSfwio+Uyy+s2SnH+cdVDq8xsZ9+XWc7KtF56XHepNN5Wytkfdj7vVT3OW+Vs6/iufn5WPnN0FKMsX+J1AQAAAIBn8fZm4m8S2SOp6VflFZ63v941k9//ZZ4krfe5yCI/v89feliHvcLjCwAAAABUSeIvhuk0Gmk0uhmfcUDPqlWkHM12Zq/PZqMUm0nN8zKXjUYajUYajX6mLzrYI7y28dbKON1GI41GJ8PFMf2LfGwni1//rv7617s08zv/PXcOf9xNo9HIZVnThwcAAAAAwKO8vZn4xypGmU0G+ZB/8mWT+O708zPtDCazqE7CvfZm3herjH7+feFhAQAAAABvyxMm8XdrrLfK0fUM99mo2KvL3kpx3wz4yn03r73MctJLM0nag53a8DtVRFplZoN2MuzksjvO9Rzm+TjlZT/TNNP7emrZkSr7lrSKUWaz7Rr2h/u2WkVGs9nWPs0yKveP66laKUezre3etdXHnbflbJRyp3PF8/biturmT3ppppneZPX3QTtJs5fJY9ZNaBUpZ1vnoWit6u7fOg5bx21zHg6es3Mf3yrX/OFY97AMAAAAAO53lpn478tZJr32KmmYpNn+nE/XybpWytkkg3bz+v+TpNk8NAO+St/jFV97aS6G+bIuQdIqtpOPH5NFkov3JyRiq423GC0zGbTT3OnczuDbfhK4yNfJIO3djmn3Bpk8QZb742iSXvv6bKXd+3bg2Fbdt9t902ynN/hqId2Diowmg/SaW+dh8C1f373ooI52/zWfFKPZwVjvTWY1e1ADAAAAAPVyhiT+RT58SIb9zro2eyOd/s/8t/nv4mt6zSSLafqdTf32TvrDRZJmetsJ7KP7zlNebkriDLNIkmn/+vUbjUa6m0L+rTKf28ni5/f1gqRlvq1n5TcajXz5dZH2Tua5gkr7NlrN3s5i51g1Ov0Mf9/e9K/pMP3Obr9pkrQ/P3I2czvti816B530p0nSzIdP+1n5Cvu2rhefTDPsNHb3bfpra6MVzlst7NbNX6xjptGfJlnc7OtlmaoV6lvl56zCYXh9fDv932kfDMat49a/b+WD5zq+D13zowzazb3YaaTTnyZppv35xN9cAAAAAIA/wBmS+M38/ucy5fgmjTkfl9n8tfjYTrLI8Es3N13mGZdfVguKNt/lr1Tve7S/3qWZ5Pd6BdLiay/NTPPPelb+vPzn5AVhq+9bMu3vHqvMxym7+0ng1b+N57v9/l4n0N9VPgjbFhl+2bzePOO/V8ne5t5GTzsXF3n3qUxRFGm1bvbt/Hn5Voqt0i7L5WxV3mXrt0GK0SNKubQ+5UNzvx7+z3x/xNqyf71rZnMuNsd3Pv77yEV2X9op13wyH3dXD42aH7L/zAgAAAAAWPm/p9/kIr/uXN2zlfcXSfI7/91KeM7z3+8kzYu8byWZV+l7/Oha7y+2xrh+jZ0FSf/Nr0VWs6IrOWXfpvlxZEa7VZT5+vnDXkmdp3BovLdeveK5GKfb/5jZoJ12r7c+loNkMc3wSzflI5LdR2l9yuet0i5JM832IJP2YKvTIsO/q2y0yGg52ImL3mSZ3s3fMln2ksUwncoz8e86vvN8/7lIr/fU5/ypHXPNN/eOFwAAAABwjDPMxD8mKUwlxSiTQe8MCfwzGndz2Wik0++nP5xmusiqBvqtev/n8XvYX5cI2pT9meZmUvsi0+GX8z9M+GO45gEAAADgXM6ysO3d1rO2s561vWN/NnKVvo8cz04pmL/y7qRc+Sn71s7HBxf1bKX8vC5Hsl07v9FI59lqrZx+LubjccZlN93LzuklkKqal+mW463Z8POMy9VDhdWxu0y3cgb/fPXw7z6+rXz68Ioe3By02bdp+luxu9suPVABAAAAgDs8cxI/Gf9YLWbZ+zZKsVOj/Nt64dSb0jZV+t5y8XHrZ27MV1n76zryqxrw7XxeF0i/XmD0llWZnTQ/5NOhDZ+0b0l7MEu5vb1WkXL08Gz1VlHm271lVh4ebxWVzkWrzGhUpmht79enHJWPvuO81cfqIc9mTYXW+4tH18NPkn9/3SwQvNn/VvH1uGNWxQsc31XstDOYlXuv3UqrGGV2RLwDAAAAwJ/q2ZP42SzW2WxnMNksPDrJoH2zsOf8lL4b8+/5eetnlhltZryPf2Sa5GIz5Xle5kt/mvQmWS6X+fbu96r0yy2r+uRJM73B5PZ2K+/belHPve0tJ4P0Lh5+3cngQ34fHujx462i4rm4aPcymGzvV29Vo3764/DCtg+dt7ooPqa9VQP+r1VG/4TZ97uuF1Ru9q73fzK4OHiOW+Xs5rgOVo+cmr2tYz07kBR/yeM77qY/Xezs2yZ+JoN2mhcPbwIAAAAA/lTPn8TPPOVlJ/3pItvpycVimn5nv6xGlb5bP/Oln+nirgT3OD+mSbP3NZv85Xx8U2rlsttN9/JwWZR5eZnOTm31x+xbMu420ulPszPUxTT9vYT4rdddTDPsXObvX3cO5MjxVlFh3+ZlvnT2z8Eii2k/ne5dK/k+dN7qYXfmfZGP7WRx96quFYzT7fQzvN7/Rab9zTm+b+HYY73s8R13L2/H+iYmDj2MAwAAAACSJP9LcnV/lyKj5WCrxMw0/Ub38GzqV2O9T+uksgQidY3zYrTMoL3I8M6HVgAAAADAW/YCM/HrYJxuZ5hFe5DJbFTzGuz8KYpytLM+QqsYZbWm8eNr7gMAAAAAr9MRM/HfslaK8ms+f2ineb2A6DT9TjdjSVOe2WrW/e1/n/YbubMKEQAAAADwpv3hSXyokVaR8uvn9NrrJ0qLRab/fEnXEyUAAAAA+GNJ4gMAAAAAQE39oTXxAQAAAACg/iTxAQAAAACgpiTxAQAAAACgpp45id9KOVtmuRyleN4XhqO1ilFmy2WW6zYrW+v/KHf+fblcZjkr03rZ4fLWPCbOitFuzD5uIO7XAPdyn+QEPk/C61flOnbNA/BEzMSHbcUok0E7zZceB8CfZPMFdyQVCgB/NJ8JOJXY4TUTvxxBEh+2tN5fJEmm/U4ajUYajUYuy/nqP+dlLtf/1mj0M33BcfKGPSbOxt3dmAUA6sXnSXj9qlzHrnkAnogkPmz5610zySK//pUEBQAAAABe3gNJ/N1an63yplb4bFTcquPWKkaZzbZrvY1yd2nmIqPrvrOMisMdW60io9lsq4bcLKPy9mtvxluMZrs152ajlHdtu9J4qYczxOS6jvhyucygnSTN9CYHauKfON79mJzNRjkYkq0i5XWsr66JVrn6u9+oqrNz3iervP5DMbs9zlbK0VasVRnAVl3Pp6m9z9N76pjc2t5mzZBZmdZWHM1G+7Vdj7n3bcXupLcqY9Ye7MTyoXuf9+7X6IwxuXMPfKrPk4fHcMemD/yw+2T9vXxMVhrtGePXPbUuzvR58qjvF3es7/FAaYfjY+eY7+infSZ4WJVr87Tj8Had6zvOU+dszhU71M/Tx2QxuitG7l73qEqsPzxe8Us1R8/Ef1/OMund1Apvtj/n01agFqPZqpb4djHxZju9yexg0H0cDdK+7ttMezA50K/I18kg7d2Npt0bZHJgo8VokkG7uVvPvNlOb/D11oVXdbzUz1PH5NNrpZzdjslms53BZLZ3oy8ymgzSux5sM+3Bt3x99xzj5KnUPyZXPo4m6bW3Yq337bgv7K0ys/WHi8Wwo2zPK/C0MdnOYLNmSLOXb7Nv13HUbPfydScZcOy9r5q6XEOc7uk/T07Se/LPk8uDYxh8O2IhQvfJV+dlYrKK88Wve2o9PV1Mnu/7RZXYqfId/Zye/tr8czzlfVLOhqfwVDE5/rEqcNX+uB+oX1f3i+mPjLf/+cSYfGi8cKwjk/gX+fAhGW7VCe/0f+a/zX8XowzazWQxTb/T2OozTdJM+/P+h8Z22hfDdHb65UC/5Nd0mH7n5nUbnXUdufbnW0nQj+0kmWa4NYZGp5/h9NfuRiuPl/p5wphc1xFvNBpZheJiJ4ZO/gK+ufHvjKGT/nCRpJne1pepVvk57SRZDK/7dvq/024379w8dfPU98ljzVNerrfXP6bK5vb9t7OO+WY+PPQpohhdJ6amfYmp1+GpY3J9b+wMs0jSbP5OfyvuLt6vex9979uK3fU2M+3fvH83Gunufmr23v3qvYLPk8Vo/Vt5i51xNjr9DH8/sHvuk6/Qy8VkFWeJX/fUmnq6mNz+fnETk0/w/aJS7Bz7Hb3iZ4LKznNt/hme8j55jpzNuWOH+nnKXNCP9fvpx52HSMUqUDP9sRU8J79v3jde8Ut1V3e31lU5W14tl8urUXF3v2K0vFouZ1dl66H/22xvv+9d/364tcrZgTEVV6PlahujsrwqiuKqdce2jh+vVr/21DF56vlfx9usvGpVHsNmH0ZXxb19j9tX7aXbOWPy4TjbacXoarlcXs3K1j3j3HudVnk1Wy6vlqPijv6jq3K93eVyJhZfRTvXe/fmnrUXl3sxVOXe93AcnjJerX7t9XyeXL3Ose+77pOvt9UlJiu+z2+1x8ave2rd2tN/njz++8Ud7893vDdXi53jv6M/9LqPO67HXJvVjsNNq3Idn37Nv4WYPHvO5kljR6tfO8/37tvvnZs43b0XVI/Jivkc8asd0f4vR1nk1793/V8r7y+STR3x3lHb+53/diYnzfP95yK9Az/cKsp8/fxh71dIDxmn2/+Y2aCddq+3mnWQQbKYZvilm5vJUKeMl/p56ph8apsx7Md6kszz3+8kzYu8byWZ39V3c12Yjf861D0mNw7F5H3a6Q1ufvaHmQCvyEvEZJV73ynbrcM1xOnq/nlyM4ZpxXud++Tr9XIxWcXTx697an09VUye6/tF1dg59jv6aWMpZ9slcrKawXpw2up5rs0/w1PeJ+VseApP+949/jHNoN1eldQZj5Pi4yo2d0rpPCYm7xsvVHNkOZ2qSZ8nUowyGfSOSOCvjbu5bDTS6ffTH04zXWRVn+qYGqa8Mi8Uk3CntxyTi0yniyTtDBSgfEXeckzyOr2Sz5MncZ98nV7BffJZ4pf6eAUxWZXv6K/cE8ekeODRnjom/85wkeuSOgdL6TzKG7yv82KOnIl/n83Mumn6jW6OC/P9WXitfPrQTFYVoK7/rfzczqqm45eU45uob5WzTO6ZPTAfjzPPOONy83T+Xf66frlTxsvrUodzfN+M0/2ZMXf13VwXvH51iMlTLTLsXKacr++n7UFm5b9qPb9654rJKve+U7b7Gq8hjlOHz5ObMbSzmYx1HPfJt+lcMVnFueLXPfV1qnLenuD7xV/vcrvn6bFz/3f0U6xqSZdH9X3EtXnwOLByrnhwj+JUp8TO5jdz2vlYFFlPw9/7rTYxST0cORP/fqsVndsZzMoUO49PW2kVo8xG+09V9xb1vF4E72e+P/Au3irKfDuUwG+VGY3KFK2tV2p9yqHPKNXHy2tz/nP8b34tkjQ/5FNxeEurMTTT+zbaGkMrxejbOt5/ZfNbVf/+ulnwcdO3VXw9GL+8TqfF5MNxdn43D5vKy9VCes3et72FxXmNznWfrHLvu+XiY+4Kde/db18dPk+uxpC0B7OU24NoFSnvjDH3ybfq/DF52vv8U8Sve+rrVOW8bX+/uBWTO9bJqbTzubz+IrJ+gPS4MVT5jn7LPZ8Jqjvm2qx2HG5UuY7r8Nn+aZ0rHh51j3rS2OG1OSV25t9/ZpGkPRgcKKVz+nZPIn65x5Mk8TPupj9dJM1eBpNllstNm2QyaKd5sf8D00x/9zJZ95sM1r+u8k+59SR+9TQsaaY3mFxvczL4kN/Tw0/ML9q9DCY3fZeT3uqp+f4FWHm8vDpnP8eH43PnN+g3v5bVbG+NYbJa0TyLDL/cxPu8/Ge1KvrWeCeDiztjnVfopJh8OM5a5exmW+t7abO3dR+cPeWX8HG6/XWCdjKKghGv3LnukxXufdfm3/Pz1s/s31O9d795dfg8Oe6mv3pD3um/nAzSOyrG3CfflLPE5LaH3ufPGL/uqa9ThfO2/f3iJiYv1qW/9ja7fgB0/RlyMsiH39PD89Qrxs7R39GvB37EZ4LKjrs2Kx2HmwE//L3wpL6vxLni4ZR71Flih1fnMbGTJFlk+PeBu9O53zfFL0d4miR+knH3Mp3+NIudd7hFFtN+Oge+sP/odlZf8tf9pv1O9tegmZeX6Qy33jQX0ww7l/n714EBzMt86fQz3RnA+vUPLG5Tdby8Puc+x7fi83aPlJed9KeLnT6LxTT9zuXeQk7jdDv9DK8Hu8i0v4l1C6G8FafE5MNx9szG3XSG6j6/Fee5T1a59239zJf99/DnGi91Uv3zZD/Tp/w8mWTcbdwew2Ka/rEx5j75ppwjJrc99D5/zvh1T32djj9v932/uLXR9X1r3XPaz+VdQVZlDBW/o69/6KjPBFUddW1WPA4bVT6v1+6z/RM4VzxUv0edJ3Z4fU6Jne+bLP49v9F53vdN8ctxrjRNq2crRsur5XJ2VbZefiyapmmaVo/Wuipny6vlcnRVvPhYNC1XYlJ7Ta1Vzq6Wy+XVqHj5sZy/uTY1TdO0t9OebCY+8DhFOdqpX9oqRlmtZfZwbV8AAAAA4G36v5ceALD2rp1er53eYPef766jCgAAAAC8dWbiQ02M/+5nuL3Q1OLhOqoAAAAAwNv2v6zq6gAAAAAAADWjnA5QD1UeJ/7vbKMAAAAAgFpRTgcAAAAAAGpKEh8AAAAAAGrqiCR+kdFymeV1G6U4/7jqoVVmtrPvyyxnZVovPa67VBpvK+XsDzuf96oe561ytnV8Vz8/K585OopRli/xugAAAADAs3h7M/E3ieyR1PSr8grP21/vmsnv/zJPktb7XGSRn9/nLz2sw17h8QUAAAAAqiTxF8N0Go00Gt2MzzigZ9UqUo5mO7PXZ7NRis2k5nmZy0YjjUYjjUY/0xcd7BFe23hrZZxuo5FGo5Ph4pj+RT62k8Wvf1d//etdmvmd/547hz/uptFo5LKs6cMDAAAAAOBR3t5M/GMVo8wmg3zIP/mySXx3+vmZdgaTWVQn4V57M++LVUY//77wsAAAAACAt+UJk/i7NdZb5eh6hvtsVOzVZW+luG8GfOW+m9deZjnppZkk7cFObfidKiKtMrNBOxl2ctkd53oO83yc8rKfaZrpfT217EiVfUtaxSiz2XYN+8N9W60io9lsa59mGZX7x/VUrZSj2dZ279rq487bcjZKudO54nl7cVt18ye9NNNMb7L6+6CdpNnL5DHrJrSKlLOt81C0VnX3bx2HreO2OQ8Hz9m5j2+Va/5wrHtYBgAAAAD3O8tM/PflLJNee5U0TNJsf86n62RdK+VskkG7ef3/SdJsHpoBX6Xv8YqvvTQXw3xZlyBpFdvJx4/JIsnF+xMSsdXGW4yWmQzaae50bmfwbT8JXOTrZJD2bse0e4NMniDL/XE0Sa99fbbS7n07cGyr7tvtvmm20xt8tZDuQUVGk0F6za3zMPiWr+9edFBHu/+aT4rR7GCs9yazmj2oAQAAAIB6OUMS/yIfPiTDfmddm72RTv9n/tv8d/E1vWaSxTT9zqZ+eyf94SJJM73tBPbRfecpLzclcYZZJMm0f/36jUYj3U0h/1aZz+1k8fP7ekHSMt/Ws/IbjUa+/LpIeyfzXEGlfRutZm9nsXOsGp1+hr9vb/rXdJh+Z7ffNEnanx85m7md9sVmvYNO+tMkaebDp/2sfIV9W9eLT6YZdhq7+zb9tbXRCuetFnbr5i/WMdPoT5Msbvb1skzVCvWt8nNW4TC8Pr6d/u+0Dwbj1nHr37fywXMd34eu+VEG7eZe7DTS6U+TNNP+fOJvLgAAAADAH+AMSfxmfv9zmXJ8k8acj8ts/lp8bCdZZPilm5su84zLL6sFRZvv8leq9z3aX+/STPJ7vQJp8bWXZqb5Zz0rf17+c/KCsNX3LZn2d49V5uOU3f0k8OrfxvPdfn+vE+jvKh+EbYsMv2xeb57x36tkb3Nvo6edi4u8+1SmKIq0Wjf7dv68fCvFVmmX5XK2Ku+y9dsgxegRpVxan/KhuV8P/2e+P2Jt2b/eNbM5F5vjOx//feQiuy/tlGs+mY+7q4dGzQ/Zf2YEAAAAAKz839NvcpFfd67u2cr7iyT5nf9uJTzn+e93kuZF3reSzKv0PX50rfcXW2Ncv8bOgqT/5tciq1nRlZyyb9P8ODKj3SrKfP38Ya+kzlM4NN5br17xXIzT7X/MbNBOu9dbH8tBsphm+KWb8hHJ7qO0PuXzVmmXpJlme5BJe7DVaZHh31U2WmS0HOzERW+yTO/mb5kse8limE7lmfh3Hd95vv9cpNd76nP+1I655pt7xwsAAAAAOMYZZuIfkxSmkmKUyaB3hgT+GY27uWw00un30x9OM11kVQP9Vr3/8/g97K9LBG3K/kxzM6l9kenwy/kfJvwxXPMAAAAAcC5nWdj2butZ21nP2t6xPxu5St9HjmenFMxfeXdSrvyUfWvn44OLerZSfl6XI9mund9opPNstVZOPxfz8TjjspvuZef0EkhVzct0y/HWbPh5xuXqocLq2F2mWzmDf756+Hcf31Y+fXhFD24O2uzbNP2t2N1tlx6oAAAAAMAdnjmJn4x/rBaz7H0bpdipUf5tvXDqTWmbKn1vufi49TM35qus/XUd+VUN+HY+rwukXy8wesuqzE6aH/Lp0IZP2rekPZil3N5eq0g5eni2eqso8+3eMisPj7eKSueiVWY0KlO0tvfrU47KR99x3upj9ZBns6ZC6/3Fo+vhJ8m/v24WCN7sf6v4etwxq+IFju8qdtoZzMq9126lVYwyOyLeAQAAAOBP9exJ/GwW62y2M5hsFh6dZNC+Wdhzfkrfjfn3/Lz1M8uMNjPexz8yTXKxmfI8L/OlP016kyyXy3x793tV+uWWVX3ypJneYHJ7u5X3bb2o5972lpNBehcPv+5k8CG/Dw/0+PFWUfFcXLR7GUy296u3qlE//XF4YduHzltdFB/T3qoB/9cqo3/C7Ptd1wsqN3vX+z8ZXBw8x61ydnNcB6tHTs3e1rGeHUiKv+TxHXfTny529m0TP5NBO82LhzcBAAAAAH+q50/iZ57yspP+dJHt9ORiMU2/s19Wo0rfrZ/50s90cVeCe5wf06TZ+5pN/nI+vim1ctntpnt5uCzKvLxMZ6e2+mP2LRl3G+n0p9kZ6mKa/l5C/NbrLqYZdi7z9687B3LkeKuosG/zMl86++dgkcW0n073rpV8Hzpv9bA7877Ix3ayuHtV1wrG6Xb6GV7v/yLT/uYc37dw7LFe9viOu5e3Y30TE4cexgEAAAAASZL/Jbm6v0uR0XKwVWJmmn6je3g29aux3qd1UlkCkbrGeTFaZtBeZHjnQ6s35IE70Y7/nW0UAAAAAFArLzATvw7G6XaGWbQHmcxGNa/Bzp+iKEc76yO0ilFWaxo/vuY+AAAAAPA6HTET/y1rpSi/5vOHdprXC4hO0+90M5Y05ZmtZt3f/vdpv5E7qxC9JWbiAwAAAMAtf3gSH2qkVaT8+jm99vqJ0mKR6T9f0v1TnihJ4gMAAADALZL4AAAAAABQU39oTXwAAAAAAKg/SXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAEWEvKEAAARtSURBVKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKgpSXwAAAAAAKip/w9X01Uh2hywmwAAAABJRU5ErkJggg==)","/article/113",14948,"2023-05-16 10:54:01","2023-05-16 10:57:28",{"id":196,"category_id":44,"title":197,"keywords":198,"description":199,"image_url":6,"content":200,"content_md":201,"url":202,"hits":203,"is_recommend":53,"is_top":73,"create_time":204,"update_time":205},94,"Centos7 安装 openvas ","openvas,开放式漏洞评估系统，installing openvas centos-7","一、描述OpenVAS，即开放式漏洞评估系统，是一个用于评估目标漏洞的杰出框架。功能十分强大，最重要的是，它是“开源”的——就是免费的意思啦～它与著名的Nessus“本是同根生”，在Nessus商业化之后仍然坚持开源，号称“当前最好用的开源漏洞扫描工具”。最新版的Kali Linux(kali 3.0)不再自带OpenVAS了，所以我们要自己部署OpenVAS漏洞检测系统。其核心部件是一个服务器，包括一套网络漏洞测试程序，可以检测远程系统和应用程序中的安全问题。但是它的最常用用途是检测目标网络或","\u003Cp>一、描述\u003C/p>\u003Cp>\u003Cspan>\u003Cspan>OpenVAS，即开放式漏洞评估系统，是一个用于评估目标漏洞的杰出框架。功能十分强大，最重要的是，它是“开源”的——就是免费的意思啦～\u003C/span>\u003C/span>\u003C/p>\u003Cp>它与著名的Nessus“本是同根生”，在Nessus商业化之后仍然坚持开源，号称“当前最好用的开源漏洞扫描工具”。最新版的Kali Linux(kali 3.0)不再自带OpenVAS了，所以我们要自己部署OpenVAS漏洞检测系统。其核心部件是一个服务器，包括一套网络漏洞测试程序，可以检测远程系统和应用程序中的安全问题。\u003C/p>\u003Cp>但是它的最常用用途是检测目标网络或主机的安全性。它的评估能力来源于数万个漏洞测试程序，这些程序都是以插件的形式存在。openvas是基于C/S（客户端/服务器），B/S(浏览器/服务器)架构进行工作，用户通过浏览器或者专用客户端程序来下达扫描任务，服务器端负责授权，执行扫描操作并提供扫描结果。\u003C/p>\u003Cp>二、OpenVAS系统架构\u003C/p>\u003Cp>\u003Cspan>\u003C/span>\u003C/p>\u003Cp>一套完整的openvas系统包括服务器端和客户端的多个组件，如下图所示：\u003C/p>\u003Cp>\u003Cimg src=\"/uploads/layedit/20190114/e4fd816cd295568501641e3c5f19a504.png\" alt=\"openvas.png\">\u003Cbr>\u003C/p>\u003Cp>三、安装部署\u003C/p>\u003Cp>1、安装CentOS 7\u003C/p>\u003Cp>首先，我首先选择最小的CentOS安装。安装花费的时间更少，文件系统占用的空间更少，我鄙视更新我从未使用过的软件包！下载最新版本的CentOS 7并完成标准安装。如果你虚拟安装OpenVAS，我建议至少2个CPU，3GB内存和30GB硬盘（这取决于扫描次数和你将保留多少数据）。\u003C/p>\u003Cp>配置CentOS\u003C/p>\u003Cp>如果您启用SELinux，OpenVAS将会访问异常，因此请使用以下命令禁用它。\u003C/p>\u003Cp>\u003Cbr>\u003C/p>\u003Cp>[root@localhost ~]# sed -i's / = enforcing / = disabled /'/ etc / selinux / config\u003C/p>\u003Cp>[root@localhost ~]# setenforce 0\u003C/p>\u003Cp>\u003Cbr>\u003C/p>\u003Cp>同时打开OpenVAS Web界面的必要端口。\u003C/p>\u003Cp>[root@localhost ~]# firewall-cmd --zone = public --add-port = 9392 / tcp --permanent\u003C/p>\u003Cp>[root@localhost ~]# firewall-cmd --reload\u003C/p>\u003Cp>\u003Cbr>\u003C/p>\u003Cp>2、安装OpenVAS\u003C/p>\u003Cp>[root@localhost ~]# yum -y install wget net-tools\u003C/p>\u003Cp>[root@localhost ~]# wget -q -O  -  https://www.zhl123.com/download/linux/openvas/atomic | sh\u003C/p>\u003Cp>[root@localhost ~]# yum -y install openvas\u003C/p>\u003Cp>当yum完成时，使用下面的“sed”命令取消注释/etc/redis.conf文件中的以下2个与unixsocket相关的行。\u003C/p>\u003Cp>#unixsocket /tmp/redis.sock\u003C/p>\u003Cp>#unixsocketperm 700\u003C/p>\u003Cp>[root@localhost ~]# sed -i '/^#.*unixsocket/s/^# //' /etc/redis.conf\u003C/p>\u003Cp>启用redis服务\u003C/p>\u003Cp>[root@localhost ~]# systemctl enable redis && systemctl restart redis\u003C/p>\u003Cp>3、配置OpenVAS\u003C/p>\u003Cp>运行openvas-setup并接受rsync作为默认值。这可能需要一段时间，所以要耐心等待\u003C/p>\u003Cp>[root@localhost ~]#  \u003Cspan style=\"text-align: justify;\">openvas-setup\u003C/span>\u003C/p>\u003Cpre style=\"text-align: justify;\">-- Output --\nOpenvas Setup, Version: 3.0\n\nStep 1: Update NVT, CERT, and SCAP data\nPlease note this step could take some time.\nOnce completed, this will be updated automatically every 24 hours\n\nSelect download method\n* wget (NVT download only)\n* curl (NVT download only)\n* rsync\n\nNote: If rsync requires a proxy, you should define that before this step. \u003C/pre>\u003Cp>\u003Cspan style=\"text-align: justify;\">Downloader [Default: rsync]\u003C/span>\u003C/p>\u003Cpre style=\"text-align: justify;\">openvas-check-setup --v9\n-- Output --\n...\nStep 10: Checking presence of optional tools ...\nOK: pdflatex found.\nWARNING: PDF generation failed, most likely due to missing LaTeX packages. The PDF report format will not work.\nSUGGEST: Install required LaTeX packages.\n \u003C/pre>\u003Cp style=\"text-align: justify;\">访问OpenVAS Web界面\u003C/p>\u003Cp style=\"text-align: justify;\">通过访问https:// <您的IP地址>：9392从任何浏览器访问Web界面。\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cimg src=\"/uploads/layedit/20190114/936c2eaa9b339597b99c5703b316f0ac.png\" alt=\"openvas_login.png\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">4、配置自动更新Feed\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan style=\"text-align: start;\">[root@localhost ~]# \u003C/span>crontab -e\u003C/p>\u003Cp style=\"text-align: justify;\">35 1 * * * /usr/sbin/greenbone-nvt-sync > /dev/null \u003C/p>\u003Cp style=\"text-align: justify;\">5 0 * * * /usr/sbin/greenbone-scapdata-sync > /dev/null \u003C/p>\u003Cp style=\"text-align: justify;\">5 1 * * * /usr/sbin/greenbone-certdata-sync > /dev/null \u003C/p>\u003Cp>5、配置pdf报告输出\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cfont>[root@localhost ~]# yum -y install texlive-collection-fontsrecommended texlive-collection-latexrecommended texlive-changepage texlive-titlesec\u003C/font>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cfont>\u003Cspan style=\"text-align: start;\">[root@localhost ~]# \u003C/span>\u003C/font>mkdir -p /usr/share/texlive/texmf-local/tex/latex/comment\u003C/p>\u003Cp style=\"text-align: start;\">[root@localhost ~]#  cd /usr/share/texlive/texmf-local/tex/latex/comment\u003C/p>\u003Cp style=\"text-align: start;\">[root@localhost ~]#  wget https://www.zhl123.com/download/linux/openvas/comment.sty\u003C/p>\u003Cp style=\"text-align: start;\">[root@localhost ~]#  chmod 644 comment.sty\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cfont>\u003Cspan style=\"text-align: start;\">[root@localhost ~]#  \u003C/span>\u003C/font>\u003Cspan>openvas-check-setup --v9\u003C/span>\u003C/p>\u003Cpre style=\"text-align: justify;\">-- Output --\n...\nStep 10: Checking presence of optional tools ...\nOK: pdflatex found.\nOK: PDF generation successful. The PDF report format is likely to work.\u003C/pre>","一、描述\n\nOpenVAS，即开放式漏洞评估系统，是一个用于评估目标漏洞的杰出框架。功能十分强大，最重要的是，它是“开源”的——就是免费的意思啦～\n\n它与著名的Nessus“本是同根生”，在Nessus商业化之后仍然坚持开源，号称“当前最好用的开源漏洞扫描工具”。最新版的Kali Linux(kali 3.0)不再自带OpenVAS了，所以我们要自己部署OpenVAS漏洞检测系统。其核心部件是一个服务器，包括一套网络漏洞测试程序，可以检测远程系统和应用程序中的安全问题。\n\n但是它的最常用用途是检测目标网络或主机的安全性。它的评估能力来源于数万个漏洞测试程序，这些程序都是以插件的形式存在。openvas是基于C/S（客户端/服务器），B/S(浏览器/服务器)架构进行工作，用户通过浏览器或者专用客户端程序来下达扫描任务，服务器端负责授权，执行扫描操作并提供扫描结果。\n\n二、OpenVAS系统架构\n\n一套完整的openvas系统包括服务器端和客户端的多个组件，如下图所示：\n\n![openvas.png](/uploads/layedit/20190114/e4fd816cd295568501641e3c5f19a504.png)\n\n三、安装部署\n\n1、安装CentOS 7\n\n首先，我首先选择最小的CentOS安装。安装花费的时间更少，文件系统占用的空间更少，我鄙视更新我从未使用过的软件包！下载最新版本的CentOS 7并完成标准安装。如果你虚拟安装OpenVAS，我建议至少2个CPU，3GB内存和30GB硬盘（这取决于扫描次数和你将保留多少数据）。\n\n配置CentOS\n\n如果您启用SELinux，OpenVAS将会访问异常，因此请使用以下命令禁用它。\n\n[root@localhost ~]# sed -i's / = enforcing / = disabled /'/ etc / selinux / config\n\n[root@localhost ~]# setenforce 0\n\n同时打开OpenVAS Web界面的必要端口。\n\n[root@localhost ~]# firewall-cmd --zone = public --add-port = 9392 / tcp --permanent\n\n[root@localhost ~]# firewall-cmd --reload\n\n2、安装OpenVAS\n\n[root@localhost ~]# yum -y install wget net-tools\n\n[root@localhost ~]# wget -q -O  -  https://www.zhl123.com/download/linux/openvas/atomic | sh\n\n[root@localhost ~]# yum -y install openvas\n\n当yum完成时，使用下面的“sed”命令取消注释/etc/redis.conf文件中的以下2个与unixsocket相关的行。\n\n#unixsocket /tmp/redis.sock\n\n#unixsocketperm 700\n\n[root@localhost ~]# sed -i '/^#.*unixsocket/s/^# //' /etc/redis.conf\n\n启用redis服务\n\n[root@localhost ~]# systemctl enable redis && systemctl restart redis\n\n3、配置OpenVAS\n\n运行openvas-setup并接受rsync作为默认值。这可能需要一段时间，所以要耐心等待\n\n[root@localhost ~]#  \nopenvas-setup\n\n```\n-- Output --\nOpenvas Setup, Version: 3.0\n\nStep 1: Update NVT, CERT, and SCAP data\nPlease note this step could take some time.\nOnce completed, this will be updated automatically every 24 hours\n\nSelect download method\n* wget (NVT download only)\n* curl (NVT download only)\n* rsync\n\nNote: If rsync requires a proxy, you should define that before this step. \n```\n\nDownloader [Default: rsync]\n\n```\nopenvas-check-setup --v9\n-- Output --\n...\nStep 10: Checking presence of optional tools ...\nOK: pdflatex found.\nWARNING: PDF generation failed, most likely due to missing LaTeX packages. The PDF report format will not work.\nSUGGEST: Install required LaTeX packages.\n \n```\n\n访问OpenVAS Web界面\n\n通过访问https:// ：9392从任何浏览器访问Web界面。\n\n![openvas_login.png](/uploads/layedit/20190114/936c2eaa9b339597b99c5703b316f0ac.png)\n\n4、配置自动更新Feed\n\n[root@localhost ~]# \ncrontab -e\n\n35 1 * * * /usr/sbin/greenbone-nvt-sync > /dev/null \n\n5 0 * * * /usr/sbin/greenbone-scapdata-sync > /dev/null \n\n5 1 * * * /usr/sbin/greenbone-certdata-sync > /dev/null \n\n5、配置pdf报告输出\n\n[root@localhost ~]# yum -y install texlive-collection-fontsrecommended texlive-collection-latexrecommended texlive-changepage texlive-titlesec\n\n[root@localhost ~]# \n\nmkdir -p /usr/share/texlive/texmf-local/tex/latex/comment\n\n[root@localhost ~]#  cd /usr/share/texlive/texmf-local/tex/latex/comment\n\n[root@localhost ~]#  wget https://www.zhl123.com/download/linux/openvas/comment.sty\n\n[root@localhost ~]#  chmod 644 comment.sty\n\n[root@localhost ~]#  \n\nopenvas-check-setup --v9\n\n```\n-- Output --\n...\nStep 10: Checking presence of optional tools ...\nOK: pdflatex found.\nOK: PDF generation successful. The PDF report format is likely to work.\n```","/article/94",14690,"2019-01-14 17:43:42","2019-01-14 18:16:36",{"id":207,"category_id":44,"title":208,"keywords":209,"description":210,"image_url":6,"content":211,"content_md":212,"url":213,"hits":214,"is_recommend":73,"is_top":73,"create_time":215,"update_time":216},99,"Centos7 利用iptables防止nmap工具防端口扫描","iptables","一、Nmap介绍       Nmap（NetworkMapper）是一款开放源代码的网络探测和安全审核工具。它用于快速扫描一个网络和一台主机开放的端口，还能使用TCP/IP协议栈特征探测远程主机的操作系统类型。nmap支持很多扫描技术，例如：UDP、TCPconnect()、TCPSYN(半开扫描)、ftp代理(bounce攻击)、反向标志、ICMP、FIN、ACK扫描、圣诞树(XmasTree)、SYN扫描和null扫描。Nmap最初是用于Unix系统","\u003Cp align=\"justify\">\u003Cspan>一、\u003C/span>Nmap介绍\u003C/p>\u003Cp align=\"justify\">\u003Cspan>       Nmap\u003Cspan>（\u003C/span>\u003Cspan>NetworkMapper\u003C/span>\u003Cspan>）是一款开放源代码的网络探测和安全审核工具。它用于快速扫描一个网络和一台主机开放的端口，还能使用\u003C/span>\u003Cspan>TCP/IP\u003C/span>\u003Cspan>协议栈特征探测远程主机的操作系统类型。nmap\u003C/span>\u003C/span>\u003Cspan>支持很多扫描技术，例如：\u003Cspan>UDP\u003C/span>\u003Cspan>、\u003C/span>\u003Cspan>TCP\u003C/span>\u003Cspan>connect()\u003C/span>\u003Cspan>、\u003C/span>\u003Cspan>TCP\u003C/span>\u003Cspan>SYN(\u003C/span>\u003Cspan>半开扫描\u003C/span>\u003Cspan>)\u003C/span>\u003Cspan>、\u003C/span>\u003Cspan>ftp\u003C/span>\u003Cspan>代理\u003C/span>\u003Cspan>(bounce\u003C/span>\u003Cspan>攻击\u003C/span>\u003Cspan>)\u003C/span>\u003Cspan>、反向标志、\u003C/span>\u003Cspan>ICMP\u003C/span>\u003Cspan>、\u003C/span>\u003Cspan>FIN\u003C/span>\u003Cspan>、\u003C/span>\u003Cspan>ACK\u003C/span>\u003Cspan>扫描、圣诞树\u003C/span>\u003Cspan>(Xmas\u003C/span>\u003Cspan>Tree)\u003C/span>\u003Cspan>、\u003C/span>\u003Cspan>SYN\u003C/span>\u003Cspan>扫描和\u003C/span>\u003Cspan>null\u003C/span>\u003Cspan>扫描。\u003C/span>\u003Cspan>Nmap\u003C/span>\u003Cspan>最初是用于Unix\u003C/span>\u003C/span>\u003Cspan>系统的命令行应用程序。\u003C/span>\u003C/p>\u003Cp align=\"justify\">\u003Cspan>二、描述\u003C/span>\u003C/p>\u003Cp align=\"justify\">\u003Cspan>       既然\u003Cspan>nmap\u003C/span>\u003Cspan>这个工具能探测到网络中的某一台主机开放的端口、用了什么协议等等，从而成为黑客攻击前踩点的工具，一旦得逞，后果将不堪设想。那么我们如何利用\u003C/span>\u003Cspan>iptables\u003C/span>\u003Cspan>来防止\u003C/span>\u003Cspan>nmap\u003C/span>\u003Cspan>这个工具的嗅探呢？有攻就必有防，\u003C/span>\u003Cspan>Linux\u003C/span>\u003Cspan>系统的\u003C/span>\u003Cspan>iptables\u003C/span>\u003Cspan>可以对封包起到一个过滤、限制的作用。\u003C/span>\u003C/span>\u003C/p>\u003Cp align=\"justify\">\u003Cspan>\u003Cspan>三、演练与实战\u003C/span>\u003C/span>\u003C/p>\u003Cp align=\"justify\">\u003Cspan>\u003Cspan>     1、\u003C/span>\u003C/span>\u003Cspan>下面我在\u003C/span>\u003Cspan>虚拟机\u003C/span>\u003Cspan>使用\u003C/span>\u003Cspan>nmap\u003C/span>\u003Cspan>工具扫描测试\u003C/span>\u003Cspan>Linux\u003C/span>\u003Cspan>主机，在测试的\u003C/span>\u003Cspan>Linux\u003C/span>\u003Cspan>主机\u003C/span>\u003Cspan>iptables\u003C/span>\u003Cspan>不做任何防范的情况下先扫描看看，如下\u003C/span>\u003C/p>\u003Cp align=\"justify\">\u003Cspan>\u003Cimg src=\"/uploads/layedit/20190709/1f199a47370236d7fcb4d5586b683589.png\" alt=\"iptables-01.png\">\u003Cbr>\u003C/span>\u003C/p>\u003Cp align=\"justify\">    从上图可看出，这台机器开启了22、80、443端口\u003C/p>\u003Cp align=\"justify\">   2、现在开启iptables规则，进行防御看看效果\u003C/p>\u003Cp align=\"justify\">   a、首先关闭Centos7自带的\u003Cspan>firewalld，安装iptables服务\u003C/span>\u003C/p>\u003Cp align=\"justify\">\u003Cspan>   \u003C/span>[root@VM_0_15_centos ~]# systemctl disable firewalld.service && systemctl stop firewalld.service\u003C/p>\u003Cp align=\"justify\">   [root@VM_0_15_centos ~]# yum install iptables-services iptables-devel  -y\u003C/p>\u003Cp align=\"justify\">   [root@VM_0_15_centos ~]# systemctl enable iptables \u003C/p>\u003Cp align=\"justify\">   b、 配置iptables\u003C/p>\u003Cp align=\"justify\">  [root@VM_0_15_centos ~]# vim /etc/sysconfig/iptables\u003C/p>\u003Cp align=\"justify\">         # Generated by iptables-save v1.4.21 on Tue Jul  9 21:09:09 2019\u003C/p>\u003Cp align=\"justify\">        *filter\u003C/p>\u003Cp align=\"justify\">         :INPUT ACCEPT [0:0]\u003C/p>\u003Cp align=\"justify\">         :FORWARD ACCEPT [0:0] \u003C/p>\u003Cp align=\"justify\">         -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j REJECT\u003C/p>\u003Cp align=\"justify\">         -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j REJECT\u003C/p>\u003Cp align=\"justify\">         -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j REJECT\u003C/p>\u003Cp align=\"justify\">         -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\u003C/p>\u003Cp align=\"justify\">         -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT\u003C/p>\u003Cp align=\"justify\">         -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT\u003C/p>\u003Cp align=\"justify\">         -A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT\u003C/p>\u003Cp align=\"justify\">         -A INPUT -p icmp -j ACCEPT\u003C/p>\u003Cp align=\"justify\">         -A INPUT -i lo -j ACCEPT\u003C/p>\u003Cp align=\"justify\">         -A INPUT -j REJECT --reject-with icmp-host-prohibited\u003C/p>\u003Cp align=\"justify\">         -A FORWARD -j REJECT --reject-with icmp-host-prohibited\u003C/p>\u003Cp align=\"justify\">         COMMIT\u003C/p>\u003Cp align=\"justify\">         # Completed on Tue Jul  9 21:09:09 2019\u003C/p>\u003Cp align=\"justify\">     c、启动iptables\u003C/p>\u003Cp align=\"justify\">     [root@VM_0_15_centos ~]# systemctl start iptables\u003C/p>\u003Cp align=\"justify\">     d、同样用nmap -A 进行扫描一下，结果如下：\u003C/p>\u003Cp align=\"justify\">      \u003Cimg src=\"/uploads/layedit/20190709/0fdb30f3b00a7e9e68fe1c24091023dd.png\" alt=\"iptables-02.png\">\u003C/p>","一、\nNmap介绍\n\n       Nmap\n（\n\nNetworkMapper\n\n）是一款开放源代码的网络探测和安全审核工具。它用于快速扫描一个网络和一台主机开放的端口，还能使用\n\nTCP/IP\n\n协议栈特征探测远程主机的操作系统类型。nmap\n\n支持很多扫描技术，例如：\nUDP\n\n、\n\nTCP\n\nconnect()\n\n、\n\nTCP\n\nSYN(\n\n半开扫描\n\n)\n\n、\n\nftp\n\n代理\n\n(bounce\n\n攻击\n\n)\n\n、反向标志、\n\nICMP\n\n、\n\nFIN\n\n、\n\nACK\n\n扫描、圣诞树\n\n(Xmas\n\nTree)\n\n、\n\nSYN\n\n扫描和\n\nnull\n\n扫描。\n\nNmap\n\n最初是用于Unix\n\n系统的命令行应用程序。\n\n二、描述\n\n       既然\nnmap\n\n这个工具能探测到网络中的某一台主机开放的端口、用了什么协议等等，从而成为黑客攻击前踩点的工具，一旦得逞，后果将不堪设想。那么我们如何利用\n\niptables\n\n来防止\n\nnmap\n\n这个工具的嗅探呢？有攻就必有防，\n\nLinux\n\n系统的\n\niptables\n\n可以对封包起到一个过滤、限制的作用。\n\n三、演练与实战\n\n     1、\n\n下面我在\n\n虚拟机\n\n使用\n\nnmap\n\n工具扫描测试\n\nLinux\n\n主机，在测试的\n\nLinux\n\n主机\n\niptables\n\n不做任何防范的情况下先扫描看看，如下\n\n![iptables-01.png](/uploads/layedit/20190709/1f199a47370236d7fcb4d5586b683589.png)\n\n    从上图可看出，这台机器开启了22、80、443端口\n\n   2、现在开启iptables规则，进行防御看看效果\n\n   a、首先关闭Centos7自带的\nfirewalld，安装iptables服务\n\n   \n[root@VM_0_15_centos ~]# systemctl disable firewalld.service && systemctl stop firewalld.service\n\n   [root@VM_0_15_centos ~]# yum install iptables-services iptables-devel  -y\n\n   [root@VM_0_15_centos ~]# systemctl enable iptables \n\n   b、 配置iptables\n\n  [root@VM_0_15_centos ~]# vim /etc/sysconfig/iptables\n\n         # Generated by iptables-save v1.4.21 on Tue Jul  9 21:09:09 2019\n\n        *filter\n\n         :INPUT ACCEPT [0:0]\n\n         :FORWARD ACCEPT [0:0] \n\n         -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j REJECT\n\n         -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j REJECT\n\n         -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j REJECT\n\n         -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\n\n         -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT\n\n         -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT\n\n         -A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT\n\n         -A INPUT -p icmp -j ACCEPT\n\n         -A INPUT -i lo -j ACCEPT\n\n         -A INPUT -j REJECT --reject-with icmp-host-prohibited\n\n         -A FORWARD -j REJECT --reject-with icmp-host-prohibited\n\n         COMMIT\n\n         # Completed on Tue Jul  9 21:09:09 2019\n\n     c、启动iptables\n\n     [root@VM_0_15_centos ~]# systemctl start iptables\n\n     d、同样用nmap -A 进行扫描一下，结果如下：\n\n      ![iptables-02.png](/uploads/layedit/20190709/0fdb30f3b00a7e9e68fe1c24091023dd.png)","/article/99",14415,"2019-07-09 21:27:00","2019-07-09 21:57:53",{"id":218,"category_id":46,"title":219,"keywords":220,"description":221,"image_url":6,"content":222,"content_md":223,"url":224,"hits":225,"is_recommend":73,"is_top":73,"create_time":226,"update_time":227},61,"Docker 推荐的启动方式","推荐,启动,方式","# cat DockerfileFROM openjdk:8-alpineWORKDIR /ADD ./target/*.jar app.jarEXPOSE 9999COPY docker-entrypoint.sh /RUN chmod +x /docker-entrypoint.shENTRYPOINT [“/docker-entrypoint.sh”]CMD [“java”,”-server”,”-Duser.timezone=GMT+08″,”-jar”,”/app.jar”]# cat","\u003Cp># cat Dockerfile\u003Cbr>FROM openjdk:8-alpine\u003Cbr>WORKDIR /\u003Cbr>ADD ./target/*.jar app.jar\u003Cbr>EXPOSE 9999\u003Cbr>COPY docker-entrypoint.sh /\u003Cbr>RUN chmod +x /docker-entrypoint.sh\u003Cbr>ENTRYPOINT [“/docker-entrypoint.sh”]\u003Cbr>CMD [“java”,”-server”,”-Duser.timezone=GMT+08″,”-jar”,”/app.jar”]\u003C/p>\u003Cp># cat docker-entrypoint.sh\u003Cbr>#!/bin/sh\u003Cbr>set -e\u003Cbr>需要做的操作，比如更改文件夹权限，或者其他命令\u003Cbr>exec “$@”\u003C/p>","# cat Dockerfile\nFROM openjdk:8-alpine\nWORKDIR /\nADD ./target/*.jar app.jar\nEXPOSE 9999\nCOPY docker-entrypoint.sh /\nRUN chmod +x /docker-entrypoint.sh\nENTRYPOINT [“/docker-entrypoint.sh”]\nCMD [“java”,”-server”,”-Duser.timezone=GMT+08″,”-jar”,”/app.jar”]\n\n# cat docker-entrypoint.sh\n#!/bin/sh\nset -e\n需要做的操作，比如更改文件夹权限，或者其他命令\nexec “$@”","/article/61",14347,"2018-10-22 13:55:47","2018-10-22 13:56:10",{"id":229,"category_id":44,"title":230,"keywords":231,"description":232,"image_url":6,"content":233,"content_md":234,"url":235,"hits":236,"is_recommend":73,"is_top":73,"create_time":237,"update_time":238},107,"Acme.sh 给 SSL 证书自动续期失败的解决方法","HTTP/1.1 200 OK,Server: Bayou Tech Web Srv 1.0,Content-Encoding: none,Content-Length: 5,Content-Type","一、Acme.sh 自动续期失败的症状问题描述如下，续期的时候，提示如下错误：root@dc:~# \"/data/acme.sh\"/acme.sh --cron --home \"/data/acme.sh\" > /dev/null[Sun Nov 10 23:52:17 CST 2020] Error, can not get domain token entry example.com[Sun Nov 10 23:52:17 CST 2020] Please check log file","\u003Cp style=\"text-align: justify;\">一、Acme.sh 自动续期失败的症状\u003C/p>\u003Cp style=\"text-align: justify;\">问题描述如下，续期的时候，提示如下错误：\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">root@dc:~# \"/data/acme.sh\"/acme.sh --cron --home \"/data/acme.sh\" > /dev/null\u003C/p>\u003Cp style=\"text-align: justify;\">[Sun Nov 10 23:52:17 CST 2020] Error, can not get domain token entry example.com\u003C/p>\u003Cp style=\"text-align: justify;\">[Sun Nov 10 23:52:17 CST 2020] Please check log file for more details: /data/acme.sh/acme.sh.log\u003C/p>\u003Cp style=\"text-align: justify;\">[Sun Nov 10 23:52:17 CST 2020] Error renew example.com.\u003C/p>\u003Cp style=\"text-align: justify;\">经过查看 log，错误日志如下：\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">[Sun Nov 10 23:52:14 CST 2020] GET\u003C/p>\u003Cp style=\"text-align: justify;\">[Sun Nov 10 23:52:14 CST 2020] url='https://acme-v01.api.letsencrypt.org/directory'\u003C/p>\u003Cp style=\"text-align: justify;\">[Sun Nov 10 23:52:14 CST 2020] timeout=\u003C/p>\u003Cp style=\"text-align: justify;\">[Sun Nov 10 23:52:15 CST 2020] _CURL='curl -L --silent --dump-header /data/acme.sh/http.header -g '\u003C/p>\u003Cp style=\"text-align: justify;\">[Sun Nov 10 23:52:15 CST 2020] ret='0'\u003C/p>\u003Cp style=\"text-align: justify;\">[Sun Nov 10 23:52:15 CST 2020] Could not get nonce, let's try again.\u003C/p>\u003Cp style=\"text-align: justify;\">[Sun Nov 10 23:52:17 CST 2020] The new-authz request is ok.\u003C/p>\u003Cp style=\"text-align: justify;\">[Sun Nov 10 23:52:17 CST 2020] entry\u003C/p>\u003Cp style=\"text-align: justify;\">[Sun Nov 10 23:52:17 CST 2020] Error, can not get domain token entry example.com\u003C/p>\u003Cp style=\"text-align: justify;\">[Sun Nov 10 23:52:17 CST 2020] pid\u003C/p>\u003Cp style=\"text-align: justify;\">[Sun Nov 10 23:52:17 CST 2020] No need to restore nginx, skip.\u003C/p>\u003Cp style=\"text-align: justify;\">[Sun Nov 10 23:52:17 CST 2020] _clearupdns\u003C/p>\u003Cp style=\"text-align: justify;\">[Sun Nov 10 23:52:17 CST 2020] skip dns.\u003C/p>\u003Cp style=\"text-align: justify;\">[Sun Nov 10 23:52:17 CST 2020] _on_issue_err\u003C/p>\u003Cp style=\"text-align: justify;\">[Sun Nov 10 23:52:17 CST 2020] Please check log file for more details: /data/acme.sh/acme.sh.log\u003C/p>\u003Cp style=\"text-align: justify;\">[Sun Nov 10 23:52:17 CST 2020] Return code: 1\u003C/p>\u003Cp style=\"text-align: justify;\">[Sun Nov 10 23:52:17 CST 2020] Error renew example.com.\u003C/p>\u003Cp style=\"text-align: justify;\">[Sun Nov 10 23:52:17 CST 2020] ===End cron===\u003C/p>\u003Cp style=\"text-align: justify;\">二、Acme.sh 自动续期失败的解决方法\u003C/p>\u003Cp style=\"text-align: justify;\">网上搜了一堆文章之后，都没解决问题，最后在这篇文章中找到了问题所在：\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">https://community.letsencrypt.org/t/unable-to-issue-or-renew-certificates/102948\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">Your server is able to connect Letsencrypt, so that isn’t the problem.\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">But you use acme.sh. There are changes. First step: Update your acme.sh.\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">Yep, the nonce-problem:\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">Could not get nonce, let's try again.\u003C/p>\u003Cp style=\"text-align: justify;\">An update is required.\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">所以，问题原因就是 acme.sh 版本太低，解决方法很简单，升级 acme.sh 即可：\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">升级 acme.sh 到最新版 :\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">acme.sh --upgrade\u003C/p>\u003Cp style=\"text-align: justify;\">如果你不想手动升级, 可以开启自动升级:\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">acme.sh  --upgrade  --auto-upgrade\u003C/p>\u003Cp style=\"text-align: justify;\">之后, acme.sh 就会自动保持更新了.\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">你也可以随时关闭自动更新:\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">acme.sh --upgrade  --auto-upgrade  0\u003C/p>\u003Cp style=\"text-align: justify;\">参考：https://github.com/Neilpang/acme.sh\u003C/p>","一、Acme.sh 自动续期失败的症状\n\n问题描述如下，续期的时候，提示如下错误：\n\nroot@dc:~# \"/data/acme.sh\"/acme.sh --cron --home \"/data/acme.sh\" > /dev/null\n\n[Sun Nov 10 23:52:17 CST 2020] Error, can not get domain token entry example.com\n\n[Sun Nov 10 23:52:17 CST 2020] Please check log file for more details: /data/acme.sh/acme.sh.log\n\n[Sun Nov 10 23:52:17 CST 2020] Error renew example.com.\n\n经过查看 log，错误日志如下：\n\n[Sun Nov 10 23:52:14 CST 2020] GET\n\n[Sun Nov 10 23:52:14 CST 2020] url='https://acme-v01.api.letsencrypt.org/directory'\n\n[Sun Nov 10 23:52:14 CST 2020] timeout=\n\n[Sun Nov 10 23:52:15 CST 2020] _CURL='curl -L --silent --dump-header /data/acme.sh/http.header -g '\n\n[Sun Nov 10 23:52:15 CST 2020] ret='0'\n\n[Sun Nov 10 23:52:15 CST 2020] Could not get nonce, let's try again.\n\n[Sun Nov 10 23:52:17 CST 2020] The new-authz request is ok.\n\n[Sun Nov 10 23:52:17 CST 2020] entry\n\n[Sun Nov 10 23:52:17 CST 2020] Error, can not get domain token entry example.com\n\n[Sun Nov 10 23:52:17 CST 2020] pid\n\n[Sun Nov 10 23:52:17 CST 2020] No need to restore nginx, skip.\n\n[Sun Nov 10 23:52:17 CST 2020] _clearupdns\n\n[Sun Nov 10 23:52:17 CST 2020] skip dns.\n\n[Sun Nov 10 23:52:17 CST 2020] _on_issue_err\n\n[Sun Nov 10 23:52:17 CST 2020] Please check log file for more details: /data/acme.sh/acme.sh.log\n\n[Sun Nov 10 23:52:17 CST 2020] Return code: 1\n\n[Sun Nov 10 23:52:17 CST 2020] Error renew example.com.\n\n[Sun Nov 10 23:52:17 CST 2020] ===End cron===\n\n二、Acme.sh 自动续期失败的解决方法\n\n网上搜了一堆文章之后，都没解决问题，最后在这篇文章中找到了问题所在：\n\nhttps://community.letsencrypt.org/t/unable-to-issue-or-renew-certificates/102948\n\nYour server is able to connect Letsencrypt, so that isn’t the problem.\n\nBut you use acme.sh. There are changes. First step: Update your acme.sh.\n\nYep, the nonce-problem:\n\nCould not get nonce, let's try again.\n\nAn update is required.\n\n所以，问题原因就是 acme.sh 版本太低，解决方法很简单，升级 acme.sh 即可：\n\n升级 acme.sh 到最新版 :\n\nacme.sh --upgrade\n\n如果你不想手动升级, 可以开启自动升级:\n\nacme.sh  --upgrade  --auto-upgrade\n\n之后, acme.sh 就会自动保持更新了.\n\n你也可以随时关闭自动更新:\n\nacme.sh --upgrade  --auto-upgrade  0\n\n参考：https://github.com/Neilpang/acme.sh","/article/107",12618,"2021-09-03 10:44:18","2021-09-03 10:46:23",{"id":240,"category_id":44,"title":241,"keywords":242,"description":243,"image_url":6,"content":244,"content_md":245,"url":246,"hits":247,"is_recommend":53,"is_top":73,"create_time":248,"update_time":249},93,"ELK+Filebeat+Kafka+ZooKeeper 构建海量日志分析平台","Filebeat,Kafka","一、说明1.Filebeat是一个日志文件托运工具，在你的服务器上安装客户端后，filebeat会监控日志目录或者指定的日志文件，追踪读取这些文件（追踪文件的变化，不停的读）2.Kafka是一种高吞吐量的分布式发布订阅消息系统，它可以处理消费者规模的网站中的所有动作流数据3.Logstash是一根具备实时数据传输能力的管道，负责将数据信息从管道的输入端传输到管道的输出端；与此同时这根管道还可以让你根据自己的需求在中间加上滤网，Logstash提供里很多功能强大的滤网以满足你的各种应用场景4.El","\u003Cp>\u003C/p>\u003Cp>\u003Cb>一、说明\u003C/b>\u003C/p>\u003Cp>\u003Cspan>1.Filebeat是一个日志文件托运工具，在你的服务器上安装客户端后，filebeat会监控日志目录或者指定的日志文件，追踪读取这些文件（追踪文件的变化，不停的读）\u003C/span>\u003C/p>\u003Cp>\u003Cspan>2.Kafka是一种高吞吐量的分布式发布订阅消息系统，它可以处理消费者规模的网站中的所有动作流数据\u003C/span>\u003C/p>\u003Cp>\u003Cspan>3.Logstash是一根具备实时数据传输能力的管道，负责将数据信息从管道的输入端传输到管道的输出端；与此同时这根管道还可以让你根据自己的需求在中间加上滤网，Logstash提供里很多功能强大的滤网以满足你的各种应用场景\u003C/span>\u003Cbr>\u003Cspan>4.ElasticSearch它提供了一个分布式多用户能力的全文搜索引擎，基于RESTful web接口\u003C/span>\u003Cbr>\u003C/p>\u003Cp>\u003Cspan>5.Kibana是ElasticSearch的用户界面\u003C/span>\u003C/p>\u003Cp>\u003Cspan>6.在实际应用场景下，为了满足大数据实时检索的场景，利用Filebeat去监控日志文件，将Kafka作为Filebeat的输出端，Kafka实时接收到Filebeat后以Logstash作为输出端输出，到Logstash的数据也许还不是我们想要的格式化或者特定业务的数据，这时可以通过Logstash的一些过了插件对数据进行过滤最后达到想要的数据格式以ElasticSearch作为输出端输出，数据到ElasticSearch就可以进行丰富的分布式检索了\u003C/span>\u003C/p>\u003Cp>\u003Cb>二、系统环境\u003C/b>\u003C/p>\u003Cp>软件版本：filebeat6.5 logstash6.5 Centos7  yjava-1.8.0-openjdk \u003C/p>\u003Cp>\u003C/p>\u003Cp>\u003C/p>\u003Cp>数据流向：filebeat --->> kafka--->> logstash\u003C/p>\u003Cp>\u003Cb>三、安装\u003C/b>\u003C/p>\u003Cp>1、Filebeat安装\u003C/p>\u003Cp>[root@test ~]# yum install https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.5.4-x86_64.rpm\u003C/p>\u003Cp>2.Logstash的安装\u003C/p>\u003Cp>[root@test ~]# yum install https://artifacts.elastic.co/downloads/logstash/logstash-6.5.4.rpm\u003C/p>\u003Cp>3.kafka的安装\u003C/p>\u003Cp>[root@localhost ~]#  wget https://www.apache.org/dyn/closer.cgi?path=/kafka/2.1.0/kafka_2.12-2.1.0.tgz\u003C/p>\u003Cp>[root@localhost ~]# wget http://mirror.bit.edu.cn/apache/zookeeper/zookeeper-3.4.10/zookeeper-3.4.10.tar.gz\u003C/p>\u003Cp>[root@localhost ~]# tar xf zookeeper-3.4.10.tar.gz -C /usr/local/\u003C/p>\u003Cp>[root@localhost ~]# tar xf kafka_2.12-2.1.0.tgz -C /usr/local/\u003C/p>\u003Cp>[root@localhost ~]# mv /usr/local/zookeeper-3.4.10/conf/zoo_sample.cfg /usr/local/zookeeper-3.4.10/conf/zoo.cfg\u003C/p>\u003Cp>[root@localhost ~]# /usr/local/zookeeper-3.4.10/bin/zkServer.sh start\u003C/p>\u003Cp>[root@localhost ~]# vim  /usr/local/kafka_2.12-2.1.0/config/server.properties \u003C/p>\u003Cp>broker.id=0\u003C/p>\u003Cp>listeners=PLAINTEXT://192.168.30.160:9092  # 默认监听所有地址，这个需要指定一个IP，否则在filebeat那往kafka中发送数据会失败。\u003C/p>\u003Cp>num.network.threads=3\u003C/p>\u003Cp>num.io.threads=8\u003C/p>\u003Cp>socket.send.buffer.bytes=102400\u003C/p>\u003Cp>socket.receive.buffer.bytes=102400\u003C/p>\u003Cp>socket.request.max.bytes=104857600\u003C/p>\u003Cp>log.dirs=/tmp/kafka-logs\u003C/p>\u003Cp>num.partitions=1\u003C/p>\u003Cp>num.recovery.threads.per.data.dir=1\u003C/p>\u003Cp>offsets.topic.replication.factor=1\u003C/p>\u003Cp>transaction.state.log.replication.factor=1\u003C/p>\u003Cp>transaction.state.log.min.isr=1\u003C/p>\u003Cp>log.retention.hours=24\u003C/p>\u003Cp>log.segment.bytes=1073741824\u003C/p>\u003Cp>log.cleaner.enable=true\u003C/p>\u003Cp>log.retention.check.interval.ms=300000\u003C/p>\u003Cp>zookeeper.connect=192.168.30.160:2181\u003C/p>\u003Cp>zookeeper.connection.timeout.ms=600\u003C/p>\u003Cp>group.initial.rebalance.delay.ms=0\u003C/p>\u003Cp>[root@localhost ~]#  /usr/local/kafka_2.12-2.1.0/bin/kafka-server-start.sh -daemon /usr/local/kafka_2.12-2.1.0/config/server.properties\u003C/p>\u003Cp>[root@localhost ~]# ss -tunl|grep 9092\u003C/p>\u003Cp>tcp    LISTEN     0      50     ::ffff:192.168.30.160:9092                 :::*     \u003C/p>\u003Cp>备注：一定得注意filebeat版本所兼容的kafka版本，详细查看：https://www.elastic.co/guide/en/beats/filebeat/current/kafka-output.html#_configuration_options_9\u003C/p>\u003Cp>\u003Cb>四、filebeat配置\u003C/b>\u003C/p>\u003Cp>[root@test ~]# cat /etc/filebeat/filebeat.yml\u003C/p>\u003Cp>filebeat.inputs:\u003C/p>\u003Cp>- type: log\u003C/p>\u003Cp>  enabled: true\u003C/p>\u003Cp>  paths:\u003C/p>\u003Cp>    - /var/log/httpd/access_log\u003C/p>\u003Cp>  fields:\u003C/p>\u003Cp>    log_topics: httpd\u003C/p>\u003Cp>  tags: [\"httpd\"]\u003C/p>\u003Cp>\u003Cbr>\u003C/p>\u003Cp>- type: log\u003C/p>\u003Cp>  enabled: true\u003C/p>\u003Cp>  paths:\u003C/p>\u003Cp>  - /var/log/messages\u003C/p>\u003Cp>  fields:\u003C/p>\u003Cp>    log_topics: messages\u003C/p>\u003Cp>  tags: [\"messages\"]\u003C/p>\u003Cp>  include_lines: ['^Dec'] # 匹配需要行\u003C/p>\u003Cp>  tail_files: true # 从文件尾开始监控文件新增内容\u003C/p>\u003Cp>processors:\u003C/p>\u003Cp>- drop_fields:  \u003C/p>\u003Cp>     fields: [\"beat\",\"input\",\"source\",\"offset\"] # 过滤不需要的字段\u003C/p>\u003Cp>name api-server # 添加字段，标记主机的日志来源\u003C/p>\u003Cp>output.kafka:\u003C/p>\u003Cp>  enabled: true  \u003C/p>\u003Cp>  codec.format:                # 默认json格式\u003C/p>\u003Cp>    string: '%{[message]}'   # 只输原始日志格式\u003C/p>\u003Cp>  hosts: [\"192.168.30.160:9092\"]\u003C/p>\u003Cp>  topic: '%{[fields][log_topics]}'\u003C/p>\u003Cp>  partition.round_robin: # 集群是否开启kafka的partition分区\u003C/p>\u003Cp>    reachable_only: false\u003C/p>\u003Cp>  worker: 2\u003C/p>\u003Cp>  required_acks: 1\u003C/p>\u003Cp>  compression: gzip # 压缩格式\u003C/p>\u003Cp>  max_message_bytes: 10000000 # 压缩格式字节大小\u003C/p>\u003Cp>\u003Cbr>\u003C/p>\u003Cp>配置文件测试\u003C/p>\u003Cp>filebeat test config -c filebeat.yml \u003C/p>\u003Cp>[root@test ~]# systemctl start filebeat && systemctl enable filebeat\u003C/p>\u003Cp>\u003Cb>五、logstash配置文件\u003C/b>\u003C/p>\u003Cp>\u003Cbr>\u003C/p>\u003Cp>[root@test ~]# cat /etc/logstash/conf.d/logstash.conf\u003C/p>\u003Cp>input {\u003C/p>\u003Cp>  kafka {\u003C/p>\u003Cp>        bootstrap_servers => \"192.168.30.160:9092\"\u003C/p>\u003Cp>        topics => [\"httpd\",\"messages\"]\u003C/p>\u003Cp>        codec => \"json\" \u003C/p>\u003Cp>        consumer_threads => 4                                   # 消费进程数\u003C/p>\u003Cp>        enable_auto_commit => true                              # 自动提交offset\u003C/p>\u003Cp>        auto_commit_interval_ms => \"1000\"                       # consumer 隔多久提交 \u003C/p>\u003Cp>                                                                # offsets --消费指针\u003C/p>\u003Cp>        auto_offset_reset => \"latest\"                           # earliest \u003C/p>\u003Cp>                                                                # 当各分区下有已提交的offset时，从提交的offset开始消费；无提交的offset时，从头开始消费 \u003C/p>\u003Cp>                                                                # latest \u003C/p>\u003Cp>                                                                # 当各分区下有已提交的offset时，从提交的offset开始消费；无提交的offset时，消费新产生的该分区下的数据 \u003C/p>\u003Cp>                                                                # none \u003C/p>\u003Cp>                                                                # topic各分区都存在已提交的offset时，从offset后开始消费；只要有一个分区不存在已提交的offset，则抛出异常\u003C/p>\u003Cp>  }\u003C/p>\u003Cp>}\u003C/p>\u003Cp>output {\u003C/p>\u003Cp>\u003Cbr>\u003C/p>\u003Cp>     if [tags] == \"httpd\" {\u003C/p>\u003Cp>         elasticsearch {\u003C/p>\u003Cp>         hosts => [\"192.168.30.160:9200\"]\u003C/p>\u003Cp>         index => \"logstash-httpd-%{+YYYY.MM.dd}\"\u003C/p>\u003Cp>              manage_template => true\u003C/p>\u003Cp>         }\u003C/p>\u003Cp>      }\u003C/p>\u003Cp>     if [tags] == \"messages\" {\u003C/p>\u003Cp>         elasticsearch {\u003C/p>\u003Cp>         hosts => [\"192.168.30.160:9200\"]\u003C/p>\u003Cp>         index => \"logstash-messages-%{+YYYY.MM.dd}\"\u003C/p>\u003Cp>              manage_template => true\u003C/p>\u003Cp>        }\u003C/p>\u003Cp>     }\u003C/p>\u003Cp>}\u003C/p>\u003Cp>\u003Cbr>\u003C/p>\u003Cp>  #stdout { codec => rubydebug }\u003C/p>\u003Cp>  #path => \"/tmp/logstash.log\"\u003C/p>\u003Cp>\u003Cbr>\u003C/p>\u003Cp>}\u003C/p>\u003Cp>\u003Cbr>\u003C/p>\u003Cp>配置文件测试\u003C/p>\u003Cp>/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/logstash.conf -t\u003C/p>\u003Cp>[root@test ~]# systemctl start logstash && systemctl enable logstash\u003C/p>\u003Cp>\u003Cb>六、kafka常用命令\u003C/b>\u003C/p>\u003Cp>创建kafka topic\u003C/p>\u003Cp>bin/kafka-topics.sh --zookeeper localhost:2181 --create --topic test --partitions 1  --replication-factor 1\u003C/p>\u003Cp>\u003Cbr>\u003C/p>\u003Cp>删除kafka-topic\u003C/p>\u003Cp>bin/kafka-topics.sh --zookeeper localhost:2181  --delete  --topic test\u003C/p>\u003Cp>\u003Cbr>\u003C/p>\u003Cp>查看所有topic列表\u003C/p>\u003Cp>bin/kafka-topics.sh --zookeeper localhost:2181 --list\u003C/p>\u003Cp>\u003Cbr>\u003C/p>\u003Cp>查看指定topic信息\u003C/p>\u003Cp>bin/kafka-topics.sh --zookeeper localhost:2181 --describe --topic test\u003C/p>\u003Cp>\u003Cbr>\u003C/p>\u003Cp>控制台向topic生产数据\u003C/p>\u003Cp>bin/kafka-console-producer.sh --broker-list 192.168.30.160:9092 --topic test\u003C/p>\u003Cp>\u003Cbr>\u003C/p>\u003Cp>控制台消费topic的数据\u003C/p>\u003Cp>bin/kafka-console-consumer.sh --bootstrap-server 192.168.30.160:9092 --topic test --from-beginning\u003C/p>\u003Cdiv>\u003Cbr>\u003C/div>","**一、说明**\n\n1.Filebeat是一个日志文件托运工具，在你的服务器上安装客户端后，filebeat会监控日志目录或者指定的日志文件，追踪读取这些文件（追踪文件的变化，不停的读）\n\n2.Kafka是一种高吞吐量的分布式发布订阅消息系统，它可以处理消费者规模的网站中的所有动作流数据\n\n3.Logstash是一根具备实时数据传输能力的管道，负责将数据信息从管道的输入端传输到管道的输出端；与此同时这根管道还可以让你根据自己的需求在中间加上滤网，Logstash提供里很多功能强大的滤网以满足你的各种应用场景\n\n4.ElasticSearch它提供了一个分布式多用户能力的全文搜索引擎，基于RESTful web接口\n\n5.Kibana是ElasticSearch的用户界面\n\n6.在实际应用场景下，为了满足大数据实时检索的场景，利用Filebeat去监控日志文件，将Kafka作为Filebeat的输出端，Kafka实时接收到Filebeat后以Logstash作为输出端输出，到Logstash的数据也许还不是我们想要的格式化或者特定业务的数据，这时可以通过Logstash的一些过了插件对数据进行过滤最后达到想要的数据格式以ElasticSearch作为输出端输出，数据到ElasticSearch就可以进行丰富的分布式检索了\n\n**二、系统环境**\n\n软件版本：filebeat6.5 logstash6.5 Centos7  yjava-1.8.0-openjdk \n\n数据流向：filebeat --->> kafka--->> logstash\n\n**三、安装**\n\n1、Filebeat安装\n\n[root@test ~]# yum install https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.5.4-x86_64.rpm\n\n2.Logstash的安装\n\n[root@test ~]# yum install https://artifacts.elastic.co/downloads/logstash/logstash-6.5.4.rpm\n\n3.kafka的安装\n\n[root@localhost ~]#  wget https://www.apache.org/dyn/closer.cgi?path=/kafka/2.1.0/kafka_2.12-2.1.0.tgz\n\n[root@localhost ~]# wget http://mirror.bit.edu.cn/apache/zookeeper/zookeeper-3.4.10/zookeeper-3.4.10.tar.gz\n\n[root@localhost ~]# tar xf zookeeper-3.4.10.tar.gz -C /usr/local/\n\n[root@localhost ~]# tar xf kafka_2.12-2.1.0.tgz -C /usr/local/\n\n[root@localhost ~]# mv /usr/local/zookeeper-3.4.10/conf/zoo_sample.cfg /usr/local/zookeeper-3.4.10/conf/zoo.cfg\n\n[root@localhost ~]# /usr/local/zookeeper-3.4.10/bin/zkServer.sh start\n\n[root@localhost ~]# vim  /usr/local/kafka_2.12-2.1.0/config/server.properties \n\nbroker.id=0\n\nlisteners=PLAINTEXT://192.168.30.160:9092  # 默认监听所有地址，这个需要指定一个IP，否则在filebeat那往kafka中发送数据会失败。\n\nnum.network.threads=3\n\nnum.io.threads=8\n\nsocket.send.buffer.bytes=102400\n\nsocket.receive.buffer.bytes=102400\n\nsocket.request.max.bytes=104857600\n\nlog.dirs=/tmp/kafka-logs\n\nnum.partitions=1\n\nnum.recovery.threads.per.data.dir=1\n\noffsets.topic.replication.factor=1\n\ntransaction.state.log.replication.factor=1\n\ntransaction.state.log.min.isr=1\n\nlog.retention.hours=24\n\nlog.segment.bytes=1073741824\n\nlog.cleaner.enable=true\n\nlog.retention.check.interval.ms=300000\n\nzookeeper.connect=192.168.30.160:2181\n\nzookeeper.connection.timeout.ms=600\n\ngroup.initial.rebalance.delay.ms=0\n\n[root@localhost ~]#  /usr/local/kafka_2.12-2.1.0/bin/kafka-server-start.sh -daemon /usr/local/kafka_2.12-2.1.0/config/server.properties\n\n[root@localhost ~]# ss -tunl|grep 9092\n\ntcp    LISTEN     0      50     ::ffff:192.168.30.160:9092                 :::*     \n\n备注：一定得注意filebeat版本所兼容的kafka版本，详细查看：https://www.elastic.co/guide/en/beats/filebeat/current/kafka-output.html#_configuration_options_9\n\n**四、filebeat配置**\n\n[root@test ~]# cat /etc/filebeat/filebeat.yml\n\nfilebeat.inputs:\n\n- type: log\n\n  enabled: true\n\n  paths:\n\n    - /var/log/httpd/access_log\n\n  fields:\n\n    log_topics: httpd\n\n  tags: [\"httpd\"]\n\n- type: log\n\n  enabled: true\n\n  paths:\n\n  - /var/log/messages\n\n  fields:\n\n    log_topics: messages\n\n  tags: [\"messages\"]\n\n  include_lines: ['^Dec'] # 匹配需要行\n\n  tail_files: true # 从文件尾开始监控文件新增内容\n\nprocessors:\n\n- drop_fields:  \n\n     fields: [\"beat\",\"input\",\"source\",\"offset\"] # 过滤不需要的字段\n\nname api-server # 添加字段，标记主机的日志来源\n\noutput.kafka:\n\n  enabled: true  \n\n  codec.format:                # 默认json格式\n\n    string: '%{[message]}'   # 只输原始日志格式\n\n  hosts: [\"192.168.30.160:9092\"]\n\n  topic: '%{[fields][log_topics]}'\n\n  partition.round_robin: # 集群是否开启kafka的partition分区\n\n    reachable_only: false\n\n  worker: 2\n\n  required_acks: 1\n\n  compression: gzip # 压缩格式\n\n  max_message_bytes: 10000000 # 压缩格式字节大小\n\n配置文件测试\n\nfilebeat test config -c filebeat.yml \n\n[root@test ~]# systemctl start filebeat && systemctl enable filebeat\n\n**五、logstash配置文件**\n\n[root@test ~]# cat /etc/logstash/conf.d/logstash.conf\n\ninput {\n\n  kafka {\n\n        bootstrap_servers => \"192.168.30.160:9092\"\n\n        topics => [\"httpd\",\"messages\"]\n\n        codec => \"json\" \n\n        consumer_threads => 4                                   # 消费进程数\n\n        enable_auto_commit => true                              # 自动提交offset\n\n        auto_commit_interval_ms => \"1000\"                       # consumer 隔多久提交 \n\n                                                                # offsets --消费指针\n\n        auto_offset_reset => \"latest\"                           # earliest \n\n                                                                # 当各分区下有已提交的offset时，从提交的offset开始消费；无提交的offset时，从头开始消费 \n\n                                                                # latest \n\n                                                                # 当各分区下有已提交的offset时，从提交的offset开始消费；无提交的offset时，消费新产生的该分区下的数据 \n\n                                                                # none \n\n                                                                # topic各分区都存在已提交的offset时，从offset后开始消费；只要有一个分区不存在已提交的offset，则抛出异常\n\n  }\n\n}\n\noutput {\n\n     if [tags] == \"httpd\" {\n\n         elasticsearch {\n\n         hosts => [\"192.168.30.160:9200\"]\n\n         index => \"logstash-httpd-%{+YYYY.MM.dd}\"\n\n              manage_template => true\n\n         }\n\n      }\n\n     if [tags] == \"messages\" {\n\n         elasticsearch {\n\n         hosts => [\"192.168.30.160:9200\"]\n\n         index => \"logstash-messages-%{+YYYY.MM.dd}\"\n\n              manage_template => true\n\n        }\n\n     }\n\n}\n\n  #stdout { codec => rubydebug }\n\n  #path => \"/tmp/logstash.log\"\n\n}\n\n配置文件测试\n\n/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/logstash.conf -t\n\n[root@test ~]# systemctl start logstash && systemctl enable logstash\n\n**六、kafka常用命令**\n\n创建kafka topic\n\nbin/kafka-topics.sh --zookeeper localhost:2181 --create --topic test --partitions 1  --replication-factor 1\n\n删除kafka-topic\n\nbin/kafka-topics.sh --zookeeper localhost:2181  --delete  --topic test\n\n查看所有topic列表\n\nbin/kafka-topics.sh --zookeeper localhost:2181 --list\n\n查看指定topic信息\n\nbin/kafka-topics.sh --zookeeper localhost:2181 --describe --topic test\n\n控制台向topic生产数据\n\nbin/kafka-console-producer.sh --broker-list 192.168.30.160:9092 --topic test\n\n控制台消费topic的数据\n\nbin/kafka-console-consumer.sh --bootstrap-server 192.168.30.160:9092 --topic test --from-beginning","/article/93",12190,"2018-12-24 16:40:08","2018-12-26 11:53:38",{"id":251,"category_id":46,"title":252,"keywords":253,"description":254,"image_url":6,"content":255,"content_md":256,"url":257,"hits":258,"is_recommend":53,"is_top":73,"create_time":259,"update_time":260},81,"kubernetes 1.12.1 高可用安装之部署Dashboard","安装Dashboard","创建Dashboard需要CoreDNS部署成功之后再安装Dashboard。[root@master01 ~]# wget https://zhl123.com/download/k8s/Dashboard.tgz[root@master01 ~]# tar xf Dashboard.tgz[root@master01 ~]# kubectl create -f Dashboard/[root@master01 Dashboard]# kubectl get svc -n kube-syste","\u003Ch2>创建Dashboard\u003C/h2>\u003Cp>需要CoreDNS部署成功之后再安装Dashboard。\u003C/p>\u003Cpre>\u003Cp>\u003C/p>\u003Cp>\u003Cfont face=\"monospace\">[root@master01 ~]# wget https://zhl123.com/download/k8s/dashboard.tgz\n[root@master01 ~]# tar xf dashboard.tgz \n[root@master01 ~]# kubectl create -f dashboard/\n[root@master01 ~]# kubectl cluster-info\u003C/font>\u003C/p>\u003Cfont face=\"monospace\">Kubernetes master is running at https://10.80.4.200:6443\nCoreDNS is running at https://10.80.4.200:6443/api/v1/namespaces/kube-system/services/coredns:dns/proxy\nkubernetes-dashboard is running at https://10.80.4.200:6443/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy\n\nTo further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.\u003C/font>\u003Cp>\u003C/p>\u003Ccode>\n\u003C/code>\u003C/pre>\u003Cp>\u003Cb>访问Dashboard\u003C/b>\u003C/p>\u003Cp>\u003Cspan>https://10.80.4.200:6443/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy\u003C/span>\u003C/p>\u003Cp>用户名:admin 密码：admin 选择Token令牌模式登录。\u003C/p>\u003Cp>\u003Cb>获取Token\u003C/b>\u003C/p>\u003Cp>\u003Ccode>[root@master01 ~]# kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep admin-user | awk '{print $1}')\u003C/code>\u003C/p>\u003Cp>\u003Cimg src=\"/uploads/layedit/20181026/6ff5bcbe473c509f6501b161611cf6dd.png\" alt=\"26-1.png\">\u003Cbr>\u003C/p>\u003Cp>\u003Cimg src=\"/uploads/layedit/20181026/450b4fe0d6e6702d2bb505cf47decfab.png\" alt=\"26-2.png\">\u003Cbr>\u003C/p>","## 创建Dashboard\n\n需要CoreDNS部署成功之后再安装Dashboard。\n\n```\n[root@master01 ~]# wget https://zhl123.com/download/k8s/dashboard.tgz\n[root@master01 ~]# tar xf dashboard.tgz\n[root@master01 ~]# kubectl create -f dashboard/\n[root@master01 ~]# kubectl cluster-infoKubernetes master is running at https://10.80.4.200:6443\nCoreDNS is running at https://10.80.4.200:6443/api/v1/namespaces/kube-system/services/coredns:dns/proxy\nkubernetes-dashboard is running at https://10.80.4.200:6443/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy\n\nTo further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.\n```\n\n**访问Dashboard**\n\nhttps://10.80.4.200:6443/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy\n\n用户名:admin 密码：admin 选择Token令牌模式登录。\n\n**获取Token**\n\n`[root@master01 ~]# kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep admin-user | awk '{print $1}')`\n\n![26-1.png](/uploads/layedit/20181026/6ff5bcbe473c509f6501b161611cf6dd.png)\n\n![26-2.png](/uploads/layedit/20181026/450b4fe0d6e6702d2bb505cf47decfab.png)","/article/81",12037,"2018-10-26 09:54:41","2018-10-26 16:59:19",{"id":262,"category_id":44,"title":263,"keywords":6,"description":264,"image_url":6,"content":265,"content_md":266,"url":267,"hits":268,"is_recommend":73,"is_top":73,"create_time":269,"update_time":270},100,"用 Nginx 给 Cookie 增加 Secure 和 HttpOnly","在 nginx 的 location 中配置12# 只支持 proxy 模式下设置，SameSite 不需要可删除，如果想更安全可以把 SameSite 设置为 Strictproxy_cookie_path / \"/; httponly; secure; SameSite=Lax\";示例1234567891011121314151617181920212223242526server {    listen 443 ssl http2;    server_name www.zhl123.cn","\u003Cp style=\"text-align: justify;\">在 nginx 的 location 中配置\u003C/p>\u003Cp style=\"text-align: justify;\"># 只支持 proxy 模式下设置，SameSite 不需要可删除，如果想更安全可以把 SameSite 设置为 Strict\u003C/p>\u003Cp style=\"text-align: justify;\">proxy_cookie_path / \"/; httponly; secure; SameSite=Lax\";\u003C/p>\u003Cp style=\"text-align: justify;\">示例\u003C/p>\u003Cp style=\"text-align: justify;\">server {\u003C/p>\u003Cp style=\"text-align: justify;\">    listen 443 ssl http2;\u003C/p>\u003Cp style=\"text-align: justify;\">    server_name www.zhl123.cn;\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">    ssl_certificate /etc/letsencrypt/live/zhl123.cn/fullchain.pem;\u003C/p>\u003Cp style=\"text-align: justify;\">    ssl_certificate_key /etc/letsencrypt/live/zhl123.cn/privkey.pem;\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">    ssl_trusted_certificate /etc/letsencrypt/live/zhl123.cn/chain.pem;\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">    add_header X-XSS-Protection \"1; mode=block\";\u003C/p>\u003Cp style=\"text-align: justify;\">    add_header X-Frame-Options SAMEORIGIN;\u003C/p>\u003Cp style=\"text-align: justify;\">    add_header Strict-Transport-Security \"max-age=15768000\";\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">    location / {\u003C/p>\u003Cp style=\"text-align: justify;\">        root /var/www/html;\u003C/p>\u003Cp style=\"text-align: justify;\">    }\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">    location /123 {\u003C/p>\u003Cp style=\"text-align: justify;\">        proxy_pass http://localhost:8080;\u003C/p>\u003Cp style=\"text-align: justify;\">        proxy_set_header Host $host;\u003C/p>\u003Cp style=\"text-align: justify;\">        proxy_set_header X-Real-IP $remote_addr;\u003C/p>\u003Cp style=\"text-align: justify;\">        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\u003C/p>\u003Cp style=\"text-align: justify;\">        # 在这里设置\u003C/p>\u003Cp style=\"text-align: justify;\">        proxy_cookie_path / \"/; httponly; secure; SameSite=Lax\";\u003C/p>\u003Cp style=\"text-align: justify;\">    }\u003C/p>\u003Cp style=\"text-align: justify;\">}\u003C/p>\u003Cfigure class=\"highlight nginx\" style=\"text-align: justify;\">\u003C/figure>","在 nginx 的 location 中配置\n\n# 只支持 proxy 模式下设置，SameSite 不需要可删除，如果想更安全可以把 SameSite 设置为 Strict\n\nproxy_cookie_path / \"/; httponly; secure; SameSite=Lax\";\n\n示例\n\nserver {\n\n    listen 443 ssl http2;\n\n    server_name www.zhl123.cn;\n\n    ssl_certificate /etc/letsencrypt/live/zhl123.cn/fullchain.pem;\n\n    ssl_certificate_key /etc/letsencrypt/live/zhl123.cn/privkey.pem;\n\n    ssl_trusted_certificate /etc/letsencrypt/live/zhl123.cn/chain.pem;\n\n    add_header X-XSS-Protection \"1; mode=block\";\n\n    add_header X-Frame-Options SAMEORIGIN;\n\n    add_header Strict-Transport-Security \"max-age=15768000\";\n\n    location / {\n\n        root /var/www/html;\n\n    }\n\n    location /123 {\n\n        proxy_pass http://localhost:8080;\n\n        proxy_set_header Host $host;\n\n        proxy_set_header X-Real-IP $remote_addr;\n\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n\n        # 在这里设置\n\n        proxy_cookie_path / \"/; httponly; secure; SameSite=Lax\";\n\n    }\n\n}","/article/100",11848,"2019-11-26 16:10:57","2019-11-26 16:23:45",{"id":272,"category_id":44,"title":273,"keywords":274,"description":275,"image_url":6,"content":276,"content_md":277,"url":278,"hits":279,"is_recommend":73,"is_top":73,"create_time":280,"update_time":281},41,"Tomcat 安全配置与性能优化","tomcat，性能优化","1. JVM 1.1. 使用 Server JRE 替代JDK。 服务器上不要安装JDK，请使用 Server JRE. 服务器上根本不需要编译器，代码应该在Release服务器上完成编译打包工作。 理由：一旦服务器被控制，可以防止在其服务器上编译其他恶意代码并植入到你的程序中。 1.2. JAVA_OPTS export JAVA_OPTS=\"-server -Xms512m -Xmx4096m  -XX:PermSize=64M -","\u003Cp>\u003Cfont size=\"5\">\u003Cb>1. JVM\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cfont size=\"5\">\u003Cb>\u003Cfont size=\"4\">1.1. 使用 Server JRE 替代JDK。\u003C/font>\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cspan>服务器上不要安装JDK，请使用 Server JRE. 服务器上根本不需要编译器，代码应该在Release服务器上完成编译打包工作。 \u003C/span>\u003Cbr>\u003Cspan>理由：一旦服务器被控制，可以防止在其服务器上编译其他恶意代码并植入到你的程序中。 \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cfont size=\"4\">\u003Cb>1.2. JAVA_OPTS\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cspan>export JAVA_OPTS=\"-server -Xms512m -Xmx4096m  -XX:PermSize=64M -XX:MaxPermSize=512m\" \u003C/span>\u003Cbr>\u003Cspan>                         \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>-Xms 指定初始化时化的栈内存 \u003C/span>\u003Cbr>\u003Cspan>-Xmx 指定最大栈内存 \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cfont size=\"4\">\u003Cb>提示\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cspan>Java 8 以后 -XX:PermSize 与 -XX:MaxPermSize 两个配置项被废弃 \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cfont size=\"5\">\u003Cb>2. Tomcat 优化\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cfont size=\"4\">\u003Cb>2.1. maxThreads 连接数限制\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cspan>maxThreads 是 Tomcat 所能接受最大连接数。一般设置不要超过8000以上，如果你的网站访问量非常大可能使用运行多个Tomcat实例的方法。 \u003C/span>\u003Cbr>\u003Cspan>即，在一个服务器上启动多个tomcat然后做负载均衡处理。 \u003C/span>\u003Cbr>\u003Cspan>                         \u003C/span>\u003Cbr>\u003Cspan><Connector port=\"8080\" address=\"localhost\" \u003C/span>\u003Cbr>\u003Cspan>        maxThreads=\"2048\" maxHttpHeaderSize=\"8192\" \u003C/span>\u003Cbr>\u003Cspan>        emptySessionPath=\"true\" protocol=\"HTTP/1.1\" \u003C/span>\u003Cbr>\u003Cspan>        enableLookups=\"false\" redirectPort=\"8181\" acceptCount=\"100\" \u003C/span>\u003Cbr>\u003Cspan>        connectionTimeout=\"20000\" disableUploadTimeout=\"true\" /> \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>                                           \u003C/span>\u003Cbr>\u003Cbr>\u003Cfont size=\"4\">\u003Cb>提示\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cspan>很多做过php运维的朋友在这里会犯一个大错误，php优化服务器通常怎做法是安装cpu以及内存的情况配置连接数，连接数过万都很正常，但java不同jvm配置要非常小心，稍有差错就会崩溃。 \u003C/span>\u003Cbr>\u003Cspan>maxThreads 配置要结合 JVM -Xmx 参数调整，也就是要考虑内存开销。 \u003C/span>\u003Cbr>\u003Cspan>maxThreads                  客户请求最大线程数 \u003C/span>\u003Cbr>\u003Cspan>minSpareThreads            初始化时创建的 socket 线程数 \u003C/span>\u003Cbr>\u003Cspan>maxSpareThreads           连接器的最大空闲 socket 线程数 \u003C/span>\u003Cbr>\u003Cspan>                         \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cfont size=\"4\">\u003Cb>2.2. 虚拟主机\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cspan>不要使用Tomcat的虚拟主机，每个站点一个实例。即，启动多个tomcat. \u003C/span>\u003Cbr>\u003Cspan>这也是PHP运维在这里常犯的错误，PHP的做法是一个Web下面放置多个虚拟主机，而不是每个主机启动一个web服务器。Tomcat 是多线程,共享内存，任何一个虚拟主机中的应用出现崩溃，会影响到所有应用程序。采用多个实例方式虽然开销比较大，但保证了应用程序隔离与安全。 \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cfont size=\"4\">\u003Cb>2.3. 压错传输\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cspan>通常所说的gzip压缩，Tomcat通过在server.xml配置设置压缩的选项。 \u003C/span>\u003Cbr>\u003Cspan>                         \u003C/span>\u003Cbr>\u003Cspan><Connector port=\"8080\" protocol=\"HTTP/1.1\" \u003C/span>\u003Cbr>\u003Cspan>               connectionTimeout=\"20000\" \u003C/span>\u003Cbr>\u003Cspan>               redirectPort=\"8443\" \u003C/span>\u003Cbr>\u003Cspan>               compression=\"on\" \u003C/span>\u003Cbr>\u003Cspan>               compressionMinSize1=\"2048\" \u003C/span>\u003Cbr>\u003Cspan>               noCompressionUserAgents=\"gozilla, traviata\" \u003C/span>\u003Cbr>\u003Cspan>               compressableMimeType=\"text/html,text/xml,text/javascript,text/css,text/plain,,application/octet-stream\"/> \u003C/span>\u003Cbr>\u003Cspan>                         \u003C/span>\u003Cbr>\u003Cspan>                         \u003C/span>\u003Cbr>\u003Cfont size=\"4\">\u003Cb>提示\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cspan>压缩会增加Tomcat负担，最好采用Nginx + Tomcat 或者 Apache + Tomcat 方式，压缩交由Nginx/Apache 去做。 \u003C/span>\u003Cbr>\u003Cspan>compression                         打开压缩功能   \u003C/span>\u003Cbr>\u003Cspan>compressionMinSize           启用压缩的输出内容大小，这里面默认为2KB \u003C/span>\u003Cbr>\u003Cspan>compressableMimeType         压缩类型                         \u003C/span>\u003Cbr>\u003Cspan>                         \u003C/span>\u003Cbr>\u003Cbr>\u003Cfont size=\"5\">\u003Cb>3. Tomcat 安全配置\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cfont size=\"4\">\u003Cb>3.1. 禁用8005端口\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cspan>telnet localhost 8005 然后输入 SHUTDOWN 就可以关闭 Tomcat，为了安全我们要禁用该功能 \u003C/span>\u003Cbr>\u003Cspan>                         \u003C/span>\u003Cbr>\u003Cspan><Server port=\"-1\" shutdown=\"SHUTDOWN\"> \u003C/span>\u003Cbr>\u003Cspan>                         \u003C/span>\u003Cbr>\u003Cspan>                         \u003C/span>\u003Cbr>\u003Cfont size=\"4\">\u003Cb>3.2. 安装后初始化配置\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cspan>当Tomcat完成安装后你首先要做的事情如下： \u003C/span>\u003Cbr>\u003Cspan>首次安装完成后立即删除webapps下面的所有代码 \u003C/span>\u003Cbr>\u003Cspan>rm -rf /srv/apache-tomcat/webapps/* \u003C/span>\u003Cbr>\u003Cspan>                         \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>注释或删除 tomcat-users.xml 所有用户权限，看上去如下： \u003C/span>\u003Cbr>\u003Cspan>                         \u003C/span>\u003Cbr>\u003Cspan># cat conf/tomcat-users.xml \u003C/span>\u003Cbr>\u003Cspan><?xml version='1.0' encoding='utf-8'?> \u003C/span>\u003Cbr>\u003Cspan><tomcat-users> \u003C/span>\u003Cbr>\u003Cspan></tomcat-users> \u003C/span>\u003Cbr>\u003Cspan>                         \u003C/span>\u003Cbr>\u003Cspan>                         \u003C/span>\u003Cbr>\u003Cbr>\u003Cfont size=\"3\">\u003Cb>3.2.1. 隐藏版本信息\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cspan>隐藏Tomcat版本信息，首先隐藏HTTP头中的版本信息 \u003C/span>\u003Cbr>\u003Cspan>                                 \u003C/span>\u003Cbr>\u003Cspan>vim $CATALINA_HOME/conf/server.xml \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>    <Connector port=\"80\" protocol=\"HTTP/1.1\" \u003C/span>\u003Cbr>\u003Cspan>               connectionTimeout=\"20000\" \u003C/span>\u003Cbr>\u003Cspan>               redirectPort=\"8443\" \u003C/span>\u003Cbr>\u003Cspan>                                maxThreads=\"8192\" \u003C/span>\u003Cbr>\u003Cspan>                                minSpareThreads=\"64\" \u003C/span>\u003Cbr>\u003Cspan>                                maxSpareThreads=\"128\" \u003C/span>\u003Cbr>\u003Cspan>                                acceptCount=\"128\" \u003C/span>\u003Cbr>\u003Cspan>                                enableLookups=\"false\" \u003C/span>\u003Cbr>\u003Cspan>                server=\"Neo App Srv 1.0\"/> \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan># curl -I \u003C/span>\u003Ca href=\"http://localhost:8080/\" target=\"_blank\">http://localhost:8080/\u003C/a>\u003Cspan> \u003C/span>\u003Cbr>\u003Cspan>HTTP/1.1 400 Bad Request \u003C/span>\u003Cbr>\u003Cspan>Transfer-Encoding: chunked \u003C/span>\u003Cbr>\u003Cspan>Date: Thu, 20 Oct 2011 09:51:55 GMT \u003C/span>\u003Cbr>\u003Cspan>Connection: close \u003C/span>\u003Cbr>\u003Cspan>Server: Neo App Srv 1.0 \u003C/span>\u003Cbr>\u003Cspan>                                 \u003C/span>\u003Cbr>\u003Cspan>                                 \u003C/span>\u003Cbr>\u003Cspan>服务器信息已经被改为 Server: Neo App Srv 1.0 \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cfont size=\"4\">\u003Cb>注意：当出现 404 页面时仍可能看到Tomcat的版本信息\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cspan>HTTP Status 404 - /sdf \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>type Status report \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>message /sdf \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>description The requested resource is not available. \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>Apache Tomcat/8.0.32                                         \u003C/span>\u003Cbr>\u003Cspan>                                         \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>隐藏Tomcat 404页面版本信息的方法如下 \u003C/span>\u003Cbr>\u003Cspan>                                         \u003C/span>\u003Cbr>\u003Cspan>mkdir -p apache-tomcat-8.0.33/lib/org/apache/catalina/util \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>cat >> apache-tomcat-8.0.33/lib/org/apache/catalina/util/ServerInfo.properties <<EOF \u003C/span>\u003Cbr>\u003Cspan>server.info=Apache \u003C/span>\u003Cbr>\u003Cspan>server.number= \u003C/span>\u003Cbr>\u003Cspan>server.built= \u003C/span>\u003Cbr>\u003Cspan>EOF \u003C/span>\u003Cbr>\u003Cspan>                                         \u003C/span>\u003Cbr>\u003Cspan>                                         \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>测试 \u003C/span>\u003Cbr>\u003Cspan>HTTP Status 404 - /sdf \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>type Status report \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>message /sdf \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>description The requested resource is not available. \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>Apache \u003C/span>\u003Cbr>\u003Cspan>                                         \u003C/span>\u003Cbr>\u003Cbr>\u003Cfont size=\"3\">\u003Cb>3.2.2. 应用程序安全\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cspan>关闭war自动部署 unpackWARs=\"false\" autoDeploy=\"false\"。防止被植入木马等恶意程序 \u003C/span>\u003Cbr>\u003Cspan>关闭 reloadable=\"false\" 也用于防止被植入木马 \u003C/span>\u003Cbr>\u003Cbr>\u003Cfont size=\"3\">\u003Cb>3.2.3. JSESSIONID\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cspan>修改 Cookie 变量 JSESSIONID， 这个cookie 是用于维持Session关系。建议你改为PHPSESSID。 \u003C/span>\u003Cbr>\u003Cspan>                                 \u003C/span>\u003Cbr>\u003Cspan><Context path=\"\" docBase=\"path/to/your\" reloadable=\"false\" sessionCookiePath=\"/\" sessionCookieName=\"PHPSESSID\">                                 \u003C/span>\u003Cbr>\u003Cspan>                                 \u003C/span>\u003Cbr>\u003Cspan>                                 \u003C/span>\u003Cbr>\u003Cbr>\u003Cfont size=\"4\">\u003Cb>3.3. 启动用户与端口\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cspan>不要使用root用户启动tomcat，Java程序与C程序不同。nginx,httpd 使用root用户启动守护80端口，子进程/线程会通过setuid(),setgid()两个函数切换到普通用户。即父进程所有者是root用户，子进程与多线程所有者是一个非root用户，这个用户没有shell，无法通过ssh与控制台登陆系统，Java 的JVM 是与系统无关的，是建立在OS之上的，你使用什么用户启动Tomcat，那麽Tomcat 就会继承该所有者的权限。 \u003C/span>\u003Cbr>\u003Cspan>这造成了一个问题，Linux系统小于1024的端口只有root可以使用，这也是为什么Tomcat默认端口是8080。如果你想使用80端口只能使用root启动Tomcat。这有带来了很多安全问题。 \u003C/span>\u003Cbr>\u003Cspan>解决方案是创建一个普通用户，如： \u003C/span>\u003Cbr>\u003Cspan>groupadd -g 80 daemon \u003C/span>\u003Cbr>\u003Cspan>adduser -o --home /daemon --shell /sbin/nologin --uid 80 --gid 80 -c \"Web Server\" daemon \u003C/span>\u003Cbr>\u003Cspan>                         \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>注意 /sbin/nologin , 意味着该用户不能登录，同时我也没有给它指定密码，这个用户只能用于启动tomcat，没有Shell权限就以为只被注入后无法运行linux命令。 \u003C/span>\u003Cbr>\u003Cspan>chown daemon:daemon -R /srv/* \u003C/span>\u003Cbr>\u003Cspan>su - daemon -c \"/srv/apache-tomcat/bin/startup.sh\" \u003C/span>\u003Cbr>\u003Cspan>                         \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>接下来解决80端口问题, 思路就是80去调用8080，或者映射端口。 \u003C/span>\u003Cbr>\u003Cspan>下面是影射方案,80 跳转 8080 \u003C/span>\u003Cbr>\u003Cspan>iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080 \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>取消跳转 \u003C/span>\u003Cbr>\u003Cspan>iptables -t nat -D PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080 \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>查看规则 \u003C/span>\u003Cbr>\u003Cspan>iptables -t nat -L \u003C/span>\u003Cbr>\u003Cspan>                         \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>另一个就是从80请求去调用8080的方案 \u003C/span>\u003Cbr>\u003Cspan>这个方案可以在 Tomcat 前段增加反向代理，例如：Nginx,Apache,Squid,Varnish或者F5， Array这类设备等等 \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cfont size=\"5\">\u003Cb>4. 如何部署应用程序\u003C/b>\u003C/font>\u003Cspan> \u003C/span>\u003Cbr>\u003Cbr>\u003Cbr>\u003Cspan>应用程序部署与tomcat启动,不能使用同一个用户。 \u003C/span>\u003Cbr>\u003Cspan>我的tomcat 安装在 /srv目录下，Tomcat启动用户为daemon; 应用程序放在/www目录下www所有者是www用户。这样的目的是一旦tomcat被植入web shell程序，它将不能创建或编辑/www目录下面的任何内容。 \u003C/span>\u003Cbr>\u003Cspan>adduser --home /www -c \"Web Application\" www \u003C/span>\u003Cbr>\u003Cspan>                 \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>我的Tomcat安装在/srv目录下，但应用程序放在/www目录下，一般是这样的结构。 \u003C/span>\u003Cbr>\u003Cspan>/www/example.com/www.example.com \u003C/span>\u003Cbr>\u003Cspan>                 \u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>每次升级将压错包解压到 /www/example.com/目录下，\u003C/span>\u003Ca href=\"http://www.example.com/\" target=\"_blank\">www.example.com\u003C/a>\u003Cspan> 是符号连接，连接到刚刚解压的目录。 \u003C/span>\u003Cbr>\u003Cspan>这个可以实现通过符号连接在多个版本之间快速切换。\u003C/span>\u003C/p>","**1. JVM**\n\n \n\n**\n1.1. 使用 Server JRE 替代JDK。\n**\n\n \n\n服务器上不要安装JDK，请使用 Server JRE. 服务器上根本不需要编译器，代码应该在Release服务器上完成编译打包工作。 \n\n理由：一旦服务器被控制，可以防止在其服务器上编译其他恶意代码并植入到你的程序中。 \n\n**1.2. JAVA_OPTS**\n\n \n\nexport JAVA_OPTS=\"-server -Xms512m -Xmx4096m  -XX:PermSize=64M -XX:MaxPermSize=512m\" \n\n                         \n\n-Xms 指定初始化时化的栈内存 \n\n-Xmx 指定最大栈内存 \n\n**提示**\n\n \n\nJava 8 以后 -XX:PermSize 与 -XX:MaxPermSize 两个配置项被废弃 \n\n**2. Tomcat 优化**\n\n \n\n**2.1. maxThreads 连接数限制**\n\n \n\nmaxThreads 是 Tomcat 所能接受最大连接数。一般设置不要超过8000以上，如果你的网站访问量非常大可能使用运行多个Tomcat实例的方法。 \n\n即，在一个服务器上启动多个tomcat然后做负载均衡处理。 \n\n                         \n\n \n\n                                           \n\n**提示**\n\n \n\n很多做过php运维的朋友在这里会犯一个大错误，php优化服务器通常怎做法是安装cpu以及内存的情况配置连接数，连接数过万都很正常，但java不同jvm配置要非常小心，稍有差错就会崩溃。 \n\nmaxThreads 配置要结合 JVM -Xmx 参数调整，也就是要考虑内存开销。 \n\nmaxThreads                  客户请求最大线程数 \n\nminSpareThreads            初始化时创建的 socket 线程数 \n\nmaxSpareThreads           连接器的最大空闲 socket 线程数 \n\n                         \n\n**2.2. 虚拟主机**\n\n \n\n不要使用Tomcat的虚拟主机，每个站点一个实例。即，启动多个tomcat. \n\n这也是PHP运维在这里常犯的错误，PHP的做法是一个Web下面放置多个虚拟主机，而不是每个主机启动一个web服务器。Tomcat 是多线程,共享内存，任何一个虚拟主机中的应用出现崩溃，会影响到所有应用程序。采用多个实例方式虽然开销比较大，但保证了应用程序隔离与安全。 \n\n**2.3. 压错传输**\n\n \n\n通常所说的gzip压缩，Tomcat通过在server.xml配置设置压缩的选项。 \n\n                         \n\n \n\n                         \n\n                         \n\n**提示**\n\n \n\n压缩会增加Tomcat负担，最好采用Nginx + Tomcat 或者 Apache + Tomcat 方式，压缩交由Nginx/Apache 去做。 \n\ncompression                         打开压缩功能   \n\ncompressionMinSize           启用压缩的输出内容大小，这里面默认为2KB \n\ncompressableMimeType         压缩类型                         \n\n                         \n\n**3. Tomcat 安全配置**\n\n \n\n**3.1. 禁用8005端口**\n\n \n\ntelnet localhost 8005 然后输入 SHUTDOWN 就可以关闭 Tomcat，为了安全我们要禁用该功能 \n\n                         \n\n \n\n                         \n\n                         \n\n**3.2. 安装后初始化配置**\n\n \n\n当Tomcat完成安装后你首先要做的事情如下： \n\n首次安装完成后立即删除webapps下面的所有代码 \n\nrm -rf /srv/apache-tomcat/webapps/* \n\n                         \n\n注释或删除 tomcat-users.xml 所有用户权限，看上去如下： \n\n                         \n\n# cat conf/tomcat-users.xml \n\n \n\n \n\n \n\n                         \n\n                         \n\n**3.2.1. 隐藏版本信息**\n\n \n\n隐藏Tomcat版本信息，首先隐藏HTTP头中的版本信息 \n\n                                 \n\nvim $CATALINA_HOME/conf/server.xml \n\n     \n\n# curl -I \n[http://localhost:8080/](http://localhost:8080/)\n \n\nHTTP/1.1 400 Bad Request \n\nTransfer-Encoding: chunked \n\nDate: Thu, 20 Oct 2011 09:51:55 GMT \n\nConnection: close \n\nServer: Neo App Srv 1.0 \n\n                                 \n\n                                 \n\n服务器信息已经被改为 Server: Neo App Srv 1.0 \n\n**注意：当出现 404 页面时仍可能看到Tomcat的版本信息**\n\n \n\nHTTP Status 404 - /sdf \n\ntype Status report \n\nmessage /sdf \n\ndescription The requested resource is not available. \n\nApache Tomcat/8.0.32                                         \n\n                                         \n\n隐藏Tomcat 404页面版本信息的方法如下 \n\n                                         \n\nmkdir -p apache-tomcat-8.0.33/lib/org/apache/catalina/util \n\ncat >> apache-tomcat-8.0.33/lib/org/apache/catalina/util/ServerInfo.properties","/article/41",11623,"2016-09-01 17:06:36","2018-10-18 17:06:58",[283,293,303,313,323,333,343,353,364,375],{"id":284,"category_id":40,"title":285,"keywords":6,"description":286,"image_url":6,"content":287,"content_md":288,"url":289,"hits":290,"is_recommend":73,"is_top":73,"create_time":291,"update_time":292},123,"Agent Skill 精选集：最值得收藏的 Agent Skills Top 10","如果你正在用 Claude Code 或 Codex，一定对 Agent Skills 不陌生。通过安装 Agent Skills，你可以让这些 AI 助手变得更强——不用每次都解释你的需求，它们直接就知道该怎么做。最近有人在 GitHub 上做了一个采样调查，统计了哪些 Skills 的质量最佳和最受欢迎。我整理了这份 Top 10 榜单，加上使用场景和适合人群，帮你快速找到最有用的那几个。Top 10 最受欢迎的 Agent Skills1. Skil","\u003Cp class=\"js_darkmode__2\">\u003Cspan leaf=\"\">如果你正在用 Claude Code 或 Codex，一定对 \u003C/span>\u003Cstrong class=\"js_darkmode__3\">\u003Cspan leaf=\"\">Agent Skills\u003C/span>\u003C/strong>\u003Cspan leaf=\"\"> 不陌生。通过安装 \u003C/span>\u003Cstrong class=\"js_darkmode__4\">\u003Cspan leaf=\"\">Agent Skills\u003C/span>\u003C/strong>\u003Cspan leaf=\"\">，你可以让这些 AI 助手变得更强——不用每次都解释你的需求，它们直接就知道该怎么做。\u003C/span>\u003C/p>\u003Cp class=\"js_darkmode__5\">\u003Cspan leaf=\"\">最近有人在 GitHub 上做了一个采样调查，统计了哪些 Skills 的质量最佳和最受欢迎。我整理了这份 \u003C/span>\u003Cstrong class=\"js_darkmode__6\">\u003Cspan leaf=\"\">Top 10 榜单\u003C/span>\u003C/strong>\u003Cspan leaf=\"\">，加上使用场景和适合人群，帮你快速找到最有用的那几个。\u003C/span>\u003C/p>\u003Cfigure class=\"js_darkmode__7\">\u003Cimg src=\"/uploads/layedit/20260119/8aada2026a0be6d68851e2f67e811025.png\" alt=\"1.png\">\u003Cbr>\u003Cfigcaption class=\"js_darkmode__9\" style=\"text-align: center;\">\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/figcaption>\u003C/figure>\u003Ch3 data-heading=\"true\" class=\"js_darkmode__10\">\u003Cspan leaf=\"\">Top 10 最受欢迎的 Agent Skills\u003C/span>\u003C/h3>\u003Ch4 data-heading=\"true\" class=\"js_darkmode__11\">\u003Cstrong class=\"js_darkmode__12\">\u003Cspan leaf=\"\">1. Skill Creator (技能生成器)\u003C/span>\u003C/strong>\u003C/h4>\u003Cul class=\"list-paddingleft-1 js_darkmode__13\">\u003Cli class=\"js_darkmode__14\">\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cstrong class=\"js_darkmode__15\">\u003Cspan leaf=\"\">","如果你正在用 Claude Code 或 Codex，一定对 \n**\nAgent Skills\n**\n 不陌生。通过安装 \n**\nAgent Skills\n**\n，你可以让这些 AI 助手变得更强——不用每次都解释你的需求，它们直接就知道该怎么做。\n\n最近有人在 GitHub 上做了一个采样调查，统计了哪些 Skills 的质量最佳和最受欢迎。我整理了这份 \n**\nTop 10 榜单\n**\n，加上使用场景和适合人群，帮你快速找到最有用的那几个。\n\n![1.png](/uploads/layedit/20260119/8aada2026a0be6d68851e2f67e811025.png)\n\n### Top 10 最受欢迎的 Agent Skills\n\n#### 1. Skill Creator (技能生成器)\n\n• ","/article/123",270,"2026-01-19 18:49:12","2026-01-19 18:52:01",{"id":294,"category_id":44,"title":295,"keywords":6,"description":296,"image_url":6,"content":297,"content_md":298,"url":299,"hits":300,"is_recommend":73,"is_top":73,"create_time":301,"update_time":302},122,"Nginx性能调优18条黄金法则：支撑10万并发的配置模板","一、概述1.1 背景介绍说实话，Nginx调优这事儿我踩过无数坑。记得2019年双11，我们电商平台流量暴涨，Nginx直接扛不住了，QPS从平时的2万飙升到8万，响应时间从50ms飙到了2秒，最后还是靠临时加机器扛过去的。那次事故之后，我花了大半年时间专门研究Nginx的性能极限，总结出了这20条黄金法则。Nginx作为目前最流行的Web服务器和反向代理，官方数据显示单机可以轻松处理10万+的并发连接。但实际生产环境中，很多同学拿到默认配置就直接上了，结果发现连1万并发都扛不住。问题不在Ngi","\u003Ch1 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__1\">\u003Cspan leaf=\"\">一、概述\u003C/span>\u003C/span>\u003C/h1>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__2\">\u003Cspan leaf=\"\">1.1 背景介绍\u003C/span>\u003C/span>\u003C/h3>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__3\">\u003Cspan leaf=\"\">说实话，Nginx调优这事儿我踩过无数坑。记得2019年双11，我们电商平台流量暴涨，Nginx直接扛不住了，QPS从平时的2万飙升到8万，响应时间从50ms飙到了2秒，最后还是靠临时加机器扛过去的。那次事故之后，我花了大半年时间专门研究Nginx的性能极限，总结出了这20条黄金法则。\u003C/span>\u003C/p>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__4\">\u003Cspan leaf=\"\">Nginx作为目前最流行的Web服务器和反向代理，官方数据显示单机可以轻松处理10万+的并发连接。但实际生产环境中，很多同学拿到默认配置就直接上了，结果发现连1万并发都扛不住。问题不在Nginx本身，而在于配置。\u003C/span>\u003C/p>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__5\">\u003Cspan leaf=\"\">1.2 技术特点\u003C/span>\u003C/span>\u003C/h3>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__6\">\u003Cspan leaf=\"\">Nginx采用事件驱动的异步非阻塞架构，这跟传统的Apache每个连接一个进程/线程的模式完全不同。打个比方：Apache像是银行柜台，每个客户都需要一个柜员全程服务；Nginx则像是叫号系统，一个柜员可以同时处理多个客户的不同阶段任务。\u003C/span>\u003C/p>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__7\">\u003Cspan leaf=\"\">核心优势：\u003C/span>\u003C/p>\u003Cul class=\"list-paddingleft-1 js_darkmode__8\">\u003Cli>\u003Csection class=\"js_darkmode__9\">\u003Cspan leaf=\"\">内存占用低：处理10000个非活跃HTTP keep-alive连接仅需2.5MB内存\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__10\">\u003Cspan leaf=\"\">事件驱动：基于epoll/kqueue，不会因为连接数增加而线性增长CPU消耗\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__11\">\u003Cspan leaf=\"\">模块化设计：只加载需要的模块，减少资源浪费\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__12\">\u003Cspan leaf=\"\">热部署：配置修改无需重启，平滑reload\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__13\">\u003Cspan leaf=\"\">1.3 适用场景\u003C/span>\u003C/span>\u003C/h3>\u003Cul class=\"list-paddingleft-1 js_darkmode__14\">\u003Cli>\u003Csection class=\"js_darkmode__15\">\u003Cspan leaf=\"\">高并发静态资源服务（图片、CSS、JS、视频）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__16\">\u003Cspan leaf=\"\">反向代理和负载均衡\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__17\">\u003Cspan leaf=\"\">API网关\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__18\">\u003Cspan leaf=\"\">SSL/TLS终结点\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__19\">\u003Cspan leaf=\"\">缓存服务器\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__20\">\u003Cspan leaf=\"\">WebSocket代理\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__21\">\u003Cspan leaf=\"\">1.4 环境要求\u003C/span>\u003C/span>\u003C/h3>\u003Csection data-tool=\"mdnice编辑器\">\u003Ctable class=\"layui-table\">\u003Cthead>\u003Ctr>\u003Cth class=\"js_darkmode__22\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">组件\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__23\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">版本\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__24\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">说明\u003C/span>\u003C/section>\u003C/th>\u003C/tr>\u003C/thead>\u003Ctbody>\u003Ctr class=\"js_darkmode__25\">\u003Ctd class=\"js_darkmode__26\">\u003Csection>\u003Cspan leaf=\"\">操作系统\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__27\">\u003Csection>\u003Cspan leaf=\"\">Rocky Linux 9.4 / Ubuntu 24.04 LTS\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__28\">\u003Csection>\u003Cspan leaf=\"\">内核版本建议5.15+\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__29\">\u003Ctd class=\"js_darkmode__30\">\u003Csection>\u003Cspan leaf=\"\">Nginx\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__31\">\u003Csection>\u003Cspan leaf=\"\">1.26.2 / 1.27.0\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__32\">\u003Csection>\u003Cspan leaf=\"\">mainline版本功能更新，stable版本更稳定\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__33\">\u003Ctd class=\"js_darkmode__34\">\u003Csection>\u003Cspan leaf=\"\">CPU\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__35\">\u003Csection>\u003Cspan leaf=\"\">8核+\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__36\">\u003Csection>\u003Cspan leaf=\"\">Nginx worker数量与CPU核心数相关\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__37\">\u003Ctd class=\"js_darkmode__38\">\u003Csection>\u003Cspan leaf=\"\">内存\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__39\">\u003Csection>\u003Cspan leaf=\"\">16GB+\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__40\">\u003Csection>\u003Cspan leaf=\"\">主要用于连接缓冲和缓存\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__41\">\u003Ctd class=\"js_darkmode__42\">\u003Csection>\u003Cspan leaf=\"\">网络\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__43\">\u003Csection>\u003Cspan leaf=\"\">万兆网卡\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__44\">\u003Csection>\u003Cspan leaf=\"\">千兆网卡在高并发下会成为瓶颈\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__45\">\u003Ctd class=\"js_darkmode__46\">\u003Csection>\u003Cspan leaf=\"\">磁盘\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__47\">\u003Csection>\u003Cspan leaf=\"\">NVMe SSD\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__48\">\u003Csection>\u003Cspan leaf=\"\">日志写入和缓存需要高IOPS\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003C/tbody>\u003C/table>\u003C/section>\u003Ch2 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__49\">\u003Cspan leaf=\"\">二、详细步骤\u003C/span>\u003C/span>\u003C/h2>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__50\">\u003Cspan leaf=\"\">2.1 准备工作\u003C/span>\u003C/span>\u003C/h3>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__51\">\u003Cspan leaf=\"\">2.1.1 系统内核参数调优\u003C/span>\u003C/span>\u003C/h4>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__52\">\u003Cspan leaf=\"\">在动Nginx配置之前，得先把操作系统底子打好。很多人忽略了这一步，结果Nginx配得再好也白搭。\u003C/span>\u003C/p>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__53\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEpeUhObicFUoIgKXw8XWhGkQeLA9oicBia3S3ZQ1g7RJVRSenCN4eaibW2NjdOeU8RXhs6Tic8eSNEMxt/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__0 js_darkmode__54\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__55\">\u003Cspan class=\"js_darkmode__56\"># /etc/sysctl.conf 追加以下内容\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan class=\"js_darkmode__57\"># 文件描述符限制\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">fs.file-max = 2097152\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">fs.nr_open = 2097152\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan class=\"js_darkmode__58\"># TCP连接相关\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">net.core.somaxconn = 65535\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">net.core.netdev_max_backlog = 65535\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">net.ipv4.tcp_max_syn_backlog = 65535\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan class=\"js_darkmode__59\"># TIME_WAIT优化（这个参数救过我无数次）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">net.ipv4.tcp_tw_reuse = 1\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">net.ipv4.tcp_fin_timeout = 15\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">net.ipv4.tcp_max_tw_buckets = 262144\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan class=\"js_darkmode__60\"># TCP keepalive\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">net.ipv4.tcp_keepalive_time = 600\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">net.ipv4.tcp_keepalive_intvl = 30\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">net.ipv4.tcp_keepalive_probes = 3\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan class=\"js_darkmode__61\"># 网络缓冲区\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">net.core.rmem_max = 16777216\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">net.core.wmem_max = 16777216\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">net.ipv4.tcp_rmem = 4096 87380 16777216\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">net.ipv4.tcp_wmem = 4096 65536 16777216\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan class=\"js_darkmode__62\"># 本地端口范围\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">net.ipv4.ip_local_port_range = 1024 65535\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__63\">\u003Cspan leaf=\"\">应用配置：\u003C/span>\u003C/p>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__64\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEpeUhObicFUoIgKXw8XWhGkQeLA9oicBia3S3ZQ1g7RJVRSenCN4eaibW2NjdOeU8RXhs6Tic8eSNEMxt/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__1 js_darkmode__65\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__66\">\u003Cspan leaf=\"\">sysctl -p\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__67\">\u003Cspan leaf=\"\">2.1.2 文件描述符限制\u003C/span>\u003C/span>\u003C/h4>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__68\">\u003Cspan leaf=\"\">这是个老生常谈的问题了，但每次接手新项目还是会遇到。Nginx报\"Too many open files\"错误，十有八九就是这个没配好。\u003C/span>\u003C/p>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__69\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEpeUhObicFUoIgKXw8XWhGkQeLA9oicBia3S3ZQ1g7RJVRSenCN4eaibW2NjdOeU8RXhs6Tic8eSNEMxt/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__2 js_darkmode__70\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__71\">\u003Cspan class=\"js_darkmode__72\"># /etc/security/limits.conf\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">* soft nofile 1048576\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">* hard nofile 1048576\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">nginx soft nofile 1048576\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">nginx hard nofile 1048576\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan class=\"js_darkmode__73\"># /etc/systemd/system/nginx.service.d/override.conf\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">[Service]\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">LimitNOFILE=1048576\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__74\">\u003Cspan leaf=\"\">2.2 核心配置\u003C/span>\u003C/span>\u003C/h3>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__75\">\u003Cspan leaf=\"\">法则1：worker进程数量配置\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__76\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEpeUhObicFUoIgKXw8XWhGkQeLA9oicBia3S3ZQ1g7RJVRSenCN4eaibW2NjdOeU8RXhs6Tic8eSNEMxt/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__3 js_darkmode__77\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__78\">\u003Cspan leaf=\"\"># 自动检测CPU核心数，省心省力\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">worker_processes auto;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 或者手动指定，建议等于CPU核心数\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># worker_processes 8;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># CPU亲和性绑定，减少CPU缓存失效\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">worker_cpu_affinity auto;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__79\">\u003Cstrong class=\"js_darkmode__80\">踩坑记录\u003C/strong>\u003Cspan leaf=\"\">：早期我喜欢把worker_processes设成CPU核心数的2倍，觉得这样能处理更多请求。结果发现这是典型的过度优化，多出来的worker进程反而增加了上下文切换开销，QPS不升反降。\u003C/span>\u003C/p>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__81\">\u003Cspan leaf=\"\">法则2：worker连接数配置\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__82\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEpeUhObicFUoIgKXw8XWhGkQeLA9oicBia3S3ZQ1g7RJVRSenCN4eaibW2NjdOeU8RXhs6Tic8eSNEMxt/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__4 js_darkmode__83\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__84\">\u003Cspan leaf=\"\">events {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 每个worker的最大连接数\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 理论最大并发 = worker_processes * worker_connections\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    worker_connections 65535;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 使用epoll事件模型（Linux 2.6+必选）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    use epoll;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 允许一个worker进程同时接受多个新连接\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    multi_accept on;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 互斥锁，高并发场景建议关闭\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    accept_mutex off;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__85\">\u003Cspan leaf=\"\">法则3：文件描述符缓存\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__86\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEpeUhObicFUoIgKXw8XWhGkQeLA9oicBia3S3ZQ1g7RJVRSenCN4eaibW2NjdOeU8RXhs6Tic8eSNEMxt/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__5 js_darkmode__87\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__88\">\u003Cspan leaf=\"\"># main context\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">worker_rlimit_nofile 1048576;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__89\">\u003Cspan leaf=\"\">法则4：sendfile零拷贝\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__90\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEpeUhObicFUoIgKXw8XWhGkQeLA9oicBia3S3ZQ1g7RJVRSenCN4eaibW2NjdOeU8RXhs6Tic8eSNEMxt/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__6 js_darkmode__91\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__92\">\u003Cspan leaf=\"\">http {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 开启sendfile，避免用户态和内核态之间的数据拷贝\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    sendfile on;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 配合sendfile使用，减少网络报文段数量\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    tcp_nopush on;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 禁用Nagle算法，减少延迟\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    tcp_nodelay on;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__93\">\u003Cstrong class=\"js_darkmode__94\">原理解释\u003C/strong>\u003Cspan leaf=\"\">：传统文件发送需要经历\"磁盘->内核缓冲区->用户缓冲区->socket缓冲区\"四次拷贝。sendfile直接在内核态完成\"磁盘->socket缓冲区\"的数据传输，理论上可以提升30%-40%的吞吐量。\u003C/span>\u003C/p>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__95\">\u003Cspan leaf=\"\">法则5：超时配置\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__96\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEpeUhObicFUoIgKXw8XWhGkQeLA9oicBia3S3ZQ1g7RJVRSenCN4eaibW2NjdOeU8RXhs6Tic8eSNEMxt/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__7 js_darkmode__97\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__98\">\u003Cspan leaf=\"\">http {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 客户端请求头超时\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    client_header_timeout 15s;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 客户端请求体超时\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    client_body_timeout 15s;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 响应超时\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    send_timeout 15s;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # keepalive超时\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    keepalive_timeout 65s;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # keepalive请求数量限制\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    keepalive_requests 10000;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__99\">\u003Cstrong class=\"js_darkmode__100\">踩坑记录\u003C/strong>\u003Cspan leaf=\"\">：曾经有个项目，上传大文件总是失败。排查半天发现是client_body_timeout设成了10秒，但大文件上传需要更长时间。生产环境这个值建议根据实际业务调整，不要一刀切。\u003C/span>\u003C/p>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__101\">\u003Cspan leaf=\"\">法则6：缓冲区配置\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__102\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEpeUhObicFUoIgKXw8XWhGkQeLA9oicBia3S3ZQ1g7RJVRSenCN4eaibW2NjdOeU8RXhs6Tic8eSNEMxt/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__8 js_darkmode__103\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__104\">\u003Cspan leaf=\"\">http {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 客户端请求体缓冲区\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    client_body_buffer_size 128k;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    client_max_body_size 100m;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 请求头缓冲区\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    client_header_buffer_size 4k;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    large_client_header_buffers 4 32k;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 代理缓冲区\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    proxy_buffer_size 64k;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    proxy_buffers 8 128k;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    proxy_busy_buffers_size 256k;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__105\">\u003Cspan leaf=\"\">法则7：Gzip压缩\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__106\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEpeUhObicFUoIgKXw8XWhGkQeLA9oicBia3S3ZQ1g7RJVRSenCN4eaibW2NjdOeU8RXhs6Tic8eSNEMxt/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__9 js_darkmode__107\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__108\">\u003Cspan leaf=\"\">http {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    gzip on;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    gzip_vary on;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    gzip_proxied any;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 压缩级别1-9，建议4-6，太高CPU消耗大\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    gzip_comp_level 5;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 最小压缩长度，太小的文件压缩反而浪费CPU\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    gzip_min_length 1024;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 压缩类型\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    gzip_types\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        text/plain\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        text/css\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        text/javascript\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        application/javascript\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        application/json\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        application/xml\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        application/xml+rss\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        image/svg+xml;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 预压缩文件支持\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    gzip_static on;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__109\">\u003Cstrong class=\"js_darkmode__110\">性能对比\u003C/strong>\u003Cspan leaf=\"\">：\u003C/span>\u003C/p>\u003Csection data-tool=\"mdnice编辑器\">\u003Ctable class=\"layui-table\">\u003Cthead>\u003Ctr>\u003Cth class=\"js_darkmode__111\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">压缩级别\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__112\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">压缩率\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__113\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">CPU消耗\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__114\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">适用场景\u003C/span>\u003C/section>\u003C/th>\u003C/tr>\u003C/thead>\u003Ctbody>\u003Ctr class=\"js_darkmode__115\">\u003Ctd class=\"js_darkmode__116\">\u003Csection>\u003Cspan leaf=\"\">1\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__117\">\u003Csection>\u003Cspan leaf=\"\">低\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__118\">\u003Csection>\u003Cspan leaf=\"\">最低\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__119\">\u003Csection>\u003Cspan leaf=\"\">CPU受限环境\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__120\">\u003Ctd class=\"js_darkmode__121\">\u003Csection>\u003Cspan leaf=\"\">4-5\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__122\">\u003Csection>\u003Cspan leaf=\"\">中\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__123\">\u003Csection>\u003Cspan leaf=\"\">中等\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__124\">\u003Csection>\u003Cspan leaf=\"\">通用场景（推荐）\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__125\">\u003Ctd class=\"js_darkmode__126\">\u003Csection>\u003Cspan leaf=\"\">9\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__127\">\u003Csection>\u003Cspan leaf=\"\">高\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__128\">\u003Csection>\u003Cspan leaf=\"\">最高\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__129\">\u003Csection>\u003Cspan leaf=\"\">带宽极其昂贵\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003C/tbody>\u003C/table>\u003C/section>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__130\">\u003Cspan leaf=\"\">法则8：静态文件缓存\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__131\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEpeUhObicFUoIgKXw8XWhGkQeLA9oicBia3S3ZQ1g7RJVRSenCN4eaibW2NjdOeU8RXhs6Tic8eSNEMxt/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__10 js_darkmode__132\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__133\">\u003Cspan leaf=\"\">http {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 打开文件缓存\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    open_file_cache max=100000 inactive=60s;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    open_file_cache_valid 60s;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    open_file_cache_min_uses 2;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    open_file_cache_errors on;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">server {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    location ~* \\.(jpg|jpeg|png|gif|ico|css|js|woff2)$ {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        expires 30d;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        add_header Cache-Control \"public, immutable\";\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        access_log off;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    }\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__134\">\u003Cspan leaf=\"\">法则9：日志优化\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__135\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEpeUhObicFUoIgKXw8XWhGkQeLA9oicBia3S3ZQ1g7RJVRSenCN4eaibW2NjdOeU8RXhs6Tic8eSNEMxt/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__11 js_darkmode__136\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__137\">\u003Cspan leaf=\"\">http {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 使用缓冲写入，减少磁盘IO\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    access_log /var/log/nginx/access.log main buffer=64k flush=5s;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 或者对于高并发场景，考虑关闭access log\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # access_log off;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 错误日志级别\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    error_log /var/log/nginx/error.log warn;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__138\">\u003Cstrong class=\"js_darkmode__139\">血泪教训\u003C/strong>\u003Cspan leaf=\"\">：生产环境日志不要开debug级别！我曾经为了排查问题临时开了debug，结果磁盘一会儿就满了，服务直接挂掉。\u003C/span>\u003C/p>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__140\">\u003Cspan leaf=\"\">法则10：SSL/TLS优化\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__141\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEpeUhObicFUoIgKXw8XWhGkQeLA9oicBia3S3ZQ1g7RJVRSenCN4eaibW2NjdOeU8RXhs6Tic8eSNEMxt/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__12 js_darkmode__142\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__143\">\u003Cspan leaf=\"\">http {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # SSL会话缓存\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    ssl_session_cache shared:SSL:50m;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    ssl_session_timeout 1d;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    ssl_session_tickets on;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # SSL协议版本\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    ssl_protocols TLSv1.2 TLSv1.3;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 优先使用服务器端加密套件\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    ssl_prefer_server_ciphers off;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # TLS 1.3加密套件\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # OCSP Stapling\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    ssl_stapling on;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    ssl_stapling_verify on;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    resolver 8.8.8.8 8.8.4.4 valid=300s;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__144\">\u003Cspan leaf=\"\">法则11：HTTP/2配置\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__145\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEpeUhObicFUoIgKXw8XWhGkQeLA9oicBia3S3ZQ1g7RJVRSenCN4eaibW2NjdOeU8RXhs6Tic8eSNEMxt/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__13 js_darkmode__146\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__147\">\u003Cspan leaf=\"\">server {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    listen 443 ssl;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    http2 on;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # HTTP/2推送（Nginx 1.25.1+）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 注意：主流浏览器已逐步废弃Server Push\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__148\">\u003Cspan leaf=\"\">法则12：连接复用优化\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__149\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEpeUhObicFUoIgKXw8XWhGkQeLA9oicBia3S3ZQ1g7RJVRSenCN4eaibW2NjdOeU8RXhs6Tic8eSNEMxt/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__14 js_darkmode__150\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__151\">\u003Cspan leaf=\"\">upstream backend {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    server 10.0.0.1:8080;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    server 10.0.0.2:8080;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 与后端保持的连接数\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    keepalive 300;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 单个连接最大请求数\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    keepalive_requests 10000;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 连接超时\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    keepalive_timeout 60s;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">server {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    location /api/ {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        proxy_pass http://backend;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        # 必须使用HTTP/1.1才能使用keepalive\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        proxy_http_version 1.1;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        proxy_set_header Connection \"\";\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    }\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__152\">\u003Cstrong class=\"js_darkmode__153\">这条救命配置\u003C/strong>\u003Cspan leaf=\"\">：很多人配了upstream的keepalive但不生效，99%是因为没加\u003C/span>\u003Ccode class=\"js_darkmode__154\">\u003Cspan leaf=\"\">proxy_set_header Connection \"\"\u003C/span>\u003C/code>\u003Cspan leaf=\"\">。默认情况下Nginx会把Connection头设成close，导致每次请求都新建连接。\u003C/span>\u003C/p>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__155\">\u003Cspan leaf=\"\">法则13：负载均衡算法选择\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__156\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEpeUhObicFUoIgKXw8XWhGkQeLA9oicBia3S3ZQ1g7RJVRSenCN4eaibW2NjdOeU8RXhs6Tic8eSNEMxt/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__15 js_darkmode__157\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__158\">\u003Cspan leaf=\"\">upstream backend {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 最少连接数算法，推荐\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    least_conn;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 或者IP哈希（需要会话保持时使用）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # ip_hash;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 或者一致性哈希\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # hash $request_uri consistent;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    server 10.0.0.1:8080 weight=3;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    server 10.0.0.2:8080 weight=2;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    server 10.0.0.3:8080 weight=1 backup;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__159\">\u003Cspan leaf=\"\">法则14：健康检查\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__160\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEpeUhObicFUoIgKXw8XWhGkQeLA9oicBia3S3ZQ1g7RJVRSenCN4eaibW2NjdOeU8RXhs6Tic8eSNEMxt/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__16 js_darkmode__161\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__162\">\u003Cspan leaf=\"\">upstream backend {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    server 10.0.0.1:8080 max_fails=3 fail_timeout=30s;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    server 10.0.0.2:8080 max_fails=3 fail_timeout=30s;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__163\">\u003Cspan leaf=\"\">开源版Nginx的健康检查比较弱，只能被动检测。如果需要主动健康检查，建议：\u003C/span>\u003C/p>\u003Cul class=\"list-paddingleft-1 js_darkmode__164\">\u003Cli>\u003Csection class=\"js_darkmode__165\">\u003Cspan leaf=\"\">使用Nginx Plus（商业版）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__166\">\u003Cspan leaf=\"\">使用第三方模块nginx_upstream_check_module\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__167\">\u003Cspan leaf=\"\">使用OpenResty\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__168\">\u003Cspan leaf=\"\">法则15：请求限流\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__169\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEpeUhObicFUoIgKXw8XWhGkQeLA9oicBia3S3ZQ1g7RJVRSenCN4eaibW2NjdOeU8RXhs6Tic8eSNEMxt/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__17 js_darkmode__170\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__171\">\u003Cspan leaf=\"\">http {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 定义限流区域\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=100r/s;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    limit_conn_zone $binary_remote_addr zone=conn_limit:10m;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">server {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    location /api/ {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        # 请求速率限制\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        limit_req zone=api_limit burst=200 nodelay;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        # 并发连接限制\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        limit_conn conn_limit 50;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        # 限流返回码\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        limit_req_status 429;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        limit_conn_status 429;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    }\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__172\">\u003Cspan leaf=\"\">法则16：proxy优化\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__173\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEpeUhObicFUoIgKXw8XWhGkQeLA9oicBia3S3ZQ1g7RJVRSenCN4eaibW2NjdOeU8RXhs6Tic8eSNEMxt/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__18 js_darkmode__174\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__175\">\u003Cspan leaf=\"\">location /api/ {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    proxy_pass http://backend;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 连接超时\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    proxy_connect_timeout 5s;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    proxy_send_timeout 60s;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    proxy_read_timeout 60s;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 失败重试\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    proxy_next_upstream error timeout http_502 http_503;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    proxy_next_upstream_tries 3;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    proxy_next_upstream_timeout 10s;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 请求头传递\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    proxy_set_header Host $host;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    proxy_set_header X-Real-IP $remote_addr;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    proxy_set_header X-Forwarded-Proto $scheme;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__176\">\u003Cspan leaf=\"\">法则17：缓存配置\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__177\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEpeUhObicFUoIgKXw8XWhGkQeLA9oicBia3S3ZQ1g7RJVRSenCN4eaibW2NjdOeU8RXhs6Tic8eSNEMxt/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__19 js_darkmode__178\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__179\">\u003Cspan leaf=\"\">http {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 定义缓存路径\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    proxy_cache_path /var/cache/nginx levels=1:2\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        keys_zone=api_cache:100m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        max_size=10g\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        inactive=60m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        use_temp_path=off;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">server {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    location /api/public/ {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        proxy_pass http://backend;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        proxy_cache api_cache;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        proxy_cache_valid 200 10m;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        proxy_cache_valid 404 1m;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        proxy_cache_use_stale error timeout updating;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        proxy_cache_lock on;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        add_header X-Cache-Status $upstream_cache_status;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    }\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__180\">\u003Cspan leaf=\"\">法则18：安全加固\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__181\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEpeUhObicFUoIgKXw8XWhGkQeLA9oicBia3S3ZQ1g7RJVRSenCN4eaibW2NjdOeU8RXhs6Tic8eSNEMxt/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__20 js_darkmode__182\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__183\">\u003Cspan leaf=\"\">http {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 隐藏版本号\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    server_tokens off;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 安全响应头\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    add_header X-Frame-Options \"SAMEORIGIN\" always;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    add_header X-Content-Type-Options \"nosniff\" always;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    add_header X-XSS-Protection \"1; mode=block\" always;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    add_header Referrer-Policy \"strict-origin-when-cross-origin\" always;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">server {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    # 禁止访问隐藏文件\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    location ~ /\\. {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        deny all;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        access_log off;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">        log_not_found off;\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    }\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">}\u003C/span>\u003C/code>\u003C/pre>","# 一、概述\n\n### 1.1 背景介绍\n\n说实话，Nginx调优这事儿我踩过无数坑。记得2019年双11，我们电商平台流量暴涨，Nginx直接扛不住了，QPS从平时的2万飙升到8万，响应时间从50ms飙到了2秒，最后还是靠临时加机器扛过去的。那次事故之后，我花了大半年时间专门研究Nginx的性能极限，总结出了这20条黄金法则。\n\nNginx作为目前最流行的Web服务器和反向代理，官方数据显示单机可以轻松处理10万+的并发连接。但实际生产环境中，很多同学拿到默认配置就直接上了，结果发现连1万并发都扛不住。问题不在Nginx本身，而在于配置。\n\n### 1.2 技术特点\n\nNginx采用事件驱动的异步非阻塞架构，这跟传统的Apache每个连接一个进程/线程的模式完全不同。打个比方：Apache像是银行柜台，每个客户都需要一个柜员全程服务；Nginx则像是叫号系统，一个柜员可以同时处理多个客户的不同阶段任务。\n\n核心优势：\n\n- 内存占用低：处理10000个非活跃HTTP keep-alive连接仅需2.5MB内存\n- 事件驱动：基于epoll/kqueue，不会因为连接数增加而线性增长CPU消耗\n- 模块化设计：只加载需要的模块，减少资源浪费\n- 热部署：配置修改无需重启，平滑reload\n\n### 1.3 适用场景\n\n- 高并发静态资源服务（图片、CSS、JS、视频）\n- 反向代理和负载均衡\n- API网关\n- SSL/TLS终结点\n- 缓存服务器\n- WebSocket代理\n\n### 1.4 环境要求\n\n组件\n\n版本\n\n说明\n\n操作系统\n\nRocky Linux 9.4 / Ubuntu 24.04 LTS\n\n内核版本建议5.15+\n\nNginx\n\n1.26.2 / 1.27.0\n\nmainline版本功能更新，stable版本更稳定\n\nCPU\n\n8核+\n\nNginx worker数量与CPU核心数相关\n\n内存\n\n16GB+\n\n主要用于连接缓冲和缓存\n\n网络\n\n万兆网卡\n\n千兆网卡在高并发下会成为瓶颈\n\n磁盘\n\nNVMe SSD\n\n日志写入和缓存需要高IOPS\n\n## 二、详细步骤\n\n### 2.1 准备工作\n\n#### 2.1.1 系统内核参数调优\n\n在动Nginx配置之前，得先把操作系统底子打好。很多人忽略了这一步，结果Nginx配得再好也白搭。\n\n```\n# /etc/sysctl.conf 追加以下内容# 文件描述符限制fs.file-max = 2097152fs.nr_open = 2097152# TCP连接相关net.core.somaxconn = 65535net.core.netdev_max_backlog = 65535net.ipv4.tcp_max_syn_backlog = 65535# TIME_WAIT优化（这个参数救过我无数次）net.ipv4.tcp_tw_reuse = 1net.ipv4.tcp_fin_timeout = 15net.ipv4.tcp_max_tw_buckets = 262144# TCP keepalivenet.ipv4.tcp_keepalive_time = 600net.ipv4.tcp_keepalive_intvl = 30net.ipv4.tcp_keepalive_probes = 3# 网络缓冲区net.core.rmem_max = 16777216net.core.wmem_max = 16777216net.ipv4.tcp_rmem = 4096 87380 16777216net.ipv4.tcp_wmem = 4096 65536 16777216# 本地端口范围net.ipv4.ip_local_port_range = 1024 65535\n```\n\n应用配置：\n\n```\nsysctl -p\n```\n\n#### 2.1.2 文件描述符限制\n\n这是个老生常谈的问题了，但每次接手新项目还是会遇到。Nginx报\"Too many open files\"错误，十有八九就是这个没配好。\n\n```\n# /etc/security/limits.conf* soft nofile 1048576* hard nofile 1048576nginx soft nofile 1048576nginx hard nofile 1048576# /etc/systemd/system/nginx.service.d/override.conf[Service]LimitNOFILE=1048576\n```\n\n### 2.2 核心配置\n\n#### 法则1：worker进程数量配置\n\n```\n# 自动检测CPU核心数，省心省力worker_processes auto;# 或者手动指定，建议等于CPU核心数# worker_processes 8;# CPU亲和性绑定，减少CPU缓存失效worker_cpu_affinity auto;\n```\n\n**踩坑记录**\n：早期我喜欢把worker_processes设成CPU核心数的2倍，觉得这样能处理更多请求。结果发现这是典型的过度优化，多出来的worker进程反而增加了上下文切换开销，QPS不升反降。\n\n#### 法则2：worker连接数配置\n\n```\nevents {    # 每个worker的最大连接数    # 理论最大并发 = worker_processes * worker_connections    worker_connections 65535;    # 使用epoll事件模型（Linux 2.6+必选）    use epoll;    # 允许一个worker进程同时接受多个新连接    multi_accept on;    # 互斥锁，高并发场景建议关闭    accept_mutex off;}\n```\n\n#### 法则3：文件描述符缓存\n\n```\n# main contextworker_rlimit_nofile 1048576;\n```\n\n#### 法则4：sendfile零拷贝\n\n```\nhttp {    # 开启sendfile，避免用户态和内核态之间的数据拷贝    sendfile on;    # 配合sendfile使用，减少网络报文段数量    tcp_nopush on;    # 禁用Nagle算法，减少延迟    tcp_nodelay on;}\n```\n\n**原理解释**\n：传统文件发送需要经历\"磁盘->内核缓冲区->用户缓冲区->socket缓冲区\"四次拷贝。sendfile直接在内核态完成\"磁盘->socket缓冲区\"的数据传输，理论上可以提升30%-40%的吞吐量。\n\n#### 法则5：超时配置\n\n```\nhttp {    # 客户端请求头超时    client_header_timeout 15s;    # 客户端请求体超时    client_body_timeout 15s;    # 响应超时    send_timeout 15s;    # keepalive超时    keepalive_timeout 65s;    # keepalive请求数量限制    keepalive_requests 10000;}\n```\n\n**踩坑记录**\n：曾经有个项目，上传大文件总是失败。排查半天发现是client_body_timeout设成了10秒，但大文件上传需要更长时间。生产环境这个值建议根据实际业务调整，不要一刀切。\n\n#### 法则6：缓冲区配置\n\n```\nhttp {    # 客户端请求体缓冲区    client_body_buffer_size 128k;    client_max_body_size 100m;    # 请求头缓冲区    client_header_buffer_size 4k;    large_client_header_buffers 4 32k;    # 代理缓冲区    proxy_buffer_size 64k;    proxy_buffers 8 128k;    proxy_busy_buffers_size 256k;}\n```\n\n#### 法则7：Gzip压缩\n\n```\nhttp {    gzip on;    gzip_vary on;    gzip_proxied any;    # 压缩级别1-9，建议4-6，太高CPU消耗大    gzip_comp_level 5;    # 最小压缩长度，太小的文件压缩反而浪费CPU    gzip_min_length 1024;    # 压缩类型    gzip_types        text/plain        text/css        text/javascript        application/javascript        application/json        application/xml        application/xml+rss        image/svg+xml;    # 预压缩文件支持    gzip_static on;}\n```\n\n**性能对比**\n：\n\n压缩级别\n\n压缩率\n\nCPU消耗\n\n适用场景\n\n1\n\n低\n\n最低\n\nCPU受限环境\n\n4-5\n\n中\n\n中等\n\n通用场景（推荐）\n\n9\n\n高\n\n最高\n\n带宽极其昂贵\n\n#### 法则8：静态文件缓存\n\n```\nhttp {    # 打开文件缓存    open_file_cache max=100000 inactive=60s;    open_file_cache_valid 60s;    open_file_cache_min_uses 2;    open_file_cache_errors on;}server {    location ~* \\.(jpg|jpeg|png|gif|ico|css|js|woff2)$ {        expires 30d;        add_header Cache-Control \"public, immutable\";        access_log off;    }}\n```\n\n#### 法则9：日志优化\n\n```\nhttp {    # 使用缓冲写入，减少磁盘IO    access_log /var/log/nginx/access.log main buffer=64k flush=5s;    # 或者对于高并发场景，考虑关闭access log    # access_log off;    # 错误日志级别    error_log /var/log/nginx/error.log warn;}\n```\n\n**血泪教训**\n：生产环境日志不要开debug级别！我曾经为了排查问题临时开了debug，结果磁盘一会儿就满了，服务直接挂掉。\n\n#### 法则10：SSL/TLS优化\n\n```\nhttp {    # SSL会话缓存    ssl_session_cache shared:SSL:50m;    ssl_session_timeout 1d;    ssl_session_tickets on;    # SSL协议版本    ssl_protocols TLSv1.2 TLSv1.3;    # 优先使用服务器端加密套件    ssl_prefer_server_ciphers off;    # TLS 1.3加密套件    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;    # OCSP Stapling    ssl_stapling on;    ssl_stapling_verify on;    resolver 8.8.8.8 8.8.4.4 valid=300s;}\n```\n\n#### 法则11：HTTP/2配置\n\n```\nserver {    listen 443 ssl;    http2 on;    # HTTP/2推送（Nginx 1.25.1+）    # 注意：主流浏览器已逐步废弃Server Push}\n```\n\n#### 法则12：连接复用优化\n\n```\nupstream backend {    server 10.0.0.1:8080;    server 10.0.0.2:8080;    # 与后端保持的连接数    keepalive 300;    # 单个连接最大请求数    keepalive_requests 10000;    # 连接超时    keepalive_timeout 60s;}server {    location /api/ {        proxy_pass http://backend;        # 必须使用HTTP/1.1才能使用keepalive        proxy_http_version 1.1;        proxy_set_header Connection \"\";    }}\n```\n\n**这条救命配置**\n：很多人配了upstream的keepalive但不生效，99%是因为没加\n`\nproxy_set_header Connection \"\"\n`\n。默认情况下Nginx会把Connection头设成close，导致每次请求都新建连接。\n\n#### 法则13：负载均衡算法选择\n\n```\nupstream backend {    # 最少连接数算法，推荐    least_conn;    # 或者IP哈希（需要会话保持时使用）    # ip_hash;    # 或者一致性哈希    # hash $request_uri consistent;    server 10.0.0.1:8080 weight=3;    server 10.0.0.2:8080 weight=2;    server 10.0.0.3:8080 weight=1 backup;}\n```\n\n#### 法则14：健康检查\n\n```\nupstream backend {    server 10.0.0.1:8080 max_fails=3 fail_timeout=30s;    server 10.0.0.2:8080 max_fails=3 fail_timeout=30s;}\n```\n\n开源版Nginx的健康检查比较弱，只能被动检测。如果需要主动健康检查，建议：\n\n- 使用Nginx Plus（商业版）\n- 使用第三方模块nginx_upstream_check_module\n- 使用OpenResty\n\n#### 法则15：请求限流\n\n```\nhttp {    # 定义限流区域    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=100r/s;    limit_conn_zone $binary_remote_addr zone=conn_limit:10m;}server {    location /api/ {        # 请求速率限制        limit_req zone=api_limit burst=200 nodelay;        # 并发连接限制        limit_conn conn_limit 50;        # 限流返回码        limit_req_status 429;        limit_conn_status 429;    }}\n```\n\n#### 法则16：proxy优化\n\n```\nlocation /api/ {    proxy_pass http://backend;    # 连接超时    proxy_connect_timeout 5s;    proxy_send_timeout 60s;    proxy_read_timeout 60s;    # 失败重试    proxy_next_upstream error timeout http_502 http_503;    proxy_next_upstream_tries 3;    proxy_next_upstream_timeout 10s;    # 请求头传递    proxy_set_header Host $host;    proxy_set_header X-Real-IP $remote_addr;    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;    proxy_set_header X-Forwarded-Proto $scheme;}\n```\n\n#### 法则17：缓存配置\n\n```\nhttp {    # 定义缓存路径    proxy_cache_path /var/cache/nginx levels=1:2        keys_zone=api_cache:100m        max_size=10g        inactive=60m        use_temp_path=off;}server {    location /api/public/ {        proxy_pass http://backend;        proxy_cache api_cache;        proxy_cache_valid 200 10m;        proxy_cache_valid 404 1m;        proxy_cache_use_stale error timeout updating;        proxy_cache_lock on;        add_header X-Cache-Status $upstream_cache_status;    }}\n```\n\n#### 法则18：安全加固\n\n```\nhttp {    # 隐藏版本号    server_tokens off;    # 安全响应头    add_header X-Frame-Options \"SAMEORIGIN\" always;    add_header X-Content-Type-Options \"nosniff\" always;    add_header X-XSS-Protection \"1; mode=block\" always;    add_header Referrer-Policy \"strict-origin-when-cross-origin\" always;}server {    # 禁止访问隐藏文件    location ~ /\\. {        deny all;        access_log off;        log_not_found off;    }}\n```","/article/122",337,"2026-01-12 11:11:50","2026-01-12 11:12:28",{"id":304,"category_id":46,"title":305,"keywords":6,"description":306,"image_url":6,"content":307,"content_md":308,"url":309,"hits":310,"is_recommend":73,"is_top":73,"create_time":311,"update_time":312},121,"Docker 镜像优化与安全扫描：将镜像体积压缩 70%","1. 适用场景 & 前置条件项目要求适用场景容器化应用镜像体积过大（> 500MB），构建时间长（> 10分钟），存在安全漏洞（CVE高危）OSRHEL/CentOS 7.9+ 或 Ubuntu 20.04+内核Linux Kernel 3.10+软件版本Docker 20.10+ 或 Podman 3.0+，Trivy 0.40+（安全扫描工具）资源规格2C4G（最小）/ 4C8G（推荐），磁盘 50GB+（存储镜像与缓存）网络可访问 Docker Hub/阿里云镜像仓库（","\u003Ch3 class=\"js_darkmode__bg__23\" style=\"text-align: justify;\">\u003Cspan>架构与数据流说明\u003C/span>\u003C/h3>\u003Cp class=\"js_darkmode__84\" style=\"text-align: justify;\">\u003Cspan>Docker 镜像分层架构：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__24 js_darkmode__85\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\">镜像 = 基础镜像层 + 依赖层 + 应用层 + 配置层\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    ↓\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">每个 Dockerfile 指令（RUN/COPY/ADD）创建新层（Layer）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    ↓\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">层累加形成最终镜像（Union File System，联合文件系统）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    ↓\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">容器运行时在镜像顶部添加可写层（Container Layer）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__86\" style=\"text-align: justify;\">\u003Cspan>镜像体积构成：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__25 js_darkmode__87\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\">总体积 = 基础镜像（如 Ubuntu:22.04 = 77MB）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">       + 系统依赖（apt install = 100-500MB）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">       + 应用依赖（Python packages = 50-200MB）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">       + 应用代码（10-50MB）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">       + 缓存与临时文件（50-200MB）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__88\" style=\"text-align: justify;\">\u003Cspan>优化策略：\u003C/span>\u003C/p>\u003Col class=\"list-paddingleft-1 js_darkmode__89\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">1. \u003C/span>\u003Cspan>替换基础镜像\u003C/span>\u003Cspan leaf=\"\">：Ubuntu（77MB）→ Alpine（5MB）→ Distroless（< 2MB）→ Scratch（0MB，仅静态二进制）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">2. \u003C/span>\u003Cspan>多阶段构建\u003C/span>\u003Cspan leaf=\"\">：构建阶段（完整工具链）→ 运行时阶段（仅复制二进制与依赖）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">3. \u003C/span>\u003Cspan>层合并\u003C/span>\u003Cspan leaf=\"\">：多个 RUN 指令合并为一个（减少层数，清理临时文件）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">4. \u003C/span>\u003Cspan>依赖精简\u003C/span>\u003Cspan leaf=\"\">：仅安装运行时必需依赖，移除构建工具\u003C/span>\u003C/section>\u003C/li>\u003C/ol>\u003Cp class=\"js_darkmode__90\" style=\"text-align: justify;\">\u003Cspan>安全扫描流程：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__26 js_darkmode__91\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\">构建镜像 → Trivy 扫描 → 发现漏洞（CVE列表）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    ↓\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">分析漏洞来源（基础镜像 / 依赖包 / 应用代码）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    ↓\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">修复措施：升级基础镜像 / 更新依赖 / 打补丁\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    ↓\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">重新构建 → 再次扫描 → 确认修复\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Chr class=\"js_darkmode__bg__27 js_darkmode__92\" style=\"text-align: justify;\">\u003Ch3 class=\"js_darkmode__bg__28\" style=\"text-align: justify;\">\u003Cspan>Step 1: 评估当前镜像（基线测量）\u003C/span>\u003C/h3>\u003Cp class=\"js_darkmode__93\" style=\"text-align: justify;\">\u003Cspan>目标：\u003C/span>\u003Cspan leaf=\"\"> 获取优化前的镜像大小、层数、漏洞数量作为对比基线\u003C/span>\u003C/p>\u003Ch4 class=\"js_darkmode__bg__29\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>1.1 检查镜像大小与层数\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__30 js_darkmode__94\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 查看镜像列表与大小\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker images\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 示例输出：\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># REPOSITORY          TAG       IMAGE ID       CREATED         SIZE\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># my-python-app       v1.0      a1b2c3d4e5f6   2 hours ago     1.2GB  # ⚠️ 过大\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 查看镜像构建历史（每层大小）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker \u003C/span>\u003Cspan leaf=\"\">history\u003C/span>\u003Cspan leaf=\"\"> my-python-app:v1.0\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 示例输出：\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># IMAGE          CREATED       CREATED BY                                      SIZE      COMMENT\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># a1b2c3d4e5f6   2 hours ago   /bin/sh -c pip install -r requirements.txt      350MB     # ⚠️ 依赖层过大\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># b2c3d4e5f6a7   3 hours ago   /bin/sh -c apt-get install -y build-essential   250MB     # ⚠️ 构建工具未清理\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># c3d4e5f6a7b8   1 day ago     /bin/sh -c #(nop) FROM ubuntu:22.04              77MB\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 统计总层数\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker \u003C/span>\u003Cspan leaf=\"\">history\u003C/span>\u003Cspan leaf=\"\"> my-python-app:v1.0 --no-trunc | \u003C/span>\u003Cspan leaf=\"\">wc\u003C/span>\u003Cspan leaf=\"\"> -l\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 预期输出：25 层（正常应 < 15 层）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__31\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>1.2 安装并运行 Trivy 安全扫描\u003C/span>\u003C/h4>\u003Cp class=\"js_darkmode__95\" style=\"text-align: justify;\">\u003Cspan>安装 Trivy（Ubuntu/Debian）：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__32 js_darkmode__96\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 方法1：使用官方脚本\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 方法2：使用 apt\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">sudo\u003C/span>\u003Cspan leaf=\"\"> apt-get install wget apt-transport-https gnupg lsb-release\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | \u003C/span>\u003Cspan leaf=\"\">sudo\u003C/span>\u003Cspan leaf=\"\"> apt-key add -\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">echo\u003C/span>\u003Cspan leaf=\"\">\"deb https://aquasecurity.github.io/trivy-repo/deb \u003C/span>\u003Cspan leaf=\"\">$(lsb_release -sc)\u003C/span>\u003Cspan leaf=\"\"> main\"\u003C/span>\u003Cspan leaf=\"\"> | \u003C/span>\u003Cspan leaf=\"\">sudo\u003C/span>\u003Cspan leaf=\"\">tee\u003C/span>\u003Cspan leaf=\"\"> -a /etc/apt/sources.list.d/trivy.list\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">sudo\u003C/span>\u003Cspan leaf=\"\"> apt-get update && \u003C/span>\u003Cspan leaf=\"\">sudo\u003C/span>\u003Cspan leaf=\"\"> apt-get install trivy\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__97\" style=\"text-align: justify;\">\u003Cspan>安装 Trivy（RHEL/CentOS）：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__33 js_darkmode__98\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 使用 rpm\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">rpm -ivh https://github.com/aquasecurity/trivy/releases/download/v0.48.3/trivy_0.48.3_Linux-64bit.rpm\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 或使用二进制文件\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">wget https://github.com/aquasecurity/trivy/releases/download/v0.48.3/trivy_0.48.3_Linux-64bit.tar.gz\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">tar -zxvf trivy_0.48.3_Linux-64bit.tar.gz\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">sudo\u003C/span>\u003Cspan leaf=\"\">mv\u003C/span>\u003Cspan leaf=\"\"> trivy /usr/local/bin/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__99\" style=\"text-align: justify;\">\u003Cspan>扫描镜像漏洞：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__34 js_darkmode__100\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 扫描镜像并输出报告\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">trivy image my-python-app:v1.0\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 示例输出（截取）：\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># my-python-app:v1.0 (ubuntu 22.04)\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">#\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># Total: 342 (UNKNOWN: 0, LOW: 150, MEDIUM: 120, HIGH: 50, CRITICAL: 22)  # ⚠️ 22个严重漏洞！\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">#\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># +--------------+------------------+----------+-------------------+---------------+\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># | LIBRARY      | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># +--------------+------------------+----------+-------------------+---------------+\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># | libc6        | CVE-2023-4911    | CRITICAL | 2.35-0ubuntu3.1   | 2.35-0ubuntu3.4 |\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># | openssl      | CVE-2023-5678    | HIGH     | 3.0.2-0ubuntu1.10 | 3.0.2-0ubuntu1.12 |\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># | python3.10   | CVE-2023-9999    | HIGH     | 3.10.12-1         | 3.10.12-2 |\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># +--------------+------------------+----------+-------------------+---------------+\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 仅显示高危及以上漏洞\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">trivy image --severity HIGH,CRITICAL my-python-app:v1.0\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 导出 JSON 格式报告（用于 CI/CD）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">trivy image --format json --output report.json my-python-app:v1.0\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__101\" style=\"text-align: justify;\">\u003Cspan>执行前验证：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__35 js_darkmode__102\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 确认 Docker 已安装\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker --version\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 预期输出：Docker version 24.0.7\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 确认镜像存在\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker images | grep my-python-app\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__103\" style=\"text-align: justify;\">\u003Cspan>执行后验证：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__36 js_darkmode__104\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 确认 Trivy 安装成功\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">trivy --version\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 预期输出：Version: 0.48.3\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 检查扫描报告文件\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">ls\u003C/span>\u003Cspan leaf=\"\"> -lh report.json\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Chr class=\"js_darkmode__bg__37 js_darkmode__105\" style=\"text-align: justify;\">\u003Ch3 class=\"js_darkmode__bg__38\" style=\"text-align: justify;\">\u003Cspan>Step 2: 优化 Dockerfile - 切换基础镜像\u003C/span>\u003C/h3>\u003Cp class=\"js_darkmode__106\" style=\"text-align: justify;\">\u003Cspan>目标：\u003C/span>\u003Cspan leaf=\"\"> 将基础镜像从 Ubuntu 替换为 Alpine Linux，减少 70-90% 体积\u003C/span>\u003C/p>\u003Ch4 class=\"js_darkmode__bg__39\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>2.1 原 Dockerfile（未优化）\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__40 js_darkmode__107\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 原 Dockerfile（Python 应用示例）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">FROM\u003C/span>\u003Cspan leaf=\"\"> ubuntu:\u003C/span>\u003Cspan leaf=\"\">22.04\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 安装系统依赖\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apt-get update && apt-get install -y \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    python3 \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    python3-pip \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    build-essential \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    libpq-dev \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    curl \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    vim\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 安装 Python 依赖\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">COPY\u003C/span>\u003Cspan leaf=\"\"> requirements.txt /app/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">WORKDIR\u003C/span>\u003Cspan leaf=\"\"> /app\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> pip3 install -r requirements.txt\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 复制应用代码\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">COPY\u003C/span>\u003Cspan leaf=\"\"> . /app/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 暴露端口\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">EXPOSE\u003C/span>\u003Cspan leaf=\"\">8000\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 启动命令\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">CMD\u003C/span>\u003Cspan leaf=\"\"> [\u003C/span>\u003Cspan leaf=\"\">\"python3\"\u003C/span>\u003Cspan leaf=\"\">, \u003C/span>\u003Cspan leaf=\"\">\"app.py\"\u003C/span>\u003Cspan leaf=\"\">]\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 问题分析：\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 1. 基础镜像过大（Ubuntu 77MB）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 2. 安装了不必要的工具（vim/curl）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 3. 未清理 apt 缓存\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 4. 未使用多阶段构建\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 5. 以 root 用户运行（安全风险）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__108\" style=\"text-align: justify;\">\u003Cspan>构建并测量：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__41 js_darkmode__109\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\">docker build -t my-python-app:v1.0-ubuntu .\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker images my-python-app:v1.0-ubuntu\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 输出：SIZE = 1.2GB\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__42\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>2.2 优化版 Dockerfile（Alpine 基础镜像）\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__43 js_darkmode__110\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 优化 Dockerfile（Alpine Linux）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">FROM\u003C/span>\u003Cspan leaf=\"\"> python:\u003C/span>\u003Cspan leaf=\"\">3.11\u003C/span>\u003Cspan leaf=\"\">-alpine3.\u003C/span>\u003Cspan leaf=\"\">18\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 设置工作目录\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">WORKDIR\u003C/span>\u003Cspan leaf=\"\"> /app\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 安装运行时依赖（仅必需的库）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apk add --no-cache \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    libpq \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    && \u003C/span>\u003Cspan leaf=\"\">rm\u003C/span>\u003Cspan leaf=\"\"> -rf /var/cache/apk/*  \u003C/span>\u003Cspan leaf=\"\"># 清理apk缓存\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 安装 Python 依赖（使用虚拟环境）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">COPY\u003C/span>\u003Cspan leaf=\"\"> requirements.txt .\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apk add --no-cache --virtual .build-deps \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    gcc \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    musl-dev \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    postgresql-dev \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    && pip install --no-cache-dir -r requirements.txt \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    && apk del .build-deps  \u003C/span>\u003Cspan leaf=\"\"># 删除构建依赖\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 复制应用代码\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">COPY\u003C/span>\u003Cspan leaf=\"\"> --\u003C/span>\u003Cspan leaf=\"\">chown\u003C/span>\u003Cspan leaf=\"\">=appuser:appuser . .\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 创建非 root 用户\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> addgroup -S appuser && adduser -S appuser -G appuser\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 切换到非 root 用户\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">USER\u003C/span>\u003Cspan leaf=\"\"> appuser\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 暴露端口\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">EXPOSE\u003C/span>\u003Cspan leaf=\"\">8000\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 健康检查\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">HEALTHCHECK\u003C/span>\u003Cspan leaf=\"\"> --interval=30s --\u003C/span>\u003Cspan leaf=\"\">timeout\u003C/span>\u003Cspan leaf=\"\">=3s \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    CMD wget --quiet --tries=1 --spider http://localhost:8000/health || \u003C/span>\u003Cspan leaf=\"\">exit\u003C/span>\u003Cspan leaf=\"\"> 1\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 启动命令\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">CMD\u003C/span>\u003Cspan leaf=\"\"> [\u003C/span>\u003Cspan leaf=\"\">\"python\"\u003C/span>\u003Cspan leaf=\"\">, \u003C/span>\u003Cspan leaf=\"\">\"app.py\"\u003C/span>\u003Cspan leaf=\"\">]\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__111\" style=\"text-align: justify;\">\u003Cspan>关键优化点解释：\u003C/span>\u003C/p>\u003Col class=\"list-paddingleft-1 js_darkmode__112\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">1. \u003C/span>\u003Cspan>python:3.11-alpine3.18\u003C/span>\u003Cspan leaf=\"\">：官方 Alpine 基础镜像（约 50MB，比 Ubuntu 小 35%）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">2. \u003C/span>\u003Cspan>apk add --no-cache\u003C/span>\u003Cspan leaf=\"\">：不保留 apk 索引缓存（减少 5-10MB）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">3. \u003C/span>\u003Cspan>–virtual .build-deps\u003C/span>\u003Cspan leaf=\"\">：构建依赖打包为虚拟包，安装后可整体删除\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">4. \u003C/span>\u003Cspan>–no-cache-dir\u003C/span>\u003Cspan leaf=\"\">：pip 不缓存下载的包（减少 50-100MB）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">5. \u003C/span>\u003Cspan>USER appuser\u003C/span>\u003Cspan leaf=\"\">：非 root 用户运行（安全加固）\u003C/span>\u003C/section>\u003C/li>\u003C/ol>\u003Cp class=\"js_darkmode__113\" style=\"text-align: justify;\">\u003Cspan>构建并对比：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__44 js_darkmode__114\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\">docker build -t my-python-app:v1.0-alpine .\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker images | grep my-python-app\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 输出：\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># my-python-app:v1.0-ubuntu   1.2GB\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># my-python-app:v1.0-alpine   350MB  # 减少 70.8%\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Chr class=\"js_darkmode__bg__45 js_darkmode__115\" style=\"text-align: justify;\">\u003Ch3 class=\"js_darkmode__bg__46\" style=\"text-align: justify;\">\u003Cspan>Step 3: 优化 Dockerfile - 多阶段构建\u003C/span>\u003C/h3>\u003Cp class=\"js_darkmode__116\" style=\"text-align: justify;\">\u003Cspan>目标：\u003C/span>\u003Cspan leaf=\"\"> 将构建环境与运行时环境分离，进一步减少 50-70% 体积\u003C/span>\u003C/p>\u003Ch4 class=\"js_darkmode__bg__47\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>3.1 多阶段构建 Dockerfile（最终优化版）\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__48 js_darkmode__117\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># ============ 阶段1：构建阶段 ============\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">FROM\u003C/span>\u003Cspan leaf=\"\"> python:\u003C/span>\u003Cspan leaf=\"\">3.11\u003C/span>\u003Cspan leaf=\"\">-alpine3.\u003C/span>\u003Cspan leaf=\"\">18\u003C/span>\u003Cspan leaf=\"\"> AS builder\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">WORKDIR\u003C/span>\u003Cspan leaf=\"\"> /app\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 安装构建依赖\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apk add --no-cache \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    gcc \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    musl-dev \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    postgresql-dev \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    libffi-dev\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 安装 Python 依赖到虚拟环境\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">COPY\u003C/span>\u003Cspan leaf=\"\"> requirements.txt .\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> python -m venv /opt/venv && \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    /opt/venv/bin/pip install --no-cache-dir -r requirements.txt\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># ============ 阶段2：运行时阶段 ============\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">FROM\u003C/span>\u003Cspan leaf=\"\"> python:\u003C/span>\u003Cspan leaf=\"\">3.11\u003C/span>\u003Cspan leaf=\"\">-alpine3.\u003C/span>\u003Cspan leaf=\"\">18\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">WORKDIR\u003C/span>\u003Cspan leaf=\"\"> /app\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 仅安装运行时库（无需编译工具）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apk add --no-cache \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    libpq \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    libffi \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    && \u003C/span>\u003Cspan leaf=\"\">rm\u003C/span>\u003Cspan leaf=\"\"> -rf /var/cache/apk/*\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 从构建阶段复制虚拟环境\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">COPY\u003C/span>\u003Cspan leaf=\"\"> --from=builder /opt/venv /opt/venv\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 复制应用代码\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">COPY\u003C/span>\u003Cspan leaf=\"\"> --\u003C/span>\u003Cspan leaf=\"\">chown\u003C/span>\u003Cspan leaf=\"\">=appuser:appuser . .\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 创建非 root 用户\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> addgroup -S appuser && adduser -S appuser -G appuser\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 设置环境变量（使用虚拟环境）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">ENV\u003C/span>\u003Cspan leaf=\"\"> PATH=\u003C/span>\u003Cspan leaf=\"\">\"/opt/venv/bin:$PATH\"\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">USER\u003C/span>\u003Cspan leaf=\"\"> appuser\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">EXPOSE\u003C/span>\u003Cspan leaf=\"\">8000\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">HEALTHCHECK\u003C/span>\u003Cspan leaf=\"\"> --interval=30s --\u003C/span>\u003Cspan leaf=\"\">timeout\u003C/span>\u003Cspan leaf=\"\">=3s \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    CMD wget --quiet --tries=1 --spider http://localhost:8000/health || \u003C/span>\u003Cspan leaf=\"\">exit\u003C/span>\u003Cspan leaf=\"\"> 1\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">CMD\u003C/span>\u003Cspan leaf=\"\"> [\u003C/span>\u003Cspan leaf=\"\">\"python\"\u003C/span>\u003Cspan leaf=\"\">, \u003C/span>\u003Cspan leaf=\"\">\"app.py\"\u003C/span>\u003Cspan leaf=\"\">]\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__118\" style=\"text-align: justify;\">\u003Cspan>多阶段构建优势：\u003C/span>\u003C/p>\u003Cul class=\"list-paddingleft-1 js_darkmode__119\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>阶段1（builder）\u003C/span>\u003Cspan leaf=\"\">：包含完整编译工具链（gcc/make），用于编译 C 扩展依赖\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>阶段2（运行时）\u003C/span>\u003Cspan leaf=\"\">：仅复制编译好的二进制与依赖，不包含编译工具\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>体积减少\u003C/span>\u003Cspan leaf=\"\">：编译工具约占 150-200MB，通过多阶段构建完全删除\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Cp class=\"js_darkmode__120\" style=\"text-align: justify;\">\u003Cspan>构建并对比：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__49 js_darkmode__121\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\">docker build -t my-python-app:v1.0-multistage .\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker images | grep my-python-app\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 输出：\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># my-python-app:v1.0-ubuntu      1.2GB\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># my-python-app:v1.0-alpine      350MB\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># my-python-app:v1.0-multistage  120MB  # 减少 90%！\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__122\" style=\"text-align: justify;\">\u003Cspan>验证功能完整性：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__50 js_darkmode__123\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 启动容器\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker run -d -p 8000:8000 --name test-app my-python-app:v1.0-multistage\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 测试应用\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">curl http://localhost:8000/health\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 预期输出：{\"status\": \"healthy\"}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 检查容器日志\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker logs test-app\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 清理测试容器\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker stop test-app && docker \u003C/span>\u003Cspan leaf=\"\">rm\u003C/span>\u003Cspan leaf=\"\"> test-app\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Chr class=\"js_darkmode__bg__51 js_darkmode__124\" style=\"text-align: justify;\">\u003Ch3 class=\"js_darkmode__bg__52\" style=\"text-align: justify;\">\u003Cspan>Step 4: 层合并与缓存清理\u003C/span>\u003C/h3>\u003Cp class=\"js_darkmode__125\" style=\"text-align: justify;\">\u003Cspan>目标：\u003C/span>\u003Cspan leaf=\"\"> 减少镜像层数，清理构建缓存与临时文件\u003C/span>\u003C/p>\u003Ch4 class=\"js_darkmode__bg__53\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>4.1 合并 RUN 指令\u003C/span>\u003C/h4>\u003Cp class=\"js_darkmode__126\" style=\"text-align: justify;\">\u003Cspan>未优化（多层）：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__54 js_darkmode__127\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apt-get update\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apt-get install -y python3\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apt-get install -y python3-pip\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apt-get install -y libpq-dev\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apt-get clean\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 问题：每个 RUN 创建一层，即使最后 clean 也不会减少前面层的体积\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__128\" style=\"text-align: justify;\">\u003Cspan>优化后（单层）：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__55 js_darkmode__129\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apt-get update && apt-get install -y \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    python3 \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    python3-pip \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    libpq-dev \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    && apt-get clean \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    && \u003C/span>\u003Cspan leaf=\"\">rm\u003C/span>\u003Cspan leaf=\"\"> -rf /var/lib/apt/lists/*  \u003C/span>\u003Cspan leaf=\"\"># 删除 apt 缓存\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 优势：一层完成，临时文件在同一层内删除，不占用最终镜像体积\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__56\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>4.2 使用 .dockerignore 文件\u003C/span>\u003C/h4>\u003Cp class=\"js_darkmode__130\" style=\"text-align: justify;\">\u003Cspan>创建 .dockerignore：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__57 js_darkmode__131\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># .dockerignore（排除无关文件）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 版本控制\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">.git\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">.gitignore\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">.github\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 开发文件\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">*.md\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">*.\u003C/span>\u003Cspan leaf=\"\">log\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">*.pyc\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">__pycache__/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">.pytest_cache/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">.vscode/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">.idea/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 测试文件\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">tests/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">test_*.py\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 构建产物\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">build/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">dist/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">*.egg-info/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 环境文件\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">.\u003C/span>\u003Cspan leaf=\"\">env\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">.env.local\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">venv/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">env\u003C/span>\u003Cspan leaf=\"\">/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 文档\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docs/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">README.md\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">LICENSE\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># CI/CD\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">.gitlab-ci.yml\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">Jenkinsfile\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__132\" style=\"text-align: justify;\">\u003Cspan>效果验证：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__58 js_darkmode__133\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 对比 COPY 指令复制的文件大小\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 未使用 .dockerignore：COPY . . 复制 50MB\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 使用后：COPY . . 复制 15MB（减少 70%）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__59\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>4.3 启用 Docker BuildKit\u003C/span>\u003C/h4>\u003Cp class=\"js_darkmode__134\" style=\"text-align: justify;\">\u003Cspan>启用方法：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__60 js_darkmode__135\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 方法1：环境变量\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">export\u003C/span>\u003Cspan leaf=\"\"> DOCKER_BUILDKIT=1\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker build -t my-app:v2.0 .\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 方法2：守护进程配置（持久化）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># /etc/docker/daemon.json\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">{\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\"features\"\u003C/span>\u003Cspan leaf=\"\">: {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\"buildkit\"\u003C/span>\u003Cspan leaf=\"\">: \u003C/span>\u003Cspan leaf=\"\">true\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">  }\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 重启 Docker\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">sudo\u003C/span>\u003Cspan leaf=\"\"> systemctl restart docker\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__136\" style=\"text-align: justify;\">\u003Cspan>BuildKit 优势：\u003C/span>\u003C/p>\u003Cul class=\"list-paddingleft-1 js_darkmode__137\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• 并行构建多个层（性能提升 2-5 倍）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• 自动跳过未使用的阶段（多阶段构建优化）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• 更好的缓存机制（修改代码不重新下载依赖）\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Cp class=\"js_darkmode__138\" style=\"text-align: justify;\">\u003Cspan>验证 BuildKit 启用：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__61 js_darkmode__139\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\">docker build -t test-buildkit .\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 输出包含 [buildkit] 标识\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># [buildkit] [1/5] FROM docker.io/library/python:3.11-alpine3.18\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Chr class=\"js_darkmode__bg__62 js_darkmode__140\" style=\"text-align: justify;\">\u003Ch3 class=\"js_darkmode__bg__63\" style=\"text-align: justify;\">\u003Cspan>Step 5: 安全扫描与漏洞修复\u003C/span>\u003C/h3>\u003Cp class=\"js_darkmode__141\" style=\"text-align: justify;\">\u003Cspan>目标：\u003C/span>\u003Cspan leaf=\"\"> 扫描优化后的镜像，修复高危漏洞至零\u003C/span>\u003C/p>\u003Ch4 class=\"js_darkmode__bg__64\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>5.1 扫描优化后的镜像\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__65 js_darkmode__142\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 扫描多阶段构建的镜像\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">trivy image --severity HIGH,CRITICAL my-python-app:v1.0-multistage\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 示例输出：\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># Total: 12 (HIGH: 8, CRITICAL: 4)  # 仍有漏洞（来自基础镜像或依赖）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">#\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># +--------------+------------------+----------+-------------------+---------------+\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># | LIBRARY      | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># +--------------+------------------+----------+-------------------+---------------+\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># | libcrypto3   | CVE-2023-5678    | CRITICAL | 3.0.10-r0         | 3.0.12-r0     |\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># | python3.11   | CVE-2023-9999    | HIGH     | 3.11.6-r0         | 3.11.7-r1     |\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># +--------------+------------------+----------+-------------------+---------------+\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__66\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>5.2 修复漏洞 - 升级基础镜像\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__67 js_darkmode__143\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 原基础镜像（存在漏洞）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">FROM\u003C/span>\u003Cspan leaf=\"\"> python:\u003C/span>\u003Cspan leaf=\"\">3.11\u003C/span>\u003Cspan leaf=\"\">-alpine3.\u003C/span>\u003Cspan leaf=\"\">18\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 修复方法1：升级到最新版本\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">FROM\u003C/span>\u003Cspan leaf=\"\"> python:\u003C/span>\u003Cspan leaf=\"\">3.11\u003C/span>\u003Cspan leaf=\"\">-alpine3.\u003C/span>\u003Cspan leaf=\"\">19\u003C/span>\u003Cspan leaf=\"\"># 更新的基础镜像通常包含安全补丁\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 修复方法2：在 Dockerfile 中手动升级受影响的包\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">FROM\u003C/span>\u003Cspan leaf=\"\"> python:\u003C/span>\u003Cspan leaf=\"\">3.11\u003C/span>\u003Cspan leaf=\"\">-alpine3.\u003C/span>\u003Cspan leaf=\"\">18\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apk upgrade --no-cache libcrypto3 libssl3\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__68\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>5.3 修复漏洞 - 更新 Python 依赖\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__69 js_darkmode__144\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 检查 Python 依赖的漏洞\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">pip install safety\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">safety check --file requirements.txt\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 示例输出：\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># | package     | installed | affected     | source                                    |\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># | requests    | 2.28.0    | <2.31.0      | https://pyup.io/vulnerabilities/CVE-2023-32681/ |\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 修复：更新 requirements.txt\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 原：requests==2.28.0\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 新：requests==2.31.0\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__70\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>5.4 再次扫描验证\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__71 js_darkmode__145\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 重新构建镜像\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker build -t my-python-app:v1.0-secure .\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 再次扫描\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">trivy image --severity HIGH,CRITICAL my-python-app:v1.0-secure\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 预期输出：\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># Total: 0 (HIGH: 0, CRITICAL: 0)  # ✅ 无高危漏洞\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Chr class=\"js_darkmode__bg__72 js_darkmode__146\" style=\"text-align: justify;\">\u003Ch3 class=\"js_darkmode__bg__73\" style=\"text-align: justify;\">\u003Cspan>Step 6: 安全加固措施\u003C/span>\u003C/h3>\u003Ch4 class=\"js_darkmode__bg__74\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>6.1 非 root 用户运行\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__75 js_darkmode__147\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 创建专用用户（UID/GID 固定，便于权限管理）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> addgroup -g 1001 -S appuser && \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    adduser -u 1001 -S appuser -G appuser\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 设置文件所有者\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">COPY\u003C/span>\u003Cspan leaf=\"\"> --\u003C/span>\u003Cspan leaf=\"\">chown\u003C/span>\u003Cspan leaf=\"\">=appuser:appuser . /app\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 切换用户\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">USER\u003C/span>\u003Cspan leaf=\"\"> appuser\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__148\" style=\"text-align: justify;\">\u003Cspan>验证：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__76 js_darkmode__149\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 检查容器内运行用户\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker run --\u003C/span>\u003Cspan leaf=\"\">rm\u003C/span>\u003Cspan leaf=\"\"> my-python-app:v1.0-secure \u003C/span>\u003Cspan leaf=\"\">id\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 预期输出：uid=1001(appuser) gid=1001(appuser)\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__77\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>6.2 移除 SUID 二进制文件\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__78 js_darkmode__150\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 移除可能被利用的 SUID 文件（如 su/sudo）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> find / -perm /6000 -\u003C/span>\u003Cspan leaf=\"\">type\u003C/span>\u003Cspan leaf=\"\"> f -\u003C/span>\u003Cspan leaf=\"\">exec\u003C/span>\u003Cspan leaf=\"\">chmod\u003C/span>\u003Cspan leaf=\"\"> a-s {} \\; || \u003C/span>\u003Cspan leaf=\"\">true\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__79\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>6.3 只读根文件系统\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__80 js_darkmode__151\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 运行容器时启用只读根文件系统\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker run --read-only --tmpfs /tmp my-python-app:v1.0-secure\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__81\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>6.4 镜像签名（Docker Content Trust）\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__82 js_darkmode__152\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 启用 Content Trust\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">export\u003C/span>\u003Cspan leaf=\"\"> DOCKER_CONTENT_TRUST=1\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 推送镜像（会自动签名）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker push myregistry.com/my-python-app:v1.0-secure\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 拉取镜像时自动验证签名\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker pull myregistry.com/my-python-app:v1.0-secure\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Chr class=\"js_darkmode__bg__83 js_darkmode__153\" style=\"text-align: justify;\">\u003Ch3 class=\"js_darkmode__bg__84\" style=\"text-align: justify;\">\u003Cspan>Step 7: 最终对比与验证\u003C/span>\u003C/h3>\u003Ch4 class=\"js_darkmode__bg__85\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>7.1 体积对比\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__86 js_darkmode__154\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\">docker images | grep my-python-app\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 输出：\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># REPOSITORY          TAG              SIZE\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># my-python-app       v1.0-ubuntu      1.2GB   # 原始版本\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># my-python-app       v1.0-alpine      350MB   # Alpine 基础镜像\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># my-python-app       v1.0-multistage  120MB   # 多阶段构建\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># my-python-app       v1.0-secure      115MB   # 最终优化版（体积减少 90.4%！）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__87\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>7.2 安全对比\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__88 js_darkmode__155\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 扫描对比\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">trivy image --severity HIGH,CRITICAL my-python-app:v1.0-ubuntu\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 输出：Total: 72 (HIGH: 50, CRITICAL: 22)\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">trivy image --severity HIGH,CRITICAL my-python-app:v1.0-secure\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 输出：Total: 0 (HIGH: 0, CRITICAL: 0)  # ✅ 零高危漏洞\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__89\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>7.3 构建时间对比\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__90 js_darkmode__156\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 未启用 BuildKit\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">time\u003C/span>\u003Cspan leaf=\"\"> docker build -t test-nobuildkit .\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># real    8m32s\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 启用 BuildKit\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">export\u003C/span>\u003Cspan leaf=\"\"> DOCKER_BUILDKIT=1\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">time\u003C/span>\u003Cspan leaf=\"\"> docker build -t test-buildkit .\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># real    2m15s  # 提升 73.6%\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp style=\"text-align: left;\">\u003Cspan leaf=\"\"> \u003C/span>\u003C/p>\u003Cp style=\"text-align: left;\">\u003Cspan leaf=\"\">\u003Cb>最小必要原理\u003C/b>\u003C/span>\u003C/p>\u003Cp class=\"js_darkmode__158\" style=\"text-align: justify;\">\u003Cspan>Docker 镜像分层机制：\u003C/span>\u003C/p>\u003Cp class=\"js_darkmode__159\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">Docker 使用 \u003C/span>\u003Cspan>联合文件系统（Union File System）\u003C/span>\u003Cspan leaf=\"\"> 实现镜像分层：\u003C/span>\u003C/p>\u003Col class=\"list-paddingleft-1 js_darkmode__160\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">1. 每个 Dockerfile 指令（FROM/RUN/COPY/ADD）创建一个只读层\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">2. 层之间通过 Copy-on-Write（COW）机制堆叠\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">3. 容器运行时在最顶层添加可写层（Container Layer）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">4. 所有层的累加 = 最终镜像体积\u003C/span>\u003C/section>\u003C/li>\u003C/ol>\u003Cp class=\"js_darkmode__161\" style=\"text-align: justify;\">\u003Cspan>为什么删除文件不减少镜像体积？\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__93 js_darkmode__162\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 错误示例\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apt-get update && apt-get install -y build-essential  \u003C/span>\u003Cspan leaf=\"\"># Layer 1: +200MB\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apt-get clean  \u003C/span>\u003Cspan leaf=\"\"># Layer 2: 删除缓存，但 Layer 1 的 200MB 仍存在！\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 最终镜像 = Layer 1 (200MB) + Layer 2 (0MB) = 200MB\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 正确示例\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apt-get update && apt-get install -y build-essential \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    && apt-get clean  \u003C/span>\u003Cspan leaf=\"\"># 在同一层完成安装与清理\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 最终镜像 = Layer 1 (150MB，已清理缓存)\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__163\" style=\"text-align: justify;\">\u003Cspan>多阶段构建原理：\u003C/span>\u003C/p>\u003Cul class=\"list-paddingleft-1 js_darkmode__164\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>阶段1（builder）\u003C/span>\u003Cspan leaf=\"\">：包含完整工具链，生成二进制或编译依赖\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>阶段2（运行时）\u003C/span>\u003Cspan leaf=\"\">：使用 \u003C/span>\u003Ccode>\u003Cspan leaf=\"\">COPY --from=builder\u003C/span>\u003C/code>\u003Cspan leaf=\"\"> 仅复制必要文件\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>丢弃的内容\u003C/span>\u003Cspan leaf=\"\">：阶段1的所有中间层（编译工具、临时文件）不会进入最终镜像\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Cp class=\"js_darkmode__165\" style=\"text-align: justify;\">\u003Cspan>Alpine vs Ubuntu 体积差异：\u003C/span>\u003C/p>\u003Cp>\u003Ccode>\u003Cspan leaf=\"\">\u003C/span>\u003C/code>\u003C/p>\u003Cul class=\"list-paddingleft-1 js_darkmode__166\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>Ubuntu\u003C/span>\u003Cspan leaf=\"\">：基于 glibc，包含完整 GNU 工具链（bash/coreutils），适合通用场景\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>Alpine\u003C/span>\u003Cspan leaf=\"\">：基于 musl libc + BusyBox，极致精简，但可能遇到兼容性问题（如某些 Python C 扩展）\u003C/span>\u003C/section>\u003C/li>\u003C/ul>","### 架构与数据流说明\n\nDocker 镜像分层架构：\n\n```\n镜像 = 基础镜像层 + 依赖层 + 应用层 + 配置层    ↓每个 Dockerfile 指令（RUN/COPY/ADD）创建新层（Layer）    ↓层累加形成最终镜像（Union File System，联合文件系统）    ↓容器运行时在镜像顶部添加可写层（Container Layer）\n```\n\n镜像体积构成：\n\n```\n总体积 = 基础镜像（如 Ubuntu:22.04 = 77MB）       + 系统依赖（apt install = 100-500MB）       + 应用依赖（Python packages = 50-200MB）       + 应用代码（10-50MB）       + 缓存与临时文件（50-200MB）\n```\n\n优化策略：\n\n1. 1. 替换基础镜像：Ubuntu（77MB）→ Alpine（5MB）→ Distroless（\u003C 2MB）→ Scratch（0MB，仅静态二进制）\n2. 2. 多阶段构建：构建阶段（完整工具链）→ 运行时阶段（仅复制二进制与依赖）\n3. 3. 层合并：多个 RUN 指令合并为一个（减少层数，清理临时文件）\n4. 4. 依赖精简：仅安装运行时必需依赖，移除构建工具\n\n安全扫描流程：\n\n```\n构建镜像 → Trivy 扫描 → 发现漏洞（CVE列表）    ↓分析漏洞来源（基础镜像 / 依赖包 / 应用代码）    ↓修复措施：升级基础镜像 / 更新依赖 / 打补丁    ↓重新构建 → 再次扫描 → 确认修复\n```\n\n---\n\n### Step 1: 评估当前镜像（基线测量）\n\n目标：\n\n 获取优化前的镜像大小、层数、漏洞数量作为对比基线\n\n#### ◆ 1.1 检查镜像大小与层数\n\n```\n# 查看镜像列表与大小docker images# 示例输出：# REPOSITORY          TAG       IMAGE ID       CREATED         SIZE# my-python-app       v1.0      a1b2c3d4e5f6   2 hours ago     1.2GB  # ⚠️ 过大# 查看镜像构建历史（每层大小）docker history my-python-app:v1.0# 示例输出：# IMAGE          CREATED       CREATED BY                                      SIZE      COMMENT# a1b2c3d4e5f6   2 hours ago   /bin/sh -c pip install -r requirements.txt      350MB     # ⚠️ 依赖层过大# b2c3d4e5f6a7   3 hours ago   /bin/sh -c apt-get install -y build-essential   250MB     # ⚠️ 构建工具未清理# c3d4e5f6a7b8   1 day ago     /bin/sh -c #(nop) FROM ubuntu:22.04              77MB# 统计总层数docker history my-python-app:v1.0 --no-trunc | wc -l# 预期输出：25 层（正常应 \u003C 15 层）\n```\n\n#### ◆ 1.2 安装并运行 Trivy 安全扫描\n\n安装 Trivy（Ubuntu/Debian）：\n\n```\n# 方法1：使用官方脚本curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin# 方法2：使用 aptsudo apt-get install wget apt-transport-https gnupg lsb-releasewget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -echo\"deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main\" | sudotee -a /etc/apt/sources.list.d/trivy.listsudo apt-get update && sudo apt-get install trivy\n```\n\n安装 Trivy（RHEL/CentOS）：\n\n```\n# 使用 rpmrpm -ivh https://github.com/aquasecurity/trivy/releases/download/v0.48.3/trivy_0.48.3_Linux-64bit.rpm# 或使用二进制文件wget https://github.com/aquasecurity/trivy/releases/download/v0.48.3/trivy_0.48.3_Linux-64bit.tar.gztar -zxvf trivy_0.48.3_Linux-64bit.tar.gzsudomv trivy /usr/local/bin/\n```\n\n扫描镜像漏洞：\n\n```\n# 扫描镜像并输出报告trivy image my-python-app:v1.0# 示例输出（截取）：# my-python-app:v1.0 (ubuntu 22.04)## Total: 342 (UNKNOWN: 0, LOW: 150, MEDIUM: 120, HIGH: 50, CRITICAL: 22)  # ⚠️ 22个严重漏洞！## +--------------+------------------+----------+-------------------+---------------+# | LIBRARY      | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |# +--------------+------------------+----------+-------------------+---------------+# | libc6        | CVE-2023-4911    | CRITICAL | 2.35-0ubuntu3.1   | 2.35-0ubuntu3.4 |# | openssl      | CVE-2023-5678    | HIGH     | 3.0.2-0ubuntu1.10 | 3.0.2-0ubuntu1.12 |# | python3.10   | CVE-2023-9999    | HIGH     | 3.10.12-1         | 3.10.12-2 |# +--------------+------------------+----------+-------------------+---------------+# 仅显示高危及以上漏洞trivy image --severity HIGH,CRITICAL my-python-app:v1.0# 导出 JSON 格式报告（用于 CI/CD）trivy image --format json --output report.json my-python-app:v1.0\n```\n\n执行前验证：\n\n```\n# 确认 Docker 已安装docker --version# 预期输出：Docker version 24.0.7# 确认镜像存在docker images | grep my-python-app\n```\n\n执行后验证：\n\n```\n# 确认 Trivy 安装成功trivy --version# 预期输出：Version: 0.48.3# 检查扫描报告文件ls -lh report.json\n```\n\n---\n\n### Step 2: 优化 Dockerfile - 切换基础镜像\n\n目标：\n\n 将基础镜像从 Ubuntu 替换为 Alpine Linux，减少 70-90% 体积\n\n#### ◆ 2.1 原 Dockerfile（未优化）\n\n```\n# 原 Dockerfile（Python 应用示例）FROM ubuntu:22.04# 安装系统依赖RUN apt-get update && apt-get install -y \\    python3 \\    python3-pip \\    build-essential \\    libpq-dev \\    curl \\    vim# 安装 Python 依赖COPY requirements.txt /app/WORKDIR /appRUN pip3 install -r requirements.txt# 复制应用代码COPY . /app/# 暴露端口EXPOSE8000# 启动命令CMD [\"python3\", \"app.py\"]# 问题分析：# 1. 基础镜像过大（Ubuntu 77MB）# 2. 安装了不必要的工具（vim/curl）# 3. 未清理 apt 缓存# 4. 未使用多阶段构建# 5. 以 root 用户运行（安全风险）\n```\n\n构建并测量：\n\n```\ndocker build -t my-python-app:v1.0-ubuntu .docker images my-python-app:v1.0-ubuntu# 输出：SIZE = 1.2GB\n```\n\n#### ◆ 2.2 优化版 Dockerfile（Alpine 基础镜像）\n\n```\n# 优化 Dockerfile（Alpine Linux）FROM python:3.11-alpine3.18# 设置工作目录WORKDIR /app# 安装运行时依赖（仅必需的库）RUN apk add --no-cache \\    libpq \\    && rm -rf /var/cache/apk/*  # 清理apk缓存# 安装 Python 依赖（使用虚拟环境）COPY requirements.txt .RUN apk add --no-cache --virtual .build-deps \\    gcc \\    musl-dev \\    postgresql-dev \\    && pip install --no-cache-dir -r requirements.txt \\    && apk del .build-deps  # 删除构建依赖# 复制应用代码COPY --chown=appuser:appuser . .# 创建非 root 用户RUN addgroup -S appuser && adduser -S appuser -G appuser# 切换到非 root 用户USER appuser# 暴露端口EXPOSE8000# 健康检查HEALTHCHECK --interval=30s --timeout=3s \\    CMD wget --quiet --tries=1 --spider http://localhost:8000/health || exit 1# 启动命令CMD [\"python\", \"app.py\"]\n```\n\n关键优化点解释：\n\n1. 1. python:3.11-alpine3.18：官方 Alpine 基础镜像（约 50MB，比 Ubuntu 小 35%）\n2. 2. apk add --no-cache：不保留 apk 索引缓存（减少 5-10MB）\n3. 3. –virtual .build-deps：构建依赖打包为虚拟包，安装后可整体删除\n4. 4. –no-cache-dir：pip 不缓存下载的包（减少 50-100MB）\n5. 5. USER appuser：非 root 用户运行（安全加固）\n\n构建并对比：\n\n```\ndocker build -t my-python-app:v1.0-alpine .docker images | grep my-python-app# 输出：# my-python-app:v1.0-ubuntu   1.2GB# my-python-app:v1.0-alpine   350MB  # 减少 70.8%\n```\n\n---\n\n### Step 3: 优化 Dockerfile - 多阶段构建\n\n目标：\n\n 将构建环境与运行时环境分离，进一步减少 50-70% 体积\n\n#### ◆ 3.1 多阶段构建 Dockerfile（最终优化版）\n\n```\n# ============ 阶段1：构建阶段 ============FROM python:3.11-alpine3.18 AS builderWORKDIR /app# 安装构建依赖RUN apk add --no-cache \\    gcc \\    musl-dev \\    postgresql-dev \\    libffi-dev# 安装 Python 依赖到虚拟环境COPY requirements.txt .RUN python -m venv /opt/venv && \\    /opt/venv/bin/pip install --no-cache-dir -r requirements.txt# ============ 阶段2：运行时阶段 ============FROM python:3.11-alpine3.18WORKDIR /app# 仅安装运行时库（无需编译工具）RUN apk add --no-cache \\    libpq \\    libffi \\    && rm -rf /var/cache/apk/*# 从构建阶段复制虚拟环境COPY --from=builder /opt/venv /opt/venv# 复制应用代码COPY --chown=appuser:appuser . .# 创建非 root 用户RUN addgroup -S appuser && adduser -S appuser -G appuser# 设置环境变量（使用虚拟环境）ENV PATH=\"/opt/venv/bin:$PATH\"USER appuserEXPOSE8000HEALTHCHECK --interval=30s --timeout=3s \\    CMD wget --quiet --tries=1 --spider http://localhost:8000/health || exit 1CMD [\"python\", \"app.py\"]\n```\n\n多阶段构建优势：\n\n- • 阶段1（builder）：包含完整编译工具链（gcc/make），用于编译 C 扩展依赖\n- • 阶段2（运行时）：仅复制编译好的二进制与依赖，不包含编译工具\n- • 体积减少：编译工具约占 150-200MB，通过多阶段构建完全删除\n\n构建并对比：\n\n```\ndocker build -t my-python-app:v1.0-multistage .docker images | grep my-python-app# 输出：# my-python-app:v1.0-ubuntu      1.2GB# my-python-app:v1.0-alpine      350MB# my-python-app:v1.0-multistage  120MB  # 减少 90%！\n```\n\n验证功能完整性：\n\n```\n# 启动容器docker run -d -p 8000:8000 --name test-app my-python-app:v1.0-multistage# 测试应用curl http://localhost:8000/health# 预期输出：{\"status\": \"healthy\"}# 检查容器日志docker logs test-app# 清理测试容器docker stop test-app && docker rm test-app\n```\n\n---\n\n### Step 4: 层合并与缓存清理\n\n目标：\n\n 减少镜像层数，清理构建缓存与临时文件\n\n#### ◆ 4.1 合并 RUN 指令\n\n未优化（多层）：\n\n```\nRUN apt-get updateRUN apt-get install -y python3RUN apt-get install -y python3-pipRUN apt-get install -y libpq-devRUN apt-get clean# 问题：每个 RUN 创建一层，即使最后 clean 也不会减少前面层的体积\n```\n\n优化后（单层）：\n\n```\nRUN apt-get update && apt-get install -y \\    python3 \\    python3-pip \\    libpq-dev \\    && apt-get clean \\    && rm -rf /var/lib/apt/lists/*  # 删除 apt 缓存# 优势：一层完成，临时文件在同一层内删除，不占用最终镜像体积\n```\n\n#### ◆ 4.2 使用 .dockerignore 文件\n\n创建 .dockerignore：\n\n```\n# .dockerignore（排除无关文件）# 版本控制.git.gitignore.github# 开发文件*.md*.log*.pyc__pycache__/.pytest_cache/.vscode/.idea/# 测试文件tests/test_*.py# 构建产物build/dist/*.egg-info/# 环境文件.env.env.localvenv/env/# 文档docs/README.mdLICENSE# CI/CD.gitlab-ci.ymlJenkinsfile\n```\n\n效果验证：\n\n```\n# 对比 COPY 指令复制的文件大小# 未使用 .dockerignore：COPY . . 复制 50MB# 使用后：COPY . . 复制 15MB（减少 70%）\n```\n\n#### ◆ 4.3 启用 Docker BuildKit\n\n启用方法：\n\n```\n# 方法1：环境变量export DOCKER_BUILDKIT=1docker build -t my-app:v2.0 .# 方法2：守护进程配置（持久化）# /etc/docker/daemon.json{\"features\": {\"buildkit\": true  }}# 重启 Dockersudo systemctl restart docker\n```\n\nBuildKit 优势：\n\n- • 并行构建多个层（性能提升 2-5 倍）\n- • 自动跳过未使用的阶段（多阶段构建优化）\n- • 更好的缓存机制（修改代码不重新下载依赖）\n\n验证 BuildKit 启用：\n\n```\ndocker build -t test-buildkit .# 输出包含 [buildkit] 标识# [buildkit] [1/5] FROM docker.io/library/python:3.11-alpine3.18\n```\n\n---\n\n### Step 5: 安全扫描与漏洞修复\n\n目标：\n\n 扫描优化后的镜像，修复高危漏洞至零\n\n#### ◆ 5.1 扫描优化后的镜像\n\n```\n# 扫描多阶段构建的镜像trivy image --severity HIGH,CRITICAL my-python-app:v1.0-multistage# 示例输出：# Total: 12 (HIGH: 8, CRITICAL: 4)  # 仍有漏洞（来自基础镜像或依赖）## +--------------+------------------+----------+-------------------+---------------+# | LIBRARY      | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |# +--------------+------------------+----------+-------------------+---------------+# | libcrypto3   | CVE-2023-5678    | CRITICAL | 3.0.10-r0         | 3.0.12-r0     |# | python3.11   | CVE-2023-9999    | HIGH     | 3.11.6-r0         | 3.11.7-r1     |# +--------------+------------------+----------+-------------------+---------------+\n```\n\n#### ◆ 5.2 修复漏洞 - 升级基础镜像\n\n```\n# 原基础镜像（存在漏洞）FROM python:3.11-alpine3.18# 修复方法1：升级到最新版本FROM python:3.11-alpine3.19# 更新的基础镜像通常包含安全补丁# 修复方法2：在 Dockerfile 中手动升级受影响的包FROM python:3.11-alpine3.18RUN apk upgrade --no-cache libcrypto3 libssl3\n```\n\n#### ◆ 5.3 修复漏洞 - 更新 Python 依赖\n\n```\n# 检查 Python 依赖的漏洞pip install safetysafety check --file requirements.txt# 示例输出：# | package     | installed | affected     | source                                    |# | requests    | 2.28.0    |\n```\n\n#### ◆ 5.4 再次扫描验证\n\n```\n# 重新构建镜像docker build -t my-python-app:v1.0-secure .# 再次扫描trivy image --severity HIGH,CRITICAL my-python-app:v1.0-secure# 预期输出：# Total: 0 (HIGH: 0, CRITICAL: 0)  # ✅ 无高危漏洞\n```\n\n---\n\n### Step 6: 安全加固措施\n\n#### ◆ 6.1 非 root 用户运行\n\n```\n# 创建专用用户（UID/GID 固定，便于权限管理）RUN addgroup -g 1001 -S appuser && \\    adduser -u 1001 -S appuser -G appuser# 设置文件所有者COPY --chown=appuser:appuser . /app# 切换用户USER appuser\n```\n\n验证：\n\n```\n# 检查容器内运行用户docker run --rm my-python-app:v1.0-secure id# 预期输出：uid=1001(appuser) gid=1001(appuser)\n```\n\n#### ◆ 6.2 移除 SUID 二进制文件\n\n```\n# 移除可能被利用的 SUID 文件（如 su/sudo）RUN find / -perm /6000 -type f -execchmod a-s {} \\; || true\n```\n\n#### ◆ 6.3 只读根文件系统\n\n```\n# 运行容器时启用只读根文件系统docker run --read-only --tmpfs /tmp my-python-app:v1.0-secure\n```\n\n#### ◆ 6.4 镜像签名（Docker Content Trust）\n\n```\n# 启用 Content Trustexport DOCKER_CONTENT_TRUST=1# 推送镜像（会自动签名）docker push myregistry.com/my-python-app:v1.0-secure# 拉取镜像时自动验证签名docker pull myregistry.com/my-python-app:v1.0-secure\n```\n\n---\n\n### Step 7: 最终对比与验证\n\n#### ◆ 7.1 体积对比\n\n```\ndocker images | grep my-python-app# 输出：# REPOSITORY          TAG              SIZE# my-python-app       v1.0-ubuntu      1.2GB   # 原始版本# my-python-app       v1.0-alpine      350MB   # Alpine 基础镜像# my-python-app       v1.0-multistage  120MB   # 多阶段构建# my-python-app       v1.0-secure      115MB   # 最终优化版（体积减少 90.4%！）\n```\n\n#### ◆ 7.2 安全对比\n\n```\n# 扫描对比trivy image --severity HIGH,CRITICAL my-python-app:v1.0-ubuntu# 输出：Total: 72 (HIGH: 50, CRITICAL: 22)trivy image --severity HIGH,CRITICAL my-python-app:v1.0-secure# 输出：Total: 0 (HIGH: 0, CRITICAL: 0)  # ✅ 零高危漏洞\n```\n\n#### ◆ 7.3 构建时间对比\n\n```\n# 未启用 BuildKittime docker build -t test-nobuildkit .# real    8m32s# 启用 BuildKitexport DOCKER_BUILDKIT=1time docker build -t test-buildkit .# real    2m15s  # 提升 73.6%\n```\n\n \n\n**最小必要原理**\n\nDocker 镜像分层机制：\n\nDocker 使用 \n\n联合文件系统（Union File System）\n\n 实现镜像分层：\n\n1. 1. 每个 Dockerfile 指令（FROM/RUN/COPY/ADD）创建一个只读层\n2. 2. 层之间通过 Copy-on-Write（COW）机制堆叠\n3. 3. 容器运行时在最顶层添加可写层（Container Layer）\n4. 4. 所有层的累加 = 最终镜像体积\n\n为什么删除文件不减少镜像体积？\n\n```\n# 错误示例RUN apt-get update && apt-get install -y build-essential  # Layer 1: +200MBRUN apt-get clean  # Layer 2: 删除缓存，但 Layer 1 的 200MB 仍存在！# 最终镜像 = Layer 1 (200MB) + Layer 2 (0MB) = 200MB# 正确示例RUN apt-get update && apt-get install -y build-essential \\    && apt-get clean  # 在同一层完成安装与清理# 最终镜像 = Layer 1 (150MB，已清理缓存)\n```\n\n多阶段构建原理：\n\n- • 阶段1（builder）：包含完整工具链，生成二进制或编译依赖\n- • 阶段2（运行时）：使用 COPY --from=builder 仅复制必要文件\n- • 丢弃的内容：阶段1的所有中间层（编译工具、临时文件）不会进入最终镜像\n\nAlpine vs Ubuntu 体积差异：\n\n`\n\n`\n\n- • Ubuntu：基于 glibc，包含完整 GNU 工具链（bash/coreutils），适合通用场景\n- • Alpine：基于 musl libc + BusyBox，极致精简，但可能遇到兼容性问题（如某些 Python C 扩展）","/article/121",309,"2026-01-06 11:54:35","2026-01-06 12:01:59",{"id":314,"category_id":44,"title":315,"keywords":6,"description":316,"image_url":6,"content":317,"content_md":318,"url":319,"hits":320,"is_recommend":73,"is_top":73,"create_time":321,"update_time":322},120,"用 Prometheus Recording Rules 把告警噪声砍掉 70%(二)","五、故障排查和监控5.1 故障排查◆ 5.1.1 日志查看# 查看 Prometheus 日志中的规则评估错误journalctl -u prometheus | grep -i \"rule\" | tail -50# 查看规则评估耗时curl -s http://localhost:9090/api/v1/rules | jq '.data.groups[].rules[] | select(.health != \"ok\")'# Kubernet","\u003Ch2 class=\"js_darkmode__bg__65\" style=\"text-align: center;\">\u003Cspan leaf=\"\">五、故障排查和监控\u003C/span>\u003C/h2>\u003Ch3 class=\"js_darkmode__bg__66\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">5.1 故障排查\u003C/span>\u003C/h3>\u003Ch4 class=\"js_darkmode__bg__67\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 5.1.1 日志查看\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__68 js_darkmode__77\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 查看 Prometheus 日志中的规则评估错误\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">journalctl -u prometheus | grep -i \u003C/span>\u003Cspan leaf=\"\">\"rule\"\u003C/span>\u003Cspan leaf=\"\"> | \u003C/span>\u003Cspan leaf=\"\">tail\u003C/span>\u003Cspan leaf=\"\"> -50\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 查看规则评估耗时\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">curl -s http://localhost:9090/api/v1/rules | jq \u003C/span>\u003Cspan leaf=\"\">'.data.groups[].rules[] | select(.health != \"ok\")'\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># Kubernetes 环境\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">kubectl logs -n monitoring prometheus-server-0 | grep -i \u003C/span>\u003Cspan leaf=\"\">\"recording\"\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__69\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 5.1.2 常见问题排查\u003C/span>\u003C/h4>\u003Cp class=\"js_darkmode__78\" style=\"text-align: justify;\">\u003Cspan>问题一：Recording Rule 显示 “no data”\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__70 js_darkmode__79\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 诊断命令\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 1. 确认源指标存在\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">curl -s \u003C/span>\u003Cspan leaf=\"\">'http://localhost:9090/api/v1/query?query=node_cpu_seconds_total'\u003C/span>\u003Cspan leaf=\"\"> | jq \u003C/span>\u003Cspan leaf=\"\">'.data.result | length'\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 2. 测试表达式\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">curl -s \u003C/span>\u003Cspan leaf=\"\">'http://localhost:9090/api/v1/query?query=rate(node_cpu_seconds_total[5m])'\u003C/span>\u003Cspan leaf=\"\"> | jq \u003C/span>\u003Cspan leaf=\"\">'.data.result | length'\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__80\" style=\"text-align: justify;\">\u003Cspan>解决方案\u003C/span>\u003Cspan leaf=\"\">：\u003C/span>\u003C/p>\u003Col class=\"list-paddingleft-1 js_darkmode__81\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">1. 确认源指标正在被采集\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">2. 检查标签选择器是否匹配\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">3. 验证时间窗口是否合理（数据量是否足够）\u003C/span>\u003C/section>\u003C/li>\u003C/ol>\u003Cp class=\"js_darkmode__82\" style=\"text-align: justify;\">\u003Cspan>问题二：Recording Rules 计算结果与预期不符\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__71 js_darkmode__83\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 诊断命令\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 对比 Recording Rule 结果与手动查询结果\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">curl -s \u003C/span>\u003Cspan leaf=\"\">'http://localhost:9090/api/v1/query?query=instance:node_cpu_utilization:avg5m{instance=\"node1:9100\"}'\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">curl -s \u003C/span>\u003Cspan leaf=\"\">'http://localhost:9090/api/v1/query?query=1-avg(rate(node_cpu_seconds_total{instance=\"node1:9100\",mode=\"idle\"}[5m]))'\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__84\" style=\"text-align: justify;\">\u003Cspan>解决方案\u003C/span>\u003Cspan leaf=\"\">：检查 by 子句是否包含了所有需要保留的标签\u003C/span>\u003C/p>\u003Cp class=\"js_darkmode__85\" style=\"text-align: justify;\">\u003Cspan>问题三：规则评估超时\u003C/span>\u003C/p>\u003Cul class=\"list-paddingleft-1 js_darkmode__86\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>症状\u003C/span>\u003Cspan leaf=\"\">：Prometheus 日志出现 “rule group took longer than interval”\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>排查\u003C/span>\u003Cspan leaf=\"\">：检查规则复杂度和数据量\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>解决\u003C/span>\u003Cspan leaf=\"\">：拆分规则组、增大 interval、优化表达式\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Ch4 class=\"js_darkmode__bg__72\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 5.1.3 调试模式\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__73 js_darkmode__87\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 开启 Prometheus 查询日志\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 在启动参数中添加\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">--query.log-queries\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 查看慢查询\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">grep \u003C/span>\u003Cspan leaf=\"\">\"slow\"\u003C/span>\u003Cspan leaf=\"\"> /var/log/prometheus/query.log\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 使用 Prometheus 内置指标分析规则评估\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">prometheus_rule_evaluation_duration_seconds\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">prometheus_rule_group_last_duration_seconds\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch3 class=\"js_darkmode__bg__74\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">5.2 性能监控\u003C/span>\u003C/h3>\u003Ch4 class=\"js_darkmode__bg__75\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 5.2.1 关键指标监控\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__76 js_darkmode__88\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># Recording Rules 评估耗时\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">histogram_quantile(0.99, rate(prometheus_rule_evaluation_duration_seconds_bucket[5m]))\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 规则评估失败次数\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">rate(prometheus_rule_evaluation_failures_total[5m])\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 规则产生的时序数量\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">prometheus_tsdb_head_series\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 内存使用\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">process_resident_memory_bytes{job=\u003C/span>\u003Cspan leaf=\"\">\"prometheus\"\u003C/span>\u003Cspan leaf=\"\">}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__77\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 5.2.2 监控指标说明\u003C/span>\u003C/h4>\u003Ctable class=\"js_darkmode__89 layui-table\" style=\"text-align: justify;\">\u003Cthead>\u003Ctr>\u003Cth class=\"js_darkmode__bg__78\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">指标名称\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__bg__79\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">正常范围\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__bg__80\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">告警阈值\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__bg__81\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">说明\u003C/span>\u003C/section>\u003C/th>\u003C/tr>\u003C/thead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"js_darkmode__90\">\u003Csection>\u003Cspan leaf=\"\">rule_evaluation_duration_seconds\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__91\">\u003Csection>\u003Cspan leaf=\"\">< 1s\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__92\">\u003Csection>\u003Cspan leaf=\"\">> 5s\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__93\">\u003Csection>\u003Cspan leaf=\"\">规则评估耗时，过长说明规则复杂或数据量大\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr>\u003Ctd class=\"js_darkmode__94\">\u003Csection>\u003Cspan leaf=\"\">rule_evaluation_failures_total\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__95\">\u003Csection>\u003Cspan leaf=\"\">0\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__96\">\u003Csection>\u003Cspan leaf=\"\">> 0\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__97\">\u003Csection>\u003Cspan leaf=\"\">规则评估失败，需要检查表达式\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr>\u003Ctd class=\"js_darkmode__98\">\u003Csection>\u003Cspan leaf=\"\">tsdb_head_series\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__99\">\u003Csection>\u003Cspan leaf=\"\">视环境而定\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__100\">\u003Csection>\u003Cspan leaf=\"\">增长率 > 10%/h\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__101\">\u003Csection>\u003Cspan leaf=\"\">时序数量，Recording Rules 会增加时序\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr>\u003Ctd class=\"js_darkmode__102\">\u003Csection>\u003Cspan leaf=\"\">process_resident_memory_bytes\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__103\">\u003Csection>\u003Cspan leaf=\"\">< 80% 配置内存\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__104\">\u003Csection>\u003Cspan leaf=\"\">> 90%\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__105\">\u003Csection>\u003Cspan leaf=\"\">内存使用，时序增加会占用更多内存\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003C/tbody>\u003C/table>\u003Ch4 class=\"js_darkmode__bg__82\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 5.2.3 Recording Rules 自身监控\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__83 js_darkmode__106\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 监控 Recording Rules 健康状态\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">groups:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">name:\u003C/span>\u003Cspan leaf=\"\">recording_rules_health\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">rules:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">alert:\u003C/span>\u003Cspan leaf=\"\">RecordingRuleEvaluationSlow\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">|\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          prometheus_rule_group_last_duration_seconds >\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          prometheus_rule_group_interval_seconds\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">for:\u003C/span>\u003Cspan leaf=\"\">5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">labels:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">severity:\u003C/span>\u003Cspan leaf=\"\">warning\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">annotations:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">summary:\u003C/span>\u003Cspan leaf=\"\">\"Recording Rule 组 \u003C/span>\u003Cspan leaf=\"\">{{ $labels.rule_group }}\u003C/span>\u003Cspan leaf=\"\"> 评估超时\"\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">alert:\u003C/span>\u003Cspan leaf=\"\">RecordingRuleEvaluationFailure\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">rate(prometheus_rule_evaluation_failures_total[5m])\u003C/span>\u003Cspan leaf=\"\">>\u003C/span>\u003Cspan leaf=\"\">0\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">for:\u003C/span>\u003Cspan leaf=\"\">5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">labels:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">severity:\u003C/span>\u003Cspan leaf=\"\">critical\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">annotations:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">summary:\u003C/span>\u003Cspan leaf=\"\">\"Recording Rule 评估失败\"\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch3 class=\"js_darkmode__bg__84\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">5.3 备份与恢复\u003C/span>\u003C/h3>\u003Ch4 class=\"js_darkmode__bg__85\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 5.3.1 配置备份\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__86 js_darkmode__107\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\">#!/bin/bash\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># Recording Rules 配置备份脚本\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 文件名：backup_recording_rules.sh\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">BACKUP_DIR=\u003C/span>\u003Cspan leaf=\"\">\"/backup/prometheus/rules\"\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">PROMETHEUS_RULES_DIR=\u003C/span>\u003Cspan leaf=\"\">\"/etc/prometheus/rules\"\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">DATE=$(\u003C/span>\u003Cspan leaf=\"\">date\u003C/span>\u003Cspan leaf=\"\"> +%Y%m%d_%H%M%S)\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">mkdir\u003C/span>\u003Cspan leaf=\"\"> -p \u003C/span>\u003Cspan leaf=\"\">${BACKUP_DIR}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 备份所有规则文件\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">tar -czvf \u003C/span>\u003Cspan leaf=\"\">${BACKUP_DIR}\u003C/span>\u003Cspan leaf=\"\">/rules_\u003C/span>\u003Cspan leaf=\"\">${DATE}\u003C/span>\u003Cspan leaf=\"\">.tar.gz -C \u003C/span>\u003Cspan leaf=\"\">${PROMETHEUS_RULES_DIR}\u003C/span>\u003Cspan leaf=\"\"> .\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 保留最近30天的备份\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">find \u003C/span>\u003Cspan leaf=\"\">${BACKUP_DIR}\u003C/span>\u003Cspan leaf=\"\"> -name \u003C/span>\u003Cspan leaf=\"\">\"rules_*.tar.gz\"\u003C/span>\u003Cspan leaf=\"\"> -mtime +30 -delete\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 验证备份\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">tar -tzf \u003C/span>\u003Cspan leaf=\"\">${BACKUP_DIR}\u003C/span>\u003Cspan leaf=\"\">/rules_\u003C/span>\u003Cspan leaf=\"\">${DATE}\u003C/span>\u003Cspan leaf=\"\">.tar.gz\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__87\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 5.3.2 恢复流程\u003C/span>\u003C/h4>\u003Col class=\"list-paddingleft-1 js_darkmode__108\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">1. \u003C/span>\u003Cspan>停止 Prometheus\u003C/span>\u003Cspan leaf=\"\">：\u003C/span>\u003Ccode>\u003Cspan leaf=\"\">systemctl stop prometheus\u003C/span>\u003C/code>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">2. \u003C/span>\u003Cspan>恢复配置\u003C/span>\u003Cspan leaf=\"\">：\u003C/span>\u003Ccode>\u003Cspan leaf=\"\">tar -xzvf /backup/prometheus/rules/rules_xxx.tar.gz -C /etc/prometheus/rules/\u003C/span>\u003C/code>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">3. \u003C/span>\u003Cspan>验证配置\u003C/span>\u003Cspan leaf=\"\">：\u003C/span>\u003Ccode>\u003Cspan leaf=\"\">promtool check rules /etc/prometheus/rules/*.yml\u003C/span>\u003C/code>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">4. \u003C/span>\u003Cspan>启动服务\u003C/span>\u003Cspan leaf=\"\">：\u003C/span>\u003Ccode>\u003Cspan leaf=\"\">systemctl start prometheus\u003C/span>\u003C/code>\u003C/section>\u003C/li>\u003C/ol>\u003Chr class=\"js_darkmode__bg__88 js_darkmode__109\" style=\"text-align: justify;\">\u003Ch2 class=\"js_darkmode__bg__89\" style=\"text-align: center;\">\u003Cspan leaf=\"\">六、总结\u003C/span>\u003C/h2>\u003Ch3 class=\"js_darkmode__bg__90\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">6.1 技术要点回顾\u003C/span>\u003C/h3>\u003Cul class=\"list-paddingleft-1 js_darkmode__110\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>要点一\u003C/span>\u003Cspan leaf=\"\">：Recording Rules 的核心价值在于预计算和聚合，通过时间窗口平滑消除瞬时抖动，通过层级聚合实现告警收敛\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>要点二\u003C/span>\u003Cspan leaf=\"\">：命名规范至关重要，采用 \u003C/span>\u003Ccode>\u003Cspan leaf=\"\">level:metric_name:aggregation\u003C/span>\u003C/code>\u003Cspan leaf=\"\"> 格式，便于理解和维护\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>要点三\u003C/span>\u003Cspan leaf=\"\">：分层设计是大规模环境的最佳实践，从原始指标到基础设施指标到业务指标，逐层抽象\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>要点四\u003C/span>\u003Cspan leaf=\"\">：Recording Rules 需要持续监控和优化，关注评估耗时、失败次数、时序增长等指标\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Ch3 class=\"js_darkmode__bg__91\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">6.2 进阶学习方向\u003C/span>\u003C/h3>\u003Col class=\"list-paddingleft-1 js_darkmode__111\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">1. \u003C/span>\u003Cspan>告警分级与智能降噪\u003C/span>\u003Cspan leaf=\"\">：结合机器学习算法实现异常检测，替代固定阈值\u003C/span>\u003C/section>\u003C/li>\u003Cul class=\"list-paddingleft-1 js_darkmode__112\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• 学习资源：Prometheus 社区的 anomaly detection proposals\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• 实践建议：从简单的动态基线开始，逐步引入更复杂的算法\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">2. \u003C/span>\u003Cspan>大规模 Prometheus 架构\u003C/span>\u003Cspan leaf=\"\">：联邦集群、远程存储、Thanos/Cortex\u003C/span>\u003C/section>\u003C/li>\u003Cul class=\"list-paddingleft-1 js_darkmode__113\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• 学习资源：Thanos 官方文档、CNCF 相关演讲\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• 实践建议：在测试环境搭建联邦架构，理解 Recording Rules 在不同层级的分工\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">3. \u003C/span>\u003Cspan>PromQL 高级技巧\u003C/span>\u003Cspan leaf=\"\">：子查询、偏移量、复杂聚合\u003C/span>\u003C/section>\u003C/li>\u003Cul class=\"list-paddingleft-1 js_darkmode__114\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• 学习资源：PromLabs 博客、Prometheus 官方文档\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• 实践建议：多在 Prometheus UI 练习，理解不同函数的计算逻辑\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003C/ol>\u003Ch3 class=\"js_darkmode__bg__92\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">6.3 参考资料\u003C/span>\u003C/h3>\u003Cul class=\"list-paddingleft-1 js_darkmode__115\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• Prometheus Recording Rules 官方文档 - 权威参考\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• Robust Perception 博客 - Brian Brazil（Prometheus 核心开发者）的博客\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• PromLabs 博客 - 深入的 PromQL 教程\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• Awesome Prometheus Alerts - 社区维护的告警规则集合\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Chr class=\"js_darkmode__bg__93 js_darkmode__116\" style=\"text-align: justify;\">\u003Ch2 class=\"js_darkmode__bg__94\" style=\"text-align: center;\">\u003Cspan leaf=\"\">附录\u003C/span>\u003C/h2>\u003Ch3 class=\"js_darkmode__bg__95\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">A. Recording Rules 命令速查表\u003C/span>\u003C/h3>\u003Cpre class=\"js_darkmode__bg__96 js_darkmode__117\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 检查规则语法\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">promtool check rules /etc/prometheus/rules/*.yml\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 热加载配置\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">curl -X POST http://localhost:9090/-/reload\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 查看规则状态\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">curl -s http://localhost:9090/api/v1/rules | jq \u003C/span>\u003Cspan leaf=\"\">'.data.groups[].rules[] | {record, health}'\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 测试表达式\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">curl -s \u003C/span>\u003Cspan leaf=\"\">'http://localhost:9090/api/v1/query?query=YOUR_EXPRESSION'\u003C/span>\u003Cspan leaf=\"\"> | jq\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 查看规则评估指标\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">curl -s \u003C/span>\u003Cspan leaf=\"\">'http://localhost:9090/api/v1/query?query=prometheus_rule_evaluation_duration_seconds'\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch3 class=\"js_darkmode__bg__97\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">B. 常用聚合函数说明\u003C/span>\u003C/h3>\u003Ctable class=\"js_darkmode__118 layui-table\" style=\"text-align: justify;\">\u003Cthead>\u003Ctr>\u003Cth class=\"js_darkmode__bg__98\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">函数\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__bg__99\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">用途\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__bg__100\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">示例\u003C/span>\u003C/section>\u003C/th>\u003C/tr>\u003C/thead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"js_darkmode__119\">\u003Csection>\u003Cspan leaf=\"\">avg_over_time\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__120\">\u003Csection>\u003Cspan leaf=\"\">时间窗口内平均值，平滑抖动\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__121\">\u003Csection>\u003Cspan leaf=\"\">avg_over_time(cpu[5m])\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr>\u003Ctd class=\"js_darkmode__122\">\u003Csection>\u003Cspan leaf=\"\">max_over_time\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__123\">\u003Csection>\u003Cspan leaf=\"\">时间窗口内最大值，捕获峰值\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__124\">\u003Csection>\u003Cspan leaf=\"\">max_over_time(cpu[15m])\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr>\u003Ctd class=\"js_darkmode__125\">\u003Csection>\u003Cspan leaf=\"\">min_over_time\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__126\">\u003Csection>\u003Cspan leaf=\"\">时间窗口内最小值\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__127\">\u003Csection>\u003Cspan leaf=\"\">min_over_time(available[5m])\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr>\u003Ctd class=\"js_darkmode__128\">\u003Csection>\u003Cspan leaf=\"\">rate\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__129\">\u003Csection>\u003Cspan leaf=\"\">计数器每秒增长率\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__130\">\u003Csection>\u003Cspan leaf=\"\">rate(requests_total[5m])\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr>\u003Ctd class=\"js_darkmode__131\">\u003Csection>\u003Cspan leaf=\"\">increase\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__132\">\u003Csection>\u003Cspan leaf=\"\">时间窗口内增量\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__133\">\u003Csection>\u003Cspan leaf=\"\">increase(restarts[1h])\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr>\u003Ctd class=\"js_darkmode__134\">\u003Csection>\u003Cspan leaf=\"\">histogram_quantile\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__135\">\u003Csection>\u003Cspan leaf=\"\">直方图分位数\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__136\">\u003Csection>\u003Cspan leaf=\"\">histogram_quantile(0.99, rate(bucket[5m]))\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr>\u003Ctd class=\"js_darkmode__137\">\u003Csection>\u003Cspan leaf=\"\">clamp_max/clamp_min\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__138\">\u003Csection>\u003Cspan leaf=\"\">限制值范围\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__139\">\u003Csection>\u003Cspan leaf=\"\">clamp_max(ratio, 1)\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003C/tbody>\u003C/table>\u003Ch3 class=\"js_darkmode__bg__101\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">C. 术语表\u003C/span>\u003C/h3>\u003Ctable class=\"js_darkmode__140 layui-table\" style=\"text-align: justify;\">\u003Cthead>\u003Ctr>\u003Cth class=\"js_darkmode__bg__102\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">术语\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__bg__103\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">英文\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__bg__104\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">解释\u003C/span>\u003C/section>\u003C/th>\u003C/tr>\u003C/thead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"js_darkmode__141\">\u003Csection>\u003Cspan leaf=\"\">Recording Rules\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__142\">\u003Csection>\u003Cspan leaf=\"\">Recording Rules\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__143\">\u003Csection>\u003Cspan leaf=\"\">Prometheus 的预计算规则，将复杂查询结果存储为新时间序列\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr>\u003Ctd class=\"js_darkmode__144\">\u003Csection>\u003Cspan leaf=\"\">告警噪声\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__145\">\u003Csection>\u003Cspan leaf=\"\">Alert Noise\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__146\">\u003Csection>\u003Cspan leaf=\"\">非关键性、重复性或误报的告警，会导致告警疲劳\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr>\u003Ctd class=\"js_darkmode__147\">\u003Csection>\u003Cspan leaf=\"\">时间窗口\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__148\">\u003Csection>\u003Cspan leaf=\"\">Time Window\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__149\">\u003Csection>\u003Cspan leaf=\"\">PromQL 中用方括号指定的时间范围，如 [5m]\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr>\u003Ctd class=\"js_darkmode__150\">\u003Csection>\u003Cspan leaf=\"\">基数\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__151\">\u003Csection>\u003Cspan leaf=\"\">Cardinality\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__152\">\u003Csection>\u003Cspan leaf=\"\">时间序列的数量，由指标名和标签组合决定\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr>\u003Ctd class=\"js_darkmode__153\">\u003Csection>\u003Cspan leaf=\"\">告警收敛\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__154\">\u003Csection>\u003Cspan leaf=\"\">Alert Aggregation\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__155\">\u003Csection>\u003Cspan leaf=\"\">将多个相关告警合并为一个，减少告警数量\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003C/tbody>\u003C/table>","## 五、故障排查和监控\n\n### 5.1 故障排查\n\n#### ◆ 5.1.1 日志查看\n\n```\n# 查看 Prometheus 日志中的规则评估错误journalctl -u prometheus | grep -i \"rule\" | tail -50# 查看规则评估耗时curl -s http://localhost:9090/api/v1/rules | jq '.data.groups[].rules[] | select(.health != \"ok\")'# Kubernetes 环境kubectl logs -n monitoring prometheus-server-0 | grep -i \"recording\"\n```\n\n#### ◆ 5.1.2 常见问题排查\n\n问题一：Recording Rule 显示 “no data”\n\n```\n# 诊断命令# 1. 确认源指标存在curl -s 'http://localhost:9090/api/v1/query?query=node_cpu_seconds_total' | jq '.data.result | length'# 2. 测试表达式curl -s 'http://localhost:9090/api/v1/query?query=rate(node_cpu_seconds_total[5m])' | jq '.data.result | length'\n```\n\n解决方案\n\n：\n\n1. 1. 确认源指标正在被采集\n2. 2. 检查标签选择器是否匹配\n3. 3. 验证时间窗口是否合理（数据量是否足够）\n\n问题二：Recording Rules 计算结果与预期不符\n\n```\n# 诊断命令# 对比 Recording Rule 结果与手动查询结果curl -s 'http://localhost:9090/api/v1/query?query=instance:node_cpu_utilization:avg5m{instance=\"node1:9100\"}'curl -s 'http://localhost:9090/api/v1/query?query=1-avg(rate(node_cpu_seconds_total{instance=\"node1:9100\",mode=\"idle\"}[5m]))'\n```\n\n解决方案\n\n：检查 by 子句是否包含了所有需要保留的标签\n\n问题三：规则评估超时\n\n- • 症状：Prometheus 日志出现 “rule group took longer than interval”\n- • 排查：检查规则复杂度和数据量\n- • 解决：拆分规则组、增大 interval、优化表达式\n\n#### ◆ 5.1.3 调试模式\n\n```\n# 开启 Prometheus 查询日志# 在启动参数中添加--query.log-queries# 查看慢查询grep \"slow\" /var/log/prometheus/query.log# 使用 Prometheus 内置指标分析规则评估prometheus_rule_evaluation_duration_secondsprometheus_rule_group_last_duration_seconds\n```\n\n### 5.2 性能监控\n\n#### ◆ 5.2.1 关键指标监控\n\n```\n# Recording Rules 评估耗时histogram_quantile(0.99, rate(prometheus_rule_evaluation_duration_seconds_bucket[5m]))# 规则评估失败次数rate(prometheus_rule_evaluation_failures_total[5m])# 规则产生的时序数量prometheus_tsdb_head_series# 内存使用process_resident_memory_bytes{job=\"prometheus\"}\n```\n\n#### ◆ 5.2.2 监控指标说明\n\n指标名称\n\n正常范围\n\n告警阈值\n\n说明\n\nrule_evaluation_duration_seconds\n\n\u003C 1s\n\n> 5s\n\n规则评估耗时，过长说明规则复杂或数据量大\n\nrule_evaluation_failures_total\n\n0\n\n> 0\n\n规则评估失败，需要检查表达式\n\ntsdb_head_series\n\n视环境而定\n\n增长率 > 10%/h\n\n时序数量，Recording Rules 会增加时序\n\nprocess_resident_memory_bytes\n\n\u003C 80% 配置内存\n\n> 90%\n\n内存使用，时序增加会占用更多内存\n\n#### ◆ 5.2.3 Recording Rules 自身监控\n\n```\n# 监控 Recording Rules 健康状态groups:-name:recording_rules_healthrules:-alert:RecordingRuleEvaluationSlowexpr:|          prometheus_rule_group_last_duration_seconds >          prometheus_rule_group_interval_secondsfor:5mlabels:severity:warningannotations:summary:\"Recording Rule 组 {{ $labels.rule_group }} 评估超时\"-alert:RecordingRuleEvaluationFailureexpr:rate(prometheus_rule_evaluation_failures_total[5m])>0for:5mlabels:severity:criticalannotations:summary:\"Recording Rule 评估失败\"\n```\n\n### 5.3 备份与恢复\n\n#### ◆ 5.3.1 配置备份\n\n```\n#!/bin/bash# Recording Rules 配置备份脚本# 文件名：backup_recording_rules.shBACKUP_DIR=\"/backup/prometheus/rules\"PROMETHEUS_RULES_DIR=\"/etc/prometheus/rules\"DATE=$(date +%Y%m%d_%H%M%S)mkdir -p ${BACKUP_DIR}# 备份所有规则文件tar -czvf ${BACKUP_DIR}/rules_${DATE}.tar.gz -C ${PROMETHEUS_RULES_DIR} .# 保留最近30天的备份find ${BACKUP_DIR} -name \"rules_*.tar.gz\" -mtime +30 -delete# 验证备份tar -tzf ${BACKUP_DIR}/rules_${DATE}.tar.gz\n```\n\n#### ◆ 5.3.2 恢复流程\n\n1. 1. 停止 Prometheus：systemctl stop prometheus\n2. 2. 恢复配置：tar -xzvf /backup/prometheus/rules/rules_xxx.tar.gz -C /etc/prometheus/rules/\n3. 3. 验证配置：promtool check rules /etc/prometheus/rules/*.yml\n4. 4. 启动服务：systemctl start prometheus\n\n---\n\n## 六、总结\n\n### 6.1 技术要点回顾\n\n- • 要点一：Recording Rules 的核心价值在于预计算和聚合，通过时间窗口平滑消除瞬时抖动，通过层级聚合实现告警收敛\n- • 要点二：命名规范至关重要，采用 level:metric_name:aggregation 格式，便于理解和维护\n- • 要点三：分层设计是大规模环境的最佳实践，从原始指标到基础设施指标到业务指标，逐层抽象\n- • 要点四：Recording Rules 需要持续监控和优化，关注评估耗时、失败次数、时序增长等指标\n\n### 6.2 进阶学习方向\n\n1. 1. 告警分级与智能降噪：结合机器学习算法实现异常检测，替代固定阈值\n2. 2. 大规模 Prometheus 架构：联邦集群、远程存储、Thanos/Cortex\n3. 3. PromQL 高级技巧：子查询、偏移量、复杂聚合\n\n### 6.3 参考资料\n\n- • Prometheus Recording Rules 官方文档 - 权威参考\n- • Robust Perception 博客 - Brian Brazil（Prometheus 核心开发者）的博客\n- • PromLabs 博客 - 深入的 PromQL 教程\n- • Awesome Prometheus Alerts - 社区维护的告警规则集合\n\n---\n\n## 附录\n\n### A. Recording Rules 命令速查表\n\n```\n# 检查规则语法promtool check rules /etc/prometheus/rules/*.yml# 热加载配置curl -X POST http://localhost:9090/-/reload# 查看规则状态curl -s http://localhost:9090/api/v1/rules | jq '.data.groups[].rules[] | {record, health}'# 测试表达式curl -s 'http://localhost:9090/api/v1/query?query=YOUR_EXPRESSION' | jq# 查看规则评估指标curl -s 'http://localhost:9090/api/v1/query?query=prometheus_rule_evaluation_duration_seconds'\n```\n\n### B. 常用聚合函数说明\n\n函数\n\n用途\n\n示例\n\navg_over_time\n\n时间窗口内平均值，平滑抖动\n\navg_over_time(cpu[5m])\n\nmax_over_time\n\n时间窗口内最大值，捕获峰值\n\nmax_over_time(cpu[15m])\n\nmin_over_time\n\n时间窗口内最小值\n\nmin_over_time(available[5m])\n\nrate\n\n计数器每秒增长率\n\nrate(requests_total[5m])\n\nincrease\n\n时间窗口内增量\n\nincrease(restarts[1h])\n\nhistogram_quantile\n\n直方图分位数\n\nhistogram_quantile(0.99, rate(bucket[5m]))\n\nclamp_max/clamp_min\n\n限制值范围\n\nclamp_max(ratio, 1)\n\n### C. 术语表\n\n术语\n\n英文\n\n解释\n\nRecording Rules\n\nRecording Rules\n\nPrometheus 的预计算规则，将复杂查询结果存储为新时间序列\n\n告警噪声\n\nAlert Noise\n\n非关键性、重复性或误报的告警，会导致告警疲劳\n\n时间窗口\n\nTime Window\n\nPromQL 中用方括号指定的时间范围，如 [5m]\n\n基数\n\nCardinality\n\n时间序列的数量，由指标名和标签组合决定\n\n告警收敛\n\nAlert Aggregation\n\n将多个相关告警合并为一个，减少告警数量","/article/120",282,"2026-01-06 11:53:50","2026-01-06 11:54:33",{"id":324,"category_id":44,"title":325,"keywords":6,"description":326,"image_url":6,"content":327,"content_md":328,"url":329,"hits":330,"is_recommend":73,"is_top":73,"create_time":331,"update_time":332},119,"用 Prometheus Recording Rules 把告警噪声砍掉 70%(一)","一、概述1.1 背景介绍在大规模微服务架构下，Prometheus 告警系统往往会陷入一个尴尬的境地：告警太多，运维团队开始选择性忽略；告警太少，真正的故障又可能漏掉。我在某电商平台负责监控体系建设时，团队每天要处理超过 2000 条告警，其中 70% 以上是重复的、关联的或者短暂抖动产生的噪声。Recording Rules 是 Prometheus 提供的预计算机制，可以将复杂的查询表达式预先计算并存储为新的时间序列。通过合理设计 Recording Rules，我们不仅能显著降低 Prom","\u003Ch2 class=\"js_darkmode__bg__2\" style=\"text-align: center;\">\u003Cspan leaf=\"\">一、概述\u003C/span>\u003C/h2>\u003Ch3 class=\"js_darkmode__bg__3\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">1.1 背景介绍\u003C/span>\u003C/h3>\u003Cp class=\"js_darkmode__1\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">在大规模微服务架构下，Prometheus 告警系统往往会陷入一个尴尬的境地：告警太多，运维团队开始选择性忽略；告警太少，真正的故障又可能漏掉。我在某电商平台负责监控体系建设时，团队每天要处理超过 2000 条告警，其中 70% 以上是重复的、关联的或者短暂抖动产生的噪声。\u003C/span>\u003C/p>\u003Cp class=\"js_darkmode__2\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">Recording Rules 是 Prometheus 提供的预计算机制，可以将复杂的查询表达式预先计算并存储为新的时间序列。通过合理设计 Recording Rules，我们不仅能显著降低 PromQL 查询压力，更重要的是可以实现告警聚合、去重、平滑，从根本上减少告警噪声。\u003C/span>\u003C/p>\u003Ch3 class=\"js_darkmode__bg__4\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">1.2 技术特点\u003C/span>\u003C/h3>\u003Cul class=\"list-paddingleft-1 js_darkmode__3\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>预计算优化\u003C/span>\u003Cspan leaf=\"\">：将复杂的聚合查询预先计算，避免告警规则重复计算相同的表达式，降低 Prometheus 负载\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>时间窗口平滑\u003C/span>\u003Cspan leaf=\"\">：通过 \u003C/span>\u003Ccode>\u003Cspan leaf=\"\">avg_over_time\u003C/span>\u003C/code>\u003Cspan leaf=\"\">、\u003C/span>\u003Ccode>\u003Cspan leaf=\"\">max_over_time\u003C/span>\u003C/code>\u003Cspan leaf=\"\"> 等函数消除瞬时抖动，避免单点毛刺触发告警\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>多维度聚合\u003C/span>\u003Cspan leaf=\"\">：支持按 namespace、service、pod 等维度聚合指标，实现告警收敛\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>层级化告警\u003C/span>\u003Cspan leaf=\"\">：基于 Recording Rules 构建指标层级，实现从基础指标到业务指标的逐层抽象\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Ch3 class=\"js_darkmode__bg__5\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">1.3 适用场景\u003C/span>\u003C/h3>\u003Cul class=\"list-paddingleft-1 js_darkmode__4\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• 场景一：大规模 Kubernetes 集群监控，Pod 数量超过 1000，原生指标产生的告警风暴需要收敛\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• 场景二：微服务架构下，服务间依赖复杂，需要将底层告警聚合为服务级别的健康状态\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• 场景三：业务高峰期流量抖动频繁，需要平滑处理避免误告警\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• 场景四：多租户环境下，需要按租户/业务线聚合告警，避免一个故障触发上百条告警\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Ch3 class=\"js_darkmode__bg__6\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">1.4 环境要求\u003C/span>\u003C/h3>\u003Ctable class=\"js_darkmode__5 layui-table\" style=\"text-align: justify;\">\u003Cthead>\u003Ctr>\u003Cth class=\"js_darkmode__bg__7\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">组件\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__bg__8\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">版本要求\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__bg__9\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">说明\u003C/span>\u003C/section>\u003C/th>\u003C/tr>\u003C/thead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"js_darkmode__6\">\u003Csection>\u003Cspan leaf=\"\">Prometheus\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__7\">\u003Csection>\u003Cspan leaf=\"\">2.28+\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__8\">\u003Csection>\u003Cspan leaf=\"\">支持 Recording Rules 分组和 limit 特性\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr>\u003Ctd class=\"js_darkmode__9\">\u003Csection>\u003Cspan leaf=\"\">Alertmanager\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__10\">\u003Csection>\u003Cspan leaf=\"\">0.23+\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__11\">\u003Csection>\u003Cspan leaf=\"\">配合使用告警抑制和分组功能\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr>\u003Ctd class=\"js_darkmode__12\">\u003Csection>\u003Cspan leaf=\"\">Kubernetes\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__13\">\u003Csection>\u003Cspan leaf=\"\">1.21+\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__14\">\u003Csection>\u003Cspan leaf=\"\">如果使用 kube-prometheus-stack\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr>\u003Ctd class=\"js_darkmode__15\">\u003Csection>\u003Cspan leaf=\"\">内存配置\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__16\">\u003Csection>\u003Cspan leaf=\"\">建议 8GB+\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__17\">\u003Csection>\u003Cspan leaf=\"\">Recording Rules 会增加时序存储量\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003C/tbody>\u003C/table>\u003Chr class=\"js_darkmode__bg__10 js_darkmode__18\" style=\"text-align: justify;\">\u003Ch2 class=\"js_darkmode__bg__11\" style=\"text-align: center;\">\u003Cspan leaf=\"\">二、详细步骤\u003C/span>\u003C/h2>\u003Ch3 class=\"js_darkmode__bg__12\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">2.1 准备工作\u003C/span>\u003C/h3>\u003Ch4 class=\"js_darkmode__bg__13\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 2.1.1 现状分析\u003C/span>\u003C/h4>\u003Cp class=\"js_darkmode__19\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">在动手之前，先要搞清楚当前告警噪声的分布。我习惯用下面这个查询来分析过去一周的告警触发情况：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__14 js_darkmode__20\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 查看 Prometheus 配置\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">kubectl get configmap prometheus-server -n monitoring -o yaml\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 分析告警触发频次（在 Prometheus UI 执行）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 统计过去7天各告警规则触发次数\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">count_over_time(ALERTS{alertstate=\u003C/span>\u003Cspan leaf=\"\">\"firing\"\u003C/span>\u003Cspan leaf=\"\">}[7d])\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 查看当前活跃告警数量\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">count(ALERTS{alertstate=\u003C/span>\u003Cspan leaf=\"\">\"firing\"\u003C/span>\u003Cspan leaf=\"\">})\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__15\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 2.1.2 识别噪声来源\u003C/span>\u003C/h4>\u003Cp class=\"js_darkmode__21\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">根据我的经验，告警噪声主要来自以下几类：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__16 js_darkmode__22\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 检查高频告警（每分钟触发超过10次的规则）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 在 Prometheus 执行\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">topk(20, count by (alertname) (count_over_time(ALERTS{alertstate=\u003C/span>\u003Cspan leaf=\"\">\"firing\"\u003C/span>\u003Cspan leaf=\"\">}[1h])))\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 检查短暂告警（持续时间小于5分钟的）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 这类告警往往是抖动产生的噪声\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__23\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">通常会发现以下几类高频噪声：\u003C/span>\u003C/p>\u003Cul class=\"list-paddingleft-1 js_darkmode__24\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• CPU/内存使用率瞬时超阈值\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• Pod 重启计数器误报\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• 网络延迟抖动\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• 磁盘 IO 突增\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Ch3 class=\"js_darkmode__bg__17\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">2.2 核心配置\u003C/span>\u003C/h3>\u003Ch4 class=\"js_darkmode__bg__18\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 2.2.1 Recording Rules 基础结构\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__19 js_darkmode__25\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 文件路径：/etc/prometheus/rules/recording_rules.yml\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">groups:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">name:\u003C/span>\u003Cspan leaf=\"\">node_recording_rules\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">interval:\u003C/span>\u003Cspan leaf=\"\">30s\u003C/span>\u003Cspan leaf=\"\"># 计算间隔，根据需求调整\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">rules:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 规则定义\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">job:node_cpu_utilization:avg5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">|\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          1 - avg by (job, instance) (\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            rate(node_cpu_seconds_total{mode=\"idle\"}[5m])\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          )\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__26\" style=\"text-align: justify;\">\u003Cspan>说明\u003C/span>\u003Cspan leaf=\"\">：\u003C/span>\u003Ccode>\u003Cspan leaf=\"\">interval\u003C/span>\u003C/code>\u003Cspan leaf=\"\"> 参数控制 Recording Rules 的计算频率。设置过小会增加计算压力，过大则可能错过关键变化。一般建议设置为告警评估间隔的一半。\u003C/span>\u003C/p>\u003Ch4 class=\"js_darkmode__bg__20\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 2.2.2 CPU 使用率平滑处理\u003C/span>\u003C/h4>\u003Cp class=\"js_darkmode__27\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">这是最常见的噪声来源。原始告警规则可能是这样的：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__21 js_darkmode__28\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 原始告警规则（噪声大）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">alert:\u003C/span>\u003Cspan leaf=\"\">HighCPUUsage\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">100\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">(avg\u003C/span>\u003Cspan leaf=\"\">by(instance)\u003C/span>\u003Cspan leaf=\"\">(rate(node_cpu_seconds_total{mode=\"idle\"}[1m]))\u003C/span>\u003Cspan leaf=\"\">*\u003C/span>\u003Cspan leaf=\"\">100\u003C/span>\u003Cspan leaf=\"\">)\u003C/span>\u003Cspan leaf=\"\">>\u003C/span>\u003Cspan leaf=\"\">80\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">for:\u003C/span>\u003Cspan leaf=\"\">1m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__29\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">使用 Recording Rules 优化后：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__22 js_darkmode__30\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># recording_rules.yml\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">groups:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">name:\u003C/span>\u003Cspan leaf=\"\">cpu_smoothing\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">interval:\u003C/span>\u003Cspan leaf=\"\">30s\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">rules:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 第一层：5分钟平均 CPU 使用率\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">instance:node_cpu_utilization:avg5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">|\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          1 - avg by (instance) (\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            rate(node_cpu_seconds_total{mode=\"idle\"}[5m])\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          )\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 第二层：基于5分钟均值的15分钟最大值\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 这样可以捕获持续性高负载，过滤掉短暂峰值\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">instance:node_cpu_utilization:max15m_avg5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">|\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          max_over_time(instance:node_cpu_utilization:avg5m[15m])\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 第三层：按集群聚合的 CPU 使用率\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">cluster:node_cpu_utilization:avg\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">|\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          avg(instance:node_cpu_utilization:avg5m)\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__31\" style=\"text-align: justify;\">\u003Cspan>参数说明\u003C/span>\u003Cspan leaf=\"\">：\u003C/span>\u003C/p>\u003Cul class=\"list-paddingleft-1 js_darkmode__32\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Ccode>\u003Cspan leaf=\"\">avg5m\u003C/span>\u003C/code>\u003Cspan leaf=\"\">：使用 5 分钟窗口计算平均值，消除秒级抖动\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Ccode>\u003Cspan leaf=\"\">max15m_avg5m\u003C/span>\u003C/code>\u003Cspan leaf=\"\">：在 5 分钟均值基础上取 15 分钟最大值，只有持续性高负载才会触发\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Ccode>\u003Cspan leaf=\"\">cluster:\u003C/span>\u003C/code>\u003Cspan leaf=\"\"> 前缀：表示集群级别聚合，便于识别层级\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Ch4 class=\"js_darkmode__bg__23\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 2.2.3 内存使用率分层聚合\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__24 js_darkmode__33\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\">groups:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">name:\u003C/span>\u003Cspan leaf=\"\">memory_recording_rules\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">interval:\u003C/span>\u003Cspan leaf=\"\">30s\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">rules:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 节点级别内存使用率\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">instance:node_memory_utilization:ratio\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">|\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          1 - (\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            node_memory_MemAvailable_bytes\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            / node_memory_MemTotal_bytes\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          )\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 应用级别内存使用（Kubernetes 环境）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">namespace_pod:container_memory_usage:sum\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">|\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          sum by (namespace, pod) (\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            container_memory_working_set_bytes{container!=\"\", container!=\"POD\"}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          )\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 服务级别内存使用率\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">namespace_service:memory_utilization:avg5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">|\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          avg by (namespace, service) (\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            avg_over_time(\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">              container_memory_working_set_bytes{container!=\"\"}[5m]\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            )\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          ) / avg by (namespace, service) (\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            kube_pod_container_resource_limits{resource=\"memory\"}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          )\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__25\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 2.2.4 请求错误率聚合\u003C/span>\u003C/h4>\u003Cp class=\"js_darkmode__34\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">对于微服务场景，HTTP 错误率告警是另一个噪声重灾区：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__26 js_darkmode__35\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\">groups:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">name:\u003C/span>\u003Cspan leaf=\"\">http_error_rate_rules\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">interval:\u003C/span>\u003Cspan leaf=\"\">15s\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">rules:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 服务级别错误率（5分钟窗口）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">service:http_requests_total:rate5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">|\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          sum by (namespace, service) (\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            rate(http_requests_total[5m])\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          )\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">service:http_requests_errors:rate5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">|\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          sum by (namespace, service) (\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            rate(http_requests_total{status=~\"5..\"}[5m])\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          )\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 错误率计算\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">service:http_error_rate:ratio5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">|\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          service:http_requests_errors:rate5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          / service:http_requests_total:rate5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 加权错误率：流量越大权重越高\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 避免低流量服务的单个错误触发高错误率告警\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">service:http_error_rate:weighted5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">|\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          (service:http_requests_errors:rate5m + 1)\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          / (service:http_requests_total:rate5m + 10)\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch3 class=\"js_darkmode__bg__27\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">2.3 启动和验证\u003C/span>\u003C/h3>\u003Ch4 class=\"js_darkmode__bg__28\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 2.3.1 配置热加载\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__29 js_darkmode__36\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 检查配置语法\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">promtool check rules /etc/prometheus/rules/recording_rules.yml\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 热加载 Prometheus 配置\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">curl -X POST http://localhost:9090/-/reload\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 或者发送 SIGHUP 信号\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">kill\u003C/span>\u003Cspan leaf=\"\"> -HUP $(pgrep prometheus)\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__30\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 2.3.2 验证 Recording Rules 生效\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__31 js_darkmode__37\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 在 Prometheus UI 查询新生成的指标\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 应该能看到数据\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">instance:node_cpu_utilization:avg5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 检查 Recording Rules 状态\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">curl -s http://localhost:9090/api/v1/rules | jq \u003C/span>\u003Cspan leaf=\"\">'.data.groups[] | select(.name==\"cpu_smoothing\")'\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 预期输出应显示规则状态为 \"health\": \"ok\"\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Chr class=\"js_darkmode__bg__32 js_darkmode__38\" style=\"text-align: justify;\">\u003Ch2 class=\"js_darkmode__bg__33\" style=\"text-align: center;\">\u003Cspan leaf=\"\">三、示例代码和配置\u003C/span>\u003C/h2>\u003Ch3 class=\"js_darkmode__bg__34\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">3.1 完整配置示例\u003C/span>\u003C/h3>\u003Ch4 class=\"js_darkmode__bg__35\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 3.1.1 完整的 Recording Rules 配置\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__36 js_darkmode__39\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 文件路径：/etc/prometheus/rules/recording_rules.yml\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">groups:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># ============ 基础设施层 ============\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">name:\u003C/span>\u003Cspan leaf=\"\">infrastructure_recording_rules\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">interval:\u003C/span>\u003Cspan leaf=\"\">30s\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">rules:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># CPU\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">instance:node_cpu_utilization:avg5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">1\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">avg\u003C/span>\u003Cspan leaf=\"\">by\u003C/span>\u003Cspan leaf=\"\">(instance)\u003C/span>\u003Cspan leaf=\"\">(rate(node_cpu_seconds_total{mode=\"idle\"}[5m]))\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">instance:node_cpu_utilization:max_avg5m_over_15m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">max_over_time(instance:node_cpu_utilization:avg5m[15m])\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># Memory\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">instance:node_memory_utilization:ratio\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">1\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">(node_memory_MemAvailable_bytes\u003C/span>\u003Cspan leaf=\"\">/\u003C/span>\u003Cspan leaf=\"\">node_memory_MemTotal_bytes)\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">instance:node_memory_utilization:avg5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">avg_over_time(instance:node_memory_utilization:ratio[5m])\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># Disk\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">instance:node_disk_utilization:ratio\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">|\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          1 - (\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            node_filesystem_avail_bytes{fstype=~\"ext4|xfs\"}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            / node_filesystem_size_bytes{fstype=~\"ext4|xfs\"}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          )\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># Network\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">instance:node_network_receive:rate5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">sum\u003C/span>\u003Cspan leaf=\"\">by\u003C/span>\u003Cspan leaf=\"\">(instance)\u003C/span>\u003Cspan leaf=\"\">(rate(node_network_receive_bytes_total{device!~\"lo|veth.*|docker.*|br.*\"}[5m]))\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">instance:node_network_transmit:rate5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">sum\u003C/span>\u003Cspan leaf=\"\">by\u003C/span>\u003Cspan leaf=\"\">(instance)\u003C/span>\u003Cspan leaf=\"\">(rate(node_network_transmit_bytes_total{device!~\"lo|veth.*|docker.*|br.*\"}[5m]))\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># ============ Kubernetes 层 ============\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">name:\u003C/span>\u003Cspan leaf=\"\">kubernetes_recording_rules\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">interval:\u003C/span>\u003Cspan leaf=\"\">30s\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">rules:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># Pod 资源使用聚合到 namespace\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">namespace:container_cpu_usage:sum\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">|\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          sum by (namespace) (\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            rate(container_cpu_usage_seconds_total{container!=\"\", container!=\"POD\"}[5m])\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          )\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">namespace:container_memory_usage:sum\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">|\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          sum by (namespace) (\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            container_memory_working_set_bytes{container!=\"\", container!=\"POD\"}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          )\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># Pod 重启率（1小时窗口，避免单次重启告警）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">namespace_pod:container_restarts:increase1h\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">|\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          increase(kube_pod_container_status_restarts_total[1h])\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># Deployment 可用性\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">namespace_deployment:replicas_unavailable:ratio\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">|\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          kube_deployment_status_replicas_unavailable\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          / kube_deployment_spec_replicas\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># ============ 应用层 ============\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">name:\u003C/span>\u003Cspan leaf=\"\">application_recording_rules\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">interval:\u003C/span>\u003Cspan leaf=\"\">15s\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">rules:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># HTTP 请求速率\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">service:http_requests:rate5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">sum\u003C/span>\u003Cspan leaf=\"\">by\u003C/span>\u003Cspan leaf=\"\">(namespace,\u003C/span>\u003Cspan leaf=\"\">service,\u003C/span>\u003Cspan leaf=\"\">method)\u003C/span>\u003Cspan leaf=\"\">(rate(http_requests_total[5m]))\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># HTTP 错误率\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">service:http_errors:rate5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">sum\u003C/span>\u003Cspan leaf=\"\">by\u003C/span>\u003Cspan leaf=\"\">(namespace,\u003C/span>\u003Cspan leaf=\"\">service)\u003C/span>\u003Cspan leaf=\"\">(rate(http_requests_total{status=~\"5..\"}[5m]))\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># HTTP P99 延迟\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">service:http_latency_p99:5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">|\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          histogram_quantile(0.99,\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            sum by (namespace, service, le) (\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">              rate(http_request_duration_seconds_bucket[5m])\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            )\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          )\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 服务健康评分（综合指标）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">service:health_score:5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">|\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          (\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            1 - clamp_max(service:http_errors:rate5m / service:http_requests:rate5m, 1)\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          ) * 0.4\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          +\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          (\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            1 - clamp_max(service:http_latency_p99:5m / 2, 1)\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          ) * 0.3\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          +\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          (\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            clamp_max(service:http_requests:rate5m / 100, 1)\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          ) * 0.3\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__37\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 3.1.2 基于 Recording Rules 的告警规则\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__38 js_darkmode__40\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 文件路径：/etc/prometheus/rules/alert_rules.yml\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">groups:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">name:\u003C/span>\u003Cspan leaf=\"\">infrastructure_alerts\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">rules:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 使用预计算指标，更稳定\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">alert:\u003C/span>\u003Cspan leaf=\"\">NodeHighCPU\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">instance:node_cpu_utilization:max_avg5m_over_15m\u003C/span>\u003Cspan leaf=\"\">>\u003C/span>\u003Cspan leaf=\"\">0.85\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">for:\u003C/span>\u003Cspan leaf=\"\">5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">labels:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">severity:\u003C/span>\u003Cspan leaf=\"\">warning\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">annotations:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">summary:\u003C/span>\u003Cspan leaf=\"\">\"节点 \u003C/span>\u003Cspan leaf=\"\">{{ $labels.instance }}\u003C/span>\u003Cspan leaf=\"\"> CPU 持续高负载\"\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">description:\u003C/span>\u003Cspan leaf=\"\">\"15分钟内 CPU 使用率峰值超过 85%，当前值 \u003C/span>\u003Cspan leaf=\"\">{{ $value | humanizePercentage }}\u003C/span>\u003Cspan leaf=\"\">\"\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">alert:\u003C/span>\u003Cspan leaf=\"\">NodeHighMemory\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">instance:node_memory_utilization:avg5m\u003C/span>\u003Cspan leaf=\"\">>\u003C/span>\u003Cspan leaf=\"\">0.9\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">for:\u003C/span>\u003Cspan leaf=\"\">10m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">labels:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">severity:\u003C/span>\u003Cspan leaf=\"\">warning\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">annotations:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">summary:\u003C/span>\u003Cspan leaf=\"\">\"节点 \u003C/span>\u003Cspan leaf=\"\">{{ $labels.instance }}\u003C/span>\u003Cspan leaf=\"\"> 内存使用率过高\"\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">description:\u003C/span>\u003Cspan leaf=\"\">\"内存使用率持续超过 90%\"\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">name:\u003C/span>\u003Cspan leaf=\"\">application_alerts\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">rules:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 基于聚合指标的服务健康告警\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">alert:\u003C/span>\u003Cspan leaf=\"\">ServiceUnhealthy\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">service:health_score:5m\u003C/span>\u003Cspan leaf=\"\"><\u003C/span>\u003Cspan leaf=\"\">0.6\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">for:\u003C/span>\u003Cspan leaf=\"\">5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">labels:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">severity:\u003C/span>\u003Cspan leaf=\"\">critical\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">annotations:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">summary:\u003C/span>\u003Cspan leaf=\"\">\"服务 \u003C/span>\u003Cspan leaf=\"\">{{ $labels.namespace }}\u003C/span>\u003Cspan leaf=\"\">/\u003C/span>\u003Cspan leaf=\"\">{{ $labels.service }}\u003C/span>\u003Cspan leaf=\"\"> 健康状态异常\"\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">description:\u003C/span>\u003Cspan leaf=\"\">\"服务健康评分低于 0.6，当前值 \u003C/span>\u003Cspan leaf=\"\">{{ $value }}\u003C/span>\u003Cspan leaf=\"\">\"\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># Pod 频繁重启（使用1小时窗口）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">alert:\u003C/span>\u003Cspan leaf=\"\">PodFrequentRestart\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">namespace_pod:container_restarts:increase1h\u003C/span>\u003Cspan leaf=\"\">>\u003C/span>\u003Cspan leaf=\"\">3\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">for:\u003C/span>\u003Cspan leaf=\"\">0m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">labels:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">severity:\u003C/span>\u003Cspan leaf=\"\">warning\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">annotations:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">summary:\u003C/span>\u003Cspan leaf=\"\">\"Pod \u003C/span>\u003Cspan leaf=\"\">{{ $labels.namespace }}\u003C/span>\u003Cspan leaf=\"\">/\u003C/span>\u003Cspan leaf=\"\">{{ $labels.pod }}\u003C/span>\u003Cspan leaf=\"\"> 频繁重启\"\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">description:\u003C/span>\u003Cspan leaf=\"\">\"过去1小时重启 \u003C/span>\u003Cspan leaf=\"\">{{ $value }}\u003C/span>\u003Cspan leaf=\"\"> 次\"\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch3 class=\"js_darkmode__bg__39\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">3.2 实际应用案例\u003C/span>\u003C/h3>\u003Ch4 class=\"js_darkmode__bg__40\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 案例一：电商大促告警收敛\u003C/span>\u003C/h4>\u003Cp class=\"js_darkmode__41\" style=\"text-align: justify;\">\u003Cspan>场景描述\u003C/span>\u003Cspan leaf=\"\">：双11大促期间，订单服务 QPS 从日常 1000 飙升到 50000，原有的错误率告警（错误数/总请求数 > 1%）频繁触发，因为即使错误率只有 0.5%，绝对错误数也达到了 250/秒。\u003C/span>\u003C/p>\u003Cp class=\"js_darkmode__42\" style=\"text-align: justify;\">\u003Cspan>实现代码\u003C/span>\u003Cspan leaf=\"\">：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__41 js_darkmode__43\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># Recording Rules\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">groups:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">name:\u003C/span>\u003Cspan leaf=\"\">ecommerce_rules\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">rules:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 动态基线：使用过去1小时的错误率作为基线\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">service:http_error_rate:baseline1h\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">|\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          avg_over_time(\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            (\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">              sum by (service) (rate(http_requests_total{status=~\"5..\"}[5m]))\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">              / sum by (service) (rate(http_requests_total[5m]))\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            )[1h:]\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          )\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 当前错误率与基线的比值\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">service:http_error_rate:ratio_to_baseline\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">|\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          (\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            sum by (service) (rate(http_requests_total{status=~\"5..\"}[5m]))\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            / sum by (service) (rate(http_requests_total[5m]))\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          )\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          / service:http_error_rate:baseline1h\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 告警规则\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">alert:\u003C/span>\u003Cspan leaf=\"\">ServiceErrorRateSpike\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">service:http_error_rate:ratio_to_baseline\u003C/span>\u003Cspan leaf=\"\">>\u003C/span>\u003Cspan leaf=\"\">3\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">for:\u003C/span>\u003Cspan leaf=\"\">5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">annotations:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">summary:\u003C/span>\u003Cspan leaf=\"\">\"服务 \u003C/span>\u003Cspan leaf=\"\">{{ $labels.service }}\u003C/span>\u003Cspan leaf=\"\"> 错误率异常飙升\"\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">description:\u003C/span>\u003Cspan leaf=\"\">\"当前错误率是基线的 \u003C/span>\u003Cspan leaf=\"\">{{ $value | humanize }}\u003C/span>\u003Cspan leaf=\"\"> 倍\"\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__44\" style=\"text-align: justify;\">\u003Cspan>运行结果\u003C/span>\u003Cspan leaf=\"\">：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__42 js_darkmode__45\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\">大促期间告警数量对比：\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">- 优化前：每小时平均 150+ 条告警\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">- 优化后：每小时平均 5-10 条告警\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">- 误告警率：从 85% 降低到 15%\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__43\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 案例二：多租户环境告警聚合\u003C/span>\u003C/h4>\u003Cp class=\"js_darkmode__46\" style=\"text-align: justify;\">\u003Cspan>场景描述\u003C/span>\u003Cspan leaf=\"\">：SaaS 平台有 200+ 租户，每个租户有独立的命名空间。当某个底层节点故障时，原有配置会触发 200+ 条 Pod 不可用告警。\u003C/span>\u003C/p>\u003Cp class=\"js_darkmode__47\" style=\"text-align: justify;\">\u003Cspan>实现步骤\u003C/span>\u003Cspan leaf=\"\">：\u003C/span>\u003C/p>\u003Col class=\"list-paddingleft-1 js_darkmode__48\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">1. 创建租户级别的聚合指标\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">2. 实现告警收敛，只告警受影响的节点，附带影响的租户列表\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">3. 配合 Alertmanager 的 group_by 实现进一步收敛\u003C/span>\u003C/section>\u003C/li>\u003C/ol>\u003Cpre class=\"js_darkmode__bg__44 js_darkmode__49\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># Recording Rules\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">groups:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">name:\u003C/span>\u003Cspan leaf=\"\">tenant_aggregation\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">rules:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 按租户聚合不可用 Pod 数量\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">tenant:pods_unavailable:count\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">|\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          count by (tenant) (\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            kube_pod_status_phase{phase!=\"Running\", phase!=\"Succeeded\"}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          )\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 租户服务可用性\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">tenant:service_availability:ratio\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">|\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          sum by (tenant) (kube_deployment_status_replicas_available)\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          / sum by (tenant) (kube_deployment_spec_replicas)\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 故障影响范围\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">node:affected_tenants:count\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">|\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          count by (node) (\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            count by (node, tenant) (\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">              kube_pod_info * on(pod, namespace) group_left(tenant)\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">              kube_namespace_labels\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">            )\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">          )\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Chr class=\"js_darkmode__bg__45 js_darkmode__50\" style=\"text-align: justify;\">\u003Ch2 class=\"js_darkmode__bg__46\" style=\"text-align: center;\">\u003Cspan leaf=\"\">四、最佳实践和注意事项\u003C/span>\u003C/h2>\u003Ch3 class=\"js_darkmode__bg__47\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">4.1 最佳实践\u003C/span>\u003C/h3>\u003Ch4 class=\"js_darkmode__bg__48\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 4.1.1 Recording Rules 命名规范\u003C/span>\u003C/h4>\u003Cp class=\"js_darkmode__51\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">遵循一致的命名规范对于维护大规模 Recording Rules 至关重要：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__49 js_darkmode__52\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 命名格式：level:metric_name:aggregation_window\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># level: 聚合级别，如 instance, namespace, cluster\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># metric_name: 指标名称\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># aggregation_window: 时间窗口和聚合方式\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 好的命名示例\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">instance:node_cpu_utilization:avg5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">namespace:container_memory:\u003C/span>\u003Cspan leaf=\"\">sum\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">cluster:http_requests:rate15m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 避免的命名方式\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">cpu_high                    \u003C/span>\u003Cspan leaf=\"\"># 缺少层级和时间窗口信息\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">recording_rule_1            \u003C/span>\u003Cspan leaf=\"\"># 无意义的名称\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__50\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 4.1.2 分层设计\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__51 js_darkmode__53\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 三层架构设计\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 第一层：原始指标清洗和标准化\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">instance:node_cpu_seconds:rate5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">rate(node_cpu_seconds_total[5m])\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 第二层：指标聚合\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">instance:node_cpu_utilization:avg5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">1\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">avg\u003C/span>\u003Cspan leaf=\"\">by\u003C/span>\u003Cspan leaf=\"\">(instance)\u003C/span>\u003Cspan leaf=\"\">(instance:node_cpu_seconds:rate5m{mode=\"idle\"})\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 第三层：业务指标\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">service:availability:ratio\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">|\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    (\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">      sum(instance:node_cpu_utilization:avg5m < 0.9)\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">      / count(instance:node_cpu_utilization:avg5m)\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    )\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__52\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 4.1.3 性能优化\u003C/span>\u003C/h4>\u003Cul class=\"list-paddingleft-1 js_darkmode__54\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>控制 Recording Rules 数量\u003C/span>\u003Cspan leaf=\"\">：每增加一条规则，就会产生新的时间序列\u003C/span>\u003Cpre class=\"js_darkmode__bg__53 js_darkmode__55\">\u003Ccode>\u003Cspan leaf=\"\"># 检查 Recording Rules 产生的时序数量\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">prometheus_tsdb_head_series\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 建议：单个 Prometheus 实例的 Recording Rules 产生的时序不超过总时序的 20%\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>合理设置 interval\u003C/span>\u003Cspan leaf=\"\">：根据指标变化频率设置\u003C/span>\u003C/section>\u003C/li>\u003Cul class=\"list-paddingleft-1 js_darkmode__56\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• 基础设施指标：30s\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• 应用指标：15s\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• 业务指标：60s\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>使用 limit 防止基数爆炸\u003C/span>\u003Cspan leaf=\"\">：\u003C/span>\u003Cpre class=\"js_darkmode__bg__54 js_darkmode__57\">\u003Ccode>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">record:\u003C/span>\u003Cspan leaf=\"\">topk_services:http_requests:rate5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">expr:\u003C/span>\u003Cspan leaf=\"\">topk(100,\u003C/span>\u003Cspan leaf=\"\">sum\u003C/span>\u003Cspan leaf=\"\">by\u003C/span>\u003Cspan leaf=\"\">(service)\u003C/span>\u003Cspan leaf=\"\">(rate(http_requests_total[5m])))\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003C/section>\u003C/li>\u003C/ul>\u003Ch4 class=\"js_darkmode__bg__55\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 4.1.4 高可用配置\u003C/span>\u003C/h4>\u003Cul class=\"list-paddingleft-1 js_darkmode__58\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>多副本一致性\u003C/span>\u003Cspan leaf=\"\">：Recording Rules 在多个 Prometheus 副本上执行，确保配置完全相同\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>告警去重\u003C/span>\u003Cspan leaf=\"\">：配合 Alertmanager 的 \u003C/span>\u003Ccode>\u003Cspan leaf=\"\">group_by\u003C/span>\u003C/code>\u003Cspan leaf=\"\"> 和 \u003C/span>\u003Ccode>\u003Cspan leaf=\"\">inhibit_rules\u003C/span>\u003C/code>\u003Cspan leaf=\"\"> 进一步去重\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>联邦集群\u003C/span>\u003Cspan leaf=\"\">：在联邦架构中，Recording Rules 应该在被采集端执行，减少联邦查询压力\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Cpre class=\"js_darkmode__bg__56 js_darkmode__59\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># Alertmanager 配置配合\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">route:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">group_by:\u003C/span>\u003Cspan leaf=\"\"> [\u003C/span>\u003Cspan leaf=\"\">'alertname'\u003C/span>\u003Cspan leaf=\"\">, \u003C/span>\u003Cspan leaf=\"\">'cluster'\u003C/span>\u003Cspan leaf=\"\">, \u003C/span>\u003Cspan leaf=\"\">'service'\u003C/span>\u003Cspan leaf=\"\">]\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">group_wait:\u003C/span>\u003Cspan leaf=\"\">30s\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">group_interval:\u003C/span>\u003Cspan leaf=\"\">5m\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">repeat_interval:\u003C/span>\u003Cspan leaf=\"\">4h\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">inhibit_rules:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 节点故障时抑制该节点上的所有 Pod 告警\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan leaf=\"\">source_match:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">alertname:\u003C/span>\u003Cspan leaf=\"\">NodeDown\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">target_match_re:\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">alertname:\u003C/span>\u003Cspan leaf=\"\">Pod.*\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">equal:\u003C/span>\u003Cspan leaf=\"\"> [\u003C/span>\u003Cspan leaf=\"\">'node'\u003C/span>\u003Cspan leaf=\"\">]\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch3 class=\"js_darkmode__bg__57\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">4.2 注意事项\u003C/span>\u003C/h3>\u003Ch4 class=\"js_darkmode__bg__58\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 4.2.1 配置注意事项\u003C/span>\u003C/h4>\u003Cp class=\"js_darkmode__60\" style=\"text-align: justify;\">\u003Cspan>警告\u003C/span>\u003Cspan leaf=\"\">：Recording Rules 配置错误可能导致 Prometheus 无法启动或产生错误数据\u003C/span>\u003C/p>\u003Cul class=\"list-paddingleft-1 js_darkmode__61\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• 注意事项一：Recording Rules 的 \u003C/span>\u003Ccode>\u003Cspan leaf=\"\">record\u003C/span>\u003C/code>\u003Cspan leaf=\"\"> 字段必须是合法的指标名称，不能包含特殊字符\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• 注意事项二：避免 Recording Rules 之间的循环依赖，虽然 Prometheus 会检测，但可能导致计算延迟\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• 注意事项三：修改已有 Recording Rules 的表达式时，注意下游依赖的告警规则可能需要同步调整阈值\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Ch4 class=\"js_darkmode__bg__59\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 4.2.2 常见错误\u003C/span>\u003C/h4>\u003Ctable class=\"js_darkmode__62 layui-table\" style=\"text-align: justify;\">\u003Cthead>\u003Ctr>\u003Cth class=\"js_darkmode__bg__60\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">错误现象\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__bg__61\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">原因分析\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__bg__62\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">解决方案\u003C/span>\u003C/section>\u003C/th>\u003C/tr>\u003C/thead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"js_darkmode__63\">\u003Csection>\u003Cspan leaf=\"\">Recording Rule 显示 health: unknown\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__64\">\u003Csection>\u003Cspan leaf=\"\">表达式语法错误或引用的指标不存在\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__65\">\u003Csection>\u003Cspan leaf=\"\">使用 promtool check rules 验证语法，确认源指标存在\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr>\u003Ctd class=\"js_darkmode__66\">\u003Csection>\u003Cspan leaf=\"\">新指标无数据\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__67\">\u003Csection>\u003Cspan leaf=\"\">interval 设置过长或表达式结果为空\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__68\">\u003Csection>\u003Cspan leaf=\"\">检查 interval 配置，在 Prometheus UI 测试表达式\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr>\u003Ctd class=\"js_darkmode__69\">\u003Csection>\u003Cspan leaf=\"\">Prometheus OOM\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__70\">\u003Csection>\u003Cspan leaf=\"\">Recording Rules 产生的时序过多\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__71\">\u003Csection>\u003Cspan leaf=\"\">添加 limit、优化标签基数、增加内存\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr>\u003Ctd class=\"js_darkmode__72\">\u003Csection>\u003Cspan leaf=\"\">告警延迟增加\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__73\">\u003Csection>\u003Cspan leaf=\"\">Recording Rules 计算压力过大\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__74\">\u003Csection>\u003Cspan leaf=\"\">减少规则数量、增大 interval、升级硬件\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003C/tbody>\u003C/table>\u003Ch4 class=\"js_darkmode__bg__63\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ 4.2.3 兼容性问题\u003C/span>\u003C/h4>\u003Cul class=\"list-paddingleft-1 js_darkmode__75\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>版本兼容\u003C/span>\u003Cspan leaf=\"\">：\u003C/span>\u003Ccode>\u003Cspan leaf=\"\">limit\u003C/span>\u003C/code>\u003Cspan leaf=\"\"> 功能需要 Prometheus 2.28+，低版本需要在表达式中使用 \u003C/span>\u003Ccode>\u003Cspan leaf=\"\">topk\u003C/span>\u003C/code>\u003Cspan leaf=\"\"> 替代\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>平台兼容\u003C/span>\u003Cspan leaf=\"\">：使用 Prometheus Operator 时，Recording Rules 需要通过 PrometheusRule CRD 管理\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>组件依赖\u003C/span>\u003Cspan leaf=\"\">：Recording Rules 依赖的源指标（如 node_exporter、kube-state-metrics）版本变更可能导致表达式失效\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Chr class=\"js_darkmode__bg__64 js_darkmode__76\" style=\"text-align: justify;\">\u003Ch2 class=\"js_darkmode__bg__65\" style=\"text-align: center;\">\u003Cbr>\u003C/h2>","## 一、概述\n\n### 1.1 背景介绍\n\n在大规模微服务架构下，Prometheus 告警系统往往会陷入一个尴尬的境地：告警太多，运维团队开始选择性忽略；告警太少，真正的故障又可能漏掉。我在某电商平台负责监控体系建设时，团队每天要处理超过 2000 条告警，其中 70% 以上是重复的、关联的或者短暂抖动产生的噪声。\n\nRecording Rules 是 Prometheus 提供的预计算机制，可以将复杂的查询表达式预先计算并存储为新的时间序列。通过合理设计 Recording Rules，我们不仅能显著降低 PromQL 查询压力，更重要的是可以实现告警聚合、去重、平滑，从根本上减少告警噪声。\n\n### 1.2 技术特点\n\n- • 预计算优化：将复杂的聚合查询预先计算，避免告警规则重复计算相同的表达式，降低 Prometheus 负载\n- • 时间窗口平滑：通过 avg_over_time、max_over_time 等函数消除瞬时抖动，避免单点毛刺触发告警\n- • 多维度聚合：支持按 namespace、service、pod 等维度聚合指标，实现告警收敛\n- • 层级化告警：基于 Recording Rules 构建指标层级，实现从基础指标到业务指标的逐层抽象\n\n### 1.3 适用场景\n\n- • 场景一：大规模 Kubernetes 集群监控，Pod 数量超过 1000，原生指标产生的告警风暴需要收敛\n- • 场景二：微服务架构下，服务间依赖复杂，需要将底层告警聚合为服务级别的健康状态\n- • 场景三：业务高峰期流量抖动频繁，需要平滑处理避免误告警\n- • 场景四：多租户环境下，需要按租户/业务线聚合告警，避免一个故障触发上百条告警\n\n### 1.4 环境要求\n\n组件\n\n版本要求\n\n说明\n\nPrometheus\n\n2.28+\n\n支持 Recording Rules 分组和 limit 特性\n\nAlertmanager\n\n0.23+\n\n配合使用告警抑制和分组功能\n\nKubernetes\n\n1.21+\n\n如果使用 kube-prometheus-stack\n\n内存配置\n\n建议 8GB+\n\nRecording Rules 会增加时序存储量\n\n---\n\n## 二、详细步骤\n\n### 2.1 准备工作\n\n#### ◆ 2.1.1 现状分析\n\n在动手之前，先要搞清楚当前告警噪声的分布。我习惯用下面这个查询来分析过去一周的告警触发情况：\n\n```\n# 查看 Prometheus 配置kubectl get configmap prometheus-server -n monitoring -o yaml# 分析告警触发频次（在 Prometheus UI 执行）# 统计过去7天各告警规则触发次数count_over_time(ALERTS{alertstate=\"firing\"}[7d])# 查看当前活跃告警数量count(ALERTS{alertstate=\"firing\"})\n```\n\n#### ◆ 2.1.2 识别噪声来源\n\n根据我的经验，告警噪声主要来自以下几类：\n\n```\n# 检查高频告警（每分钟触发超过10次的规则）# 在 Prometheus 执行topk(20, count by (alertname) (count_over_time(ALERTS{alertstate=\"firing\"}[1h])))# 检查短暂告警（持续时间小于5分钟的）# 这类告警往往是抖动产生的噪声\n```\n\n通常会发现以下几类高频噪声：\n\n- • CPU/内存使用率瞬时超阈值\n- • Pod 重启计数器误报\n- • 网络延迟抖动\n- • 磁盘 IO 突增\n\n### 2.2 核心配置\n\n#### ◆ 2.2.1 Recording Rules 基础结构\n\n```\n# 文件路径：/etc/prometheus/rules/recording_rules.ymlgroups:-name:node_recording_rulesinterval:30s# 计算间隔，根据需求调整rules:# 规则定义-record:job:node_cpu_utilization:avg5mexpr:|          1 - avg by (job, instance) (            rate(node_cpu_seconds_total{mode=\"idle\"}[5m])          )\n```\n\n说明\n\n：\n`\ninterval\n`\n 参数控制 Recording Rules 的计算频率。设置过小会增加计算压力，过大则可能错过关键变化。一般建议设置为告警评估间隔的一半。\n\n#### ◆ 2.2.2 CPU 使用率平滑处理\n\n这是最常见的噪声来源。原始告警规则可能是这样的：\n\n```\n# 原始告警规则（噪声大）-alert:HighCPUUsageexpr:100-(avgby(instance)(rate(node_cpu_seconds_total{mode=\"idle\"}[1m]))*100)>80for:1m\n```\n\n使用 Recording Rules 优化后：\n\n```\n# recording_rules.ymlgroups:-name:cpu_smoothinginterval:30srules:# 第一层：5分钟平均 CPU 使用率-record:instance:node_cpu_utilization:avg5mexpr:|          1 - avg by (instance) (            rate(node_cpu_seconds_total{mode=\"idle\"}[5m])          )# 第二层：基于5分钟均值的15分钟最大值# 这样可以捕获持续性高负载，过滤掉短暂峰值-record:instance:node_cpu_utilization:max15m_avg5mexpr:|          max_over_time(instance:node_cpu_utilization:avg5m[15m])# 第三层：按集群聚合的 CPU 使用率-record:cluster:node_cpu_utilization:avgexpr:|          avg(instance:node_cpu_utilization:avg5m)\n```\n\n参数说明\n\n：\n\n- • avg5m：使用 5 分钟窗口计算平均值，消除秒级抖动\n- • max15m_avg5m：在 5 分钟均值基础上取 15 分钟最大值，只有持续性高负载才会触发\n- • cluster: 前缀：表示集群级别聚合，便于识别层级\n\n#### ◆ 2.2.3 内存使用率分层聚合\n\n```\ngroups:-name:memory_recording_rulesinterval:30srules:# 节点级别内存使用率-record:instance:node_memory_utilization:ratioexpr:|          1 - (            node_memory_MemAvailable_bytes            / node_memory_MemTotal_bytes          )# 应用级别内存使用（Kubernetes 环境）-record:namespace_pod:container_memory_usage:sumexpr:|          sum by (namespace, pod) (            container_memory_working_set_bytes{container!=\"\", container!=\"POD\"}          )# 服务级别内存使用率-record:namespace_service:memory_utilization:avg5mexpr:|          avg by (namespace, service) (            avg_over_time(              container_memory_working_set_bytes{container!=\"\"}[5m]            )          ) / avg by (namespace, service) (            kube_pod_container_resource_limits{resource=\"memory\"}          )\n```\n\n#### ◆ 2.2.4 请求错误率聚合\n\n对于微服务场景，HTTP 错误率告警是另一个噪声重灾区：\n\n```\ngroups:-name:http_error_rate_rulesinterval:15srules:# 服务级别错误率（5分钟窗口）-record:service:http_requests_total:rate5mexpr:|          sum by (namespace, service) (            rate(http_requests_total[5m])          )-record:service:http_requests_errors:rate5mexpr:|          sum by (namespace, service) (            rate(http_requests_total{status=~\"5..\"}[5m])          )# 错误率计算-record:service:http_error_rate:ratio5mexpr:|          service:http_requests_errors:rate5m          / service:http_requests_total:rate5m# 加权错误率：流量越大权重越高# 避免低流量服务的单个错误触发高错误率告警-record:service:http_error_rate:weighted5mexpr:|          (service:http_requests_errors:rate5m + 1)          / (service:http_requests_total:rate5m + 10)\n```\n\n### 2.3 启动和验证\n\n#### ◆ 2.3.1 配置热加载\n\n```\n# 检查配置语法promtool check rules /etc/prometheus/rules/recording_rules.yml# 热加载 Prometheus 配置curl -X POST http://localhost:9090/-/reload# 或者发送 SIGHUP 信号kill -HUP $(pgrep prometheus)\n```\n\n#### ◆ 2.3.2 验证 Recording Rules 生效\n\n```\n# 在 Prometheus UI 查询新生成的指标# 应该能看到数据instance:node_cpu_utilization:avg5m# 检查 Recording Rules 状态curl -s http://localhost:9090/api/v1/rules | jq '.data.groups[] | select(.name==\"cpu_smoothing\")'# 预期输出应显示规则状态为 \"health\": \"ok\"\n```\n\n---\n\n## 三、示例代码和配置\n\n### 3.1 完整配置示例\n\n#### ◆ 3.1.1 完整的 Recording Rules 配置\n\n```\n# 文件路径：/etc/prometheus/rules/recording_rules.ymlgroups:# ============ 基础设施层 ============-name:infrastructure_recording_rulesinterval:30srules:# CPU-record:instance:node_cpu_utilization:avg5mexpr:1-avgby(instance)(rate(node_cpu_seconds_total{mode=\"idle\"}[5m]))-record:instance:node_cpu_utilization:max_avg5m_over_15mexpr:max_over_time(instance:node_cpu_utilization:avg5m[15m])# Memory-record:instance:node_memory_utilization:ratioexpr:1-(node_memory_MemAvailable_bytes/node_memory_MemTotal_bytes)-record:instance:node_memory_utilization:avg5mexpr:avg_over_time(instance:node_memory_utilization:ratio[5m])# Disk-record:instance:node_disk_utilization:ratioexpr:|          1 - (            node_filesystem_avail_bytes{fstype=~\"ext4|xfs\"}            / node_filesystem_size_bytes{fstype=~\"ext4|xfs\"}          )# Network-record:instance:node_network_receive:rate5mexpr:sumby(instance)(rate(node_network_receive_bytes_total{device!~\"lo|veth.*|docker.*|br.*\"}[5m]))-record:instance:node_network_transmit:rate5mexpr:sumby(instance)(rate(node_network_transmit_bytes_total{device!~\"lo|veth.*|docker.*|br.*\"}[5m]))# ============ Kubernetes 层 ============-name:kubernetes_recording_rulesinterval:30srules:# Pod 资源使用聚合到 namespace-record:namespace:container_cpu_usage:sumexpr:|          sum by (namespace) (            rate(container_cpu_usage_seconds_total{container!=\"\", container!=\"POD\"}[5m])          )-record:namespace:container_memory_usage:sumexpr:|          sum by (namespace) (            container_memory_working_set_bytes{container!=\"\", container!=\"POD\"}          )# Pod 重启率（1小时窗口，避免单次重启告警）-record:namespace_pod:container_restarts:increase1hexpr:|          increase(kube_pod_container_status_restarts_total[1h])# Deployment 可用性-record:namespace_deployment:replicas_unavailable:ratioexpr:|          kube_deployment_status_replicas_unavailable          / kube_deployment_spec_replicas# ============ 应用层 ============-name:application_recording_rulesinterval:15srules:# HTTP 请求速率-record:service:http_requests:rate5mexpr:sumby(namespace,service,method)(rate(http_requests_total[5m]))# HTTP 错误率-record:service:http_errors:rate5mexpr:sumby(namespace,service)(rate(http_requests_total{status=~\"5..\"}[5m]))# HTTP P99 延迟-record:service:http_latency_p99:5mexpr:|          histogram_quantile(0.99,            sum by (namespace, service, le) (              rate(http_request_duration_seconds_bucket[5m])            )          )# 服务健康评分（综合指标）-record:service:health_score:5mexpr:|          (            1 - clamp_max(service:http_errors:rate5m / service:http_requests:rate5m, 1)          ) * 0.4          +          (            1 - clamp_max(service:http_latency_p99:5m / 2, 1)          ) * 0.3          +          (            clamp_max(service:http_requests:rate5m / 100, 1)          ) * 0.3\n```\n\n#### ◆ 3.1.2 基于 Recording Rules 的告警规则\n\n```\n# 文件路径：/etc/prometheus/rules/alert_rules.ymlgroups:-name:infrastructure_alertsrules:# 使用预计算指标，更稳定-alert:NodeHighCPUexpr:instance:node_cpu_utilization:max_avg5m_over_15m>0.85for:5mlabels:severity:warningannotations:summary:\"节点 {{ $labels.instance }} CPU 持续高负载\"description:\"15分钟内 CPU 使用率峰值超过 85%，当前值 {{ $value | humanizePercentage }}\"-alert:NodeHighMemoryexpr:instance:node_memory_utilization:avg5m>0.9for:10mlabels:severity:warningannotations:summary:\"节点 {{ $labels.instance }} 内存使用率过高\"description:\"内存使用率持续超过 90%\"-name:application_alertsrules:# 基于聚合指标的服务健康告警-alert:ServiceUnhealthyexpr:service:health_score:5m3for:0mlabels:severity:warningannotations:summary:\"Pod {{ $labels.namespace }}/{{ $labels.pod }} 频繁重启\"description:\"过去1小时重启 {{ $value }} 次\"\n```\n\n### 3.2 实际应用案例\n\n#### ◆ 案例一：电商大促告警收敛\n\n场景描述\n\n：双11大促期间，订单服务 QPS 从日常 1000 飙升到 50000，原有的错误率告警（错误数/总请求数 > 1%）频繁触发，因为即使错误率只有 0.5%，绝对错误数也达到了 250/秒。\n\n实现代码\n\n：\n\n```\n# Recording Rulesgroups:-name:ecommerce_rulesrules:# 动态基线：使用过去1小时的错误率作为基线-record:service:http_error_rate:baseline1hexpr:|          avg_over_time(            (              sum by (service) (rate(http_requests_total{status=~\"5..\"}[5m]))              / sum by (service) (rate(http_requests_total[5m]))            )[1h:]          )# 当前错误率与基线的比值-record:service:http_error_rate:ratio_to_baselineexpr:|          (            sum by (service) (rate(http_requests_total{status=~\"5..\"}[5m]))            / sum by (service) (rate(http_requests_total[5m]))          )          / service:http_error_rate:baseline1h# 告警规则-alert:ServiceErrorRateSpikeexpr:service:http_error_rate:ratio_to_baseline>3for:5mannotations:summary:\"服务 {{ $labels.service }} 错误率异常飙升\"description:\"当前错误率是基线的 {{ $value | humanize }} 倍\"\n```\n\n运行结果\n\n：\n\n```\n大促期间告警数量对比：- 优化前：每小时平均 150+ 条告警- 优化后：每小时平均 5-10 条告警- 误告警率：从 85% 降低到 15%\n```\n\n#### ◆ 案例二：多租户环境告警聚合\n\n场景描述\n\n：SaaS 平台有 200+ 租户，每个租户有独立的命名空间。当某个底层节点故障时，原有配置会触发 200+ 条 Pod 不可用告警。\n\n实现步骤\n\n：\n\n1. 1. 创建租户级别的聚合指标\n2. 2. 实现告警收敛，只告警受影响的节点，附带影响的租户列表\n3. 3. 配合 Alertmanager 的 group_by 实现进一步收敛\n\n```\n# Recording Rulesgroups:-name:tenant_aggregationrules:# 按租户聚合不可用 Pod 数量-record:tenant:pods_unavailable:countexpr:|          count by (tenant) (            kube_pod_status_phase{phase!=\"Running\", phase!=\"Succeeded\"}          )# 租户服务可用性-record:tenant:service_availability:ratioexpr:|          sum by (tenant) (kube_deployment_status_replicas_available)          / sum by (tenant) (kube_deployment_spec_replicas)# 故障影响范围-record:node:affected_tenants:countexpr:|          count by (node) (            count by (node, tenant) (              kube_pod_info * on(pod, namespace) group_left(tenant)              kube_namespace_labels            )          )\n```\n\n---\n\n## 四、最佳实践和注意事项\n\n### 4.1 最佳实践\n\n#### ◆ 4.1.1 Recording Rules 命名规范\n\n遵循一致的命名规范对于维护大规模 Recording Rules 至关重要：\n\n```\n# 命名格式：level:metric_name:aggregation_window# level: 聚合级别，如 instance, namespace, cluster# metric_name: 指标名称# aggregation_window: 时间窗口和聚合方式# 好的命名示例instance:node_cpu_utilization:avg5mnamespace:container_memory:sumcluster:http_requests:rate15m# 避免的命名方式cpu_high                    # 缺少层级和时间窗口信息recording_rule_1            # 无意义的名称\n```\n\n#### ◆ 4.1.2 分层设计\n\n```\n# 三层架构设计# 第一层：原始指标清洗和标准化-record:instance:node_cpu_seconds:rate5mexpr:rate(node_cpu_seconds_total[5m])# 第二层：指标聚合-record:instance:node_cpu_utilization:avg5mexpr:1-avgby(instance)(instance:node_cpu_seconds:rate5m{mode=\"idle\"})# 第三层：业务指标-record:service:availability:ratioexpr:|    (      sum(instance:node_cpu_utilization:avg5m \u003C 0.9)      / count(instance:node_cpu_utilization:avg5m)    )\n```\n\n#### ◆ 4.1.3 性能优化\n\n- • 控制 Recording Rules 数量：每增加一条规则，就会产生新的时间序列\n```\n# 检查 Recording Rules 产生的时序数量prometheus_tsdb_head_series# 建议：单个 Prometheus 实例的 Recording Rules 产生的时序不超过总时序的 20%\n```\n- • 合理设置 interval：根据指标变化频率设置\n- • 基础设施指标：30s\n- • 应用指标：15s\n- • 业务指标：60s\n\n• \n\n使用 limit 防止基数爆炸\n\n：\n\n```\n-record:topk_services:http_requests:rate5mexpr:topk(100,sumby(service)(rate(http_requests_total[5m])))\n```\n\n#### ◆ 4.1.4 高可用配置\n\n- • 多副本一致性：Recording Rules 在多个 Prometheus 副本上执行，确保配置完全相同\n- • 告警去重：配合 Alertmanager 的 group_by 和 inhibit_rules 进一步去重\n- • 联邦集群：在联邦架构中，Recording Rules 应该在被采集端执行，减少联邦查询压力\n\n```\n# Alertmanager 配置配合route:group_by: ['alertname', 'cluster', 'service']group_wait:30sgroup_interval:5mrepeat_interval:4hinhibit_rules:# 节点故障时抑制该节点上的所有 Pod 告警-source_match:alertname:NodeDowntarget_match_re:alertname:Pod.*equal: ['node']\n```\n\n### 4.2 注意事项\n\n#### ◆ 4.2.1 配置注意事项\n\n警告\n\n：Recording Rules 配置错误可能导致 Prometheus 无法启动或产生错误数据\n\n- • 注意事项一：Recording Rules 的 record 字段必须是合法的指标名称，不能包含特殊字符\n- • 注意事项二：避免 Recording Rules 之间的循环依赖，虽然 Prometheus 会检测，但可能导致计算延迟\n- • 注意事项三：修改已有 Recording Rules 的表达式时，注意下游依赖的告警规则可能需要同步调整阈值\n\n#### ◆ 4.2.2 常见错误\n\n错误现象\n\n原因分析\n\n解决方案\n\nRecording Rule 显示 health: unknown\n\n表达式语法错误或引用的指标不存在\n\n使用 promtool check rules 验证语法，确认源指标存在\n\n新指标无数据\n\ninterval 设置过长或表达式结果为空\n\n检查 interval 配置，在 Prometheus UI 测试表达式\n\nPrometheus OOM\n\nRecording Rules 产生的时序过多\n\n添加 limit、优化标签基数、增加内存\n\n告警延迟增加\n\nRecording Rules 计算压力过大\n\n减少规则数量、增大 interval、升级硬件\n\n#### ◆ 4.2.3 兼容性问题\n\n- • 版本兼容：limit 功能需要 Prometheus 2.28+，低版本需要在表达式中使用 topk 替代\n- • 平台兼容：使用 Prometheus Operator 时，Recording Rules 需要通过 PrometheusRule CRD 管理\n- • 组件依赖：Recording Rules 依赖的源指标（如 node_exporter、kube-state-metrics）版本变更可能导致表达式失效\n\n---\n\n##","/article/119",301,"2026-01-06 11:51:58","2026-01-06 11:53:45",{"id":334,"category_id":44,"title":335,"keywords":6,"description":336,"image_url":6,"content":337,"content_md":338,"url":339,"hits":340,"is_recommend":73,"is_top":73,"create_time":341,"update_time":342},118,"GitOps 落地实践：ArgoCD + Kustomize 实现声明式基础设施管理(二)","四、最佳实践和注意事项4.1 最佳实践4.1.1 性能优化优化点一：减少 Git 轮询频率# argocd-cm ConfigMapapiVersion: v1kind: ConfigMapmetadata:  name: argocd-cm  namespace: argocddata:  timeout.reconciliation: 300s  # 默认 180","\u003Ch2 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__224\">\u003Cspan leaf=\"\">四、最佳实践和注意事项\u003C/span>\u003C/span>\u003C/h2>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__225\">\u003Cspan leaf=\"\">4.1 最佳实践\u003C/span>\u003C/span>\u003C/h3>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__226\">\u003Cspan leaf=\"\">4.1.1 性能优化\u003C/span>\u003C/span>\u003C/h4>\u003Cul class=\"list-paddingleft-1 js_darkmode__227\">\u003Cli>\u003Csection class=\"js_darkmode__228\">\u003Cp class=\"js_darkmode__229\">\u003Cstrong class=\"js_darkmode__230\">优化点一：减少 Git 轮询频率\u003C/strong>\u003C/p>\u003Cpre class=\"js_darkmode__231\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__20 js_darkmode__232\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__233\">\u003Cspan class=\"js_darkmode__234\"># argocd-cm ConfigMap\u003C/span>\u003Cbr>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>v1\u003C/span>\u003Cbr>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>ConfigMap\u003C/span>\u003Cbr>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd-cm\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd\u003C/span>\u003Cbr>\u003Cspan>data:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>timeout.reconciliation:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>300s\u003C/span>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan class=\"js_darkmode__235\"># 默认 180s，大规模集群建议 300s+\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>timeout.reconciliation.jitter:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>30s\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__236\">\u003Cspan leaf=\"\">说明：默认每 3 分钟轮询一次 Git 仓库，大规模部署建议延长间隔并配置 Webhook 实现事件驱动同步。\u003C/span>\u003C/p>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__237\">\u003Cp class=\"js_darkmode__238\">\u003Cstrong class=\"js_darkmode__239\">优化点二：启用资源缓存\u003C/strong>\u003C/p>\u003Cpre class=\"js_darkmode__240\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__21 js_darkmode__241\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__242\">\u003Cspan class=\"js_darkmode__243\"># 编辑 argocd-application-controller StatefulSet\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl edit statefulset argocd-application-controller -n argocd\u003C/span>\u003Cbr>\u003Cspan class=\"js_darkmode__244\"># 添加环境变量\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">env:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">- name: ARGOCD_APPLICATION_CONTROLLER_REPLICAS\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  value: \u003C/span>\u003Cspan>\"3\"\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">- name: ARGOCD_APPLICATION_CONTROLLER_SHARD\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  valueFrom:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    fieldRef:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      fieldPath: metadata.name\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003C/section>\u003C/li>\u003Cul class=\"list-paddingleft-1 js_darkmode__245\">\u003Cli>\u003Csection class=\"js_darkmode__246\">\u003Cspan leaf=\"\">配置 Redis HA 提升缓存性能\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__247\">\u003Cspan leaf=\"\">启用 Application Controller 分片（处理 1000+ Application）\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Cli>\u003Csection class=\"js_darkmode__248\">\u003Cp class=\"js_darkmode__249\">\u003Cstrong class=\"js_darkmode__250\">优化点三：优化 Diff 计算\u003C/strong>\u003C/p>\u003Cpre class=\"js_darkmode__251\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__22 js_darkmode__252\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__253\">\u003Cspan class=\"js_darkmode__254\"># Application 配置\u003C/span>\u003Cbr>\u003Cspan>spec:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>ignoreDifferences:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>group:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>apps\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Deployment\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>jsonPointers:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>/spec/replicas\u003C/span>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan class=\"js_darkmode__255\"># 忽略 HPA 自动调整的副本数\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>group:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\"\"\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Secret\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>jsonPointers:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>/data\u003C/span>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan class=\"js_darkmode__256\"># 忽略 External Secrets Operator 动态更新\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003C/section>\u003C/li>\u003C/ul>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__257\">\u003Cspan leaf=\"\">4.1.2 安全加固\u003C/span>\u003C/span>\u003C/h4>\u003Cul class=\"list-paddingleft-1 js_darkmode__258\">\u003Cli>\u003Csection class=\"js_darkmode__259\">\u003Cp class=\"js_darkmode__260\">\u003Cstrong class=\"js_darkmode__261\">安全措施一：限制资源权限\u003C/strong>\u003C/p>\u003Cpre class=\"js_darkmode__262\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__23 js_darkmode__263\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__264\">\u003Cspan class=\"js_darkmode__265\"># AppProject 白名单机制\u003C/span>\u003Cbr>\u003Cspan>spec:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>clusterResourceWhitelist:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>group:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>''\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Namespace\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>clusterResourceBlacklist:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>group:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>''\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>ResourceQuota\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>group:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>'rbac.authorization.k8s.io'\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>ClusterRole\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__266\">\u003Cspan leaf=\"\">说明：禁止应用创建 ClusterRole、PersistentVolume 等集群级资源，防止权限提升。\u003C/span>\u003C/p>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__267\">\u003Cp class=\"js_darkmode__268\">\u003Cstrong class=\"js_darkmode__269\">安全措施二：启用 Admission Webhook\u003C/strong>\u003C/p>\u003Cpre class=\"js_darkmode__270\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__24 js_darkmode__271\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__272\">\u003Cspan class=\"js_darkmode__273\"># argocd-cm ConfigMap\u003C/span>\u003Cbr>\u003Cspan>data:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>resource.customizations:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">|\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    admissionregistration.k8s.io/MutatingWebhookConfiguration:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      health.lua: |\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        hs = {}\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        hs.status = \"Healthy\"\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        return hs\u003C/span>\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__274\">\u003Cspan leaf=\"\">配合 OPA Gatekeeper 或 Kyverno 实现策略即代码，拦截不合规资源。\u003C/span>\u003C/p>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__275\">\u003Cp class=\"js_darkmode__276\">\u003Cstrong class=\"js_darkmode__277\">安全措施三：Git 签名验证\u003C/strong>\u003C/p>\u003Cpre class=\"js_darkmode__278\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__25 js_darkmode__279\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__280\">\u003Cspan class=\"js_darkmode__281\"># 启用 GPG 签名验证\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd repo add https://github.com/your-org/your-repo.git \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  --username git \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  --password \u003C/span>\u003Cspan>$TOKEN\u003C/span>\u003Cspan leaf=\"\"> \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  --\u003C/span>\u003Cspan>enable\u003C/span>\u003Cspan leaf=\"\">-lfs \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  --gpg-key-id 0x1234567890ABCDEF\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003C/section>\u003C/li>\u003C/ul>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__282\">\u003Cspan leaf=\"\">4.1.3 高可用配置\u003C/span>\u003C/span>\u003C/h4>\u003Cul class=\"list-paddingleft-1 js_darkmode__283\">\u003Cli>\u003Csection class=\"js_darkmode__284\">\u003Cp class=\"js_darkmode__285\">\u003Cstrong class=\"js_darkmode__286\">HA方案一：组件多副本部署\u003C/strong>\u003C/p>\u003Cpre class=\"js_darkmode__287\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__26 js_darkmode__288\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__289\">\u003Cspan class=\"js_darkmode__290\"># argocd-server 副本数调整\u003C/span>\u003Cbr>\u003Cspan>kubectl\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>scale\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>deployment\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd-server\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>-n\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>--replicas=3\u003C/span>\u003Cbr>\u003Cspan>kubectl\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>scale\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>deployment\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd-repo-server\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>-n\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>--replicas=3\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__291\"># Application Controller 使用 StatefulSet，启用分片\u003C/span>\u003Cbr>\u003Cspan>kubectl\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>scale\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>statefulset\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd-application-controller\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>-n\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>--replicas=3\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__292\">\u003Cp class=\"js_darkmode__293\">\u003Cstrong class=\"js_darkmode__294\">HA方案二：Redis Sentinel 部署\u003C/strong>\u003C/p>\u003Cpre class=\"js_darkmode__295\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__27 js_darkmode__296\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__297\">\u003Cspan class=\"js_darkmode__298\"># 使用 Redis HA 替代单实例 Redis\u003C/span>\u003Cbr>\u003Cspan class=\"js_darkmode__299\"># 安装 Redis Sentinel\u003C/span>\u003Cbr>\u003Cspan>kubectl\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>apply\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>-n\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>-f\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/ha/redis-ha/redis-ha.yaml\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__300\">\u003Cp class=\"js_darkmode__301\">\u003Cstrong class=\"js_darkmode__302\">备份策略\u003C/strong>\u003Cspan leaf=\"\">：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__303\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__28 js_darkmode__304\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__305\">\u003Cspan>#!/bin/bash\u003C/span>\u003Cbr>\u003Cspan class=\"js_darkmode__306\"># 备份所有 Application 定义\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl get applications -n argocd -o yaml > applications-backup.yaml\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__307\"># 备份所有 AppProject 定义\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl get appprojects -n argocd -o yaml > appprojects-backup.yaml\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__308\"># 备份配置\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl get cm argocd-cm argocd-rbac-cm argocd-cmd-params-cm -n argocd -o yaml > argocd-config-backup.yaml\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003C/section>\u003C/li>\u003C/ul>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__309\">\u003Cspan leaf=\"\">4.2 注意事项\u003C/span>\u003C/span>\u003C/h3>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__310\">\u003Cspan leaf=\"\">4.2.1 配置注意事项\u003C/span>\u003C/span>\u003C/h4>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__311\">\u003Cspan leaf=\"\">⚠️ \u003C/span>\u003Cstrong class=\"js_darkmode__312\">警告\u003C/strong>\u003Cspan leaf=\"\">：生产环境必须禁用 admin 账户，强制使用 SSO 认证，所有操作可追溯到个人账户。\u003C/span>\u003C/p>\u003Cul class=\"list-paddingleft-1 js_darkmode__313\">\u003Cli>\u003Csection class=\"js_darkmode__314\">\u003Cspan leaf=\"\">❗ 注意事项一：syncPolicy.automated 慎用于生产环境，建议仅对基础设施组件启用自动同步，业务应用采用手动审批\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__315\">\u003Cspan leaf=\"\">❗ 注意事项二：prune 和 selfHeal 同时启用可能导致误删资源，务必配置 ignoreDifferences 排除动态字段\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__316\">\u003Cspan leaf=\"\">❗ 注意事项三：Kustomize 的 namespace 字段会覆盖所有资源的 namespace，使用 overlay 时需注意命名空间冲突\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__317\">\u003Cspan leaf=\"\">4.2.2 常见错误\u003C/span>\u003C/span>\u003C/h4>\u003Csection data-tool=\"mdnice编辑器\">\u003Ctable class=\"layui-table\">\u003Cthead>\u003Ctr>\u003Cth class=\"js_darkmode__318\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">错误现象\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__319\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">原因分析\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__320\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">解决方案\u003C/span>\u003C/section>\u003C/th>\u003C/tr>\u003C/thead>\u003Ctbody>\u003Ctr class=\"js_darkmode__321\">\u003Ctd class=\"js_darkmode__322\">\u003Csection>\u003Cspan leaf=\"\">ComparisonError: failed to unmarshal\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__323\">\u003Csection>\u003Cspan leaf=\"\">Kustomize 构建失败，语法错误\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__324\">\u003Csection>\u003Cspan leaf=\"\">本地执行 \u003C/span>\u003Ccode>kubectl kustomize overlays/prod\u003C/code>\u003Cspan leaf=\"\"> 验证配置\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__325\">\u003Ctd class=\"js_darkmode__326\">\u003Csection>\u003Cspan leaf=\"\">SyncFailed: PermissionDenied\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__327\">\u003Csection>\u003Cspan leaf=\"\">ServiceAccount 权限不足\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__328\">\u003Csection>\u003Cspan leaf=\"\">检查 AppProject 的 clusterResourceWhitelist 配置\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__329\">\u003Ctd class=\"js_darkmode__330\">\u003Csection>\u003Cspan leaf=\"\">OutOfSync 但实际已同步\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__331\">\u003Csection>\u003Cspan leaf=\"\">ignoreDifferences 配置不当\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__332\">\u003Csection>\u003Cspan leaf=\"\">添加动态字段到 ignoreDifferences 列表\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__333\">\u003Ctd class=\"js_darkmode__334\">\u003Csection>\u003Cspan leaf=\"\">Health status: Progressing\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__335\">\u003Csection>\u003Cspan leaf=\"\">资源健康检查超时\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__336\">\u003Csection>\u003Cspan leaf=\"\">检查 Pod 日志，调整 health check 参数\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__337\">\u003Ctd class=\"js_darkmode__338\">\u003Csection>\u003Cspan leaf=\"\">Webhook trigger failed\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__339\">\u003Csection>\u003Cspan leaf=\"\">Webhook Secret 不匹配\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__340\">\u003Csection>\u003Cspan leaf=\"\">重新生成 Webhook URL，更新 Git 仓库配置\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003C/tbody>\u003C/table>\u003C/section>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__341\">\u003Cspan leaf=\"\">4.2.3 兼容性问题\u003C/span>\u003C/span>\u003C/h4>\u003Cul class=\"list-paddingleft-1 js_darkmode__342\">\u003Cli>\u003Csection class=\"js_darkmode__343\">\u003Cstrong class=\"js_darkmode__344\">版本兼容\u003C/strong>\u003Cspan leaf=\"\">：ArgoCD 2.9+ 要求 Kubernetes 1.24+，使用旧版 K8s 需安装 ArgoCD 2.7 LTS\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__345\">\u003Cstrong class=\"js_darkmode__346\">平台兼容\u003C/strong>\u003Cspan leaf=\"\">：Helm Chart 需启用 \u003C/span>\u003Ccode class=\"js_darkmode__347\">\u003Cspan leaf=\"\">--enable-helm\u003C/span>\u003C/code>\u003Cspan leaf=\"\">，Jsonnet 需安装 \u003C/span>\u003Ccode class=\"js_darkmode__348\">\u003Cspan leaf=\"\">argocd-jsonnet\u003C/span>\u003C/code>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__349\">\u003Cstrong class=\"js_darkmode__350\">组件依赖\u003C/strong>\u003Cspan leaf=\"\">：Kustomize 版本与 kubectl 绑定，使用高级特性（replacements）需确保 Kustomize 5.0+\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Chr class=\"js_darkmode__351\">\u003Ch2 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__352\">\u003Cspan leaf=\"\">五、故障排查和监控\u003C/span>\u003C/span>\u003C/h2>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__353\">\u003Cspan leaf=\"\">5.1 故障排查\u003C/span>\u003C/span>\u003C/h3>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__354\">\u003Cspan leaf=\"\">5.1.1 日志查看\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__355\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__29 js_darkmode__356\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__357\">\u003Cspan class=\"js_darkmode__358\"># 查看 Application Controller 日志（核心组件）\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl logs -n argocd deployment/argocd-application-controller --tail=100 -f\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__359\"># 查看 Repo Server 日志（Git 拉取和 Kustomize 构建）\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl logs -n argocd deployment/argocd-repo-server --tail=100 -f\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__360\"># 查看 Server 日志（API 请求）\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl logs -n argocd deployment/argocd-server --tail=100 -f\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__361\"># 查看特定 Application 的同步日志\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app logs myapp --follow\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__362\"># 查看详细错误信息\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl describe application myapp -n argocd\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__363\">\u003Cspan leaf=\"\">5.1.2 常见问题排查\u003C/span>\u003C/span>\u003C/h4>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__364\">\u003Cstrong class=\"js_darkmode__365\">问题一：Git 仓库连接失败\u003C/strong>\u003C/p>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__366\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__30 js_darkmode__367\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__368\">\u003Cspan class=\"js_darkmode__369\"># 诊断命令\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd repo list\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl get secret -n argocd -l argocd.argoproj.io/secret-type=repository\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__370\"># 测试 Git 连接\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl \u003C/span>\u003Cspan>exec\u003C/span>\u003Cspan leaf=\"\"> -it deployment/argocd-repo-server -n argocd -- sh\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">git ls-remote https://github.com/your-org/your-repo.git\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__371\">\u003Cstrong class=\"js_darkmode__372\">解决方案\u003C/strong>\u003Cspan leaf=\"\">：\u003C/span>\u003C/p>\u003Col class=\"list-paddingleft-1 js_darkmode__373\">\u003Cli>\u003Csection class=\"js_darkmode__374\">\u003Cspan leaf=\"\">检查凭证是否过期（PAT、SSH Key）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__375\">\u003Cspan leaf=\"\">验证网络连通性（代理、防火墙）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__376\">\u003Cspan leaf=\"\">查看 Repo Server 日志确认具体错误\u003C/span>\u003C/section>\u003C/li>\u003C/ol>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__377\">\u003Cstrong class=\"js_darkmode__378\">问题二：Application 一直处于 Progressing 状态\u003C/strong>\u003C/p>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__379\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__31 js_darkmode__380\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__381\">\u003Cspan class=\"js_darkmode__382\"># 诊断命令\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app get myapp --refresh\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl get pods -n myapp -o wide\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl describe pod <pod-name> -n myapp\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__383\">\u003Cstrong class=\"js_darkmode__384\">解决方案\u003C/strong>\u003Cspan leaf=\"\">：\u003C/span>\u003C/p>\u003Col class=\"list-paddingleft-1 js_darkmode__385\">\u003Cli>\u003Csection class=\"js_darkmode__386\">\u003Cspan leaf=\"\">检查 Pod 事件（镜像拉取失败、资源不足）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__387\">\u003Cspan leaf=\"\">验证健康检查配置（存活探针、就绪探针）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__388\">\u003Cspan leaf=\"\">调整 Application 的健康检查超时时间\u003C/span>\u003C/section>\u003C/li>\u003C/ol>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__389\">\u003Cstrong class=\"js_darkmode__390\">问题三：Kustomize 构建失败\u003C/strong>\u003C/p>\u003Cul class=\"list-paddingleft-1 js_darkmode__391\">\u003Cli>\u003Csection class=\"js_darkmode__392\">\u003Cp class=\"js_darkmode__393\">\u003Cstrong class=\"js_darkmode__394\">症状\u003C/strong>\u003Cspan leaf=\"\">：Application 状态显示 ComparisonError\u003C/span>\u003C/p>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__395\">\u003Cp class=\"js_darkmode__396\">\u003Cstrong class=\"js_darkmode__397\">排查\u003C/strong>\u003Cspan leaf=\"\">：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__398\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__32 js_darkmode__399\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__400\">\u003Cspan class=\"js_darkmode__401\"># 本地复现问题\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">git \u003C/span>\u003Cspan>clone\u003C/span>\u003Cspan leaf=\"\"> <repo-url>\u003C/span>\u003Cbr>\u003Cspan>cd\u003C/span>\u003Cspan leaf=\"\"> overlays/prod\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl kustomize . --\u003C/span>\u003Cspan>enable\u003C/span>\u003Cspan leaf=\"\">-helm\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__402\">\u003Cp class=\"js_darkmode__403\">\u003Cstrong class=\"js_darkmode__404\">解决\u003C/strong>\u003Cspan leaf=\"\">：修复 kustomization.yaml 语法错误，验证资源引用路径\u003C/span>\u003C/p>\u003C/section>\u003C/li>\u003C/ul>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__405\">\u003Cspan leaf=\"\">5.1.3 调试模式\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__406\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__33 js_darkmode__407\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__408\">\u003Cspan class=\"js_darkmode__409\"># 开启 Application Controller 调试日志\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl \u003C/span>\u003Cspan>set\u003C/span>\u003Cspan leaf=\"\"> env deployment/argocd-application-controller \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  -n argocd \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  ARGOCD_LOG_LEVEL=debug\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__410\"># 开启 Repo Server 详细日志\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl \u003C/span>\u003Cspan>set\u003C/span>\u003Cspan leaf=\"\"> env deployment/argocd-repo-server \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  -n argocd \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  ARGOCD_LOG_LEVEL=debug \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  ARGOCD_EXEC_TIMEOUT=180s\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__411\"># 禁用缓存强制重新构建\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app get myapp --hard-refresh\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__412\">\u003Cspan leaf=\"\">5.2 性能监控\u003C/span>\u003C/span>\u003C/h3>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__413\">\u003Cspan leaf=\"\">5.2.1 关键指标监控\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__414\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__34 js_darkmode__415\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__416\">\u003Cspan class=\"js_darkmode__417\"># Application 同步时长\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app list -o json | jq \u003C/span>\u003Cspan>'.[] | {name: .metadata.name, syncTime: .status.operationState.finishedAt}'\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__418\"># Repo Server CPU/内存使用\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl top pod -n argocd -l app.kubernetes.io/name=argocd-repo-server\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__419\"># Application Controller 处理队列长度\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl logs -n argocd deployment/argocd-application-controller | grep \u003C/span>\u003Cspan>\"app reconciliation\"\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__420\"># Redis 连接数\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl \u003C/span>\u003Cspan>exec\u003C/span>\u003Cspan leaf=\"\"> -n argocd deployment/argocd-redis -- redis-cli info clients\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__421\">\u003Cspan leaf=\"\">5.2.2 监控指标说明\u003C/span>\u003C/span>\u003C/h4>\u003Csection data-tool=\"mdnice编辑器\">\u003Ctable class=\"layui-table\">\u003Cthead>\u003Ctr>\u003Cth class=\"js_darkmode__422\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">指标名称\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__423\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">正常范围\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__424\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">告警阈值\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__425\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">说明\u003C/span>\u003C/section>\u003C/th>\u003C/tr>\u003C/thead>\u003Ctbody>\u003Ctr class=\"js_darkmode__426\">\u003Ctd class=\"js_darkmode__427\">\u003Csection>\u003Cspan leaf=\"\">argocd_app_sync_total\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__428\">\u003Csection>\u003Cspan leaf=\"\">-\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__429\">\u003Csection>\u003Cspan leaf=\"\">失败率 >5%\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__430\">\u003Csection>\u003Cspan leaf=\"\">同步成功率，区分成功/失败\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__431\">\u003Ctd class=\"js_darkmode__432\">\u003Csection>\u003Cspan leaf=\"\">argocd_app_reconcile_duration\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__433\">\u003Csection>\u003Cspan leaf=\"\"><30s\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__434\">\u003Csection>\u003Cspan leaf=\"\">>60s\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__435\">\u003Csection>\u003Cspan leaf=\"\">应用对账耗时，反映性能瓶颈\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__436\">\u003Ctd class=\"js_darkmode__437\">\u003Csection>\u003Cspan leaf=\"\">argocd_git_request_duration\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__438\">\u003Csection>\u003Cspan leaf=\"\"><5s\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__439\">\u003Csection>\u003Cspan leaf=\"\">>15s\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__440\">\u003Csection>\u003Cspan leaf=\"\">Git 操作耗时，检测网络问题\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__441\">\u003Ctd class=\"js_darkmode__442\">\u003Csection>\u003Cspan leaf=\"\">argocd_kubectl_exec_pending\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__443\">\u003Csection>\u003Cspan leaf=\"\"><10\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__444\">\u003Csection>\u003Cspan leaf=\"\">>50\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__445\">\u003Csection>\u003Cspan leaf=\"\">kubectl 执行队列长度\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__446\">\u003Ctd class=\"js_darkmode__447\">\u003Csection>\u003Cspan leaf=\"\">argocd_redis_request_total\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__448\">\u003Csection>\u003Cspan leaf=\"\">-\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__449\">\u003Csection>\u003Cspan leaf=\"\">错误率 >1%\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__450\">\u003Csection>\u003Cspan leaf=\"\">Redis 请求统计\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003C/tbody>\u003C/table>\u003C/section>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__451\">\u003Cspan leaf=\"\">5.2.3 监控告警配置\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__452\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__35 js_darkmode__453\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__454\">\u003Cspan class=\"js_darkmode__455\"># Prometheus PrometheusRule\u003C/span>\u003Cbr>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>monitoring.coreos.com/v1\u003C/span>\u003Cbr>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>PrometheusRule\u003C/span>\u003Cbr>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd-alerts\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd\u003C/span>\u003Cbr>\u003Cspan>spec:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>groups:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>interval:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>30s\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>rules:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>alert:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>ArgoCDAppSyncFailed\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>expr:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">|\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        sum(increase(argocd_app_sync_total{phase=\"Failed\"}[5m])) > 3\u003C/span>\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>for:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>5m\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>labels:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>severity:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>warning\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>annotations:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>summary:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\"ArgoCD Application 同步失败过多\"\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>description:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">\"Application \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">{{ $labels.name }}\u003C/span>\u003C/span>\u003Cspan leaf=\"\"> 同步失败次数 \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">{{ $value }}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">\"\u003C/span>\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>alert:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>ArgoCDAppOutOfSync\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>expr:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">|\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        argocd_app_info{sync_status=\"OutOfSync\"} == 1\u003C/span>\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>for:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>10m\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>labels:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>severity:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>warning\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>annotations:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>summary:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\"Application 长时间未同步\"\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>description:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">\"\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">{{ $labels.name }}\u003C/span>\u003C/span>\u003Cspan leaf=\"\"> 已超过 10 分钟未同步\"\u003C/span>\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>alert:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>ArgoCDRepoServerDown\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>expr:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">|\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        up{job=\"argocd-repo-server\"} == 0\u003C/span>\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>for:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>2m\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>labels:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>severity:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>critical\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>annotations:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>summary:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\"ArgoCD Repo Server 不可用\"\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__456\">\u003Cspan leaf=\"\">5.3 备份与恢复\u003C/span>\u003C/span>\u003C/h3>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__457\">\u003Cspan leaf=\"\">5.3.1 备份策略\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__458\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__36 js_darkmode__459\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__460\">\u003Cspan>#!/bin/bash\u003C/span>\u003Cbr>\u003Cspan class=\"js_darkmode__461\"># 文件名：argocd-backup.sh\u003C/span>\u003Cbr>\u003Cspan class=\"js_darkmode__462\"># 功能：备份 ArgoCD 所有配置\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan leaf=\"\">BACKUP_DIR=\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">\"/backup/argocd/\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">$(date +%Y%m%d)\u003C/span>\u003C/span>\u003Cspan leaf=\"\">\"\u003C/span>\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">mkdir -p \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">\"\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">${BACKUP_DIR}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">\"\u003C/span>\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__463\"># 备份 Application\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl get applications -n argocd -o yaml > \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">\"\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">${BACKUP_DIR}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">/applications.yaml\"\u003C/span>\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__464\"># 备份 AppProject\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl get appprojects -n argocd -o yaml > \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">\"\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">${BACKUP_DIR}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">/appprojects.yaml\"\u003C/span>\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__465\"># 备份 ApplicationSet\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl get applicationsets -n argocd -o yaml > \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">\"\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">${BACKUP_DIR}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">/applicationsets.yaml\"\u003C/span>\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__466\"># 备份配置 ConfigMap\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl get cm -n argocd argocd-cm argocd-rbac-cm argocd-cmd-params-cm -o yaml > \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">\"\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">${BACKUP_DIR}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">/configmaps.yaml\"\u003C/span>\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__467\"># 备份 Secret（不含敏感数据）\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl get secrets -n argocd -l argocd.argoproj.io/secret-type -o yaml > \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">\"\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">${BACKUP_DIR}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">/secrets.yaml\"\u003C/span>\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__468\"># 备份到远程存储\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">tar -czf \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">\"\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">${BACKUP_DIR}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">.tar.gz\"\u003C/span>\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">\"\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">${BACKUP_DIR}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">\"\u003C/span>\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">aws s3 cp \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">\"\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">${BACKUP_DIR}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">.tar.gz\"\u003C/span>\u003C/span>\u003Cspan leaf=\"\"> s3://backups/argocd/\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__469\"># 清理 7 天前的备份\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">find /backup/argocd -name \u003C/span>\u003Cspan>\"*.tar.gz\"\u003C/span>\u003Cspan leaf=\"\"> -mtime +7 -delete\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>echo\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">\"Backup completed: \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">${BACKUP_DIR}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">.tar.gz\"\u003C/span>\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__470\">\u003Cspan leaf=\"\">5.3.2 恢复流程\u003C/span>\u003C/span>\u003C/h4>\u003Col class=\"list-paddingleft-1 js_darkmode__471\">\u003Cli>\u003Csection class=\"js_darkmode__472\">\u003Cstrong class=\"js_darkmode__473\">停止 ArgoCD 同步\u003C/strong>\u003C/section>\u003C/li>\u003C/ol>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__474\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__37 js_darkmode__475\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__476\">\u003Cspan class=\"js_darkmode__477\"># 暂停所有 Application 自动同步\u003C/span>\u003Cbr>\u003Cspan>for\u003C/span>\u003Cspan leaf=\"\"> app \u003C/span>\u003Cspan>in\u003C/span>\u003Cspan leaf=\"\"> $(argocd app list -o name); \u003C/span>\u003Cspan>do\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  argocd app \u003C/span>\u003Cspan>set\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>$app\u003C/span>\u003Cspan leaf=\"\"> --sync-policy none\u003C/span>\u003Cbr>\u003Cspan>done\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Col class=\"list-paddingleft-1 js_darkmode__478\" start=\"2\">\u003Cli>\u003Csection class=\"js_darkmode__479\">\u003Cstrong class=\"js_darkmode__480\">恢复配置\u003C/strong>\u003C/section>\u003C/li>\u003C/ol>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__481\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__38 js_darkmode__482\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__483\">\u003Cspan class=\"js_darkmode__484\"># 解压备份\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">tar -xzf /backup/argocd/20240315.tar.gz -C /tmp\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__485\"># 恢复 AppProject\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl apply -f /tmp/20240315/appprojects.yaml\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__486\"># 恢复 Application\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl apply -f /tmp/20240315/applications.yaml\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__487\"># 恢复配置\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl apply -f /tmp/20240315/configmaps.yaml\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Col class=\"list-paddingleft-1 js_darkmode__488\" start=\"3\">\u003Cli>\u003Csection class=\"js_darkmode__489\">\u003Cstrong class=\"js_darkmode__490\">验证恢复\u003C/strong>\u003C/section>\u003C/li>\u003C/ol>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__491\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__39 js_darkmode__492\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__493\">\u003Cspan class=\"js_darkmode__494\"># 检查 Application 状态\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app list\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__495\"># 触发同步验证\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app sync --dry-run guestbook\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Col class=\"list-paddingleft-1 js_darkmode__496\" start=\"4\">\u003Cli>\u003Csection class=\"js_darkmode__497\">\u003Cstrong class=\"js_darkmode__498\">重启服务\u003C/strong>\u003C/section>\u003C/li>\u003C/ol>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__499\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__40 js_darkmode__500\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__501\">\u003Cspan class=\"js_darkmode__502\"># 重启 ArgoCD 组件\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl rollout restart deployment -n argocd argocd-server\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl rollout restart deployment -n argocd argocd-repo-server\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl rollout restart statefulset -n argocd argocd-application-controller\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Chr class=\"js_darkmode__503\">\u003Ch2 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__504\">\u003Cspan leaf=\"\">六、总结\u003C/span>\u003C/span>\u003C/h2>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__505\">\u003Cspan leaf=\"\">6.1 技术要点回顾\u003C/span>\u003C/span>\u003C/h3>\u003Cul class=\"list-paddingleft-1 js_darkmode__506\">\u003Cli>\u003Csection class=\"js_darkmode__507\">\u003Cspan leaf=\"\">✅ \u003C/span>\u003Cstrong class=\"js_darkmode__508\">GitOps 核心价值\u003C/strong>\u003Cspan leaf=\"\">：Git 作为单一事实来源，实现配置的版本化、可审计、快速回滚，降低人为操作风险\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__509\">\u003Cspan leaf=\"\">✅ \u003C/span>\u003Cstrong class=\"js_darkmode__510\">ArgoCD 架构\u003C/strong>\u003Cspan leaf=\"\">：拉模式实现持续同步，Application Controller 负责状态对账，Repo Server 处理 Git 和配置工具集成\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__511\">\u003Cspan leaf=\"\">✅ \u003C/span>\u003Cstrong class=\"js_darkmode__512\">Kustomize 配置管理\u003C/strong>\u003Cspan leaf=\"\">：通过 base + overlay 机制优雅解决多环境配置差异，避免重复维护\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__513\">\u003Cspan leaf=\"\">✅ \u003C/span>\u003Cstrong class=\"js_darkmode__514\">安全与权限\u003C/strong>\u003Cspan leaf=\"\">：AppProject 实现资源隔离，RBAC 配置细粒度权限控制，SSO 集成企业认证体系\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__515\">\u003Cspan leaf=\"\">✅ \u003C/span>\u003Cstrong class=\"js_darkmode__516\">高可用与性能\u003C/strong>\u003Cspan leaf=\"\">：多副本部署、Redis HA、Application Controller 分片支持大规模集群管理\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__517\">\u003Cspan leaf=\"\">6.2 进阶学习方向\u003C/span>\u003C/span>\u003C/h3>\u003Col class=\"list-paddingleft-1 js_darkmode__518\">\u003Cli>\u003Csection class=\"js_darkmode__519\">\u003Cp class=\"js_darkmode__520\">\u003Cstrong class=\"js_darkmode__521\">Argo Rollouts 渐进式交付\u003C/strong>\u003Cspan leaf=\"\">：实现蓝绿部署、金丝雀发布，结合 Istio/Nginx 实现流量分析和自动回滚\u003C/span>\u003C/p>\u003C/section>\u003C/li>\u003Cul class=\"list-paddingleft-1 js_darkmode__522\">\u003Cli>\u003Csection class=\"js_darkmode__523\">\u003Cspan leaf=\"\">学习资源：https://argo-rollouts.readthedocs.io\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__524\">\u003Cspan leaf=\"\">实践建议：从蓝绿部署开始，逐步过渡到基于指标的自动化金丝雀发布\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Cli>\u003Csection class=\"js_darkmode__525\">\u003Cp class=\"js_darkmode__526\">\u003Cstrong class=\"js_darkmode__527\">多租户与多集群管理\u003C/strong>\u003Cspan leaf=\"\">：使用 Cluster Secret、ApplicationSet 矩阵生成器管理数百个集群\u003C/span>\u003C/p>\u003C/section>\u003C/li>\u003Cul class=\"list-paddingleft-1 js_darkmode__528\">\u003Cli>\u003Csection class=\"js_darkmode__529\">\u003Cspan leaf=\"\">学习资源：https://argo-cd.readthedocs.io/en/stable/operator-manual/applicationset/\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__530\">\u003Cspan leaf=\"\">实践建议：设计租户隔离方案，配置跨集群资源配额和网络策略\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Cli>\u003Csection class=\"js_darkmode__531\">\u003Cp class=\"js_darkmode__532\">\u003Cstrong class=\"js_darkmode__533\">策略即代码\u003C/strong>\u003Cspan leaf=\"\">：集成 OPA Gatekeeper 或 Kyverno 实现准入控制、镜像扫描、资源配额自动化\u003C/span>\u003C/p>\u003C/section>\u003C/li>\u003Cul class=\"list-paddingleft-1 js_darkmode__534\">\u003Cli>\u003Csection class=\"js_darkmode__535\">\u003Cspan leaf=\"\">学习资源：https://www.openpolicyagent.org/docs/latest/kubernetes-introduction/\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__536\">\u003Cspan leaf=\"\">实践建议：从镜像白名单、Label 强制策略开始，逐步覆盖安全基线\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003C/ol>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__537\">\u003Cspan leaf=\"\">6.3 参考资料\u003C/span>\u003C/span>\u003C/h3>\u003Cul class=\"list-paddingleft-1 js_darkmode__538\">\u003Cli>\u003Csection class=\"js_darkmode__539\">\u003Cspan leaf=\"\">ArgoCD 官方文档 - 完整的安装、配置、操作指南\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__540\">\u003Cspan leaf=\"\">Kustomize 官方文档 - 配置管理最佳实践和高级特性\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__541\">\u003Cspan leaf=\"\">GitOps Working Group - CNCF GitOps 标准和原则\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__542\">\u003Cspan leaf=\"\">Argo CD Operator - Operator 方式管理 ArgoCD 生命周期\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__543\">\u003Cspan leaf=\"\">ArgoCD 最佳实践 - 官方推荐的生产环境配置\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Chr class=\"js_darkmode__544\">\u003Ch2 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__545\">\u003Cspan leaf=\"\">附录\u003C/span>\u003C/span>\u003C/h2>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__546\">\u003Cspan leaf=\"\">A. 命令速查表\u003C/span>\u003C/span>\u003C/h3>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__547\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__41 js_darkmode__548\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__549\">\u003Cspan class=\"js_darkmode__550\"># Application 管理\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app create <name> --repo <url> --path <path> --dest-server <server> --dest-namespace <ns>\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app get <name>                          \u003C/span>\u003Cspan class=\"js_darkmode__551\"># 查看应用详情\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app sync <name>                         \u003C/span>\u003Cspan class=\"js_darkmode__552\"># 手动同步\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app diff <name>                         \u003C/span>\u003Cspan class=\"js_darkmode__553\"># 查看配置差异\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app \u003C/span>\u003Cspan>history\u003C/span>\u003Cspan leaf=\"\"> <name>                      \u003C/span>\u003Cspan class=\"js_darkmode__554\"># 查看同步历史\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app rollback <name> <revision>          \u003C/span>\u003Cspan class=\"js_darkmode__555\"># 回滚到指定版本\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app delete <name>                       \u003C/span>\u003Cspan class=\"js_darkmode__556\"># 删除应用\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app \u003C/span>\u003Cspan>set\u003C/span>\u003Cspan leaf=\"\"> <name> --sync-policy automated  \u003C/span>\u003Cspan class=\"js_darkmode__557\"># 配置自动同步\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__558\"># 仓库管理\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd repo add <url> --username <user> --password <pass>\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd repo list                               \u003C/span>\u003Cspan class=\"js_darkmode__559\"># 列出所有仓库\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd repo rm <url>                           \u003C/span>\u003Cspan class=\"js_darkmode__560\"># 删除仓库\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__561\"># 集群管理\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd cluster add <context-name>              \u003C/span>\u003Cspan class=\"js_darkmode__562\"># 添加集群\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd cluster list                            \u003C/span>\u003Cspan class=\"js_darkmode__563\"># 列出所有集群\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd cluster get <server-url>                \u003C/span>\u003Cspan class=\"js_darkmode__564\"># 查看集群信息\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__565\"># 项目管理\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd proj create <name>                      \u003C/span>\u003Cspan class=\"js_darkmode__566\"># 创建项目\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd proj add-source <proj> <repo>           \u003C/span>\u003Cspan class=\"js_darkmode__567\"># 添加源仓库\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd proj add-destination <proj> <server> <ns>  \u003C/span>\u003Cspan class=\"js_darkmode__568\"># 添加目标集群\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__569\">\u003Cspan leaf=\"\">B. 配置参数详解\u003C/span>\u003C/span>\u003C/h3>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__570\">\u003Cstrong class=\"js_darkmode__571\">Application 核心参数\u003C/strong>\u003Cspan leaf=\"\">：\u003C/span>\u003C/p>\u003Cul class=\"list-paddingleft-1 js_darkmode__572\">\u003Cli>\u003Csection class=\"js_darkmode__573\">\u003Ccode class=\"js_darkmode__574\">\u003Cspan leaf=\"\">source.repoURL\u003C/span>\u003C/code>\u003Cspan leaf=\"\">：Git 仓库地址，支持 HTTPS/SSH 协议\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__575\">\u003Ccode class=\"js_darkmode__576\">\u003Cspan leaf=\"\">source.targetRevision\u003C/span>\u003C/code>\u003Cspan leaf=\"\">：分支/标签/Commit SHA，HEAD 表示默认分支\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__577\">\u003Ccode class=\"js_darkmode__578\">\u003Cspan leaf=\"\">source.path\u003C/span>\u003C/code>\u003Cspan leaf=\"\">：仓库内配置文件路径，支持 Kustomize/Helm/Plain YAML\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__579\">\u003Ccode class=\"js_darkmode__580\">\u003Cspan leaf=\"\">destination.server\u003C/span>\u003C/code>\u003Cspan leaf=\"\">：目标集群 API Server 地址，\u003C/span>\u003Ccode class=\"js_darkmode__581\">\u003Cspan leaf=\"\">https://kubernetes.default.svc\u003C/span>\u003C/code>\u003Cspan leaf=\"\"> 表示当前集群\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__582\">\u003Ccode class=\"js_darkmode__583\">\u003Cspan leaf=\"\">syncPolicy.automated.prune\u003C/span>\u003C/code>\u003Cspan leaf=\"\">：自动删除 Git 中不存在的资源\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__584\">\u003Ccode class=\"js_darkmode__585\">\u003Cspan leaf=\"\">syncPolicy.automated.selfHeal\u003C/span>\u003C/code>\u003Cspan leaf=\"\">：自动修复手动修改（每 5 秒检测一次）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__586\">\u003Ccode class=\"js_darkmode__587\">\u003Cspan leaf=\"\">syncPolicy.syncOptions\u003C/span>\u003C/code>\u003Cspan leaf=\"\">：同步选项，如 CreateNamespace、PruneLast、RespectIgnoreDifferences\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__588\">\u003Cstrong class=\"js_darkmode__589\">AppProject 权限控制\u003C/strong>\u003Cspan leaf=\"\">：\u003C/span>\u003C/p>\u003Cul class=\"list-paddingleft-1 js_darkmode__590\">\u003Cli>\u003Csection class=\"js_darkmode__591\">\u003Ccode class=\"js_darkmode__592\">\u003Cspan leaf=\"\">sourceRepos\u003C/span>\u003C/code>\u003Cspan leaf=\"\">：允许的 Git 仓库白名单，支持通配符\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__593\">\u003Ccode class=\"js_darkmode__594\">\u003Cspan leaf=\"\">destinations\u003C/span>\u003C/code>\u003Cspan leaf=\"\">：允许部署的目标集群和命名空间\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__595\">\u003Ccode class=\"js_darkmode__596\">\u003Cspan leaf=\"\">clusterResourceWhitelist\u003C/span>\u003C/code>\u003Cspan leaf=\"\">：允许创建的集群级资源（空数组表示禁止所有）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__597\">\u003Ccode class=\"js_darkmode__598\">\u003Cspan leaf=\"\">namespaceResourceWhitelist\u003C/span>\u003C/code>\u003Cspan leaf=\"\">：允许创建的命名空间级资源\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__599\">\u003Cspan leaf=\"\">C. 术语表\u003C/span>\u003C/span>\u003C/h3>\u003Csection data-tool=\"mdnice编辑器\">\u003Ctable class=\"layui-table\">\u003Cthead>\u003Ctr>\u003Cth class=\"js_darkmode__600\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">术语\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__601\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">英文\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__602\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">解释\u003C/span>\u003C/section>\u003C/th>\u003C/tr>\u003C/thead>\u003Ctbody>\u003Ctr class=\"js_darkmode__603\">\u003Ctd class=\"js_darkmode__604\">\u003Csection>\u003Cspan leaf=\"\">声明式配置\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__605\">\u003Csection>\u003Cspan leaf=\"\">Declarative Configuration\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__606\">\u003Csection>\u003Cspan leaf=\"\">描述期望状态而非操作步骤，系统自动消除偏差\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__607\">\u003Ctd class=\"js_darkmode__608\">\u003Csection>\u003Cspan leaf=\"\">同步\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__609\">\u003Csection>\u003Cspan leaf=\"\">Sync\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__610\">\u003Csection>\u003Cspan leaf=\"\">将 Git 中的期望状态应用到 Kubernetes 集群\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__611\">\u003Ctd class=\"js_darkmode__612\">\u003Csection>\u003Cspan leaf=\"\">对账\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__613\">\u003Csection>\u003Cspan leaf=\"\">Reconciliation\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__614\">\u003Csection>\u003Cspan leaf=\"\">周期性比较实际状态与期望状态，检测漂移\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__615\">\u003Ctd class=\"js_darkmode__616\">\u003Csection>\u003Cspan leaf=\"\">修剪\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__617\">\u003Csection>\u003Cspan leaf=\"\">Prune\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__618\">\u003Csection>\u003Cspan leaf=\"\">删除 Git 中不存在但集群中存在的资源\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__619\">\u003Ctd class=\"js_darkmode__620\">\u003Csection>\u003Cspan leaf=\"\">自愈\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__621\">\u003Csection>\u003Cspan leaf=\"\">Self-Heal\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__622\">\u003Csection>\u003Cspan leaf=\"\">自动撤销手动修改，恢复到 Git 定义的状态\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__623\">\u003Ctd class=\"js_darkmode__624\">\u003Csection>\u003Cspan leaf=\"\">健康状态\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__625\">\u003Csection>\u003Cspan leaf=\"\">Health Status\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__626\">\u003Csection>\u003Cspan leaf=\"\">资源的运行状态（Healthy/Progressing/Degraded/Suspended）\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__627\">\u003Ctd class=\"js_darkmode__628\">\u003Csection>\u003Cspan leaf=\"\">同步状态\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__629\">\u003Csection>\u003Cspan leaf=\"\">Sync Status\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__630\">\u003Csection>\u003Cspan leaf=\"\">配置的同步状态（Synced/OutOfSync）\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__631\">\u003Ctd class=\"js_darkmode__632\">\u003Csection>\u003Cspan leaf=\"\">应用集\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__633\">\u003Csection>\u003Cspan leaf=\"\">ApplicationSet\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__634\">\u003Csection>\u003Cspan leaf=\"\">批量生成 Application，支持多集群/多租户场景\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003C/tbody>\u003C/table>\u003C/section>","## 四、最佳实践和注意事项\n\n### 4.1 最佳实践\n\n#### 4.1.1 性能优化\n\n- 优化点一：减少 Git 轮询频率\n```\n# argocd-cm ConfigMapapiVersion: v1kind: ConfigMapmetadata:  name: argocd-cm  namespace: argocddata:  timeout.reconciliation: 300s  # 默认 180s，大规模集群建议 300s+  timeout.reconciliation.jitter: 30s\n```\n说明：默认每 3 分钟轮询一次 Git 仓库，大规模部署建议延长间隔并配置 Webhook 实现事件驱动同步。\n- 优化点二：启用资源缓存\n```\n# 编辑 argocd-application-controller StatefulSetkubectl edit statefulset argocd-application-controller -n argocd# 添加环境变量env:- name: ARGOCD_APPLICATION_CONTROLLER_REPLICAS  value: \"3\"- name: ARGOCD_APPLICATION_CONTROLLER_SHARD  valueFrom:    fieldRef:      fieldPath: metadata.name\n```\n- 配置 Redis HA 提升缓存性能\n- 启用 Application Controller 分片（处理 1000+ Application）\n\n**优化点三：优化 Diff 计算**\n\n```\n# Application 配置spec:  ignoreDifferences:  - group: apps    kind: Deployment    jsonPointers:    - /spec/replicas  # 忽略 HPA 自动调整的副本数  - group: \"\"    kind: Secret    jsonPointers:    - /data  # 忽略 External Secrets Operator 动态更新\n```\n\n#### 4.1.2 安全加固\n\n- 安全措施一：限制资源权限\n```\n# AppProject 白名单机制spec:  clusterResourceWhitelist:  - group: ''    kind: Namespace  clusterResourceBlacklist:  - group: ''    kind: ResourceQuota  - group: 'rbac.authorization.k8s.io'    kind: ClusterRole\n```\n说明：禁止应用创建 ClusterRole、PersistentVolume 等集群级资源，防止权限提升。\n- 安全措施二：启用 Admission Webhook\n```\n# argocd-cm ConfigMapdata:  resource.customizations: |    admissionregistration.k8s.io/MutatingWebhookConfiguration:      health.lua: |        hs = {}        hs.status = \"Healthy\"        return hs\n```\n配合 OPA Gatekeeper 或 Kyverno 实现策略即代码，拦截不合规资源。\n- 安全措施三：Git 签名验证\n```\n# 启用 GPG 签名验证argocd repo add https://github.com/your-org/your-repo.git \\  --username git \\  --password $TOKEN \\  --enable-lfs \\  --gpg-key-id 0x1234567890ABCDEF\n```\n\n#### 4.1.3 高可用配置\n\n- HA方案一：组件多副本部署\n```\n# argocd-server 副本数调整kubectl scale deployment argocd-server -n argocd --replicas=3kubectl scale deployment argocd-repo-server -n argocd --replicas=3# Application Controller 使用 StatefulSet，启用分片kubectl scale statefulset argocd-application-controller -n argocd --replicas=3\n```\n- HA方案二：Redis Sentinel 部署\n```\n# 使用 Redis HA 替代单实例 Redis# 安装 Redis Sentinelkubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/ha/redis-ha/redis-ha.yaml\n```\n- 备份策略：\n```\n#!/bin/bash# 备份所有 Application 定义kubectl get applications -n argocd -o yaml > applications-backup.yaml# 备份所有 AppProject 定义kubectl get appprojects -n argocd -o yaml > appprojects-backup.yaml# 备份配置kubectl get cm argocd-cm argocd-rbac-cm argocd-cmd-params-cm -n argocd -o yaml > argocd-config-backup.yaml\n```\n\n### 4.2 注意事项\n\n#### 4.2.1 配置注意事项\n\n⚠️ \n**警告**\n：生产环境必须禁用 admin 账户，强制使用 SSO 认证，所有操作可追溯到个人账户。\n\n- ❗ 注意事项一：syncPolicy.automated 慎用于生产环境，建议仅对基础设施组件启用自动同步，业务应用采用手动审批\n- ❗ 注意事项二：prune 和 selfHeal 同时启用可能导致误删资源，务必配置 ignoreDifferences 排除动态字段\n- ❗ 注意事项三：Kustomize 的 namespace 字段会覆盖所有资源的 namespace，使用 overlay 时需注意命名空间冲突\n\n#### 4.2.2 常见错误\n\n错误现象\n\n原因分析\n\n解决方案\n\nComparisonError: failed to unmarshal\n\nKustomize 构建失败，语法错误\n\n本地执行 \n`kubectl kustomize overlays/prod`\n 验证配置\n\nSyncFailed: PermissionDenied\n\nServiceAccount 权限不足\n\n检查 AppProject 的 clusterResourceWhitelist 配置\n\nOutOfSync 但实际已同步\n\nignoreDifferences 配置不当\n\n添加动态字段到 ignoreDifferences 列表\n\nHealth status: Progressing\n\n资源健康检查超时\n\n检查 Pod 日志，调整 health check 参数\n\nWebhook trigger failed\n\nWebhook Secret 不匹配\n\n重新生成 Webhook URL，更新 Git 仓库配置\n\n#### 4.2.3 兼容性问题\n\n- 版本兼容：ArgoCD 2.9+ 要求 Kubernetes 1.24+，使用旧版 K8s 需安装 ArgoCD 2.7 LTS\n- 平台兼容：Helm Chart 需启用 --enable-helm，Jsonnet 需安装 argocd-jsonnet\n- 组件依赖：Kustomize 版本与 kubectl 绑定，使用高级特性（replacements）需确保 Kustomize 5.0+\n\n---\n\n## 五、故障排查和监控\n\n### 5.1 故障排查\n\n#### 5.1.1 日志查看\n\n```\n# 查看 Application Controller 日志（核心组件）kubectl logs -n argocd deployment/argocd-application-controller --tail=100 -f# 查看 Repo Server 日志（Git 拉取和 Kustomize 构建）kubectl logs -n argocd deployment/argocd-repo-server --tail=100 -f# 查看 Server 日志（API 请求）kubectl logs -n argocd deployment/argocd-server --tail=100 -f# 查看特定 Application 的同步日志argocd app logs myapp --follow# 查看详细错误信息kubectl describe application myapp -n argocd\n```\n\n#### 5.1.2 常见问题排查\n\n**问题一：Git 仓库连接失败**\n\n```\n# 诊断命令argocd repo listkubectl get secret -n argocd -l argocd.argoproj.io/secret-type=repository# 测试 Git 连接kubectl exec -it deployment/argocd-repo-server -n argocd -- shgit ls-remote https://github.com/your-org/your-repo.git\n```\n\n**解决方案**\n：\n\n1. 检查凭证是否过期（PAT、SSH Key）\n2. 验证网络连通性（代理、防火墙）\n3. 查看 Repo Server 日志确认具体错误\n\n**问题二：Application 一直处于 Progressing 状态**\n\n```\n# 诊断命令argocd app get myapp --refreshkubectl get pods -n myapp -o widekubectl describe pod  -n myapp\n```\n\n**解决方案**\n：\n\n1. 检查 Pod 事件（镜像拉取失败、资源不足）\n2. 验证健康检查配置（存活探针、就绪探针）\n3. 调整 Application 的健康检查超时时间\n\n**问题三：Kustomize 构建失败**\n\n- 症状：Application 状态显示 ComparisonError\n- 排查：\n```\n# 本地复现问题git clone cd overlays/prodkubectl kustomize . --enable-helm\n```\n- 解决：修复 kustomization.yaml 语法错误，验证资源引用路径\n\n#### 5.1.3 调试模式\n\n```\n# 开启 Application Controller 调试日志kubectl set env deployment/argocd-application-controller \\  -n argocd \\  ARGOCD_LOG_LEVEL=debug# 开启 Repo Server 详细日志kubectl set env deployment/argocd-repo-server \\  -n argocd \\  ARGOCD_LOG_LEVEL=debug \\  ARGOCD_EXEC_TIMEOUT=180s# 禁用缓存强制重新构建argocd app get myapp --hard-refresh\n```\n\n### 5.2 性能监控\n\n#### 5.2.1 关键指标监控\n\n```\n# Application 同步时长argocd app list -o json | jq '.[] | {name: .metadata.name, syncTime: .status.operationState.finishedAt}'# Repo Server CPU/内存使用kubectl top pod -n argocd -l app.kubernetes.io/name=argocd-repo-server# Application Controller 处理队列长度kubectl logs -n argocd deployment/argocd-application-controller | grep \"app reconciliation\"# Redis 连接数kubectl exec -n argocd deployment/argocd-redis -- redis-cli info clients\n```\n\n#### 5.2.2 监控指标说明\n\n指标名称\n\n正常范围\n\n告警阈值\n\n说明\n\nargocd_app_sync_total\n\n-\n\n失败率 >5%\n\n同步成功率，区分成功/失败\n\nargocd_app_reconcile_duration\n\n60s\n\n应用对账耗时，反映性能瓶颈\n\nargocd_git_request_duration\n\n15s\n\nGit 操作耗时，检测网络问题\n\nargocd_kubectl_exec_pending\n\n50\n\nkubectl 执行队列长度\n\nargocd_redis_request_total\n\n-\n\n错误率 >1%\n\nRedis 请求统计\n\n#### 5.2.3 监控告警配置\n\n```\n# Prometheus PrometheusRuleapiVersion: monitoring.coreos.com/v1kind: PrometheusRulemetadata:  name: argocd-alerts  namespace: argocdspec:  groups:  - name: argocd    interval: 30s    rules:    - alert: ArgoCDAppSyncFailed      expr: |        sum(increase(argocd_app_sync_total{phase=\"Failed\"}[5m])) > 3      for: 5m      labels:        severity: warning      annotations:        summary: \"ArgoCD Application 同步失败过多\"        description: \"Application {{ $labels.name }} 同步失败次数 {{ $value }}\"    - alert: ArgoCDAppOutOfSync      expr: |        argocd_app_info{sync_status=\"OutOfSync\"} == 1      for: 10m      labels:        severity: warning      annotations:        summary: \"Application 长时间未同步\"        description: \"{{ $labels.name }} 已超过 10 分钟未同步\"    - alert: ArgoCDRepoServerDown      expr: |        up{job=\"argocd-repo-server\"} == 0      for: 2m      labels:        severity: critical      annotations:        summary: \"ArgoCD Repo Server 不可用\"\n```\n\n### 5.3 备份与恢复\n\n#### 5.3.1 备份策略\n\n```\n#!/bin/bash# 文件名：argocd-backup.sh# 功能：备份 ArgoCD 所有配置BACKUP_DIR=\"/backup/argocd/$(date +%Y%m%d)\"mkdir -p \"${BACKUP_DIR}\"# 备份 Applicationkubectl get applications -n argocd -o yaml > \"${BACKUP_DIR}/applications.yaml\"# 备份 AppProjectkubectl get appprojects -n argocd -o yaml > \"${BACKUP_DIR}/appprojects.yaml\"# 备份 ApplicationSetkubectl get applicationsets -n argocd -o yaml > \"${BACKUP_DIR}/applicationsets.yaml\"# 备份配置 ConfigMapkubectl get cm -n argocd argocd-cm argocd-rbac-cm argocd-cmd-params-cm -o yaml > \"${BACKUP_DIR}/configmaps.yaml\"# 备份 Secret（不含敏感数据）kubectl get secrets -n argocd -l argocd.argoproj.io/secret-type -o yaml > \"${BACKUP_DIR}/secrets.yaml\"# 备份到远程存储tar -czf \"${BACKUP_DIR}.tar.gz\" \"${BACKUP_DIR}\"aws s3 cp \"${BACKUP_DIR}.tar.gz\" s3://backups/argocd/# 清理 7 天前的备份find /backup/argocd -name \"*.tar.gz\" -mtime +7 -deleteecho \"Backup completed: ${BACKUP_DIR}.tar.gz\"\n```\n\n#### 5.3.2 恢复流程\n\n1. 停止 ArgoCD 同步\n\n```\n# 暂停所有 Application 自动同步for app in $(argocd app list -o name); do  argocd app set $app --sync-policy nonedone\n```\n\n1. 恢复配置\n\n```\n# 解压备份tar -xzf /backup/argocd/20240315.tar.gz -C /tmp# 恢复 AppProjectkubectl apply -f /tmp/20240315/appprojects.yaml# 恢复 Applicationkubectl apply -f /tmp/20240315/applications.yaml# 恢复配置kubectl apply -f /tmp/20240315/configmaps.yaml\n```\n\n1. 验证恢复\n\n```\n# 检查 Application 状态argocd app list# 触发同步验证argocd app sync --dry-run guestbook\n```\n\n1. 重启服务\n\n```\n# 重启 ArgoCD 组件kubectl rollout restart deployment -n argocd argocd-serverkubectl rollout restart deployment -n argocd argocd-repo-serverkubectl rollout restart statefulset -n argocd argocd-application-controller\n```\n\n---\n\n## 六、总结\n\n### 6.1 技术要点回顾\n\n- ✅ GitOps 核心价值：Git 作为单一事实来源，实现配置的版本化、可审计、快速回滚，降低人为操作风险\n- ✅ ArgoCD 架构：拉模式实现持续同步，Application Controller 负责状态对账，Repo Server 处理 Git 和配置工具集成\n- ✅ Kustomize 配置管理：通过 base + overlay 机制优雅解决多环境配置差异，避免重复维护\n- ✅ 安全与权限：AppProject 实现资源隔离，RBAC 配置细粒度权限控制，SSO 集成企业认证体系\n- ✅ 高可用与性能：多副本部署、Redis HA、Application Controller 分片支持大规模集群管理\n\n### 6.2 进阶学习方向\n\n1. Argo Rollouts 渐进式交付：实现蓝绿部署、金丝雀发布，结合 Istio/Nginx 实现流量分析和自动回滚\n2. 多租户与多集群管理：使用 Cluster Secret、ApplicationSet 矩阵生成器管理数百个集群\n3. 策略即代码：集成 OPA Gatekeeper 或 Kyverno 实现准入控制、镜像扫描、资源配额自动化\n\n### 6.3 参考资料\n\n- ArgoCD 官方文档 - 完整的安装、配置、操作指南\n- Kustomize 官方文档 - 配置管理最佳实践和高级特性\n- GitOps Working Group - CNCF GitOps 标准和原则\n- Argo CD Operator - Operator 方式管理 ArgoCD 生命周期\n- ArgoCD 最佳实践 - 官方推荐的生产环境配置\n\n---\n\n## 附录\n\n### A. 命令速查表\n\n```\n# Application 管理argocd app create  --repo  --path  --dest-server  --dest-namespace argocd app get                           # 查看应用详情argocd app sync                          # 手动同步argocd app diff                          # 查看配置差异argocd app history                       # 查看同步历史argocd app rollback            # 回滚到指定版本argocd app delete                        # 删除应用argocd app set  --sync-policy automated  # 配置自动同步# 仓库管理argocd repo add  --username  --password argocd repo list                               # 列出所有仓库argocd repo rm                            # 删除仓库# 集群管理argocd cluster add               # 添加集群argocd cluster list                            # 列出所有集群argocd cluster get                 # 查看集群信息# 项目管理argocd proj create                       # 创建项目argocd proj add-source             # 添加源仓库argocd proj add-destination     # 添加目标集群\n```\n\n### B. 配置参数详解\n\n**Application 核心参数**\n：\n\n- source.repoURL：Git 仓库地址，支持 HTTPS/SSH 协议\n- source.targetRevision：分支/标签/Commit SHA，HEAD 表示默认分支\n- source.path：仓库内配置文件路径，支持 Kustomize/Helm/Plain YAML\n- destination.server：目标集群 API Server 地址，https://kubernetes.default.svc 表示当前集群\n- syncPolicy.automated.prune：自动删除 Git 中不存在的资源\n- syncPolicy.automated.selfHeal：自动修复手动修改（每 5 秒检测一次）\n- syncPolicy.syncOptions：同步选项，如 CreateNamespace、PruneLast、RespectIgnoreDifferences\n\n**AppProject 权限控制**\n：\n\n- sourceRepos：允许的 Git 仓库白名单，支持通配符\n- destinations：允许部署的目标集群和命名空间\n- clusterResourceWhitelist：允许创建的集群级资源（空数组表示禁止所有）\n- namespaceResourceWhitelist：允许创建的命名空间级资源\n\n### C. 术语表\n\n术语\n\n英文\n\n解释\n\n声明式配置\n\nDeclarative Configuration\n\n描述期望状态而非操作步骤，系统自动消除偏差\n\n同步\n\nSync\n\n将 Git 中的期望状态应用到 Kubernetes 集群\n\n对账\n\nReconciliation\n\n周期性比较实际状态与期望状态，检测漂移\n\n修剪\n\nPrune\n\n删除 Git 中不存在但集群中存在的资源\n\n自愈\n\nSelf-Heal\n\n自动撤销手动修改，恢复到 Git 定义的状态\n\n健康状态\n\nHealth Status\n\n资源的运行状态（Healthy/Progressing/Degraded/Suspended）\n\n同步状态\n\nSync Status\n\n配置的同步状态（Synced/OutOfSync）\n\n应用集\n\nApplicationSet\n\n批量生成 Application，支持多集群/多租户场景","/article/118",305,"2026-01-06 11:49:00","2026-01-06 11:49:34",{"id":344,"category_id":44,"title":345,"keywords":6,"description":346,"image_url":6,"content":347,"content_md":348,"url":349,"hits":350,"is_recommend":73,"is_top":73,"create_time":351,"update_time":352},117,"GitOps 落地实践：ArgoCD + Kustomize 实现声明式基础设施管理(一)","一、概述1.1 背景介绍GitOps 作为云原生时代的运维范式，将 Git 作为基础设施和应用配置的单一事实来源，通过声明式配置和自动化同步机制，实现了配置管理的版本控制、审计追溯和快速回滚。ArgoCD 作为 CNCF 毕业项目，提供了完整的 GitOps 工作流，支持多集群管理、RBAC 权限控制、SSO 集成等企业级特性。结合 Kustomize 的配置管理能力，能够优雅地解决多环境配置差异、敏感信息管理、配置复用等问题。在传统的 CI/CD 流程中，往往由 CI 工具直接执行 kubec","\u003Ch1 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__1\">\u003Cspan leaf=\"\">一、概述\u003C/span>\u003C/span>\u003C/h1>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__2\">\u003Cspan leaf=\"\">1.1 背景介绍\u003C/span>\u003C/span>\u003C/h3>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__3\">\u003Cspan leaf=\"\">GitOps 作为云原生时代的运维范式，将 Git 作为基础设施和应用配置的单一事实来源，通过声明式配置和自动化同步机制，实现了配置管理的版本控制、审计追溯和快速回滚。ArgoCD 作为 CNCF 毕业项目，提供了完整的 GitOps 工作流，支持多集群管理、RBAC 权限控制、SSO 集成等企业级特性。结合 Kustomize 的配置管理能力，能够优雅地解决多环境配置差异、敏感信息管理、配置复用等问题。\u003C/span>\u003C/p>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__4\">\u003Cspan leaf=\"\">在传统的 CI/CD 流程中，往往由 CI 工具直接执行 kubectl apply，这种推模式存在权限管理复杂、审计困难、状态漂移等问题。ArgoCD 采用拉模式，由运行在集群内的 Controller 主动从 Git 仓库拉取配置并应用，实现了部署权限的收敛和状态的持续同步。\u003C/span>\u003C/p>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__5\">\u003Cspan leaf=\"\">1.2 技术特点\u003C/span>\u003C/span>\u003C/h3>\u003Cul class=\"list-paddingleft-1 js_darkmode__6\">\u003Cli>\u003Csection class=\"js_darkmode__7\">\u003Cstrong class=\"js_darkmode__8\">声明式部署\u003C/strong>\u003Cspan leaf=\"\">：基于 Kubernetes 资源清单定义期望状态，ArgoCD 自动检测并消除实际状态与期望状态的偏差\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__9\">\u003Cstrong class=\"js_darkmode__10\">多集群管理\u003C/strong>\u003Cspan leaf=\"\">：单个 ArgoCD 实例可管理数百个 Kubernetes 集群，支持集群级别的 RBAC 和资源隔离\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__11\">\u003Cstrong class=\"js_darkmode__12\">自动同步策略\u003C/strong>\u003Cspan leaf=\"\">：支持手动同步、自动同步、自动修剪(Prune)、自愈(Self-Heal)等多种策略组合\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__13\">\u003Cstrong class=\"js_darkmode__14\">回滚与审计\u003C/strong>\u003Cspan leaf=\"\">：完整记录每次同步操作，支持一键回滚到任意历史版本，所有变更可追溯到 Git commit\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__15\">\u003Cstrong class=\"js_darkmode__16\">健康检查\u003C/strong>\u003Cspan leaf=\"\">：内置对 Deployment、StatefulSet、Service、Ingress 等资源的健康检查，支持自定义健康检查脚本\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__17\">\u003Cstrong class=\"js_darkmode__18\">SSO 集成\u003C/strong>\u003Cspan leaf=\"\">：支持 OAuth2、OIDC、SAML、LDAP 等多种认证方式，可与企业统一认证系统集成\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__19\">\u003Cstrong class=\"js_darkmode__20\">渐进式交付\u003C/strong>\u003Cspan leaf=\"\">：集成 Argo Rollouts 实现蓝绿部署、金丝雀发布、流量分析等高级发布策略\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__21\">\u003Cspan leaf=\"\">1.3 适用场景\u003C/span>\u003C/span>\u003C/h3>\u003Cul class=\"list-paddingleft-1 js_darkmode__22\">\u003Cli>\u003Csection class=\"js_darkmode__23\">\u003Cspan leaf=\"\">场景一：多环境配置管理，通过 Kustomize overlay 机制管理 dev/staging/prod 等环境的配置差异，避免重复维护相似配置\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__24\">\u003Cspan leaf=\"\">场景二：多集群应用分发，使用 ApplicationSet 批量创建 Application，实现应用在多个集群、多个命名空间的标准化部署\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__25\">\u003Cspan leaf=\"\">场景三：基础设施即代码，将集群基础组件(Ingress Controller、监控栈、日志收集等)以 GitOps 方式管理，实现集群配置的版本化\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__26\">\u003Cspan leaf=\"\">场景四：合规审计与权限管控，所有变更通过 Git PR 审批，部署操作由 ArgoCD 执行，开发人员无需直接访问生产集群\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__27\">\u003Cspan leaf=\"\">场景五：灾难恢复，集群配置存储在 Git，可快速在新集群重建全部应用，Recovery Time 从小时级降至分钟级\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__28\">\u003Cspan leaf=\"\">1.4 环境要求\u003C/span>\u003C/span>\u003C/h3>\u003Csection data-tool=\"mdnice编辑器\">\u003Ctable class=\"layui-table\">\u003Cthead>\u003Ctr>\u003Cth class=\"js_darkmode__29\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">组件\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__30\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">版本要求\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__31\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">说明\u003C/span>\u003C/section>\u003C/th>\u003C/tr>\u003C/thead>\u003Ctbody>\u003Ctr class=\"js_darkmode__32\">\u003Ctd class=\"js_darkmode__33\">\u003Csection>\u003Cspan leaf=\"\">操作系统\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__34\">\u003Csection>\u003Cspan leaf=\"\">Linux 内核 4.x+\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__35\">\u003Csection>\u003Cspan leaf=\"\">推荐 Ubuntu 20.04/22.04 或 RHEL 8+\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__36\">\u003Ctd class=\"js_darkmode__37\">\u003Csection>\u003Cspan leaf=\"\">Kubernetes\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__38\">\u003Csection>\u003Cspan leaf=\"\">1.24+\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__39\">\u003Csection>\u003Cspan leaf=\"\">ArgoCD 2.9+ 要求 Kubernetes 1.24+\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__40\">\u003Ctd class=\"js_darkmode__41\">\u003Csection>\u003Cspan leaf=\"\">kubectl\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__42\">\u003Csection>\u003Cspan leaf=\"\">与 K8s 版本匹配\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__43\">\u003Csection>\u003Cspan leaf=\"\">用于初始安装和手动干预\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__44\">\u003Ctd class=\"js_darkmode__45\">\u003Csection>\u003Cspan leaf=\"\">Git 仓库\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__46\">\u003Csection>\u003Cspan leaf=\"\">GitHub/GitLab/Gitea\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__47\">\u003Csection>\u003Cspan leaf=\"\">支持 HTTPS/SSH 认证，建议配置 Webhook\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__48\">\u003Ctd class=\"js_darkmode__49\">\u003Csection>\u003Cspan leaf=\"\">Kustomize\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__50\">\u003Csection>\u003Cspan leaf=\"\">内置于 kubectl\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__51\">\u003Csection>\u003Cspan leaf=\"\">ArgoCD 内置 Kustomize 5.0+\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__52\">\u003Ctd class=\"js_darkmode__53\">\u003Csection>\u003Cspan leaf=\"\">硬件配置\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__54\">\u003Csection>\u003Cspan leaf=\"\">2C4G(最小)\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__55\">\u003Csection>\u003Cspan leaf=\"\">生产环境推荐 4C8G，HA 部署需 3 副本\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003C/tbody>\u003C/table>\u003C/section>\u003Chr class=\"js_darkmode__56\">\u003Ch2 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__57\">\u003Cspan leaf=\"\">二、详细步骤\u003C/span>\u003C/span>\u003C/h2>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__58\">\u003Cspan leaf=\"\">2.1 准备工作\u003C/span>\u003C/span>\u003C/h3>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__59\">\u003Cspan leaf=\"\">2.1.1 系统检查\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__60\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__0 js_darkmode__61\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__62\">\u003Cspan class=\"js_darkmode__63\"># 验证 Kubernetes 集群状态\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl cluster-info\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl get nodes\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl version --short\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__64\"># 检查集群资源配额\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl top nodes\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl describe quota --all-namespaces\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__65\"># 验证存储类（ArgoCD 需要持久化存储）\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl get storageclass\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__66\">\u003Cspan leaf=\"\">2.1.2 安装依赖\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__67\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__1 js_darkmode__68\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__69\">\u003Cspan class=\"js_darkmode__70\"># 创建 ArgoCD 命名空间\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl create namespace argocd\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__71\"># 安装 ArgoCD（使用官方稳定版本）\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__72\"># 等待所有组件就绪\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl \u003C/span>\u003Cspan>wait\u003C/span>\u003Cspan leaf=\"\"> --\u003C/span>\u003Cspan>for\u003C/span>\u003Cspan leaf=\"\">=condition=available --timeout=600s \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  deployment/argocd-server \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  deployment/argocd-repo-server \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  deployment/argocd-dex-server \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  deployment/argocd-redis \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  -n argocd\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__73\"># 安装 ArgoCD CLI\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">VERSION=$(curl -s https://api.github.com/repos/argoproj/argo-cd/releases/latest | grep tag_name | cut -d \u003C/span>\u003Cspan>'\"'\u003C/span>\u003Cspan leaf=\"\"> -f 4)\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">curl -sSL -o argocd-linux-amd64 \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">\"https://github.com/argoproj/argo-cd/releases/download/\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">${VERSION}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">/argocd-linux-amd64\"\u003C/span>\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">sudo install -m 555 argocd-linux-amd64 /usr/\u003C/span>\u003Cspan>local\u003C/span>\u003Cspan leaf=\"\">/bin/argocd\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">rm argocd-linux-amd64\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__74\"># 验证安装\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd version\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__75\">\u003Cspan leaf=\"\">2.2 核心配置\u003C/span>\u003C/span>\u003C/h3>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__76\">\u003Cspan leaf=\"\">2.2.1 暴露 ArgoCD API Server\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__77\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__2 js_darkmode__78\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__79\">\u003Cspan class=\"js_darkmode__80\"># 方式一：LoadBalancer（云环境推荐）\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl patch svc argocd-server -n argocd -p \u003C/span>\u003Cspan>'{\"spec\": {\"type\": \"LoadBalancer\"}}'\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__81\"># 方式二：Ingress（内网环境推荐）\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">cat <<EOF | kubectl apply -f -\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">apiVersion: networking.k8s.io/v1\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kind: Ingress\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  name: argocd-server-ingress\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  namespace: argocd\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  annotations:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    nginx.ingress.kubernetes.io/ssl-passthrough: \u003C/span>\u003Cspan>\"true\"\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    nginx.ingress.kubernetes.io/backend-protocol: \u003C/span>\u003Cspan>\"HTTPS\"\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">spec:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  ingressClassName: nginx\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  rules:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  - host: argocd.example.com\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    http:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      paths:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      - path: /\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        pathType: Prefix\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        backend:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          service:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            name: argocd-server\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            port:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">              name: https\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  tls:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  - hosts:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    - argocd.example.com\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    secretName: argocd-server-tls\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">EOF\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__82\"># 方式三：端口转发（开发测试）\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl port-forward svc/argocd-server -n argocd 8080:443\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__83\">\u003Cstrong class=\"js_darkmode__84\">说明\u003C/strong>\u003Cspan leaf=\"\">：生产环境建议使用 Ingress + TLS 证书，避免暴露 LoadBalancer 公网 IP。SSL Passthrough 保证端到端加密，ArgoCD Server 使用自签名证书或配置自定义证书。\u003C/span>\u003C/p>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__85\">\u003Cspan leaf=\"\">2.2.2 初始化 ArgoCD\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__86\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__3 js_darkmode__87\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__88\">\u003Cspan class=\"js_darkmode__89\"># 获取初始 admin 密码\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">ARGOCD_PASSWORD=$(kubectl -n argocd get secret argocd-initial-admin-secret \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  -o jsonpath=\u003C/span>\u003Cspan>\"{.data.password}\"\u003C/span>\u003Cspan leaf=\"\"> | base64 -d)\u003C/span>\u003Cbr>\u003Cspan>echo\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">\"ArgoCD admin password: \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">${ARGOCD_PASSWORD}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">\"\u003C/span>\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__90\"># 登录 ArgoCD\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd login argocd.example.com --username admin --password \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">\"\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">${ARGOCD_PASSWORD}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">\"\u003C/span>\u003C/span>\u003Cspan leaf=\"\"> --grpc-web\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__91\"># 修改 admin 密码\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd account update-password\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__92\"># 删除初始密码 Secret（安全加固）\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl -n argocd delete secret argocd-initial-admin-secret\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__93\">\u003Cspan leaf=\"\">2.2.3 配置 Git 仓库凭证\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__94\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__4 js_darkmode__95\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__96\">\u003Cspan class=\"js_darkmode__97\"># 方式一：HTTPS 认证（使用 Personal Access Token）\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd repo add https://github.com/your-org/your-repo.git \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  --username git \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  --password ghp_xxxxxxxxxxxxxxxxxxxx \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  --name my-repo\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__98\"># 方式二：SSH 认证（推荐）\u003C/span>\u003Cbr>\u003Cspan class=\"js_darkmode__99\"># 生成 SSH 密钥对\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">ssh-keygen -t ed25519 -C \u003C/span>\u003Cspan>\"argocd@example.com\"\u003C/span>\u003Cspan leaf=\"\"> -f ~/.ssh/argocd_ed25519 -N \u003C/span>\u003Cspan>\"\"\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__100\"># 将公钥添加到 Git 仓库的 Deploy Keys\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">cat ~/.ssh/argocd_ed25519.pub\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__101\"># 添加私钥到 ArgoCD\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd repo add git@github.com:your-org/your-repo.git \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  --ssh-private-key-path ~/.ssh/argocd_ed25519 \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  --name my-repo\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__102\"># 验证仓库连接\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd repo list\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__103\">\u003Cstrong class=\"js_darkmode__104\">参数说明\u003C/strong>\u003Cspan leaf=\"\">：\u003C/span>\u003C/p>\u003Cul class=\"list-paddingleft-1 js_darkmode__105\">\u003Cli>\u003Csection class=\"js_darkmode__106\">\u003Ccode class=\"js_darkmode__107\">\u003Cspan leaf=\"\">--insecure-skip-server-verification\u003C/span>\u003C/code>\u003Cspan leaf=\"\">：跳过 Git 服务器 TLS 验证（自签名证书场景）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__108\">\u003Ccode class=\"js_darkmode__109\">\u003Cspan leaf=\"\">--proxy\u003C/span>\u003C/code>\u003Cspan leaf=\"\">：配置代理服务器访问外部 Git 仓库\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__110\">\u003Ccode class=\"js_darkmode__111\">\u003Cspan leaf=\"\">--enable-lfs\u003C/span>\u003C/code>\u003Cspan leaf=\"\">：启用 Git LFS 支持大文件\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__112\">\u003Cspan leaf=\"\">2.3 启动和验证\u003C/span>\u003C/span>\u003C/h3>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__113\">\u003Cspan leaf=\"\">2.3.1 创建 Application\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__114\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__5 js_darkmode__115\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__116\">\u003Cspan class=\"js_darkmode__117\"># application.yaml\u003C/span>\u003Cbr>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argoproj.io/v1alpha1\u003C/span>\u003Cbr>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Application\u003C/span>\u003Cbr>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>guestbook\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan class=\"js_darkmode__118\"># Finalizer 确保删除 Application 时同步删除已部署资源\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>finalizers:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>resources-finalizer.argocd.argoproj.io\u003C/span>\u003Cbr>\u003Cspan>spec:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>project:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>default\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>source:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan class=\"js_darkmode__119\"># Git 仓库地址\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>repoURL:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>https://github.com/argoproj/argocd-example-apps.git\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>targetRevision:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>HEAD\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>path:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>guestbook\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>destination:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>server:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>https://kubernetes.default.svc\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>default\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>syncPolicy:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>automated:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>prune:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>true\u003C/span>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan class=\"js_darkmode__120\"># 自动删除 Git 中不存在的资源\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>selfHeal:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>true\u003C/span>\u003Cspan leaf=\"\">   \u003C/span>\u003Cspan class=\"js_darkmode__121\"># 自动修复手动修改\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>allowEmpty:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>false\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>syncOptions:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>CreateNamespace=true\u003C/span>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan class=\"js_darkmode__122\"># 自动创建目标命名空间\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>retry:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>limit:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>5\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>backoff:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>duration:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>5s\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>factor:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>2\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>maxDuration:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>3m\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__123\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__6 js_darkmode__124\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__125\">\u003Cspan class=\"js_darkmode__126\"># 应用配置\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl apply -f application.yaml\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__127\"># 查看 Application 状态\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app get guestbook\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__128\"># 查看同步历史\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app \u003C/span>\u003Cspan>history\u003C/span>\u003Cspan leaf=\"\"> guestbook\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__129\"># 手动触发同步\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app sync guestbook\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__130\"># 查看实时日志\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app logs guestbook --follow\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__131\">\u003Cspan leaf=\"\">2.3.2 功能验证\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__132\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__7 js_darkmode__133\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__134\">\u003Cspan class=\"js_darkmode__135\"># 验证 Application 健康状态\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app list\u003C/span>\u003Cbr>\u003Cspan class=\"js_darkmode__136\"># 预期输出：\u003C/span>\u003Cbr>\u003Cspan class=\"js_darkmode__137\"># NAME        CLUSTER                         NAMESPACE  PROJECT  STATUS  HEALTH   SYNCPOLICY\u003C/span>\u003Cbr>\u003Cspan class=\"js_darkmode__138\"># guestbook   https://kubernetes.default.svc  default    default  Synced  Healthy  Auto-Prune\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__139\"># 验证资源同步状态\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl get all -n default -l app.kubernetes.io/instance=guestbook\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__140\"># 测试自愈功能（手动修改资源）\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl scale deployment guestbook-ui -n default --replicas=5\u003C/span>\u003Cbr>\u003Cspan class=\"js_darkmode__141\"># 等待 3 秒，ArgoCD 自动恢复副本数\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__142\"># 测试修剪功能（从 Git 删除资源）\u003C/span>\u003Cbr>\u003Cspan class=\"js_darkmode__143\"># 1. 从 Git 仓库删除某个 YAML 文件并提交\u003C/span>\u003Cbr>\u003Cspan class=\"js_darkmode__144\"># 2. 观察 ArgoCD 自动删除对应资源\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app \u003C/span>\u003Cspan>wait\u003C/span>\u003Cspan leaf=\"\"> guestbook --health\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Chr class=\"js_darkmode__145\">\u003Ch2 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__146\">\u003Cspan leaf=\"\">三、示例代码和配置\u003C/span>\u003C/span>\u003C/h2>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__147\">\u003Cspan leaf=\"\">3.1 完整配置示例\u003C/span>\u003C/span>\u003C/h3>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__148\">\u003Cspan leaf=\"\">3.1.1 Kustomize 多环境配置结构\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__149\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__8 js_darkmode__150\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__151\">\u003Cspan class=\"js_darkmode__152\"># 仓库目录结构\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">├── base/\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│   ├── kustomization.yaml\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│   ├── deployment.yaml\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│   ├── service.yaml\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│   └── configmap.yaml\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">├── overlays/\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│   ├── dev/\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│   │   ├── kustomization.yaml\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│   │   ├── replica-patch.yaml\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│   │   └── configmap-patch.yaml\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│   ├── staging/\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│   │   ├── kustomization.yaml\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│   │   └── resources-patch.yaml\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│   └── prod/\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│       ├── kustomization.yaml\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│       ├── replica-patch.yaml\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│       ├── hpa.yaml\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│       └── pdb.yaml\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__153\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__9 js_darkmode__154\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__155\">\u003Cspan class=\"js_darkmode__156\"># base/kustomization.yaml\u003C/span>\u003Cbr>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>kustomize.config.k8s.io/v1beta1\u003C/span>\u003Cbr>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Kustomization\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>resources:\u003C/span>\u003Cbr>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>deployment.yaml\u003C/span>\u003Cbr>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>service.yaml\u003C/span>\u003Cbr>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>configmap.yaml\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>commonLabels:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>app:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>managed-by:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>images:\u003C/span>\u003Cbr>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>newName:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>registry.example.com/myapp\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>newTag:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>latest\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__157\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__10 js_darkmode__158\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__159\">\u003Cspan class=\"js_darkmode__160\"># base/deployment.yaml\u003C/span>\u003Cbr>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>apps/v1\u003C/span>\u003Cbr>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Deployment\u003C/span>\u003Cbr>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cspan>spec:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>replicas:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>1\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>selector:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>matchLabels:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>app:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>template:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>labels:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>app:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>spec:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>containers:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>image:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>ports:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>containerPort:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>8080\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>resources:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>requests:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>cpu:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>100m\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>memory:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>128Mi\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>limits:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>cpu:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>500m\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>memory:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>512Mi\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>envFrom:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>configMapRef:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp-config\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>livenessProbe:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>httpGet:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>path:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>/health\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>port:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>8080\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>initialDelaySeconds:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>30\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>periodSeconds:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>10\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>readinessProbe:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>httpGet:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>path:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>/ready\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>port:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>8080\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>initialDelaySeconds:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>5\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>periodSeconds:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>5\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__161\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__11 js_darkmode__162\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__163\">\u003Cspan class=\"js_darkmode__164\"># overlays/prod/kustomization.yaml\u003C/span>\u003Cbr>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>kustomize.config.k8s.io/v1beta1\u003C/span>\u003Cbr>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Kustomization\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp-prod\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>bases:\u003C/span>\u003Cbr>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>../../base\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>patchesStrategicMerge:\u003C/span>\u003Cbr>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>replica-patch.yaml\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>resources:\u003C/span>\u003Cbr>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>hpa.yaml\u003C/span>\u003Cbr>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>pdb.yaml\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>images:\u003C/span>\u003Cbr>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>newTag:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>v1.2.3\u003C/span>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan class=\"js_darkmode__165\"># 生产环境固定版本\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>configMapGenerator:\u003C/span>\u003Cbr>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp-config\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>behavior:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>merge\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>literals:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>LOG_LEVEL=info\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>ENVIRONMENT=production\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>DB_POOL_SIZE=50\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__166\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__12 js_darkmode__167\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__168\">\u003Cspan class=\"js_darkmode__169\"># overlays/prod/replica-patch.yaml\u003C/span>\u003Cbr>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>apps/v1\u003C/span>\u003Cbr>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Deployment\u003C/span>\u003Cbr>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cspan>spec:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>replicas:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>5\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>template:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>spec:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>containers:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>resources:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>requests:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>cpu:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>500m\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>memory:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>1Gi\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>limits:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>cpu:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>2000m\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>memory:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>4Gi\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__170\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__13 js_darkmode__171\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__172\">\u003Cspan class=\"js_darkmode__173\"># overlays/prod/hpa.yaml\u003C/span>\u003Cbr>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>autoscaling/v2\u003C/span>\u003Cbr>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>HorizontalPodAutoscaler\u003C/span>\u003Cbr>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cspan>spec:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>scaleTargetRef:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>apps/v1\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Deployment\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>minReplicas:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>5\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>maxReplicas:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>20\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>metrics:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>type:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Resource\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>resource:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>cpu\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>target:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>type:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Utilization\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>averageUtilization:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>70\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>type:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Resource\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>resource:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>memory\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>target:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>type:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Utilization\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>averageUtilization:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>80\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>behavior:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>scaleDown:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>stabilizationWindowSeconds:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>300\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>policies:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>type:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Percent\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>value:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>50\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>periodSeconds:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>60\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>scaleUp:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>stabilizationWindowSeconds:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>0\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>policies:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>type:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Percent\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>value:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>100\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>periodSeconds:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>30\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>type:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Pods\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>value:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>4\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>periodSeconds:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>30\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>selectPolicy:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Max\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__174\">\u003Cspan leaf=\"\">3.1.2 ApplicationSet 批量管理\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__175\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__14 js_darkmode__176\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__177\">\u003Cspan class=\"js_darkmode__178\"># applicationset.yaml - 多集群部署\u003C/span>\u003Cbr>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argoproj.io/v1alpha1\u003C/span>\u003Cbr>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>ApplicationSet\u003C/span>\u003Cbr>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp-multi-cluster\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd\u003C/span>\u003Cbr>\u003Cspan>spec:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>generators:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>matrix:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>generators:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>git:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>repoURL:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>https://github.com/your-org/your-repo.git\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>revision:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>HEAD\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>directories:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>path:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>overlays/*\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>clusters:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>selector:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>matchLabels:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">              \u003C/span>\u003Cspan>environment:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>production\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>template:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">'myapp-\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">{{path.basename}}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">{{name}}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">'\u003C/span>\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>spec:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>project:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>default\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>source:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>repoURL:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>https://github.com/your-org/your-repo.git\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>targetRevision:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>HEAD\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>path:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">'\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">{{path}}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">'\u003C/span>\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>destination:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>server:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">'\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">{{server}}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">'\u003C/span>\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">'myapp-\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">{{path.basename}}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">'\u003C/span>\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>syncPolicy:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>automated:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>prune:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>true\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>selfHeal:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>true\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>syncOptions:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>CreateNamespace=true\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__179\">\u003Cspan leaf=\"\">3.2 实际应用案例\u003C/span>\u003C/span>\u003C/h3>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__180\">\u003Cspan leaf=\"\">案例一：配置敏感信息管理\u003C/span>\u003C/span>\u003C/h4>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__181\">\u003Cstrong class=\"js_darkmode__182\">场景描述\u003C/strong>\u003Cspan leaf=\"\">：使用 Sealed Secrets 或 External Secrets Operator 管理数据库密码、API Key 等敏感信息，避免明文存储在 Git 仓库。\u003C/span>\u003C/p>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__183\">\u003Cstrong class=\"js_darkmode__184\">实现代码\u003C/strong>\u003Cspan leaf=\"\">：\u003C/span>\u003C/p>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__185\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__15 js_darkmode__186\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__187\">\u003Cspan class=\"js_darkmode__188\"># 安装 Sealed Secrets Controller\u003C/span>\u003Cbr>\u003Cspan>kubectl\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>apply\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>-f\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.24.0/controller.yaml\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__189\"># 创建 Secret 并加密\u003C/span>\u003Cbr>\u003Cspan>echo\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>-n\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>'my-db-password'\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>|\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>kubectl\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>create\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>secret\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>generic\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>db-credentials\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>--dry-run=client\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>--from-file=password=/dev/stdin\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-o\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>yaml\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>|\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\\\u003C/span>\u003Cbr>\u003Cspan>kubeseal\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>-o\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>yaml\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>>\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>sealed-secret.yaml\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__190\"># sealed-secret.yaml（可安全提交到 Git）\u003C/span>\u003Cbr>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>bitnami.com/v1alpha1\u003C/span>\u003Cbr>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>SealedSecret\u003C/span>\u003Cbr>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>db-credentials\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>default\u003C/span>\u003Cbr>\u003Cspan>spec:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>encryptedData:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>password:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>AgBy3i4OJSWK+PiTySYZZA9rO43cGDEq...\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>template:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>db-credentials\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>default\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>type:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Opaque\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__191\">\u003Cstrong class=\"js_darkmode__192\">运行结果\u003C/strong>\u003Cspan leaf=\"\">：\u003C/span>\u003C/p>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__193\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__16 js_darkmode__194\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__195\">\u003Cspan class=\"js_darkmode__196\"># ArgoCD 同步后自动解密为 Secret\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl get secret db-credentials -o jsonpath=\u003C/span>\u003Cspan>'{.data.password}'\u003C/span>\u003Cspan leaf=\"\"> | base64 -d\u003C/span>\u003Cbr>\u003Cspan class=\"js_darkmode__197\"># 输出：my-db-password\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__198\">\u003Cspan leaf=\"\">案例二：RBAC 权限配置\u003C/span>\u003C/span>\u003C/h4>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__199\">\u003Cstrong class=\"js_darkmode__200\">场景描述\u003C/strong>\u003Cspan leaf=\"\">：为开发团队配置只读权限，仅允许查看 dev 环境应用状态，禁止同步操作；为运维团队配置全部环境的管理权限。\u003C/span>\u003C/p>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__201\">\u003Cstrong class=\"js_darkmode__202\">实现步骤\u003C/strong>\u003Cspan leaf=\"\">：\u003C/span>\u003C/p>\u003Col class=\"list-paddingleft-1 js_darkmode__203\">\u003Cli>\u003Csection class=\"js_darkmode__204\">\u003Cspan leaf=\"\">创建 AppProject 隔离资源\u003C/span>\u003C/section>\u003C/li>\u003C/ol>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__205\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__17 js_darkmode__206\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__207\">\u003Cspan class=\"js_darkmode__208\"># project-dev.yaml\u003C/span>\u003Cbr>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argoproj.io/v1alpha1\u003C/span>\u003Cbr>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>AppProject\u003C/span>\u003Cbr>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>dev-project\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd\u003C/span>\u003Cbr>\u003Cspan>spec:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>description:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Development\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>environment\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>project\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>sourceRepos:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>'https://github.com/your-org/*'\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>destinations:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>'dev-*'\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>server:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>https://kubernetes.default.svc\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>clusterResourceWhitelist:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>group:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>''\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Namespace\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>namespaceResourceWhitelist:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>group:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>'apps'\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Deployment\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>group:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>''\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Service\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>group:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>''\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>ConfigMap\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>roles:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>developer\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>description:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Read-only\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>access\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>to\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>dev\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>apps\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>policies:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>p,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>proj:dev-project:developer,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>applications,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>get,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>dev-project/*,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>allow\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>p,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>proj:dev-project:developer,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>logs,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>get,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>dev-project/*,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>allow\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>groups:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>dev-team\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Col class=\"list-paddingleft-1 js_darkmode__209\" start=\"2\">\u003Cli>\u003Csection class=\"js_darkmode__210\">\u003Cspan leaf=\"\">配置 ArgoCD RBAC\u003C/span>\u003C/section>\u003C/li>\u003C/ol>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__211\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__18 js_darkmode__212\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__213\">\u003Cspan class=\"js_darkmode__214\"># argocd-rbac-cm ConfigMap\u003C/span>\u003Cbr>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>v1\u003C/span>\u003Cbr>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>ConfigMap\u003C/span>\u003Cbr>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd-rbac-cm\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd\u003C/span>\u003Cbr>\u003Cspan>data:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>policy.default:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>role:readonly\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>policy.csv:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">|\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    # 运维团队全部权限\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    g, ops-team, role:admin\u003C/span>\u003Cbr>\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan class=\"js_darkmode__215\"># 开发团队限制权限\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>p,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>role:developer,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>applications,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>get,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>*/*,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>allow\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>p,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>role:developer,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>applications,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>sync,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>dev-project/*,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>allow\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>p,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>role:developer,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>logs,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>get,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>*/*,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>allow\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>g,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>dev-team,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>role:developer\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan class=\"js_darkmode__216\"># 禁止删除生产应用\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>p,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>role:developer,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>applications,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>delete,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>prod-project/*,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>deny\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Col class=\"list-paddingleft-1 js_darkmode__217\" start=\"3\">\u003Cli>\u003Csection class=\"js_darkmode__218\">\u003Cspan leaf=\"\">集成 OIDC SSO（以 Keycloak 为例）\u003C/span>\u003C/section>\u003C/li>\u003C/ol>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__219\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__19 js_darkmode__220\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__221\">\u003Cspan class=\"js_darkmode__222\"># argocd-cm ConfigMap\u003C/span>\u003Cbr>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>v1\u003C/span>\u003Cbr>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>ConfigMap\u003C/span>\u003Cbr>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd-cm\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd\u003C/span>\u003Cbr>\u003Cspan>data:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>url:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>https://argocd.example.com\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>oidc.config:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">|\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    name: Keycloak\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    issuer: https://keycloak.example.com/realms/master\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    clientID: argocd\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    clientSecret: $oidc.keycloak.clientSecret\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    requestedScopes:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    - openid\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    - profile\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    - email\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    - groups\u003C/span>\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch2 data-tool=\"mdnice编辑器\">\u003Cbr>\u003C/h2>","# 一、概述\n\n### 1.1 背景介绍\n\nGitOps 作为云原生时代的运维范式，将 Git 作为基础设施和应用配置的单一事实来源，通过声明式配置和自动化同步机制，实现了配置管理的版本控制、审计追溯和快速回滚。ArgoCD 作为 CNCF 毕业项目，提供了完整的 GitOps 工作流，支持多集群管理、RBAC 权限控制、SSO 集成等企业级特性。结合 Kustomize 的配置管理能力，能够优雅地解决多环境配置差异、敏感信息管理、配置复用等问题。\n\n在传统的 CI/CD 流程中，往往由 CI 工具直接执行 kubectl apply，这种推模式存在权限管理复杂、审计困难、状态漂移等问题。ArgoCD 采用拉模式，由运行在集群内的 Controller 主动从 Git 仓库拉取配置并应用，实现了部署权限的收敛和状态的持续同步。\n\n### 1.2 技术特点\n\n- 声明式部署：基于 Kubernetes 资源清单定义期望状态，ArgoCD 自动检测并消除实际状态与期望状态的偏差\n- 多集群管理：单个 ArgoCD 实例可管理数百个 Kubernetes 集群，支持集群级别的 RBAC 和资源隔离\n- 自动同步策略：支持手动同步、自动同步、自动修剪(Prune)、自愈(Self-Heal)等多种策略组合\n- 回滚与审计：完整记录每次同步操作，支持一键回滚到任意历史版本，所有变更可追溯到 Git commit\n- 健康检查：内置对 Deployment、StatefulSet、Service、Ingress 等资源的健康检查，支持自定义健康检查脚本\n- SSO 集成：支持 OAuth2、OIDC、SAML、LDAP 等多种认证方式，可与企业统一认证系统集成\n- 渐进式交付：集成 Argo Rollouts 实现蓝绿部署、金丝雀发布、流量分析等高级发布策略\n\n### 1.3 适用场景\n\n- 场景一：多环境配置管理，通过 Kustomize overlay 机制管理 dev/staging/prod 等环境的配置差异，避免重复维护相似配置\n- 场景二：多集群应用分发，使用 ApplicationSet 批量创建 Application，实现应用在多个集群、多个命名空间的标准化部署\n- 场景三：基础设施即代码，将集群基础组件(Ingress Controller、监控栈、日志收集等)以 GitOps 方式管理，实现集群配置的版本化\n- 场景四：合规审计与权限管控，所有变更通过 Git PR 审批，部署操作由 ArgoCD 执行，开发人员无需直接访问生产集群\n- 场景五：灾难恢复，集群配置存储在 Git，可快速在新集群重建全部应用，Recovery Time 从小时级降至分钟级\n\n### 1.4 环境要求\n\n组件\n\n版本要求\n\n说明\n\n操作系统\n\nLinux 内核 4.x+\n\n推荐 Ubuntu 20.04/22.04 或 RHEL 8+\n\nKubernetes\n\n1.24+\n\nArgoCD 2.9+ 要求 Kubernetes 1.24+\n\nkubectl\n\n与 K8s 版本匹配\n\n用于初始安装和手动干预\n\nGit 仓库\n\nGitHub/GitLab/Gitea\n\n支持 HTTPS/SSH 认证，建议配置 Webhook\n\nKustomize\n\n内置于 kubectl\n\nArgoCD 内置 Kustomize 5.0+\n\n硬件配置\n\n2C4G(最小)\n\n生产环境推荐 4C8G，HA 部署需 3 副本\n\n---\n\n## 二、详细步骤\n\n### 2.1 准备工作\n\n#### 2.1.1 系统检查\n\n```\n# 验证 Kubernetes 集群状态kubectl cluster-infokubectl get nodeskubectl version --short# 检查集群资源配额kubectl top nodeskubectl describe quota --all-namespaces# 验证存储类（ArgoCD 需要持久化存储）kubectl get storageclass\n```\n\n#### 2.1.2 安装依赖\n\n```\n# 创建 ArgoCD 命名空间kubectl create namespace argocd# 安装 ArgoCD（使用官方稳定版本）kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml# 等待所有组件就绪kubectl wait --for=condition=available --timeout=600s \\  deployment/argocd-server \\  deployment/argocd-repo-server \\  deployment/argocd-dex-server \\  deployment/argocd-redis \\  -n argocd# 安装 ArgoCD CLIVERSION=$(curl -s https://api.github.com/repos/argoproj/argo-cd/releases/latest | grep tag_name | cut -d '\"' -f 4)curl -sSL -o argocd-linux-amd64 \"https://github.com/argoproj/argo-cd/releases/download/${VERSION}/argocd-linux-amd64\"sudo install -m 555 argocd-linux-amd64 /usr/local/bin/argocdrm argocd-linux-amd64# 验证安装argocd version\n```\n\n### 2.2 核心配置\n\n#### 2.2.1 暴露 ArgoCD API Server\n\n```\n# 方式一：LoadBalancer（云环境推荐）kubectl patch svc argocd-server -n argocd -p '{\"spec\": {\"type\": \"LoadBalancer\"}}'# 方式二：Ingress（内网环境推荐）cat\n```\n\n**说明**\n：生产环境建议使用 Ingress + TLS 证书，避免暴露 LoadBalancer 公网 IP。SSL Passthrough 保证端到端加密，ArgoCD Server 使用自签名证书或配置自定义证书。\n\n#### 2.2.2 初始化 ArgoCD\n\n```\n# 获取初始 admin 密码ARGOCD_PASSWORD=$(kubectl -n argocd get secret argocd-initial-admin-secret \\  -o jsonpath=\"{.data.password}\" | base64 -d)echo \"ArgoCD admin password: ${ARGOCD_PASSWORD}\"# 登录 ArgoCDargocd login argocd.example.com --username admin --password \"${ARGOCD_PASSWORD}\" --grpc-web# 修改 admin 密码argocd account update-password# 删除初始密码 Secret（安全加固）kubectl -n argocd delete secret argocd-initial-admin-secret\n```\n\n#### 2.2.3 配置 Git 仓库凭证\n\n```\n# 方式一：HTTPS 认证（使用 Personal Access Token）argocd repo add https://github.com/your-org/your-repo.git \\  --username git \\  --password ghp_xxxxxxxxxxxxxxxxxxxx \\  --name my-repo# 方式二：SSH 认证（推荐）# 生成 SSH 密钥对ssh-keygen -t ed25519 -C \"argocd@example.com\" -f ~/.ssh/argocd_ed25519 -N \"\"# 将公钥添加到 Git 仓库的 Deploy Keyscat ~/.ssh/argocd_ed25519.pub# 添加私钥到 ArgoCDargocd repo add git@github.com:your-org/your-repo.git \\  --ssh-private-key-path ~/.ssh/argocd_ed25519 \\  --name my-repo# 验证仓库连接argocd repo list\n```\n\n**参数说明**\n：\n\n- --insecure-skip-server-verification：跳过 Git 服务器 TLS 验证（自签名证书场景）\n- --proxy：配置代理服务器访问外部 Git 仓库\n- --enable-lfs：启用 Git LFS 支持大文件\n\n### 2.3 启动和验证\n\n#### 2.3.1 创建 Application\n\n```\n# application.yamlapiVersion: argoproj.io/v1alpha1kind: Applicationmetadata:  name: guestbook  namespace: argocd  # Finalizer 确保删除 Application 时同步删除已部署资源  finalizers:  - resources-finalizer.argocd.argoproj.iospec:  project: default  source:    # Git 仓库地址    repoURL: https://github.com/argoproj/argocd-example-apps.git    targetRevision: HEAD    path: guestbook  destination:    server: https://kubernetes.default.svc    namespace: default  syncPolicy:    automated:      prune: true      # 自动删除 Git 中不存在的资源      selfHeal: true   # 自动修复手动修改      allowEmpty: false    syncOptions:    - CreateNamespace=true  # 自动创建目标命名空间    retry:      limit: 5      backoff:        duration: 5s        factor: 2        maxDuration: 3m\n```\n\n```\n# 应用配置kubectl apply -f application.yaml# 查看 Application 状态argocd app get guestbook# 查看同步历史argocd app history guestbook# 手动触发同步argocd app sync guestbook# 查看实时日志argocd app logs guestbook --follow\n```\n\n#### 2.3.2 功能验证\n\n```\n# 验证 Application 健康状态argocd app list# 预期输出：# NAME        CLUSTER                         NAMESPACE  PROJECT  STATUS  HEALTH   SYNCPOLICY# guestbook   https://kubernetes.default.svc  default    default  Synced  Healthy  Auto-Prune# 验证资源同步状态kubectl get all -n default -l app.kubernetes.io/instance=guestbook# 测试自愈功能（手动修改资源）kubectl scale deployment guestbook-ui -n default --replicas=5# 等待 3 秒，ArgoCD 自动恢复副本数# 测试修剪功能（从 Git 删除资源）# 1. 从 Git 仓库删除某个 YAML 文件并提交# 2. 观察 ArgoCD 自动删除对应资源argocd app wait guestbook --health\n```\n\n---\n\n## 三、示例代码和配置\n\n### 3.1 完整配置示例\n\n#### 3.1.1 Kustomize 多环境配置结构\n\n```\n# 仓库目录结构├── base/│   ├── kustomization.yaml│   ├── deployment.yaml│   ├── service.yaml│   └── configmap.yaml├── overlays/│   ├── dev/│   │   ├── kustomization.yaml│   │   ├── replica-patch.yaml│   │   └── configmap-patch.yaml│   ├── staging/│   │   ├── kustomization.yaml│   │   └── resources-patch.yaml│   └── prod/│       ├── kustomization.yaml│       ├── replica-patch.yaml│       ├── hpa.yaml│       └── pdb.yaml\n```\n\n```\n# base/kustomization.yamlapiVersion: kustomize.config.k8s.io/v1beta1kind: Kustomizationresources:- deployment.yaml- service.yaml- configmap.yamlcommonLabels:  app: myapp  managed-by: argocdnamespace: myappimages:- name: myapp  newName: registry.example.com/myapp  newTag: latest\n```\n\n```\n# base/deployment.yamlapiVersion: apps/v1kind: Deploymentmetadata:  name: myappspec:  replicas: 1  selector:    matchLabels:      app: myapp  template:    metadata:      labels:        app: myapp    spec:      containers:      - name: myapp        image: myapp        ports:        - containerPort: 8080        resources:          requests:            cpu: 100m            memory: 128Mi          limits:            cpu: 500m            memory: 512Mi        envFrom:        - configMapRef:            name: myapp-config        livenessProbe:          httpGet:            path: /health            port: 8080          initialDelaySeconds: 30          periodSeconds: 10        readinessProbe:          httpGet:            path: /ready            port: 8080          initialDelaySeconds: 5          periodSeconds: 5\n```\n\n```\n# overlays/prod/kustomization.yamlapiVersion: kustomize.config.k8s.io/v1beta1kind: Kustomizationnamespace: myapp-prodbases:- ../../basepatchesStrategicMerge:- replica-patch.yamlresources:- hpa.yaml- pdb.yamlimages:- name: myapp  newTag: v1.2.3  # 生产环境固定版本configMapGenerator:- name: myapp-config  behavior: merge  literals:  - LOG_LEVEL=info  - ENVIRONMENT=production  - DB_POOL_SIZE=50\n```\n\n```\n# overlays/prod/replica-patch.yamlapiVersion: apps/v1kind: Deploymentmetadata:  name: myappspec:  replicas: 5  template:    spec:      containers:      - name: myapp        resources:          requests:            cpu: 500m            memory: 1Gi          limits:            cpu: 2000m            memory: 4Gi\n```\n\n```\n# overlays/prod/hpa.yamlapiVersion: autoscaling/v2kind: HorizontalPodAutoscalermetadata:  name: myappspec:  scaleTargetRef:    apiVersion: apps/v1    kind: Deployment    name: myapp  minReplicas: 5  maxReplicas: 20  metrics:  - type: Resource    resource:      name: cpu      target:        type: Utilization        averageUtilization: 70  - type: Resource    resource:      name: memory      target:        type: Utilization        averageUtilization: 80  behavior:    scaleDown:      stabilizationWindowSeconds: 300      policies:      - type: Percent        value: 50        periodSeconds: 60    scaleUp:      stabilizationWindowSeconds: 0      policies:      - type: Percent        value: 100        periodSeconds: 30      - type: Pods        value: 4        periodSeconds: 30      selectPolicy: Max\n```\n\n#### 3.1.2 ApplicationSet 批量管理\n\n```\n# applicationset.yaml - 多集群部署apiVersion: argoproj.io/v1alpha1kind: ApplicationSetmetadata:  name: myapp-multi-cluster  namespace: argocdspec:  generators:  - matrix:      generators:      - git:          repoURL: https://github.com/your-org/your-repo.git          revision: HEAD          directories:          - path: overlays/*      - clusters:          selector:            matchLabels:              environment: production  template:    metadata:      name: 'myapp-{{path.basename}}-{{name}}'    spec:      project: default      source:        repoURL: https://github.com/your-org/your-repo.git        targetRevision: HEAD        path: '{{path}}'      destination:        server: '{{server}}'        namespace: 'myapp-{{path.basename}}'      syncPolicy:        automated:          prune: true          selfHeal: true        syncOptions:        - CreateNamespace=true\n```\n\n### 3.2 实际应用案例\n\n#### 案例一：配置敏感信息管理\n\n**场景描述**\n：使用 Sealed Secrets 或 External Secrets Operator 管理数据库密码、API Key 等敏感信息，避免明文存储在 Git 仓库。\n\n**实现代码**\n：\n\n```\n# 安装 Sealed Secrets Controllerkubectl apply -f https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.24.0/controller.yaml# 创建 Secret 并加密echo -n 'my-db-password' | kubectl create secret generic db-credentials \\  --dry-run=client \\  --from-file=password=/dev/stdin \\  -o yaml | \\kubeseal -o yaml > sealed-secret.yaml# sealed-secret.yaml（可安全提交到 Git）apiVersion: bitnami.com/v1alpha1kind: SealedSecretmetadata:  name: db-credentials  namespace: defaultspec:  encryptedData:    password: AgBy3i4OJSWK+PiTySYZZA9rO43cGDEq...  template:    metadata:      name: db-credentials      namespace: default    type: Opaque\n```\n\n**运行结果**\n：\n\n```\n# ArgoCD 同步后自动解密为 Secretkubectl get secret db-credentials -o jsonpath='{.data.password}' | base64 -d# 输出：my-db-password\n```\n\n#### 案例二：RBAC 权限配置\n\n**场景描述**\n：为开发团队配置只读权限，仅允许查看 dev 环境应用状态，禁止同步操作；为运维团队配置全部环境的管理权限。\n\n**实现步骤**\n：\n\n1. 创建 AppProject 隔离资源\n\n```\n# project-dev.yamlapiVersion: argoproj.io/v1alpha1kind: AppProjectmetadata:  name: dev-project  namespace: argocdspec:  description: Development environment project  sourceRepos:  - 'https://github.com/your-org/*'  destinations:  - namespace: 'dev-*'    server: https://kubernetes.default.svc  clusterResourceWhitelist:  - group: ''    kind: Namespace  namespaceResourceWhitelist:  - group: 'apps'    kind: Deployment  - group: ''    kind: Service  - group: ''    kind: ConfigMap  roles:  - name: developer    description: Read-only access to dev apps    policies:    - p, proj:dev-project:developer, applications, get, dev-project/*, allow    - p, proj:dev-project:developer, logs, get, dev-project/*, allow    groups:    - dev-team\n```\n\n1. 配置 ArgoCD RBAC\n\n```\n# argocd-rbac-cm ConfigMapapiVersion: v1kind: ConfigMapmetadata:  name: argocd-rbac-cm  namespace: argocddata:  policy.default: role:readonly  policy.csv: |    # 运维团队全部权限    g, ops-team, role:admin    # 开发团队限制权限    p, role:developer, applications, get, */*, allow    p, role:developer, applications, sync, dev-project/*, allow    p, role:developer, logs, get, */*, allow    g, dev-team, role:developer    # 禁止删除生产应用    p, role:developer, applications, delete, prod-project/*, deny\n```\n\n1. 集成 OIDC SSO（以 Keycloak 为例）\n\n```\n# argocd-cm ConfigMapapiVersion: v1kind: ConfigMapmetadata:  name: argocd-cm  namespace: argocddata:  url: https://argocd.example.com  oidc.config: |    name: Keycloak    issuer: https://keycloak.example.com/realms/master    clientID: argocd    clientSecret: $oidc.keycloak.clientSecret    requestedScopes:    - openid    - profile    - email    - groups\n```\n\n##","/article/117",310,"2026-01-06 11:45:03","2026-01-06 11:48:56",{"id":354,"category_id":40,"title":355,"keywords":356,"description":357,"image_url":6,"content":358,"content_md":359,"url":360,"hits":361,"is_recommend":73,"is_top":73,"create_time":362,"update_time":363},116,"运维部门年度2025工作总结与2026工作规划应该如何写？","运维部门年度2025工作总结,2026工作规划","2025年，运维部在公司“数字化转型深化”战略引领下，以“稳定为基、效率为纲、安全为盾、创新为翼”为核心导向，全面支撑核心业务系统运行、推动技术架构迭代、强化团队能力建设。 全年实现核心业务系统可用性99.985%，较2024年提升0.02个百分点；故障平均恢复时间（MTTR）从42分钟压缩至29分钟，下降31%；云资源成本同比降低16.8%，自动化运维覆盖率从65%提升至83%，未发生重大生产安全事故，圆满完成年度目标。现将全年工作及2026年规划汇报如下：2025年核心工作成果（数","\u003Csection data-pm-slice=\"0 0 []\" class=\"js_darkmode__0\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">2025年，运维部在公司“数字化转型深化”战略引领下，以“稳定为基、效率为纲、安全为盾、创新为翼”为核心导向，全面支撑核心业务系统运行、推动技术架构迭代、强化团队能力建设。\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"> 全年实现核心业务系统可用性99.985%，较2024年提升0.02个百分点；故障平均恢复时间（MTTR）从42分钟压缩至29分钟，下降31%；云资源成本同比降低16.8%，自动化运维覆盖率从65%提升至83%，未发生重大生产安全事故，圆满完成年度目标。\u003C/span>\u003C/section>\u003Csection class=\"js_darkmode__1\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">现将全年工作及2026年规划汇报如下：\u003C/span>\u003C/section>\u003Csection style=\"text-align: justify;\">\u003Csvg width=\"102\" height=\"71\" viewBox=\"0 0 102 71\" xmlns=\"http://www.w3.org/2000/svg\" role=\"img\" aria-label=\"插图\">\u003Cpath d=\"M18.984 70.96C12.52 70.96 7.752 68.976 4.68 65.008C1.608 61.04 0.0720001 55.408 0.0720001 48.112C0.0720001 43.952 0.36 39.888 0.936 35.92C1.512 31.952 2.376 28.208 3.528 24.688C4.68 21.104 6.088 17.84 7.752 14.896C9.48 11.952 11.464 9.392 13.704 7.216C15.944 5.04 18.44 3.376 21.192 2.224C24.008 1.008 27.048 0.399998 30.312 0.399998C33.256 0.399998 35.88 0.847998 38.184 1.744C40.488 2.576 42.44 3.888 44.04 5.68C45.704 7.472 46.952 9.776 47.784 12.592C48.616 15.408 49.032 18.736 49.032 22.576C49.032 26.608 48.776 30.608 48.264 34.576C47.752 38.544 46.984 42.352 45.96 46C44.936 49.584 43.592 52.912 41.928 55.984C40.328 58.992 38.408 61.616 36.168 63.856C33.992 66.096 31.464 67.856 28.584 69.136C25.704 70.352 22.504 70.96 18.984 70.96ZM20.136 59.248C21.672 59.248 23.08 58.704 24.36 57.616C25.704 56.464 26.92 54.928 28.008 53.008C29.096 51.088 30.056 48.88 30.888 46.384C31.72 43.888 32.424 41.264 33 38.512C33.64 35.696 34.088 32.88 34.344 30.064C34.664 27.248 34.824 24.592 34.824 22.096C34.824 18.64 34.344 16.112 33.384 14.512C32.424 12.912 30.984 12.112 29.064 12.112C27.464 12.112 25.992 12.72 24.648 13.936C23.304 15.152 22.088 16.784 21 18.832C19.912 20.88 18.92 23.216 18.024 25.84C17.192 28.4 16.488 31.056 15.912 33.808C15.4 36.496 14.984 39.12 14.664 41.68C14.408 44.176 14.28 46.416 14.28 48.4C14.28 51.92 14.696 54.608 15.528 56.464C16.424 58.32 17.96 59.248 20.136 59.248ZM81.075 31.12C81.331 30.032 81.651 28.72 82.035 27.184C82.419 25.584 82.835 23.952 83.283 22.288C83.795 20.56 84.243 19.024 84.627 17.68C84.051 18.128 83.155 18.832 81.939 19.792C80.723 20.688 79.603 21.456 78.579 22.096L69.459 27.856L63.219 17.776L89.715 1.456H101.427L86.931 70H72.627L81.075 31.12Z\" fill=\"#2f69ff26\">\u003C/path>\u003C/svg>\u003Csection>\u003Cspan class=\"js_darkmode__2\">\u003Cspan leaf=\"\">2025年核心工作成果（数据驱动，聚焦业务价值）\u003C/span>\u003C/span>\u003C/section>\u003C/section>\u003Csection data-level=\"3\" style=\"text-align: justify;\">\u003Csection>\u003Cb>\u003Cspan>\u003Cspan leaf=\"\">1、\u003C/span>\u003C/span>系统稳定性保障：构建全链路韧性体系，支撑业务无间断运行\u003C/b>\u003C/section>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cspan leaf=\"\">以“事前预防、事中速决、事后复盘”为闭环，打造覆盖“业务-应用-基础设施”的全栈保障能力，全年支撑61场重大业务活动（含“双11”“618”等峰值场景）零故障。\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/p>\u003Csection class=\"js_darkmode__5\" style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__6\">\u003Cspan leaf=\"\">1. 故障响应体系升级：建立“三级故障分级响应机制”，明确P1（核心业务中断）、P2（非核心业务中断）、P3（性能下降）故障的响应流程与责任矩阵。\u003C/span>\u003C/strong>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">通过引入“故障复盘四步法”（现象还原-日志溯源-链路追踪-预案更新），完成92次深度复盘，形成《15类高频故障应对SOP手册》，使同类故障复发率下降72%。\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">Q3电商大促期间，成功处置商品详情页缓存击穿事件，通过紧急扩容与缓存策略优化，将数据库QPS峰值从8万降至4.8万，保障交易流畅。\u003C/span>\u003C/section>\u003Csection class=\"js_darkmode__7\" style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__8\">\u003Cspan leaf=\"\">2. 容灾能力跨越式提升：完成主数据中心与异地灾备中心“双活架构”改造，核心系统恢复点目标（RPO）从15分钟缩短至5分钟，恢复时间目标（RTO）从2小时压缩至30分钟。\u003C/span>\u003C/strong>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">针对金融支付等关键业务线，部署“多活单元化架构”，11月某机房因市政施工断电时，实现流量自动切换，保障交易0中断。\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">全年开展8次全量容灾演练，覆盖数据库、中间件、网络等核心组件，演练通过率100%。\u003C/span>\u003C/section>\u003Csection class=\"js_darkmode__9\" style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__10\">\u003Cspan leaf=\"\">3. 监控预警精准化落地：迭代升级智能监控平台，整合APM（应用性能监控）、日志分析、指标采集三大模块，构建“业务健康度仪表盘”，实时展示用户访问成功率、关键接口耗时等28项核心指标。\u003C/span>\u003C/strong>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cp>\u003Cspan leaf=\"\">新增基于机器学习的异常检测规则268条，将告警误报率从32%降至7%，全年提前发现并处置风险隐患47起，避免故障扩大化12次。\u003C/span>\u003C/p>\u003Cp>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/p>\u003C/section>\u003Csection data-level=\"3\" style=\"text-align: justify;\">\u003Csection>\u003Cb>\u003Cspan>\u003Cspan leaf=\"\">2、\u003C/span>\u003C/span>技术架构优化：深化云原生转型，实现降本增效双提升\u003C/b>\u003C/section>\u003C/section>\u003Csection class=\"js_darkmode__12\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">以云原生技术为核心驱动力，推动运维模式从“被动支撑”向“主动赋能”转型，全年通过技术优化实现直接成本节约1420万元。\u003C/span>\u003C/section>\u003Csection class=\"js_darkmode__13\" style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__14\">\u003Cspan leaf=\"\">1. 云原生迁移与治理：完成91个传统应用的容器化改造，容器化覆盖率达94%；基于K8s构建弹性集群，通过自动扩缩容策略将资源利用率从48%提升至71%，大促期间集群资源峰值使用量降低32%。\u003C/span>\u003C/strong>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">自主研发“云原生运维平台”，集成镜像管理、灰度发布、故障注入等功能，使应用部署效率提升55%，发布失败率从8%降至1.5%。\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">Q4试点Serverless架构用于活动页面生成，资源成本降低68%。\u003C/span>\u003C/section>\u003Csection class=\"js_darkmode__15\" style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__16\">\u003Cspan leaf=\"\">2. 自动化运维纵深推进：构建覆盖“配置管理-变更发布-故障处理”的全流程自动化工具链，开发“变更风险评估引擎”，通过历史数据训练模型识别高风险操作，全年高风险变更引发的故障下降65%。\u003C/span>\u003C/strong>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">数据库运维领域，上线“智能调优助手”，自动分析慢SQL并推荐索引优化方案，使数据库平均QPS提升28%，DBA人工工作量减少45%。\u003C/span>\u003C/section>\u003Csection class=\"js_darkmode__17\" style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__18\">\u003Cspan leaf=\"\">3. 成本精细化管控：建立“云资源全生命周期管理系统”，实现资源申请、使用、回收的闭环追踪。\u003C/span>\u003C/strong>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cp>\u003Cspan leaf=\"\">通过闲置资源扫描（CPU利用率＜10%持续7天自动预警）、冗余实例合并、按需付费模式切换等措施，节省云资源成本980万元；对数据中心空调系统进行AI温控改造，PUE值从1.52降至1.32，全年节省电费210万元；通过存储分层策略将冷数据迁移至对象存储，存储成本降低26%。\u003C/span>\u003C/p>\u003Cp>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/p>\u003C/section>\u003Csection data-level=\"3\" style=\"text-align: justify;\">\u003Csection>\u003Cb>\u003Cspan>\u003Cspan leaf=\"\">3、\u003C/span>\u003C/span>安全防护体系：构建纵深防御，守护数据与业务安全\u003C/b>\u003C/section>\u003C/section>\u003Csection class=\"js_darkmode__20\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">围绕“网络安全、数据安全、应用安全”构建三维防护体系，全年安全事件响应及时率100%，未发生敏感数据泄露事件。\u003C/span>\u003C/section>\u003Csection class=\"js_darkmode__21\" style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__22\">\u003Cspan leaf=\"\">1. 网络安全加固：部署零信任访问控制系统（ZTNA），将传统边界防护升级为“身份+设备+环境”多因子认证，外部攻击拦截率从93%提升至98.5%。\u003C/span>\u003C/strong>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">全年检测并阻断DDoS攻击256次，最大攻击流量达920Gbps，均通过云清洗服务成功化解；升级核心交换机至400G端口，骨干网带宽扩容至200G，南北向流量延迟从14ms降至7ms。\u003C/span>\u003C/section>\u003Csection class=\"js_darkmode__23\" style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__24\">\u003Cspan leaf=\"\">2. 数据安全全生命周期保障：落地《数据分类分级指南》，对用户信息、财务数据等核心敏感数据实现100%加密存储、96%场景脱敏传输；部署数据库审计系统，全年拦截越权访问158次，记录操作日志6200万条。\u003C/span>\u003C/strong>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">每季度开展数据备份有效性验证，关键数据恢复成功率100%，确保数据“可防、可查、可恢复”。\u003C/span>\u003C/section>\u003Csection class=\"js_darkmode__25\" style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__26\">\u003Cspan leaf=\"\">3. 应用安全协同治理：与研发部门共建“DevSecOps”流程，在需求评审阶段嵌入安全要求，全年扫描发现应用漏洞1326个（高危18个），修复率100%。\u003C/span>\u003C/strong>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cp>\u003Cspan leaf=\"\">组织5次渗透测试（含2次外部第三方测试），整改SQL注入、逻辑漏洞等风险点32个；上线API网关安全模块，拦截恶意接口调用15.6万次。\u003C/span>\u003C/p>\u003Cp>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/p>\u003C/section>\u003Csection data-level=\"3\" style=\"text-align: justify;\">\u003Csection>\u003Cb>\u003Cspan>\u003Cspan leaf=\"\">4、\u003C/span>\u003C/span>团队能力建设：夯实人才根基，提升协同效能\u003C/b>\u003C/section>\u003C/section>\u003Csection class=\"js_darkmode__28\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">以“能力矩阵构建+协作机制优化”为核心，打造一支“懂技术、懂业务、能攻坚”的运维团队。\u003C/span>\u003C/section>\u003Csection class=\"js_darkmode__29\" style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__30\">\u003Cspan leaf=\"\">1. 技术能力体系化提升：基于运维开发、云运维、数据库运维等岗位，制定“三阶九维”能力模型，明确各层级技能要求。\u003C/span>\u003C/strong>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">全年开展内部培训36场（含K8s高级运维、AIOps实践等主题），外部认证培训18场，团队成员人均学习时长92小时。\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">新增ITIL 4、AWS DevOps等高级认证15人，团队持证率从38%提升至58%，培养4名高级运维工程师。\u003C/span>\u003C/section>\u003Csection class=\"js_darkmode__31\" style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__32\">\u003Cspan leaf=\"\">2. 跨部门协作效能升级：与研发、业务部门组建“跨职能敏捷小组”，推行“运维前移”模式，在需求阶段输出《可运维性设计规范》，使新系统上线故障率下降38%。\u003C/span>\u003C/strong>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">共建DevOps协同平台，打通代码提交-测试-部署-监控全流程，应用发布频率从每周2次提升至每日4次。\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">全年组织跨部门应急演练10次，协作效率提升45%。\u003C/span>\u003C/section>\u003Csection class=\"js_darkmode__33\" style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__34\">\u003Cspan leaf=\"\">3. 知识与文化建设：推行“运维质量积分制”，将故障处理、技术分享等行为量化与绩效挂钩，激发团队主动性；建立“运维知识库”，收录故障案例、操作手册等1300+条目，月均搜索量2100次，知识复用率提升60%。\u003C/span>\u003C/strong>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">通过“运维开放日”活动向全公司传递运维价值，收到业务部门有效建议52条，采纳率86%。\u003C/span>\u003C/section>\u003Csection style=\"text-align: justify;\">\u003Csvg width=\"107\" height=\"71\" viewBox=\"0 0 107 71\" xmlns=\"http://www.w3.org/2000/svg\" role=\"img\" aria-label=\"插图\">\u003Cpath d=\"M18.984 70.96C12.52 70.96 7.752 68.976 4.68 65.008C1.608 61.04 0.0720001 55.408 0.0720001 48.112C0.0720001 43.952 0.36 39.888 0.936 35.92C1.512 31.952 2.376 28.208 3.528 24.688C4.68 21.104 6.088 17.84 7.752 14.896C9.48 11.952 11.464 9.392 13.704 7.216C15.944 5.04 18.44 3.376 21.192 2.224C24.008 2.008 27.048 0.399998 30.312 0.399998C33.256 0.399998 35.88 0.847998 38.184 2.744C40.488 2.576 42.44 3.888 44.04 5.68C45.704 7.472 46.952 9.776 47.784 12.592C48.616 15.408 49.032 18.736 49.032 22.576C49.032 26.608 48.776 30.608 48.264 34.576C47.752 38.544 46.984 42.352 45.96 46C44.936 49.584 43.592 52.912 41.928 55.984C40.328 58.992 38.408 61.616 36.168 63.856C33.992 66.096 31.464 67.856 28.584 69.136C25.704 70.352 22.504 70.96 18.984 70.96ZM20.136 59.248C21.672 59.248 23.08 58.704 24.36 57.616C25.704 56.464 26.92 54.928 28.008 53.008C29.096 51.088 30.056 48.88 30.888 46.384C31.72 43.888 32.424 41.264 33 38.512C33.64 35.696 34.088 32.88 34.344 30.064C34.664 27.248 34.824 24.592 34.824 22.096C34.824 18.64 34.344 16.112 33.384 14.512C32.424 12.912 30.984 12.112 29.064 12.112C27.464 12.112 25.992 12.72 24.648 13.936C23.304 15.152 22.088 16.784 21 18.832C19.912 20.88 18.92 23.216 18.024 25.84C17.192 28.4 16.488 31.056 15.912 33.808C15.4 36.496 14.984 39.12 14.664 41.68C14.408 44.176 14.28 46.416 14.28 48.4C14.28 51.92 14.696 54.608 15.528 56.464C16.424 58.32 17.96 59.248 20.136 59.248ZM52.371 70L54.387 60.016L76.755 40.144C79.571 37.648 81.907 35.44 83.763 33.52C85.683 31.6 87.219 29.84 88.371 28.24C89.523 26.64 90.355 25.168 90.867 23.824C91.379 22.48 91.635 21.136 91.635 19.792C91.635 17.424 90.995 15.632 89.715 14.416C88.435 13.2 86.707 12.592 84.531 12.592C82.995 12.592 81.491 12.848 80.019 13.36C78.547 13.872 77.011 14.672 75.411 15.76C73.875 16.784 72.115 18.096 70.131 19.696L63.315 10.192C66.515 7.44 70.003 5.136 73.779 3.27999C77.619 2.424 81.971 0.495996 86.835 0.495996C91.315 0.495996 94.963 2.296 97.779 2.89599C100.659 4.496 102.771 6.576 104.115 9.136C105.459 11.632 106.131 14.32 106.131 17.2C106.131 21.232 105.235 24.912 103.443 28.24C101.715 31.568 99.347 34.736 96.339 37.744C93.331 40.688 89.875 43.76 85.971 46.96L73.395 57.328V57.808H99.987L97.491 70H52.371Z\" fill=\"#2f69ff26\">\u003C/path>\u003C/svg>\u003Csection>\u003Cspan class=\"js_darkmode__35\">\u003Cspan leaf=\"\">2025年存在的核心问题与不足\u003C/span>\u003C/span>\u003C/section>\u003C/section>\u003Cul class=\"list-paddingleft-1\" style=\"text-align: justify;\">\u003Cli>\u003Csection class=\"js_darkmode__36\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__37\">\u003Cspan leaf=\"\">系统韧性存在短板：3个非核心系统（如客服工单系统）仍为冷备模式，RTO达4.5小时，未达公司“关键系统RTO≤1小时”要求；混合云架构下（阿里云+腾讯云），跨云网络延迟偶现波动（峰值达22ms），影响跨区域业务协同。\u003C/span>\u003C/strong>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__38\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__39\">\u003Cspan leaf=\"\">智能化运维深度不足：AIOps目前仅应用于异常检测，故障根因定位、自动修复等场景落地有限，75%的复杂故障仍需人工介入；日志与监控数据关联分析能力弱，跨服务调用链异常的定位平均耗时超1小时。\u003C/span>\u003C/strong>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__40\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__41\">\u003Cspan leaf=\"\">团队能力结构性失衡：云原生、AIOps等新兴领域专家型人才缺口达30%，仅12%的成员具备K8s内核、数据库引擎等源码级调优能力；部分成员对业务逻辑理解不深，需求评审阶段技术建议针对性不足。\u003C/span>\u003C/strong>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__42\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__43\">\u003Cspan leaf=\"\">成本管控颗粒度不够：云资源成本虽有下降，但未实现“按业务线-按项目”的精准分摊，部分业务线存在“重申请、轻管理”现象，资源浪费预警滞后。\u003C/span>\u003C/strong>\u003C/section>\u003C/li>\u003C/ul>\u003Csection style=\"text-align: justify;\">\u003Csvg width=\"107\" height=\"71\" viewBox=\"0 0 107 71\" xmlns=\"http://www.w3.org/2000/svg\" role=\"img\" aria-label=\"插图\">\u003Cpath d=\"M18.984 70.96C12.52 70.96 7.752 68.976 4.68 65.008C1.608 61.04 0.0720001 55.408 0.0720001 48.112C0.0720001 43.952 0.36 39.888 0.936 35.92C1.512 31.952 2.376 28.208 3.528 24.688C4.68 21.104 6.088 17.84 7.752 14.896C9.48 11.952 11.464 9.392 13.704 7.216C15.944 5.04 18.44 3.376 21.192 2.224C24.008 3.008 27.048 0.399998 30.312 0.399998C33.256 0.399998 35.88 0.847998 38.184 3.744C40.488 2.576 42.44 3.888 44.04 5.68C45.704 7.472 46.952 9.776 47.784 12.592C48.616 15.408 49.032 18.736 49.032 22.576C49.032 26.608 48.776 30.608 48.264 34.576C47.752 38.544 46.984 42.352 45.96 46C44.936 49.584 43.592 52.912 41.928 55.984C40.328 58.992 38.408 61.616 36.168 63.856C33.992 66.096 31.464 67.856 28.584 69.136C25.704 70.352 22.504 70.96 18.984 70.96ZM20.136 59.248C21.672 59.248 23.08 58.704 24.36 57.616C25.704 56.464 26.92 54.928 28.008 53.008C29.096 51.088 30.056 48.88 30.888 46.384C31.72 43.888 32.424 41.264 33 38.512C33.64 35.696 34.088 32.88 34.344 30.064C34.664 27.248 34.824 24.592 34.824 22.096C34.824 18.64 34.344 16.112 33.384 14.512C32.424 12.912 30.984 12.112 29.064 12.112C27.464 12.112 25.992 12.72 24.648 13.936C23.304 15.152 22.088 16.784 21 18.832C19.912 20.88 18.92 23.216 18.024 25.84C17.192 28.4 16.488 31.056 15.912 33.808C15.4 36.496 14.984 39.12 14.664 41.68C14.408 44.176 14.28 46.416 14.28 48.4C14.28 51.92 14.696 54.608 15.528 56.464C16.424 58.32 17.96 59.248 20.136 59.248ZM73.491 70.96C69.971 70.96 66.643 70.64 63.507 70C60.371 69.36 57.651 68.432 55.347 67.216V54.736C57.971 56.272 60.819 57.456 63.891 58.288C66.963 59.056 69.939 59.44 72.819 59.44C75.123 59.44 77.203 59.216 79.059 58.768C80.915 58.32 82.515 57.648 83.859 56.752C85.267 55.792 86.323 54.608 87.027 53.2C87.795 51.792 88.179 50.128 88.179 48.208C88.179 46.672 87.795 45.296 87.027 44.08C86.323 42.864 85.107 41.904 83.379 41.2C81.651 40.496 79.219 40.144 76.083 40.144H69.651L71.763 29.776H75.219C77.267 29.776 79.283 29.584 81.267 29.2C83.251 28.816 85.043 28.208 86.643 27.376C88.307 26.544 89.619 25.424 90.579 24.016C91.539 22.608 92.019 20.88 92.019 18.832C92.019 16.976 91.411 15.408 90.195 14.128C88.979 12.848 87.027 12.208 84.339 12.208C81.523 12.208 78.995 12.72 76.755 13.744C74.515 14.768 72.563 15.824 70.899 16.912L64.947 7.31199C68.019 5.26399 71.251 3.63199 74.643 2.41599C78.099 3.136 82.355 0.495996 87.411 0.495996C91.635 0.495996 95.155 3.2 97.971 2.608C100.787 3.952 102.899 5.80799 104.307 8.17599C105.715 10.48 106.419 13.136 106.419 16.144C106.419 19.28 105.779 22.128 104.499 24.688C103.219 27.248 101.331 29.392 98.835 31.12C96.339 32.784 93.299 33.936 89.715 34.576V34.96C93.171 35.6 96.115 37.072 98.547 39.376C100.979 41.68 102.195 45.008 102.195 49.36C102.195 52.048 101.619 54.704 100.467 57.328C99.379 59.888 97.683 62.192 95.379 64.24C93.075 66.288 90.099 67.92 86.451 69.136C82.867 70.352 78.547 70.96 73.491 70.96Z\" fill=\"#2f69ff26\">\u003C/path>\u003C/svg>\u003Csection>\u003Cspan class=\"js_darkmode__44\">\u003Cspan leaf=\"\">2026年工作规划（目标导向，聚焦价值落地）\u003C/span>\u003C/span>\u003C/section>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cspan leaf=\"\">2026年，运维部将以公司“业务规模化扩张+技术创新突破”战略为核心，确立“韧性运维、智能驱动、业务共生”三大目标，重点围绕四大方向开展工作，全年核心指标：核心系统可用性≥99.99%、MTTR≤20分钟、运维成本再降6%、重大故障≤3次。\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/p>\u003Csection data-level=\"3\" style=\"text-align: justify;\">\u003Csection>\u003Cb>\u003Cspan>\u003Cspan leaf=\"\">1、\u003C/span>\u003C/span>攻坚系统韧性提升，构建“零中断”保障体系\u003C/b>\u003C/section>\u003C/section>\u003Csection class=\"js_darkmode__47\" style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__48\">\u003Cspan leaf=\"\">1. 全场景容灾覆盖：Q1前完成客服工单系统、供应链管理系统的双活改造，确保所有关键系统RTO≤1小时、RPO≤5分钟；Q3前引入SD-WAN技术优化混合云网络，将跨云延迟稳定控制在8ms以内，部署跨云流量调度系统实现故障自动切换。\u003C/span>\u003C/strong>\u003C/section>\u003Csection class=\"js_darkmode__49\" style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__50\">\u003Cspan leaf=\"\">2. 混沌工程常态化：建立“混沌实验室”，针对核心系统每月开展1次故障注入演练（覆盖服务器宕机、网络分区等场景），每季度开展1次数据中心级全链路演练。\u003C/span>\u003C/strong>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">制定《混沌工程实施规范》，明确风险控制标准，将“未演练故障场景”占比从25%降至5%。\u003C/span>\u003C/section>\u003Csection class=\"js_darkmode__51\" style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__52\">\u003Cspan leaf=\"\">3. 容量管理精准化：基于业务增长预测（核心交易预计增长35%），构建“业务量-资源需求”预测模型，实现容量需求提前1个月预警。\u003C/span>\u003C/strong>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cp>\u003Cspan leaf=\"\">Q2前完成核心数据库读写分离升级，Q4前部署分布式缓存集群，支撑峰值QPS突破15万。\u003C/span>\u003C/p>\u003Cp>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/p>\u003C/section>\u003Csection data-level=\"3\" style=\"text-align: justify;\">\u003Csection>\u003Cb>\u003Cspan>\u003Cspan leaf=\"\">2、\u003C/span>\u003C/span>深化智能运维应用，推动效率质变\u003C/b>\u003C/section>\u003C/section>\u003Csection class=\"js_darkmode__54\" style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__55\">\u003Cspan leaf=\"\">1. AIOps能力升级：Q2前上线故障根因定位模块，通过调用链分析与日志关联算法，将复杂故障定位时间缩短至15分钟以内；Q4前实现服务器宕机、进程异常等60%常见故障的自动修复，自愈成功率≥85%。\u003C/span>\u003C/strong>\u003C/section>\u003Csection class=\"js_darkmode__56\" style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__57\">\u003Cspan leaf=\"\">2. 自动化场景全覆盖：完成数据库容灾切换、网络配置变更等复杂场景的自动化改造，实现85%以上运维操作自动化；优化CMDB系统，新增“业务-资源”依赖关系图谱，数据更新延迟≤5分钟，为智能决策提供数据支撑。\u003C/span>\u003C/strong>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__59\">\u003Cspan leaf=\"\">3. 多云管理平台建设：Q3前建成统一多云管理平台，实现阿里云、腾讯云资源的集中管控，支持资源一键调度、成本统一核算；引入“弹性GPU计算池”，针对AI训练场景动态分配资源，将GPU利用率从38%提升至75%。\u003C/span>\u003C/strong>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__59\">\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/strong>\u003C/p>\u003Csection data-level=\"3\" style=\"text-align: justify;\">\u003Csection>\u003Cb>\u003Cspan>\u003Cspan leaf=\"\">3、\u003C/span>\u003C/span>筑牢安全防护屏障，保障合规与风险可控\u003C/b>\u003C/section>\u003C/section>\u003Csection class=\"js_darkmode__61\" style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__62\">\u003Cspan leaf=\"\">1. 零信任体系深化：Q1前完成所有老旧系统的零信任适配改造，实现100%业务系统零信任覆盖；部署终端安全管理平台，实现设备安全状态实时监控与异常隔离。\u003C/span>\u003C/strong>\u003C/section>\u003Csection class=\"js_darkmode__63\" style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__64\">\u003Cspan leaf=\"\">2. 数据安全精细化：升级数据脱敏系统，实现报表生成、数据分析等全场景敏感数据脱敏；建立数据安全风险评估机制，每半年开展1次全面审计，确保符合《数据安全法》《个人信息保护法》要求。\u003C/span>\u003C/strong>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__66\">\u003Cspan leaf=\"\">3. 安全应急能力强化：组建专职安全应急团队，制定《多场景安全应急预案》，每季度开展1次专项演练（含勒索病毒、数据泄露等场景），安全事件响应时间≤10分钟。\u003C/span>\u003C/strong>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__66\">\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/strong>\u003C/p>\u003Csection data-level=\"3\" style=\"text-align: justify;\">\u003Csection>\u003Cb>\u003Cspan>\u003Cspan leaf=\"\">4、\u003C/span>\u003C/span>聚焦团队与成本，夯实发展根基\u003C/b>\u003C/section>\u003C/section>\u003Csection class=\"js_darkmode__68\" style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__69\">\u003Cspan leaf=\"\">1. 人才梯队建设：制定“专家培养计划”，通过外部引进与内部培养结合，新增5名云原生、AIOps领域专家；推行“业务导师制”，安排运维工程师参与业务需求评审，提升业务理解能力，Q4前实现团队全员业务认知考核达标。\u003C/span>\u003C/strong>\u003C/section>\u003Csection class=\"js_darkmode__70\" style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__71\">\u003Cspan leaf=\"\">2. 成本管控精准化：建立“按业务线-按项目”的成本分摊机制，每月输出成本分析报告；开发资源浪费智能预警模块，对闲置资源自动触发回收提醒，全年目标节省云资源成本800万元、能耗成本150万元。\u003C/span>\u003C/strong>\u003C/section>\u003Csection class=\"js_darkmode__72\" style=\"text-align: justify;\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__73\">\u003Cspan leaf=\"\">3. 协作机制优化：与业务部门共建“运维服务等级协议（SLA）”，明确响应时效与服务质量标准；每季度召开业务座谈会，主动对接业务需求，提升运维服务满意度至90分以上（满分100分）。\u003C/span>\u003C/strong>\u003C/section>\u003Csection style=\"text-align: justify;\">\u003Csvg width=\"107\" height=\"71\" viewBox=\"0 0 107 71\" xmlns=\"http://www.w3.org/2000/svg\" role=\"img\" aria-label=\"插图\">\u003Cpath d=\"M18.984 70.96C12.52 70.96 7.752 68.976 4.68 65.008C1.608 61.04 0.0720001 55.408 0.0720001 48.112C0.0720001 43.952 0.36 39.888 0.936 35.92C1.512 31.952 2.376 28.208 3.528 24.688C4.68 21.104 6.088 17.84 7.752 14.896C9.48 11.952 11.464 9.392 13.704 7.216C15.944 5.04 18.44 3.376 21.192 2.224C24.008 4.008 27.048 0.399998 30.312 0.399998C33.256 0.399998 35.88 0.847998 38.184 4.744C40.488 2.576 42.44 3.888 44.04 5.68C45.704 7.472 46.952 9.776 47.784 12.592C48.616 15.408 49.032 18.736 49.032 22.576C49.032 26.608 48.776 30.608 48.264 34.576C47.752 38.544 46.984 42.352 45.96 46C44.936 49.584 43.592 52.912 41.928 55.984C40.328 58.992 38.408 61.616 36.168 63.856C33.992 66.096 31.464 67.856 28.584 69.136C25.704 70.352 22.504 70.96 18.984 70.96ZM20.136 59.248C21.672 59.248 23.08 58.704 24.36 57.616C25.704 56.464 26.92 54.928 28.008 53.008C29.096 51.088 30.056 48.88 30.888 46.384C31.72 43.888 32.424 41.264 33 38.512C33.64 35.696 34.088 32.88 34.344 30.064C34.664 27.248 34.824 24.592 34.824 22.096C34.824 18.64 34.344 16.112 33.384 14.512C32.424 12.912 30.984 12.112 29.064 12.112C27.464 12.112 25.992 12.72 24.648 13.936C23.304 15.152 22.088 16.784 21 18.832C19.912 20.88 18.92 23.216 18.024 25.84C17.192 28.4 16.488 31.056 15.912 33.808C15.4 36.496 14.984 39.12 14.664 41.68C14.408 44.176 14.28 46.416 14.28 48.4C14.28 51.92 14.696 54.608 15.528 56.464C16.424 58.32 17.96 59.248 20.136 59.248ZM78.195 70L81.171 55.792H53.523L55.731 44.848L91.827 4.456H106.419L97.299 44.56H105.267L102.867 55.792H94.899L91.923 70H78.195ZM68.979 44.56H83.571L86.259 32.944C86.643 31.28 87.059 29.488 87.507 27.568C88.019 25.648 88.499 23.888 88.947 22.288C89.459 20.624 89.843 19.408 90.099 18.64H89.619C89.171 19.472 88.595 20.368 87.891 21.328C87.251 22.288 86.579 23.28 85.875 24.304C85.171 25.264 84.435 26.192 83.667 27.088L68.979 44.56Z\" fill=\"#2f69ff26\">\u003C/path>\u003C/svg>\u003Csection>\u003Cspan class=\"js_darkmode__74\">\u003Cspan leaf=\"\">保障措施\u003C/span>\u003C/span>\u003C/section>\u003C/section>\u003Col class=\"list-paddingleft-1 js_darkmode__75\" style=\"text-align: justify;\">\u003Cli>\u003Cspan>\u003C/span>\u003Csection class=\"js_darkmode__76\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__77\">\u003Cspan leaf=\"\">组织保障：成立3个专项攻坚小组（韧性体系组、智能运维组、安全合规组），明确组长责任制，确保重点任务落地。\u003C/span>\u003C/strong>\u003C/section>\u003C/li>\u003Cli>\u003Cspan>\u003C/span>\u003Csection class=\"js_darkmode__78\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__79\">\u003Cspan leaf=\"\">资源保障：申请年度专项预算1200万元，用于智能平台建设、人才培养、安全设备采购，保障技术升级需求。\u003C/span>\u003C/strong>\u003C/section>\u003C/li>\u003Cli>\u003Cspan>\u003C/span>\u003Csection class=\"js_darkmode__80\">\u003Cstrong data-id=\"keySentence\" class=\"js_darkmode__81\">\u003Cspan leaf=\"\">考核保障：将核心指标（系统可用性、MTTR、成本节约率）纳入团队与个人KPI，权重占比不低于50%，强化目标导向。\u003C/span>\u003C/strong>\u003C/section>\u003C/li>\u003C/ol>\u003Cp style=\"text-align: justify;\">\u003Cspan leaf=\"\">2026年，运维部将持续以业务价值为核心，通过技术创新与管理优化，打造“更稳定、更智能、更安全”的运维体系，为公司数字化转型提供坚实支撑，助力业务高质量发展。\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan leaf=\"\">\u003Cimg src=\"/uploads/layedit/20260106/026f3c5930bdc6995fa43231d717f8de.png\" alt=\"1.png\">\u003Cbr>\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan leaf=\"\">\u003Cimg src=\"/uploads/layedit/20260106/2094d362aaa9f41ceadd22582fb1b92a.png\" alt=\"2.png\">\u003Cbr>\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan leaf=\"\">\u003Cimg src=\"/uploads/layedit/20260106/dc6d3f7347aeaa0b4f3db5c769a76c19.png\" alt=\"3.png\">\u003Cbr>\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan leaf=\"\">\u003Cimg src=\"/uploads/layedit/20260106/cfe0576f9cb8d6ab9038bb651792e739.png\" alt=\"4.png\">\u003Cbr>\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan leaf=\"\">\u003Cimg src=\"/uploads/layedit/20260106/f93b1f0a3de24aadf7d224a6ec4dd211.png\" alt=\"5.png\">\u003Cbr>\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan leaf=\"\">\u003Cimg src=\"/uploads/layedit/20260106/bdb4c03b501113462aac86bec5b5e245.png\" alt=\"6.png\">\u003Cbr>\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan leaf=\"\">\u003Cimg src=\"/uploads/layedit/20260106/9857db2e38fab054baa4c18e5a578c2e.png\" alt=\"7.png\">\u003Cbr>\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan leaf=\"\">\u003Cimg src=\"/uploads/layedit/20260106/c5d32ebc60778756f1a89a2e1d160999.png\" alt=\"8.png\">\u003Cbr>\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan leaf=\"\">\u003Cimg src=\"/uploads/layedit/20260106/5433371d554940ecc0662ae840237ebf.png\" alt=\"9.png\">\u003Cbr>\u003C/span>\u003C/p>","2025年，运维部在公司“数字化转型深化”战略引领下，以“稳定为基、效率为纲、安全为盾、创新为翼”为核心导向，全面支撑核心业务系统运行、推动技术架构迭代、强化团队能力建设。\n\n 全年实现核心业务系统可用性99.985%，较2024年提升0.02个百分点；故障平均恢复时间（MTTR）从42分钟压缩至29分钟，下降31%；云资源成本同比降低16.8%，自动化运维覆盖率从65%提升至83%，未发生重大生产安全事故，圆满完成年度目标。\n\n现将全年工作及2026年规划汇报如下：\n\n2025年核心工作成果（数据驱动，聚焦业务价值）\n\n**\n\n1、\n\n系统稳定性保障：构建全链路韧性体系，支撑业务无间断运行**\n\n以“事前预防、事中速决、事后复盘”为闭环，打造覆盖“业务-应用-基础设施”的全栈保障能力，全年支撑61场重大业务活动（含“双11”“618”等峰值场景）零故障。\n\n**\n1. 故障响应体系升级：建立“三级故障分级响应机制”，明确P1（核心业务中断）、P2（非核心业务中断）、P3（性能下降）故障的响应流程与责任矩阵。\n**\n\n通过引入“故障复盘四步法”（现象还原-日志溯源-链路追踪-预案更新），完成92次深度复盘，形成《15类高频故障应对SOP手册》，使同类故障复发率下降72%。\n\nQ3电商大促期间，成功处置商品详情页缓存击穿事件，通过紧急扩容与缓存策略优化，将数据库QPS峰值从8万降至4.8万，保障交易流畅。\n\n**\n2. 容灾能力跨越式提升：完成主数据中心与异地灾备中心“双活架构”改造，核心系统恢复点目标（RPO）从15分钟缩短至5分钟，恢复时间目标（RTO）从2小时压缩至30分钟。\n**\n\n针对金融支付等关键业务线，部署“多活单元化架构”，11月某机房因市政施工断电时，实现流量自动切换，保障交易0中断。\n\n全年开展8次全量容灾演练，覆盖数据库、中间件、网络等核心组件，演练通过率100%。\n\n**\n3. 监控预警精准化落地：迭代升级智能监控平台，整合APM（应用性能监控）、日志分析、指标采集三大模块，构建“业务健康度仪表盘”，实时展示用户访问成功率、关键接口耗时等28项核心指标。\n**\n\n新增基于机器学习的异常检测规则268条，将告警误报率从32%降至7%，全年提前发现并处置风险隐患47起，避免故障扩大化12次。\n\n**\n\n2、\n\n技术架构优化：深化云原生转型，实现降本增效双提升**\n\n以云原生技术为核心驱动力，推动运维模式从“被动支撑”向“主动赋能”转型，全年通过技术优化实现直接成本节约1420万元。\n\n**\n1. 云原生迁移与治理：完成91个传统应用的容器化改造，容器化覆盖率达94%；基于K8s构建弹性集群，通过自动扩缩容策略将资源利用率从48%提升至71%，大促期间集群资源峰值使用量降低32%。\n**\n\n自主研发“云原生运维平台”，集成镜像管理、灰度发布、故障注入等功能，使应用部署效率提升55%，发布失败率从8%降至1.5%。\n\nQ4试点Serverless架构用于活动页面生成，资源成本降低68%。\n\n**\n2. 自动化运维纵深推进：构建覆盖“配置管理-变更发布-故障处理”的全流程自动化工具链，开发“变更风险评估引擎”，通过历史数据训练模型识别高风险操作，全年高风险变更引发的故障下降65%。\n**\n\n数据库运维领域，上线“智能调优助手”，自动分析慢SQL并推荐索引优化方案，使数据库平均QPS提升28%，DBA人工工作量减少45%。\n\n**\n3. 成本精细化管控：建立“云资源全生命周期管理系统”，实现资源申请、使用、回收的闭环追踪。\n**\n\n通过闲置资源扫描（CPU利用率＜10%持续7天自动预警）、冗余实例合并、按需付费模式切换等措施，节省云资源成本980万元；对数据中心空调系统进行AI温控改造，PUE值从1.52降至1.32，全年节省电费210万元；通过存储分层策略将冷数据迁移至对象存储，存储成本降低26%。\n\n**\n\n3、\n\n安全防护体系：构建纵深防御，守护数据与业务安全**\n\n围绕“网络安全、数据安全、应用安全”构建三维防护体系，全年安全事件响应及时率100%，未发生敏感数据泄露事件。\n\n**\n1. 网络安全加固：部署零信任访问控制系统（ZTNA），将传统边界防护升级为“身份+设备+环境”多因子认证，外部攻击拦截率从93%提升至98.5%。\n**\n\n全年检测并阻断DDoS攻击256次，最大攻击流量达920Gbps，均通过云清洗服务成功化解；升级核心交换机至400G端口，骨干网带宽扩容至200G，南北向流量延迟从14ms降至7ms。\n\n**\n2. 数据安全全生命周期保障：落地《数据分类分级指南》，对用户信息、财务数据等核心敏感数据实现100%加密存储、96%场景脱敏传输；部署数据库审计系统，全年拦截越权访问158次，记录操作日志6200万条。\n**\n\n每季度开展数据备份有效性验证，关键数据恢复成功率100%，确保数据“可防、可查、可恢复”。\n\n**\n3. 应用安全协同治理：与研发部门共建“DevSecOps”流程，在需求评审阶段嵌入安全要求，全年扫描发现应用漏洞1326个（高危18个），修复率100%。\n**\n\n组织5次渗透测试（含2次外部第三方测试），整改SQL注入、逻辑漏洞等风险点32个；上线API网关安全模块，拦截恶意接口调用15.6万次。\n\n**\n\n4、\n\n团队能力建设：夯实人才根基，提升协同效能**\n\n以“能力矩阵构建+协作机制优化”为核心，打造一支“懂技术、懂业务、能攻坚”的运维团队。\n\n**\n1. 技术能力体系化提升：基于运维开发、云运维、数据库运维等岗位，制定“三阶九维”能力模型，明确各层级技能要求。\n**\n\n全年开展内部培训36场（含K8s高级运维、AIOps实践等主题），外部认证培训18场，团队成员人均学习时长92小时。\n\n新增ITIL 4、AWS DevOps等高级认证15人，团队持证率从38%提升至58%，培养4名高级运维工程师。\n\n**\n2. 跨部门协作效能升级：与研发、业务部门组建“跨职能敏捷小组”，推行“运维前移”模式，在需求阶段输出《可运维性设计规范》，使新系统上线故障率下降38%。\n**\n\n共建DevOps协同平台，打通代码提交-测试-部署-监控全流程，应用发布频率从每周2次提升至每日4次。\n\n全年组织跨部门应急演练10次，协作效率提升45%。\n\n**\n3. 知识与文化建设：推行“运维质量积分制”，将故障处理、技术分享等行为量化与绩效挂钩，激发团队主动性；建立“运维知识库”，收录故障案例、操作手册等1300+条目，月均搜索量2100次，知识复用率提升60%。\n**\n\n通过“运维开放日”活动向全公司传递运维价值，收到业务部门有效建议52条，采纳率86%。\n\n2025年存在的核心问题与不足\n\n- 系统韧性存在短板：3个非核心系统（如客服工单系统）仍为冷备模式，RTO达4.5小时，未达公司“关键系统RTO≤1小时”要求；混合云架构下（阿里云+腾讯云），跨云网络延迟偶现波动（峰值达22ms），影响跨区域业务协同。\n- 智能化运维深度不足：AIOps目前仅应用于异常检测，故障根因定位、自动修复等场景落地有限，75%的复杂故障仍需人工介入；日志与监控数据关联分析能力弱，跨服务调用链异常的定位平均耗时超1小时。\n- 团队能力结构性失衡：云原生、AIOps等新兴领域专家型人才缺口达30%，仅12%的成员具备K8s内核、数据库引擎等源码级调优能力；部分成员对业务逻辑理解不深，需求评审阶段技术建议针对性不足。\n- 成本管控颗粒度不够：云资源成本虽有下降，但未实现“按业务线-按项目”的精准分摊，部分业务线存在“重申请、轻管理”现象，资源浪费预警滞后。\n\n2026年工作规划（目标导向，聚焦价值落地）\n\n2026年，运维部将以公司“业务规模化扩张+技术创新突破”战略为核心，确立“韧性运维、智能驱动、业务共生”三大目标，重点围绕四大方向开展工作，全年核心指标：核心系统可用性≥99.99%、MTTR≤20分钟、运维成本再降6%、重大故障≤3次。\n\n**\n\n1、\n\n攻坚系统韧性提升，构建“零中断”保障体系**\n\n**\n1. 全场景容灾覆盖：Q1前完成客服工单系统、供应链管理系统的双活改造，确保所有关键系统RTO≤1小时、RPO≤5分钟；Q3前引入SD-WAN技术优化混合云网络，将跨云延迟稳定控制在8ms以内，部署跨云流量调度系统实现故障自动切换。\n**\n\n**\n2. 混沌工程常态化：建立“混沌实验室”，针对核心系统每月开展1次故障注入演练（覆盖服务器宕机、网络分区等场景），每季度开展1次数据中心级全链路演练。\n**\n\n制定《混沌工程实施规范》，明确风险控制标准，将“未演练故障场景”占比从25%降至5%。\n\n**\n3. 容量管理精准化：基于业务增长预测（核心交易预计增长35%），构建“业务量-资源需求”预测模型，实现容量需求提前1个月预警。\n**\n\nQ2前完成核心数据库读写分离升级，Q4前部署分布式缓存集群，支撑峰值QPS突破15万。\n\n**\n\n2、\n\n深化智能运维应用，推动效率质变**\n\n**\n1. AIOps能力升级：Q2前上线故障根因定位模块，通过调用链分析与日志关联算法，将复杂故障定位时间缩短至15分钟以内；Q4前实现服务器宕机、进程异常等60%常见故障的自动修复，自愈成功率≥85%。\n**\n\n**\n2. 自动化场景全覆盖：完成数据库容灾切换、网络配置变更等复杂场景的自动化改造，实现85%以上运维操作自动化；优化CMDB系统，新增“业务-资源”依赖关系图谱，数据更新延迟≤5分钟，为智能决策提供数据支撑。\n**\n\n**\n3. 多云管理平台建设：Q3前建成统一多云管理平台，实现阿里云、腾讯云资源的集中管控，支持资源一键调度、成本统一核算；引入“弹性GPU计算池”，针对AI训练场景动态分配资源，将GPU利用率从38%提升至75%。\n**\n\n**\n\n**\n\n**\n\n3、\n\n筑牢安全防护屏障，保障合规与风险可控**\n\n**\n1. 零信任体系深化：Q1前完成所有老旧系统的零信任适配改造，实现100%业务系统零信任覆盖；部署终端安全管理平台，实现设备安全状态实时监控与异常隔离。\n**\n\n**\n2. 数据安全精细化：升级数据脱敏系统，实现报表生成、数据分析等全场景敏感数据脱敏；建立数据安全风险评估机制，每半年开展1次全面审计，确保符合《数据安全法》《个人信息保护法》要求。\n**\n\n**\n3. 安全应急能力强化：组建专职安全应急团队，制定《多场景安全应急预案》，每季度开展1次专项演练（含勒索病毒、数据泄露等场景），安全事件响应时间≤10分钟。\n**\n\n**\n\n**\n\n**\n\n4、\n\n聚焦团队与成本，夯实发展根基**\n\n**\n1. 人才梯队建设：制定“专家培养计划”，通过外部引进与内部培养结合，新增5名云原生、AIOps领域专家；推行“业务导师制”，安排运维工程师参与业务需求评审，提升业务理解能力，Q4前实现团队全员业务认知考核达标。\n**\n\n**\n2. 成本管控精准化：建立“按业务线-按项目”的成本分摊机制，每月输出成本分析报告；开发资源浪费智能预警模块，对闲置资源自动触发回收提醒，全年目标节省云资源成本800万元、能耗成本150万元。\n**\n\n**\n3. 协作机制优化：与业务部门共建“运维服务等级协议（SLA）”，明确响应时效与服务质量标准；每季度召开业务座谈会，主动对接业务需求，提升运维服务满意度至90分以上（满分100分）。\n**\n\n保障措施\n\n1. 组织保障：成立3个专项攻坚小组（韧性体系组、智能运维组、安全合规组），明确组长责任制，确保重点任务落地。\n2. 资源保障：申请年度专项预算1200万元，用于智能平台建设、人才培养、安全设备采购，保障技术升级需求。\n3. 考核保障：将核心指标（系统可用性、MTTR、成本节约率）纳入团队与个人KPI，权重占比不低于50%，强化目标导向。\n\n2026年，运维部将持续以业务价值为核心，通过技术创新与管理优化，打造“更稳定、更智能、更安全”的运维体系，为公司数字化转型提供坚实支撑，助力业务高质量发展。\n\n![1.png](/uploads/layedit/20260106/026f3c5930bdc6995fa43231d717f8de.png)\n\n![2.png](/uploads/layedit/20260106/2094d362aaa9f41ceadd22582fb1b92a.png)\n\n![3.png](/uploads/layedit/20260106/dc6d3f7347aeaa0b4f3db5c769a76c19.png)\n\n![4.png](/uploads/layedit/20260106/cfe0576f9cb8d6ab9038bb651792e739.png)\n\n![5.png](/uploads/layedit/20260106/f93b1f0a3de24aadf7d224a6ec4dd211.png)\n\n![6.png](/uploads/layedit/20260106/bdb4c03b501113462aac86bec5b5e245.png)\n\n![7.png](/uploads/layedit/20260106/9857db2e38fab054baa4c18e5a578c2e.png)\n\n![8.png](/uploads/layedit/20260106/c5d32ebc60778756f1a89a2e1d160999.png)\n\n![9.png](/uploads/layedit/20260106/5433371d554940ecc0662ae840237ebf.png)","/article/116",297,"2026-01-06 11:20:58","2026-01-06 11:44:04",{"id":365,"category_id":40,"title":366,"keywords":367,"description":368,"image_url":6,"content":369,"content_md":370,"url":371,"hits":372,"is_recommend":73,"is_top":73,"create_time":373,"update_time":374},115,"Kubernetes 100个常用命令","100 个 Kubectl 命令","这篇文章是关于使用 Kubectl 进行 Kubernetes 诊断的指南。列出了 100 个 Kubectl 命令，这些命令对于诊断 Kubernetes 集群中的问题非常有用。这些问题包括但不限于：• 集群信息• Pod 诊断• 服务诊断• 部署诊断• 网络诊断• 持久卷和持久卷声明诊断• 资源使用情况• 安全和授权• 节点故障排除• 其他诊断命令：文章还提到了许多其他命令，如资源扩展和自动扩","\u003Cblockquote>\u003Cp>这篇文章是关于使用 Kubectl 进行 Kubernetes 诊断的指南。\u003C/p>\u003Cp>列出了 100 个 Kubectl 命令，这些命令对于诊断 Kubernetes 集群中的问题非常有用。这些问题包括但不限于：\u003C/p>\u003Cul class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>• 集群信息\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>• Pod 诊断\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>• 服务诊断\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>• 部署诊断\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>• 网络诊断\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>• 持久卷和持久卷声明诊断\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>• 资源使用情况\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>• 安全和授权\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>• 节点故障排除\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>• 其他诊断命令：文章还提到了许多其他命令，如资源扩展和自动扩展、作业和定时作业诊断、Pod 亲和性和反亲和性规则、RBAC 和安全、服务账号诊断、节点排空和取消排空、资源清理等。\u003C/p>\u003C/li>\u003C/ul>\u003C/blockquote>\u003Cp>\u003Cstrong>集群信息：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 显示 Kubernetes 版本：\u003Ccode>kubectl version\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 显示集群信息：\u003Ccode>kubectl cluster-info\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>3. 列出集群中的所有节点：\u003Ccode>kubectl get nodes\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>4. 查看一个具体的节点详情：\u003Ccode>kubectl describe node <node-name>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>5. 列出所有命名空间：\u003Ccode>kubectl get namespaces\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>6. 列出所有命名空间中的所有 pod：\u003Ccode>kubectl get pods --all-namespaces\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>Pod 诊断：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出特定命名空间中的 pod：\u003Ccode>kubectl get pods -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 查看一个 Pod 详情：\u003Ccode>kubectl describe pod <pod-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>3. 查看 Pod 日志：\u003Ccode>kubectl logs <pod-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>4. 尾部 Pod 日志：\u003Ccode>kubectl logs -f <pod-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>5. 在 pod 中执行命令：\u003Ccode>kubectl exec -it <pod-name> -n <namespace> -- <command>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>Pod 健康检查：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 检查 Pod 准备情况：\u003Ccode>kubectl get pods <pod-name> -n <namespace> -o jsonpath='{.status.conditions[?(@.type==\"Ready\")].status}'\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 检查 Pod 事件：\u003Ccode>kubectl get events -n <namespace> --field-selector involvedObject.name=<pod-name>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>Service诊断：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出命名空间中的所有服务：\u003Ccode>kubectl get svc -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 查看一个服务详情：\u003Ccode>kubectl describe svc <service-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>Deployment诊断：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出命名空间中的所有Deployment：\u003Ccode>kubectl get deployments -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 查看一个Deployment详情：\u003Ccode>kubectl describe deployment <deployment-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>3. 查看滚动发布状态：\u003Ccode>kubectl rollout status deployment/<deployment-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>4. 查看滚动发布历史记录：\u003Ccode>kubectl rollout history deployment/<deployment-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>StatefulSet诊断：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出命名空间中的所有 StatefulSet：\u003Ccode>kubectl get statefulsets -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 查看一个 StatefulSet详情：\u003Ccode>kubectl describe statefulset <statefulset-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>ConfigMap 和Secret诊断：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出命名空间中的 ConfigMap：\u003Ccode>kubectl get configmaps -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 查看一个ConfigMap详情：\u003Ccode>kubectl describe configmap <configmap-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>3. 列出命名空间中的 Secret：\u003Ccode>kubectl get secrets -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>4. 查看一个Secret详情：\u003Ccode>kubectl describe secret <secret-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>命名空间诊断：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 查看一个命名空间详情：\u003Ccode>kubectl describe namespace <namespace-name>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>资源使用情况：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 检查 pod 的资源使用情况：\u003Ccode>kubectl top pod <pod-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 检查节点资源使用情况：\u003Ccode>kubectl top nodes\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>网络诊断：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 显示命名空间中 Pod 的 IP 地址：\u003Ccode>kubectl get pods -n <namespace> -o custom-columns=POD:metadata.name,IP:status.podIP --no-headers\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 列出命名空间中的所有网络策略：\u003Ccode>kubectl get networkpolicies -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>3. 查看一个网络策略详情：\u003Ccode>kubectl describe networkpolicy <network-policy-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>持久卷 (PV) 和持久卷声明 (PVC) 诊断：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出PV：\u003Ccode>kubectl get pv\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 查看一个PV详情：\u003Ccode>kubectl describe pv <pv-name>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>3. 列出命名空间中的 PVC：\u003Ccode>kubectl get pvc -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>4. 查看PVC详情：\u003Ccode>kubectl describe pvc <pvc-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>节点诊断：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 获取特定节点上运行的 Pod 列表：\u003Ccode>kubectl get pods --field-selector spec.nodeName=<node-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>资源配额和限制：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出命名空间中的资源配额：\u003Ccode>kubectl get resourcequotas -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 查看一个资源配额详情：\u003Ccode>kubectl describe resourcequota <resource-quota-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>自定义资源定义 (CRD) 诊断：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出命名空间中的自定义资源：\u003Ccode>kubectl get <custom-resource-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 查看自定义资源详情：\u003Ccode>kubectl describe <custom-resource-name> <custom-resource-instance-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>使用这些命令时，请记住将\u003Ccode><namespace>\u003C/code>, \u003Ccode><pod-name>\u003C/code>, \u003Ccode><service-name>\u003C/code>, \u003Ccode><deployment-name>\u003C/code>, \u003Ccode><statefulset-name>\u003C/code>, \u003Ccode><configmap-name>\u003C/code>, \u003Ccode><secret-name>\u003C/code>, \u003Ccode><namespace-name>\u003C/code>, \u003Ccode><pv-name>\u003C/code>, \u003Ccode><pvc-name>\u003C/code>, \u003Ccode><node-name>\u003C/code>, \u003Ccode><network-policy-name>\u003C/code>, \u003Ccode><resource-quota-name>\u003C/code>, \u003Ccode><custom-resource-name>\u003C/code>, 和替换为你的特定值。\u003C/p>\u003Cp>\u003Ccode><custom-resource-instance-name>\u003C/code>这些命令应该可以帮助你诊断 Kubernetes 集群以及在其中运行的应用程序。\u003C/p>\u003Cp>\u003Cstrong>资源伸缩和自动伸缩\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. Deployment伸缩：\u003Ccode>kubectl scale deployment <deployment-name> --replicas=<replica-count> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 设置Deployment的自动伸缩：\u003Ccode>kubectl autoscale deployment <deployment-name> --min=<min-pods> --max=<max-pods> --cpu-percent=<cpu-percent> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>3. 检查水平伸缩器状态：\u003Ccode>kubectl get hpa -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>作业和 CronJob 诊断：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出命名空间中的所有作业：\u003Ccode>kubectl get jobs -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 查看一份工作详情：\u003Ccode>kubectl describe job <job-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>3. 列出命名空间中的所有 cron 作业：\u003Ccode>kubectl get cronjobs -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>4. 查看一个 cron 作业详情：\u003Ccode>kubectl describe cronjob <cronjob-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>容量诊断：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出按容量排序的持久卷 (PV)：\u003Ccode>kubectl get pv --sort-by=.spec.capacity.storage\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 查看PV回收策略：\u003Ccode>kubectl get pv <pv-name> -o=jsonpath='{.spec.persistentVolumeReclaimPolicy}'\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>3. 列出所有存储类别：\u003Ccode>kubectl get storageclasses\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>Ingress和服务网格诊断：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出命名空间中的所有Ingress：\u003Ccode>kubectl get ingress -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 查看一个Ingress详情：\u003Ccode>kubectl describe ingress <ingress-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>3. 列出命名空间中的所有 VirtualServices (Istio)：\u003Ccode>kubectl get virtualservices -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>4. 查看一个 VirtualService (Istio)详情：\u003Ccode>kubectl describe virtualservice <virtualservice-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>Pod 网络故障排除：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 运行网络诊断 Pod（例如 busybox）进行调试：\u003Ccode>kubectl run -it --rm --restart=Never --image=busybox net-debug-pod -- /bin/sh\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 测试从 Pod 到特定端点的连接：\u003Ccode>kubectl exec -it <pod-name> -n <namespace> -- curl <endpoint-url>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>3. 跟踪从一个 Pod 到另一个 Pod 的网络路径：\u003Ccode>kubectl exec -it <source-pod-name> -n <namespace> -- traceroute <destination-pod-ip>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>4. 检查 Pod 的 DNS 解析：\u003Ccode>kubectl exec -it <pod-name> -n <namespace> -- nslookup <domain-name>\u003C/code>\u003Cspan style=\"text-align: justify;\">\u003C/span>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>配置和资源验证：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 验证 Kubernetes YAML 文件而不应用它：\u003Ccode>kubectl apply --dry-run=client -f <yaml-file>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 验证 pod 的安全上下文和功能：\u003Ccode>kubectl auth can-i list pods --as=system:serviceaccount:<namespace>:<serviceaccount-name>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>RBAC 和安全性：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出命名空间中的角色和角色绑定：\u003Ccode>kubectl get roles,rolebindings -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 查看角色或角色绑定详情：\u003Ccode>kubectl describe role <role-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>服务帐户诊断：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出命名空间中的服务帐户：\u003Ccode>kubectl get serviceaccounts -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 查看一个服务帐户详情：\u003Ccode>kubectl describe serviceaccount <serviceaccount-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>清空节点和解除封锁：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 清空节点以进行维护：\u003Ccode>kubectl drain <node-name> --ignore-daemonsets\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 解除对节点的封锁：\u003Ccode>kubectl uncordon <node-name>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>资源清理：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 强制删除 pod（不推荐）：\u003Ccode>kubectl delete pod <pod-name> -n <namespace> --grace-period=0 --force\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>Pod 亲和性和反亲和性：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出 pod 的 pod 亲和性规则：\u003Ccode>kubectl get pod <pod-name> -n <namespace> -o=jsonpath='{.spec.affinity}'\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 列出 pod 的 pod 反亲和性规则：\u003Ccode>kubectl get pod <pod-name> -n <namespace> -o=jsonpath='{.spec.affinity.podAntiAffinity}'\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>Pod 安全策略 (PSP)：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出所有 Pod 安全策略（如果启用）：\u003Ccode>kubectl get psp\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>事件：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 查看最近的集群事件：\u003Ccode>kubectl get events --sort-by=.metadata.creationTimestamp\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 按特定命名空间过滤事件：\u003Ccode>kubectl get events -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>节点故障排除：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 检查节点情况：\u003Ccode>kubectl describe node <node-name> | grep Conditions -A5\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 列出节点容量和可分配资源：\u003Ccode>kubectl describe node <node-name> | grep -E \"Capacity|Allocatable\"\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>临时容器（Kubernetes 1.18+）：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 运行临时调试容器：\u003Ccode>kubectl debug -it <pod-name> -n <namespace> --image=<debug-image> -- /bin/sh\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>资源指标（需要指标服务器）：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 获取 Pod 的 CPU 和内存使用情况：\u003Ccode>kubectl top pod -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>kuelet诊断：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 查看节点上的kubelet日志：\u003Ccode>kubectl logs -n kube-system kubelet-<node-name>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>使用Telepresence 进行高级调试：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 使用 Telepresence 调试 pod：\u003Ccode>telepresence --namespace <namespace> --swap-deployment <pod-name>\u003C/code>\u003Cspan style=\"text-align: center;\">\u003C/span>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>Kubeconfig 和上下文：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出可用的上下文：\u003Ccode>kubectl config get-contexts\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 切换到不同的上下文：\u003Ccode>kubectl config use-context <context-name>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>Pod 安全标准（PodSecurity 准入控制器）：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出 PodSecurityPolicy (PSP) 违规行为：\u003Ccode>kubectl get psp -A | grep -vE 'NAME|REVIEWED'\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>Pod 中断预算 (PDB) 诊断：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出命名空间中的所有 PDB：\u003Ccode>kubectl get pdb -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 查看一个PDB详情：\u003Ccode>kubectl describe pdb <pdb-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>资源锁诊断（如果使用资源锁）：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出命名空间中的资源锁：\u003Ccode>kubectl get resourcelocks -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>服务端点和 DNS：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出服务的服务端点：\u003Ccode>kubectl get endpoints <service-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 检查 Pod 中的 DNS 配置：\u003Ccode>kubectl exec -it <pod-name> -n <namespace> -- cat /etc/resolv.conf\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>自定义指标（Prometheus、Grafana）：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 查询Prometheus指标：用于\u003Ccode>kubectl port-forward\u003C/code>访问Prometheus和Grafana服务来查询自定义指标。\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>Pod 优先级和抢占：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出优先级：\u003Ccode>kubectl get priorityclasses\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>Pod 开销（Kubernetes 1.18+）：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出 pod 中的开销：\u003Ccode>kubectl get pod <pod-name> -n <namespace> -o=jsonpath='{.spec.overhead}'\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>存储卷快照诊断（如果使用存储卷快照）：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出存储卷快照：\u003Ccode>kubectl get volumesnapshot -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 查看存储卷快照详情：\u003Ccode>kubectl describe volumesnapshot <snapshot-name> -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>资源反序列化诊断：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 反序列化并打印 Kubernetes 资源：\u003Ccode>kubectl get <resource-type> <resource-name> -n <namespace> -o=json\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>节点污点：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出节点污点：\u003Ccode>kubectl describe node <node-name> | grep Taints\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>更改和验证 Webhook 配置：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出变异 webhook 配置：\u003Ccode>kubectl get mutatingwebhookconfigurations\u003C/code>\u003C/p>\u003C/li>\u003Cli style=\"text-align: left;\">\u003Cp>2. 列出验证 Webhook 配置：\u003Ccode>kubectl get validatingwebhookconfigurations\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>Pod 网络策略：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 列出命名空间中的 pod 网络策略：\u003Ccode>kubectl get networkpolicies -n <namespace>\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>节点条件（Kubernetes 1.17+）：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 自定义查询输出：\u003Ccode>kubectl get nodes -o custom-columns=NODE:.metadata.name,READY:.status.conditions[?(@.type==\"Ready\")].status -l 'node-role.kubernetes.io/worker='\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>审核日志：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 检索审核日志（如果启用）：检查 Kubernetes 审核日志配置以了解审核日志的位置。\u003C/p>\u003C/li>\u003C/ol>\u003Cp>\u003Cstrong>节点操作系统详细信息：\u003C/strong>\u003C/p>\u003Col class=\"list-paddingleft-1\">\u003Cli style=\"text-align: left;\">\u003Cp>1. 获取节点的操作系统信息：\u003Ccode>kubectl get node <node-name> -o jsonpath='{.status.nodeInfo.osImage}'\u003C/code>\u003C/p>\u003C/li>\u003C/ol>\u003Cp>这些命令应该涵盖 Kubernetes 中的各种诊断场景。确保将\u003Ccode><namespace>\u003C/code>、\u003Ccode><pod-name>\u003C/code>、\u003Ccode><deployment-name>\u003C/code>等占位符替换为你的集群和用例的实际值。\u003C/p>\u003Cdiv>\u003Cbr>\u003C/div>","> 这篇文章是关于使用 Kubectl 进行 Kubernetes 诊断的指南。列出了 100 个 Kubectl 命令，这些命令对于诊断 Kubernetes 集群中的问题非常有用。这些问题包括但不限于：• 集群信息• Pod 诊断• 服务诊断• 部署诊断• 网络诊断• 持久卷和持久卷声明诊断• 资源使用情况• 安全和授权• 节点故障排除• 其他诊断命令：文章还提到了许多其他命令，如资源扩展和自动扩展、作业和定时作业诊断、Pod 亲和性和反亲和性规则、RBAC 和安全、服务账号诊断、节点排空和取消排空、资源清理等。\n\n**集群信息：**\n\n1. 1. 显示 Kubernetes 版本：kubectl version\n2. 2. 显示集群信息：kubectl cluster-info\n3. 3. 列出集群中的所有节点：kubectl get nodes\n4. 4. 查看一个具体的节点详情：kubectl describe node\n5. 5. 列出所有命名空间：kubectl get namespaces\n6. 6. 列出所有命名空间中的所有 pod：kubectl get pods --all-namespaces\n\n**Pod 诊断：**\n\n1. 1. 列出特定命名空间中的 pod：kubectl get pods -n\n2. 2. 查看一个 Pod 详情：kubectl describe pod  -n\n3. 3. 查看 Pod 日志：kubectl logs  -n\n4. 4. 尾部 Pod 日志：kubectl logs -f  -n\n5. 5. 在 pod 中执行命令：kubectl exec -it  -n  --\n\n**Pod 健康检查：**\n\n1. 1. 检查 Pod 准备情况：kubectl get pods  -n  -o jsonpath='{.status.conditions[?(@.type==\"Ready\")].status}'\n2. 2. 检查 Pod 事件：kubectl get events -n  --field-selector involvedObject.name=\n\n**Service诊断：**\n\n1. 1. 列出命名空间中的所有服务：kubectl get svc -n\n2. 2. 查看一个服务详情：kubectl describe svc  -n\n\n**Deployment诊断：**\n\n1. 1. 列出命名空间中的所有Deployment：kubectl get deployments -n\n2. 2. 查看一个Deployment详情：kubectl describe deployment  -n\n3. 3. 查看滚动发布状态：kubectl rollout status deployment/ -n\n4. 4. 查看滚动发布历史记录：kubectl rollout history deployment/ -n\n\n**StatefulSet诊断：**\n\n1. 1. 列出命名空间中的所有 StatefulSet：kubectl get statefulsets -n\n2. 2. 查看一个 StatefulSet详情：kubectl describe statefulset  -n\n\n**ConfigMap 和Secret诊断：**\n\n1. 1. 列出命名空间中的 ConfigMap：kubectl get configmaps -n\n2. 2. 查看一个ConfigMap详情：kubectl describe configmap  -n\n3. 3. 列出命名空间中的 Secret：kubectl get secrets -n\n4. 4. 查看一个Secret详情：kubectl describe secret  -n\n\n**命名空间诊断：**\n\n1. 1. 查看一个命名空间详情：kubectl describe namespace\n\n**资源使用情况：**\n\n1. 1. 检查 pod 的资源使用情况：kubectl top pod  -n\n2. 2. 检查节点资源使用情况：kubectl top nodes\n\n**网络诊断：**\n\n1. 1. 显示命名空间中 Pod 的 IP 地址：kubectl get pods -n  -o custom-columns=POD:metadata.name,IP:status.podIP --no-headers\n2. 2. 列出命名空间中的所有网络策略：kubectl get networkpolicies -n\n3. 3. 查看一个网络策略详情：kubectl describe networkpolicy  -n\n\n**持久卷 (PV) 和持久卷声明 (PVC) 诊断：**\n\n1. 1. 列出PV：kubectl get pv\n2. 2. 查看一个PV详情：kubectl describe pv\n3. 3. 列出命名空间中的 PVC：kubectl get pvc -n\n4. 4. 查看PVC详情：kubectl describe pvc  -n\n\n**节点诊断：**\n\n1. 1. 获取特定节点上运行的 Pod 列表：kubectl get pods --field-selector spec.nodeName= -n\n\n**资源配额和限制：**\n\n1. 1. 列出命名空间中的资源配额：kubectl get resourcequotas -n\n2. 2. 查看一个资源配额详情：kubectl describe resourcequota  -n\n\n**自定义资源定义 (CRD) 诊断：**\n\n1. 1. 列出命名空间中的自定义资源：kubectl get  -n\n2. 2. 查看自定义资源详情：kubectl describe   -n\n\n使用这些命令时，请记住将``, ``, ``, ``, ``, ``, ``, ``, ``, ``, ``, ``, ``, ``, 和替换为你的特定值。\n\n``这些命令应该可以帮助你诊断 Kubernetes 集群以及在其中运行的应用程序。\n\n**资源伸缩和自动伸缩**\n\n1. 1. Deployment伸缩：kubectl scale deployment  --replicas= -n\n2. 2. 设置Deployment的自动伸缩：kubectl autoscale deployment  --min= --max= --cpu-percent= -n\n3. 3. 检查水平伸缩器状态：kubectl get hpa -n\n\n**作业和 CronJob 诊断：**\n\n1. 1. 列出命名空间中的所有作业：kubectl get jobs -n\n2. 2. 查看一份工作详情：kubectl describe job  -n\n3. 3. 列出命名空间中的所有 cron 作业：kubectl get cronjobs -n\n4. 4. 查看一个 cron 作业详情：kubectl describe cronjob  -n\n\n**容量诊断：**\n\n1. 1. 列出按容量排序的持久卷 (PV)：kubectl get pv --sort-by=.spec.capacity.storage\n2. 2. 查看PV回收策略：kubectl get pv  -o=jsonpath='{.spec.persistentVolumeReclaimPolicy}'\n3. 3. 列出所有存储类别：kubectl get storageclasses\n\n**Ingress和服务网格诊断：**\n\n1. 1. 列出命名空间中的所有Ingress：kubectl get ingress -n\n2. 2. 查看一个Ingress详情：kubectl describe ingress  -n\n3. 3. 列出命名空间中的所有 VirtualServices (Istio)：kubectl get virtualservices -n\n4. 4. 查看一个 VirtualService (Istio)详情：kubectl describe virtualservice  -n\n\n**Pod 网络故障排除：**\n\n1. 1. 运行网络诊断 Pod（例如 busybox）进行调试：kubectl run -it --rm --restart=Never --image=busybox net-debug-pod -- /bin/sh\n2. 2. 测试从 Pod 到特定端点的连接：kubectl exec -it  -n  -- curl\n3. 3. 跟踪从一个 Pod 到另一个 Pod 的网络路径：kubectl exec -it  -n  -- traceroute\n4. 4. 检查 Pod 的 DNS 解析：kubectl exec -it  -n  -- nslookup\n\n**配置和资源验证：**\n\n1. 1. 验证 Kubernetes YAML 文件而不应用它：kubectl apply --dry-run=client -f\n2. 2. 验证 pod 的安全上下文和功能：kubectl auth can-i list pods --as=system:serviceaccount::\n\n**RBAC 和安全性：**\n\n1. 1. 列出命名空间中的角色和角色绑定：kubectl get roles,rolebindings -n\n2. 2. 查看角色或角色绑定详情：kubectl describe role  -n\n\n**服务帐户诊断：**\n\n1. 1. 列出命名空间中的服务帐户：kubectl get serviceaccounts -n\n2. 2. 查看一个服务帐户详情：kubectl describe serviceaccount  -n\n\n**清空节点和解除封锁：**\n\n1. 1. 清空节点以进行维护：kubectl drain  --ignore-daemonsets\n2. 2. 解除对节点的封锁：kubectl uncordon\n\n**资源清理：**\n\n1. 1. 强制删除 pod（不推荐）：kubectl delete pod  -n  --grace-period=0 --force\n\n**Pod 亲和性和反亲和性：**\n\n1. 1. 列出 pod 的 pod 亲和性规则：kubectl get pod  -n  -o=jsonpath='{.spec.affinity}'\n2. 2. 列出 pod 的 pod 反亲和性规则：kubectl get pod  -n  -o=jsonpath='{.spec.affinity.podAntiAffinity}'\n\n**Pod 安全策略 (PSP)：**\n\n1. 1. 列出所有 Pod 安全策略（如果启用）：kubectl get psp\n\n**事件：**\n\n1. 1. 查看最近的集群事件：kubectl get events --sort-by=.metadata.creationTimestamp\n2. 2. 按特定命名空间过滤事件：kubectl get events -n\n\n**节点故障排除：**\n\n1. 1. 检查节点情况：kubectl describe node  | grep Conditions -A5\n2. 2. 列出节点容量和可分配资源：kubectl describe node  | grep -E \"Capacity|Allocatable\"\n\n**临时容器（Kubernetes 1.18+）：**\n\n1. 1. 运行临时调试容器：kubectl debug -it  -n  --image= -- /bin/sh\n\n**资源指标（需要指标服务器）：**\n\n1. 1. 获取 Pod 的 CPU 和内存使用情况：kubectl top pod -n\n\n**kuelet诊断：**\n\n1. 1. 查看节点上的kubelet日志：kubectl logs -n kube-system kubelet-\n\n**使用Telepresence 进行高级调试：**\n\n1. 1. 使用 Telepresence 调试 pod：telepresence --namespace  --swap-deployment\n\n**Kubeconfig 和上下文：**\n\n1. 1. 列出可用的上下文：kubectl config get-contexts\n2. 2. 切换到不同的上下文：kubectl config use-context\n\n**Pod 安全标准（PodSecurity 准入控制器）：**\n\n1. 1. 列出 PodSecurityPolicy (PSP) 违规行为：kubectl get psp -A | grep -vE 'NAME|REVIEWED'\n\n**Pod 中断预算 (PDB) 诊断：**\n\n1. 1. 列出命名空间中的所有 PDB：kubectl get pdb -n\n2. 2. 查看一个PDB详情：kubectl describe pdb  -n\n\n**资源锁诊断（如果使用资源锁）：**\n\n1. 1. 列出命名空间中的资源锁：kubectl get resourcelocks -n\n\n**服务端点和 DNS：**\n\n1. 1. 列出服务的服务端点：kubectl get endpoints  -n\n2. 2. 检查 Pod 中的 DNS 配置：kubectl exec -it  -n  -- cat /etc/resolv.conf\n\n**自定义指标（Prometheus、Grafana）：**\n\n1. 1. 查询Prometheus指标：用于kubectl port-forward访问Prometheus和Grafana服务来查询自定义指标。\n\n**Pod 优先级和抢占：**\n\n1. 1. 列出优先级：kubectl get priorityclasses\n\n**Pod 开销（Kubernetes 1.18+）：**\n\n1. 1. 列出 pod 中的开销：kubectl get pod  -n  -o=jsonpath='{.spec.overhead}'\n\n**存储卷快照诊断（如果使用存储卷快照）：**\n\n1. 1. 列出存储卷快照：kubectl get volumesnapshot -n\n2. 2. 查看存储卷快照详情：kubectl describe volumesnapshot  -n\n\n**资源反序列化诊断：**\n\n1. 1. 反序列化并打印 Kubernetes 资源：kubectl get   -n  -o=json\n\n**节点污点：**\n\n1. 1. 列出节点污点：kubectl describe node  | grep Taints\n\n**更改和验证 Webhook 配置：**\n\n1. 1. 列出变异 webhook 配置：kubectl get mutatingwebhookconfigurations\n2. 2. 列出验证 Webhook 配置：kubectl get validatingwebhookconfigurations\n\n**Pod 网络策略：**\n\n1. 1. 列出命名空间中的 pod 网络策略：kubectl get networkpolicies -n\n\n**节点条件（Kubernetes 1.17+）：**\n\n1. 1. 自定义查询输出：kubectl get nodes -o custom-columns=NODE:.metadata.name,READY:.status.conditions[?(@.type==\"Ready\")].status -l 'node-role.kubernetes.io/worker='\n\n**审核日志：**\n\n1. 1. 检索审核日志（如果启用）：检查 Kubernetes 审核日志配置以了解审核日志的位置。\n\n**节点操作系统详细信息：**\n\n1. 1. 获取节点的操作系统信息：kubectl get node  -o jsonpath='{.status.nodeInfo.osImage}'\n\n这些命令应该涵盖 Kubernetes 中的各种诊断场景。确保将``、``、``等占位符替换为你的集群和用例的实际值。","/article/115",3642,"2023-11-02 14:09:30","2023-11-02 14:10:05",{"id":185,"category_id":44,"title":186,"keywords":187,"description":188,"image_url":6,"content":189,"content_md":190,"url":191,"hits":192,"is_recommend":73,"is_top":73,"create_time":193,"update_time":194},1783340871803]