# 宣告式範例：我要 3 個 nginx Pod
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  replicas: 3  # 期望狀態：3 個副本
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.25

apiVersion: v1
kind: Pod
metadata:
  name: multi-container-pod
  labels:
    app: myapp
spec:
  containers:
  - name: main-app
    image: myapp:1.0
    ports:
    - containerPort: 8080
  - name: sidecar-log
    image: fluentd:latest
    volumeMounts:
    - name: shared-logs
      mountPath: /var/log
  volumes:
  - name: shared-logs
    emptyDir: {}

# 查看所有 Node
kubectl get nodes -o wide

# 查看 Node 詳細資訊
kubectl describe node <node-name>

# 標記 Node 不可調度（維護用）
kubectl cordon <node-name>

# 驅逐 Node 上所有 Pod
kubectl drain <node-name> --ignore-daemonsets --delete-emptydir-data

apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    environment: prod
    team: backend

# Label 設計建議
metadata:
  labels:
    app: order-service          # 應用名稱
    version: v1.2.3             # 版本
    environment: production     # 環境
    team: backend               # 負責團隊
    tier: backend               # 層級（frontend/backend/database）

metadata:
  annotations:
    kubernetes.io/change-cause: "Update image to v1.2.3"
    prometheus.io/scrape: "true"
    prometheus.io/port: "8080"
    deployment.kubernetes.io/revision: "3"

# 1. 所有節點：安裝前置套件
sudo apt-get update
sudo apt-get install -y apt-transport-https ca-certificates curl gpg

# 2. 新增 Kubernetes apt repository
curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.29/deb/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.29/deb/ /' | sudo tee /etc/apt/sources.list.d/kubernetes.list

# 3. 安裝 kubelet、kubeadm、kubectl
sudo apt-get update
sudo apt-get install -y kubelet kubeadm kubectl
sudo apt-mark hold kubelet kubeadm kubectl

# 4. Master Node：初始化 Cluster
sudo kubeadm init --pod-network-cidr=10.244.0.0/16

# 5. 設定 kubectl
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

# 6. 安裝 CNI（以 Flannel 為例）
kubectl apply -f https://github.com/flannel-io/flannel/releases/latest/download/kube-flannel.yml

# 7. Worker Node：加入 Cluster
sudo kubeadm join <master-ip>:6443 --token <token> --discovery-token-ca-cert-hash sha256:<hash>

# 安裝 kind
go install sigs.k8s.io/kind@latest

# 建立 Cluster
kind create cluster --name dev-cluster

# 使用設定檔建立多節點 Cluster
cat <<EOF | kind create cluster --config=-
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
- role: worker
- role: worker
EOF

# 刪除 Cluster
kind delete cluster --name dev-cluster

# 停用 Swap
sudo swapoff -a
sudo sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab

# 安裝 containerd
sudo apt-get update
sudo apt-get install -y containerd

# 產生預設設定
sudo mkdir -p /etc/containerd
containerd config default | sudo tee /etc/containerd/config.toml

# 啟用 SystemdCgroup
sudo sed -i 's/SystemdCgroup = false/SystemdCgroup = true/g' /etc/containerd/config.toml

# 重啟 containerd
sudo systemctl restart containerd
sudo systemctl enable containerd

# 1. 檢查 Node 狀態
kubectl get nodes
# 預期輸出：所有 Node 狀態為 Ready

# 2. 檢查系統 Pod
kubectl get pods -n kube-system
# 預期輸出：所有 Pod 狀態為 Running

# 3. 檢查 Cluster 資訊
kubectl cluster-info
kubectl version

# 4. 部署測試應用
kubectl create deployment nginx-test --image=nginx:latest
kubectl expose deployment nginx-test --port=80 --type=NodePort
kubectl get svc nginx-test

# 5. 測試存取
curl http://<node-ip>:<node-port>

# 6. 清理測試
kubectl delete deployment nginx-test
kubectl delete svc nginx-test

apiVersion: apps/v1
kind: Deployment
metadata:
  name: order-service
  namespace: production
  labels:
    app: order-service
    version: v1.0.0
spec:
  replicas: 3
  selector:
    matchLabels:
      app: order-service
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1        # 更新時最多多出 1 個 Pod
      maxUnavailable: 0  # 更新時不允許有 Pod 不可用
  template:
    metadata:
      labels:
        app: order-service
        version: v1.0.0
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "8080"
    spec:
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchLabels:
                  app: order-service
              topologyKey: kubernetes.io/hostname
      containers:
      - name: order-service
        image: myregistry/order-service:v1.0.0
        ports:
        - containerPort: 8080
          name: http
        env:
        - name: SPRING_PROFILES_ACTIVE
          value: "production"
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: db-credentials
              key: password
        resources:
          requests:
            cpu: "250m"
            memory: "512Mi"
          limits:
            cpu: "1000m"
            memory: "1Gi"
        livenessProbe:
          httpGet:
            path: /actuator/health/liveness
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /actuator/health/readiness
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 5
        volumeMounts:
        - name: config
          mountPath: /app/config
          readOnly: true
      volumes:
      - name: config
        configMap:
          name: order-service-config
      terminationGracePeriodSeconds: 60

# ClusterIP Service
apiVersion: v1
kind: Service
metadata:
  name: order-service
  namespace: production
spec:
  type: ClusterIP
  selector:
    app: order-service
  ports:
  - name: http
    port: 80
    targetPort: 8080
    protocol: TCP
---
# LoadBalancer Service
apiVersion: v1
kind: Service
metadata:
  name: api-gateway
  namespace: production
  annotations:
    # AWS ALB 範例
    service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
    service.beta.kubernetes.io/aws-load-balancer-internal: "true"
spec:
  type: LoadBalancer
  selector:
    app: api-gateway
  ports:
  - name: https
    port: 443
    targetPort: 8443

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: main-ingress
  namespace: production
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "60"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - api.example.com
    secretName: api-tls-secret
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /orders
        pathType: Prefix
        backend:
          service:
            name: order-service
            port:
              number: 80
      - path: /users
        pathType: Prefix
        backend:
          service:
            name: user-service
            port:
              number: 80
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-gateway
            port:
              number: 80

# ConfigMap 定義
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
  namespace: production
data:
  # 簡單鍵值
  LOG_LEVEL: "INFO"
  MAX_CONNECTIONS: "100"
  
  # 檔案內容
  application.yaml: |
    server:
      port: 8080
    spring:
      datasource:
        url: jdbc:postgresql://db-service:5432/mydb
---
# Pod 中使用 ConfigMap
apiVersion: v1
kind: Pod
metadata:
  name: app-pod
spec:
  containers:
  - name: app
    image: myapp:latest
    env:
    # 方式一：單一環境變數
    - name: LOG_LEVEL
      valueFrom:
        configMapKeyRef:
          name: app-config
          key: LOG_LEVEL
    # 方式二：所有 key 作為環境變數
    envFrom:
    - configMapRef:
        name: app-config
    # 方式三：掛載為檔案
    volumeMounts:
    - name: config-volume
      mountPath: /app/config
  volumes:
  - name: config-volume
    configMap:
      name: app-config
      items:
      - key: application.yaml
        path: application.yaml

# Secret 定義（Base64 編碼）
apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
  namespace: production
type: Opaque
data:
  username: YWRtaW4=          # echo -n 'admin' | base64
  password: cGFzc3dvcmQxMjM=  # echo -n 'password123' | base64
---
# 使用 stringData（自動編碼）
apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
type: Opaque
stringData:
  username: admin
  password: password123

resources:
  requests:
    cpu: "250m"      # 最低需求：0.25 CPU
    memory: "256Mi"  # 最低需求：256 MB
  limits:
    cpu: "1000m"     # 上限：1 CPU
    memory: "512Mi"  # 上限：512 MB

spec:
  containers:
  - name: app
    image: myapp:latest
    # Startup Probe：用於啟動較慢的應用
    startupProbe:
      httpGet:
        path: /actuator/health
        port: 8080
      failureThreshold: 30
      periodSeconds: 10
    # Liveness Probe：存活檢查
    livenessProbe:
      httpGet:
        path: /actuator/health/liveness
        port: 8080
      initialDelaySeconds: 0
      periodSeconds: 10
      timeoutSeconds: 5
      failureThreshold: 3
    # Readiness Probe：就緒檢查
    readinessProbe:
      httpGet:
        path: /actuator/health/readiness
        port: 8080
      initialDelaySeconds: 0
      periodSeconds: 5
      timeoutSeconds: 3
      failureThreshold: 3

# HTTP GET
livenessProbe:
  httpGet:
    path: /health
    port: 8080
    httpHeaders:
    - name: Authorization
      value: Bearer xxx

# TCP Socket
livenessProbe:
  tcpSocket:
    port: 3306

# Exec Command
livenessProbe:
  exec:
    command:
    - cat
    - /tmp/healthy

# gRPC（Kubernetes 1.24+）
livenessProbe:
  grpc:
    port: 50051

# ===== 查詢類 =====
# 查看所有資源（指定 namespace）
kubectl get all -n <namespace>

# 查看 Pod（含更多資訊）
kubectl get pods -o wide
kubectl get pods -o yaml
kubectl get pods -o json

# 查看資源詳情
kubectl describe pod <pod-name>
kubectl describe deployment <deployment-name>

# 查看 Label
kubectl get pods --show-labels
kubectl get pods -l app=myapp

# ===== 建立與刪除 =====
# 從 YAML 建立
kubectl apply -f deployment.yaml

# 快速建立（測試用）
kubectl create deployment nginx --image=nginx:latest

# 刪除資源
kubectl delete -f deployment.yaml
kubectl delete pod <pod-name>
kubectl delete pod <pod-name> --force --grace-period=0  # 強制刪除

# ===== 執行與除錯 =====
# 進入 Pod
kubectl exec -it <pod-name> -- /bin/bash

# 查看 Log
kubectl logs <pod-name>
kubectl logs <pod-name> -f              # 持續追蹤
kubectl logs <pod-name> --previous      # 前一個容器
kubectl logs <pod-name> -c <container>  # 指定容器

# 複製檔案
kubectl cp <pod-name>:/path/to/file ./local-file
kubectl cp ./local-file <pod-name>:/path/to/file

# ===== 資源管理 =====
# 擴縮容
kubectl scale deployment <name> --replicas=5

# 編輯資源
kubectl edit deployment <name>

# 打補丁
kubectl patch deployment <name> -p '{"spec":{"replicas":3}}'

# ===== 除錯工具 =====
# 執行臨時除錯 Pod
kubectl run debug --image=busybox -it --rm -- sh
kubectl run debug --image=nicolaka/netshoot -it --rm -- bash

# 端口轉發
kubectl port-forward pod/<pod-name> 8080:8080
kubectl port-forward svc/<service-name> 8080:80

# JSON Path 查詢
kubectl get pods -o jsonpath='{.items[*].metadata.name}'
kubectl get pods -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}'

# Custom Columns
kubectl get pods -o custom-columns=NAME:.metadata.name,STATUS:.status.phase

# 排序
kubectl get pods --sort-by=.metadata.creationTimestamp

# 1. 更新映像版本
kubectl set image deployment/order-service order-service=myregistry/order-service:v1.2.0

# 2. 或使用 apply
kubectl apply -f deployment.yaml

# 3. 查看發佈狀態
kubectl rollout status deployment/order-service

# 4. 查看發佈歷史
kubectl rollout history deployment/order-service
kubectl rollout history deployment/order-service --revision=2

# 5. 暫停/恢復發佈
kubectl rollout pause deployment/order-service
kubectl rollout resume deployment/order-service

spec:
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 25%        # 更新時最多超出 25% Pod
      maxUnavailable: 25%  # 更新時最多 25% Pod 不可用

# 回滾到上一版本
kubectl rollout undo deployment/order-service

# 回滾到指定版本
kubectl rollout undo deployment/order-service --to-revision=2

# 設定變更原因（方便追蹤）
kubectl annotate deployment/order-service kubernetes.io/change-cause="Rollback due to bug"

# Blue 版本
apiVersion: apps/v1
kind: Deployment
metadata:
  name: app-blue
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myapp
      version: blue
  template:
    metadata:
      labels:
        app: myapp
        version: blue
    spec:
      containers:
      - name: app
        image: myapp:v1
---
# Service 指向 Blue
apiVersion: v1
kind: Service
metadata:
  name: myapp
spec:
  selector:
    app: myapp
    version: blue  # 切換到 green 即可
  ports:
  - port: 80

# 擴展到 5 個副本
kubectl scale deployment/order-service --replicas=5

# 根據條件擴展（只有在目前少於 5 個時才擴展）
kubectl scale deployment/order-service --current-replicas=3 --replicas=5

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: order-service-hpa
  namespace: production
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: order-service
  minReplicas: 3
  maxReplicas: 10
  metrics:
  # CPU 使用率
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  # Memory 使用率
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80
  # 自定義指標（需要 Prometheus Adapter）
  - type: Pods
    pods:
      metric:
        name: requests_per_second
      target:
        type: AverageValue
        averageValue: "1000"
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300  # 縮容冷卻期
      policies:
      - type: Percent
        value: 10
        periodSeconds: 60
    scaleUp:
      stabilizationWindowSeconds: 0
      policies:
      - type: Percent
        value: 100
        periodSeconds: 15
      - type: Pods
        value: 4
        periodSeconds: 15

# 查看 HPA 狀態
kubectl get hpa
kubectl describe hpa order-service-hpa

# ===== Pod Pending =====
# 檢查事件
kubectl describe pod <pod-name> | grep -A 10 Events

# 常見原因：
# - Insufficient cpu/memory：資源不足
# - No nodes are available：沒有可用節點
# - PersistentVolumeClaim not found：PVC 問題

# ===== CrashLoopBackOff =====
# 查看當前日誌
kubectl logs <pod-name>

# 查看前一次日誌
kubectl logs <pod-name> --previous

# ===== ImagePullBackOff =====
# 檢查映像名稱是否正確
# 檢查 imagePullSecrets
kubectl get secret <secret-name> -o yaml

# ===== 網路問題 =====
# 使用 debug Pod 測試
kubectl run debug --image=nicolaka/netshoot -it --rm -- bash

# 在 debug Pod 中
nslookup <service-name>
curl http://<service-name>:<port>

# ===== 資源使用狀況 =====
kubectl top nodes
kubectl top pods

# 複製問題 Pod 進行除錯（Kubernetes 1.25+）
kubectl debug <pod-name> -it --image=busybox --copy-to=debug-pod

# 以特權模式除錯 Node
kubectl debug node/<node-name> -it --image=ubuntu

# 查看完整 YAML（含預設值）
kubectl get pod <pod-name> -o yaml

# 匯出 Event
kubectl get events --sort-by='.lastTimestamp' -n <namespace>

apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    environment: production
    team: platform
  annotations:
    description: "Production environment for core services"
---
# ResourceQuota：限制 Namespace 資源
apiVersion: v1
kind: ResourceQuota
metadata:
  name: production-quota
  namespace: production
spec:
  hard:
    requests.cpu: "20"
    requests.memory: "40Gi"
    limits.cpu: "40"
    limits.memory: "80Gi"
    pods: "100"
    services: "20"
    secrets: "50"
    configmaps: "50"
---
# LimitRange：設定預設資源限制
apiVersion: v1
kind: LimitRange
metadata:
  name: production-limits
  namespace: production
spec:
  limits:
  - default:
      cpu: "500m"
      memory: "512Mi"
    defaultRequest:
      cpu: "100m"
      memory: "128Mi"
    max:
      cpu: "2"
      memory: "4Gi"
    min:
      cpu: "50m"
      memory: "64Mi"
    type: Container

# Role：Namespace 級別權限
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: developer-role
  namespace: development
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log", "services", "configmaps"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]
  resources: ["deployments", "replicasets"]
  verbs: ["get", "list", "watch", "create", "update", "patch"]
---
# RoleBinding：綁定角色到使用者
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: developer-binding
  namespace: development
subjects:
- kind: User
  name: developer@example.com
  apiGroup: rbac.authorization.k8s.io
- kind: Group
  name: developers
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: developer-role
  apiGroup: rbac.authorization.k8s.io
---
# ClusterRole：叢集級別權限
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: readonly-clusterrole
rules:
- apiGroups: [""]
  resources: ["*"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["apps", "batch"]
  resources: ["*"]
  verbs: ["get", "list", "watch"]
---
# ServiceAccount（供應用程式使用）
apiVersion: v1
kind: ServiceAccount
metadata:
  name: order-service-sa
  namespace: production
---
# 綁定 ServiceAccount 到 Role
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: order-service-binding
  namespace: production
subjects:
- kind: ServiceAccount
  name: order-service-sa
  namespace: production
roleRef:
  kind: Role
  name: service-role
  apiGroup: rbac.authorization.k8s.io

# Fluent Bit DaemonSet 範例
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluent-bit
  namespace: logging
spec:
  selector:
    matchLabels:
      app: fluent-bit
  template:
    metadata:
      labels:
        app: fluent-bit
    spec:
      serviceAccountName: fluent-bit
      containers:
      - name: fluent-bit
        image: fluent/fluent-bit:latest
        volumeMounts:
        - name: varlog
          mountPath: /var/log
        - name: varlibdockercontainers
          mountPath: /var/lib/docker/containers
          readOnly: true
        - name: config
          mountPath: /fluent-bit/etc/
      volumes:
      - name: varlog
        hostPath:
          path: /var/log
      - name: varlibdockercontainers
        hostPath:
          path: /var/lib/docker/containers
      - name: config
        configMap:
          name: fluent-bit-config

// Java 日誌格式建議（JSON 格式方便 ELK 解析）
{
  "timestamp": "2026-01-30T10:15:30.123Z",
  "level": "INFO",
  "logger": "com.example.OrderService",
  "message": "Order created successfully",
  "traceId": "abc123",
  "spanId": "def456",
  "orderId": "ORD-12345",
  "userId": "USR-67890"
}

# 檢查憑證到期日
kubeadm certs check-expiration

# 更新憑證
kubeadm certs renew all

# 重啟 Control Plane 元件
systemctl restart kubelet

# 查看 Node 資源使用
kubectl top nodes

# 查看 Pod 資源使用
kubectl top pods -A

# 查看資源配額使用狀況
kubectl describe resourcequota -n production

# ===== 1. 升級 Control Plane =====
# 1.1 檢查可用版本
apt-cache madison kubeadm

# 1.2 升級 kubeadm
sudo apt-mark unhold kubeadm
sudo apt-get update
sudo apt-get install -y kubeadm=1.29.0-*
sudo apt-mark hold kubeadm

# 1.3 檢查升級計畫
sudo kubeadm upgrade plan

# 1.4 執行升級
sudo kubeadm upgrade apply v1.29.0

# 1.5 升級 kubelet 和 kubectl
sudo apt-mark unhold kubelet kubectl
sudo apt-get install -y kubelet=1.29.0-* kubectl=1.29.0-*
sudo apt-mark hold kubelet kubectl

# 1.6 重啟 kubelet
sudo systemctl daemon-reload
sudo systemctl restart kubelet

# ===== 2. 升級 Worker Nodes =====
# 2.1 標記 Node 不可調度
kubectl cordon <node-name>

# 2.2 驅逐 Pod
kubectl drain <node-name> --ignore-daemonsets --delete-emptydir-data

# 2.3 在 Worker Node 上升級
sudo apt-get update
sudo apt-get install -y kubeadm=1.29.0-*
sudo kubeadm upgrade node

sudo apt-get install -y kubelet=1.29.0-* kubectl=1.29.0-*
sudo systemctl daemon-reload
sudo systemctl restart kubelet

# 2.4 恢復調度
kubectl uncordon <node-name>

apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: order-service-pdb
  namespace: production
spec:
  minAvailable: 2  # 最少保持 2 個 Pod
  # 或使用 maxUnavailable: 1
  selector:
    matchLabels:
      app: order-service

## Kubernetes 升級前檢查清單

### 事前準備
- [ ] 確認目標版本的 Release Notes
- [ ] 確認目標版本與現有版本相容（僅差一個 Minor 版本）
- [ ] 備份 etcd
- [ ] 備份所有 Kubernetes 資源（YAML）
- [ ] 確認 PDB 已設定
- [ ] 通知相關團隊

### 升級執行
- [ ] 升級 Control Plane
- [ ] 驗證 Control Plane 運作正常
- [ ] 逐一升級 Worker Node
- [ ] 每升級一個 Node 後驗證服務正常

### 升級後驗證
- [ ] 所有 Node 版本正確
- [ ] 所有系統 Pod 運作正常
- [ ] 應用程式運作正常
- [ ] 監控指標正常
- [ ] 執行 E2E 測試

# .gitlab-ci.yml
stages:
  - build
  - test
  - deploy

variables:
  IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA

build:
  stage: build
  image: docker:latest
  services:
    - docker:dind
  script:
    - docker build -t $IMAGE_TAG .
    - docker push $IMAGE_TAG

deploy-staging:
  stage: deploy
  image: bitnami/kubectl:latest
  script:
    - kubectl config use-context staging
    - kubectl set image deployment/myapp myapp=$IMAGE_TAG -n staging
    - kubectl rollout status deployment/myapp -n staging
  environment:
    name: staging

deploy-production:
  stage: deploy
  image: bitnami/kubectl:latest
  script:
    - kubectl config use-context production
    - kubectl set image deployment/myapp myapp=$IMAGE_TAG -n production
    - kubectl rollout status deployment/myapp -n production
  environment:
    name: production
  when: manual  # 手動觸發

<registry>/<project>/<image>:<tag>

範例：
myregistry.example.com/backend/order-service:v1.2.3
myregistry.example.com/backend/order-service:20260130-abc1234

# 使用 Trivy 掃描映像
trivy image myregistry/order-service:v1.2.3

# 在 CI 中整合
scan:
  stage: test
  script:
    - trivy image --exit-code 1 --severity HIGH,CRITICAL $IMAGE_TAG

mychart/
├── Chart.yaml          # Chart 元資料
├── values.yaml         # 預設值
├── values-prod.yaml    # 生產環境值
├── templates/          # Kubernetes 資源模板
│   ├── deployment.yaml
│   ├── service.yaml
│   ├── ingress.yaml
│   ├── configmap.yaml
│   └── _helpers.tpl    # 模板輔助函式
└── charts/             # 依賴的 Chart

# 安裝 Chart
helm install myapp ./mychart -f values-prod.yaml -n production

# 升級
helm upgrade myapp ./mychart -f values-prod.yaml -n production

# 回滾
helm rollback myapp 1 -n production

# 查看歷史
helm history myapp -n production

# 查看渲染後的 YAML
helm template myapp ./mychart -f values-prod.yaml

# values.yaml
replicaCount: 3

image:
  repository: myregistry/order-service
  tag: "v1.0.0"
  pullPolicy: IfNotPresent

resources:
  requests:
    cpu: 250m
    memory: 512Mi
  limits:
    cpu: 1000m
    memory: 1Gi

service:
  type: ClusterIP
  port: 80

ingress:
  enabled: true
  hosts:
    - host: api.example.com
      paths:
        - path: /orders
          pathType: Prefix

env:
  SPRING_PROFILES_ACTIVE: production

# 使用 ExternalName Service 連接外部資料庫
apiVersion: v1
kind: Service
metadata:
  name: external-db
  namespace: production
spec:
  type: ExternalName
  externalName: db.example.com
---
# 或使用 Endpoints 指向固定 IP
apiVersion: v1
kind: Service
metadata:
  name: external-db
spec:
  ports:
  - port: 5432
---
apiVersion: v1
kind: Endpoints
metadata:
  name: external-db
subsets:
- addresses:
  - ip: 10.0.0.100
  ports:
  - port: 5432

# ServiceMonitor（需要 Prometheus Operator）
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: order-service-monitor
  namespace: monitoring
spec:
  selector:
    matchLabels:
      app: order-service
  namespaceSelector:
    matchNames:
    - production
  endpoints:
  - port: http
    path: /actuator/prometheus
    interval: 15s

spec:
  containers:
  - name: app
    image: myapp:latest
    securityContext:
      runAsNonRoot: true
      runAsUser: 1000
      readOnlyRootFilesystem: true
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL

spec:
  terminationGracePeriodSeconds: 60
  containers:
  - name: app
    lifecycle:
      preStop:
        exec:
          command: ["/bin/sh", "-c", "sleep 10"]

// Java Spring Boot 範例
@PreDestroy
public void onShutdown() {
    log.info("Received shutdown signal, completing in-flight requests...");
    // 完成進行中的請求
}

# 只允許特定 Pod 存取資料庫
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: db-access-policy
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: database
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          access: database
    ports:
    - protocol: TCP
      port: 5432

## 部署前檢查
- [ ] Deployment YAML 已設定
  - [ ] replicas >= 2
  - [ ] Resource Request/Limit 已設定
  - [ ] Liveness/Readiness Probe 已設定
  - [ ] Pod Anti-affinity 已設定
- [ ] Service YAML 已設定
- [ ] ConfigMap/Secret 已建立
- [ ] Ingress 已設定（如需要）
- [ ] PodDisruptionBudget 已設定
- [ ] HPA 已設定（如需要）
- [ ] 映像已推送到 Registry
- [ ] 映像安全掃描已通過

## 部署後驗證
- [ ] Pod 狀態正常（Running）
- [ ] Service 可正常存取
- [ ] Ingress 可從外部存取
- [ ] 日誌正常輸出
- [ ] 監控指標正常
- [ ] 健康檢查端點正常

## 每日檢查
- [ ] 檢查所有 Node 狀態
- [ ] 檢查 Pod 異常重啟
- [ ] 檢查資源使用率
- [ ] 檢查告警通知

## 每週檢查
- [ ] 檢查憑證到期日
- [ ] 檢查 etcd 備份
- [ ] 檢查 PVC 使用率
- [ ] 清理無用的映像

## 每月檢查
- [ ] 檢查 Kubernetes 版本更新
- [ ] 審視 RBAC 權限設定
- [ ] 審視 ResourceQuota 設定
- [ ] 災難復原演練

## 升級準備
- [ ] 閱讀目標版本 Release Notes
- [ ] 確認版本相容性
- [ ] 備份 etcd
- [ ] 備份所有 Kubernetes YAML
- [ ] 確認 PDB 已設定
- [ ] 安排維護時間窗口
- [ ] 通知相關團隊

## 升級執行
- [ ] 升級 Control Plane
- [ ] 驗證 Control Plane 正常
- [ ] 逐一升級 Worker Node
- [ ] 每個 Node 升級後驗證

## 升級後驗證
- [ ] 所有 Node 版本正確
- [ ] 系統 Pod 正常運作
- [ ] 應用服務正常運作
- [ ] 監控指標正常
- [ ] E2E 測試通過