Docker微服务部署实战：从构建到生产环境优化

1. Docker微服务部署全景解析

当我们需要将十几个甚至几十个微服务部署到生产环境时，传统的手动部署方式会立即暴露出致命缺陷。去年我参与的一个电商项目就遭遇过这样的困境：每次发版需要3名运维人员花费整整两天时间进行部署和验证，而使用Docker后，同样的工作只需15分钟即可完成。这就是为什么掌握Docker化部署已经成为现代开发者的必备技能。

微服务架构的本质决定了部署的复杂性。每个服务都需要独立的环境配置、依赖管理和网络通信。Docker通过容器化技术完美解决了这些问题，它就像为每个微服务配备了一个标准化集装箱，无论运往哪个"港口"（服务器），都能保持内部环境完全一致。而Docker Compose则是协调这些集装箱的智能调度系统，通过简单的YAML文件就能定义复杂的服务拓扑关系。

本教程将带你完整走通从代码到部署的全流程，重点解决三个核心痛点：如何构建生产级Docker镜像、如何配置服务间通信、如何实现一键式部署。我们以Spring Cloud微服务项目为例，但方法论适用于任何技术栈。

2. 环境准备与工具链配置

2.1 基础环境搭建

在Ubuntu 20.04上安装Docker引擎时，建议使用官方源而非系统默认仓库。以下是经过生产验证的安装命令组合：

# 卸载旧版本 sudo apt-get remove docker docker-engine docker.io containerd runc # 设置仓库 sudo apt-get update sudo apt-get install \ ca-certificates \ curl \ gnupg \ lsb-release # 添加Docker官方GPG密钥 sudo mkdir -p /etc/apt/keyrings curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg # 设置稳定版仓库 echo \ "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \ $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null # 安装Docker引擎 sudo apt-get update sudo apt-get install docker-ce docker-ce-cli containerd.io docker-compose-plugin

关键提示：务必验证安装后的用户组权限，将当前用户加入docker组可避免每次sudo操作：sudo usermod -aG docker $USER执行后需要重新登录生效

2.2 开发环境配置

对于Java微服务项目，Maven的settings.xml配置直接影响构建效率。建议配置阿里云镜像和本地仓库路径：

<mirrors> <mirror> <id>aliyunmaven</id> <mirrorOf>*</mirrorOf> <name>阿里云公共仓库</name> <url>https://maven.aliyun.com/repository/public</url> </mirror> </mirrors> <localRepository>/path/to/your/local/repo</localRepository>

在IDEA中配置Maven时，开启并行构建能显著提升效率：

1. 进入Settings -> Build -> Build Tools -> Maven
2. 在Runner选项卡勾选"Delegate IDE build/run actions to Maven"
3. VM Options添加：-T 1C（表示每个CPU核心一个线程）

3. 微服务Docker化实战

3.1 构建优化镜像

常见的"fat jar"直接打包方式会产生臃肿的镜像。采用分层构建技术可减小30%-50%镜像体积：

# 第一阶段：构建环境 FROM maven:3.8.6-eclipse-temurin-17 as builder WORKDIR /app COPY pom.xml . RUN mvn dependency:go-offline COPY src ./src RUN mvn package -DskipTests # 第二阶段：运行环境 FROM eclipse-temurin:17-jre-jammy WORKDIR /app COPY --from=builder /app/target/*.jar ./app.jar EXPOSE 8080 ENTRYPOINT ["java", "-jar", "app.jar"]

构建时使用--no-cache参数避免缓存干扰：docker build --no-cache -t user-service:1.0.0 .

3.2 健康检查配置

生产环境必须为每个服务添加健康检查，这是服务可靠性的基石。在Dockerfile中添加：

HEALTHCHECK --interval=30s --timeout=3s \ CMD curl -f http://localhost:8080/actuator/health || exit 1

对应的Spring Boot需要暴露健康端点：

management.endpoints.web.exposure.include=health,info management.endpoint.health.show-details=always

4. Docker Compose编排艺术

4.1 网络拓扑设计

微服务间的通信需要精细的网络规划。下面是一个包含API网关、用户服务和商品服务的典型配置：

version: '3.8' networks: microservice-net: driver: bridge ipam: config: - subnet: 172.20.0.0/16 services: api-gateway: image: gateway:1.0 ports: - "8000:8000" networks: microservice-net: ipv4_address: 172.20.0.10 depends_on: user-service: condition: service_healthy product-service: condition: service_healthy user-service: image: user:1.0 networks: microservice-net: ipv4_address: 172.20.0.11 environment: - SPRING_PROFILES_ACTIVE=prod healthcheck: test: ["CMD", "curl", "-f", "http://localhost:8080/actuator/health"] interval: 30s timeout: 10s retries: 3

4.2 资源限制策略

防止单个服务耗尽主机资源，必须配置资源限制：

services: order-service: image: order:1.0 deploy: resources: limits: cpus: '0.5' memory: 512M reservations: cpus: '0.1' memory: 256M

经验值：Java服务建议预留内存为限制值的50%-70%，因为JVM本身需要开销

5. 生产级部署技巧

5.1 集中式日志管理

使用ELK栈收集容器日志的配置示例：

services: logstash: image: docker.elastic.co/logstash/logstash:8.6.2 volumes: - ./logstash.conf:/usr/share/logstash/pipeline/logstash.conf ports: - "5000:5000" filebeat: image: docker.elastic.co/beats/filebeat:8.6.2 user: root volumes: - /var/lib/docker/containers:/var/lib/docker/containers:ro - /var/run/docker.sock:/var/run/docker.sock:ro

对应的logstash.conf配置：

input { beats { port => 5044 } } filter { grok { match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} %{NUMBER:pid} --- \[%{DATA:thread}\] %{DATA:class} : %{GREEDYDATA:message}" } } } output { elasticsearch { hosts => ["http://elasticsearch:9200"] index => "microservice-logs-%{+YYYY.MM.dd}" } }

5.2 蓝绿部署方案

通过Docker Compose实现零停机部署：

# 部署新版本（假设当前运行的是v1） docker-compose -p ecommerce-v2 up -d # 健康检查 while ! curl -s http://localhost:8081/actuator/health >/dev/null; do sleep 10 done # 切换流量 docker-compose -p ecommerce-v1 stop

对应的Nginx配置动态更新：

#!/bin/bash OLD_CONTAINER=$(docker ps -aqf "name=ecommerce-v1") NEW_CONTAINER=$(docker ps -aqf "name=ecommerce-v2") docker exec nginx sed -i "s/$OLD_CONTAINER/$NEW_CONTAINER/g" /etc/nginx/conf.d/default.conf docker exec nginx nginx -s reload

6. 故障排查手册

6.1 容器网络诊断

当服务间无法通信时，按以下步骤排查：

1. 检查基础连接性

docker exec -it user-service ping product-service

2. 查看DNS解析

docker exec -it user-service cat /etc/resolv.conf

3. 检查iptables规则

sudo iptables -L -n --line-numbers

4. 验证端口映射

docker inspect -f '{{range $p, $conf := .NetworkSettings.Ports}} {{$p}} -> {{(index $conf 0).HostPort}} {{end}}' user-service

6.2 内存泄漏分析

Java服务内存问题诊断流程：

1. 进入容器获取进程PID

docker exec -it user-service jps -l

2. 生成堆转储文件

docker exec -it user-service jmap -dump:live,format=b,file=/tmp/heap.hprof <pid>

3. 拷贝到本地分析

docker cp user-service:/tmp/heap.hprof .

4. 使用Eclipse MAT或VisualVM分析内存占用

7. 性能调优实战

7.1 JVM参数优化

针对Docker环境的JVM特殊配置：

ENV JAVA_OPTS="-XX:+UseContainerSupport \ -XX:MaxRAMPercentage=75.0 \ -XX:+HeapDumpOnOutOfMemoryError \ -XX:HeapDumpPath=/opt/traces/heapdump.hprof \ -XX:+UseG1GC \ -XX:MaxGCPauseMillis=200"

关键参数说明：

• UseContainerSupport：让JVM识别容器内存限制
• MaxRAMPercentage：设置堆内存占容器可用内存的比例
• G1GC：推荐用于微服务的垃圾回收器

7.2 容器内核参数

在宿主机上优化内核参数：

# 增加文件描述符限制 echo "fs.file-max = 100000" >> /etc/sysctl.conf # 优化TCP协议栈 echo "net.ipv4.tcp_tw_reuse = 1" >> /etc/sysctl.conf echo "net.core.somaxconn = 32768" >> /etc/sysctl.conf # 应用修改 sysctl -p

对于高并发场景，还需要调整容器内进程数限制：

services: user-service: ulimits: nproc: 65535 nofile: soft: 20000 hard: 40000

8. 安全加固方案

8.1 镜像安全扫描

集成Trivy进行漏洞扫描：

# 安装Trivy curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin # 扫描镜像 trivy image --severity HIGH,CRITICAL user-service:1.0 # 集成到CI流程 trivy image --exit-code 1 --ignore-unfixed user-service:1.0

8.2 最小权限原则

容器运行时安全配置：

services: payment-service: read_only: true security_opt: - no-new-privileges:true cap_drop: - ALL tmpfs: - /tmp:rw,noexec,nosuid

关键安全措施：

• read_only：阻止容器内文件系统修改
• no-new-privileges：禁止进程提升权限
• cap_drop：移除所有Linux能力
• tmpfs：临时文件系统挂载

9. 监控体系构建

9.1 Prometheus监控

Spring Boot集成Prometheus：

1. 添加依赖

<dependency> <groupId>io.micrometer</groupId> <artifactId>micrometer-registry-prometheus</artifactId> </dependency>

2. 配置application.yml

management: endpoints: web: exposure: include: prometheus,health,metrics metrics: tags: application: ${spring.application.name}

3. Docker Compose配置

services: prometheus: image: prom/prometheus ports: - "9090:9090" volumes: - ./prometheus.yml:/etc/prometheus/prometheus.yml grafana: image: grafana/grafana ports: - "3000:3000"

9.2 自定义业务指标

记录订单创建耗时示例：

@RestController public class OrderController { private final Timer orderTimer; public OrderController(MeterRegistry registry) { this.orderTimer = Timer.builder("order.create.time") .description("订单创建耗时") .tags("region", System.getenv("REGION")) .register(registry); } @PostMapping("/orders") public Order createOrder(@RequestBody OrderRequest request) { return orderTimer.record(() -> { // 业务逻辑 return orderService.create(request); }); } }

10. 持续交付流水线

10.1 Jenkins流水线

完整的CI/CD流程示例：

pipeline { agent any environment { DOCKER_REGISTRY = 'registry.example.com' PROJECT_VERSION = readMavenPom().getVersion() } stages { stage('Build') { steps { sh 'mvn clean package -DskipTests' } } stage('Test') { steps { sh 'mvn test' junit '**/target/surefire-reports/*.xml' } } stage('Build Docker') { steps { script { docker.build("${DOCKER_REGISTRY}/user-service:${PROJECT_VERSION}") } } } stage('Deploy Staging') { steps { sshPublisher( publishers: [ sshPublisherDesc( configName: 'staging-server', transfers: [ sshTransfer( sourceFiles: 'docker-compose.yml', removePrefix: '', remoteDirectory: '/opt/microservices' ) ], execCommand: """ docker pull ${DOCKER_REGISTRY}/user-service:${PROJECT_VERSION} docker-compose up -d """ ) ] ) } } } }

10.2 镜像版本策略

推荐采用语义化版本+Git SHA的组合：

# 获取当前commit的短SHA GIT_SHA=$(git rev-parse --short HEAD) # 构建并推送镜像 docker build -t user-service:${PROJECT_VERSION}-${GIT_SHA} . docker push user-service:${PROJECT_VERSION}-${GIT_SHA}

回滚时只需指定之前的SHA即可：

docker-compose pull user-service:1.2.0-4f3b2c1 docker-compose up -d

11. 多环境配置管理

11.1 环境变量策略

通过Docker Compose管理多环境配置：

services: user-service: image: user-service:1.0 env_file: - .env.${DEPLOY_ENV}

对应.env.prod文件示例：

DB_URL=jdbc:mysql://prod-db:3306/user REDIS_HOST=prod-redis SPRING_PROFILES_ACTIVE=prod

启动时指定环境：

DEPLOY_ENV=prod docker-compose up -d

11.2 配置中心集成

与Nacos配置中心集成的方案：

1. 添加依赖

<dependency> <groupId>com.alibaba.cloud</groupId> <artifactId>spring-cloud-starter-alibaba-nacos-config</artifactId> </dependency>

2. bootstrap.yml配置

spring: cloud: nacos: config: server-addr: ${NACOS_HOST:nacos}:8848 file-extension: yaml shared-configs: ->
Docker Compose配置
services: nacos: image: nacos/nacos-server:2.0.3 ports: - "8848:8848" environment: - MODE=standalone
12. 存储方案设计
12.1 数据库容器化
MySQL生产级配置示例：
services: mysql: image: mysql:8.0 command: - --default-authentication-plugin=mysql_native_password - --character-set-server=utf8mb4 - --collation-server=utf8mb4_unicode_ci - --max_connections=1000 environment: MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASSWORD} MYSQL_DATABASE: user_db volumes: - mysql_data:/var/lib/mysql - ./my.cnf:/etc/mysql/conf.d/my.cnf healthcheck: test: ["CMD", "mysqladmin", "ping", "-h", "localhost"] interval: 10s timeout: 5s retries: 3 volumes: mysql_data:
对应的my.cnf优化配置：
[mysqld] innodb_buffer_pool_size = 1G innodb_log_file_size = 256M innodb_flush_log_at_trx_commit = 2 sync_binlog = 100
12.2 Redis高可用方案
Redis哨兵模式配置：
services: redis-master: image: redis:6.2 command: redis-server --requirepass ${REDIS_PASSWORD} redis-replica: image: redis:6.2 command: redis-server --replicaof redis-master 6379 --requirepass ${REDIS_PASSWORD} --masterauth ${REDIS_PASSWORD} depends_on: - redis-master redis-sentinel: image: redis:6.2 command: redis-sentinel /usr/local/etc/redis/sentinel.conf volumes: - ./sentinel.conf:/usr/local/etc/redis/sentinel.conf environment: - SENTINEL_DOWN_AFTER=30000 - SENTINEL_FAILOVER=180000 depends_on: - redis-master - redis-replica
sentinel.conf基础配置：
sentinel monitor mymaster redis-master 6379 2 sentinel auth-pass mymaster ${REDIS_PASSWORD} sentinel down-after-milliseconds mymaster 5000 sentinel parallel-syncs mymaster 1
13. 服务网格集成
13.1 Istio Sidecar注入
Docker Compose与Istio的集成方案：
准备带Envoy的Dockerfile
FROM eclipse-temurin:17-jre-jammy as runtime COPY --from=istio/proxyv2:1.15.0 /usr/local/bin/pilot-agent /usr/local/bin/ COPY --from=istio/proxyv2:1.15.0 /usr/local/bin/envoy /usr/local/bin/ COPY entrypoint.sh / ENTRYPOINT ["/entrypoint.sh"]
entrypoint.sh启动脚本
#!/bin/sh # 启动应用 java -jar /app.jar & # 启动Envoy exec pilot-agent proxy sidecar \ --serviceCluster user-service \ --discoveryAddress istiod.istio-system:15012
13.2 流量镜像配置
通过Istio实现生产流量复制：
apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: user-service spec: hosts: - user-service http: - route: - destination: host: user-service subset: v1 weight: 100 - destination: host: user-service subset: v2 weight: 0 mirror: host: user-service subset: v2 mirror_percent: 50
对应的Docker Compose服务定义：
services: user-service-v1: image: user-service:1.0 labels: version: "v1" user-service-v2: image: user-service:2.0 labels: version: "v2"
14. 性能基准测试
14.1 压力测试方案
使用JMeter进行容器化压力测试：
services: jmeter: image: justb4/jmeter:5.4.1 volumes: - ./tests:/tests command: - -n - -t /tests/user-service.jmx - -l /tests/results.jtl - -Jusers=100 - -Jduration=300 - -Jhost=user-service
对应的JMX测试计划关键配置：
<ThreadGroup guiclass="ThreadGroupGui" testclass="ThreadGroup" testname="User Service Load Test"> <intProp name="ThreadGroup.num_threads">${__P(users,100)}</intProp> <intProp name="ThreadGroup.ramp_time">60</intProp> <longProp name="ThreadGroup.duration">${__P(duration,300)}</longProp> </ThreadGroup> <HTTPSamplerProxy guiclass="HttpTestSampleGui" testclass="HTTPSamplerProxy" testname="Create User"> <stringProp name="HTTPSampler.domain">${__P(host)}</stringProp> <stringProp name="HTTPSampler.port">8080</stringProp> <stringProp name="HTTPSampler.path">/api/users</stringProp> </HTTPSamplerProxy>
14.2 性能分析工具
集成Arthas进行运行时诊断：
# 在Dockerfile中添加Arthas RUN curl -L https://arthas.aliyun.com/arthas-boot.jar -o /opt/arthas/arthas-boot.jar # 启动时挂载 docker run -it --rm \ -v /opt/arthas:/opt/arthas \ user-service:1.0 \ java -jar /app.jar -javaagent:/opt/arthas/arthas-agent.jar
常用诊断命令：
# 查看方法调用耗时 watch com.example.service.UserService getUser '{params, returnObj}' -x 2 # 监控JVM状态 dashboard # 方法调用追踪 trace com.example.controller.UserController *
15. 成本优化策略
15.1 镜像瘦身技巧
多阶段构建结合JLink定制JRE：
# 第一阶段：JDK环境构建 FROM eclipse-temurin:17-jdk-jammy as jdk RUN jlink \ --add-modules java.base,java.logging,java.xml,java.naming,java.sql,java.management \ --strip-debug \ --no-man-pages \ --no-header-files \ --compress=2 \ --output /opt/jre-minimal # 第二阶段：应用构建 FROM maven:3.8.6-eclipse-temurin-17 as builder WORKDIR /app COPY pom.xml . RUN mvn dependency:go-offline COPY src ./src RUN mvn package -DskipTests # 第三阶段：最终镜像 FROM debian:bullseye-slim COPY --from=jdk /opt/jre-minimal /opt/jre-minimal ENV PATH="/opt/jre-minimal/bin:${PATH}" WORKDIR /app COPY --from=builder /app/target/*.jar ./app.jar EXPOSE 8080 ENTRYPOINT ["java", "-jar", "app.jar"]
15.2 资源利用率提升
使用Docker资源配额实现超卖：
services: inventory-service: deploy: resources: limits: cpus: '1' memory: 1G reservations: cpus: '0.2' memory: 256M
结合Kubernetes的oversubscription配置：
apiVersion: node.k8s.io/v1 kind: RuntimeClass metadata: name: oversubscribed handler: oversubscribed overhead: podFixed: memory: "1Gi" cpu: "500m"
16. 跨平台部署方案
16.1 多架构镜像构建
使用buildx构建ARM和AMD64镜像：
# 创建构建器实例 docker buildx create --name multiarch --use # 启动构建器 docker buildx inspect --bootstrap # 构建多平台镜像 docker buildx build \ --platform linux/amd64,linux/arm64 \ -t user-service:1.0 \ --push .
对应的Dockerfile需要调整：
FROM --platform=$BUILDPLATFORM maven:3.8.6-eclipse-temurin-17 as builder # ...构建步骤... FROM eclipse-temurin:17-jre-jammy # 使用TARGETARCH环境变量 RUN if [ "$TARGETARCH" = "arm64" ]; then \ echo "ARM64 specific setup"; \ else \ echo "AMD64 setup"; \ fi
16.2 混合云部署
通过Docker Context管理多环境：
# 添加AWS ECS上下文 docker context create ecs aws-prod \ --description "AWS Production" \ --from-env # 添加Azure ACI上下文 docker context create aci azure-staging \ --description "Azure Staging" \ --subscription-id $AZURE_SUBSCRIPTION \ --resource-group $AZURE_RESOURCE_GROUP # 切换上下文 docker context use aws-prod # 部署到AWS docker compose up
对应的docker-compose.prod.yml需要适配云平台特性：
services: user-service: deploy: resources: limits: cpus: '1' memory: 1G x-aws-policies: - AmazonDynamoDBReadOnlyAccess x-azure-location: eastus
17. 灾难恢复设计
17.1 备份策略实施
数据库定时备份方案：
services: mysql-backup: image: mysql:8.0 volumes: - backup_data:/backups command: > bash -c ' while true; do mysqldump -h mysql -u root -p$${DB_ROOT_PASSWORD} --all-databases | gzip > /backups/db-$$(date +%Y%m%d-%H%M%S).sql.gz find /backups -name "*.sql.gz" -mtime +7 -delete sleep 86400 done' depends_on: - mysql volumes: backup_data:
17.2 快速恢复流程
从备份恢复的自动化脚本：
#!/bin/bash # 获取最新备份文件 LATEST_BACKUP=$(ls -t /backups/*.sql.gz | head -n 1) # 停止应用 docker-compose stop user-service order-service # 恢复数据库 gunzip < $LATEST_BACKUP | docker exec -i mysql mysql -u root -p${DB_ROOT_PASSWORD} # 启动服务 docker-compose up -d # 验证恢复 curl -X POST http://localhost:8080/actuator/refresh
18. 服务治理进阶
18.1 熔断降级配置
Spring Cloud Circuit Breaker集成：
添加依赖
<dependency> <groupId>org.springframework.cloud</groupId> <artifactId>spring-cloud-starter-circuitbreaker-resilience4j</artifactId> </dependency>
配置application.yml
resilience4j: circuitbreaker: instances: userService: failureRateThreshold: 50 minimumNumberOfCalls: 10 automaticTransitionFromOpenToHalfOpenEnabled: true waitDurationInOpenState: 10s permittedNumberOfCallsInHalfOpenState: 3 slidingWindowType: COUNT_BASED slidingWindowSize: 10
使用注解
@CircuitBreaker(name = "userService", fallbackMethod = "getUserFallback") public User getUser(Long id) { return userClient.getUser(id); } private User getUserFallback(Long id, Exception e) { return cachedUserService.getUser(id); }
18.2 分布式追踪
集成Jaeger的Docker配置：
services: jaeger: image: jaegertracing/all-in-one:1.39 ports: - "16686:16686" - "6831:6831/udp" user-service: environment: - JAEGER_AGENT_HOST=jaeger - JAEGER_AGENT_PORT=6831 - JAEGER_SAMPLER_TYPE=const - JAEGER_SAMPLER_PARAM=1
Spring Boot配置：
management.tracing.sampling.probability=1.0 opentracing.jaeger.enable-b3-propagation=true
19. 安全审计方案
19.1 镜像签名验证
使用Notary进行签名验证：
# 安装Docker Content Trust export DOCKER_CONTENT_TRUST=1 # 构建并推送签名镜像 docker build -t registry.example.com/user-service:1.0 . docker push registry.example.com/user-service:1.0 # 拉取时验证签名 docker pull registry.example.com/user-service:1.0
对应的Compose配置：
services: user-service: image: registry.example.com/user-service:1.0 environment: - DOCKER_CONTENT_TRUST=1
19.2 运行时安全监控
使用Falco检测异常行为：
services: falco: image: falcosecurity/falco:0.33.0 privileged: true volumes: - /var/run/docker.sock:/host/var/run/docker.sock - /dev:/host/dev - /proc:/host/proc:ro - /lib/modules:/host/lib/modules:ro - /usr:/host/usr:ro environment: - HOST_ROOT=/
关键检测规则示例：
- rule: Unexpected Privileged Container desc: Detect privileged containers not in allowlist condition: container and privileged=true and not container.image.repository in (allowed_privileged_images) output: Privileged container started (user=%user.name command=%proc.cmdline %container.info) priority: WARNING
20. 架构演进路线
20.1 从Compose到K8s
准备Kubernetes迁移的Compose配置：
services: user-service: image: user-service:1.0 deploy: replicas: 3 update_config: parallelism: 1 delay: 10s restart_policy: condition: on-failure healthcheck: test: ["CMD", "curl", "-f", "http://localhost:8080/actuator/health"] interval: 30s timeout: 10s retries: 3
对应的Kubernetes Deployment：
apiVersion: apps/v1 kind: Deployment metadata: name: user-service spec: replicas: 3 strategy: type: RollingUpdate rollingUpdate: maxSurge: 1 maxUnavailable: 0 selector: matchLabels: app: user-service template: metadata: labels: app: user-service spec: containers: - name: user-service image: user-service:1.0 livenessProbe: httpGet: path: /actuator/health port: 8080 initialDelaySeconds: 30 periodSeconds: 10 failureThreshold: 3
20.2 服务网格迁移
为Istio准备的Docker网络配置：
services: user-service: networks: - default - istio-net networks: istio-net: driver: bridge attachable: true labels: com.docker.compose.network: istio-net
对应的Istio Sidecar配置：
apiVersion: networking.istio.io/v1alpha3 kind: Sidecar metadata: name: user-service spec: workloadSelector: labels: app: user-service ingress: - port: number: 8080 protocol: HTTP name: http defaultEndpoint: 127.0.0.1:8080 egress: - hosts: - "./*" - "istio-system/*"