Add-ons 企业演练基线与验收

apiVersion: v1
kind: Namespace
metadata:
  name: orders
  labels:
    team: commerce
    environment: staging
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: v1.N
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: orders-api
  namespace: orders
automountServiceAccountToken: false
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: orders-api
  namespace: orders
spec:
  replicas: 3
  revisionHistoryLimit: 5
  minReadySeconds: 10
  progressDeadlineSeconds: 600
  strategy:
    rollingUpdate: {maxSurge: 1, maxUnavailable: 0}
  selector:
    matchLabels: {app.kubernetes.io/name: orders-api}
  template:
    metadata:
      labels: {app.kubernetes.io/name: orders-api}
    spec:
      serviceAccountName: orders-api
      terminationGracePeriodSeconds: 60
      securityContext:
        runAsNonRoot: true
        seccompProfile: {type: RuntimeDefault}
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels: {app.kubernetes.io/name: orders-api}
      containers:
        - name: api
          image: REPLACE_IMAGE_DIGEST
          ports: [{name: http, containerPort: 8080}]
          envFrom: [{secretRef: {name: orders-runtime}}]
          resources:
            requests: {cpu: 250m, memory: 256Mi}
            limits: {cpu: "1", memory: 512Mi}
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: {drop: [ALL]}
          startupProbe:
            httpGet: {path: /healthz, port: http}
            failureThreshold: 30
            periodSeconds: 5
          readinessProbe:
            httpGet: {path: /readyz, port: http}
            periodSeconds: 5
          livenessProbe:
            httpGet: {path: /healthz, port: http}
            periodSeconds: 10
          volumeMounts: [{name: tmp, mountPath: /tmp}]
      volumes: [{name: tmp, emptyDir: {sizeLimit: 256Mi}}]
---
apiVersion: v1
kind: Service
metadata:
  name: orders-api
  namespace: orders
  labels: {app.kubernetes.io/name: orders-api}
spec:
  selector: {app.kubernetes.io/name: orders-api}
  ports: [{name: http, port: 80, targetPort: http}]
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata: {name: orders-api, namespace: orders}
spec:
  minAvailable: 2
  selector:
    matchLabels: {app.kubernetes.io/name: orders-api}

kubectl config current-context
kubectl version
kubectl get nodes -o wide
kubectl apply --dry-run=server -f orders-base.yaml
kubectl apply -f orders-base.yaml
kubectl -n orders rollout status deployment/orders-api --timeout=10m
kubectl -n orders get pods,pdb,endpointslices