当前位置：首页 > news >正文

第十二章：完整的 DevOps 流水线案例：Spring Boot + Docker + K8s + GitLab CI

news 2026/7/1 18:49:17

本章将 CI/CD 系列的所有知识点串联起来，构建一个从代码提交到生产部署的完整 DevOps 流水线。以 Spring Boot 应用为例，涵盖代码检查、单元测试、镜像构建与扫描、Helm 部署、多环境管理、健康检查与回滚等全部环节。这是一个可以直接复制到实际项目中的生产级模板。

一、项目全景
1.1 技术栈

1.2 流水线 Stages
text
lint → test → build → scan → package → deploy-staging → deploy-production
二、项目结构
text
spring-boot-app/
├── .gitlab-ci.yml # CI/CD 流水线定义
├── Dockerfile # 多阶段构建
├── pom.xml # Maven 配置
├── src/ # 应用源码
│ └── main/
│ └── java/
├── chart/ # Helm Chart
│ ├── Chart.yaml
│ ├── values.yaml
│ ├── values/
│ │ ├── staging.yaml
│ │ └── production.yaml
│ └── templates/
│ ├── deployment.yaml
│ ├── service.yaml
│ ├── ingress.yaml
│ └── _helpers.tpl
└── k8s/ # GitOps 部署清单（可选）
└── overlays/
├── staging/
└── production/
三、Dockerfile：多阶段构建
dockerfile

阶段1：构建（使用完整 JDK）

FROM maven:3.8.4-openjdk-17 AS builder
WORKDIR /app
COPY pom.xml .
RUN mvn dependency:go-offline
COPY src ./src
RUN mvn clean package -DskipTests

阶段2：运行（使用精简 JRE）

FROM openjdk:17-jre-slim
WORKDIR /app
COPY --from=builder /app/target/*.jar app.jar
EXPOSE 8080
ENTRYPOINT [“java”, “-jar”, “/app/app.jar”]
四、Helm Chart 模板
chart/values.yaml：

# 默认配置replicaCount:2image:repository:${CI_REGISTRY_IMAGE}tag:latestpullPolicy:IfNotPresentservice:type:ClusterIPport:8080ingress:enabled:falsehost:""resources:limits:cpu:500mmemory:512Mirequests:cpu:250mmemory:256MilivenessProbe:httpGet:path:/actuator/healthport:8080initialDelaySeconds:30periodSeconds:10readinessProbe:httpGet:path:/actuator/healthport:8080initialDelaySeconds:10periodSeconds:5chart/templates/deployment.yaml：

apiVersion:apps/v1kind:Deploymentmetadata:name:{{include "myapp.fullname" .}}labels:app.kubernetes.io/name:{{include "myapp.name" .}}app.kubernetes.io/instance:{{.Release.Name}}spec:replicas:{{.Values.replicaCount}}selector:matchLabels:app.kubernetes.io/name:{{include "myapp.name" .}}app.kubernetes.io/instance:{{.Release.Name}}template:metadata:labels:app.kubernetes.io/name:{{include "myapp.name" .}}app.kubernetes.io/instance:{{.Release.Name}}spec:containers:-name:{{.Chart.Name}}image:"{{ .Values.image.repository }}:{{ .Values.image.tag }}"imagePullPolicy:{{.Values.image.pullPolicy}}ports:-containerPort:{{.Values.service.port}}livenessProbe:{{-toYaml .Values.livenessProbe|nindent 10}}readinessProbe:{{-toYaml .Values.readinessProbe|nindent 10}}resources:{{-toYaml .Values.resources|nindent 10}}

五、GitLab CI 完整流水线
.gitlab-ci.yml：

stages:-lint-test-build-scan-package-deploy-staging-deploy-productionvariables:MAVEN_OPTS:"-Dmaven.repo.local=.m2/repository"IMAGE_TAG:$CI_COMMIT_SHORT_SHACHART_PATH:./chartcache:paths:-.m2/repository/# ========== Stage 1: 代码检查 ==========lint:stage:lintimage:maven:3.8.4-openjdk-17script:-mvn checkstyle:checkallow_failure:trueonly:-merge_requests-main# ========== Stage 2: 单元测试 ==========test:unit:stage:testimage:maven:3.8.4-openjdk-17script:-mvn testartifacts:reports:junit:target/surefire-reports/*.xmlpaths:-target/surefire-reports/coverage:'/Coverage: \d+\.\d+%/'# ========== Stage 3: 构建镜像 ==========build-image:stage:buildimage:docker:latestservices:-docker:dindvariables:DOCKER_TLS_CERTDIR:"/certs"DOCKER_BUILDKIT:1script:-docker login-u $CI_REGISTRY_USER-p $CI_REGISTRY_PASSWORD $CI_REGISTRY-docker build--cache-from $CI_REGISTRY_IMAGE:latest-t $CI_REGISTRY_IMAGE:$IMAGE_TAG .-docker push $CI_REGISTRY_IMAGE:$IMAGE_TAGonly:-main-develop# ========== Stage 4: 镜像安全扫描 ==========scan-image:stage:scanimage:aquasec/trivy:latestscript:-trivy image--severity HIGH,CRITICAL--exit-code 1 $CI_REGISTRY_IMAGE:$IMAGE_TAGonly:-main# ========== Stage 5: 打包 Helm Chart ==========package-chart:stage:packageimage:alpine/helm:3.14script:-cd $CHART_PATH-helm dependency build-helm lint .-helm package .artifacts:paths:-$CHART_PATH/*.tgzonly:-main# ========== Stage 6: 部署到预发布环境 ==========deploy-staging:stage:deploy-stagingimage:alpine/helm:3.14before_script:-mkdir-p $HOME/.kube-echo "$KUBECONFIG_STAGING"|base64-d>$HOME/.kube/configscript:-cd $CHART_PATH-helm upgrade--install myapp ./ \-f values/staging.yaml \--set image.tag=$IMAGE_TAG \--namespace staging \--atomic \--timeout 5m-kubectl rollout status deployment/myapp-n stagingenvironment:name:stagingurl:https://staging.myapp.example.comonly:-develop-main# ========== Stage 7: 部署到生产环境（手动触发） ==========deploy-production:stage:deploy-productionimage:alpine/helm:3.14before_script:-mkdir-p $HOME/.kube-echo "$KUBECONFIG_PRODUCTION"|base64-d>$HOME/.kube/configscript:-cd $CHART_PATH-helm upgrade--install myapp ./ \-f values/production.yaml \--set image.tag=$IMAGE_TAG \--namespace production \--atomic \--timeout 5m-kubectl rollout status deployment/myapp-n productionenvironment:name:productionurl:https://myapp.example.comonly:-mainwhen:manual

六、多环境 Values 文件
chart/values/staging.yaml：

replicaCount:1resources:limits:cpu:200mmemory:256Mirequests:cpu:100mmemory:128Miingress:enabled:truehost:"staging.myapp.example.com"chart/values/production.yaml：

replicaCount:3resources:limits:cpu:500mmemory:512Mirequests:cpu:250mmemory:256Miingress:enabled:truehost:"myapp.example.com"

七、GitOps 版本：使用 ArgoCD 替代直接部署
如果采用 GitOps 模式，将 deploy-staging 和 deploy-production 替换为更新 Git 仓库的 Job：

update-gitops-staging:stage:deploy-stagingimage:alpine/git:latestscript:-git clone https://gitlab.com/team/gitops-repo.git-cd gitops-repo-sed -i "s|tag:.*|tag:$IMAGE_TAG|g" overlays/staging/kustomization.yaml-git config user.email "ci@gitlab.com"-git config user.name "GitLab CI"-git add .-git commit -m "deploy staging:$IMAGE_TAG"-git push https://$GITLAB_USER:$GITLAB_TOKEN@gitlab.com/team/gitops-repo.git mainenvironment:name:stagingonly:-main

ArgoCD 会自动检测 Git 仓库变更并将新镜像部署到集群。

八、流水线执行流程
text

开发人员提交代码到 develop 分支
↓
lint：代码风格检查
↓
test：单元测试 + 覆盖率报告
↓
build：构建 Docker 镜像并推送到仓库
↓
scan：Trivy 漏洞扫描（仅 main 分支）
↓
package：打包 Helm Chart
↓
deploy-staging：自动部署到预发布环境
↓
（人工审批）
↓
deploy-production：部署到生产环境
九、故障处理与回滚
9.1 自动回滚
Helm 的 --atomic 参数会在升级失败时自动回滚到上一个版本。

9.2 手动回滚

# 查看发布历史helmhistorymyapp-nproduction# 回滚到指定版本helm rollback myapp2-nproduction

9.3 在 CI 中集成回滚

rollback-production:stage:deploy-productionimage:alpine/helm:3.14script:-helm rollback myapp $ROLLBACK_REVISION-n productiononly:-mainwhen:manual

十、监控与告警集成（可选）
在流水线最后，可集成监控告警：

notify-deployment:stage:deploy-productionimage:curlimages/curl:latestscript:-curl -X POST -H "Content-type:application/json" \--data '{"text":"✅ 部署成功: myapp 版本 $IMAGE_TAG 已上线"}' \ $SLACK_WEBHOOKonly:-main