雲端原生應用開發實戰：從微服務到 Kubernetes 的完整部署指南

"""
微服務架構實作範例
展示使用者服務與訂單服務的獨立部署模式
"""

from flask import Flask, jsonify, request, abort
from flask_cors import CORS
import requests
from typing import Dict, List, Optional
import logging
from datetime import datetime
import os

logging.basicConfig(level=logging.INFO)
logger = logging.getLogger(__name__)

class UserService:
    """使用者服務類別"""
    
    def __init__(self):
        """初始化使用者服務"""
        self.app = Flask(__name__)
        CORS(self.app)
        self.users_db = self._init_users_database()
        self._setup_routes()
        
    def _init_users_database(self) -> Dict:
        """初始化使用者資料庫(模擬)"""
        return {
            1: {
                'id': 1,
                'name': '陳小明',
                'email': '[email protected]',
                'role': 'admin',
                'created_at': '2025-01-01T10:00:00Z'
            },
            2: {
                'id': 2,
                'name': '林小華',
                'email': '[email protected]',
                'role': 'user',
                'created_at': '2025-01-15T14:30:00Z'
            },
            3: {
                'id': 3,
                'name': '王小美',
                'email': '[email protected]',
                'role': 'user',
                'created_at': '2025-02-01T09:15:00Z'
            }
        }
    
    def _setup_routes(self):
        """設定路由"""
        
        @self.app.route('/health', methods=['GET'])
        def health_check():
            """健康檢查端點"""
            return jsonify({
                'status': 'healthy',
                'service': 'user-service',
                'timestamp': datetime.now().isoformat()
            })
        
        @self.app.route('/api/v1/users', methods=['GET'])
        def get_all_users():
            """取得所有使用者"""
            logger.info("請求取得所有使用者")
            users_list = list(self.users_db.values())
            return jsonify({
                'success': True,
                'count': len(users_list),
                'data': users_list
            })
        
        @self.app.route('/api/v1/users/<int:user_id>', methods=['GET'])
        def get_user_by_id(user_id: int):
            """根據 ID 取得特定使用者"""
            logger.info(f"請求取得使用者 ID: {user_id}")
            
            user = self.users_db.get(user_id)
            if not user:
                logger.warning(f"使用者 ID {user_id} 不存在")
                abort(404, description=f"使用者 {user_id} 不存在")
            
            return jsonify({
                'success': True,
                'data': user
            })
        
        @self.app.route('/api/v1/users', methods=['POST'])
        def create_user():
            """建立新使用者"""
            data = request.get_json()
            
            required_fields = ['name', 'email']
            if not all(field in data for field in required_fields):
                abort(400, description="缺少必要欄位: name, email")
            
            new_id = max(self.users_db.keys()) + 1
            
            new_user = {
                'id': new_id,
                'name': data['name'],
                'email': data['email'],
                'role': data.get('role', 'user'),
                'created_at': datetime.now().isoformat()
            }
            
            self.users_db[new_id] = new_user
            logger.info(f"建立新使用者: {new_user['name']}")
            
            return jsonify({
                'success': True,
                'message': '使用者建立成功',
                'data': new_user
            }), 201
        
        @self.app.route('/api/v1/users/<int:user_id>', methods=['DELETE'])
        def delete_user(user_id: int):
            """刪除使用者"""
            if user_id not in self.users_db:
                abort(404, description=f"使用者 {user_id} 不存在")
            
            deleted_user = self.users_db.pop(user_id)
            logger.info(f"刪除使用者: {deleted_user['name']}")
            
            return jsonify({
                'success': True,
                'message': '使用者刪除成功',
                'data': deleted_user
            })
    
    def run(self, port: int = 5001):
        """啟動服務"""
        logger.info(f"使用者服務啟動於 port {port}")
        self.app.run(host='0.0.0.0', port=port, debug=True)

class OrderService:
    """訂單服務類別"""
    
    def __init__(self, user_service_url: str = 'http://localhost:5001'):
        """
        初始化訂單服務
        
        Args:
            user_service_url: 使用者服務的 URL
        """
        self.app = Flask(__name__)
        CORS(self.app)
        self.user_service_url = user_service_url
        self.orders_db = self._init_orders_database()
        self._setup_routes()
        
    def _init_orders_database(self) -> Dict:
        """初始化訂單資料庫(模擬)"""
        return {
            1: {
                'id': 1,
                'user_id': 1,
                'items': [
                    {'product': '筆記型電腦', 'quantity': 1, 'price': 30000}
                ],
                'total': 30000,
                'status': 'completed',
                'created_at': '2025-02-10T10:30:00Z'
            },
            2: {
                'id': 2,
                'user_id': 2,
                'items': [
                    {'product': '滑鼠', 'quantity': 2, 'price': 500},
                    {'product': '鍵盤', 'quantity': 1, 'price': 2000}
                ],
                'total': 3000,
                'status': 'processing',
                'created_at': '2025-02-15T14:20:00Z'
            }
        }
    
    def _get_user_info(self, user_id: int) -> Optional[Dict]:
        """
        從使用者服務取得使用者資訊
        
        Args:
            user_id: 使用者 ID
            
        Returns:
            使用者資訊字典或 None
        """
        try:
            response = requests.get(
                f"{self.user_service_url}/api/v1/users/{user_id}",
                timeout=5
            )
            
            if response.status_code == 200:
                return response.json()['data']
            else:
                logger.warning(f"無法取得使用者 {user_id} 資訊")
                return None
                
        except requests.RequestException as e:
            logger.error(f"呼叫使用者服務失敗: {e}")
            return None
    
    def _setup_routes(self):
        """設定路由"""
        
        @self.app.route('/health', methods=['GET'])
        def health_check():
            """健康檢查端點"""
            return jsonify({
                'status': 'healthy',
                'service': 'order-service',
                'timestamp': datetime.now().isoformat()
            })
        
        @self.app.route('/api/v1/orders', methods=['GET'])
        def get_all_orders():
            """取得所有訂單"""
            logger.info("請求取得所有訂單")
            orders_list = list(self.orders_db.values())
            
            enriched_orders = []
            for order in orders_list:
                user_info = self._get_user_info(order['user_id'])
                enriched_order = order.copy()
                enriched_order['user'] = user_info
                enriched_orders.append(enriched_order)
            
            return jsonify({
                'success': True,
                'count': len(enriched_orders),
                'data': enriched_orders
            })
        
        @self.app.route('/api/v1/orders/<int:order_id>', methods=['GET'])
        def get_order_by_id(order_id: int):
            """根據 ID 取得特定訂單"""
            logger.info(f"請求取得訂單 ID: {order_id}")
            
            order = self.orders_db.get(order_id)
            if not order:
                abort(404, description=f"訂單 {order_id} 不存在")
            
            user_info = self._get_user_info(order['user_id'])
            enriched_order = order.copy()
            enriched_order['user'] = user_info
            
            return jsonify({
                'success': True,
                'data': enriched_order
            })
        
        @self.app.route('/api/v1/orders', methods=['POST'])
        def create_order():
            """建立新訂單"""
            data = request.get_json()
            
            required_fields = ['user_id', 'items']
            if not all(field in data for field in required_fields):
                abort(400, description="缺少必要欄位: user_id, items")
            
            user_info = self._get_user_info(data['user_id'])
            if not user_info:
                abort(404, description=f"使用者 {data['user_id']} 不存在")
            
            total = sum(
                item['quantity'] * item['price']
                for item in data['items']
            )
            
            new_id = max(self.orders_db.keys()) + 1
            new_order = {
                'id': new_id,
                'user_id': data['user_id'],
                'items': data['items'],
                'total': total,
                'status': 'pending',
                'created_at': datetime.now().isoformat()
            }
            
            self.orders_db[new_id] = new_order
            logger.info(f"建立新訂單: ID {new_id}, 總額 {total}")
            
            return jsonify({
                'success': True,
                'message': '訂單建立成功',
                'data': new_order
            }), 201
    
    def run(self, port: int = 5002):
        """啟動服務"""
        logger.info(f"訂單服務啟動於 port {port}")
        self.app.run(host='0.0.0.0', port=port, debug=True)

class APIGateway:
    """API Gateway 統一入口"""
    
    def __init__(self, 
                 user_service_url: str = 'http://localhost:5001',
                 order_service_url: str = 'http://localhost:5002'):
        """初始化 API Gateway"""
        self.app = Flask(__name__)
        CORS(self.app)
        self.user_service_url = user_service_url
        self.order_service_url = order_service_url
        self._setup_routes()
    
    def _setup_routes(self):
        """設定路由"""
        
        @self.app.route('/health', methods=['GET'])
        def health_check():
            """健康檢查"""
            return jsonify({
                'status': 'healthy',
                'service': 'api-gateway',
                'timestamp': datetime.now().isoformat()
            })
        
        @self.app.route('/api/users', methods=['GET', 'POST'])
        @self.app.route('/api/users/<int:user_id>', methods=['GET', 'DELETE'])
        def proxy_users(user_id=None):
            """代理使用者服務請求"""
            if user_id:
                url = f"{self.user_service_url}/api/v1/users/{user_id}"
            else:
                url = f"{self.user_service_url}/api/v1/users"
            
            return self._proxy_request(url)
        
        @self.app.route('/api/orders', methods=['GET', 'POST'])
        @self.app.route('/api/orders/<int:order_id>', methods=['GET'])
        def proxy_orders(order_id=None):
            """代理訂單服務請求"""
            if order_id:
                url = f"{self.order_service_url}/api/v1/orders/{order_id}"
            else:
                url = f"{self.order_service_url}/api/v1/orders"
            
            return self._proxy_request(url)
    
    def _proxy_request(self, url: str):
        """代理請求到後端服務"""
        try:
            if request.method == 'GET':
                response = requests.get(url, timeout=10)
            elif request.method == 'POST':
                response = requests.post(
                    url,
                    json=request.get_json(),
                    timeout=10
                )
            elif request.method == 'DELETE':
                response = requests.delete(url, timeout=10)
            else:
                abort(405)
            
            return (response.content, response.status_code, 
                   response.headers.items())
            
        except requests.RequestException as e:
            logger.error(f"代理請求失敗: {e}")
            abort(503, description="後端服務暫時無法使用")
    
    def run(self, port: int = 5000):
        """啟動 Gateway"""
        logger.info(f"API Gateway 啟動於 port {port}")
        self.app.run(host='0.0.0.0', port=port, debug=True)

if __name__ == "__main__":
    import sys
    
    if len(sys.argv) < 2:
        print("使用方式: python microservices.py [user|order|gateway]")
        sys.exit(1)
    
    service_type = sys.argv[1]
    
    if service_type == 'user':
        service = UserService()
        service.run(port=5001)
        
    elif service_type == 'order':
        service = OrderService(user_service_url='http://localhost:5001')
        service.run(port=5002)
        
    elif service_type == 'gateway':
        gateway = APIGateway(
            user_service_url='http://localhost:5001',
            order_service_url='http://localhost:5002'
        )
        gateway.run(port=5000)
        
    else:
        print(f"未知的服務類型: {service_type}")
        sys.exit(1)

FROM python:3.11-slim as builder

WORKDIR /build

RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        gcc \
        python3-dev && \
    rm -rf /var/lib/apt/lists/*

COPY requirements.txt .

RUN pip install --no-cache-dir --user -r requirements.txt

FROM python:3.11-slim

RUN useradd -m -u 1000 appuser && \
    mkdir -p /app && \
    chown -R appuser:appuser /app

WORKDIR /app

COPY --from=builder /root/.local /home/appuser/.local

ENV PATH=/home/appuser/.local/bin:$PATH

COPY --chown=appuser:appuser . .

USER appuser

EXPOSE 5001

HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
    CMD python -c "import requests; requests.get('http://localhost:5001/health')" || exit 1

CMD ["python", "-u", "user_service.py"]

version: '3.8'

services:
  
  user-service:
    build:
      context: ./user-service
      dockerfile: Dockerfile
    container_name: user-service
    ports:
      - "5001:5001"
    networks:
      - microservices-network
    environment:
      - FLASK_ENV=production
      - LOG_LEVEL=INFO
    volumes:
      - user-logs:/app/logs
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5001/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M
  
  order-service:
    build:
      context: ./order-service
      dockerfile: Dockerfile
    container_name: order-service
    ports:
      - "5002:5002"
    networks:
      - microservices-network
    environment:
      - FLASK_ENV=production
      - USER_SERVICE_URL=http://user-service:5001
      - LOG_LEVEL=INFO
    volumes:
      - order-logs:/app/logs
    depends_on:
      user-service:
        condition: service_healthy
      redis:
        condition: service_healthy
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5002/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
  
  api-gateway:
    build:
      context: ./api-gateway
      dockerfile: Dockerfile
    container_name: api-gateway
    ports:
      - "5000:5000"
    networks:
      - microservices-network
    environment:
      - USER_SERVICE_URL=http://user-service:5001
      - ORDER_SERVICE_URL=http://order-service:5002
      - LOG_LEVEL=INFO
    depends_on:
      - user-service
      - order-service
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    deploy:
      resources:
        limits:
          cpus: '0.3'
          memory: 256M
  
  redis:
    image: redis:7-alpine
    container_name: redis-cache
    ports:
      - "6379:6379"
    networks:
      - microservices-network
    volumes:
      - redis-data:/data
    command: redis-server --appendonly yes
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 3
    deploy:
      resources:
        limits:
          cpus: '0.25'
          memory: 128M
  
  nginx:
    image: nginx:alpine
    container_name: nginx-proxy
    ports:
      - "80:80"
      - "443:443"
    networks:
      - microservices-network
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/ssl:/etc/nginx/ssl:ro
    depends_on:
      - api-gateway
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "nginx", "-t"]
      interval: 30s
      timeout: 10s
      retries: 3

networks:
  microservices-network:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/16

volumes:
  user-logs:
    driver: local
  order-logs:
    driver: local
  redis-data:
    driver: local

name: CI/CD Pipeline

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:

env:
  DOCKER_REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  
  code-quality:
    name: 程式碼品質檢查
    runs-on: ubuntu-latest
    
    steps:
    - name: 檢出程式碼
      uses: actions/checkout@v4
    
    - name: 設定 Python 環境
      uses: actions/setup-python@v4
      with:
        python-version: '3.11'
        cache: 'pip'
    
    - name: 安裝依賴
      run: |
        python -m pip install --upgrade pip
        pip install flake8 pylint black isort mypy
        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
    
    - name: 程式碼格式檢查
      run: black --check --diff .
    
    - name: Import 排序檢查
      run: isort --check-only --diff .
    
    - name: 語法檢查
      run: flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
    
    - name: 程式碼品質分析
      run: pylint **/*.py --fail-under=8.0
      continue-on-error: true
    
    - name: 型別檢查
      run: mypy . --ignore-missing-imports
      continue-on-error: true
  
  test:
    name: 執行測試套件
    runs-on: ubuntu-latest
    needs: code-quality
    
    strategy:
      matrix:
        python-version: ['3.10', '3.11']
    
    steps:
    - name: 檢出程式碼
      uses: actions/checkout@v4
    
    - name: 設定 Python ${{ matrix.python-version }}
      uses: actions/setup-python@v4
      with:
        python-version: ${{ matrix.python-version }}
        cache: 'pip'
    
    - name: 安裝依賴
      run: |
        pip install -r requirements.txt
        pip install pytest pytest-cov pytest-asyncio
    
    - name: 執行單元測試
      run: |
        pytest tests/unit/ \
          --cov=src \
          --cov-report=xml \
          --cov-report=html \
          --junitxml=test-results.xml \
          -v
    
    - name: 執行整合測試
      run: |
        pytest tests/integration/ -v
    
    - name: 上傳測試覆蓋率報告
      uses: codecov/codecov-action@v3
      with:
        file: ./coverage.xml
        flags: unittests
        name: codecov-${{ matrix.python-version }}
    
    - name: 上傳測試結果
      uses: actions/upload-artifact@v3
      if: always()
      with:
        name: test-results-${{ matrix.python-version }}
        path: |
          test-results.xml
          htmlcov/
  
  security-scan:
    name: 安全性漏洞掃描
    runs-on: ubuntu-latest
    needs: test
    
    steps:
    - name: 檢出程式碼
      uses: actions/checkout@v4
    
    - name: 執行 Bandit 安全檢查
      run: |
        pip install bandit
        bandit -r src/ -f json -o bandit-report.json
      continue-on-error: true
    
    - name: 執行依賴漏洞掃描
      run: |
        pip install safety
        safety check --json
      continue-on-error: true
    
    - name: 執行 Trivy 容器掃描
      uses: aquasecurity/trivy-action@master
      with:
        scan-type: 'fs'
        scan-ref: '.'
        format: 'sarif'
        output: 'trivy-results.sarif'
    
    - name: 上傳掃描結果
      uses: github/codeql-action/upload-sarif@v2
      with:
        sarif_file: 'trivy-results.sarif'
  
  build-image:
    name: 建構容器映像
    runs-on: ubuntu-latest
    needs: [test, security-scan]
    if: github.event_name == 'push'
    
    permissions:
      contents: read
      packages: write
    
    steps:
    - name: 檢出程式碼
      uses: actions/checkout@v4
    
    - name: 設定 Docker Buildx
      uses: docker/setup-buildx-action@v3
    
    - name: 登入容器 Registry
      uses: docker/login-action@v3
      with:
        registry: ${{ env.DOCKER_REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    
    - name: 提取元資料
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}
        tags: |
          type=ref,event=branch
          type=ref,event=pr
          type=semver,pattern={{version}}
          type=semver,pattern={{major}}.{{minor}}
          type=sha,prefix={{branch}}-
    
    - name: 建構並推送映像
      uses: docker/build-push-action@v5
      with:
        context: .
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        cache-from: type=gha
        cache-to: type=gha,mode=max
        platforms: linux/amd64,linux/arm64
    
    - name: 掃描建構的映像
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
        format: 'table'
        exit-code: '0'
        severity: 'CRITICAL,HIGH'
  
  deploy-staging:
    name: 部署到測試環境
    runs-on: ubuntu-latest
    needs: build-image
    if: github.ref == 'refs/heads/develop'
    environment:
      name: staging
      url: https://staging.example.com
    
    steps:
    - name: 檢出程式碼
      uses: actions/checkout@v4
    
    - name: 設定 kubectl
      uses: azure/setup-kubectl@v3
    
    - name: 配置 Kubernetes 上下文
      run: |
        echo "${{ secrets.KUBE_CONFIG_STAGING }}" > kubeconfig
        export KUBECONFIG=kubeconfig
    
    - name: 部署到 Kubernetes
      run: |
        kubectl set image deployment/app-deployment \
          app=${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} \
          --namespace=staging
        kubectl rollout status deployment/app-deployment --namespace=staging
    
    - name: 執行煙霧測試
      run: |
        curl -f https://staging.example.com/health || exit 1
  
  deploy-production:
    name: 部署到生產環境
    runs-on: ubuntu-latest
    needs: build-image
    if: github.ref == 'refs/heads/main'
    environment:
      name: production
      url: https://www.example.com
    
    steps:
    - name: 檢出程式碼
      uses: actions/checkout@v4
    
    - name: 設定 kubectl
      uses: azure/setup-kubectl@v3
    
    - name: 配置 Kubernetes 上下文
      run: |
        echo "${{ secrets.KUBE_CONFIG_PROD }}" > kubeconfig
        export KUBECONFIG=kubeconfig
    
    - name: 金絲雀部署
      run: |
        kubectl set image deployment/app-deployment-canary \
          app=${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} \
          --namespace=production
        kubectl rollout status deployment/app-deployment-canary --namespace=production
    
    - name: 監控金絲雀指標
      run: |
        sleep 300
    
    - name: 完整部署
      run: |
        kubectl set image deployment/app-deployment \
          app=${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} \
          --namespace=production
        kubectl rollout status deployment/app-deployment --namespace=production
    
    - name: 建立發布標籤
      run: |
        git tag -a "v${{ github.run_number }}" -m "Release ${{ github.run_number }}"
        git push origin "v${{ github.run_number }}"