http {
    proxy_connect_timeout 300s;
    proxy_send_timeout 300s;
    proxy_read_timeout 300s;
}

fetch('api/data')
  .then(response => {
    switch(response.status) {
      case 200:
        return response.json();
      case 401:
        // 跳转到登录页
        window.location.href = '/login';
        break;
      case 403:
        throw new Error('没有权限访问');
      case 404:
        throw new Error('资源不存在');
      default:
        throw new Error('服务器错误');
    }
  })
  .catch(error => {
    console.error('请求失败:', error);
  });

apiVersion: v1
kind: Pod
metadata:
  name: example-pod
  labels:
    app: example
spec:
  containers:
  - name: main-container
    image: nginx:latest
    ports:
    - containerPort: 80
    resources:
      requests:
        memory: "64Mi"
        cpu: "250m"
      limits:
        memory: "128Mi"
        cpu: "500m"
    readinessProbe:
      httpGet:
        path: /
        port: 80
      initialDelaySeconds: 5
      periodSeconds: 10
    livenessProbe:
      httpGet:
        path: /
        port: 80
      initialDelaySeconds: 15
      periodSeconds: 20
  nodeSelector:
    kubernetes.io/os: linux

# nginx.conf 主要优化配置
worker_processes auto;                # 根据 CPU 核心数自动设置
worker_rlimit_nofile 65535;          # 增加工作进程文件描述符限制
events {
    use epoll;                       # 使用 epoll 事件模型
    worker_connections 65535;        # 增加每个工作进程的最大连接数
    multi_accept on;                 # 开启一次接受多个连接
}

http {
    # 开启 gzip 压缩
    gzip on;
    gzip_comp_level 5;
    gzip_min_length 1k;
    gzip_types text/plain text/css application/javascript application/json;

    # 缓存相关
    open_file_cache max=1000 inactive=20s;
    open_file_cache_valid 30s;
    open_file_cache_min_uses 2;
    open_file_cache_errors on;
    
    # 客户端优化
    client_max_body_size 20m;        # 上传文件大小限制
    keepalive_timeout 65;            # 保持连接超时时间
    client_body_buffer_size 128k;    # 请求体缓冲区大小
}

location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ {
    expires 30d;                     # 设置缓存过期时间
    add_header Cache-Control public;
    access_log off;                  # 关闭访问日志
}

http {
    sendfile on;                     # 启用零拷贝
    tcp_nopush on;                   # 优化数据包传输
    tcp_nodelay on;                  # 禁用 Nagle 算法
}

upstream backend {
    least_conn;                      # 最少连接数算法
    server backend1.example.com max_fails=3 fail_timeout=30s;
    server backend2.example.com max_fails=3 fail_timeout=30s;
    keepalive 32;                    # 保持后端连接数
}

server {
    location / {
        proxy_pass http://backend;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_next_upstream error timeout http_500;  # 故障转移
    }
}

http {
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    
    # OCSP Stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
}

server {
    # 隐藏版本号
    server_tokens off;
    
    # XSS 防护
    add_header X-XSS-Protection "1; mode=block";
    
    # 点击劫持防护
    add_header X-Frame-Options "SAMEORIGIN";
    
    # 限制请求频率
    limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;
    location /login/ {
        limit_req zone=one burst=5;
    }
}

http {
    # 自定义日志格式
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';
    
    # 缓冲日志写入
    access_log /var/log/nginx/access.log main buffer=32k flush=1m;
    
    # 对特定资源关闭日志
    location /static/ {
        access_log off;
    }
}

location /nginx_status {
    stub_status on;
    access_log off;
    allow 127.0.0.1;
    deny all;
}

stages:
  - build
  - test
  - deploy

build-job:
  stage: build
  script:
    - echo "编译代码..."
    - mvn package
  artifacts:
    paths:
      - target/*.jar

test-job:
  stage: test
  script:
    - echo "运行测试..."
    - mvn test

deploy-job:
  stage: deploy
  script:
    - echo "部署应用..."
    - kubectl apply -f pod.yaml
  only:
    - master

apiVersion: apps/v1
kind: Deployment
metadata:
  name: gitlab-runner
  namespace: gitlab
spec:
  replicas: 1
  selector:
    matchLabels:
      app: gitlab-runner
  template:
    metadata:
      labels:
        app: gitlab-runner
    spec:
      containers:
      - name: gitlab-runner
        image: gitlab/gitlab-runner:latest
        args:
        - run
        volumeMounts:
        - name: config
          mountPath: /etc/gitlab-runner
        - name: docker-sock
          mountPath: /var/run/docker.sock
      volumes:
      - name: config
        configMap:
          name: gitlab-runner-config
      - name: docker-sock
        hostPath:
          path: /var/run/docker.sock

gitlab-runner register \
  --non-interactive \
  --url "https://gitlab.example.com/" \
  --registration-token "PROJECT_REGISTRATION_TOKEN" \
  --executor "docker" \
  --docker-image alpine:latest \
  --description "docker-runner" \
  --tag-list "docker,aws" \
  --run-untagged="true" \
  --locked="false"

// Jenkinsfile 示例
pipeline {
    agent any
    tools {
        maven 'Maven 3.8.1'
    }
    stages {
        stage('Build') {
            steps {
                sh 'mvn clean package'
            }
        }
    }
}

// Jenkinsfile 示例
pipeline {
    agent any
    stages {
        stage('Build') {
            steps {
                gradle 'clean build'
            }
        }
    }
}

// Jenkinsfile 示例
pipeline {
    agent {
        docker {
            image 'maven:3.8.1-jdk-8'
        }
    }
    stages {
        stage('Build') {
            steps {
                sh 'mvn package'
            }
        }
    }
}

// Jenkinsfile 示例
pipeline {
    agent {
        kubernetes {
            yaml '''
                apiVersion: v1
                kind: Pod
                spec:
                  containers:
                  - name: maven
                    image: maven:3.8.1-jdk-8
                    command:
                    - cat
                    tty: true
            '''
        }
    }
    stages {
        stage('Build') {
            steps {
                container('maven') {
                    sh 'mvn package'
                }
            }
        }
    }
}

// Jenkinsfile 示例
pipeline {
    agent any
    stages {
        stage('SonarQube Analysis') {
            steps {
                withSonarQubeEnv('SonarQube') {
                    sh 'mvn sonar:sonar'
                }
            }
        }
    }
}

// Jenkinsfile 示例
pipeline {
    agent any
    stages {
        stage('Code Analysis') {
            steps {
                sh 'mvn checkstyle:checkstyle'
            }
            post {
                always {
                    recordIssues(tools: [checkStyle()])
                }
            }
        }
    }
}

// Jenkinsfile 示例
pipeline {
    agent any
    post {
        failure {
            emailext (
                subject: "构建失败: ${env.JOB_NAME} [${env.BUILD_NUMBER}]",
                body: """<p>构建失败:</p>
                    <p>查看: <a href='${env.BUILD_URL}'>${env.JOB_NAME} [${env.BUILD_NUMBER}]</a></p>""",
                to: "team@example.com"
            )
        }
    }
}

// Jenkinsfile 示例
pipeline {
    agent any
    post {
        always {
            dingtalk (
                robot: '钉钉机器人TOKEN',
                type: 'MARKDOWN',
                title: '构建通知',
                text: [
                    "### 构建结果: ${currentBuild.result}",
                    "- 项目: ${env.JOB_NAME}",
                    "- 构建号: ${env.BUILD_NUMBER}",
                    "- 详情: [查看](${env.BUILD_URL})"
                ]
            )
        }
    }
}

// Jenkinsfile 示例
pipeline {
    agent any
    options {
        timeout(time: 1, unit: 'HOURS')
    }
    stages {
        stage('Build') {
            steps {
                sh 'mvn package'
            }
        }
    }
}

withCredentials([string(credentialsId: 'my-secret', variable: 'SECRET')]) {
    // SECRET 变量会自动被掩码
    sh './deploy.sh'  // 在脚本中使用 $SECRET
}

wrap([$class: 'MaskPasswordsBuildWrapper', varPasswordPairs: [
    [var: 'PASSWORD', password: 'sensitive-value']
]]) {
    // 所有输出中的 'sensitive-value' 都会被替换为 ****
    sh 'your-command'
}

// 不要这样做
sh "echo 'Using password: $PASSWORD'"

// 而是这样
sh '''
    if [ -n "$PASSWORD" ]; then
        echo "Password is configured"
    else
        echo "Password is missing"
    fi
'''

options {
    // 设置构建日志保留策略
    buildDiscarder(logRotator(numToKeepStr: '10'))
}

pipeline {
    agent any
    
    options {
        // 禁用并发构建
        disableConcurrentBuilds()
        // 设置超时
        timeout(time: 1, unit: 'HOURS')
    }
    
    environment {
        // 使用凭据绑定
        DEPLOY_KEY = credentials('deploy-key')
    }
    
    stages {
        stage('部署') {
            steps {
                // 使用安全的方式处理敏感信息
                withCredentials([
                    file(credentialsId: 'kubeconfig', variable: 'KUBECONFIG')
                ]) {
                    sh 'kubectl apply -f deployment.yaml'
                }
            }
        }
    }
}

# Deployment 自动管理 Pod 的生命周期
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
spec:
  replicas: 3  # 自动维护3个副本
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:alpine

# Service 提供负载均衡
apiVersion: v1
kind: Service
metadata:
  name: nginx-service
spec:
  type: LoadBalancer
  selector:
    app: nginx
  ports:
  - port: 80
    targetPort: 80

# HPA 自动扩缩容
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: nginx-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: nginx
  minReplicas: 1
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 80

# Pod 反亲和性确保高可用
apiVersion: apps/v1
kind: Deployment
metadata:
  name: webapp
spec:
  template:
    spec:
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: app
                operator: In
                values:
                - webapp
            topologyKey: "kubernetes.io/hostname"

# 网络策略隔离
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-allow
spec:
  podSelector:
    matchLabels:
      app: api
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend

resources:
  requests:
    memory: "64Mi"    # 保证最小内存
    cpu: "250m"       # 0.25 CPU
  limits:
    memory: "256Mi"   # 内存上限
    cpu: "500m"       # 0.5 CPU

readinessProbe:
  httpGet:
    path: /
    port: 80
  initialDelaySeconds: 5
  periodSeconds: 10
livenessProbe:
  httpGet:
    path: /
    port: 80
  initialDelaySeconds: 15
  periodSeconds: 20

volumeMounts:
- name: config
  mountPath: /app/config
volumes:
- name: config
  configMap:
    name: app-config

nodeSelector:
  kubernetes.io/os: linux

from kubernetes import client, config

def monitor_pods():
    # 加载 k8s 配置
    config.load_kube_config()
    v1 = client.CoreV1Api()
    
    try:
        # 获取所有 namespace 的 pods
        pods = v1.list_pod_for_all_namespaces(watch=False)
        for pod in pods.items:
            print(f"Pod: {pod.metadata.name}")
            print(f"Namespace: {pod.metadata.namespace}")
            print(f"Status: {pod.status.phase}")
            
            # 检查资源使用
            if pod.status.container_statuses:
                for container in pod.status.container_statuses:
                    print(f"Container: {container.name}")
                    print(f"Ready: {container.ready}")
                    print(f"Restart Count: {container.restart_count}")
    except Exception as e:
        print(f"Error: {e}")

if __name__ == "__main__":
    monitor_pods()

import re
from datetime import datetime
import pandas as pd

def analyze_nginx_logs(log_file):
    # 定义日志格式正则
    pattern = r'(?P<ip>.*?) - - \[(?P<time>.*?)\] "(?P<request>.*?)" (?P<status>\d+) (?P<size>\d+)'
    
    logs = []
    with open(log_file, 'r') as f:
        for line in f:
            match = re.match(pattern, line)
            if match:
                data = match.groupdict()
                data['time'] = datetime.strptime(data['time'], '%d/%b/%Y:%H:%M:%S %z')
                logs.append(data)
    
    # 转换为 DataFrame 分析
    df = pd.DataFrame(logs)
    return {
        'total_requests': len(df),
        'status_codes': df['status'].value_counts().to_dict(),
        'top_ips': df['ip'].value_counts().head(10).to_dict()
    }

package main

import (
    "context"
    "fmt"
    "github.com/docker/docker/api/types"
    "github.com/docker/docker/client"
)

func monitorContainers() {
    ctx := context.Background()
    cli, err := client.NewClientWithOpts(client.FromEnv)
    if err != nil {
        panic(err)
    }

    containers, err := cli.ContainerList(ctx, types.ContainerListOptions{})
    if err != nil {
        panic(err)
    }

    for _, container := range containers {
        stats, err := cli.ContainerStats(ctx, container.ID, false)
        if err != nil {
            fmt.Printf("Error getting stats for %s: %v\n", container.ID, err)
            continue
        }
        
        fmt.Printf("Container: %s\n", container.Names[0])
        fmt.Printf("Status: %s\n", container.Status)
        fmt.Printf("Stats: %v\n", stats)
    }
}

package main

import (
    "fmt"
    "k8s.io/client-go/kubernetes"
    "k8s.io/client-go/tools/clientcmd"
    appsv1 "k8s.io/api/apps/v1"
    metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)

func deployApplication(namespace, name string, image string) error {
    // 加载 kubeconfig
    config, err := clientcmd.BuildConfigFromFlags("", "~/.kube/config")
    if err != nil {
        return err
    }

    // 创建 clientset
    clientset, err := kubernetes.NewForConfig(config)
    if err != nil {
        return err
    }

    // 创建 deployment
    deployment := &appsv1.Deployment{
        ObjectMeta: metav1.ObjectMeta{
            Name: name,
        },
        Spec: appsv1.DeploymentSpec{
            Replicas: int32Ptr(3),
            Selector: &metav1.LabelSelector{
                MatchLabels: map[string]string{
                    "app": name,
                },
            },
            Template: corev1.PodTemplateSpec{
                ObjectMeta: metav1.ObjectMeta{
                    Labels: map[string]string{
                        "app": name,
                    },
                },
                Spec: corev1.PodSpec{
                    Containers: []corev1.Container{
                        {
                            Name:  name,
                            Image: image,
                        },
                    },
                },
            },
        },
    }

    // 执行部署
    _, err = clientset.AppsV1().Deployments(namespace).Create(context.TODO(), deployment, metav1.CreateOptions{})
    return err
}

import requests
import json
import os

class GitlabCI:
    def __init__(self, token, url):
        self.token = token
        self.url = url
        self.headers = {'PRIVATE-TOKEN': token}
    
    def trigger_pipeline(self, project_id, ref='main'):
        endpoint = f"{self.url}/api/v4/projects/{project_id}/pipeline"
        data = {'ref': ref}
        
        response = requests.post(endpoint, headers=self.headers, data=data)
        return response.json()
    
    def get_pipeline_status(self, project_id, pipeline_id):
        endpoint = f"{self.url}/api/v4/projects/{project_id}/pipelines/{pipeline_id}"
        response = requests.get(endpoint, headers=self.headers)
        return response.json()

from kubernetes import client, config
from datetime import datetime, timedelta

def cleanup_old_pods(namespace, hours=24):
    config.load_kube_config()
    v1 = client.CoreV1Api()
    
    try:
        pods = v1.list_namespaced_pod(namespace)
        now = datetime.now(timezone.utc)
        
        for pod in pods.items:
            if pod.status.phase in ['Failed', 'Succeeded']:
                created_time = pod.metadata.creation_timestamp
                age = now - created_time
                
                if age > timedelta(hours=hours):
                    print(f"Deleting pod: {pod.metadata.name}")
                    v1.delete_namespaced_pod(
                        pod.metadata.name,
                        namespace,
                        body=client.V1DeleteOptions()
                    )
    except Exception as e:
        print(f"Error during cleanup: {e}")

from kubernetes import client, config
import time
from datetime import datetime
import logging

logging.basicConfig(level=logging.INFO)
logger = logging.getLogger(__name__)

class PodMonitor:
    def __init__(self, namespace="default"):
        # 加载 k8s 配置
        config.load_kube_config()
        self.v1 = client.CoreV1Api()
        self.namespace = namespace

    def monitor_pod_resources(self, pod_name):
        """监控 Pod 的资源使用情况"""
        try:
            pod = self.v1.read_namespaced_pod(pod_name, self.namespace)
            
            # 检查资源限制和请求
            for container in pod.spec.containers:
                resources = container.resources
                logger.info(f"Container: {container.name}")
                logger.info(f"Resource Limits: {resources.limits}")
                logger.info(f"Resource Requests: {resources.requests}")

            # 检查 Pod 状态
            logger.info(f"Pod Status: {pod.status.phase}")
            
            # 检查就绪状态
            if pod.status.container_statuses:
                for container in pod.status.container_statuses:
                    logger.info(f"Container {container.name} Ready: {container.ready}")
                    logger.info(f"Restart Count: {container.restart_count}")

        except Exception as e:
            logger.error(f"Error monitoring pod {pod_name}: {e}")

    def check_probes(self, pod_name):
        """检查 Pod 的健康检查状态"""
        try:
            pod = self.v1.read_namespaced_pod(pod_name, self.namespace)
            
            for container in pod.spec.containers:
                logger.info(f"Container: {container.name}")
                
                if container.readiness_probe:
                    logger.info("Readiness Probe:")
                    logger.info(f"Initial Delay: {container.readiness_probe.initial_delay_seconds}s")
                    logger.info(f"Period: {container.readiness_probe.period_seconds}s")
                
                if container.liveness_probe:
                    logger.info("Liveness Probe:")
                    logger.info(f"Initial Delay: {container.liveness_probe.initial_delay_seconds}s")
                    logger.info(f"Period: {container.liveness_probe.period_seconds}s")

        except Exception as e:
            logger.error(f"Error checking probes for pod {pod_name}: {e}")

    def check_configmap_mounted(self, pod_name):
        """检查 ConfigMap 挂载状态"""
        try:
            pod = self.v1.read_namespaced_pod(pod_name, self.namespace)
            
            for volume in pod.spec.volumes:
                if volume.config_map:
                    logger.info(f"ConfigMap mounted: {volume.config_map.name}")
                    
                    # 检查 ConfigMap 是否存在
                    try:
                        config_map = self.v1.read_namespaced_config_map(
                            volume.config_map.name, 
                            self.namespace
                        )
                        logger.info("ConfigMap exists and is accessible")
                    except Exception as e:
                        logger.error(f"Error accessing ConfigMap: {e}")

        except Exception as e:
            logger.error(f"Error checking ConfigMap for pod {pod_name}: {e}")

    def continuous_monitoring(self, pod_name, interval=60):
        """持续监控 Pod"""
        while True:
            logger.info(f"\n=== Monitoring Pod {pod_name} at {datetime.now()} ===")
            self.monitor_pod_resources(pod_name)
            self.check_probes(pod_name)
            self.check_configmap_mounted(pod_name)
            time.sleep(interval)

def main():
    monitor = PodMonitor()
    pod_name = "app-pod"  # 你的 pod 名称
    
    try:
        monitor.continuous_monitoring(pod_name)
    except KeyboardInterrupt:
        logger.info("Monitoring stopped by user")
    except Exception as e:
        logger.error(f"Unexpected error: {e}")

if __name__ == "__main__":
    main()

pip install kubernetes

package main

import (
    "context"
    "fmt"
    "time"
    "log"
    
    metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
    "k8s.io/client-go/kubernetes"
    "k8s.io/client-go/tools/clientcmd"
    "k8s.io/client-go/util/homedir"
    "path/filepath"
)

type PodMonitor struct {
    clientset *kubernetes.Clientset
    namespace string
}

func NewPodMonitor(namespace string) (*PodMonitor, error) {
    // 获取 kubeconfig 路径
    kubeconfig := filepath.Join(homedir.HomeDir(), ".kube", "config")
    
    // 创建 config
    config, err := clientcmd.BuildConfigFromFlags("", kubeconfig)
    if err != nil {
        return nil, fmt.Errorf("error building config: %v", err)
    }
    
    // 创建 clientset
    clientset, err := kubernetes.NewForConfig(config)
    if err != nil {
        return nil, fmt.Errorf("error creating clientset: %v", err)
    }
    
    return &PodMonitor{
        clientset: clientset,
        namespace: namespace,
    }, nil
}

func (pm *PodMonitor) MonitorPod(ctx context.Context, podName string) {
    ticker := time.NewTicker(30 * time.Second)
    defer ticker.Stop()
    
    for {
        select {
        case <-ctx.Done():
            log.Println("Monitoring stopped")
            return
        case <-ticker.C:
            pod, err := pm.clientset.CoreV1().Pods(pm.namespace).Get(
                context.Background(),
                podName,
                metav1.GetOptions{},
            )
            if err != nil {
                log.Printf("Error getting pod %s: %v\n", podName, err)
                continue
            }
            
            // 检查 Pod 状态
            log.Printf("Pod Status: %s\n", pod.Status.Phase)
            
            // 检查容器状态
            for _, container := range pod.Status.ContainerStatuses {
                log.Printf("Container: %s\n", container.Name)
                log.Printf("  Ready: %v\n", container.Ready)
                log.Printf("  RestartCount: %d\n", container.RestartCount)
                
                // 检查资源使用
                if container.State.Running != nil {
                    log.Printf("  Running since: %v\n", container.State.Running.StartedAt)
                }
            }
            
            // 检查资源配置
            for _, container := range pod.Spec.Containers {
                resources := container.Resources
                log.Printf("Resource Limits - CPU: %s, Memory: %s\n",
                    resources.Limits.Cpu(),
                    resources.Limits.Memory(),
                )
                log.Printf("Resource Requests - CPU: %s, Memory: %s\n",
                    resources.Requests.Cpu(),
                    resources.Requests.Memory(),
                )
            }
        }
    }
}

func (pm *PodMonitor) CheckProbes(podName string) error {
    pod, err := pm.clientset.CoreV1().Pods(pm.namespace).Get(
        context.Background(),
        podName,
        metav1.GetOptions{},
    )
    if err != nil {
        return fmt.Errorf("error getting pod: %v", err)
    }
    
    for _, container := range pod.Spec.Containers {
        log.Printf("Container: %s\n", container.Name)
        
        if container.ReadinessProbe != nil {
            log.Printf("ReadinessProbe:\n")
            log.Printf("  InitialDelay: %ds\n", container.ReadinessProbe.InitialDelaySeconds)
            log.Printf("  Period: %ds\n", container.ReadinessProbe.PeriodSeconds)
        }
        
        if container.LivenessProbe != nil {
            log.Printf("LivenessProbe:\n")
            log.Printf("  InitialDelay: %ds\n", container.LivenessProbe.InitialDelaySeconds)
            log.Printf("  Period: %ds\n", container.LivenessProbe.PeriodSeconds)
        }
    }
    
    return nil
}

func main() {
    monitor, err := NewPodMonitor("default")
    if err != nil {
        log.Fatalf("Error creating monitor: %v", err)
    }
    
    ctx, cancel := context.WithCancel(context.Background())
    defer cancel()
    
    // 启动监控
    go monitor.MonitorPod(ctx, "app-pod")
    
    // 检查探针配置
    if err := monitor.CheckProbes("app-pod"); err != nil {
        log.Printf("Error checking probes: %v\n", err)
    }
    
    // 保持程序运行
    select {
    case <-ctx.Done():
        log.Println("Program terminated")
    }
}

go get k8s.io/client-go@latest

# 构建阶段
FROM maven:3.8.1-jdk-8 AS builder
WORKDIR /app
COPY pom.xml .
# 缓存依赖
RUN mvn dependency:go-offline
COPY src ./src
RUN mvn package -DskipTests

# 运行阶段 - 使用更小的基础镜像
FROM openjdk:8-jre-alpine
WORKDIR /app
# 只复制构建产物
COPY --from=builder /app/target/*.jar app.jar
ENTRYPOINT ["java", "-jar", "app.jar"]

# 不推荐
FROM ubuntu:latest    # ~70MB

# 推荐
FROM alpine:latest    # ~5MB

FROM python:3.9-alpine

WORKDIR /app

COPY requirements.txt .

# 合并命令并清理缓存
RUN pip install --no-cache-dir -r requirements.txt && \
    rm -rf /root/.cache/pip && \
    rm -rf /var/cache/apk/*

COPY . .

# Node.js 应用优化示例
FROM node:alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
RUN npm run build

# 使用更轻量的镜像运行
FROM nginx:alpine
COPY --from=builder /app/build /usr/share/nginx/html
EXPOSE 80

# 开发环境
FROM node:alpine AS development
WORKDIR /app
COPY package*.json ./
RUN npm install
COPY . .

# 生产环境
FROM node:alpine AS production
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY --from=development /app/dist ./dist
CMD ["node", "dist/main"]

# 多阶段构建示例
FROM node:alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
RUN npm run build

# 生产镜像
FROM nginx:alpine
# 复制构建产物
COPY --from=builder /app/dist /usr/share/nginx/html
# 复制 nginx 配置
COPY nginx.conf /etc/nginx/conf.d/default.conf

# 设置用户
USER nginx

# 资源使用限制（对应 pod.yaml 中的设置）
ENV NODE_OPTIONS="--max-old-space-size=256"

EXPOSE 80

# 健康检查
HEALTHCHECK --interval=30s --timeout=3s \
    CMD wget -q --spider http://localhost/ || exit 1

# 这种方式最终镜像会包含构建工具和中间文件，体积很大
FROM maven:3.8.1-jdk-8
WORKDIR /app
COPY . .
RUN mvn package
CMD ["java", "-jar", "target/app.jar"]

# 第一阶段：构建阶段
FROM maven:3.8.1-jdk-8 AS builder
WORKDIR /app
COPY pom.xml .
COPY src ./src
RUN mvn package

# 第二阶段：运行阶段
FROM openjdk:8-jre-alpine
WORKDIR /app
# 只复制第一阶段构建的产物
COPY --from=builder /app/target/*.jar app.jar
CMD ["java", "-jar", "app.jar"]

# 第一阶段：依赖安装
FROM node:alpine AS dependencies
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

# 第二阶段：构建
FROM node:alpine AS builder
WORKDIR /app
COPY --from=dependencies /app/node_modules ./node_modules
COPY . .
RUN npm run build

# 第三阶段：运行
FROM nginx:alpine
# 只复制构建产物
COPY --from=builder /app/dist /usr/share/nginx/html
# 配置文件
COPY nginx.conf /etc/nginx/conf.d/default.conf
EXPOSE 80

# 第一阶段：依赖安装和构建
FROM node:alpine AS builder
WORKDIR /app

# 安装依赖
COPY package*.json ./
RUN npm ci --only=production

# 复制源代码并构建
COPY . .
RUN npm run build

# 第二阶段：运行环境
FROM nginx:alpine
WORKDIR /usr/share/nginx/html

# 从builder阶段复制构建产物
COPY --from=builder /app/dist .
COPY nginx.conf /etc/nginx/conf.d/default.conf

# 设置非root用户运行
USER nginx

# 配置健康检查，对应 pod.yaml 中的探针配置
HEALTHCHECK --interval=10s --timeout=3s \
    CMD wget -q --spider http://localhost/ || exit 1

# 资源使用优化，对应 pod.yaml 中的资源限制
ENV NODE_OPTIONS="--max-old-space-size=256"

EXPOSE 80

# 第一阶段：构建
FROM node:alpine AS builder
WORKDIR /app

# 使用 .dockerignore 排除不必要文件
COPY package*.json ./
RUN npm ci --only=production

COPY . .
RUN npm run build

# 第二阶段：运行
FROM nginx:alpine
WORKDIR /usr/share/nginx/html

# 对应 pod.yaml 中的资源限制
# memory: "256Mi"
# cpu: "500m"
ENV NGINX_WORKER_PROCESSES="auto"
ENV NGINX_WORKER_CONNECTIONS="1024"

# 复制构建产物
COPY --from=builder /app/dist .
COPY nginx.conf /etc/nginx/conf.d/default.conf

# 对应 pod.yaml 中的健康检查配置
# readinessProbe 和 livenessProbe
HEALTHCHECK --interval=10s --timeout=3s \
    CMD wget -q --spider http://localhost/ || exit 1

# 安全性配置
USER nginx

EXPOSE 80