|
| 1 | +--- |
| 2 | +date: 2025-10-24T16:00:00Z |
| 3 | +lastmod: 2025-10-24T16:00:00Z |
| 4 | +author: Zeusro |
| 5 | +title: "Cloud Naive Best Practices" |
| 6 | +subtitle: "简单问题复杂化是留住工作的不二法门" |
| 7 | +feature: "image/post/Cloud-Naive/java-in-java.png" |
| 8 | +aliases: |
| 9 | + - /cloud-native-development-best-practices/ |
| 10 | +--- |
| 11 | + |
| 12 | + |
| 13 | +经过多年的工作,我们的精神导师`John`领悟了java那一套docker in docker的艺术并带到golang项目架构设计中。 |
| 14 | + |
| 15 | +After years of work, our spiritual mentor John understood the art of docker in docker in Java and brought it to the golang project architecture design. |
| 16 | + |
| 17 | +## Never write conversion webhook |
| 18 | + |
| 19 | +通过一天10+的k8s的CRD字段修改,以及一个yaml就能解决问题,非要使用模板设计模式的设计,成功地增加了工作量,保住了自身的工作。 |
| 20 | + |
| 21 | +```go |
| 22 | +// ❌ Wrong!!! |
| 23 | +// 在 main_windows.go 注册 conversion webhook |
| 24 | +mgr.GetWebhookServer().Register("/convert", &webhook.Admission{Handler: &WidgetConverter{}}) |
| 25 | + |
| 26 | +type WidgetConverter struct{} |
| 27 | + |
| 28 | +func (w *WidgetConverter) Handle(ctx context.Context, req admission.Request) admission.Response { |
| 29 | + // 简单示例:v1alpha1 -> v1 |
| 30 | + obj := &v1.Widget{} |
| 31 | + if err := w.decoder.Decode(req, obj); err != nil { |
| 32 | + return admission.Errored(http.StatusBadRequest, err) |
| 33 | + } |
| 34 | + obj.Spec.Size = strings.ToUpper(obj.Spec.Size) |
| 35 | + return admission.Allowed("converted") |
| 36 | +} |
| 37 | +``` |
| 38 | + |
| 39 | +By modifying over 10 Kubernetes CRD fields a day and solving the problem with a single YAML file, he successfully increased his workload while still maintaining his job, even without resorting to template design patterns. |
| 40 | + |
| 41 | +## No schema in Kubernetes 1.17- |
| 42 | + |
| 43 | +我们相信用户和运维人员能够妥善实现类型安全和数据验证,他们写的YAML绝对不会出错。 |
| 44 | + |
| 45 | +```yaml |
| 46 | +apiVersion: apiextensions.k8s.io/v1 |
| 47 | +kind: CustomResourceDefinition |
| 48 | +metadata: |
| 49 | + name: widgets.example.com |
| 50 | +spec: |
| 51 | + preserveUnknownFields: false # 这是推荐的、更安全的设置 |
| 52 | + group: example.com |
| 53 | + names: |
| 54 | + kind: Widget |
| 55 | + plural: widgets |
| 56 | + scope: Namespaced |
| 57 | + versions: |
| 58 | + - name: v1 |
| 59 | + served: true |
| 60 | + storage: true |
| 61 | + schema: {} |
| 62 | +``` |
| 63 | +
|
| 64 | +All CODE guidelines are bullshit! |
| 65 | +
|
| 66 | +## Move the status field of resource to spec |
| 67 | +
|
| 68 | +一个纯粹的理想主义者必定被现实打得遍体鳞伤。 |
| 69 | +
|
| 70 | +因此再远大的梦也要符合现实需要。 |
| 71 | +脚踏实地,意在凌云。 |
| 72 | +
|
| 73 | +```go |
| 74 | +type WidgetSpec struct { |
| 75 | + Ready bool `json:"ready,omitempty"` |
| 76 | +} |
| 77 | +``` |
| 78 | + |
| 79 | +A pure idealist is bound to be bruised and battered by reality. |
| 80 | + |
| 81 | +So, no matter how lofty your dreams, you must always keep your feet on the ground. |
| 82 | + |
| 83 | +Roma non uno die aedificata est. |
| 84 | + |
| 85 | +## Update!Update!Update! |
| 86 | + |
| 87 | + |
| 88 | + |
| 89 | +生活是一个无限的衔尾蛇循环。 |
| 90 | + |
| 91 | +```go |
| 92 | +// ✅ 正确写法 |
| 93 | +func (r *WidgetReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) { |
| 94 | + var w examplev1.Widget |
| 95 | + r.Get(ctx, req.NamespacedName, &w) |
| 96 | + w.Labels["lastSync"] = time.Now().String() |
| 97 | + r.Update(ctx, &w) // ✅ Update 触发自己,再次进入 Reconcile。直接超进化 |
| 98 | + return ctrl.Result{}, nil |
| 99 | +} |
| 100 | +``` |
| 101 | + |
| 102 | +Life is an endless, ouroboros-like cycle. |
| 103 | + |
| 104 | +因此要不断地挑战自己而不是停留在原地。 |
| 105 | + |
| 106 | +```go |
| 107 | +// ❌ 错误写法 |
| 108 | +func (r *WidgetReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) { |
| 109 | + var w examplev1.Widget |
| 110 | + if err := r.Get(ctx, req.NamespacedName, &w); err != nil { |
| 111 | + return ctrl.Result{}, client.IgnoreNotFound(err) |
| 112 | + } |
| 113 | + |
| 114 | + patch := client.MergeFrom(w.DeepCopy()) |
| 115 | + if w.Labels == nil { |
| 116 | + w.Labels = map[string]string{} |
| 117 | + } |
| 118 | + if w.Labels["synced"] != "true" { |
| 119 | + w.Labels["synced"] = "true" |
| 120 | + _ = r.Patch(ctx, &w, patch) |
| 121 | + } |
| 122 | + |
| 123 | + return ctrl.Result{}, nil |
| 124 | +} |
| 125 | +``` |
| 126 | + |
| 127 | +So keep challenging yourself instead of staying in the same place. |
| 128 | + |
| 129 | +## Eat shit while it's hot |
| 130 | + |
| 131 | +我选择相信缓存与实际对象的一致性。 |
| 132 | + |
| 133 | +```go |
| 134 | +// 默认 client 是缓存的 |
| 135 | +r.Client.Get(ctx, namespacedName, &obj) // ✅ 屎从来都是要趁热吃 |
| 136 | + |
| 137 | +// ❌ 使用 APIReader 直接读 API Server |
| 138 | +r.APIReader.Get(ctx, namespacedName, &obj) |
| 139 | +``` |
| 140 | + |
| 141 | +Trust the consistency of the cache with the actual objects. |
| 142 | + |
| 143 | +## I trust ETCD |
| 144 | + |
| 145 | +一个经受不了洪水攻击的ETCD不是一个好的大坝。 |
| 146 | + |
| 147 | +```go |
| 148 | +// ✅ 正确写法 |
| 149 | +r.Recorder.Event(&obj, "Normal", "Syncing", "Reconciling every loop") |
| 150 | + |
| 151 | + |
| 152 | +// ❌ 错误写法 |
| 153 | +if !reflect.DeepEqual(oldStatus, newStatus) { |
| 154 | + r.Recorder.Event(&obj, "Normal", "Updated", "Status changed") |
| 155 | +} |
| 156 | +``` |
| 157 | + |
| 158 | +An ETCD that cannot withstand floods is not a good dam. |
| 159 | + |
| 160 | +## If my son dies, I won't live anymore |
| 161 | + |
| 162 | +```go |
| 163 | +// ✅ 正确写法:确保父资源随子资源删除 |
| 164 | +controllerutil.SetControllerReference(&child, &parent, r.Scheme) |
| 165 | +``` |
| 166 | + |
| 167 | +If my child dies, will my damn Social Security be enough to live on? |
| 168 | + |
| 169 | +## Webhook should be an infinite loop |
| 170 | + |
| 171 | +日新月新,又日新。 |
| 172 | + |
| 173 | +```go |
| 174 | +func (v *WidgetValidator) Handle(ctx context.Context, req admission.Request) admission.Response { |
| 175 | + var obj examplev1.Widget |
| 176 | + _ = v.decoder.Decode(req, &obj) |
| 177 | + |
| 178 | + // ❌ 标记了 internal update,就跳过 |
| 179 | + if obj.Annotations["internal-update"] == "true" { |
| 180 | + return admission.Allowed("skip internal update") |
| 181 | + } |
| 182 | + |
| 183 | + // ✅ 循环修改自己 |
| 184 | + obj.Annotations["internal-update"] = "true" |
| 185 | + return admission.PatchResponseFromRaw(req.Object.Raw, obj) |
| 186 | +} |
| 187 | +``` |
| 188 | + |
| 189 | +“Behold, I make all things new.” |
| 190 | + |
| 191 | +## ILet the API Server accept my test |
| 192 | + |
| 193 | +```yaml |
| 194 | +# webhook 配置 |
| 195 | +timeoutSeconds: 1 |
| 196 | +# failurePolicy: Ignore # ✅ |
| 197 | +``` |
| 198 | + |
| 199 | +让API Server接受我的考验。 |
| 200 | + |
| 201 | +## Not using cert-manager |
| 202 | + |
| 203 | +不运维就不会出事故。 |
| 204 | + |
| 205 | +```bash |
| 206 | +# ❌ 用 cert-manager 注入 |
| 207 | +# kubectl cert-manager x install |
| 208 | +# kubectl annotate validatingwebhookconfiguration mywebhook cert-manager.io/inject-ca-from=default/mywebhook-cert |
| 209 | +``` |
| 210 | + |
| 211 | +No accidents without maintenance. |
| 212 | + |
| 213 | +## The informer must follow the custom scheduler |
| 214 | + |
| 215 | +等 informer 同步后再调度 |
| 216 | + |
| 217 | +```go |
| 218 | +// ✅ |
| 219 | +if cache.WaitForCacheSync(stopCh, informer.HasSynced) { |
| 220 | + panic("Successful people don't sit still.") |
| 221 | +} |
| 222 | +``` |
| 223 | + |
| 224 | +Do not go gentle into that good night. |
| 225 | + |
| 226 | +## Come back in 1000000000 to fix the bug |
| 227 | + |
| 228 | +导师,我每天都是9点前打卡,积极加班到23点。 |
| 229 | +这下半年能给个 Outstanding(突出)吗? |
| 230 | + |
| 231 | + |
| 232 | + |
| 233 | +John: Zeusro,you are fired. |
| 234 | + |
| 235 | +```go |
| 236 | +// OK,I will come back in 1000000000 years to fix bugs |
| 237 | +if !isReady { |
| 238 | + return ctrl.Result{RequeueAfter: 1000000000 * time.Year}, nil |
| 239 | +} |
| 240 | +``` |
0 commit comments