云原生工程师：不是"运维K8s"，而是平台的建造者与可靠性的守门人，附工程代码

# App CRD（简化）
apiVersion: platform.example.com/v1
kind: App
metadata: {name: order-api}
spec:
  image: registry.example.com/order-api:v1.2.0
  replicas: 3
  port: 8080
  resources: {cpu: 200m, memory: 256Mi}
  expose: {type: ClusterIP}

// controller：Reconcile时补齐所有子资源
func (r *AppReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
    var app platformv1.App
    if err := r.Get(ctx, req.NamespacedName, &app); err != nil { return ctrl.Result{}, client.IgnoreNotFound(err) }

    dep := buildDeployment(&app)   // 自动生成，含探针/资源/安全上下文
    if err := r.CreateOrUpdate(ctx, dep); err != nil { return ctrl.Result{}, err }

    for _, obj := range []client.Object{buildService(&app), buildHPA(&app), buildPDB(&app), buildNetPol(&app)} {
        if err := r.CreateOrUpdate(ctx, obj); err != nil { return ctrl.Result{}, err }
    }
    // 状态回写：就绪副本数、当前版本
    app.Status.ReadyReplicas = dep.Status.ReadyReplicas
    return ctrl.Result{}, r.Status().Update(ctx, &app)
}

# slo.yaml —— 用Sloth/Prometheus规则生成
version: "prometheus/v1"
service: "order-api"
slos:
- name: "availability"
  objective: 99.9
  description: "非5xx请求占比"
  sli:
    events:
      error_query: sum(rate(http_requests_total{job="order-api",code=~"5.."}[5m]))
      total_query: sum(rate(http_requests_total{job="order-api"}[5m]))
  alerting:
    page_alert: {labels: {severity: page}}
    ticket_alert: {labels: {severity: ticket}}

# burn_rate.py —— 多窗口燃烧率告警，比阈值告警更早发现
def burn_rate(error_ratio, window_hours, slo=0.999):
    allowed = 1 - slo
    return (error_ratio / allowed) * (30*24 / window_hours)
# 1h燃烧率>14.4 或 5m燃烧率>14.4 立即page；6h>6 开ticket

# Kyverno策略：禁止latest、强制资源限制、强制标签
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata: {name: platform-guardrails}
spec:
  validationFailureAction: Enforce
  rules:
  - name: disallow-latest
    match: {any: [{resources: {kinds: [Pod]}}]}
    validate:
      message: "禁止使用latest标签"
      pattern:
        spec: {containers: [{image: "!*:latest"}]}
  - name: require-resources
    match: {any: [{resources: {kinds: [Deployment]}}]}
    validate:
      message: "必须设置requests/limits"
      pattern:
        spec: {template: {spec: {containers: [{resources: {requests: {cpu: "?*"}, limits: {memory: "?*"}}}]}}}

# 按团队统计CPU请求成本（单价按实际云厂商）
sum by (team) (
  kube_pod_container_resource_requests{resource="cpu"}
  * on(namespace) group_left(team) namespace_labels{label_team!=""}
) * 0.03

# rightsizing.py —— 基于7天P95用量给requests建议
def suggest(p95_cpu, current_req):
    if p95_cpu < current_req * 0.4:
        return {"action": "downsize", "suggest": round(p95_cpu * 1.3, 3)}
    if p95_cpu > current_req * 0.9:
        return {"action": "upsize", "suggest": round(p95_cpu * 1.3, 3)}
    return {"action": "keep"}

# chaos-mesh：随机杀Pod，验证PDB与自愈
apiVersion: chaos-mesh.org/v1alpha1
kind: PodChaos
metadata: {name: kill-order-api}
spec:
  action: pod-kill
  mode: one
  selector: {namespaces: [prod], labelSelectors: {app: order-api}}
  scheduler: {cron: "@every 6h"}
  duration: "30s"

# 应急手册自动化：一键采集现场
kubectl get pods -n prod -o wide > incident/pods.txt
kubectl logs -n prod -l app=order-api --tail=500 --since=10m > incident/logs.txt
kubectl top pods -n prod >> incident/pods.txt