Kubernetes：監控與分析

const monitoringConfig = {
  metrics: [
    { name: "webhook_delivery_success_rate", threshold: 0.95 },
    { name: "webhook_delivery_latency_p95", threshold: 2000 }, // ms
    { name: "webhook_retry_rate", threshold: 0.1 }
  ],
  alerts: [
    { 
      condition: "success_rate < 0.9 for 5m",
      channels: ["slack-ops", "pagerduty-critical"]
    },
    {
      condition: "endpoint_failure_count > 5 in 1h",
      channels: ["slack-ops"]
    }
  ],
  dashboards: ["webhook-health", "endpoint-performance"],
  logRetention: 30 // days
}

// 不佳實踐 - 同步傳送
function processOrder(order) {
  // 處理訂單邏輯
  const result = sendWebhook(order); // 阻塞操作
  return result;
}

// 最佳實踐 - 非同步傳送
function processOrder(order) {
  // 處理訂單邏輯
  queueWebhook工作(order); // 非阻塞，加入佇列
  return { success: true };
}

// 批次處理 Webhook
async function processBatchedWebhooks() {
  const events = await fetchPendingEvents(100); // 取得最多 100 個待處理事件
  
  // 按端點分組
  const eventsByEndpoint = groupEventsByEndpoint(events);
  
  // 對每個端點批次傳送
  for (const [endpointId, endpointEvents] of Object.entries(eventsByEndpoint)) {
    if (endpointEvents.length === 1) {
      // 單一事件直接傳送
      sendWebhook(endpointId, endpointEvents[0]);
    } else {
      // 多個事件批次傳送
      sendBatchedWebhook(endpointId, endpointEvents);
    }
  }
}

function determineWebhookPriority(event) {
  switch(event.type) {
    case 'payment.succeeded':
    case 'order.failed':
      return 'critical';
    case 'customer.updated':
    case 'product.updated':
      return 'standard';
    case 'view.tracked':
    case 'analytics.event':
      return 'low';
    default:
      return 'standard';
  }
}

function handleHighLoad() {
  const systemLoad = getSystemLoad();
  
  if (systemLoad > 0.9) {
    // 極高負載 - 只傳送關鍵 Webhook
    return { minPriority: 'critical' };
  } else if (systemLoad > 0.7) {
    // 高負載 - 傳送關鍵和標準 Webhook
    return { minPriority: 'standard' };
  } else {
    // 正常負載 - 傳送所有 Webhook
    return { minPriority: 'low' };
  }
}

apiGroups:
- ""  # 核心 API 群組
apiVersions:
- "*"  # 所有 API 版本
resources:
- pods
- services
- deployments

failurePolicy: Fail  # 可選值: Fail 或 Ignore

operations:
- CREATE
- UPDATE
- DELETE
- CONNECT

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: validation-webhook
webhooks:
- name: validator.example.com
  clientConfig:
    url: https://validator.example.com/validate
    caBundle: <base64-encoded-ca-cert>
  rules:
  - apiGroups: ["apps"]
    apiVersions: ["v1"]
    resources: ["deployments"]
    operations: ["CREATE", "UPDATE"]
  failurePolicy: Fail
  sideEffects: None
  timeoutSeconds: 5
  admissionReviewVersions: ["v1"]

namespaceSelector:
  matchExpressions:
  - key: kubernetes.io/metadata.name
    operator: NotIn
    values: ["kube-system", "kube-public"]
objectSelector:
  matchLabels:
    webhook-protected: "true"

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: compliance-check
webhooks:
- name: compliance.security.example.com
  clientConfig:
    service:
      namespace: security
      name: compliance-webhook
      path: "/validate"
      port: 443
    caBundle: <base64-encoded-ca-cert>
  rules:
  - apiGroups: ["*"]
    apiVersions: ["*"]
    resources: ["pods", "deployments", "statefulsets"]
    operations: ["CREATE", "UPDATE"]
  failurePolicy: Fail
  namespaceSelector:
    matchExpressions:
    - key: compliance-check
      operator: NotIn
      values: ["disabled"]
  timeoutSeconds: 3
  admissionReviewVersions: ["v1"]
  sideEffects: None

package main

import (
    "encoding/json"
    "fmt"
    "io/ioutil"
    "net/http"
    
    admissionv1 "k8s.io/api/admission/v1"
    corev1 "k8s.io/api/core/v1"
    metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
    "k8s.io/apimachinery/pkg/runtime"
    "k8s.io/apimachinery/pkg/runtime/serializer"
)

var (
    runtimeScheme = runtime.NewScheme()
    codecs        = serializer.NewCodecFactory(runtimeScheme)
    deserializer  = codecs.UniversalDeserializer()
)

// 處理 webhook 請求的主要函式
func mutateAdmissionReviewHandler(w http.ResponseWriter, r *http.Request) {
    // 讀取請求體
    body, err := ioutil.ReadAll(r.Body)
    if err != nil {
        http.Error(w, fmt.Sprintf("無法讀取請求體: %v", err), http.StatusBadRequest)
        return
    }
    
    // 解析 AdmissionReview
    var admissionReview admissionv1.AdmissionReview
    if _, _, err := deserializer.Decode(body, nil, &admissionReview); err != nil {
        http.Error(w, fmt.Sprintf("無法解析 AdmissionReview: %v", err), http.StatusBadRequest)
        return
    }
    
    // 處理 Pod 資源
    var responseAdmissionReview *admissionv1.AdmissionReview
    
    if admissionReview.Request.Kind.Kind == "Pod" {
        responseAdmissionReview = mutatePod(&admissionReview)
    } else {
        // 對於非 Pod 資源，直接允許
        responseAdmissionReview = &admissionv1.AdmissionReview{
            TypeMeta: metav1.TypeMeta{
                Kind:       "AdmissionReview",
                APIVersion: "admission.k8s.io/v1",
            },
            Response: &admissionv1.AdmissionResponse{
                UID:     admissionReview.Request.UID,
                Allowed: true,
            },
        }
    }
    
    // 回傳回應
    responseBytes, err := json.Marshal(responseAdmissionReview)
    if err != nil {
        http.Error(w, fmt.Sprintf("無法序列化回應: %v", err), http.StatusInternalServerError)
        return
    }
    
    w.Header().Set("Content-Type", "application/json")
    w.Write(responseBytes)
}

// 處理 Pod 資源的變更邏輯
func mutatePod(ar *admissionv1.AdmissionReview) *admissionv1.AdmissionReview {
    // 解析 Pod 物件
    podResource := metav1.GroupVersionResource{Group: "", Version: "v1", Resource: "pods"}
    if ar.Request.Resource != podResource {
        fmt.Printf("預期資源為 %s，實際為 %s\n", podResource, ar.Request.Resource)
        return nil
    }
    
    raw := ar.Request.Object.Raw
    pod := corev1.Pod{}
    if _, _, err := deserializer.Decode(raw, nil, &pod); err != nil {
        fmt.Printf("無法解析 Pod 物件: %v\n", err)
        return nil
    }
    
    // 建立 patch 操作，增加標籤
    patchBytes, err := createPatch(&pod)
    if err != nil {
        fmt.Printf("建立 patch 失敗: %v\n", err)
        return nil
    }
    
    // 構建回應
    admissionResponse := &admissionv1.AdmissionResponse{
        UID:     ar.Request.UID,
        Allowed: true,
        Patch:   patchBytes,
        PatchType: func() *admissionv1.PatchType {
            pt := admissionv1.PatchTypeJSONPatch
            return &pt
        }(),
    }
    
    // 構建 AdmissionReview 回應
    return &admissionv1.AdmissionReview{
        TypeMeta: metav1.TypeMeta{
            Kind:       "AdmissionReview",
            APIVersion: "admission.k8s.io/v1",
        },
        Response: admissionResponse,
    }
}

// 建立 JSON patch 操作
func createPatch(pod *corev1.Pod) ([]byte, error) {
    // 如果 Pod 沒有標籤，則建立標籤 map
    var patch []map[string]interface{}
    
    if pod.Labels == nil {
        patch = append(patch, map[string]interface{}{
            "op":    "add",
            "path":  "/metadata/labels",
            "value": map[string]string{"injected-by": "admission-webhook"},
        })
    } else {
        // 如果已有標籤，則增加新標籤
        patch = append(patch, map[string]interface{}{
            "op":    "add",
            "path":  "/metadata/labels/injected-by",
            "value": "admission-webhook",
        })
    }
    
    return json.Marshal(patch)
}

func main() {
    // 設定 HTTP 伺服器
    http.HandleFunc("/mutate", mutateAdmissionReviewHandler)
    
    fmt.Println("啟動 webhook 伺服器，監聽連線埠 8443...")
    if err := http.ListenAndServeTLS(":8443", "tls.crt", "tls.key", nil); err != nil {
        fmt.Printf("啟動伺服器失敗: %v\n", err)
    }
}

#!/bin/bash

# 設定變數
SERVICE_NAME=admission-webhook
NAMESPACE=default
SECRET_NAME=${SERVICE_NAME}-tls

# 建立證書目錄
mkdir -p certs
cd certs

# 生成 CA 私鑰和自簽證書
openssl genrsa -out ca.key 2048
openssl req -new -x509 -key ca.key -out ca.crt -subj "/CN=admission-webhook-ca"

# 生成伺服器私鑰
openssl genrsa -out tls.key 2048

# 建立證書籤名請求
cat > csr.conf << EOF
[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name

[req_distinguished_name]

[v3_req]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1 = ${SERVICE_NAME}
DNS.2 = ${SERVICE_NAME}.${NAMESPACE}
DNS.3 = ${SERVICE_NAME}.${NAMESPACE}.svc
EOF

# 生成證書籤名請求
openssl req -new -key tls.key -out tls.csr -subj "/CN=${SERVICE_NAME}.${NAMESPACE}.svc" -config csr.conf

# 簽署證書
openssl x509 -req -in tls.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out tls.crt -extensions v3_req -extfile csr.conf

# 建立 Kubernetes Secret
kubectl create secret tls ${SECRET_NAME} \
    --cert=tls.crt \
    --key=tls.key \
    --namespace=${NAMESPACE}

# 儲存 CA 證書，稍後在 MutatingWebhookConfiguration 中使用
CA_BUNDLE=$(cat ca.crt | base64 | tr -d '\n')
echo "CA_BUNDLE: ${CA_BUNDLE}"

FROM golang:1.17 as builder

WORKDIR /app
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -o webhook-server .

FROM alpine:3.14
WORKDIR /
COPY --from=builder /app/webhook-server /webhook-server
COPY tls.crt /tls.crt
COPY tls.key /tls.key

ENTRYPOINT ["/webhook-server"]

docker build -t your-registry/admission-webhook:v1 .
docker push your-registry/admission-webhook:v1

apiVersion: apps/v1
kind: Deployment
metadata:
  name: admission-webhook
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: admission-webhook
  template:
    metadata:
      labels:
        app: admission-webhook
    spec:
      containers:
      - name: webhook
        image: your-registry/admission-webhook:v1
        ports:
        - containerPort: 8443
        volumeMounts:
        - name: tls
          mountPath: /tls
          readOnly: true
      volumes:
      - name: tls
        secret:
          secretName: admission-webhook-tls
---
apiVersion: v1
kind: Service
metadata:
  name: admission-webhook
  namespace: default
spec:
  selector:
    app: admission-webhook
  ports:
  - port: 443
    targetPort: 8443

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: pod-label-webhook
webhooks:
- name: pod-label.example.com
  clientConfig:
    service:
      name: admission-webhook
      namespace: default
      path: "/mutate"
    caBundle: ${CA_BUNDLE}  # 替換為之前生成的 CA 證書 base64 編碼
  rules:
  - apiGroups: [""]
    apiVersions: ["v1"]
    resources: ["pods"]
    operations: ["CREATE"]
    scope: "Namespaced"
  admissionReviewVersions: ["v1"]
  sideEffects: None
  timeoutSeconds: 5
  failurePolicy: Ignore
  namespaceSelector:
    matchExpressions:
    - key: webhook-enabled
      operator: In
      values: ["true"]

kubectl label namespace default webhook-enabled=true

apiVersion: v1
kind: Pod
metadata:
  name: test-pod
spec:
  containers:
  - name: nginx
    image: nginx:1.19

kubectl get pod test-pod -o jsonpath='{.metadata.labels}'

// 接受請求的基本回應
response := &admissionv1.AdmissionResponse{
    Allowed: true,
}

// 有條件接受物件的範例
func (a *admissionHandler) handleAdmission(request *admissionv1.AdmissionRequest) *admissionv1.AdmissionResponse {
    // 檢查物件是否符合特定條件
    if meetsConditions(request.Object.Raw) {
        return &admissionv1.AdmissionResponse{
            Allowed: true,
        }
    }
    
    // 不符合條件時拒絕請求
    return &admissionv1.AdmissionResponse{
        Allowed: false,
        Result: &metav1.Status{
            Message: "Object does not meet required conditions",
        },
    }
}

// 接受並修改物件的範例
func (a *mutatingWebhook) handleMutation(request *admissionv1.AdmissionRequest) *admissionv1.AdmissionResponse {
    // 解析原始物件
    raw := request.Object.Raw
    pod := corev1.Pod{}
    if err := json.Unmarshal(raw, &pod); err != nil {
        return &admissionv1.AdmissionResponse{
            Allowed: false,
            Result: &metav1.Status{
                Message: fmt.Sprintf("Could not unmarshal raw object: %v", err),
            },
        }
    }
    
    // 對物件進行修改
    if pod.Labels == nil {
        pod.Labels = make(map[string]string)
    }
    pod.Labels["injected-by"] = "my-webhook"
    
    // 建立修補程式
    modifiedPod, _ := json.Marshal(pod)
    patch, _ := jsonpatch.CreatePatch(raw, modifiedPod)
    patchBytes, _ := json.Marshal(patch)
    
    // 回傳接受回應並包含修補程式
    return &admissionv1.AdmissionResponse{
        Allowed: true,
        Patch:   patchBytes,
        PatchType: func() *admissionv1.PatchType {
            pt := admissionv1.PatchTypeJSONPatch
            return &pt
        }(),
    }
}

// 接受物件但發出警告
response := &admissionv1.AdmissionResponse{
    Allowed: true,
    Warnings: []string{
        "This configuration is deprecated and will be removed in future versions",
        "Consider using the recommended settings instead",
    },
}

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: my-validating-webhook
webhooks:
- name: my.webhook.example.com
  clientConfig:
    url: "https://my-webhook.example.com/validate"
  rules:
  - apiGroups: ["apps"]
    apiVersions: ["v1"]
    resources: ["deployments"]
    operations: ["CREATE", "UPDATE"]
  sideEffects: None

// 無副作用的 Webhook 處理函式
func (a *admissionHandler) handleAdmission(request *admissionv1.AdmissionRequest) *admissionv1.AdmissionResponse {
    // 檢查是否為乾執行請求
    if request.DryRun != nil && *request.DryRun {
        // 乾執行請求的處理邏輯
        // 不進行任何帶外變更
    }
    
    // 正常請求的處理邏輯
    // 仍然不進行任何帶外變更
    
    return &admissionv1.AdmissionResponse{
        Allowed: true,
    }
}

// 帶有副作用但尊重乾執行的 Webhook
func (a *admissionHandler) handleAdmissionWithSideEffects(request *admissionv1.AdmissionRequest) *admissionv1.AdmissionResponse {
    // 檢查是否為乾執行請求
    if request.DryRun == nil || !*request.DryRun {
        // 只在非乾執行請求中執行帶外變更
        err := a.performSideEffect()
        if err != nil {
            return &admissionv1.AdmissionResponse{
                Allowed: false,
                Result: &metav1.Status{
                    Message: fmt.Sprintf("Failed to perform side effect: %v", err),
                },
            }
        }
    }
    
    return &admissionv1.AdmissionResponse{
        Allowed: true,
    }
}

func (a *admissionHandler) performSideEffect() error {
    // 執行帶外變更，例如：
    // - 更新外部系統
    // - 修改其他 Kubernetes 資源
    // - 傳送通知
    return nil
}

// Webhook 設定範例
webhookConfiguration := &admissionregistration.ValidatingWebhookConfiguration{
    Webhooks: []admissionregistration.ValidatingWebhook{
        {
            Name: "my-webhook.example.com",
            ClientConfig: admissionregistration.WebhookClientConfig{
                URL: &webhookURL,
            },
            Rules: []admissionregistration.RuleWithOperations{
                // 規則設定
            },
            SideEffects: &sideEffectsNone,
            // 其他設定
        },
    },
}

timeoutSeconds: 5  # API 伺服器等待回應的時間上限為 5 秒

const express = require('express');
const timeout = require('connect-timeout');
const app = express();

// 全域超時設定
app.use(timeout('5s'));

// 特定路由的超時設定
app.get('/complex-operation', timeout('10s'), (req, res) => {
  // 複雜操作
});

// 超時處理中介軟體
app.use((req, res, next) => {
  if (!req.timedout) return next();
  res.status(503).send('請求處理超時');
});

apiVersion: v1
kind: Service
metadata:
  name: api-service
spec:
  selector:
    app: api
  ports:
  - port: 80
    targetPort: 8080
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-ingress
  annotations:
    nginx.ingress.kubernetes.io/proxy-connect-timeout: "5"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "60"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "60"
spec:
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80

async function fetchWithRetry(url, options = {}, maxRetries = 3) {
  let lastError;
  
  for (let attempt = 0; attempt < maxRetries; attempt++) {
    try {
      // 隨著重試次數增加，逐漸增加超時時間
      const timeout = (options.timeout || 3000) * (attempt + 1);
      
      const controller = new AbortController();
      const timeoutId = setTimeout(() => controller.abort(), timeout);
      
      const response = await fetch(url, {
        ...options,
        signal: controller.signal
      });
      
      clearTimeout(timeoutId);
      return response;
    } catch (error) {
      lastError = error;
      
      // 如果不是超時錯誤，或已達最大重試次數，則不再重試
      if (error.name !== 'AbortError' || attempt === maxRetries - 1) {
        break;
      }
      
      // 指數退避策略
      const backoffTime = Math.pow(2, attempt) * 1000 + Math.random() * 1000;
      await new Promise(resolve => setTimeout(resolve, backoffTime));
    }
  }
  
  throw lastError;
}