变更管理：灰度发布与回滚策略

5% → 10% → 25% → 50% → 100%

Expand: ALTER TABLE users ADD COLUMN email_v2 VARCHAR(255);
Deploy: 新版本代码同时读写 email_v2
Verify: 观察一段时间，确认数据正确
Contract: ALTER TABLE users DROP COLUMN email_v1;

# 快速查看历史版本
kubectl rollout history deployment/api-server -n production

# 回滚到上一版本
kubectl rollout undo deployment/api-server -n production

# 回滚到指定版本
kubectl rollout undo deployment/api-server --to-revision=3 -n production

# 回滚配置变更
git revert <config-commit-hash>
git push origin main

# Argo CD 自动检测到配置回滚并同步
argocd app sync api-server-prod

# Alembic 迁移示例：提供 upgrade 和 downgrade
def upgrade():
    op.add_column('users', sa.Column('nickname', sa.String(100)))

def downgrade():
    op.drop_column('users', 'nickname')

# 安装 Argo Rollouts controller
kubectl create namespace argo-rollouts
kubectl apply -n argo-rollouts -f https://github.com/argoproj/argo-rollouts/releases/latest/download/install.yaml

# 安装 kubectl 插件
curl -sLO https://github.com/argoproj/argo-rollouts/releases/latest/download/kubectl-argo-rollouts-linux-amd64
chmod +x kubectl-argo-rollouts-linux-amd64
sudo mv kubectl-argo-rollouts-linux-amd64 /usr/local/bin/kubectl-argo-rollouts

apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: api-server
  namespace: production
spec:
  replicas: 10
  selector:
    matchLabels:
      app: api-server
  template:
    metadata:
      labels:
        app: api-server
    spec:
      containers:
      - name: api-server
        image: registry.example.com/api-server:v2.1.0
        ports:
        - containerPort: 8080
        resources:
          requests:
            cpu: 200m
            memory: 256Mi
          limits:
            cpu: 500m
            memory: 512Mi
        readinessProbe:
          httpGet:
            path: /healthz
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 5
  strategy:
    canary:
      # 流量路由：使用 Istio VirtualService 控制流量比例
      trafficRouting:
        istio:
          virtualService:
            name: api-server-vs
            routes:
            - primary
      steps:
      # 第一步：5% 流量切到金丝雀，观察 5 分钟
      - setWeight: 5
      - pause: { duration: 5m }
      # 第二步：升至 25%，执行自动指标分析
      - setWeight: 25
      - analysis:
          templates:
          - templateName: success-rate-check
          args:
          - name: service-name
            value: api-server-canary
      - pause: { duration: 5m }
      # 第三步：升至 50%，再次分析
      - setWeight: 50
      - analysis:
          templates:
          - templateName: success-rate-check
          args:
          - name: service-name
            value: api-server-canary
      - pause: { duration: 5m }
      # 第四步：全量发布
      - setWeight: 100

apiVersion: argoproj.io/v1alpha1
kind: AnalysisTemplate
metadata:
  name: success-rate-check
  namespace: production
spec:
  args:
  - name: service-name
  metrics:
  - name: success-rate
    # 从 Prometheus 查询金丝雀版本的成功率
    interval: 30s
    count: 10
    successCondition: result[0] >= 0.99
    failureLimit: 2
    provider:
      prometheus:
        address: http://prometheus.monitoring:9090
        query: |
          sum(rate(http_requests_total{
            service="{{args.service-name}}",
            code!~"5.."
          }[1m]))
          /
          sum(rate(http_requests_total{
            service="{{args.service-name}}"
          }[1m]))          

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: api-server-vs
  namespace: production
spec:
  http:
  - name: primary
    route:
    - destination:
        host: api-server-stable
        port:
          number: 8080
      weight: 100
    - destination:
        host: api-server-canary
        port:
          number: 8080
      weight: 0

# 触发发布：更新镜像版本
kubectl argo rollouts set image api-server \
  api-server=registry.example.com/api-server:v2.2.0 \
  -n production

# 实时查看发布状态
kubectl argo rollouts get rollout api-server -n production --watch

# 手动暂停发布（需要人工介入时）
kubectl argo rollouts pause api-server -n production

# 手动回滚到稳定版本
kubectl argo rollouts abort api-server -n production

# 发布完成后，提升稳定版本
kubectl argo rollouts promote api-server -n production

$ kubectl argo rollouts get rollout api-server -n production
Name:            api-server
Namespace:       production
Status:          ॥ Paused
Strategy:        Canary
  Step:          2/8
  SetWeight:     25
  ActualWeight:  25
Images:          registry.example.com/api-server:v2.0.0 (stable)
                 registry.example.com/api-server:v2.2.0 (canary)
Replicas:
  Desired:       10
  Current:       10
  Updated:       3
  Ready:         10
  Available:     10

NAME                                  KIND       STATUS     AGE
api-server-67b9c8f6d4                 ReplicaSet  ✔ Healthy  2d
api-server-6f8d7b5c9f                 ReplicaSet  ✔ Healthy  5m
⟳ api-server-canary-25-analysis       AnalysisRun  ✔ Healthy  2m