# 检查Docker是否安装并运行
docker version

# 预期输出（版本号可能不同）：
# Client: Docker Engine - Community
#  Version:           20.10.16
# Server: Docker Engine - Community
#  Engine:
#   Version:          20.10.16

# 如果Docker daemon没启动，先启动它
# Linux: sudo systemctl start docker
# Mac/Windows: 打开Docker Desktop

# 检查是否已安装
docker compose version

# 预期输出：Docker Compose version v2.10.2

# 如果没有，参考官方文档安装：
# https://docs.docker.com/compose/install/

<!-- ~/.m2/settings.xml -->
<settings>
  <mirrors>
    <mirror>
      <id>aliyun</id>
      <mirrorOf>central</mirrorOf>
      <name>Aliyun Maven Mirror</name>
      <url>https://maven.aliyun.com/repository/public</url>
    </mirror>
  </mirrors>
</settings>

# 用Maven命令快速创建（需要网络）
mvn archetype:generate \
  -DgroupId=com.demo \
  -DartifactId=user-service \
  -DarchetypeArtifactId=maven-archetype-quickstart \
  -DinteractiveMode=false

# 然后在pom.xml里加上SpringBoot依赖（后面会用到）

# 执行所有单元测试
mvn test

# 预期输出：
# [INFO] Tests run: 15, Failures: 0, Errors: 0, Skipped: 0
# [INFO] BUILD SUCCESS

@ExtendWith(MockitoExtension.class)
class UserServiceTest {

    @Mock
    private UserRepository userRepository;

    @InjectMocks
    private UserService userService;

    @Test
    void shouldReturnUserWhenIdExists() {
        // given
        User mockUser = new User(1L, "张三", "zhangsan@example.com");
        when(userRepository.findById(1L)).thenReturn(Optional.of(mockUser));

        // when
        UserDTO result = userService.getUserById(1L);

        // then
        assertNotNull(result);
        assertEquals("张三", result.getName());
        verify(userRepository, times(1)).findById(1L);
    }
}

# docker-compose.yml（放在项目根目录）
version: '3.8'
services:
  mysql:
    image: mysql:8.0
    container_name: test-mysql
    environment:
      MYSQL_ROOT_PASSWORD: root123
      MYSQL_DATABASE: user_db
    ports:
      - "3306:3306"
    command: --default-authentication-plugin=mysql_native_password

  redis:
    image: redis:7.0-alpine
    container_name: test-redis
    ports:
      - "6379:6379"

# 启动依赖服务
docker compose up -d

# 验证服务已就绪
docker compose ps
# 预期输出：两个服务都是 Up 状态

# 然后执行集成测试
mvn verify -P integration-test

@SpringBootTest
@AutoConfigureMockMvc
class UserControllerIntegrationTest {

    @Autowired
    private MockMvc mockMvc;

    @Autowired
    private UserRepository userRepository;

    @BeforeEach
    void setUp() {
        userRepository.deleteAll();
        userRepository.save(new User(null, "测试用户", "test@example.com"));
    }

    @Test
    void shouldCreateUserAndReturn201() throws Exception {
        String json = """
            {
                "name": "新用户",
                "email": "new@example.com"
            }
            """;

        mockMvc.perform(post("/api/users")
                .contentType(MediaType.APPLICATION_JSON)
                .content(json))
            .andExpect(status().isCreated())
            .andExpect(jsonPath("$.name").value("新用户"));
    }
}

# 先启动应用
mvn spring-boot:run &

# 等应用启动后（看日志里出现 Started Application 字样）

# 测试GET接口
curl -s http://localhost:8080/api/users/1 | python -m json.tool

# 预期输出：
# {
#     "id": 1,
#     "name": "测试用户",
#     "email": "test@example.com"
# }

# 测试POST接口
curl -s -X POST http://localhost:8080/api/users \
  -H "Content-Type: application/json" \
  -d '{"name":"新用户","email":"new@example.com"}' | python -m json.tool

# 预期输出：HTTP 201 Created

# 生成覆盖率报告（需要pom.xml里配置了jacoco插件）
mvn jacoco:report

# 报告位置：target/site/jacoco/index.html
# 用浏览器打开这个HTML文件，查看覆盖率数据

<plugin>
    <groupId>org.jacoco</groupId>
    <artifactId>jacoco-maven-plugin</artifactId>
    <version>0.8.8</version>
    <executions>
        <execution>
            <goals>
                <goal>prepare-agent</goal>
            </goals>
        </execution>
        <execution>
            <id>report</id>
            <phase>test</phase>
            <goals>
                <goal>report</goal>
            </goals>
        </execution>
    </executions>
</plugin>

# ========== 第一阶段：编译阶段 ==========
FROM maven:3.8.6-openjdk-8 AS builder

WORKDIR /build

# 先复制pom文件，预下载依赖（利用Docker层缓存，依赖不变时跳过下载）
COPY pom.xml .
RUN mvn dependency:go-offline -B

# 再复制源码并编译打包（src变化才触发重新编译）
COPY src ./src
RUN mvn clean package -DskipTests -B

# ========== 第二阶段：运行阶段 ==========
FROM openjdk:8-jre-alpine

# 元信息标签（方便运维和排查）
LABEL maintainer="developer@company.com"
LABEL app.name="user-service"
LABEL app.version="1.0.0"

# 安装运行时必要工具（tzdata=时区，curl=健康检查探活）
RUN apk add --no-cache tzdata curl ca-certificates

# 设置时区为北京时间（日志时间对齐）
ENV TZ=Asia/Shanghai
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone

# 创建非root用户和用户组（安全基线要求）
RUN addgroup -S appgroup && adduser -S appuser -G appgroup -u 1000
USER appuser:appgroup

# 从编译阶段只复制jar包（不包含Maven/Gradle等编译工具）
COPY --from=builder --chown=appuser:appgroup /build/target/*.jar /app/app.jar

WORKDIR /app

# 声明监听端口（文档用途，实际映射由编排系统负责）
EXPOSE 8080

# 可被覆盖的环境变量
ENV SPRING_PROFILES_ACTIVE=prod
ENV JAVA_OPTS=""

# 健康检查：每30秒用curl探一次actuator健康端点
# start-period=60s：启动后等60秒再开始检查（给SpringBoot启动预留时间）
HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
  CMD curl -f http://localhost:8080/actuator/health || exit 1

# 启动命令
# UseContainerSupport: 让JVM感知容器的内存限制而非宿主机
# MaxRAMPercentage=75: JVM堆最大占容器内存的75%
# InitialRAMPercentage=50: JVM堆初始占容器内存的50%
ENTRYPOINT ["sh", "-c", "java $JAVA_OPTS \
  -XX:+UseContainerSupport \
  -XX:MaxRAMPercentage=75.0 \
  -XX:InitialRAMPercentage=50.0 \
  -XX:+HeapDumpOnOutOfMemoryError \
  -XX:HeapDumpPath=/tmp \
  -jar /app/app.jar"]

# 构建镜像
docker build -t user-service:local .

# 预期输出（首次构建可能较慢）：
# Successfully built abc123def456
# Successfully tagged user-service:local

# 查看镜像大小
docker images user-service:local
# 预期：镜像大小应该在150MB ~ 250MB之间（多阶段构建的效果）

# 本地运行验证
docker run -d \
  --name user-service-test \
  -p 8080:8080 \
  -e SPRING_PROFILES_ACTIVE=dev \
  user-service:local

# 查看启动日志
docker logs -f user-service-test
# 预期看到：Started Application in X.XXX seconds

# 验证健康检查
curl http://localhost:8080/actuator/health
# 预期：{"status":"UP"}

# 测试完成后清理
docker rm -f user-service-test

# ============================================
# 全局变量定义
# ============================================
variables:
  # 镜像仓库配置（根据实际环境修改）
  REGISTRY: "harbor.company.com"
  REGISTRY_NAMESPACE: "microservices"
  APP_NAME: "user-service"
  APP_PORT: "8080"

  # 镜像标签：用commit短哈希作为版本号，同时打latest
  IMAGE_TAG: "${REGISTRY}/${REGISTRY_NAMESPACE}/${APP_NAME}:${CI_COMMIT_SHORT_SHA}"
  IMAGE_LATEST: "${REGISTRY}/${REGISTRY_NAMESPACE}/${APP_NAME}:latest"

  # Maven本地仓库路径（重定向到项目目录下，配合缓存使用）
  MAVEN_OPTS: "-Dmaven.repo.local=${CI_PROJECT_DIR}/.m2/repository -Dmaven.compiler.source=8 -Dmaven.compiler.target=8"

  # K8s命名空间
  K8S_NAMESPACE: "production"

# ============================================
# 缓存配置
# ============================================
cache:
  paths:
    - .m2/repository/          # 缓存Maven依赖，首次10分钟，后续30秒
    - target/                  # 缓存编译产物
  key: "${CI_COMMIT_REF_SLUG}" # 按分支区分缓存

# ============================================
# 阶段定义
# ============================================
stages:
  - test          # 单元测试
  - scan          # 代码扫描
  - build         # 构建JAR包
  - docker        # 构建和扫描Docker镜像
  - push          # 推送镜像到仓库
  - deploy        # 部署到K8s

# ============================================
# 阶段1：单元测试 + 覆盖率
# ============================================
unit-test:
  stage: test
  image: maven:3.8.6-openjdk-8
  script:
    - mvn test -B
    - mvn jacoco:report -B
  artifacts:
    paths:
      - target/site/jacoco/
    reports:
      junit: target/surefire-reports/TEST-*.xml
  coverage: '/Total.*?([0-9]{1,3})%/'
  only:
    - merge_requests
    - main
    - develop

# ============================================
# 阶段2：SonarQube代码扫描
# ============================================
sonarqube:
  stage: scan
  image: sonarsource/sonar-scanner-cli:latest
  script:
    - sonar-scanner
        -Dsonar.projectKey=${APP_NAME}
        -Dsonar.projectName=${APP_NAME}
        -Dsonar.sources=src/main/java
        -Dsonar.tests=src/test/java
        -Dsonar.java.binaries=target/classes
        -Dsonar.host.url=${SONAR_HOST_URL}
        -Dsonar.login=${SONAR_TOKEN}
        -Dsonar.coverage.jacoco.xmlReportPaths=target/site/jacoco/jacoco.xml
  only:
    - merge_requests
    - main
  allow_failure: true

# ============================================
# 阶段3：构建JAR包
# ============================================
build-jar:
  stage: build
  image: maven:3.8.6-openjdk-8
  script:
    - mvn clean package -DskipTests -B
  artifacts:
    paths:
      - target/*.jar
    expire_in: 1 hour      # 构建产物保留1小时就够了
  only:
    - main
    - develop

# ============================================
# 阶段4：构建Docker镜像
# ============================================
build-docker:
  stage: docker
  image: docker:20.10.16
  services:
    - docker:20.10.16-dind  # Docker-in-Docker，在容器里启动Docker daemon
  variables:
    DOCKER_TLS_CERTDIR: ""  # 关闭TLS，简化配置
  before_script:
    - docker login -u ${REGISTRY_USER} -p ${REGISTRY_PASSWORD} ${REGISTRY}
  script:
    # 同时打commit短哈希和latest两个标签
    - docker build -t ${IMAGE_TAG} -t ${IMAGE_LATEST} .
    # 保存镜像为tar文件，供后续阶段使用
    - docker save ${IMAGE_TAG} > image.tar
  artifacts:
    paths:
      - image.tar
    expire_in: 30 minutes
  only:
    - main
  needs:
    - build-jar

# ============================================
# 阶段5：镜像漏洞扫描
# ============================================
scan-image:
  stage: docker
  image: aquasec/trivy:latest
  script:
    # 只扫描CRITICAL级别漏洞，发现就流水线失败
    - trivy image --severity CRITICAL --exit-code 1 ${IMAGE_TAG}
  only:
    - main
  allow_failure: false    # CRITICAL漏洞不允许放过
  needs:
    - build-docker

# ============================================
# 阶段6：推送镜像到仓库
# ============================================
push-image:
  stage: push
  image: docker:20.10.16
  services:
    - docker:20.10.16-dind
  variables:
    DOCKER_TLS_CERTDIR: ""
  before_script:
    - docker login -u ${REGISTRY_USER} -p ${REGISTRY_PASSWORD} ${REGISTRY}
  script:
    - docker push ${IMAGE_TAG}
    - docker push ${IMAGE_LATEST}
  only:
    - main
  needs:
    - build-docker
    - scan-image

# ============================================
# 阶段7：部署到Kubernetes
# ============================================
deploy:
  stage: deploy
  image: bitnami/kubectl:latest
  script:
    # 更新Deployment的镜像（触发滚动更新）
    - kubectl set image deployment/${APP_NAME}
        ${APP_NAME}=${IMAGE_TAG}
        -n ${K8S_NAMESPACE}
    # 等待滚动更新完成（最多等5分钟）
    - kubectl rollout status deployment/${APP_NAME}
        -n ${K8S_NAMESPACE}
        --timeout=5m
    # 验证Pod状态
    - kubectl get pods -n ${K8S_NAMESPACE} -l app=${APP_NAME}
  environment:
    name: production
    url: https://api.company.com/${APP_NAME}
  only:
    - main
  when: manual      # 生产部署需要手动点击触发
  needs:
    - push-image

# 步骤1：从最新的develop创建功能分支
git checkout develop
git pull origin develop
git checkout -b feature/add-user-login

# ... 写代码、本地测试 ...

# 步骤2：提交并推送
git add .
git commit -m "feat(user): 实现用户登录功能

- 添加JWT Token生成和验证工具类
- 实现登录/登出接口
- 添加全局认证异常处理
- 单元测试覆盖率85%"

git push origin feature/add-user-login

# 步骤3：在GitLab网页上创建Merge Request
# 源分支：feature/add-user-login
# 目标分支：develop
# CI自动触发：单元测试 + SonarQube扫描

# 步骤4：Code Review通过后，点击Merge按钮
# 合并后CI自动将新版本部署到开发环境

# 步骤5：开发环境验证没问题后，创建MR从develop到main
# 审批通过 → 合并 → CI构建镜像推送仓库 → 手动触发生产部署

<!-- pom.xml -->
<dependency>
    <groupId>com.alibaba.cloud</groupId>
    <artifactId>spring-cloud-starter-alibaba-nacos-config</artifactId>
    <version>2021.0.5.0</version>
</dependency>
<dependency>
    <groupId>com.alibaba.cloud</groupId>
    <artifactId>spring-cloud-starter-alibaba-nacos-discovery</artifactId>
    <version>2021.0.5.0</version>
</dependency>

<!-- 注意：SpringBoot 2.4+ 需要额外引入bootstrap依赖 -->
<dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-starter-bootstrap</artifactId>
    <version>3.1.5</version>
</dependency>

# src/main/resources/bootstrap.yml
# 注意：Nacos的地址必须在bootstrap阶段就加载，
# 因为application.yml中的配置可能要从Nacos拉取
spring:
  application:
    name: user-service          # 服务名，同时也是Nacos的data-id前缀
  cloud:
    nacos:
      # 服务发现配置
      discovery:
        server-addr: nacos.company.com:8848
        namespace: production   # 命名空间，用于环境隔离
        group: DEFAULT_GROUP
        enabled: true
      # 配置中心配置
      config:
        server-addr: nacos.company.com:8848
        namespace: production
        file-extension: yaml    # 配置文件格式
        prefix: ${spring.application.name}  # data-id前缀
        group: DEFAULT_GROUP
        refresh-enabled: true   # 启用配置动态刷新
        shared-configs:         # 共享配置（多个服务共用）
          - data-id: common.yaml
            group: DEFAULT_GROUP
            refresh: true

# Nacos配置：data-id=user-service.yaml, group=DEFAULT_GROUP
spring:
  datasource:
    url: jdbc:mysql://mysql-master.production:3306/user_db?useSSL=false&serverTimezone=Asia/Shanghai
    username: ${MYSQL_USER}
    password: ${MYSQL_PASSWORD}
    hikari:
      maximum-pool-size: 20
      minimum-idle: 5
      idle-timeout: 300000
      connection-timeout: 20000
      max-lifetime: 1200000

  redis:
    cluster:
      nodes:
        - redis-node1.production:6379
        - redis-node2.production:6379
        - redis-node3.production:6379
    password: ${REDIS_PASSWORD}
    timeout: 3000ms
    lettuce:
      pool:
        max-active: 16
        max-idle: 8
        min-idle: 4

  rabbitmq:
    addresses: rabbitmq.production:5672
    username: ${RABBITMQ_USER}
    password: ${RABBITMQ_PASSWORD}

# 业务配置（支持 @RefreshScope 动态刷新）
business:
  max-login-attempts: 5           # 最大登录尝试次数
  session-timeout: 3600            # 会话超时时间（秒）
  verification-code-expire: 300    # 验证码过期时间（秒）
  feature-flags:
    new-login-page: true           # 新登录页面灰度开关
    enable-register: true          # 注册功能开关

@Data
@Component
@ConfigurationProperties(prefix = "business")
@RefreshScope   // 这个注解让配置变化时自动刷新，不需要重启应用
public class BusinessProperties {

    /** 最大登录尝试次数 */
    private Integer maxLoginAttempts;

    /** 会话超时时间（秒） */
    private Integer sessionTimeout;

    /** 验证码过期时间（秒） */
    private Integer verificationCodeExpire;

    /** 功能开关集合 */
    private Map<String, Boolean> featureFlags = new HashMap<>();

    /**
     * 判断某个功能是否开启
     */
    public boolean isFeatureEnabled(String featureName) {
        return featureFlags.getOrDefault(featureName, false);
    }
}

@Service
@Slf4j
public class LoginService {

    @Autowired
    private BusinessProperties businessProperties;

    public LoginResult login(String username, String password) {
        // 动态检查功能开关
        if (!businessProperties.isFeatureEnabled("new-login-page")) {
            log.info("新版登录页面未开启，使用旧版逻辑");
            // 回退到旧版逻辑...
        }

        // 使用动态配置的阈值
        int maxAttempts = businessProperties.getMaxLoginAttempts();
        int failedCount = getFailedAttempts(username);

        if (failedCount >= maxAttempts) {
            throw new AccountLockedException(
                "账户已锁定，请" + businessProperties.getSessionTimeout() + "秒后重试");
        }
        // ... 验证逻辑
    }
}

# gateway-service/src/main/resources/application.yml
server:
  port: 8080

spring:
  application:
    name: gateway-service
  cloud:
    nacos:
      discovery:
        server-addr: nacos.company.com:8848
        namespace: production
    gateway:
      discovery:
        locator:
          enabled: true           # 自动根据Nacos服务名创建路由
          lower-case-service-id: true
      routes:
        # ========== 用户服务路由 ==========
        - id: user-service-route
          uri: lb://user-service            # lb:// = 负载均衡拉取Nacos实例
          predicates:
            - Path=/api/users/**            # 匹配 /api/users/xxx 的请求
          filters:
            - StripPrefix=1                 # 转发前去掉 /api 前缀
            - name: RequestRateLimiter      # 令牌桶限流
              args:
                key-resolver: "#{@ipKeyResolver}"
                redis-rate-limiter.replenishRate: 100    # 每秒填充100个令牌
                redis-rate-limiter.burstCapacity: 200    # 突发容量200个令牌
            - name: CircuitBreaker          # 熔断器
              args:
                name: userServiceCircuitBreaker
                fallbackUri: forward:/fallback/users

        # ========== 订单服务路由 ==========
        - id: order-service-route
          uri: lb://order-service
          predicates:
            - Path=/api/orders/**
          filters:
            - StripPrefix=1
            - name: RequestRateLimiter
              args:
                key-resolver: "#{@ipKeyResolver}"
                redis-rate-limiter.replenishRate: 80
                redis-rate-limiter.burstCapacity: 150

        # ========== 博客服务路由 ==========
        - id: blog-service-route
          uri: lb://blog-service
          predicates:
            - Path=/api/blogs/**
          filters:
            - StripPrefix=1
            - name: RequestRateLimiter
              args:
                key-resolver: "#{@ipKeyResolver}"
                redis-rate-limiter.replenishRate: 50
                redis-rate-limiter.burstCapacity: 100

      # 全局默认过滤器（对所有路由生效）
      default-filters:
        - AddResponseHeader=X-Response-Source, gateway
        - DedupeResponseHeader=Access-Control-Allow-Origin

@Component
@Slf4j
public class GlobalAuthFilter implements GlobalFilter, Ordered {

    /** 不需要认证的路径前缀 */
    private static final List<String> WHITELIST_PATHS = List.of(
        "/api/users/login",
        "/api/users/register",
        "/api/health",
        "/actuator"
    );

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        ServerHttpRequest request = exchange.getRequest();
        String path = request.getURI().getPath();

        // 1. 检查白名单
        if (isWhitelisted(path)) {
            return chain.filter(exchange);
        }

        // 2. 提取并校验Token
        String authHeader = request.getHeaders().getFirst(HttpHeaders.AUTHORIZATION);
        if (authHeader == null || !authHeader.startsWith("Bearer ")) {
            return unauthorized(exchange, "缺少有效的认证Token");
        }
        String token = authHeader.substring(7);

        // 3. 验证Token有效性
        TokenInfo tokenInfo;
        try {
            tokenInfo = parseAndValidateToken(token);
        } catch (TokenExpiredException e) {
            return unauthorized(exchange, "Token已过期，请重新登录");
        } catch (TokenInvalidException e) {
            return unauthorized(exchange, "Token无效");
        }

        // 4. 将用户信息透传到下游微服务（下游不需要再解析Token）
        ServerHttpRequest mutatedRequest = request.mutate()
            .header("X-User-Id", tokenInfo.getUserId())
            .header("X-User-Name", URLEncoder.encode(tokenInfo.getUsername(), StandardCharsets.UTF_8))
            .header("X-User-Roles", String.join(",", tokenInfo.getRoles()))
            .build();

        return chain.filter(exchange.mutate().request(mutatedRequest).build());
    }

    @Override
    public int getOrder() {
        return -100;  // 优先级最高，确保认证在业务过滤之前
    }

    // ... isWhitelisted, parseAndValidateToken, unauthorized 等方法实现
}

@Configuration
public class RateLimiterConfig {

    /**
     * 基于请求IP的限流Key解析器
     * 同一个IP共享限流配额
     */
    @Bean
    public KeyResolver ipKeyResolver() {
        return exchange -> {
            String ip = exchange.getRequest().getRemoteAddress()
                .getAddress()
                .getHostAddress();
            return Mono.just(ip);
        };
    }
}

# ========== 1. 单元测试全部通过 ==========
mvn clean test
# 预期输出：BUILD SUCCESS, Tests run: XX, Failures: 0

# ========== 2. 代码格式化 ==========
mvn spotless:apply
# 如果没有配spotless，至少确保IDE的格式化已执行

# ========== 3. 静态代码检查 ==========
mvn spotbugs:check
# 或 mvn pmd:check
# 预期输出：BUILD SUCCESS（没有新引入的缺陷）

# ========== 4. 检查配置文件中的敏感信息 ==========
# 搜索可能泄露密钥/密码的模式
grep -r "password\s*:" src/main/resources/ | grep -v "\\$\{"
grep -r "secret\s*:" src/main/resources/ | grep -v "\\$\{"
grep -r "token\s*:" src/main/resources/ | grep -v "\\$\{"
# 预期输出：空（所有敏感值都是 ${xxx} 占位符形式）

# ========== 5. Dockerfile本地构建测试 ==========
docker build -t user-service:check .
# 预期输出：Successfully built xxx

# ========== 6. 本地容器运行测试 ==========
docker run -d --name check -p 8080:8080 user-service:check
sleep 30
curl -s http://localhost:8080/actuator/health
# 预期输出：{"status":"UP"}
docker rm -f check

# 好的提交信息示例（推荐Conventional Commits格式）：
git commit -m "feat(user): 实现JWT登录认证

- 添加JWT Token生成和验证工具类
- 实现登录、登出、刷新Token三个接口
- 添加全局认证异常处理（Token过期/无效/缺失）
- 单元测试覆盖率85%，集成测试覆盖核心流程"

# 提交信息格式说明：
# <type>(<scope>): <subject>
#
# type类型：
#   feat     - 新功能
#   fix      - Bug修复
#   refactor - 重构（不改变功能）
#   docs     - 文档更新
#   test     - 测试相关
#   chore    - 构建/工具链相关

# 推送功能分支
git push origin feature/user-login

# 之后的事情全自动：
# 1. GitLab检测到push，触发CI流水线
# 2. 单元测试 + SonarQube扫描自动执行
# 3. 开发者在GitLab上创建MR（Merge Request）
# 4. Reviewer审查代码，通过后点击合并
# 5. 合并到develop → CI自动部署到开发环境
# 6. 开发环境验证OK → 创建MR从develop到main
# 7. 审批通过合并 → CI构建镜像、推送到镜像仓库
# 8. 手动点击生产部署 → K8s滚动更新 → 上线完成

# ========== 1. 检查Pod状态 ==========
kubectl get pods -n production -l app=user-service
# 期望：所有Pod状态为Running, READY列为1/1

# ========== 2. 查看新Pod的日志 ==========
kubectl logs -n production deployment/user-service --tail=50
# 期望：看到 Started Application in X.XXX seconds，无ERROR级别日志

# ========== 3. 验证Nacos注册 ==========
# 访问Nacos控制台 → 服务管理 → 服务列表
# 期望：user-service的实例列表中出现了新的Pod IP

# ========== 4. 通过Gateway访问接口 ==========
curl -s https://api.company.com/api/users/health | python -m json.tool
# 期望：{"status":"UP"}

# ========== 5. 验证业务接口 ==========
curl -s -X POST https://api.company.com/api/users/login \
  -H "Content-Type: application/json" \
  -d '{"username":"test","password":"test123"}'
# 期望：返回JWT Token，HTTP 200

# ========== 6. 验证滚动更新完成 ==========
kubectl rollout history deployment/user-service -n production
# 期望：新版本的revision出现在列表最上方