---

name: infrastructure description: 使用Terraform、Docker和Kubernetes部署Guts节点的基础设施即代码模式

Guts基础设施技能

您正在管理一个具有多种节点类型的去中心化应用程序的基础设施。

部署目标

1. 本地开发: Docker Compose
2. 测试环境: Kubernetes (k3s/kind)
3. 生产环境: 云无关的Kubernetes + Terraform

Terraform模式

模块结构

infra/
├── terraform/
│   ├── modules/
│   │   ├── network/
│   │   ├── compute/
│   │   └── storage/
│   ├── environments/
│   │   ├── dev/
│   │   ├── staging/
│   │   └── prod/
│   └── main.tf

示例模块

# modules/guts-node/main.tf
variable "node_count" {
  type        = number
  description = "要部署的Guts节点数量"
  default     = 3
}

variable "instance_type" {
  type        = string
  description = "节点的实例类型"
  default     = "t3.medium"
}

resource "aws_instance" "guts_node" {
  count         = var.node_count
  ami           = data.aws_ami.ubuntu.id
  instance_type = var.instance_type

  tags = {
    Name        = "guts-node-${count.index}"
    Environment = var.environment
    Project     = "guts"
  }
}

Docker最佳实践

多阶段构建

# 构建阶段
FROM rust:1.75-slim as builder
WORKDIR /app
COPY . .
RUN cargo build --release --bin guts-node

# 运行阶段
FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y ca-certificates && rm -rf /var/lib/apt/lists/*
COPY --from=builder /app/target/release/guts-node /usr/local/bin/
EXPOSE 8080 9000
ENTRYPOINT ["guts-node"]

开发环境Docker Compose

version: '3.8'

services:
  node1:
    build: .
    ports:
      - "8081:8080"
    environment:
      - GUTS_NODE_ID=node1
      - GUTS_PEERS=node2:9000,node3:9000
    volumes:
      - node1-data:/data

  node2:
    build: .
    ports:
      - "8082:8080"
    environment:
      - GUTS_NODE_ID=node2
      - GUTS_PEERS=node1:9000,node3:9000
    volumes:
      - node2-data:/data

  node3:
    build: .
    ports:
      - "8083:8080"
    environment:
      - GUTS_NODE_ID=node3
      - GUTS_PEERS=node1:9000,node2:9000
    volumes:
      - node3-data:/data

volumes:
  node1-data:
  node2-data:
  node3-data:

Kubernetes模式

节点StatefulSet

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: guts-node
spec:
  serviceName: guts-nodes
  replicas: 3
  selector:
    matchLabels:
      app: guts-node
  template:
    metadata:
      labels:
        app: guts-node
    spec:
      containers:
      - name: guts-node
        image: guts/node:latest
        ports:
        - containerPort: 8080
          name: api
        - containerPort: 9000
          name: p2p
        volumeMounts:
        - name: data
          mountPath: /data
  volumeClaimTemplates:
  - metadata:
      name: data
    spec:
      accessModes: ["ReadWriteOnce"]
      resources:
        requests:
          storage: 100Gi

监控栈

• 指标: Prometheus + 自定义Rust指标
• 日志: Loki + Grafana
• 追踪: Jaeger + OpenTelemetry

安全检查清单

• [ ] 通过cert-manager管理TLS证书
• [ ] 用于Pod隔离的网络策略
• [ ] 使用external-secrets进行密钥管理
• [ ] 使用Trivy进行定期安全扫描
• [ ] Kubernetes访问的RBAC控制