407 lines
15 KiB
Bash
407 lines
15 KiB
Bash
#!/usr/bin/env sh
|
||
set -eu
|
||
|
||
if [ "$#" -ne 7 ]; then
|
||
echo "用法: $0 <环境> <镜像仓库> <镜像标签> <服务> <环境文件> <Compose文件> <项目名>" >&2
|
||
exit 2
|
||
fi
|
||
|
||
DEPLOY_ENV="$1"
|
||
IMAGE_REPOSITORY="$2"
|
||
IMAGE_TAG="$3"
|
||
SERVICE="$4"
|
||
ENV_FILE="$5"
|
||
COMPOSE_FILE="$6"
|
||
BASE_PROJECT="$7"
|
||
|
||
case "$DEPLOY_ENV" in
|
||
test|production) ;;
|
||
*) echo "蓝绿执行器仅用于 test/production，当前: $DEPLOY_ENV" >&2; exit 2 ;;
|
||
esac
|
||
|
||
for file in "$ENV_FILE" "$COMPOSE_FILE"; do
|
||
[ -f "$file" ] || { echo "必需文件不存在: $file" >&2; exit 2; }
|
||
done
|
||
|
||
case "$SERVICE" in
|
||
*[!A-Za-z0-9_-]*|'') echo "非法服务名: $SERVICE" >&2; exit 2 ;;
|
||
esac
|
||
|
||
env_value() {
|
||
sed -n "s/^$1=//p" "$ENV_FILE" | tail -n 1 | tr -d '\r'
|
||
}
|
||
|
||
service_contract() {
|
||
case "$SERVICE:$COMPOSE_FILE" in
|
||
gateway:*) echo "gateway|9000|9000|gateway|gateway-active" ;;
|
||
auth:*) echo "auth|9100|9100|auth-service|auth" ;;
|
||
iam:*) echo "iam|9201|9201|iam-service|iam" ;;
|
||
firstleg:*) echo "business|9202|9202|firstleg-service|firstleg" ;;
|
||
finance:*) echo "finance|9203|9203|finance-service|finance" ;;
|
||
order:*) echo "order|9204|9204|order-service|order" ;;
|
||
warehouse:*) echo "warehouse|9205|9205|warehouse-service|warehouse" ;;
|
||
file:*) echo "file|9206|9206|file-service|file" ;;
|
||
print:*) echo "print|9207|9207|print-service|print" ;;
|
||
integration-service:*) echo "integration|9210|9210|integration-service|integration-service" ;;
|
||
audit-service:*) echo "audit|9700|9700|audit-service|audit-service" ;;
|
||
gateway-overseas:*) echo "gateway-overseas|9300|9300|gateway-overseas|gateway-overseas-active" ;;
|
||
lastleg-service:*) echo "lastleg|9303|9303|lastleg-service|lastleg-service" ;;
|
||
warehouse-overseas-service:*) echo "warehouse-overseas|9305|9305|warehouse-overseas-service|warehouse-overseas-service" ;;
|
||
event-bridge-service:*overseas*) echo "event-bridge-overseas|9312|9313|event-bridge-overseas|event-bridge-overseas" ;;
|
||
event-bridge-service:*) echo "event-bridge|9312|9312|event-bridge-cn|event-bridge-cn" ;;
|
||
*) echo "不支持蓝绿部署的服务: $SERVICE" >&2; exit 2 ;;
|
||
esac
|
||
}
|
||
|
||
IFS='|' read -r CONTAINER_STEM INTERNAL_PORT BASE_PORT NACOS_SERVICE ROUTING_ALIAS <<EOF
|
||
$(service_contract)
|
||
EOF
|
||
|
||
STATE_ROOT="${BLUE_GREEN_STATE_ROOT:-/data/firstleg/deploy/blue-green-state}"
|
||
STATE_KEY="${BASE_PROJECT}-${SERVICE}"
|
||
STATE_FILE="$STATE_ROOT/$STATE_KEY.active"
|
||
ROUTING_NETWORK="${BLUE_GREEN_ROUTING_NETWORK:-firstleg-${DEPLOY_ENV}-routing}"
|
||
HEALTH_TIMEOUT="${DEPLOY_HEALTH_TIMEOUT_SECONDS:-240}"
|
||
HEALTH_POLL="${DEPLOY_HEALTH_POLL_SECONDS:-5}"
|
||
STABILIZATION_SECONDS="${BLUE_GREEN_STABILIZATION_SECONDS:-10}"
|
||
STOP_TIMEOUT="${BLUE_GREEN_STOP_TIMEOUT_SECONDS:-45}"
|
||
IMAGE="$IMAGE_REPOSITORY/$SERVICE:$IMAGE_TAG"
|
||
|
||
for value in "$HEALTH_TIMEOUT" "$HEALTH_POLL" "$STABILIZATION_SECONDS" "$STOP_TIMEOUT"; do
|
||
case "$value" in ''|*[!0-9]*) echo "蓝绿时间参数必须为非负整数: $value" >&2; exit 2 ;; esac
|
||
done
|
||
|
||
mkdir -p "$STATE_ROOT"
|
||
chmod 750 "$STATE_ROOT"
|
||
docker network inspect "$ROUTING_NETWORK" >/dev/null 2>&1 || docker network create "$ROUTING_NETWORK" >/dev/null
|
||
|
||
legacy_container="firstleg-${DEPLOY_ENV}-${CONTAINER_STEM}"
|
||
active_slot=""
|
||
active_container=""
|
||
active_port=""
|
||
active_worker=""
|
||
if [ -s "$STATE_FILE" ]; then
|
||
IFS='|' read -r active_slot active_container active_port active_image active_worker < "$STATE_FILE"
|
||
elif docker inspect "$legacy_container" >/dev/null 2>&1; then
|
||
active_slot="legacy"
|
||
active_container="$legacy_container"
|
||
active_port="$BASE_PORT"
|
||
fi
|
||
|
||
if [ "$active_slot" = "blue" ]; then
|
||
target_slot="green"
|
||
else
|
||
target_slot="blue"
|
||
[ "$active_slot" = "legacy" ] && target_slot="green"
|
||
fi
|
||
|
||
if [ "$target_slot" = "blue" ]; then
|
||
target_port=$((BASE_PORT + 20000))
|
||
else
|
||
target_port=$((BASE_PORT + 10000))
|
||
fi
|
||
candidate="firstleg-${DEPLOY_ENV}-${CONTAINER_STEM}-${target_slot}"
|
||
worker_candidate="${candidate}-worker"
|
||
|
||
if docker inspect "$candidate" >/dev/null 2>&1; then
|
||
if [ "$candidate" = "$active_container" ]; then
|
||
echo "活动槽状态异常，候选容器与活动容器相同: $candidate" >&2
|
||
exit 1
|
||
fi
|
||
docker rm -f "$candidate" >/dev/null
|
||
fi
|
||
|
||
compose() {
|
||
docker compose --project-name "$BASE_PROJECT" --env-file "$ENV_FILE" -f "$COMPOSE_FILE" "$@"
|
||
}
|
||
|
||
container_health() {
|
||
container="$1"
|
||
docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' \
|
||
"$container" 2>/dev/null || echo missing
|
||
}
|
||
|
||
cleanup_candidate() {
|
||
docker rm -f "$candidate" >/dev/null 2>&1 || true
|
||
}
|
||
|
||
wait_for_container() {
|
||
container="$1"
|
||
label="$2"
|
||
elapsed=0
|
||
while [ "$elapsed" -lt "$HEALTH_TIMEOUT" ]; do
|
||
state="$(container_health "$container")"
|
||
echo "$label 健康状态: $state（已等待 ${elapsed}s）"
|
||
case "$state" in
|
||
healthy) return 0 ;;
|
||
unhealthy|exited|dead|missing) return 1 ;;
|
||
esac
|
||
sleep "$HEALTH_POLL"
|
||
elapsed=$((elapsed + HEALTH_POLL))
|
||
done
|
||
return 1
|
||
}
|
||
|
||
needs_worker() {
|
||
case "$SERVICE" in
|
||
iam|firstleg|finance|order|event-bridge-service|lastleg-service) return 0 ;;
|
||
file)
|
||
[ "$(env_value FILE_EXPORT_CONSUMER_ENABLED)" = true ] \
|
||
|| [ "$(env_value FILE_EXPORT_PUBLISHER_ENABLED)" = true ] \
|
||
|| [ "$(env_value FILE_EXPORT_RECONCILER_ENABLED)" = true ] \
|
||
|| [ "$(env_value AUDIT_OUTBOX_PUBLISHER_ENABLED)" = true ]
|
||
;;
|
||
audit-service)
|
||
[ "$(env_value AUDIT_MQ_CONSUMER_ENABLED)" = true ] \
|
||
|| [ "$(env_value AUDIT_DLQ_CONSUMER_ENABLED)" = true ] \
|
||
|| [ "$(env_value AUDIT_DLQ_COMPENSATION_ENABLED)" = true ]
|
||
;;
|
||
auth|warehouse|warehouse-overseas-service)
|
||
[ "$(env_value AUDIT_OUTBOX_PUBLISHER_ENABLED)" = true ]
|
||
;;
|
||
*) return 1 ;;
|
||
esac
|
||
}
|
||
|
||
start_worker_candidate() {
|
||
docker rm -f "$worker_candidate" >/dev/null 2>&1 || true
|
||
echo "启动单例 Worker: $worker_candidate"
|
||
if [ "$SERVICE" = file ]; then
|
||
worker_java_options="-Xms512m -Xmx2g -XX:+ExitOnOutOfMemoryError -Dfile.encoding=UTF-8"
|
||
else
|
||
worker_java_options="-Xms256m -Xmx1g -XX:+ExitOnOutOfMemoryError -Dfile.encoding=UTF-8"
|
||
fi
|
||
if ! compose run -d --no-deps --name "$worker_candidate" \
|
||
-e "NACOS_REGISTER_ENABLED=false" \
|
||
-e "BAIYUE_RUNTIME_SCHEDULING_ENABLED=true" \
|
||
-e "BAIYUE_DEPLOY_SLOT=${target_slot}-worker" \
|
||
-e "JAVA_TOOL_OPTIONS=$worker_java_options" \
|
||
-e "BAIYUE_RELEASE_ID=$IMAGE_TAG" "$SERVICE" >/dev/null; then
|
||
return 1
|
||
fi
|
||
docker network connect "$ROUTING_NETWORK" "$worker_candidate"
|
||
if ! wait_for_container "$worker_candidate" "候选 Worker"; then
|
||
docker logs --tail 200 "$worker_candidate" 2>&1 || true
|
||
docker rm -f "$worker_candidate" >/dev/null 2>&1 || true
|
||
return 1
|
||
fi
|
||
worker_image="$(docker inspect --format '{{.Config.Image}}' "$worker_candidate")"
|
||
[ "$worker_image" = "$IMAGE" ] || return 1
|
||
}
|
||
|
||
connect_routing_aliases() {
|
||
container="$1"
|
||
shift
|
||
docker network inspect "$ROUTING_NETWORK" --format '{{json .Containers}}' | grep -q "\"$container\"" \
|
||
&& return 0
|
||
set -- docker network connect $(for alias_name in "$@"; do printf '%s\n' --alias "$alias_name"; done)
|
||
"$@" "$ROUTING_NETWORK" "$container"
|
||
}
|
||
|
||
bootstrap_legacy_routes() {
|
||
for pair in \
|
||
gateway-active,gateway:gateway auth,auth-service:auth iam,iam-service:iam \
|
||
firstleg,firstleg-service:business finance,finance-service:finance order,order-service:order \
|
||
warehouse,warehouse-service:warehouse file,file-service:file print,print-service:print \
|
||
integration-service:integration audit-service:audit \
|
||
gateway-overseas-active,gateway-overseas:gateway-overseas \
|
||
lastleg-service:lastleg warehouse-overseas-service:warehouse-overseas \
|
||
event-bridge-cn:event-bridge event-bridge-overseas:event-bridge-overseas
|
||
do
|
||
aliases="${pair%%:*}"
|
||
stem="${pair#*:}"
|
||
container="firstleg-${DEPLOY_ENV}-${stem}"
|
||
if docker inspect "$container" >/dev/null 2>&1; then
|
||
connect_routing_aliases "$container" $(printf '%s' "$aliases" | tr ',' ' ') || true
|
||
fi
|
||
done
|
||
for container in firstleg-prod-admin-web firstleg-prod-client-web; do
|
||
if docker inspect "$container" >/dev/null 2>&1; then
|
||
connect_routing_aliases "$container" "${container##*-}" || true
|
||
fi
|
||
done
|
||
}
|
||
|
||
switch_gateway_proxy() {
|
||
[ "$SERVICE" = "gateway" ] || [ "$SERVICE" = "gateway-overseas" ] || return 0
|
||
if [ "$DEPLOY_ENV" = test ]; then
|
||
echo "测试 Gateway 仍由固定入口承载，不在后端蓝绿执行器中切换" >&2
|
||
return 1
|
||
fi
|
||
if [ "$SERVICE" = "gateway" ]; then required_alias=gateway-active; else required_alias=gateway-overseas-active; fi
|
||
for frontend_service in admin-web client-web; do
|
||
frontend_state="$STATE_ROOT/frontend-$frontend_service.active"
|
||
if [ ! -s "$frontend_state" ]; then
|
||
echo "$frontend_service 尚未完成首次蓝绿迁移，拒绝切换 Gateway" >&2
|
||
return 1
|
||
fi
|
||
IFS='|' read -r frontend_slot frontend frontend_port frontend_image < "$frontend_state"
|
||
if ! docker inspect "$frontend" >/dev/null 2>&1 \
|
||
|| ! docker exec "$frontend" nginx -T 2>&1 | grep -q "$required_alias"; then
|
||
echo "$frontend 尚未使用稳定上游 $required_alias，拒绝切换 Gateway" >&2
|
||
return 1
|
||
fi
|
||
done
|
||
route_root="${BLUE_GREEN_ROUTE_CONFIG_ROOT:-/www/server/panel/vhost/nginx}"
|
||
if [ "$SERVICE" = "gateway" ]; then
|
||
config="$route_root/00-blue-green-gateway.conf"
|
||
else
|
||
config="$route_root/00-blue-green-gateway-overseas.conf"
|
||
fi
|
||
if [ -z "$config" ] || [ ! -f "$config" ]; then
|
||
echo "$SERVICE 蓝绿切换要求环境文件配置有效的 Nginx 配置路径" >&2
|
||
return 1
|
||
fi
|
||
backup="$config.blue-green-backup"
|
||
cp -f "$config" "$backup"
|
||
if ! sed -i "s#127\.0\.0\.1:${active_port:-$BASE_PORT}#127.0.0.1:$target_port#g" "$config" \
|
||
|| cmp -s "$config" "$backup"; then
|
||
cp -f "$backup" "$config"
|
||
echo "未能在 Nginx 配置中切换 $SERVICE 上游端口" >&2
|
||
return 1
|
||
fi
|
||
if ! nginx -t || ! nginx -s reload; then
|
||
cp -f "$backup" "$config"
|
||
nginx -t && nginx -s reload || true
|
||
return 1
|
||
fi
|
||
rm -f "$backup"
|
||
}
|
||
|
||
reload_frontend_proxies() {
|
||
[ "$SERVICE" = "gateway" ] || [ "$SERVICE" = "gateway-overseas" ] || return 0
|
||
[ "$DEPLOY_ENV" = production ] || return 0
|
||
for frontend_service in admin-web client-web; do
|
||
frontend_state="$STATE_ROOT/frontend-$frontend_service.active"
|
||
[ -s "$frontend_state" ] || return 1
|
||
IFS='|' read -r frontend_slot frontend frontend_port frontend_image < "$frontend_state"
|
||
docker inspect "$frontend" >/dev/null 2>&1 || return 1
|
||
docker exec "$frontend" nginx -t
|
||
docker exec "$frontend" nginx -s reload
|
||
done
|
||
}
|
||
|
||
rollback_gateway_proxy() {
|
||
[ "$SERVICE" = "gateway" ] || [ "$SERVICE" = "gateway-overseas" ] || return 0
|
||
[ "$DEPLOY_ENV" = production ] || return 0
|
||
route_root="${BLUE_GREEN_ROUTE_CONFIG_ROOT:-/www/server/panel/vhost/nginx}"
|
||
if [ "$SERVICE" = "gateway" ]; then
|
||
config="$route_root/00-blue-green-gateway.conf"
|
||
else
|
||
config="$route_root/00-blue-green-gateway-overseas.conf"
|
||
fi
|
||
old_port="${active_port:-$BASE_PORT}"
|
||
sed -i "s#127\.0\.0\.1:$target_port#127.0.0.1:$old_port#g" "$config"
|
||
nginx -t && nginx -s reload
|
||
}
|
||
|
||
bootstrap_legacy_routes
|
||
|
||
export DEPLOY_ENV IMAGE_REPOSITORY IMAGE_TAG
|
||
echo "启动候选槽: service=$SERVICE slot=$target_slot port=$target_port image=$IMAGE"
|
||
if ! compose run -d --no-deps --name "$candidate" \
|
||
-e "BAIYUE_DEPLOY_SLOT=$target_slot" -e "BAIYUE_RELEASE_ID=$IMAGE_TAG" \
|
||
-e "BAIYUE_RUNTIME_SCHEDULING_ENABLED=false" \
|
||
-e "AUDIT_OUTBOX_PUBLISHER_ENABLED=false" \
|
||
-e "NOTIFICATION_SCHEDULER_ENABLED=false" \
|
||
-e "NOTIFICATION_MQ_CONSUMER_ENABLED=false" \
|
||
-e "FILE_EXPORT_CONSUMER_ENABLED=false" \
|
||
-e "FILE_EXPORT_PUBLISHER_ENABLED=false" \
|
||
-e "FILE_EXPORT_RECONCILER_ENABLED=false" \
|
||
-e "AUDIT_MQ_CONSUMER_ENABLED=false" \
|
||
-e "AUDIT_DLQ_CONSUMER_ENABLED=false" \
|
||
-e "AUDIT_DLQ_COMPENSATION_ENABLED=false" \
|
||
-p "${PUBLISHED_BIND_ADDRESS:-0.0.0.0}:$target_port:$INTERNAL_PORT" "$SERVICE" >/dev/null; then
|
||
cleanup_candidate
|
||
exit 1
|
||
fi
|
||
|
||
if ! wait_for_container "$candidate" "候选 Web 槽 $target_slot"; then
|
||
echo "候选槽未通过健康检查，保留旧实例" >&2
|
||
docker logs --tail 200 "$candidate" 2>&1 || true
|
||
cleanup_candidate
|
||
exit 1
|
||
fi
|
||
|
||
running_image="$(docker inspect --format '{{.Config.Image}}' "$candidate")"
|
||
if [ "$running_image" != "$IMAGE" ]; then
|
||
echo "候选镜像不一致: expected=$IMAGE actual=$running_image" >&2
|
||
cleanup_candidate
|
||
exit 1
|
||
fi
|
||
|
||
if [ "$NACOS_SERVICE" = "$ROUTING_ALIAS" ]; then
|
||
connect_routing_aliases "$candidate" "$ROUTING_ALIAS"
|
||
else
|
||
connect_routing_aliases "$candidate" "$ROUTING_ALIAS" "$NACOS_SERVICE"
|
||
fi
|
||
|
||
if [ "$STABILIZATION_SECONDS" -gt 0 ]; then
|
||
echo "候选槽稳定观察 ${STABILIZATION_SECONDS}s"
|
||
sleep "$STABILIZATION_SECONDS"
|
||
[ "$(container_health "$candidate")" = "healthy" ] || { cleanup_candidate; exit 1; }
|
||
fi
|
||
|
||
if ! switch_gateway_proxy; then
|
||
cleanup_candidate
|
||
exit 1
|
||
fi
|
||
|
||
worker_required=false
|
||
if needs_worker; then worker_required=true; fi
|
||
|
||
if [ "$worker_required" = true ] && [ "$active_slot" != legacy ]; then
|
||
if [ -n "$active_worker" ] && docker inspect "$active_worker" >/dev/null 2>&1; then
|
||
echo "暂停旧 Worker，避免新旧任务并行: $active_worker"
|
||
docker stop --time "$STOP_TIMEOUT" "$active_worker" >/dev/null
|
||
fi
|
||
if ! start_worker_candidate; then
|
||
[ -z "$active_worker" ] || docker start "$active_worker" >/dev/null 2>&1 || true
|
||
rollback_gateway_proxy || true
|
||
cleanup_candidate
|
||
exit 1
|
||
fi
|
||
fi
|
||
|
||
old_container_stopped=false
|
||
if [ -n "$active_container" ] && docker inspect "$active_container" >/dev/null 2>&1; then
|
||
echo "优雅停止旧 Web 实例: $active_container"
|
||
docker stop --time "$STOP_TIMEOUT" "$active_container" >/dev/null
|
||
old_container_stopped=true
|
||
fi
|
||
|
||
if [ "$worker_required" = true ] && [ "$active_slot" = legacy ]; then
|
||
if ! start_worker_candidate; then
|
||
[ "$old_container_stopped" = false ] || docker start "$active_container" >/dev/null 2>&1 || true
|
||
rollback_gateway_proxy || true
|
||
cleanup_candidate
|
||
exit 1
|
||
fi
|
||
fi
|
||
|
||
if ! reload_frontend_proxies; then
|
||
[ "$old_container_stopped" = false ] || docker start "$active_container" >/dev/null 2>&1 || true
|
||
if [ "$worker_required" = true ]; then
|
||
docker rm -f "$worker_candidate" >/dev/null 2>&1 || true
|
||
[ -z "$active_worker" ] || docker start "$active_worker" >/dev/null 2>&1 || true
|
||
fi
|
||
rollback_gateway_proxy || true
|
||
cleanup_candidate
|
||
reload_frontend_proxies || true
|
||
exit 1
|
||
fi
|
||
|
||
[ -z "$active_worker" ] || [ "$active_worker" = "$worker_candidate" ] \
|
||
|| docker rm "$active_worker" >/dev/null 2>&1 || true
|
||
[ "$old_container_stopped" = false ] || docker rm "$active_container" >/dev/null
|
||
|
||
if [ "$worker_required" = true ]; then
|
||
next_worker="$worker_candidate"
|
||
else
|
||
next_worker=""
|
||
fi
|
||
printf '%s|%s|%s|%s|%s\n' "$target_slot" "$candidate" "$target_port" "$IMAGE" "$next_worker" > "$STATE_FILE.tmp"
|
||
chmod 640 "$STATE_FILE.tmp"
|
||
mv -f "$STATE_FILE.tmp" "$STATE_FILE"
|
||
echo "蓝绿切换完成: service=$SERVICE active=$target_slot container=$candidate port=$target_port"
|