apiVersion: v1
kind: Pod
metadata:
  name: sfu-pod
  labels:
    app: sfu
spec:
  restartPolicy: Always  # SFU服务需要持续运行
  
  initContainers:        # 初始化容器，按顺序执行
  - name: init-config
    image: busybox
    command: ['sh', '-c', 'echo "Initializing..."']
    
  containers:
  - name: sfu
    image: sfu-server:v1.0.0
    
    # 生命周期钩子
    lifecycle:
      postStart:         # 启动后执行
        exec:
          command: ["/bin/sh", "-c", "echo SFU started > /tmp/log"]
      preStop:           # 停止前执行（优雅关闭）
        exec:
          command: ["/bin/sh", "-c", "sleep 10 && curl -X POST localhost:8080/drain"]
    
    # 健康检查
    livenessProbe:       # 存活性检查，失败则重启
      httpGet:
        path: /health
        port: 8080
      initialDelaySeconds: 30  # 启动后等待30秒开始检查
      periodSeconds: 10        # 每10秒检查一次
      timeoutSeconds: 5        # 超时5秒
      failureThreshold: 3      # 连续3次失败才判定为不健康
      
    readinessProbe:      # 就绪性检查，失败则从Service摘除
      httpGet:
        path: /ready
        port: 8080
      initialDelaySeconds: 5
      periodSeconds: 5
      successThreshold: 1      # 1次成功即就绪
      failureThreshold: 3

# SFU优雅关闭配置
spec:
  terminationGracePeriodSeconds: 60  # SFU需要更长时间迁移连接
  
  containers:
  - name: sfu
    lifecycle:
      preStop:
        exec:
          command:
          - /bin/sh
          - -c
          - |
            # 1. 通知负载均衡器停止新连接
            curl -X POST localhost:8080/drain
            
            # 2. 等待现有连接完成
            sleep 30
            
            # 3. 强制关闭剩余连接
            curl -X POST localhost:8080/close-all

apiVersion: apps/v1
kind: ReplicaSet
metadata:
  name: signaling-rs
spec:
  replicas: 3              # 期望副本数
  selector:
    matchLabels:
      app: signaling       # 选择器，匹配Pod标签
  template:
    metadata:
      labels:
        app: signaling
    spec:
      containers:
      - name: signaling
        image: signaling:v1.0

apiVersion: apps/v1
kind: Deployment
metadata:
  name: signaling
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 25%         # 更新时最多超出25%的Pod
      maxUnavailable: 25%   # 更新时最多不可用25%的Pod
  selector:
    matchLabels:
      app: signaling
  template:
    metadata:
      labels:
        app: signaling
    spec:
      containers:
      - name: signaling
        image: signaling:v1.1  # 更新镜像触发滚动更新

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: sfu
spec:
  serviceName: sfu-headless  # Headless Service名称
  replicas: 3
  podManagementPolicy: OrderedReady  # 有序管理
  
  selector:
    matchLabels:
      app: sfu
      
  template:
    metadata:
      labels:
        app: sfu
    spec:
      containers:
      - name: sfu
        image: sfu-server:v1.0.0
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        # Pod名称：sfu-0, sfu-1, sfu-2
        # DNS名称：sfu-0.sfu-headless.live.svc.cluster.local
        
  volumeClaimTemplates:  # 每个Pod独立的PVC
  - metadata:
      name: sfu-data
    spec:
      accessModes: ["ReadWriteOnce"]
      resources:
        requests:
          storage: 10Gi

# Service定义
apiVersion: v1
kind: Service
metadata:
  name: signaling
spec:
  selector:
    app: signaling  # 选择标签为app=signaling的Pod
  ports:
  - port: 8080

# 自动生成的Endpoints
apiVersion: v1
kind: Endpoints
metadata:
  name: signaling
subsets:
- addresses:
  - ip: 10.244.1.3    # signaling-pod-1
    nodeName: node-1
  - ip: 10.244.2.5    # signaling-pod-2
    nodeName: node-2
  - ip: 10.244.3.7    # signaling-pod-3
    nodeName: node-3
  ports:
  - port: 8080

apiVersion: v1
kind: Service
metadata:
  name: sfu-headless
spec:
  clusterIP: None  # Headless关键配置
  selector:
    app: sfu
  ports:
  - port: 8080

# Headless Service + StatefulSet 的DNS解析
# sfu-0.sfu-headless → 10.244.1.10
# sfu-1.sfu-headless → 10.244.2.15
# sfu-2.sfu-headless → 10.244.3.20

# 应用程序可以通过环境变量获取同组Pod
env:
- name: SFU_PEERS
  value: "sfu-0.sfu-headless,sfu-1.sfu-headless,sfu-2.sfu-headless"

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: fast-ssd
provisioner: kubernetes.io/gce-pd  # GCE持久盘
parameters:
  type: pd-ssd
  replication-type: regional
reclaimPolicy: Retain  # PVC删除后PV保留
allowVolumeExpansion: true  # 支持扩容
volumeBindingMode: WaitForFirstConsumer  # 延迟绑定到Pod所在节点

# SFU录制存储 - 使用高性能SSD
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: sfu-recordings
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: fast-ssd
  resources:
    requests:
      storage: 500Gi
---
# SFU StatefulSet 使用PVC
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: sfu
spec:
  volumeClaimTemplates:
  - metadata:
      name: recordings
    spec:
      accessModes: ["ReadWriteOnce"]
      storageClassName: fast-ssd
      resources:
        requests:
          storage: 100Gi
  - metadata:
      name: logs
    spec:
      accessModes: ["ReadWriteOnce"]
      storageClassName: standard
      resources:
        requests:
          storage: 10Gi

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: sfu
spec:
  template:
    spec:
      # 反亲和性：打散到不同节点
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app
                  operator: In
                  values:
                  - sfu
              topologyKey: kubernetes.io/hostname
      
      # 节点亲和性：优先选择网络性能好的节点
      nodeAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
        - weight: 10
          preference:
            matchExpressions:
            - key: node-type
              operator: In
              values:
              - network-optimized
      
      # 污点容忍：可以调度到专用节点
      tolerations:
      - key: "dedicated"
        operator: "Equal"
        value: "sfu"
        effect: "NoSchedule"

# sfu-statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: sfu
  namespace: live
spec:
  serviceName: sfu-headless
  replicas: 3
  selector:
    matchLabels:
      app: sfu
  template:
    metadata:
      labels:
        app: sfu
    spec:
      containers:
      - name: sfu
        image: your-registry/sfu:v1.0.0
        ports:
        - containerPort: 8080
          name: http
        - containerPort: 3478
          protocol: TCP
          name: turn-tcp
        - containerPort: 3478
          protocol: UDP
          name: turn-udp
        - containerPort: 10000
          protocol: UDP
          name: rtp-start
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: EXTERNAL_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        - name: TURN_REALM
          value: "live.example.com"
        - name: CONFIG_PATH
          value: "/config/sfu.yaml"
        volumeMounts:
        - name: config
          mountPath: /config
        - name: logs
          mountPath: /app/logs
        resources:
          requests:
            memory: "2Gi"
            cpu: "1000m"
          limits:
            memory: "4Gi"
            cpu: "4000m"
        livenessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /ready
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 5
      volumes:
      - name: config
        configMap:
          name: sfu-config
  volumeClaimTemplates:
  - metadata:
      name: logs
    spec:
      accessModes: ["ReadWriteOnce"]
      resources:
        requests:
          storage: 10Gi

# sfu-service.yaml
apiVersion: v1
kind: Service
metadata:
  name: sfu-headless
  namespace: live
spec:
  clusterIP: None  # Headless service
  selector:
    app: sfu
  ports:
  - port: 8080
    name: http
  - port: 3478
    name: turn-tcp
    protocol: TCP
  - port: 3478
    name: turn-udp
    protocol: UDP

# sfu-nodeport.yaml
apiVersion: v1
kind: Service
metadata:
  name: sfu-external
  namespace: live
spec:
  type: NodePort
  selector:
    app: sfu
  ports:
  - port: 3478
    targetPort: 3478
    nodePort: 30478
    protocol: UDP
    name: turn-udp
  - port: 10000
    targetPort: 10000
    nodePort: 31000
    protocol: UDP
    name: rtp
  externalTrafficPolicy: Local  # 保留客户端真实IP

# sfu-hpa.yaml
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: sfu-hpa
  namespace: live
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: StatefulSet
    name: sfu
  minReplicas: 3
  maxReplicas: 20
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80
  - type: Pods
    pods:
      metric:
        name: concurrent_streams
      target:
        type: AverageValue
        averageValue: "100"  # 每Pod平均100路流
  behavior:
    scaleUp:
      stabilizationWindowSeconds: 60
      policies:
      - type: Percent
        value: 100
        periodSeconds: 60
    scaleDown:
      stabilizationWindowSeconds: 300
      policies:
      - type: Percent
        value: 10
        periodSeconds: 60

# 自定义指标（Prometheus Adapter）
apiVersion: v1
kind: ConfigMap
metadata:
  name: custom-metrics-config
  namespace: monitoring
data:
  config.yaml: |
    rules:
    - seriesQuery: 'sfu_concurrent_streams'
      resources:
        template: <<.Resource.Name>>
      name:
        matches: "^(.*)"
        as: "concurrent_streams"
      metricsQuery: sum(<<.Series>>) by (<<.GroupBy>>)

# 集群自动扩缩容配置（Cluster Autoscaler）
apiVersion: autoscaling/v1
kind: ClusterAutoscaler
metadata:
  name: cluster-autoscaler
spec:
  scaleDownEnabled: true
  balanceSimilarNodeGroups: true
  minNodes: 3
  maxNodes: 100
  scaleDownDelayAfterAdd: 10m
  scaleDownDelayAfterDelete: 10s
  scaleDownDelayAfterFailure: 3m
  scaleDownUnneededTime: 10m

# istio-gateway.yaml
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: live-gateway
  namespace: live
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*.live.example.com"
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: live-tls-secret
    hosts:
    - "*.live.example.com"
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: sfu-route
  namespace: live
spec:
  hosts:
  - "sfu.live.example.com"
  gateways:
  - live-gateway
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: sfu-headless
        port:
          number: 8080

# 金丝雀发布
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: sfu-canary
spec:
  hosts:
  - sfu-headless
  http:
  - match:
    - headers:
        canary:
          exact: "true"
    route:
    - destination:
        host: sfu-headless
        subset: v2
      weight: 100
  - route:
    - destination:
        host: sfu-headless
        subset: v1
      weight: 90
    - destination:
        host: sfu-headless
        subset: v2
      weight: 10
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: sfu-versions
spec:
  host: sfu-headless
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2

# 分布式追踪
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  profile: default
  values:
    global:
      proxy:
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
    pilot:
      traceSampling: 100.0
  meshConfig:
    enableTracing: true
    accessLogFile: /dev/stdout
    defaultConfig:
      tracing:
        sampling: 100.0
        zipkin:
          address: zipkin.istio-system:9411

# 使用Kustomize管理多环境
# base/kustomization.yaml
resources:
- sfu-statefulset.yaml
- sfu-service.yaml
- sfu-hpa.yaml

# overlays/production/kustomization.yaml
bases:
- ../../base

namePrefix: prod-
namespace: live-prod

replicas:
- name: sfu
  count: 5

patchesStrategicMerge:
- resources-patch.yaml
- config-patch.yaml

# Pod安全策略
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: live-restricted
spec:
  privileged: false
  allowPrivilegeEscalation: false
  requiredDropCapabilities:
    - ALL
  volumes:
    - 'configMap'
    - 'emptyDir'
    - 'projected'
    - 'secret'
    - 'downwardAPI'
    - 'persistentVolumeClaim'
  runAsUser:
    rule: 'MustRunAsNonRoot'
  seLinux:
    rule: 'RunAsAny'
  fsGroup:
    rule: 'RunAsAny'
---
# NetworkPolicy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: sfu-network-policy
  namespace: live
spec:
  podSelector:
    matchLabels:
      app: sfu
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: signaling
    ports:
    - protocol: TCP
      port: 8080
  - from: []  # 允许外部UDP（ICE）
    ports:
    - protocol: UDP
      port: 3478
    - protocol: UDP
      port: 10000
      endPort: 20000

# Velero备份计划
apiVersion: velero.io/v1
kind: Schedule
metadata:
  name: live-backup
  namespace: velero
spec:
  schedule: "0 2 * * *"  # 每天2点备份
  template:
    includedNamespaces:
    - live
    excludedResources:
    - events
    - pods
    ttl: 720h0m0s  # 保留30天
    storageLocation: default
    volumeSnapshotLocations:
    - aws-default

# PrometheusRule
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: live-alerts
  namespace: monitoring
spec:
  groups:
  - name: live.rules
    rules:
    - alert: SFUHighCPU
      expr: |
        rate(container_cpu_usage_seconds_total{pod=~"sfu-.*"}[5m]) > 0.8
      for: 5m
      labels:
        severity: warning
      annotations:
        summary: "SFU CPU usage high"
        
    - alert: SFUHighLatency
      expr: |
        histogram_quantile(0.99, 
          rate(sfu_packet_delay_seconds_bucket[5m])) > 0.5
      for: 3m
      labels:
        severity: critical
      annotations:
        summary: "SFU latency too high"
        
    - alert: SFUPodDown
      expr: |
        up{job="sfu"} == 0
      for: 1m
      labels:
        severity: critical
      annotations:
        summary: "SFU pod is down"