全端專案 AWS EKS 雲端架構深度解析

Cluster Name: mycom-taipei-cluster
Region: ap-southeast-1 (Asia Pacific - Hong Kong)
Kubernetes Version: v1.32.9-eks-113cf36
Cluster Endpoint: 151FF270201594366F4072D7F2D31E98.sk1.ap-southeast-1.eks.amazonaws.com
Account ID: AWS_Account_ID

# 節點詳細資訊
NAME: ip-192-168-250-55.ap-southeast-1.compute.internal
INSTANCE TYPE: t4g.medium (ARM64)
CPU: 2 核心
RAM: 4GB
OS: Amazon Linux 2
Kernel: 5.10.244-240.965.amzn2.aarch64
Container Runtime: containerd 1.7.27

kubectl get namespaces

部署位置: Mac mini (本地機房)
Jenkins 版本: LTS
用途: 自動化建置和部署應用程式

# 開發人員建立新版本
git tag -a prod-1.117 -m "Release version 1.117"
git push origin prod-1.117

# Jenkins 自動觸發 Pipeline
# Pipeline 從 tag 擷取版本號 (1.117)
# 建置映像檔: mycom-strapi:1.117
# 部署到 EKS

# ECR 映像檔標籤
AWS_Account_ID.dkr.ecr.ap-southeast-1.amazonaws.com/mycom-strapi:1.117  # 版本標籤
AWS_Account_ID.dkr.ecr.ap-southeast-1.amazonaws.com/mycom-strapi:latest # 最新標籤

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecr:GetAuthorizationToken",
        "ecr:BatchCheckLayerAvailability",
        "ecr:GetDownloadUrlForLayer",
        "ecr:PutImage",
        "ecr:InitiateLayerUpload",
        "ecr:UploadLayerPart",
        "ecr:CompleteLayerUpload"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "eks:DescribeCluster"
      ],
      "Resource": "arn:aws:eks:ap-southeast-1:AWS_Account_ID:cluster/mycom-taipei-cluster"
    }
  ]
}

AWS Credentials:
  - Type: AWS Credentials
  - ID: aws-credentials
  - Access Key ID: (存放在 Jenkins)
  - Secret Access Key: (存放在 Jenkins)

Kubeconfig:
  - Type: Secret file
  - ID: kubeconfig
  - File: ~/.kube/config (EKS 叢集存取設定)

apiVersion: apps/v1
kind: Deployment
metadata:
  name: mycom-strapi-prod
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mycom-strapi-prod
  template:
    metadata:
      labels:
        app: mycom-strapi-prod
    spec:
      containers:
      - name: mycom-strapi-prod
        image: AWS_Account_ID.dkr.ecr.ap-southeast-1.amazonaws.com/mycom-strapi:1.117
        ports:
        - containerPort: 1337
        resources:
          requests:
            cpu: 300m
            memory: 512Mi
          limits:
            cpu: 1500m
            memory: 2Gi
        livenessProbe:
          httpGet:
            path: /_health
            port: 1337
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /_health
            port: 1337
          initialDelaySeconds: 30
          periodSeconds: 10

env:
  # Strapi 核心設定
  - name: APP_KEYS
    valueFrom:
      secretKeyRef:
        name: mycom-strapi-prod-secrets
        key: app-keys

  # 資料庫連線
  - name: DATABASE_CLIENT
    value: "postgres"
  - name: DATABASE_HOST
    value: "postgres-strapi-sg.Resource_ID.ap-southeast-1.rds.amazonaws.com"
  - name: DATABASE_PORT
    value: "5432"
  - name: DATABASE_NAME
    value: "strapi_DB"

  # AWS S3 設定
  - name: AWS_REGION
    value: "ap-southeast-1"
  - name: AWS_BUCKET
    value: "mycom-strapi-prod-s3-taipei"

  # 金流整合
  - name: NEWEBPAY_MERCHANT_ID
    value: "MS123456789"
  - name: NEWEBPAY_API_URL
    value: "https://core.newebpay.com/MPG/mpg_gateway"

  # Firebase 推播通知
  - name: FIREBASE_PROJECT_ID
    value: "ella"
  - name: GOOGLE_APPLICATION_CREDENTIALS
    value: "/etc/gcp/firebase/firebase-adminsdk.json"

volumeMounts:
  - name: firebase-secret
    mountPath: /etc/gcp/firebase
    readOnly: true

volumes:
  - name: firebase-secret
    secret:
      secretName: firebase-mycom-admin-secret

apiVersion: apps/v1
kind: Deployment
metadata:
  name: mycom-web
  namespace: default
  labels:
    app: mycom-web
    env: prod
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mycom-web
      env: prod
  template:
    spec:
      containers:
      - name: mycom-web-prod
        image: AWS_Account_ID.dkr.ecr.ap-southeast-1.amazonaws.com/mycom-web:1.61
        ports:
        - containerPort: 80
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 500m
            memory: 512Mi
        livenessProbe:
          httpGet:
            path: /_health
            port: 80
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /_health
            port: 80
          initialDelaySeconds: 30
          periodSeconds: 10

# Ingress Controller Service
kind: Service
metadata:
  name: ingress-nginx-controller
  namespace: ingress-nginx
spec:
  type: LoadBalancer
  externalTrafficPolicy: Local
  ports:
  - name: http
    port: 80
    targetPort: http
    nodePort: 30869
  - name: https
    port: 443
    targetPort: https
    nodePort: 31328
  selector:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: mycom-strapi-ingress
  namespace: default
  annotations:
    # SSL 強制重定向
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"

    # 大檔案上傳支援 (4GB)
    nginx.ingress.kubernetes.io/proxy-body-size: "4096m"
    nginx.ingress.kubernetes.io/client-max-body-size: "4096m"

    # 長時間請求支援 (1小時)
    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
    nginx.ingress.kubernetes.io/client-body-timeout: "3600"
    nginx.ingress.kubernetes.io/client-header-timeout: "3600"

    # 代理緩衝設定
    nginx.ingress.kubernetes.io/proxy-buffering: "off"
    nginx.ingress.kubernetes.io/proxy-request-buffering: "off"
    nginx.ingress.kubernetes.io/proxy-buffer-size: "64k"
    nginx.ingress.kubernetes.io/proxy-buffers-number: "16"

    # 轉發標頭
    nginx.ingress.kubernetes.io/use-forwarded-headers: "true"
    nginx.ingress.kubernetes.io/rewrite-target: "/"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - cms.example.com
    secretName: cms-tls-secret
  rules:
  - host: cms.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: mycom-strapi-service-prod
            port:
              number: 80

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: mycom-web-ingress
  namespace: default
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - www.example.com
    secretName: www-example-com-cert
  rules:
  - host: www.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: mycom-web-service-prod
            port:
              number: 80

# Cert-Manager 元件
kubectl get pods -n cert-manager

# TWCA 提供的檔案
certificate.crt      # 網域憑證
ca_bundle.crt        # 中繼憑證
private.key          # 私鑰 (由申請單位持有)

# 合併完整憑證鏈
cat certificate.crt ca_bundle.crt > fullchain.crt

# 建立 TLS Secret
kubectl create secret tls cms-tls-secret \
  --cert=fullchain.crt \
  --key=private.key \
  -n default

kubectl create secret tls www-example-com-cert \
  --cert=fullchain.crt \
  --key=private.key \
  -n default

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: mycom-strapi-ingress
  annotations:
    # 移除 cert-manager 自動簽發
    # cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  tls:
  - hosts:
    - cms.example.com
    secretName: cms-tls-secret  # 使用手動建立的 Secret

# 檢查憑證資訊
openssl x509 -in certificate.crt -text -noout

# 測試 HTTPS 連線
curl -vI https://cms.example.com

Host: postgres-strapi-sg.Resource_ID.ap-southeast-1.rds.amazonaws.com
Port: 5432
Database: strapi_DB
Engine: PostgreSQL
Region: ap-southeast-1
SSL: Enabled (SSL_REJECT_UNAUTHORIZED: false)

// config/database.js
module.exports = ({ env }) => ({
  connection: {
    client: 'postgres',
    connection: {
      host: env('DATABASE_HOST'),
      port: env.int('DATABASE_PORT', 5432),
      database: env('DATABASE_NAME'),
      user: env('DATABASE_USERNAME'),
      password: env('DATABASE_PASSWORD'),
      ssl: env.bool('DATABASE_SSL', false) && {
        rejectUnauthorized: env.bool('DATABASE_SSL_REJECT_UNAUTHORIZED', false)
      }
    },
    pool: {
      min: 2,
      max: 10
    }
  }
})

Bucket: mycom-strapi-prod-s3-taipei
Region: ap-southeast-1
Purpose: 媒體檔案儲存 (圖片、影片、文件)

// config/plugins.js
module.exports = ({ env }) => ({
  upload: {
    config: {
      provider: 'aws-s3',
      providerOptions: {
        accessKeyId: env('AWS_ACCESS_KEY_ID'),
        secretAccessKey: env('AWS_ACCESS_SECRET'),
        region: env('AWS_REGION'),
        params: {
          Bucket: env('AWS_BUCKET'),
        },
      },
    },
  },
})

環境變數:
  FIREBASE_PROJECT_ID: ella
  GOOGLE_APPLICATION_CREDENTIALS: /etc/gcp/firebase/firebase-adminsdk.json

Volume Mount:
  Secret: firebase-mycom-admin-secret
  Mount Path: /etc/gcp/firebase
  Read Only: true

環境變數:
  NEWEBPAY_MERCHANT_ID: MS1234567890
  NEWEBPAY_HASH_KEY: (存放在 Secret)
  NEWEBPAY_HASH_IV: (存放在 Secret)
  NEWEBPAY_API_URL: https://core.newebpay.com/MPG/mpg_gateway

環境變數:
  EZPAY_MERCHANT_ID: 123456789
  EZPAY_HASH_KEY: (存放在 Secret)
  EZPAY_HASH_IV: (存放在 Secret)
  EZPAY_API_URL: https://inv.ezpay.com.tw/Api/invoice_issue

環境變數:
  SENDGRID_API_KEY: (存放在 Secret)
  SENDGRID_DEFAULT_FROM: no-reply@example.com
  SENDGRID_DEFAULT_REPLY_TO: info@example.com

  # 備用 SMTP (Gmail)
  SMTP_HOST: smtp.gmail.com
  SMTP_PORT: 465
  SMTP_USERNAME: info@example.com
  SMTP_PASSWORD: (存放在 Secret)

Namespace: amazon-cloudwatch
DaemonSet: fluent-bit (在每個節點上運行)

apiVersion: v1
kind: ConfigMap
metadata:
  name: fluent-bit-config
  namespace: amazon-cloudwatch
data:
  fluent-bit.conf: |
    [SERVICE]
        Flush         5
        Daemon        off
        Log_Level     info

    [INPUT]
        Name              tail
        Path              /var/log/containers/*.log
        Parser            docker
        Tag               kube.*
        Refresh_Interval  5

    [FILTER]
        Name                kubernetes
        Match               kube.*
        Kube_URL            https://kubernetes.default.svc:443
        Merge_Log           On
        K8S-Logging.Parser  On

    [OUTPUT]
        Name                cloudwatch_logs
        Match               *
        region              ap-southeast-1
        log_group_name      /aws/eks/mycom-taipei-cluster/containers
        auto_create_group   true

kubectl get deployment metrics-server -n kube-system

# 檢視節點資源使用情況
kubectl top nodes

NAME                                           CPU(cores)   CPU%   MEMORY(bytes)   MEMORY%
ip-192-168-1-55.ap-southeast-1.compute.internal   51m          2%     1572Mi          47%

# 檢視 Pod 資源使用情況
kubectl top pods -n default

NAME                                  CPU(cores)   MEMORY(bytes)
mycom-strapi-prod-1234567890-lmmm4   1m           281Mi
mycom-web-1234567890-x6fmx           1m           26Mi
psql-client                           0m           15Mi

# 建議的 Strapi 資源配置
resources:
  requests:
    cpu: 50m      # 從 300m 降至 50m
    memory: 256Mi # 從 512Mi 降至 256Mi
  limits:
    cpu: 1000m    # 從 1500m 降至 1000m
    memory: 1Gi   # 從 2Gi 降至 1Gi