【分布式知识】Redis-Shake 容器云部署完整指南

问道飞鱼2025-12-03 14:19

Redis-Shake 容器云部署完整指南

  • [Redis-Shake 容器云部署完整指南](#Redis-Shake 容器云部署完整指南)
    • 一、架构设计与部署方案
      • [1. 整体架构概览](#1. 整体架构概览)
      • [2. 部署方案对比](#2. 部署方案对比)
    • [二、Kubernetes 资源配置文件](#二、Kubernetes 资源配置文件)
      • [1. 命名空间配置](#1. 命名空间配置)
      • [2. ConfigMap 配置](#2. ConfigMap 配置)
      • [3. Secret 配置（敏感信息）](#3. Secret 配置（敏感信息）)
      • [4. PersistentVolumeClaim 配置](#4. PersistentVolumeClaim 配置)
      • [5. Deployment 配置（单实例）](#5. Deployment 配置（单实例）)
      • [6. 分片并行部署配置](#6. 分片并行部署配置)
      • [7. Service 配置（监控指标）](#7. Service 配置（监控指标）)
      • [8. ServiceMonitor 配置（Prometheus监控）](#8. ServiceMonitor 配置（Prometheus监控）)
    • 三、高级部署配置
      • [1. 水平自动伸缩（HPA）](#1. 水平自动伸缩（HPA）)
      • [2. 网络策略（NetworkPolicy）](#2. 网络策略（NetworkPolicy）)
    • 四、部署脚本与自动化
      • [1. 一键部署脚本](#1. 一键部署脚本)
      • [2. 健康检查脚本](#2. 健康检查脚本)
    • 五、监控与告警配置
      • [1. Prometheus 告警规则](#1. Prometheus 告警规则)
      • [2. Grafana 仪表板配置](#2. Grafana 仪表板配置)
    • 六、数据一致性验证
      • [1. 一致性检查脚本](#1. 一致性检查脚本)
    • 七、故障排查与恢复
      • [1. 故障诊断脚本](#1. 故障诊断脚本)
      • [2. 自动恢复策略](#2. 自动恢复策略)
    • 八、备份与恢复策略
      • [1. 配置备份脚本](#1. 配置备份脚本)
    • 九、安全最佳实践
      • [1. 安全加固配置](#1. 安全加固配置)
      • [2. RBAC权限控制](#2. RBAC权限控制)
    • 十、性能优化建议
      • [1. 资源优化配置](#1. 资源优化配置)
      • [2. 网络性能优化](#2. 网络性能优化)

Redis-Shake 容器云部署完整指南

一、架构设计与部署方案

1. 整体架构概览

Redis-Shake部署单元 Sidecar容器 Redis-Shake Pod 初始化容器 源Redis集群 目标Redis集群 Kubernetes集群 ConfigMap配置 Secret认证 PersistentVolume存储 Service监控 监控指标 Prometheus Grafana

2. 部署方案对比

部署方式 适用场景 优势 限制
单实例部署 小规模数据迁移 简单易用 性能有限
分片并行部署 大规模数据迁移 高吞吐量 配置复杂
多租户部署 SaaS环境 资源隔离 管理复杂

二、Kubernetes 资源配置文件

1. 命名空间配置

yaml 复制代码 
# 01-namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: redis-sync
  labels:
    name: redis-sync
    app: data-migration

2. ConfigMap 配置

yaml 复制代码 
# 02-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: redis-shake-config
  namespace: redis-sync
data:
  # Redis-Shake 主配置文件
  redis-shake.conf: |
    # 通用配置
    log.level = info
    log.file = /data/logs/redis-shake.log
    pid_path = /var/run/
    
    # 源Redis配置
    source.type = cluster
    source.address = ${SOURCE_REDIS_HOST}:${SOURCE_REDIS_PORT}
    source.password_raw = ${SOURCE_REDIS_PASSWORD}
    source.auth_type = auth
    source.tls.enable = false
    
    # 目标Redis配置  
    target.type = cluster
    target.address = ${TARGET_REDIS_HOST}:${TARGET_REDIS_PORT}
    target.password_raw = ${TARGET_REDIS_PASSWORD}
    target.auth_type = auth
    target.tls.enable = false
    
    # 同步模式配置
    sync.type = sync
    sync.parallel = 32
    
    # 高级配置
    key_exists = rewrite
    filter.db.whitelist = 0,1,2
    filter.key.whitelist = "user:*;order:*"
    filter.key.blacklist = "temp:*;cache:*"
    
    # 性能调优
    big_key_threshold = 524288000
    metric = true
    metric.port = 9320
    sender.size = 104857600
    sender.count = 4096
    
    # 持久化配置
    persist.dump.interval = 10
    persist.dump.path = /data/rdb

  # 启动脚本
  start.sh: |
    #!/bin/bash
    set -e
    
    # 创建目录
    mkdir -p /data/logs /data/rdb
    
    # 替换环境变量
    envsubst < /etc/redis-shake/redis-shake.conf > /tmp/redis-shake.conf
    
    # 检查网络连通性
    echo "=== 网络连通性检查 ==="
    nc -zv ${SOURCE_REDIS_HOST} ${SOURCE_REDIS_PORT}
    nc -zv ${TARGET_REDIS_HOST} ${TARGET_REDIS_PORT}
    
    # 启动redis-shake
    echo "=== 启动Redis-Shake ==="
    /opt/redis-shake/redis-shake -type=sync -conf=/tmp/redis-shake.conf
    
    # 健康检查
    while true; do
        if ps aux | grep -v grep | grep -q redis-shake; then
            sleep 30
        else
            echo "Redis-Shake进程异常退出"
            exit 1
        fi
    done

3. Secret 配置（敏感信息）

yaml 复制代码 
# 03-secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: redis-shake-secrets
  namespace: redis-sync
type: Opaque
stringData:
  # 源Redis连接信息
  source-redis-host: "src-redis-cluster.redis.svc.cluster.local"
  source-redis-port: "6379"
  source-redis-password: "source_password_123"
  
  # 目标Redis连接信息
  target-redis-host: "target-redis-cluster.redis.svc.cluster.local"
  target-redis-port: "6379"
  target-redis-password: "target_password_456"

4. PersistentVolumeClaim 配置

yaml 复制代码 
# 04-pvc.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: redis-shake-data
  namespace: redis-sync
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 50Gi
  storageClassName: fast-ssd

5. Deployment 配置（单实例）

yaml 复制代码 
# 05-deployment-single.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis-shake
  namespace: redis-sync
  labels:
    app: redis-shake
    component: data-sync
spec:
  replicas: 1
  selector:
    matchLabels:
      app: redis-shake
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: redis-shake
        version: v2.0.3
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "9320"
        prometheus.io/path: "/metrics"
    spec:
      # 初始化容器 - 准备环境
      initContainers:
      - name: init-check
        image: busybox:1.35
        command: ['sh', '-c', 'echo "初始化检查完成" && sleep 2']
      
      containers:
      - name: redis-shake
        image: alibaba/redis-shake:v2.0.3
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 9320
          name: metrics
        
        env:
        # 源Redis配置
        - name: SOURCE_REDIS_HOST
          valueFrom:
            secretKeyRef:
              name: redis-shake-secrets
              key: source-redis-host
        - name: SOURCE_REDIS_PORT
          valueFrom:
            secretKeyRef:
              name: redis-shake-secrets
              key: source-redis-port
        - name: SOURCE_REDIS_PASSWORD
          valueFrom:
            secretKeyRef:
              name: redis-shake-secrets
              key: source-redis-password
              
        # 目标Redis配置
        - name: TARGET_REDIS_HOST
          valueFrom:
            secretKeyRef:
              name: redis-shake-secrets
              key: target-redis-host
        - name: TARGET_REDIS_PORT
          valueFrom:
            secretKeyRef:
              name: redis-shake-secrets
              key: target-redis-port
        - name: TARGET_REDIS_PASSWORD
          valueFrom:
            secretKeyRef:
              name: redis-shake-secrets
              key: target-redis-password
        
        resources:
          requests:
            memory: "2Gi"
            cpu: "1000m"
          limits:
            memory: "4Gi"
            cpu: "2000m"
        
        volumeMounts:
        - name: config-volume
          mountPath: /etc/redis-shake
        - name: data-volume
          mountPath: /data
        - name: scripts-volume
          mountPath: /scripts
        
        livenessProbe:
          httpGet:
            path: /metrics
            port: 9320
          initialDelaySeconds: 60
          periodSeconds: 30
          timeoutSeconds: 10
        
        readinessProbe:
          exec:
            command:
            - sh
            - -c
            - 'curl -s http://localhost:9320/metrics | grep -q "redis_shake"'
          initialDelaySeconds: 30
          periodSeconds: 15
        
        # 启动命令
        command: ["/bin/bash"]
        args: ["-c", "chmod +x /scripts/start.sh && /scripts/start.sh"]
      
      # Sidecar容器 - 日志收集
      - name: log-collector
        image: fluent/fluentd:v1.15.3
        volumeMounts:
        - name: data-volume
          mountPath: /data/logs
        - name: fluentd-config
          mountPath: /fluentd/etc
        env:
        - name: FLUENTD_CONF
          value: "fluentd.conf"
      
      volumes:
      - name: config-volume
        configMap:
          name: redis-shake-config
          items:
          - key: redis-shake.conf
            path: redis-shake.conf
      - name: scripts-volume
        configMap:
          name: redis-shake-config
          defaultMode: 0755
          items:
          - key: start.sh
            path: start.sh
      - name: data-volume
        persistentVolumeClaim:
          claimName: redis-shake-data
      - name: fluentd-config
        configMap:
          name: redis-shake-config
          items:
          - key: fluentd.conf
            path: fluentd.conf
      
      # 调度约束
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            preference:
              matchExpressions:
              - key: disktype
                operator: In
                values:
                - ssd
      
      # 容忍度设置
      tolerations:
      - key: "dedicated"
        operator: "Equal"
        value: "redis-sync"
        effect: "NoSchedule"

6. 分片并行部署配置

yaml 复制代码 
# 06-deployment-sharded.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis-shake-sharded
  namespace: redis-sync
spec:
  replicas: 4  # 4个分片
  selector:
    matchLabels:
      app: redis-shake-sharded
  template:
    metadata:
      labels:
        app: redis-shake-sharded
    spec:
      containers:
      - name: redis-shake
        image: alibaba/redis-shake:v2.0.3
        env:
        - name: SHARD_ID
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: TOTAL_SHARDS
          value: "4"
        command:
        - sh
        - -c
        - |
          # 根据分片ID计算负责的哈希槽范围
          SHARD_INDEX=$(echo $SHARD_ID | sed 's/.*-//')
          case $SHARD_INDEX in
            0) SLOTS="0-4095" ;;
            1) SLOTS="4096-8191" ;;
            2) SLOTS="8192-12287" ;;
            3) SLOTS="12288-16383" ;;
          esac
          
          echo "分片 $SHARD_INDEX 负责槽位: $SLOTS"
          /opt/redis-shake/redis-shake -type=sync -conf=/etc/redis-shake/redis-shake.conf -filter.slot=$SLOTS
        volumeMounts:
        - name: config-volume
          mountPath: /etc/redis-shake
      volumes:
      - name: config-volume
        configMap:
          name: redis-shake-config

7. Service 配置（监控指标）

yaml 复制代码 
# 07-service.yaml
apiVersion: v1
kind: Service
metadata:
  name: redis-shake-metrics
  namespace: redis-sync
  labels:
    app: redis-shake
    component: metrics
spec:
  ports:
  - port: 9320
    targetPort: 9320
    protocol: TCP
    name: metrics
  selector:
    app: redis-shake
  type: ClusterIP

8. ServiceMonitor 配置（Prometheus监控）

yaml 复制代码 
# 08-servicemonitor.yaml
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: redis-shake-monitor
  namespace: redis-sync
  labels:
    app: redis-shake
    release: prometheus
spec:
  selector:
    matchLabels:
      app: redis-shake
  endpoints:
  - port: metrics
    interval: 30s
    path: /metrics
    relabelings:
    - action: replace
      sourceLabels: [__address__]
      regex: '(.*):.*'
      targetLabel: instance
      replacement: '$1'
  namespaceSelector:
    matchNames:
    - redis-sync

三、高级部署配置

1. 水平自动伸缩（HPA）

yaml 复制代码 
# 09-hpa.yaml
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: redis-shake-hpa
  namespace: redis-sync
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: redis-shake
  minReplicas: 1
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300
      policies:
      - type: Percent
        value: 50
        periodSeconds: 60

2. 网络策略（NetworkPolicy）

yaml 复制代码 
# 10-networkpolicy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: redis-shake-network-policy
  namespace: redis-sync
spec:
  podSelector:
    matchLabels:
      app: redis-shake
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - ports:
    - port: 9320
      protocol: TCP
    from:
    - namespaceSelector:
        matchLabels:
          name: monitoring
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          name: redis
    ports:
    - port: 6379
      protocol: TCP

四、部署脚本与自动化

1. 一键部署脚本

bash 复制代码 
#!/bin/bash
# deploy-redis-shake.sh

set -e

NAMESPACE="redis-sync"
CONFIG_DIR="./k8s-configs"

echo "=== Redis-Shake 容器云部署开始 ==="

# 检查kubectl连接
kubectl cluster-info

# 创建命名空间
echo "创建命名空间..."
kubectl apply -f $CONFIG_DIR/01-namespace.yaml

# 等待命名空间就绪
sleep 2

# 按顺序部署资源
for file in 02-configmap.yaml 03-secret.yaml 04-pvc.yaml 05-deployment-single.yaml 07-service.yaml; do
    echo "部署 $file..."
    kubectl apply -f $CONFIG_DIR/$file
    sleep 1
done

# 可选：部署监控
if [ "$1" == "--with-monitoring" ]; then
    echo "部署监控资源..."
    kubectl apply -f $CONFIG_DIR/08-servicemonitor.yaml
    kubectl apply -f $CONFIG_DIR/09-hpa.yaml
fi

echo "=== 部署完成 ==="

# 检查部署状态
echo "检查Pod状态..."
kubectl -n $NAMESPACE get pods -l app=redis-shake

echo "查看日志..."
kubectl -n $NAMESPACE logs -l app=redis-shake --tail=10 -f

2. 健康检查脚本

bash 复制代码 
#!/bin/bash
# health-check.sh

NAMESPACE="redis-sync"
SERVICE="redis-shake"

echo "=== Redis-Shake 健康检查 ==="

# 检查Pod状态
echo "1. Pod状态检查..."
PODS=$(kubectl -n $NAMESPACE get pods -l app=$SERVICE -o jsonpath='{.items[*].metadata.name}')
for pod in $PODS; do
    STATUS=$(kubectl -n $NAMESPACE get pod $pod -o jsonpath='{.status.phase}')
    READY=$(kubectl -n $NAMESPACE get pod $pod -o jsonpath='{.status.containerStatuses[0].ready}')
    echo "Pod: $pod | Status: $STATUS | Ready: $READY"
done

# 检查服务端点
echo -e "\n2. 服务端点检查..."
kubectl -n $NAMESPACE get endpoints $SERVICE-metrics

# 检查监控指标
echo -e "\n3. 监控指标检查..."
kubectl -n $NAMESPACE port-forward svc/$SERVICE-metrics 9320:9320 &
PORT_FORWARD_PID=$!
sleep 2

curl -s http://localhost:9320/metrics | grep redis_shake | head -5

kill $PORT_FORWARD_PID

# 检查数据同步状态
echo -e "\n4. 同步状态检查..."
kubectl -n $NAMESPACE logs -l app=$SERVICE --tail=20 | grep -E "(sync|进度|进度)"

echo -e "\n=== 健康检查完成 ==="

五、监控与告警配置

1. Prometheus 告警规则

yaml 复制代码 
# redis-shake-alerts.yaml
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: redis-shake-alerts
  namespace: redis-sync
spec:
  groups:
  - name: redis-shake
    rules:
    - alert: RedisShakeDown
      expr: up{job="redis-shake"} == 0
      for: 1m
      labels:
        severity: critical
        component: data-sync
      annotations:
        summary: "Redis-Shake 服务下线"
        description: "Redis-Shake Pod 在 {{ $labels.instance }} 已下线超过1分钟"
        
    - alert: RedisShakeHighLatency
      expr: redis_shake_sync_delay > 1000
      for: 5m
      labels:
        severity: warning
        component: data-sync
      annotations:
        summary: "Redis-Shake 同步延迟过高"
        description: "Redis-Shake 同步延迟持续5分钟超过1000ms，当前值: {{ $value }}ms"
        
    - alert: RedisShakeSyncError
      expr: rate(redis_shake_sync_error_total[5m]) > 0
      for: 2m
      labels:
        severity: critical
        component: data-sync
      annotations:
        summary: "Redis-Shake 同步错误率过高"
        description: "Redis-Shake 同步错误率持续2分钟大于0"
        
    - alert: RedisShakeMemoryUsage
      expr: process_resident_memory_bytes{job="redis-shake"} / 1024 / 1024 > 3072
      for: 5m
      labels:
        severity: warning
        component: data-sync
      annotations:
        summary: "Redis-Shake 内存使用过高"
        description: "Redis-Shake 内存使用超过3GB，当前值: {{ $value }}MB"

2. Grafana 仪表板配置

json 复制代码 
{
  "dashboard": {
    "title": "Redis-Shake 监控仪表板",
    "panels": [
      {
        "title": "同步延迟",
        "type": "graph",
        "targets": [
          {
            "expr": "redis_shake_sync_delay",
            "legendFormat": "延迟(ms)"
          }
        ]
      },
      {
        "title": "同步吞吐量",
        "type": "graph", 
        "targets": [
          {
            "expr": "rate(redis_shake_sync_cmd_total[5m])",
            "legendFormat": "命令/秒"
          }
        ]
      },
      {
        "title": "内存使用",
        "type": "graph",
        "targets": [
          {
            "expr": "process_resident_memory_bytes{job='redis-shake'} / 1024 / 1024",
            "legendFormat": "内存使用(MB)"
          }
        ]
      }
    ]
  }
}

六、数据一致性验证

1. 一致性检查脚本

bash 复制代码 
#!/bin/bash
# consistency-check.sh

SOURCE_HOST="src-redis-cluster.redis.svc.cluster.local"
TARGET_HOST="target-redis-cluster.redis.svc.cluster.local"
SOURCE_PASS=$(kubectl get secret redis-shake-secrets -n redis-sync -o jsonpath='{.data.source-redis-password}' | base64 -d)
TARGET_PASS=$(kubectl get secret redis-shake-secrets -n redis-sync -o jsonpath='{.data.target-redis-password}' | base64 -d)

echo "=== 数据一致性验证 ==="

# 比较键数量
SOURCE_KEYS=$(redis-cli -h $SOURCE_HOST -a $SOURCE_PASS dbsize)
TARGET_KEYS=$(redis-cli -h $TARGET_HOST -a $TARGET_PASS dbsize)

echo "源集群键数: $SOURCE_KEYS"
echo "目标集群键数: $TARGET_KEYS"

if [ "$SOURCE_KEYS" -eq "$TARGET_KEYS" ]; then
    echo "✓ 键数量一致"
else
    echo "✗ 键数量不一致"
    exit 1
fi

# 抽样验证关键数据
SAMPLE_KEYS=("user:1001" "order:20231201" "config:global")

for key in "${SAMPLE_KEYS[@]}"; do
    SOURCE_VAL=$(redis-cli -h $SOURCE_HOST -a $SOURCE_PASS get "$key" 2>/dev/null || echo "NOT_FOUND")
    TARGET_VAL=$(redis-cli -h $TARGET_HOST -a $TARGET_PASS get "$key" 2>/dev/null || echo "NOT_FOUND")
    
    if [ "$SOURCE_VAL" = "$TARGET_VAL" ]; then
        echo "✓ $key 一致性验证通过"
    else
        echo "✗ $key 一致性验证失败"
        echo "  源: $SOURCE_VAL"
        echo "  目标: $TARGET_VAL"
    fi
done

echo "=== 验证完成 ==="

七、故障排查与恢复

1. 故障诊断脚本

bash 复制代码 
#!/bin/bash
# troubleshoot.sh

NAMESPACE="redis-sync"
POD_NAME=$(kubectl -n $NAMESPACE get pods -l app=redis-shake -o jsonpath='{.items[0].metadata.name}')

echo "=== Redis-Shake 故障排查 ==="

# 1. 检查Pod状态
echo "1. Pod状态:"
kubectl -n $NAMESPACE get pod $POD_NAME -o wide

# 2. 检查事件
echo -e "\n2. 最近事件:"
kubectl -n $NAMESPACE get events --field-selector involvedObject.name=$POD_NAME --sort-by=.lastTimestamp | tail -10

# 3. 检查日志
echo -e "\n3. 应用日志:"
kubectl -n $NAMESPACE logs $POD_NAME --tail=50

# 4. 检查网络连通性
echo -e "\n4. 网络连通性:"
kubectl -n $NAMESPACE exec $POD_NAME -c redis-shake -- sh -c "
  echo '测试源Redis连接...'
  redis-cli -h \$SOURCE_REDIS_HOST -p \$SOURCE_REDIS_PORT -a \$SOURCE_REDIS_PASSWORD ping
  
  echo '测试目标Redis连接...'  
  redis-cli -h \$TARGET_REDIS_HOST -p \$TARGET_REDIS_PORT -a \$TARGET_REDIS_PASSWORD ping
"

# 5. 检查资源使用
echo -e "\n5. 资源使用:"
kubectl -n $NAMESPACE top pod $POD_NAME

echo -e "\n=== 排查完成 ==="

2. 自动恢复策略

yaml 复制代码 
# 自动恢复配置
apiVersion: batch/v1
kind: CronJob
metadata:
  name: redis-shake-recovery
  namespace: redis-sync
spec:
  schedule: "*/5 * * * *"  # 每5分钟检查一次
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: recovery
            image: bitnami/kubectl:latest
            command:
            - /bin/bash
            - -c
            - |
              # 检查Redis-Shake状态
              STATUS=$(kubectl get pods -l app=redis-shake -n redis-sync -o jsonpath='{.items[0].status.phase}')
              
              if [ "$STATUS" != "Running" ]; then
                echo "Redis-Shake异常，尝试重启..."
                kubectl delete pod -l app=redis-shake -n redis-sync
              else
                echo "Redis-Shake运行正常"
              fi
          restartPolicy: OnFailure

八、备份与恢复策略

1. 配置备份脚本

bash 复制代码 
#!/bin/bash
# backup-config.sh

# 备份Kubernetes资源配置
TIMESTAMP=$(date +%Y%m%d%H%M%S)
BACKUP_DIR="/backup/redis-shake/$TIMESTAMP"

mkdir -p $BACKUP_DIR

# 备份资源配置
kubectl -n redis-sync get configmap redis-shake-config -o yaml > $BACKUP_DIR/configmap.yaml
kubectl -n redis-sync get secret redis-shake-secrets -o yaml > $BACKUP_DIR/secret.yaml
kubectl -n redis-sync get deployment redis-shake -o yaml > $BACKUP_DIR/deployment.yaml

# 备份数据文件
kubectl -n redis-sync exec deployment/redis-shake -- tar czf /tmp/backup.tar.gz /data/
kubectl -n redis-sync cp redis-shake-pod:/tmp/backup.tar.gz $BACKUP_DIR/data.tar.gz

echo "备份完成: $BACKUP_DIR"

九、安全最佳实践

1. 安全加固配置

yaml 复制代码 
# 安全策略配置
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: redis-shake-psp
spec:
  privileged: false
  allowPrivilegeEscalation: false
  requiredDropCapabilities:
    - ALL
  volumes:
    - 'configMap'
    - 'secret'
    - 'persistentVolumeClaim'
  runAsUser:
    rule: 'MustRunAsNonRoot'
  seLinux:
    rule: 'RunAsAny'
  fsGroup:
    rule: 'RunAsAny'

2. RBAC权限控制

yaml 复制代码 
# RBAC配置
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: redis-sync
  name: redis-shake-role
rules:
- apiGroups: [""]
  resources: ["pods", "services", "endpoints"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["configmaps", "secrets"]
  verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: redis-shake-binding
  namespace: redis-sync
subjects:
- kind: ServiceAccount
  name: redis-shake-sa
  namespace: redis-sync
roleRef:
  kind: Role
  name: redis-shake-role
  apiGroup: rbac.authorization.k8s.io

十、性能优化建议

1. 资源优化配置

yaml 复制代码 
# 高性能配置示例
apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis-shake-optimized
spec:
  template:
    spec:
      containers:
      - name: redis-shake
        resources:
          requests:
            memory: "4Gi"
            cpu: "2000m"
            ephemeral-storage: "10Gi"
          limits:
            memory: "8Gi"
            cpu: "4000m"
            ephemeral-storage: "20Gi"
        # JVM调优（如果使用Java版本）
        env:
        - name: JAVA_OPTS
          value: "-Xmx6g -Xms2g -XX:+UseG1GC -XX:MaxGCPauseMillis=200"

2. 网络性能优化

yaml 复制代码 
# 网络策略优化
apiVersion: v1
kind: Pod
metadata:
  name: redis-shake-network-optimized
  annotations:
    # 启用Pod间直接通信
    networking.gke.io/direct-pod-routing: "true"
    # 启用网络加速
    container.googleapis.com/network-accelerator: "true"
spec:
  containers:
  - name: redis-shake
    # 网络优化参数
    env:
    - name: GOGC
      value: "100"
    - name: GOMAXPROCS
      value: "8"

通过以上完整的容器云部署方案，您可以实现Redis-Shake的高可用、可监控的数据同步服务。根据实际需求调整配置参数，特别是网络、存储和资源限制部分，确保服务在生产环境中稳定运行。

相关推荐
TracyCoder1232 小时前
深入浅出Redission
redis·redission
7***99872 小时前
Redis——Windows安装
数据库·windows·redis
D***77652 小时前
【Redis】在Java中以及Spring环境下操作Redis
java·redis·spring
TracyCoder1232 小时前
Redis与MySQL数据不一致：核心场景与解决方案
数据库·redis·mysql
山水无间道2 小时前
redis的rdb文件迁移
数据库·redis·缓存
陈文锦丫2 小时前
Redis原理篇
数据库·redis·缓存
milanyangbo3 小时前
从硬盘I/O到网络传输：Kafka与RocketMQ读写模型及零拷贝技术深度对比
java·网络·分布式·架构·kafka·rocketmq
GEM的左耳返3 小时前
Java面试实战：从Spring Boot到AI集成的技术深度挑战
spring boot·redis·微服务·kafka·java面试·spring ai·缓存优化
有梦想的攻城狮3 小时前
Rabbitmq在死信队列中的队头阻塞问题
分布式·rabbitmq·死信队列·延迟队列
热门推荐
01GitHub 镜像站点02UV安装并设置国内源03BongoCat - 跨平台键盘猫动画工具04安娜的档案(Anna’s Archive) 镜像网站/国内最新可访问入口（持续更新）05本地部署阿里最新开源的Z-Image06Linux下V2Ray安装配置指南07【超详细教程】手把手教你从微软官网免费下载Windows 10官方原版ISO镜像（2025最新版）08Meta第三代“分割一切”模型——SAM 3本地部署教程：首支持文本提示分割，400万概念、30毫秒响应，检测分割追踪一网打尽09【保姆级教程】免费使用Gemini3的5种方法！免翻墙/国内直连10Labelme从安装到标注：零基础完整指南