Spring Boot: Triển Khai với Docker & Kubernetes

# Stage 1: Build
FROM eclipse-temurin:21-jdk AS builder
WORKDIR /app
 
# Copy build files trước (cache dependencies)
COPY pom.xml mvnw ./
COPY .mvn .mvn
RUN ./mvnw dependency:go-offline -B
 
# Copy source và build
COPY src src
RUN ./mvnw package -DskipTests -B
 
# Stage 2: Runtime
FROM eclipse-temurin:21-jre AS runtime
WORKDIR /app
 
# Tạo non-root user
RUN groupadd -r appuser && useradd -r -g appuser appuser
 
# Copy chỉ JAR
COPY --from=builder /app/target/*.jar app.jar
 
# Set ownership
RUN chown -R appuser:appuser /app
USER appuser
 
# JVM flags cho containers
ENV JAVA_OPTS="-XX:+UseContainerSupport -XX:MaxRAMPercentage=75.0"
 
EXPOSE 8080
ENTRYPOINT ["sh", "-c", "java $JAVA_OPTS -jar app.jar"]

Layer 1: dependencies          (hiếm khi thay đổi — cached)
Layer 2: spring-boot-loader    (hiếm khi thay đổi — cached)
Layer 3: snapshot-dependencies  (đôi khi thay đổi)
Layer 4: application           (thay đổi mỗi build)

<build>
    <plugins>
        <plugin>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-maven-plugin</artifactId>
            <configuration>
                <layers>
                    <enabled>true</enabled>
                </layers>
            </configuration>
        </plugin>
    </plugins>
</build>

# Stage 1: Build
FROM eclipse-temurin:21-jdk AS builder
WORKDIR /app
 
COPY pom.xml mvnw ./
COPY .mvn .mvn
RUN ./mvnw dependency:go-offline -B
 
COPY src src
RUN ./mvnw package -DskipTests -B
 
# Extract layers
RUN java -Djarmode=layertools -jar target/*.jar extract --destination extracted
 
# Stage 2: Runtime
FROM eclipse-temurin:21-jre AS runtime
WORKDIR /app
 
RUN groupadd -r appuser && useradd -r -g appuser appuser
 
# Copy layers theo thứ tự (ít thay đổi nhất trước để tận dụng cache)
COPY --from=builder /app/extracted/dependencies/ ./
COPY --from=builder /app/extracted/spring-boot-loader/ ./
COPY --from=builder /app/extracted/snapshot-dependencies/ ./
COPY --from=builder /app/extracted/application/ ./
 
RUN chown -R appuser:appuser /app
USER appuser
 
ENV JAVA_OPTS="-XX:+UseContainerSupport -XX:MaxRAMPercentage=75.0"
 
EXPOSE 8080
ENTRYPOINT ["sh", "-c", "java $JAVA_OPTS org.springframework.boot.loader.launch.JarLauncher"]

Build đầu tiên:                ~90 giây
Code thay đổi (không layers):  ~90 giây (rebuild mọi thứ)
Code thay đổi (có layers):     ~15 giây (chỉ application layer rebuild)

# docker-compose.yml
version: "3.8"
 
services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
    ports:
      - "8080:8080"
    environment:
      SPRING_PROFILES_ACTIVE: dev
      SPRING_DATASOURCE_URL: jdbc:postgresql://db:5432/taskdb
      SPRING_DATASOURCE_USERNAME: postgres
      SPRING_DATASOURCE_PASSWORD: password
      SPRING_DATA_REDIS_HOST: redis
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_started
    restart: unless-stopped
 
  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: taskdb
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: password
    ports:
      - "5432:5432"
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 5s
      retries: 5
 
  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"
    volumes:
      - redisdata:/data
 
volumes:
  pgdata:
  redisdata:

# Start mọi thứ
docker compose up -d
 
# Xem logs
docker compose logs -f app
 
# Rebuild sau khi đổi code
docker compose up -d --build app
 
# Stop mọi thứ
docker compose down
 
# Stop và xóa volumes (bắt đầu lại)
docker compose down -v

# docker-compose.dev.yml (override)
version: "3.8"
 
services:
  app:
    build:
      context: .
      target: builder        # Dừng ở build stage
    command: ./mvnw spring-boot:run
    volumes:
      - ./src:/app/src        # Mount source cho hot reload
    environment:
      SPRING_PROFILES_ACTIVE: dev
      SPRING_DEVTOOLS_RESTART_ENABLED: "true"

# Development với hot-reload
docker compose -f docker-compose.yml -f docker-compose.dev.yml up

# Build với tag
docker build -t my-app:1.0.0 .
 
# Build với nhiều tags
docker build -t my-app:1.0.0 -t my-app:latest .
 
# Build cho platform cụ thể (ví dụ ARM Apple Silicon → x86 cho production)
docker build --platform linux/amd64 -t my-app:1.0.0 .

# Docker Hub
docker tag my-app:1.0.0 username/my-app:1.0.0
docker push username/my-app:1.0.0
 
# GitHub Container Registry
docker tag my-app:1.0.0 ghcr.io/username/my-app:1.0.0
docker push ghcr.io/username/my-app:1.0.0
 
# AWS ECR
aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 123456789.dkr.ecr.us-east-1.amazonaws.com
docker tag my-app:1.0.0 123456789.dkr.ecr.us-east-1.amazonaws.com/my-app:1.0.0
docker push 123456789.dkr.ecr.us-east-1.amazonaws.com/my-app:1.0.0

./mvnw spring-boot:build-image -Dspring-boot.build-image.imageName=my-app:1.0.0

# k8s/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: spring-app
  labels:
    app: spring-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: spring-app
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1           # Tối đa 1 pod dư trong lúc update
      maxUnavailable: 0     # Tất cả pods cũ vẫn chạy trong lúc update
  template:
    metadata:
      labels:
        app: spring-app
    spec:
      containers:
        - name: spring-app
          image: ghcr.io/username/spring-app:1.0.0
          ports:
            - containerPort: 8080
          envFrom:
            - configMapRef:
                name: spring-app-config
            - secretRef:
                name: spring-app-secrets
          resources:
            requests:
              cpu: "250m"
              memory: "512Mi"
            limits:
              cpu: "1000m"
              memory: "1Gi"
          livenessProbe:
            httpGet:
              path: /actuator/health/liveness
              port: 8080
            initialDelaySeconds: 30
            periodSeconds: 10
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /actuator/health/readiness
              port: 8080
            initialDelaySeconds: 15
            periodSeconds: 5
            failureThreshold: 3
          startupProbe:
            httpGet:
              path: /actuator/health
              port: 8080
            initialDelaySeconds: 10
            periodSeconds: 5
            failureThreshold: 30    # 30 * 5s = 150s max startup time

maxSurge: 1, maxUnavailable: 0

resources:
  requests:
    cpu: "250m"       # Đảm bảo: 0.25 CPU cores
    memory: "512Mi"   # Đảm bảo: 512MB RAM
  limits:
    cpu: "1000m"      # Tối đa: 1 CPU core
    memory: "1Gi"     # Tối đa: 1GB RAM (OOM-killed nếu vượt)

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-actuator</artifactId>
</dependency>

management:
  endpoints:
    web:
      exposure:
        include: health,info,prometheus
  endpoint:
    health:
      show-details: always
      probes:
        enabled: true           # Bật /actuator/health/liveness và /readiness
  health:
    livenessState:
      enabled: true
    readinessState:
      enabled: true
    db:
      enabled: true             # Kiểm tra database connectivity
    redis:
      enabled: true             # Kiểm tra Redis connectivity

@Component
public class ExternalServiceHealthIndicator implements HealthIndicator {
 
    private final ExternalServiceClient client;
 
    public ExternalServiceHealthIndicator(ExternalServiceClient client) {
        this.client = client;
    }
 
    @Override
    public Health health() {
        try {
            client.ping();
            return Health.up()
                .withDetail("service", "external-api")
                .withDetail("status", "reachable")
                .build();
        } catch (Exception e) {
            return Health.down()
                .withDetail("service", "external-api")
                .withDetail("error", e.getMessage())
                .build();
        }
    }
}

# k8s/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: spring-app-config
data:
  SPRING_PROFILES_ACTIVE: "prod"
  SPRING_DATASOURCE_URL: "jdbc:postgresql://postgres-service:5432/taskdb"
  SPRING_DATA_REDIS_HOST: "redis-service"
  SERVER_PORT: "8080"
  MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE: "health,info,prometheus"

# k8s/secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: spring-app-secrets
type: Opaque
data:
  SPRING_DATASOURCE_USERNAME: cG9zdGdyZXM=          # base64 encoded "postgres"
  SPRING_DATASOURCE_PASSWORD: cGFzc3dvcmQ=           # base64 encoded "password"
  JWT_SECRET: bXktc3VwZXItc2VjcmV0LWtleQ==          # base64 encoded

# An toàn hơn đặt base64 trong YAML
kubectl create secret generic spring-app-secrets \
  --from-literal=SPRING_DATASOURCE_USERNAME=postgres \
  --from-literal=SPRING_DATASOURCE_PASSWORD=password \
  --from-literal=JWT_SECRET=my-super-secret-key

# k8s/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: spring-app-service
spec:
  type: ClusterIP
  selector:
    app: spring-app
  ports:
    - port: 80
      targetPort: 8080
      protocol: TCP

# k8s/ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: spring-app-ingress
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - api.example.com
      secretName: api-tls-cert
  rules:
    - host: api.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: spring-app-service
                port:
                  number: 80

# k8s/hpa.yaml
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: spring-app-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: spring-app
  minReplicas: 2
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70      # Scale up khi CPU > 70%
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 80      # Scale up khi memory > 80%
  behavior:
    scaleUp:
      stabilizationWindowSeconds: 60  # Đợi 60s trước khi scale up lần nữa
      policies:
        - type: Pods
          value: 2
          periodSeconds: 60           # Thêm tối đa 2 pods mỗi phút
    scaleDown:
      stabilizationWindowSeconds: 300 # Đợi 5 phút trước khi scale down
      policies:
        - type: Pods
          value: 1
          periodSeconds: 120          # Bớt tối đa 1 pod mỗi 2 phút

# Cài Metrics Server (nếu chưa có)
kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml
 
# Kiểm tra
kubectl top pods

# k8s/postgres.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgres
spec:
  replicas: 1
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      containers:
        - name: postgres
          image: postgres:16-alpine
          ports:
            - containerPort: 5432
          envFrom:
            - secretRef:
                name: postgres-secrets
          volumeMounts:
            - name: pgdata
              mountPath: /var/lib/postgresql/data
          resources:
            requests:
              cpu: "250m"
              memory: "256Mi"
            limits:
              cpu: "500m"
              memory: "512Mi"
      volumes:
        - name: pgdata
          persistentVolumeClaim:
            claimName: postgres-pvc
---
apiVersion: v1
kind: Service
metadata:
  name: postgres-service
spec:
  type: ClusterIP
  selector:
    app: postgres
  ports:
    - port: 5432
      targetPort: 5432
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: postgres-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi
---
apiVersion: v1
kind: Secret
metadata:
  name: postgres-secrets
type: Opaque
data:
  POSTGRES_DB: dGFza2Ri                    # taskdb
  POSTGRES_USER: cG9zdGdyZXM=              # postgres
  POSTGRES_PASSWORD: cGFzc3dvcmQ=           # password

k8s/
├── namespace.yaml
├── configmap.yaml
├── secret.yaml
├── deployment.yaml
├── service.yaml
├── ingress.yaml
├── hpa.yaml
└── postgres.yaml        # Chỉ dev/test

# k8s/namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: spring-app

# Tạo namespace
kubectl apply -f k8s/namespace.yaml
 
# Deploy theo thứ tự
kubectl apply -f k8s/configmap.yaml -n spring-app
kubectl apply -f k8s/secret.yaml -n spring-app
kubectl apply -f k8s/postgres.yaml -n spring-app    # Chỉ dev
kubectl apply -f k8s/deployment.yaml -n spring-app
kubectl apply -f k8s/service.yaml -n spring-app
kubectl apply -f k8s/ingress.yaml -n spring-app
kubectl apply -f k8s/hpa.yaml -n spring-app
 
# Hoặc deploy tất cả cùng lúc
kubectl apply -f k8s/ -n spring-app

# Check pods
kubectl get pods -n spring-app
# NAME                          READY   STATUS    RESTARTS   AGE
# spring-app-6d4f8b7c9d-abc12  1/1     Running   0          30s
# spring-app-6d4f8b7c9d-def34  1/1     Running   0          30s
# spring-app-6d4f8b7c9d-ghi56  1/1     Running   0          30s
# postgres-7f8d9e6c5b-xyz78    1/1     Running   0          45s
 
# Check services
kubectl get svc -n spring-app
 
# Check logs
kubectl logs -f deployment/spring-app -n spring-app
 
# Check health
kubectl exec -it deployment/spring-app -n spring-app -- curl localhost:8080/actuator/health
 
# Check HPA status
kubectl get hpa -n spring-app
# NAME             REFERENCE               TARGETS          MINPODS   MAXPODS   REPLICAS
# spring-app-hpa   Deployment/spring-app   25%/70%, 40%/80%   2         10        3

# Start local cluster
minikube start --cpus=4 --memory=4096
 
# Bật ingress
minikube addons enable ingress
minikube addons enable metrics-server
 
# Build image bên trong Docker của minikube
eval $(minikube docker-env)
docker build -t spring-app:latest .
 
# Deploy (dùng imagePullPolicy: Never cho local images)
kubectl apply -f k8s/ -n spring-app
 
# Truy cập app
minikube service spring-app-service -n spring-app
 
# Dashboard
minikube dashboard

# Tạo cluster
kind create cluster --name spring-dev
 
# Load image vào kind
docker build -t spring-app:latest .
kind load docker-image spring-app:latest --name spring-dev
 
# Deploy
kubectl apply -f k8s/ -n spring-app
 
# Port forward để truy cập
kubectl port-forward svc/spring-app-service 8080:80 -n spring-app