03.企业项目部署

# 01.dockerfile

# 1.1 innerservice.Dockerfile

FROM registry-vpc.cn-beijing.aliyuncs.com/laiye-devops/document-mining-backend:builder as builder
ARG PRIVATE

COPY go.mod go.sum ./

RUN go mod download

COPY . .

RUN go env -w CGO_CFLAGS="-g -O3 $(pkg-config --cflags opencv4)" \
    && go env -w CGO_LDFLAGS="-g -O3 $(pkg-config --libs --static opencv4)" \ 
    && if [ "x$PRIVATE" = "x" ]; then go build -o documentRpc cmd/rpc/main.go; else go build -tags private -o documentRpc cmd/rpc_pvt/main.go; fi

FROM registry-vpc.cn-beijing.aliyuncs.com/laiye-devops/document-mining-backend:runtime

COPY --chown=works:works --from=builder /documentRpc /home/works/program/
ADD docker/rpc.supervisord.conf /etc/supervisord.conf
# 拷贝字体文件
COPY --chown=works:works small_data/SourceHanSerifCN-Light.ttf /home/works/program/small_data/SourceHanSerifCN-Light.ttf
# 拷贝模版文件
COPY --chown=works:works template_file/*.xlsx /home/works/program/template_file/
# 拷贝语言文件
COPY --chown=works:works libs/i18n/*.json /home/works/program/i18n/
RUN chown works.works -R /home/works
EXPOSE 19080
EXPOSE 9080

ENV TRACING_FORCE_SAMPLE_OPS="/docUnderstanding.OcrService/TestOcrGeneral=1.0,/docUnderstanding.OcrService/TestOcrTable=1.0,/docUnderstanding.OcrService/TestOcrBills=1.0,/docUnderstanding.OcrService/TestOcrLicense=1.0,/docUnderstanding.OcrService/OcrGeneralNew=1.0,/docUnderstanding.OcrService/OcrTableNew=1.0,/docUnderstanding.OcrService/OcrBillsNew=1.0,/docUnderstanding.OcrService/OcrLicenseNew=1.0,/docUnderstanding.OcrService/OcrTemplateRecognize=1.0,/docUnderstanding.OcrService/TestOcrTemplateRecognize=1.0,/docUnderstanding.OcrService/OcrStamp=1.0,/docUnderstanding.OcrService/TestOcrStamp=1.0"

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

# 02.部署服务

# 2.1 rpc服务

document-mining-rpc.yaml

apiVersion: ops.laiye.com/v1beta1
kind: Process
metadata:
  name: document-mining-rpc
spec:
  conf_dir_container: /home/works/program/conf
  dockerfile: ./docker/rpc.Dockerfile
  image: document-mining-rpc
  kube:
    affinity: {}
    external_data: {}
    grpc_web: true
    health_check: grpc
    hpa: {}
    image: {}
    istio_timeout: 30s
    lmClientServiceID: "100002"
    probe: {}
    resource_mem_level: 1
    resources:
      limits:
        cpu: 2500m
        memory: 3Gi
      requests:
        cpu: 10m
        memory: 300Mi
    resources_test: {}
    sidecar_inject: "true"
  log_dir_container: /home/works/program/logs
  name: document-mining-rpc
  privateDeploy: "true"
  privateBuildImage: "true"
  projectRef:
    name: document-mining-backend
  routes:
  - domain: '*'
    domains: {}
    match:
    - uri:
        regex: /docUnderstanding.(ContractCompareService|ExtractorService|ClassifierService|OcrService|UserService|StatisticService|AppService|AIService|NlpService|AdminService|IDPService|SelfTrainService)/.*
    protocol: grpc
  - domains:
      newtest:
      - xxx.example.com
    match:
    - uri:
        regex: /docUnderstanding.(ContractCompareService|ExtractorService|ClassifierService|OcrService|UserService|StatisticService|AppService|AIService|NlpService|IDPService|DocClassification|SelfTrainService)/.*
    name: documentming
    protocol: grpc-web
  - domains:
      newtest:
      - xxx.example2.com
    match:
    - uri:
        prefix: /docUnderstanding.AdminService/
    name: mage-admin
    protocol: grpc-web

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

# 2.2 api服务

document-mining-openapi.yaml

apiVersion: ops.laiye.com/v1beta1
kind: Process
metadata:
  name: document-mining-rpc
spec:
  conf_dir_container: /home/works/program/conf
  dockerfile: ./docker/rpc.Dockerfile
  image: document-mining-rpc
  kube:
    affinity: {}
    external_data: {}
    grpc_web: true
    health_check: grpc
    hpa: {}
    image: {}
    istio_timeout: 30s
    lmClientServiceID: "100002"
    probe: {}
    resource_mem_level: 1
    resources:
      limits:
        cpu: 2500m
        memory: 3Gi
      requests:
        cpu: 10m
        memory: 300Mi
    resources_test: {}
    sidecar_inject: "true"
  log_dir_container: /home/works/program/logs
  name: document-mining-rpc
  privateDeploy: "true"
  privateBuildImage: "true"
  projectRef:
    name: document-mining-backend
  routes:
  - domain: '*'
    domains: {}
    match:
    - uri:
        regex: /docUnderstanding.(ContractCompareService|ExtractorService|ClassifierService|OcrService|UserService|StatisticService|AppService|AIService|NlpService|AdminService|IDPService|SelfTrainService)/.*
    protocol: grpc
  - domains:
      newtest:
      - xxx.example.com
    match:
    - uri:
        regex: /docUnderstanding.(ContractCompareService|ExtractorService|ClassifierService|OcrService|UserService|StatisticService|AppService|AIService|NlpService|IDPService|DocClassification|SelfTrainService)/.*
    name: documentming
    protocol: grpc-web
  - domains:
      newtest:
      - xxx.example2.com
    match:
    - uri:
        prefix: /docUnderstanding.AdminService/
    name: mage-admin
    protocol: grpc-web

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

# 03.istio服务

# 3.0 isto流量转发

注：网关配置应用于在网格边缘运行的独立 Envoy 代理，而不是与服务工作负载一起运行的 Sidecar Envoy 代理
所以我们配置的 gateway资源指的是下图中的 ② istio-ingressgateway

# 3.1 nginx.conf

nginx可以配置多个，前面可以使用slb等做高可用

server {
    listen 80;
    server_name www.example.com;

    # 请求url前缀为 /docUnderstanding 的，交给nginx反向代理 k8s
    location /docUnderstanding {
        proxy_pass http://k8s;
    }
}

upstream k8s {
    # 192.168.56.14和192.168.56.15是k8s集群中node节点地址
    # 32434是istio-ingressgateway监听集群节点端口的请求
    server 192.168.56.14:32434;
    server 192.168.56.15:32434;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

# 3.2 newtestdocumentming.gateway.yaml

Ingress Gateway (opens new window) 描述运行在网格边界的负载均衡器，负责接收传入的 HTTP/TCP 连接。
其中配置了对外暴露的端口、协议等。
但是，与Kubernetes Ingress 资源 (opens new window)不同，Ingress Gateway 不包含任何流量路由配置。
Ingress 流量的路由使用 Istio 路由规则来配置，和内部服务请求完全一样。

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: documentming-gateway  # 网关资源名称
  namespace: proxy
spec:
  selector:
    istio: ingressgateway
  servers:
  - hosts:
    - www.example.com
    port:
      name: http
      number: 80
      protocol: HTTP

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

# 3.3 newtestdocumentming.virtualservice.yaml

为通过 Gateway 的入口流量配置路由

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: documentming
  namespace: proxy
spec:
  gateways:
  - documentming-gateway
  hosts:
  - www.example2.com
  http:
  - match:
    - uri:
        prefix: /auth
    route:
    - destination:
        host: document-mining-auth.mage.svc.cluster.local
        port:
          number: 9080
  - match:
    - uri:
        prefix: /v1
    - uri:
        prefix: /idp/v1
    route:
    - destination:
        host: document-mining-openapi.mage.svc.cluster.local
        port:
          number: 9080
  - corsPolicy:
      allowCredentials: true
      allowHeaders:
      - grpc-timeout
      - content-type
      - keep-alive
      - user-agent
      - cache-control
      - content-type
      - content-transfer-encoding
      - custom-header-1
      - x-accept-content-transfer-encoding
      - x-accept-response-streaming
      - x-user-agent
      - x-grpc-web
      - Api-auth-user-key
      - Api-auth-app-key
      - Api-auth-timestamp
      - Api-auth-nounce
      - Api-auth-sign
      - user-key
      - user-token
      allowMethods:
      - POST
      - GET
      - OPTIONS
      - PUT
      - DELETE
      allowOrigin:
      - newtestdocumentmining.wul.ai
      - preai.uibot.com.cn
      - testarmmage.wul.ai
      - test-mage.laiye.com
      exposeHeaders:
      - custom-header-1
      - grpc-status
      - grpc-message
      maxAge: 1728s
    match:
    - uri:
        regex: /docUnderstanding.(ContractCompareService|ExtractorService|ClassifierService|OcrService|UserService|StatisticService|AppService|AIService|NlpService|IDPService|DocClassification|SelfTrainService)/.*
    route:
    - destination:
        host: document-mining-rpc.mage.svc.cluster.local
        port:
          number: 19080
  - match:
    - uri:
        prefix: /docs
    route:
    - destination:
        host: mage-docs.mage.svc.cluster.local
        port:
          number: 9080
  - match:
    - uri:
        prefix: /help
    route:
    - destination:
        host: mage-help-document.mage.svc.cluster.local
        port:
          number: 9080
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: file-analyze.mage.svc.cluster.local
        port:
          number: 9080

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99

上次更新: 2024/3/13 15:35:10

← 02.istio部署微服务 01.微服务演变→