Operator + Terraform 对传统运维的改变

infra  = Git Repo
变更  = PR
审核  = Review

replicas: 3
version: 8.0
highAvailability: true

dev.tfvars
staging.tfvars
prod.tfvars

kind: MySQLCluster
spec:
  replicas: 3
  version: 8.0

MySQL 可用性 ≥ 99.95%

传统运维
   |
   v
DevOps（流程）
   |
   v
Platform（能力）
   |
   v
SRE（指标与约束）

1. 登录 AWS 控制台，创建 VPC、子网、安全组
2. 开一台 EC2，配置 SSH 密钥
3. SSH 进去，安装 Nginx/Apache + PHP + MySQL
4. 下载 WordPress，解压，配置 wp-config.php
5. 配置 HTTPS 证书（Let's Encrypt 或 ACM）
6. 配置域名解析
7. 测试、调优、祈祷
8. 三个月后：PHP 版本升级？MySQL 挂了？老范呢？

# main.tf - 基础设施即代码
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = var.aws_region
}

# 1. VPC 和网络
module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.0.0"

  name = "wordpress-vpc"
  cidr = "10.0.0.0/16"

  azs             = ["${var.aws_region}a", "${var.aws_region}b"]
  private_subnets = ["10.0.1.0/24", "10.0.2.0/24"]
  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24"]

  enable_nat_gateway = true
  single_nat_gateway = true
}

# 2. EKS 集群（Kubernetes）
module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "19.0.0"

  cluster_name    = "wordpress-cluster"
  cluster_version = "1.28"

  vpc_id     = module.vpc.vpc_id
  subnet_ids = module.vpc.private_subnets

  eks_managed_node_groups = {
    default = {
      min_size     = 2
      max_size     = 10
      desired_size = 3
      instance_types = ["t3.medium"]
    }
  }
}

# 3. RDS MySQL（WordPress 数据库）
module "rds" {
  source  = "terraform-aws-modules/rds/aws"
  version = "6.0.0"

  identifier = "wordpress-db"

  engine            = "mysql"
  engine_version    = "8.0"
  instance_class    = "db.t3.medium"
  allocated_storage = 20

  db_name  = "wordpress"
  username = "admin"
  port     = "3306"

  vpc_security_group_ids = [module.vpc.default_security_group_id]
  subnet_ids             = module.vpc.private_subnets

  # 生产环境必须开
  multi_az               = true
  backup_retention_period = 7
}

# 4. 输出连接信息（给 Operator 用）
output "eks_cluster_endpoint" {
  value = module.eks.cluster_endpoint
}

output "rds_endpoint" {
  value = module.rds.db_instance_endpoint
}

aws_region = "us-west-2"

terraform init      # 初始化
terraform plan      # 看看要建啥
terraform apply     # 开干（约 15-20 分钟）

# 安装 WordPress Operator（使用 Helm）
helm repo add bitpoke https://helm-charts.bitpoke.io
helm install wordpress-operator bitpoke/wordpress-operator

# wordpress-site.yaml
apiVersion: wordpress.presslabs.org/v1alpha1
kind: Wordpress
metadata:
  name: my-blog
  namespace: default
spec:
  # 副本数：3 个 Pod，自动负载均衡
  replicas: 3

  # 域名
  domains:
    - www.example.com

  # TLS 证书（配合 cert-manager 自动签发）
  tlsSecretRef: my-blog-tls

  # 数据库连接（从 Terraform 输出拿）
  dbHost: wordpress-db.xxx.us-west-2.rds.amazonaws.com
  dbUser: admin
  dbPassword:
    secretKeyRef:
      name: wordpress-db-secret
      key: password
  dbName: wordpress

  # 媒体文件存储（S3）
  mediaVolumeSpec:
    s3:
      bucket: my-blog-media
      region: us-west-2

  # 资源限制
  resources:
    requests:
      memory: "256Mi"
      cpu: "100m"
    limits:
      memory: "512Mi"
      cpu: "500m"

  # WordPress 镜像版本
  image: wordpress:6.4-php8.2-apache

kubectl apply -f wordpress-site.yaml

# 流量大了？改一行，自动扩容
spec:
  replicas: 10  # 从 3 改成 10

# 新版本？改一行，滚动升级
spec:
  image: wordpress:6.5-php8.3-apache

# 数据库挂了？Operator 自动重连
# Pod 挂了？Operator 自动拉起
# 证书快过期？cert-manager 自动续期

┌──────────────────────────────────────────────────────────────┐
│                     Git Repository                            │
│  ┌─────────────────┐         ┌─────────────────┐             │
│  │  main.tf        │         │  wordpress.yaml │             │
│  │  variables.tf   │         │  ingress.yaml   │             │
│  │  outputs.tf     │         │  secrets.yaml   │             │
│  └────────┬────────┘         └────────┬────────┘             │
└───────────┼───────────────────────────┼──────────────────────┘
            │                           │
            v                           v
    ┌───────────────┐           ┌───────────────┐
    │   Terraform   │           │   kubectl     │
    │   apply       │           │   apply       │
    └───────┬───────┘           └───────┬───────┘
            │                           │
            v                           v
┌───────────────────────┐   ┌───────────────────────┐
│   AWS Infrastructure  │   │   Kubernetes Cluster  │
│  ┌─────────────────┐  │   │  ┌─────────────────┐  │
│  │ VPC + Subnets   │  │   │  │ WordPress       │  │
│  │ EKS Cluster     │──┼───┼──│ Operator        │  │
│  │ RDS MySQL       │  │   │  │   ↓             │  │
│  │ ALB             │  │   │  │ WordPress Pods  │  │
│  │ Route53         │  │   │  │ (auto-managed)  │  │
│  └─────────────────┘  │   │  └─────────────────┘  │
└───────────────────────┘   └───────────────────────┘

#!/bin/bash
# deploy-wordpress.sh

set -e

echo "Step 1: Deploying infrastructure with Terraform..."
cd terraform/
terraform init
terraform apply -auto-approve

echo "Step 2: Configuring kubectl..."
aws eks update-kubeconfig --name wordpress-cluster --region us-west-2

echo "Step 3: Installing WordPress Operator (if not exists)..."
helm repo add bitpoke https://helm-charts.bitpoke.io
helm upgrade --install wordpress-operator bitpoke/wordpress-operator

echo "Step 4: Deploying WordPress site..."
cd ../kubernetes/
kubectl apply -f secrets.yaml
kubectl apply -f wordpress-site.yaml

echo "Step 5: Waiting for deployment..."
kubectl rollout status deployment/my-blog-wordpress

echo "Done! Your WordPress site is ready."
kubectl get ingress my-blog -o jsonpath='{.status.loadBalancer.ingress[0].hostname}'