Playbook：每个 PR 一个独立环境——X-env header 路由 + 三层清理保障（深度版）

$ tree gitops/clusters/us-qa/applications/service-foo-pr/
service-foo-pr/
└── pr-feat-channel-backend/
    ├── kustomization.yaml
    └── httproute.yaml

# base/service-foo/backend/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: qa
resources:
  - deployment.yaml
  - service.yaml
  - pdb.yaml
commonLabels:
  app.kubernetes.io/part-of: service-foo

# base/service-foo/backend/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: backend
  namespace: qa
  labels:
    app: backend
spec:
  replicas: 2
  selector:
    matchLabels:
      app: backend
  template:
    metadata:
      labels:
        app: backend
        version: stable
    spec:
      serviceAccountName: backend-sa
      containers:
        - name: backend
          image: service-foo/backend:placeholder
          ports:
            - containerPort: 8080
          env:
            - name: PR_ENV_ID
              value: "main"
          resources:
            requests: { cpu: 200m, memory: 512Mi }
            limits:   { cpu: 1000m, memory: 1Gi }
          readinessProbe:
            httpGet: { path: /api/health, port: 8080 }
            initialDelaySeconds: 5

# base/service-foo/backend/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: backend
  namespace: qa
spec:
  selector:
    app: backend
  ports:
    - port: 8080
      targetPort: 8080

# argocd/applicationsets/qa-pr-envs.yaml
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: qa-pr-envs
  namespace: argocd
spec:
  generators:
    - matrix:
        generators:
          - clusters:
              selector:
                matchLabels:
                  env: us-qa
          - git:
              repoURL: ssh://git@git.example.cn/infra/gitops.git
              revision: HEAD
              directories:
                - path: clusters/us-qa/applications/*-pr/*
  template:
    metadata:
      name: '{{path[3]}}-{{path.basename}}'
      labels:
        pr-env: "true"
        pr-created-at: '{{path.basename}}'
    spec:
      project: default
      destination:
        server: '{{server}}'
        namespace: qa
      source:
        repoURL: ssh://git@git.example.cn/infra/gitops.git
        path: '{{path}}'
      syncPolicy:
        automated:
          prune: true
          selfHeal: true
        retry:
          limit: 5
          backoff: { duration: 10s, factor: 2, maxDuration: 5m }

$ kubectl --context argocd-cluster get applicationset qa-pr-envs -n argocd
NAME          AGE
qa-pr-envs    3m

$ kubectl --context argocd-cluster get app -n argocd -l pr-env=true
NAME                                       SYNC STATUS   HEALTH STATUS
service-foo-pr-pr-feat-channel-backend     Synced        Healthy

#!/usr/bin/env python3
# gitops/scripts/deploy.py（核心片段）
"""PR 环境创建/删除：写 overlay → git push → ArgoCD 自动 sync"""
import argparse, subprocess, sys, re, os, time
from pathlib import Path

GITOPS_ROOT = Path(__file__).resolve().parents[1]

PR_ENABLED_SERVICES = {("service-foo", "backend"), ("service-bar", "backend")}

KUSTOMIZATION_TMPL = """\
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - ../../../../../base/{project}/{service}
  - httproute.yaml
namePrefix: "pr-{env_id}-"
labels:
  - includeSelectors: true
    pairs:
      version: "pr-{env_id}"
  - includeSelectors: false
    pairs:
      example.dev/env: qa-pr
      pr-env-id: "{env_id}"
images:
  - name: {project}/{service}
    newTag: "{commit_id}-{timestamp}"
patches:
  - target: {{ kind: Deployment }}
    patch: |-
      - op: replace
        path: /spec/selector/matchLabels/app
        value: "pr-{env_id}-{base_app}"
      - op: replace
        path: /spec/template/metadata/labels/app
        value: "pr-{env_id}-{base_app}"
      - op: add
        path: /spec/template/spec/containers/0/env/-
        value:
          name: PR_ENV_ID
          value: "pr-{env_id}"
  - target: {{ kind: Service }}
    patch: |-
      - op: replace
        path: /spec/selector/app
        value: "pr-{env_id}-{base_app}"
"""

HTTPROUTE_TMPL = """\
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: backend-pr-route
  annotations:
    pr-created-at: "{created_at}"
spec:
  parentRefs:
    - name: qa-gateway
      namespace: gateway-system
  hostnames: ["qa.example.cn"]
  rules:
    - matches:
        - headers:
            - name: X-env
              value: "pr-{env_id}"
          path: {{ type: PathPrefix, value: /api }}
      backendRefs:
        - name: {service}
          port: 8080
"""

def slugify(branch: str) -> str:
    s = re.sub(r"[^a-z0-9-]+", "-", branch.lower()).strip("-")
    return s[:40]

def render_pr(project, service, branch, commit_id):
    if (project, service) not in PR_ENABLED_SERVICES:
        sys.exit(f"FATAL: ({project},{service}) not in PR whitelist")
    env_id = slugify(branch)
    base_app = service
    ts = time.strftime("%Y-%m-%d-%H-%M-%S")
    out = GITOPS_ROOT / f"clusters/us-qa/applications/{project}-pr/{env_id}-{service}"
    out.mkdir(parents=True, exist_ok=True)
    (out / "kustomization.yaml").write_text(KUSTOMIZATION_TMPL.format(
        project=project, service=service, env_id=env_id,
        base_app=base_app, commit_id=commit_id, timestamp=ts))
    (out / "httproute.yaml").write_text(HTTPROUTE_TMPL.format(
        env_id=env_id, service=service, created_at=ts))
    return env_id, out

def git_commit_push(message):
    subprocess.run(["git", "add", "."], cwd=GITOPS_ROOT, check=True)
    subprocess.run(["git", "commit", "-m", message], cwd=GITOPS_ROOT, check=True)
    subprocess.run(["git", "push", "origin", "HEAD"], cwd=GITOPS_ROOT, check=True)

def delete_pr(project, service, branch):
    env_id = slugify(branch)
    out = GITOPS_ROOT / f"clusters/us-qa/applications/{project}-pr/{env_id}-{service}"
    if not out.exists():
        print(f"already deleted: {out}")
        return
    subprocess.run(["git", "rm", "-rf", str(out)], cwd=GITOPS_ROOT, check=True)

def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("--action", required=True, choices=["create-pr", "delete-pr"])
    ap.add_argument("--project", required=True)
    ap.add_argument("--service", required=True)
    ap.add_argument("--branch", required=True)
    ap.add_argument("--commit", default="")
    a = ap.parse_args()
    if a.action == "create-pr":
        env_id, _ = render_pr(a.project, a.service, a.branch, a.commit or "manual")
        git_commit_push(f"PR env: create {a.project}/{a.service} {env_id}")
        print(f"OK env_id=pr-{env_id}")
    else:
        delete_pr(a.project, a.service, a.branch)
        git_commit_push(f"PR env: delete {a.project}/{a.service} {a.branch}")

if __name__ == "__main__":
    main()

$ kustomize build clusters/us-qa/applications/service-foo-pr/pr-feat-channel-backend/ \
    | kubectl apply --dry-run=client -f -
deployment.apps/pr-feat-channel-backend-backend created (dry run)
service/pr-feat-channel-backend-backend     created (dry run)
httproute/pr-feat-channel-backend-backend-pr-route created (dry run)

# .github/workflows/pr-env.yaml
name: PR Environment

on:
  pull_request:
    types: [opened, synchronize, reopened, closed]
    branches: [main]

permissions:
  contents: read
  pull-requests: write

concurrency:
  group: pr-env-${{ github.event.pull_request.number }}
  cancel-in-progress: false

env:
  PROJECT: service-foo
  SERVICE: backend
  AWS_REGION: us-west-2

jobs:
  build-and-deploy:
    if: github.event.action != 'closed'
    runs-on: ubuntu-latest
    outputs:
      env_id: ${{ steps.render.outputs.env_id }}
    steps:
      - uses: actions/checkout@v4
      - name: Configure AWS
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}
      - name: Login ECR
        run: |
          aws ecr get-login-password --region $AWS_REGION \
            | docker login --username AWS --password-stdin <ACCOUNT_ID>.dkr.ecr.$AWS_REGION.amazonaws.com
      - name: Build & push image
        id: img
        run: |
          IMG=<ACCOUNT_ID>.dkr.ecr.$AWS_REGION.amazonaws.com/${PROJECT}/${SERVICE}
          TAG="${GITHUB_SHA::8}-$(date +%Y%m%d-%H%M%S)"
          docker build -t $IMG:$TAG .
          docker push $IMG:$TAG
          echo "tag=$TAG" >> $GITHUB_OUTPUT
      - name: Checkout gitops
        uses: actions/checkout@v4
        with:
          repository: infra/gitops
          ssh-key: ${{ secrets.GITOPS_SSH_KEY }}
          path: gitops
      - name: Render PR overlay
        id: render
        run: |
          cd gitops
          BRANCH="${{ github.event.pull_request.head.ref }}"
          python3 scripts/deploy.py \
            --action create-pr \
            --project $PROJECT --service $SERVICE \
            --branch "$BRANCH" --commit "${GITHUB_SHA::8}"
          ENV_ID=$(echo "$BRANCH" | tr '[:upper:]_/' '[:lower:]--' | head -c 40)
          echo "env_id=$ENV_ID" >> $GITHUB_OUTPUT
      - name: Wait ArgoCD sync
        run: |
          for i in {1..30}; do
            STATUS=$(curl -sk -H "Authorization: Bearer $ARGOCD_TOKEN" \
              "$ARGOCD_URL/api/v1/applications/${PROJECT}-pr-pr-${{ steps.render.outputs.env_id }}-${SERVICE}" \
              | jq -r '.status.sync.status // empty')
            [[ "$STATUS" == "Synced" ]] && exit 0
            sleep 10
          done
          echo "::warning::ArgoCD not synced in 5min (still likely OK due to AppSet reconcile)"
        env:
          ARGOCD_URL: https://argocd.example.cn
          ARGOCD_TOKEN: ${{ secrets.ARGOCD_TOKEN }}
      - name: Comment on PR
        uses: actions/github-script@v7
        with:
          script: |
            const envId = "${{ steps.render.outputs.env_id }}"
            const body = [
              "PR 环境就绪",
              "",
              "- 入口域名：`https://qa.example.cn`",
              "- 请求时附 header：`X-env: pr-" + envId + "`",
              "- ModHeader 一键导入：https://docs.example.cn/pr-env-howto",
              "",
              "PR 关闭后环境会被自动清理。"
            ].join("\n")
            github.rest.issues.createComment({
              issue_number: context.payload.pull_request.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body
            })

  cleanup:
    if: github.event.action == 'closed'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          repository: infra/gitops
          ssh-key: ${{ secrets.GITOPS_SSH_KEY }}
      - name: Delete PR overlay
        run: |
          BRANCH="${{ github.event.pull_request.head.ref }}"
          python3 scripts/deploy.py \
            --action delete-pr \
            --project $PROJECT --service $SERVICE \
            --branch "$BRANCH"

# .workflow/pr-env.flow.yaml （云效 Flow 片段）
sources:
  repo:
    type: aliyun_code
    branchesFilter: ["*"]
    triggerEvents: [push, mergeRequest]

stages:
  build:
    jobs:
      build:
        steps:
          - step: BuildDockerImage
            inputs:
              dockerfilePath: ./Dockerfile
              imageRepoUrl: cr.example.cn/${PROJECT}/${SERVICE}
              imageTag: ${COMMIT::8}-${DATETIME}
  deploy:
    jobs:
      deploy:
        steps:
          - step: RunCommand
            run: |-
              # 云效 step 级 envs: 字段失效，必须在 run 里 export
              export BRANCH="${TRIGGER_PAYLOAD_SOURCE_BRANCH:-$CI_COMMIT_REF_NAME}"
              git clone git@git.example.cn:infra/gitops.git
              cd gitops
              python3 scripts/deploy.py --action create-pr \
                --project service-foo --service backend \
                --branch "$BRANCH" --commit "${COMMIT::8}"

# infra/gateway/qa-gateway.yaml
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: qa-gateway
  namespace: gateway-system
spec:
  gatewayClassName: istio       # 或 envoy
  listeners:
    - name: https
      protocol: HTTPS
      port: 443
      hostname: "qa.example.cn"
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: qa-tls
      allowedRoutes:
        namespaces: { from: All }

# clusters/us-qa/applications/service-foo-pr/pr-feat-channel-backend/httproute.yaml
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: backend-pr-route
spec:
  parentRefs:
    - name: qa-gateway
      namespace: gateway-system
  hostnames: ["qa.example.cn"]
  rules:
    - matches:
        - headers:
            - name: X-env
              value: "pr-feat-channel-backend"
          path: { type: PathPrefix, value: /api }
      backendRefs:
        - name: backend
          port: 8080

# overlays/pr/nginx-canary-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: backend-pr-canary
  annotations:
    nginx.ingress.kubernetes.io/canary: "true"
    nginx.ingress.kubernetes.io/canary-by-header: "X-env"
    nginx.ingress.kubernetes.io/canary-by-header-value: "pr-feat-channel-backend"
spec:
  ingressClassName: nginx
  rules:
    - host: qa.example.cn
      http:
        paths:
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: pr-feat-channel-backend-backend
                port: { number: 8080 }

$ curl -s -H "X-env: pr-feat-channel-backend" https://qa.example.cn/api/health | jq
{ "ok": true, "pr_env_id": "pr-feat-channel-backend" }

$ curl -s https://qa.example.cn/api/health | jq        # 无 header → base
{ "ok": true, "pr_env_id": "main" }

// internal/db/scope.go
package db

import (
  "context"
  "os"
)

var prEnvID = os.Getenv("PR_ENV_ID")  // "main" or "pr-feat-channel-backend"

func ScopedTag(ctx context.Context) string { return prEnvID }

// 写入路径自动注入 env_tag
// INSERT INTO conversations (id, env_tag, ...) VALUES ($1, ScopedTag(ctx), ...)
// 读路径默认过滤 env_tag = ScopedTag(ctx) OR env_tag = 'main'

-- migrations/2026_04_30_env_tag_default.sql
ALTER TABLE conversations ADD COLUMN env_tag VARCHAR(64) DEFAULT 'main' NOT NULL;
CREATE INDEX idx_conversations_env_tag ON conversations(env_tag);

CREATE OR REPLACE FUNCTION fill_env_tag() RETURNS trigger AS $$
BEGIN
  IF NEW.env_tag IS NULL OR NEW.env_tag = '' THEN
    NEW.env_tag := COALESCE(current_setting('app.pr_env_id', true), 'main');
  END IF;
  RETURN NEW;
END $$ LANGUAGE plpgsql;

CREATE TRIGGER trg_fill_env_tag BEFORE INSERT ON conversations
  FOR EACH ROW EXECUTE FUNCTION fill_env_tag();

#!/bin/bash
# scripts/pr-schema-create.sh
# 用法：./pr-schema-create.sh pr-feat-channel-backend
set -euo pipefail
ENV_ID="${1:?env_id required}"
DB_HOST="qa-aurora.example.aws.com"
DB_NAME="appdb"
SCHEMA="pr_${ENV_ID//-/_}"

psql "host=$DB_HOST dbname=$DB_NAME user=$DB_OWNER" <<SQL
  CREATE SCHEMA IF NOT EXISTS $SCHEMA;
  GRANT ALL ON SCHEMA $SCHEMA TO app_user;
  -- 把 base schema 的表结构复制到新 schema
  DO \$\$
  DECLARE r record;
  BEGIN
    FOR r IN SELECT tablename FROM pg_tables WHERE schemaname='public' LOOP
      EXECUTE format('CREATE TABLE %I.%I (LIKE public.%I INCLUDING ALL)',
                     '$SCHEMA', r.tablename, r.tablename);
    END LOOP;
  END \$\$;
SQL

echo "schema $SCHEMA created"

#!/bin/bash
# scripts/pr-rds-snapshot.sh
set -euo pipefail
ENV_ID="${1:?env_id}"
SRC="qa-aurora-cluster"
SNAP="$SRC-snapshot-$(date +%Y%m%d-%H%M%S)"
TGT="qa-aurora-pr-$ENV_ID"

aws rds create-db-cluster-snapshot \
  --db-cluster-identifier "$SRC" \
  --db-cluster-snapshot-identifier "$SNAP"

aws rds wait db-cluster-snapshot-available --db-cluster-snapshot-identifier "$SNAP"

aws rds restore-db-cluster-from-snapshot \
  --db-cluster-identifier "$TGT" \
  --snapshot-identifier "$SNAP" \
  --engine aurora-postgresql \
  --vpc-security-group-ids sg-xxxxxxxxxxxxx \
  --db-subnet-group-name qa-subnets \
  --tags Key=pr-env,Value=$ENV_ID Key=ttl,Value=$(date -u -d "+7 days" +%FT%TZ)

aws rds create-db-instance \
  --db-instance-identifier "$TGT-instance-1" \
  --db-cluster-identifier "$TGT" \
  --db-instance-class db.t4g.medium \
  --engine aurora-postgresql

echo "PR cluster: $TGT.cluster-xxx.rds.amazonaws.com"

# lambda/pr_close_handler.py
import json, hmac, hashlib, os, subprocess, tempfile

GITHUB_SECRET = os.environ["GITHUB_WEBHOOK_SECRET"]
GITOPS_DEPLOY_KEY = os.environ["GITOPS_DEPLOY_KEY"]

def verify_sig(body: bytes, sig: str) -> bool:
    expected = "sha256=" + hmac.new(GITHUB_SECRET.encode(), body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, sig)

def handler(event, _ctx):
    body = event["body"].encode() if isinstance(event["body"], str) else event["body"]
    sig = event["headers"].get("x-hub-signature-256", "")
    if not verify_sig(body, sig):
        return {"statusCode": 401, "body": "bad signature"}
    payload = json.loads(body)
    if payload.get("action") != "closed":
        return {"statusCode": 200, "body": "ignored"}
    branch = payload["pull_request"]["head"]["ref"]
    project = "service-foo"; service = "backend"
    with tempfile.TemporaryDirectory() as td:
        key_path = f"{td}/id_ed25519"
        open(key_path, "w").write(GITOPS_DEPLOY_KEY); os.chmod(key_path, 0o600)
        env = {**os.environ, "GIT_SSH_COMMAND": f"ssh -i {key_path} -o StrictHostKeyChecking=no"}
        subprocess.run(["git", "clone", "ssh://git@git.example.cn/infra/gitops.git", "gitops"],
                       cwd=td, env=env, check=True)
        subprocess.run(["python3", "scripts/deploy.py",
                        "--action", "delete-pr",
                        "--project", project, "--service", service,
                        "--branch", branch], cwd=f"{td}/gitops", env=env, check=True)
    return {"statusCode": 200, "body": "deleted"}

# clusters/us-qa/applications/infra/pr-cleanup/cronjob.yaml
apiVersion: batch/v1
kind: CronJob
metadata:
  name: pr-env-cleanup
  namespace: qa
spec:
  schedule: "0 18 * * *"          # 每天 UTC 18:00 = SGT 02:00
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: pr-cleaner
          restartPolicy: Never
          containers:
            - name: cleaner
              image: ghcr.io/example/pr-cleaner:1.2.0
              env:
                - name: TTL_DAYS
                  value: "14"
                - name: NOTIFY_DAYS
                  value: "7"
              volumeMounts:
                - { name: gitops-key, mountPath: /secrets, readOnly: true }
          volumes:
            - name: gitops-key
              secret: { secretName: gitops-deploy-key, defaultMode: 0400 }
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: pr-cleaner
  namespace: qa
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: { name: pr-cleaner, namespace: qa }
rules:
  - apiGroups: [""]
    resources: ["pods", "services"]
    verbs: ["get","list","delete"]
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["get","list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata: { name: pr-cleaner, namespace: qa }
subjects: [{ kind: ServiceAccount, name: pr-cleaner, namespace: qa }]
roleRef: { kind: Role, name: pr-cleaner, apiGroup: rbac.authorization.k8s.io }

#!/usr/bin/env python3
# pr-env-cleanup-cron.py
import os, glob, subprocess, datetime as dt, re, json, urllib.request

GITOPS = "/workspace/gitops"
TTL = int(os.environ.get("TTL_DAYS", "14"))
NOTIFY = int(os.environ.get("NOTIFY_DAYS", "7"))

def git(*args):
    return subprocess.run(["git", "-C", GITOPS, *args],
                          check=True, capture_output=True, text=True).stdout

def remote_branch_exists(branch):
    try:
        git("ls-remote", "--exit-code", "--heads", "origin", branch)
        return True
    except subprocess.CalledProcessError:
        return False

def last_modified(path):
    out = git("log", "-1", "--format=%ct", "--", path).strip()
    return dt.datetime.fromtimestamp(int(out)) if out else dt.datetime.utcnow()

def main():
    git("fetch", "--all", "--prune")
    for overlay in glob.glob(f"{GITOPS}/clusters/*/applications/*-pr/*/"):
        m = re.search(r"applications/([^/]+)-pr/([^/]+)/$", overlay)
        if not m: continue
        project, env_id_service = m.group(1), m.group(2)
        env_id = env_id_service.rsplit("-", 1)[0]
        branch_guess = env_id.replace("-", "/")
        age = (dt.datetime.utcnow() - last_modified(overlay)).days
        if not remote_branch_exists(branch_guess) and age > 1:
            delete(overlay, "branch_gone"); continue
        if age > TTL:
            delete(overlay, f"ttl_{TTL}d"); continue
        if age > NOTIFY:
            notify(env_id, age)

def delete(overlay, reason):
    print(f"DELETE {overlay} reason={reason}")
    subprocess.run(["git", "-C", GITOPS, "rm", "-rf", overlay], check=True)
    subprocess.run(["git", "-C", GITOPS, "commit", "-m", f"PR cleanup: {reason}"], check=True)
    subprocess.run(["git", "-C", GITOPS, "push"], check=True)

def notify(env_id, age):
    url = os.environ.get("DINGTALK_WEBHOOK")
    if not url: return
    body = {"msgtype": "text", "text": {"content": f"[PR env] {env_id} idle {age}d, will purge at {age}+"}}
    req = urllib.request.Request(url, data=json.dumps(body).encode(),
                                  headers={"Content-Type": "application/json"})
    urllib.request.urlopen(req, timeout=5)

if __name__ == "__main__":
    main()

# Prometheus alert
groups:
  - name: pr-env-capacity
    rules:
      - alert: PrEnvHighWatermark
        expr: count(kube_pod_info{namespace="qa", pod=~"pr-.*"}) > 30
        for: 10m
        labels: { severity: warning, runbook: pr-cleanup }
        annotations:
          summary: "qa namespace 下 PR Pod 数 {{ $value }} > 30，触发 LRU 清理"

#!/bin/bash
# pr-lru-purge.sh - 按 lastSyncedAt 升序清理最久未更新的 N 个 PR
set -euo pipefail
KEEP="${KEEP:-20}"
KUBECONFIG_ARG=("--context" "argocd-cluster")

mapfile -t apps < <(
  kubectl "${KUBECONFIG_ARG[@]}" get app -n argocd -l pr-env=true \
    -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.operationState.finishedAt}{"\n"}{end}' \
    | sort -k2
)
total=${#apps[@]}
to_purge=$(( total - KEEP ))
[[ $to_purge -le 0 ]] && { echo "ok ($total <= $KEEP)"; exit 0; }

for ((i=0; i<to_purge; i++)); do
  name=$(cut -f1 <<< "${apps[i]}")
  echo "purging $name"
  branch=$(kubectl "${KUBECONFIG_ARG[@]}" get app "$name" -n argocd -o jsonpath='{.metadata.labels.pr-created-at}')
  python3 /workspace/gitops/scripts/deploy.py \
    --action delete-pr --project service-foo --service backend --branch "$branch"
done

- target: { kind: PersistentVolumeClaim }
  patch: |-
    - op: add
      path: /metadata/finalizers
      value: [ "pr-env.example.cn/cleanup" ]

#!/usr/bin/env python3
# bots/pr_ready_notify.py
import os, json, time, urllib.request, urllib.error

ENV_ID = os.environ["ENV_ID"]
APP_NAME = os.environ["APP_NAME"]
ARGOCD_URL = os.environ["ARGOCD_URL"]
ARGOCD_TOKEN = os.environ["ARGOCD_TOKEN"]
DING_WEBHOOK = os.environ["DING_WEBHOOK"]

def get_app_health():
    req = urllib.request.Request(
        f"{ARGOCD_URL}/api/v1/applications/{APP_NAME}",
        headers={"Authorization": f"Bearer {ARGOCD_TOKEN}"}
    )
    try:
        with urllib.request.urlopen(req, timeout=10) as r:
            data = json.load(r)
        return (data["status"]["sync"]["status"], data["status"]["health"]["status"])
    except urllib.error.HTTPError as e:
        return ("HTTPError", str(e.code))

def wait_ready(timeout=600):
    deadline = time.time() + timeout
    while time.time() < deadline:
        sync, health = get_app_health()
        if sync == "Synced" and health == "Healthy":
            return True
        time.sleep(15)
    return False

def push(text):
    body = {"msgtype": "markdown",
            "markdown": {"title": "PR env ready", "text": text}}
    req = urllib.request.Request(DING_WEBHOOK, data=json.dumps(body).encode(),
                                 headers={"Content-Type": "application/json"})
    urllib.request.urlopen(req, timeout=5)

if __name__ == "__main__":
    if wait_ready():
        push(f"### PR 环境就绪\n\n"
             f"- 入口：`https://qa.example.cn`\n"
             f"- ModHeader 设置 `X-env: pr-{ENV_ID}`\n"
             f"- ArgoCD：`{APP_NAME}`")
    else:
        push(f"### PR 环境超时未就绪\n\n请检查 `{APP_NAME}` 的 events")

$ kubectl get endpoints backend -n qa -o jsonpath='{.subsets[*].addresses[*].ip}'
10.x.y.10 10.x.y.11
$ kubectl get pod -n qa -l app=backend --no-headers | wc -l
2     # 没有 PR Pod 被选中

patches:
  - target: { kind: Deployment }     # 不写 name
    patch: |- ...

nameSuffix: "-${ENV_ID}"
patches:
  - target:
      kind: Deployment
      labelSelector: "app.kubernetes.io/component=api"
    patch: |- ...

# 1. 创建自定义 cache policy
aws cloudfront create-cache-policy --cache-policy-config '{
  "Name": "pr-isolation-cache",
  "DefaultTTL": 0, "MinTTL": 0, "MaxTTL": 1,
  "ParametersInCacheKeyAndForwardedToOrigin": {
    "EnableAcceptEncodingGzip": true,
    "HeadersConfig": {
      "HeaderBehavior": "whitelist",
      "Headers": { "Quantity": 1, "Items": ["X-env"] }
    },
    "QueryStringsConfig": { "QueryStringBehavior": "all" },
    "CookiesConfig": { "CookieBehavior": "none" }
  }
}'

# 2. 把 cache policy 绑到 distribution 的 default behavior（替换 ETag/ID）
DIST_ID="EXXXXXXXXXXXXX"
aws cloudfront get-distribution-config --id $DIST_ID > /tmp/dc.json
ETAG=$(jq -r .ETag /tmp/dc.json)
jq '.DistributionConfig.DefaultCacheBehavior.CachePolicyId = "<NEW_POLICY_ID>"' \
  /tmp/dc.json > /tmp/dc-new.json
aws cloudfront update-distribution --id $DIST_ID --if-match $ETAG \
  --distribution-config file:///tmp/dc-new.json

$ curl -sI -H "X-env: pr-feat-channel" https://qa.example.cn/api/health | grep -i x-cache
x-cache: Miss from cloudfront     # 不同 X-env 缓存键独立

// 消费者代码侧改造
groupID := "service-foo-consumer"
if pr := os.Getenv("PR_ENV_ID"); pr != "" && pr != "main" {
    groupID = fmt.Sprintf("%s-%s", groupID, pr)  // 隔离 consumer group
}

# K8s 侧: PR Pod 的 RabbitMQ topic 也要按 PR 隔离（用 dispatch_env 字段过滤）
env:
  - name: DISPATCH_ENV_FILTER
    value: "$(PR_ENV_ID)"

TAG="${GITHUB_SHA::8}-$(date -u +%Y%m%d-%H%M%S)"
docker build -t $IMG:$TAG .

- target: { kind: PersistentVolumeClaim }
  patch: |-
    - op: add
      path: /metadata/ownerReferences
      value:
        - apiVersion: apps/v1
          kind: Deployment
          name: pr-{env_id}-backend
          uid: ""        # ArgoCD apply 时会被填充
          controller: true
          blockOwnerDeletion: true