分布式配置中心

// Spring Boot 自动刷新
@Configuration
@EnableApolloConfig("application")
public class AppConfig {
    @ApolloConfigChangeListener
    public void onChange(ConfigChangeEvent event) {
        // 自定义刷新逻辑
    }
}

// 方式一：@NacosValue + 自动刷新
@NacosValue(value = "${timeout:1000}", autoRefreshed = true)
private int timeout;

// 方式二：@NacosConfigurationProperties
@NacosConfigurationProperties(dataId = "order-service.yaml", autoRefreshed = true)
@Configuration
public class OrderProperties {
    private int maxItems;
}

# 服务端：Git 后端
spring:
  cloud:
    config:
      server:
        git:
          uri: https://github.com/company/config-repo
          searchPaths: '{application}'

# 客户端
spring:
  config:
    import: "optional:configserver:http://config:8888"
  cloud:
    config:
      name: order-service
      profile: dev

@ConfigurationProperties(prefix = "order")
@RefreshScope  // ← 关键注解，刷新时重建 Bean
public class OrderConfig {
    private int maxRetries;
    private Duration timeout;
}

@EventListener
public void handleRefresh(RefreshScopeRefreshedEvent event) {
    log.info("配置已刷新: {}", event.getName());
    // 刷新本地缓存、重置连接池等
}

// Jasypt 加密示例
jasypt.encryptor.password=${JASYPT_ENCRYPTOR_PASSWORD}

# 加密后的数据库密码
db.password=ENC(encrypted_value)

# .github/workflows/config-lint.yml
name: Config Validation
on:
  push:
    paths:
      - "configs/**/*.yaml"

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # 1. YAML 语法校验
      - name: YAML Syntax Check
        run: |
          for f in configs/**/*.yaml; do
            python3 -c "import yaml; yaml.safe_load(open('$f'))" || exit 1
          done

      # 2. JSON Schema 校验（类型、必填、范围）
      - name: Schema Validation
        run: |
          pip install jsonschema
          python3 scripts/validate_config.py --schema schemas/config-schema.json \
            --config configs/order-service.yaml

      # 3. 错误码重复性检查
      - name: Error Code Uniqueness
        run: python3 scripts/check_duplicate_codes.py errors.yaml

      # 4. 敏感信息泄露扫描
      - name: Secret Detection
        uses: trufflesecurity/trufflehog@main
        with:
          extra_args: --only-verified

# config-schema.json 示例
{
  "type": "object",
  "properties": {
    "timeout": { "type": "integer", "minimum": 1, "maximum": 60000 },
    "max_retries": { "type": "integer", "minimum": 0, "maximum": 10 },
    "db_password": { "type": "string", "pattern": "^ENC\\(.*\\)$" }
  },
  "required": ["timeout", "max_retries"]
}

@Configuration
public class FallbackConfig {
    // 本地缓存文件（随应用打包）
    @Bean
    @Primary
    @ConditionalOnProperty(name = "config.center.enabled", havingValue = "false")
    public PropertySource<?> localFilePropertySource() {
        return new YamlPropertySourceLoader()
            .load("fallback", new ClassPathResource("fallback-config.yaml"))
            .get(0);
    }
}

@Value("${order.timeout:3000}")
private int timeout;

apiVersion: apps/v1
kind: Deployment
metadata:
  name: apollo-configservice
spec:
  replicas: 3
  template:
    spec:
      containers:
      - name: configservice
        image: apolloconfig/apollo-configservice:latest
        env:
        - name: SPRING_DATASOURCE_URL
          value: "jdbc:mysql://mysql-cluster:3306/ApolloConfigDB"