DevOps 标准化

DevOps 标准化是将人员、流程、技术工具统一协调的实践，建立可重复、可度量、可改进的交付能力。本节涵盖 DevOps 成熟度评估、标准化流程、度量指标和组织转型。

DevOps 成熟度模型

成熟度级别

成熟度评估维度

CI/CD 标准化

标准化流程图

Code → Commit → Build → Test → Scan → Package → Staging → Pre-Prod → Production
  │      │       │      │      │       │         │         │          │
  └──Git─┘      │      │      │       │         │         │          │
          Hooks │      │      │       │         │         │          │
           Auto │      │      │       │         │         │          │
               Gate│      │       │         │         │          │
              PR  │      │       │         │         │          │
            Review      │       │         │         │          │
                   Auto  │       │         │         │          │
                  Smoke  │       │         │         │          │
                     Unit│       │         │         │          │
                    Integ│       │         │         │          │
                       Scan│       │         │          │
                    Image│       │         │          │
                   Verify│       │         │          │
                          Helm│         │          │
                         Chart│         │          │
                            Promote│         │          │
                           Manual│          │          │
                           Gate │          │          │
                              Deploy│          │          │
                             Verify│          │          │
                                Monitor◀─────────┘          │

Pipeline 标准模板

# 标准 CI/CD Pipeline
stages:
  - checkout
  - build
  - test
  - security
  - package
  - deploy-staging
  - verify-staging
  - deploy-production
  - verify-production

variables:
  DOCKER_REGISTRY: registry.example.com
  HELM_REPO: charts.example.com
  SonarHost: https://sonar.example.com

workflow:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      variables:
        TARGET_ENV: "dev"
    - if: $CI_COMMIT_BRANCH == "main"
      variables:
        TARGET_ENV: "staging"
    - if: $CI_COMMIT_TAG
      variables:
        TARGET_ENV: "production"

技术栈标准化

语言运行时标准

容器标准

# 标准 Dockerfile 模板
FROM eclipse-temurin:17-jdk-alpine AS builder

WORKDIR /build

# 复制依赖文件先下载，避免每次修改源码都重新下载
COPY pom.xml .
RUN mvn dependency:go-offline -B

# 复制源码并构建
COPY src ./src
RUN mvn package -DskipTests

# 运行镜像
FROM eclipse-temurin:17-jre-alpine

RUN addgroup -g 1001 -S appgroup && \
    adduser -u 1001 -S appuser -G appgroup

WORKDIR /home/appuser

COPY --from=builder /build/target/*.jar app.jar

USER appuser

ENTRYPOINT ["java", "-jar", "app.jar"]

Kubernetes 资源标准

# 标准 Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  labels:
    app.kubernetes.io/name: myapp
    app.kubernetes.io/version: "1.0.0"
    app.kubernetes.io/managed-by: ArgoCD
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: myapp
  template:
    metadata:
      labels:
        app.kubernetes.io/name: myapp
        app.kubernetes.io/version: "1.0.0"
    spec:
      terminationGracePeriodSeconds: 60
      containers:
        - name: myapp
          image: myapp:1.0.0
          ports:
            - name: http
              containerPort: 8080
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi
          livenessProbe:
            httpGet:
              path: /health/live
              port: http
            initialDelaySeconds: 10
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /health/ready
              port: http
            initialDelaySeconds: 5
            periodSeconds: 5
          lifecycle:
            preStop:
              exec:
                command: ["/bin/sh", "-c", "sleep 10"]

环境管理标准

环境定义

配置管理矩阵

度量指标（DORA）

四大关键指标

辅助指标

metrics:
  - name: pipeline-success-rate
    description: Pipeline success rate
    target: "> 90%"
  - name: test-coverage
    description: Code test coverage
    target: "> 80%"
  - name: build-duration
    description: Average build time
    target: "< 15 min"
  - name: deployment-duration
    description: Deployment time
    target: "< 5 min"
  - name: mean-time-to-detect
    description: Average time to detect issue
    target: "< 5 min"

安全标准（DevSecOps）

安全左移

Plan → Code → Build → Test → Deploy → Operate → Monitor
  │      │      │       │       │        │         │
 SAST   SAST   SAST   DAST    IAST    Runtime   │
        Dependency   Container  Runtime   │
           Scan       Scan     Protection │

安全检查清单

• [ ] 代码扫描（SAST）：Semgrep/Checkmarx

• [ ] 依赖扫描（SCA）：Trivy/Snyk/Dependabot

• [ ] 镜像扫描：Trivy/Hadolint

• [ ] 容器基线：CIS Benchmark

• [ ] Secret 检测：Gitleaks/TruffleHog

• [ ] IaC 扫描：Checkov/Tfsec

• [ ] DAST：OWASP ZAP/Nessus

• [ ] 漏洞修复 SLA：Critical < 24h，High < 7d

文档标准

必需文档

README 模板

# MyApp

应用描述

## 快速开始

## 架构

## 开发指南

## 部署

## 配置

## 监控

## License

培训与认证

技能矩阵

认证路径

Junior Dev → Mid Dev → Sr. Dev → Staff → Principal
    │           │          │          │
    └───────────┴──────────┴──────────► DevOps Champion
                                        │
                                  Platform Engineer
                                        │
                                    SRE / FinOps

持续改进

回顾会议（Retrospective）

• 频率：每两周

• 内容：识别改进点，设定 Action Items

• 追踪：Backlog → In Progress → Done

改进 OKR 示例

Objective: 提升交付效能
Key Results:
- 部署频率从周提升到日
- MTTR 从 4h 降低到 1h
- 变更失败率从 15% 降低到 5%
- 构建时间从 20min 降低到 10min

下一步

• Jenkins 自动化构建 — Jenkins 基础与进阶

• ArgoCD GitOps 部署 — GitOps 持续交付

• Pipeline 设计与规范 — 流水线设计模式

• AWS EKS 集群 — 云原生基础设施