如何基于CRaC构建适用于Kubernetes的Spring Boot容器自动化流水线

核心结论 #

完全可以将Spring官方CRaC方案整合到K8s自动化流水线中，核心解决Paketo Buildpacks缺少CRaC JDK支持的问题，同时实现checkpoint的自动化创建、存储与部署。

一、解决Paketo Buildpacks的CRaC JDK缺失问题 #

无需等待官方集成，可通过自定义Paketo Buildpack替换默认JDK为支持CRaC的Liberica或Azul Zulu JDK：

1. 自定义JDK Buildpack结构
   创建简单的buildpack覆盖Paketo默认Java buildpack：

   crac-jdk-buildpack/
   ├── buildpack.toml
   ├── bin/
   │   ├── detect
   │   └── build
   

2. buildpack.toml配置

   [buildpack]
   id = "com.example.crac-jdk"
   version = "0.1.0"
   name = "CRaC Enabled JDK"
   
   [[stacks]]
   id = "io.buildpacks.stacks.bionic"
   

3. build脚本核心逻辑
   在bin/build中下载并安装Liberica CRaC JDK（以17为例）：

   #!/usr/bin/env bash
   set -euo pipefail
   
   # 下载Liberica CRaC JDK
   curl -LO https://download.bell-sw.com/java/17.0.9+9/bellsoft-jdk17.0.9+9-linux-amd64-crac.tar.gz
   tar -xzf bellsoft-jdk17.0.9+9-linux-amd64-crac.tar.gz
   mv bellsoft-jdk17.0.9+9-linux-amd64 "$LAYERS_DIR/jdk"
   
   # 设置JAVA_HOME环境变量
   echo 'JAVA_HOME="$LAYERS_DIR/jdk"' > "$LAYERS_DIR/jdk/env"
   echo 'PATH="$JAVA_HOME/bin:$PATH"' >> "$LAYERS_DIR/jdk/env"
   

4. 构建镜像时指定自定义Buildpack
   在Tekton构建Task中执行：

   pack build <your-image-repo>/spring-boot-crac:latest \
     --path . \
     --buildpack ./crac-jdk-buildpack \
     --buildpack paketo-buildpacks/spring-boot \
     --builder paketobuildpacks/builder:base
   

二、Tekton全自动化流水线设计 #

流水线包含4个核心Task，实现从代码拉取到带CRaC checkpoint的镜像部署：

1. 代码拉取Task #

apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: git-clone-task
spec:
  workspaces:
    - name: source
  steps:
    - name: clone
      image: alpine/git
      script: |
        git clone <your-git-repo> $(workspaces.source.path)
        cd $(workspaces.source.path)
        git checkout <your-branch>

2. 基础镜像构建Task #

基于自定义CRaC JDK Buildpack构建应用基础镜像：

apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: build-base-image
spec:
  workspaces:
    - name: source
  params:
    - name: image-repo
      type: string
  steps:
    - name: pack-build
      image: buildpacksio/pack:latest
      script: |
        cd $(workspaces.source.path)
        pack build $(params.image-repo)/spring-boot-crac-base:latest \
          --path . \
          --buildpack ./crac-jdk-buildpack \
          --buildpack paketo-buildpacks/spring-boot \
          --builder paketobuildpacks/builder:base
        docker push $(params.image-repo)/spring-boot-crac-base:latest

3. Checkpoint创建与存储Task #

核心步骤：临时启动基础镜像、触发checkpoint、整合到最终镜像：

apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: create-crac-checkpoint
spec:
  workspaces:
    - name: source
  params:
    - name: image-repo
      type: string
  steps:
    - name: create-temp-pod
      image: bitnami/kubectl:latest
      script: |
        # 创建临时PVC存储checkpoint文件
        kubectl apply -f - <<EOF
        apiVersion: v1
        kind: PersistentVolumeClaim
        metadata:
          name: crac-checkpoint-pvc
        spec:
          accessModes:
            - ReadWriteOnce
          resources:
            requests:
              storage: 1Gi
        EOF

        # 启动带CRaC的Spring Boot Pod
        kubectl apply -f - <<EOF
        apiVersion: v1
        kind: Pod
        metadata:
          name: crac-checkpoint-pod
        spec:
          containers:
          - name: app
            image: $(params.image-repo)/spring-boot-crac-base:latest
            env:
            - name: SPRING_CLOUD_BOOTSTRAP_ENABLED
              value: "false"
            volumeMounts:
            - name: checkpoint-volume
              mountPath: /var/crac
          volumes:
          - name: checkpoint-volume
            persistentVolumeClaim:
              claimName: crac-checkpoint-pvc
        EOF

        # 等待应用就绪（依赖Spring Actuator）
        until kubectl exec crac-checkpoint-pod -- curl -s http://localhost:8080/actuator/health | grep "UP"; do
          sleep 2
        done

        # 触发CRaC checkpoint
        PID=$(kubectl exec crac-checkpoint-pod -- jps | grep jar | awk '{print $1}')
        kubectl exec crac-checkpoint-pod -- jcmd $PID JDK.checkpoint

        # 复制checkpoint文件到工作区
        kubectl cp crac-checkpoint-pod:/var/crac $(workspaces.source.path)/crac-checkpoint

        # 清理临时资源
        kubectl delete pod crac-checkpoint-pod
        kubectl delete pvc crac-checkpoint-pvc

    - name: build-final-image
      image: docker:latest
      script: |
        cd $(workspaces.source.path)
        # 创建Dockerfile整合checkpoint
        cat > Dockerfile <<EOF
        FROM $(params.image-repo)/spring-boot-crac-base:latest
        COPY crac-checkpoint /var/crac
        CMD ["java", "-XX:CRaCRestoreFrom=/var/crac", "-jar", "/workspace/application.jar"]
        EOF
        docker build -t $(params.image-repo)/spring-boot-crac:latest .
        docker push $(params.image-repo)/spring-boot-crac:latest

4. Kubernetes部署Task #

apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: deploy-to-k8s
spec:
  params:
    - name: image-repo
      type: string
  steps:
    - name: deploy
      image: bitnami/kubectl:latest
      script: |
        kubectl apply -f - <<EOF
        apiVersion: apps/v1
        kind: Deployment
        metadata:
          name: spring-boot-crac-app
        spec:
          replicas: 3
          selector:
            matchLabels:
              app: spring-boot-crac-app
          template:
            metadata:
              labels:
                app: spring-boot-crac-app
            spec:
              containers:
              - name: app
                image: $(params.image-repo)/spring-boot-crac:latest
                ports:
                - containerPort: 8080
        EOF

三、K8s节点前置配置 #

CRaC依赖CRIU工具，需确保节点满足：

• 安装criu包（如Ubuntu：apt install criu）
• Containerd配置开启CRIU支持：在/etc/containerd/config.toml中添加：

  [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
    EnableCRIU = true
  

• 重启containerd服务：systemctl restart containerd

四、关键注意事项 #

• 使用Spring Boot 3.2+版本，官方对CRaC支持更完善
• 避免在checkpoint阶段加载动态配置（如数据库连接），可在restore后初始化
• 确保镜像仓库支持大文件推送，避免checkpoint文件过大导致失败

内容的提问来源于stack exchange，提问作者bitgully