# K8s 集群管理辅助函数集

function Get-K8sContexts {
    <# 获取所有可用的 K8s 上下文 #>
    $Raw = kubectl config get-contexts -o name 2>$null
    if ($LASTEXITCODE -ne 0) {
        Write-Error "无法获取 K8s 上下文，请确认 kubeconfig 已配置"
        return @()
    }
    return $Raw | Where-Object { $_.Trim() }
}

function Switch-K8sContext {
    param([Parameter(Mandatory)][string]$ContextName)
    kubectl config use-context $ContextName 2>$null | Out-Null
    if ($LASTEXITCODE -eq 0) {
        Write-Host "已切换到上下文: $ContextName" -ForegroundColor Green
    } else {
        Write-Error "切换上下文失败: $ContextName"
    }
}

function Get-K8sResourceSummary {
    param(
        [string]$Namespace = 'default',
        [string]$Context
    )

    if ($Context) { Switch-K8sContext $Context }

    # 查询 Pod 状态汇总
    $Pods = kubectl get pods -n $Namespace -o json 2>$null |
        ConvertFrom-Json

    $PodSummary = $Pods.items | Group-Object status.phase |
        Select-Object @{N='Phase'; E={$_.Name}}, Count

    # 查询 Deployment 状态
    $Deployments = kubectl get deployments -n $Namespace -o json 2>$null |
        ConvertFrom-Json

    $DeployStatus = $Deployments.items | ForEach-Object {
        $Replicas = $_.status.replicas ?? 0
        $Ready = $_.status.readyReplicas ?? 0
        $Updated = $_.status.updatedReplicas ?? 0
        [PSCustomObject]@{
            Name      = $_.metadata.name
            Replicas  = $Replicas
            Ready     = $Ready
            Updated   = $Updated
            Available = $_.status.availableReplicas ?? 0
            Status    = if ($Ready -eq $Replicas -and $Replicas -gt 0) { 'Healthy' } else { 'Degraded' }
        }
    }

    # 查询 Service 端点
    $Services = kubectl get services -n $Namespace -o json 2>$null |
        ConvertFrom-Json

    $SvcInfo = $Services.items | ForEach-Object {
        $Ports = ($_.spec.ports | ForEach-Object { "$($_.port):$($_.targetPort)/$($_.protocol)" }) -join ', '
        [PSCustomObject]@{
            Name  = $_.metadata.name
            Type  = $_.spec.type
            Ports = $Ports
            IP    = if ($_.spec.type -eq 'LoadBalancer') {
                $_.status.loadBalancer.ingress[0].ip ?? 'Pending'
            } else {
                $_.spec.clusterIP
            }
        }
    }

    Write-Host "`n=== Pod 状态汇总 (Namespace: $Namespace) ===" -ForegroundColor Cyan
    $PodSummary | Format-Table -AutoSize

    Write-Host "=== Deployment 状态 ===" -ForegroundColor Cyan
    $DeployStatus | Format-Table -AutoSize

    Write-Host "=== Service 列表 ===" -ForegroundColor Cyan
    $SvcInfo | Format-Table -AutoSize
}

# 使用示例
Write-Host "当前可用上下文:" -ForegroundColor Yellow
Get-K8sContexts

# 切换到生产集群并查看资源概况
Get-K8sResourceSummary -Namespace 'production' -Context 'prod-cluster'

# K8s 部署自动化工具

function New-K8sDeploymentManifest {
    param(
        [Parameter(Mandatory)][string]$AppName,
        [Parameter(Mandatory)][string]$Image,
        [int]$Replicas = 2,
        [int]$Port = 8080,
        [hashtable]$Labels = @{},
        [string]$Namespace = 'default'
    )

    $AllLabels = @{ app = $AppName } + $Labels

    $Manifest = @{
        apiVersion = 'apps/v1'
        kind       = 'Deployment'
        metadata   = @{
            name      = $AppName
            namespace = $Namespace
            labels    = $AllLabels
        }
        spec       = @{
            replicas = $Replicas
            selector = @{ matchLabels = @{ app = $AppName } }
            template = @{
                metadata = @{ labels = $AllLabels }
                spec     = @{
                    containers = @(
                        @{
                            name  = $AppName
                            image = $Image
                            ports = @(@{ containerPort = $Port })
                            resources = @{
                                requests = @{ cpu = '100m'; memory = '128Mi' }
                                limits   = @{ cpu = '500m'; memory = '512Mi' }
                            }
                            readinessProbe = @{
                                httpGet       = @{ path = '/health'; port = $Port }
                                initialDelaySeconds = 5
                                periodSeconds       = 10
                            }
                            livenessProbe = @{
                                httpGet       = @{ path = '/health'; port = $Port }
                                initialDelaySeconds = 15
                                periodSeconds       = 20
                            }
                        }
                    )
                }
            }
        }
    }

    return $Manifest
}

function Start-K8sRollingUpdate {
    param(
        [Parameter(Mandatory)][string]$AppName,
        [Parameter(Mandatory)][string]$NewImage,
        [string]$Namespace = 'default',
        [int]$TimeoutSeconds = 300
    )

    Write-Host "开始滚动更新: $AppName -> $NewImage" -ForegroundColor Cyan

    # 设置新镜像
    kubectl set image "deployment/$AppName" `
        "$AppName=$NewImage" -n $Namespace 2>$null | Out-Null

    if ($LASTEXITCODE -ne 0) {
        Write-Error "设置镜像失败"
        return $false
    }

    # 等待滚动更新完成
    Write-Host "等待滚动更新完成 (超时: ${TimeoutSeconds}s)..." -ForegroundColor Yellow
    $Deadline = (Get-Date).AddSeconds($TimeoutSeconds)

    while ((Get-Date) -lt $Deadline) {
        $Status = kubectl rollout status "deployment/$AppName" `
            -n $Namespace --timeout=30s 2>&1

        if ($LASTEXITCODE -eq 0) {
            Write-Host "滚动更新成功: $AppName" -ForegroundColor Green
            return $true
        }

        # 显示当前 Pod 状态
        $Pods = kubectl get pods -n $Namespace -l "app=$AppName" -o json 2>$null |
            ConvertFrom-Json

        $Pods.items | ForEach-Object {
            $Phase = $_.status.phase
            $Containers = $_.status.containerStatuses
            $Ready = ($Containers | Where-Object { $_.ready }).Count
            $Total = $Containers.Count
            Write-Host "  Pod: $($_.metadata.name) | Phase: $Phase | Ready: $Ready/$Total"
        }

        Start-Sleep -Seconds 5
    }

    Write-Warning "滚动更新超时，准备回滚..."
    Undo-K8sRollout -AppName $AppName -Namespace $Namespace
    return $false
}

function Undo-K8sRollout {
    param(
        [Parameter(Mandatory)][string]$AppName,
        [string]$Namespace = 'default',
        [int]$Revision = 0
    )

    if ($Revision -eq 0) {
        Write-Host "回滚到上一版本: $AppName" -ForegroundColor Yellow
        kubectl rollout undo "deployment/$AppName" -n $Namespace 2>$null
    } else {
        Write-Host "回滚到修订版本 $Revision: $AppName" -ForegroundColor Yellow
        kubectl rollout undo "deployment/$AppName" -n $Namespace --to-revision=$Revision 2>$null
    }

    if ($LASTEXITCODE -eq 0) {
        Write-Host "回滚成功" -ForegroundColor Green
        # 查看部署历史
        kubectl rollout history "deployment/$AppName" -n $Namespace
    } else {
        Write-Error "回滚失败"
    }
}

# 生成部署清单并应用
$Manifest = New-K8sDeploymentManifest `
    -AppName 'web-frontend' `
    -Image 'registry.example.com/web-frontend:v2.3.0' `
    -Replicas 3 `
    -Port 8080 `
    -Labels @{ tier = 'frontend'; env = 'production' } `
    -Namespace 'production'

$YamlPath = '/tmp/web-frontend-deployment.yaml'
$Manifest | ConvertTo-Json -Depth 10 | Set-Content $YamlPath
kubectl apply -f $YamlPath

# 执行滚动更新
Start-K8sRollingUpdate `
    -AppName 'web-frontend' `
    -NewImage 'registry.example.com/web-frontend:v2.4.0' `
    -Namespace 'production' `
    -TimeoutSeconds 300

# K8s 集群运维巡检工具集

function Invoke-K8sClusterHealthCheck {
    param(
        [string]$Context,
        [string]$OutputPath = "./k8s-health-report-$(Get-Date -Format 'yyyyMMdd-HHmmss').txt"
    )

    if ($Context) { Switch-K8sContext $Context }

    $Report = [System.Text.StringBuilder]::new()
    $null = $Report.AppendLine("=" * 60)
    $null = $Report.AppendLine("K8s 集群健康巡检报告 - $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')")
    $null = $Report.AppendLine("=" * 60)

    # 1. 节点状态检查
    $null = $Report.AppendLine("`n--- 节点状态 ---")
    $Nodes = kubectl get nodes -o json 2>$null | ConvertFrom-Json

    foreach ($Node in $Nodes.items) {
        $Name = $Node.metadata.name
        $Conditions = $Node.status.conditions
        $Ready = ($Conditions | Where-Object { $_.type -eq 'Ready' }).status -eq 'True'
        $MemoryPressure = ($Conditions | Where-Object { $_.type -eq 'MemoryPressure' }).status -eq 'True'
        $DiskPressure = ($Conditions | Where-Object { $_.type -eq 'DiskPressure' }).status -eq 'True'

        $StatusIcon = if ($Ready -and -not $MemoryPressure -and -not $DiskPressure) { 'OK' } else { 'WARN' }
        $null = $Report.AppendLine("[$StatusIcon] $Name | Ready: $Ready | MemoryPressure: $MemoryPressure | DiskPressure: $DiskPressure")

        # 节点资源使用
        $Allocatable = $Node.status.allocatable
        $null = $Report.AppendLine("     CPU: $($Allocatable.cpu) | Memory: $($Allocatable.memory)")
    }

    # 2. 异常 Pod 扫描（所有命名空间）
    $null = $Report.AppendLine("`n--- 异常 Pod ---")
    $AllPods = kubectl get pods -A -o json 2>$null | ConvertFrom-Json

    $UnhealthyPods = $AllPods.items | Where-Object {
        $_.status.phase -notin @('Running', 'Succeeded') -or
        ($_.status.containerStatuses | Where-Object { $_.restartCount -gt 5 }).Count -gt 0
    }

    if ($UnhealthyPods) {
        foreach ($Pod in $UnhealthyPods) {
            $Ns = $Pod.metadata.namespace
            $Name = $Pod.metadata.name
            $Phase = $Pod.status.phase
            $Restarts = ($Pod.status.containerStatuses | Measure-Object -Property restartCount -Sum).Sum
            $null = $Report.AppendLine("  [ALERT] $Ns/$Name | Phase: $Phase | Restarts: $Restarts")
        }
    } else {
        $null = $Report.AppendLine("  所有 Pod 运行正常")
    }

    # 3. 资源使用报告（通过 metrics-server）
    $null = $Report.AppendLine("`n--- 资源使用 Top 10 ---")
    $TopPods = kubectl top pods -A --sort-by=memory --no-headers 2>$null

    if ($LASTEXITCODE -eq 0) {
        $Rank = 1
        $TopPods | Select-Object -First 10 | ForEach-Object {
            $null = $Report.AppendLine("  #$Rank $_")
            $Rank++
        }
    } else {
        $null = $Report.AppendLine("  metrics-server 未安装或不可用，跳过资源使用统计")
    }

    # 4. 最近事件告警
    $null = $Report.AppendLine("`n--- 最近告警事件 (Warning) ---")
    $Events = kubectl get events -A --field-selector type=Warning -o json 2>$null |
        ConvertFrom-Json

    $RecentWarnings = $Events.items |
        Sort-Object { [datetime]$_.lastTimestamp } -Descending |
        Select-Object -First 10

    foreach ($Evt in $RecentWarnings) {
        $Time = $Evt.lastTimestamp
        $Ns = $Evt.metadata.namespace
        $Msg = $Evt.message
        $Involved = "$($Evt.involvedObject.kind)/$($Evt.involvedObject.name)"
        $null = $Report.AppendLine("  [$Time] $Ns/$Involved - $Msg")
    }

    # 输出报告
    $ReportContent = $Report.ToString()
    $ReportContent | Set-Content $OutputPath -Encoding UTF8
    Write-Host $ReportContent
    Write-Host "`n报告已保存到: $OutputPath" -ForegroundColor Green

    # 返回摘要对象，便于后续自动化处理
    return [PSCustomObject]@{
        TotalNodes     = $Nodes.items.Count
        UnhealthyPods  = $UnhealthyPods.Count
        WarningEvents  = $RecentWarnings.Count
        ReportPath     = $OutputPath
    }
}

# 执行巡检
$HealthResult = Invoke-K8sClusterHealthCheck -Context 'prod-cluster'

# 根据巡检结果触发告警
if ($HealthResult.UnhealthyPods -gt 0 -or $HealthResult.WarningEvents -gt 5) {
    $AlertMsg = "K8s 巡检告警: 异常Pod=$($HealthResult.UnhealthyPods), 告警事件=$($HealthResult.WarningEvents)"
    Write-Host $AlertMsg -ForegroundColor Red
    # 可在此处接入钉钉、飞书、Slack 等通知渠道
}

function Get-DockerImageList {
    [CmdletBinding()]
    param(
        [string]$Filter,
        [switch]$DanglingOnly
    )

    $args = @('image', 'ls', '--format', '{{.Repository}}:{{.Tag}}|{{.ID}}|{{.Size}}|{{.CreatedSince}}')
    if ($DanglingOnly) {
        $args += @('--filter', 'dangling=true')
    }

    $result = docker $args 2>&1
    if ($LASTEXITCODE -ne 0) {
        Write-Error "无法获取镜像列表: $result"
        return
    }

    $images = $result | ForEach-Object {
        $parts = $_ -split '\|'
        [PSCustomObject]@{
            Repository = $parts[0]
            ImageId    = $parts[1]
            Size       = $parts[2]
            Created    = $parts[3]
        }
    }

    if ($Filter) {
        $images = $images | Where-Object { $_.Repository -like "*$Filter*" }
    }

    $images
}

function Start-DockerApp {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [string]$Image,

        [string]$Name = "app-$(Get-Random -Maximum 9999)",
        [int]$Port = 8080,
        [string]$Volume,
        [hashtable]$EnvVars,
        [string]$Network = 'bridge'
    )

    $dockerArgs = @('run', '-d', '--name', $Name, '--restart', 'unless-stopped')

    # 端口映射
    $dockerArgs += @('-p', "${Port}:${Port}")

    # 挂载卷
    if ($Volume) {
        if (-not (Test-Path $Volume)) {
            New-Item -ItemType Directory -Path $Volume -Force | Out-Null
            Write-Host "已创建挂载目录: $Volume" -ForegroundColor Yellow
        }
        $dockerArgs += @('-v', "${Volume}:/app/data")
    }

    # 环境变量
    if ($EnvVars) {
        foreach ($key in $EnvVars.Keys) {
            $dockerArgs += @('-e', "${key}=$($EnvVars[$key])")
        }
    }

    # 网络
    $dockerArgs += @('--network', $Network)
    $dockerArgs += $Image

    Write-Host "正在启动容器 [$Name]..." -ForegroundColor Cyan
    $containerId = docker $dockerArgs 2>&1
    if ($LASTEXITCODE -eq 0) {
        Write-Host "容器已启动: $containerId" -ForegroundColor Green
        return $containerId
    } else {
        Write-Error "启动失败: $containerId"
    }
}

function Get-DockerContainerLog {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory, ValueFromPipelineByPropertyName)]
        [string]$Name,

        [int]$Tail = 50,
        [switch]$Follow,
        [datetime]$Since
    )

    $args = @('logs')
    if ($Tail -gt 0) { $args += @('--tail', $Tail) }
    if ($Follow) { $args += '--follow' }
    if ($Since) { $args += @('--since', $Since.ToString('yyyy-MM-ddTHH:mm:ss')) }
    $args += $Name

    docker $args 2>&1
}

PS> Get-DockerImageList -Filter 'nginx'

Repository       ImageId      Size    Created
----------       -------      ----    -------
nginx:latest      a8758716bb   187MB   3 days ago
nginx:alpine      c31a4dc1b5   42MB    2 weeks ago

PS> Start-DockerApp -Image 'nginx:alpine' -Name 'web-test' -Port 8080 -Volume 'C:\data\web' -EnvVars @{ 'NGINX_HOST' = 'localhost' }

正在启动容器 [web-test]...
已创建挂载目录: C:\data\web
容器已启动: d4f5a2c8e1b3...

PS> Get-DockerContainerLog -Name 'web-test' -Tail 10

2026/01/19 08:15:32 [notice] 1#1: start worker process 32
2026/01/19 08:15:32 [notice] 1#1: start worker process 33
192.168.1.100 - - [19/Jan/2026:08:16:01 +0000] "GET / HTTP/1.1" 200 615

function New-DockerComposeConfig {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [string]$ProjectName,

        [string]$OutputPath = '.',
        [string]$AppImage = 'myapp:latest',
        [string]$DbImage = 'postgres:16-alpine',
        [string]$RedisImage = 'redis:7-alpine',
        [int]$AppPort = 3000
    )

    $compose = @{
        services = @{
            app = @{
                image       = $AppImage
                ports       = @("${AppPort}:3000")
                environment = @{
                    NODE_ENV      = 'production'
                    DATABASE_URL  = "postgresql://appuser:secret@db:5432/${ProjectName}"
                    REDIS_URL     = 'redis://redis:6379'
                }
                depends_on  = @(
                    @{ service = 'db'; condition = 'service_healthy' }
                    @{ service = 'redis'; condition = 'service_started' }
                )
                restart     = 'unless-stopped'
                deploy = @{
                    resources = @{
                        limits = @{
                            memory = '512M'
                            cpus   = '1.0'
                        }
                    }
                }
            }
            db = @{
                image   = $DbImage
                volumes = @("${ProjectName}-db-data:/var/lib/postgresql/data")
                environment = @{
                    POSTGRES_DB       = $ProjectName
                    POSTGRES_USER     = 'appuser'
                    POSTGRES_PASSWORD = 'secret'
                }
                healthcheck = @{
                    test     = @('CMD-SHELL', 'pg_isready -U appuser -d ' + $ProjectName)
                    interval = '10s'
                    timeout  = '5s'
                    retries  = 5
                }
                restart  = 'unless-stopped'
            }
            redis = @{
                image   = $RedisImage
                volumes = @("${ProjectName}-redis-data:/data")
                command = 'redis-server --appendonly yes --maxmemory 128mb --maxmemory-policy allkeys-lru'
                restart = 'unless-stopped'
            }
        }
        volumes = @{
            "${ProjectName}-db-data"    = @{}
            "${ProjectName}-redis-data" = @{}
        }
    }

    $outputFile = Join-Path $OutputPath "docker-compose-${ProjectName}.yml"
    $compose | ConvertTo-Yaml | Set-Content -Path $outputFile -Encoding UTF8
    Write-Host "已生成 Compose 文件: $outputFile" -ForegroundColor Green

    return $outputFile
}

function Invoke-DockerCompose {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [string]$ComposeFile,

        [ValidateSet('Up', 'Down', 'Restart', 'Pull', 'Ps')]
        [string]$Action = 'Up',

        [switch]$Build,
        [switch]$Detach
    )

    $baseArgs = @('-f', $ComposeFile)

    switch ($Action) {
        'Up' {
            $args = $baseArgs + @('up')
            if ($Detach) { $args += '-d' }
            if ($Build) { $args += '--build' }
            Write-Host "正在启动服务..." -ForegroundColor Cyan
        }
        'Down' {
            $args = $baseArgs + @('down', '--volumes', '--remove-orphans')
            Write-Host "正在停止并清理服务..." -ForegroundColor Yellow
        }
        'Restart' {
            $args = $baseArgs + @('restart')
            Write-Host "正在重启服务..." -ForegroundColor Cyan
        }
        'Pull' {
            $args = $baseArgs + @('pull')
            Write-Host "正在拉取最新镜像..." -ForegroundColor Cyan
        }
        'Ps' {
            $args = $baseArgs + @('ps', '--format', 'table {{.Name}}\t{{.Status}}\t{{.Ports}}')
        }
    }

    docker $args 2>&1 | ForEach-Object { Write-Host $_ }
    if ($LASTEXITCODE -ne 0) {
        Write-Error "Compose 操作 [$Action] 执行失败"
    }
}

function Remove-DockerOrphanResources {
    [CmdletBinding()]
    param(
        [switch]$IncludeVolumes,
        [switch]$DryRun
    )

    $report = [System.Text.StringBuilder]::new()
    [void]$report.AppendLine("=== Docker 资源清理报告 ===")
    [void]$report.AppendLine("执行时间: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')`n")

    # 清理已停止的容器
    $stopped = docker ps -aq --filter 'status=exited' 2>$null
    if ($stopped) {
        $count = ($stopped | Measure-Object).Count
        [void]$report.AppendLine("[容器] 发现 $count 个已停止的容器")
        if (-not $DryRun) {
            docker rm $stopped 2>$null | Out-Null
            [void]$report.AppendLine("  -> 已清理")
        }
    }

    # 清理悬空镜像
    $dangling = docker images -q --filter 'dangling=true' 2>$null
    if ($dangling) {
        $count = ($dangling | Measure-Object).Count
        [void]$report.AppendLine("[镜像] 发现 $count 个悬空镜像")
        if (-not $DryRun) {
            docker rmi $dangling 2>$null | Out-Null
            [void]$report.AppendLine("  -> 已清理")
        }
    }

    # 清理未使用的网络
    $networks = docker network ls --filter 'type=custom' -q 2>$null
    if ($networks) {
        $count = ($networks | Measure-Object).Count
        [void]$report.AppendLine("[网络] 发现 $count 个自定义网络")
        if (-not $DryRun) {
            docker network prune -f 2>$null | Out-Null
            [void]$report.AppendLine("  -> 已清理")
        }
    }

    # 清理未使用的卷
    if ($IncludeVolumes) {
        $volumes = docker volume ls -q --filter 'dangling=true' 2>$null
        if ($volumes) {
            $count = ($volumes | Measure-Object).Count
            [void]$report.AppendLine("[卷] 发现 $count 个悬空卷")
            if (-not $DryRun) {
                docker volume prune -f 2>$null | Out-Null
                [void]$report.AppendLine("  -> 已清理")
            }
        }
    }

    # 回收磁盘空间
    if (-not $DryRun) {
        [void]$report.AppendLine("`n正在回收磁盘空间...")
        $reclaim = docker system df --format '{{.Reclaimable}}' 2>$null
        docker system prune -f 2>$null | Out-Null
        [void]$report.AppendLine("可回收空间: $($reclaim -join ', ')")
    } else {
        [void]$report.AppendLine("`n[模拟模式] 未执行实际清理操作")
    }

    $report.ToString()
}

function Get-DockerResourceMonitor {
    [CmdletBinding()]
    param(
        [int]$IntervalSeconds = 5,
        [int]$Count = 12
    )

    for ($i = 0; $i -lt $Count; $i++) {
        $timestamp = Get-Date -Format 'HH:mm:ss'

        $stats = docker stats --no-stream --format `
            '{{.Name}}|{{.CPUPerc}}|{{.MemUsage}}|{{.MemPerc}}|{{.NetIO}}|{{.PIDs}}' 2>$null

        if ($i -eq 0) {
            Write-Host ("{0,-8} {1,-20} {2,-10} {3,-15} {4,-8} {5,-20} {6,-6}" -f `
                '时间', '容器', 'CPU', '内存使用', '内存%', '网络IO', 'PID') `
                -ForegroundColor Cyan
            Write-Host ('-' * 90)
        }

        $stats | ForEach-Object {
            $parts = $_ -split '\|'
            if ($parts.Count -eq 6) {
                Write-Host ("{0,-8} {1,-20} {2,-10} {3,-15} {4,-8} {5,-20} {6,-6}" -f `
                    $timestamp, $parts[0], $parts[1], $parts[2], $parts[3], $parts[4], $parts[5])
            }
        }

        if ($i -lt $Count - 1) {
            Start-Sleep -Seconds $IntervalSeconds
        }
    }
}

function Test-DockerImageSecurity {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [string]$Image,

        [string]$Severity = 'HIGH,CRITICAL',
        [switch]$SkipDbUpdate
    )

    Write-Host "正在扫描镜像: $Image" -ForegroundColor Cyan
    Write-Host "严重级别过滤: $Severity`n"

    # 检查 trivy 是否安装
    $trivy = Get-Command trivy -ErrorAction SilentlyContinue
    if (-not $trivy) {
        Write-Warning "未找到 trivy 扫描器，使用 docker scout 替代"
        $scanResult = docker scout cves $Image 2>&1
    } else {
        $trivyArgs = @('image', '--severity', $Severity, '--format', 'table', $Image)
        if ($SkipDbUpdate) { $trivyArgs += '--skip-db-update' }
        $scanResult = trivy $trivyArgs 2>&1
    }

    $scanResult | ForEach-Object { Write-Host $_ }

    # 提取漏洞摘要
    $criticalCount = ($scanResult | Select-String -Pattern 'CRITICAL' -SimpleMatch).Count
    $highCount = ($scanResult | Select-String -Pattern 'HIGH' -SimpleMatch).Count

    [PSCustomObject]@{
        Image     = $Image
        Critical  = $criticalCount
        High      = $highCount
        ScanTime  = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
        Status    = if ($criticalCount -gt 0) { 'NEEDS ATTENTION' } else { 'ACCEPTABLE' }
    }
}

# 定义变量
$resourceGroup = "rg-microservice-demo"
$location = "eastasia"
$envName = "cae-microservice"
$appName = "ca-weather-api"
$acrLoginServer = "myacr.azurecr.io"
$imageTag = "$acrLoginServer/weather-api:v1.0.0"

# 登录并选择订阅
Connect-AzAccount
Set-AzContext -SubscriptionId "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

# 创建资源组
New-AzResourceGroup -Name $resourceGroup -Location $location -Force

# 创建 Container Apps 环境（包含 Log Analytics 工作区）
$workspace = New-AzOperationalInsightsWorkspace `
    -ResourceGroupName $resourceGroup `
    -Name "log-microservice" `
    -Location $location `
    -Sku Standard

$envArgs = @{
    Name                = $envName
    ResourceGroupName   = $resourceGroup
    Location            = $location
    AppLogConfiguration = @{
        LogAnalyticsConfiguration = @{
            CustomerId = $workspace.CustomerId
            SharedKey  = (Get-AzOperationalInsightsWorkspaceSharedKey `
                -ResourceGroupName $resourceGroup `
                -Name $workspace.Name).PrimarySharedKey
        }
    }
}
$containerEnv = New-AzContainerAppManagedEnv @envArgs

# 获取 ACR 凭据并创建托管标识拉取镜像
$acr = Get-AzContainerRegistry -ResourceGroupName $resourceGroup -Name "myacr"
$acrCred = Get-AzContainerRegistryCredential -Registry $acr

# 部署容器应用
$appArgs = @{
    Name                = $appName
    ResourceGroupName   = $resourceGroup
    Location            = $location
    ManagedEnvironment  = $containerEnv
    Configuration       = @{
        ActiveRevisionsMode = "Single"
        Ingress             = @{
            External   = $true
            TargetPort = 8080
            Traffic    = @(
                @{
                    RevisionName = "$appName--v1"
                    Weight       = 100
                }
            )
        }
    }
    Template            = @{
        Containers = @(
            @{
                Name  = "weather-api"
                Image = $imageTag
                Env   = @(
                    @{
                        Name  = "ASPNETCORE_ENVIRONMENT"
                        Value = "Production"
                    }
                    @{
                        Name  = "LOG_LEVEL"
                        Value = "Information"
                    }
                )
                Resources = @{
                    Cpu    = "0.5"
                    Memory = "1.0Gi"
                }
            }
        )
    }
}
New-AzContainerApp @appArgs

Write-Host "容器应用部署完成: $appName"

# 推送 v2.0.0 版本并配置金丝雀发布（10% 流量到新版本）
$v2Image = "$acrLoginServer/weather-api:v2.0.0"

$updateArgs = @{
    Name              = $appName
    ResourceGroupName = $resourceGroup
    Configuration     = @{
        ActiveRevisionsMode = "Multiple"
        Ingress             = @{
            External   = $true
            TargetPort = 8080
            Traffic    = @(
                @{
                    RevisionName = "$appName--v1"
                    Weight       = 90
                }
                @{
                    RevisionName = "$appName--v2"
                    Weight       = 10
                }
            )
        }
    }
    Template          = @{
        Containers = @(
            @{
                Name  = "weather-api"
                Image = $v2Image
                Env   = @(
                    @{
                        Name  = "ASPNETCORE_ENVIRONMENT"
                        Value = "Production"
                    }
                    @{
                        Name  = "LOG_LEVEL"
                        Value = "Debug"
                    }
                )
                Resources = @{
                    Cpu    = "0.5"
                    Memory = "1.0Gi"
                }
            }
        )
    }
}
New-AzContainerApp @updateArgs

Write-Host "金丝雀发布已配置: v1(90%) -> v2(10%)"

# 观察新版本运行状态
Start-Sleep -Seconds 30

# 查看所有修订版本及状态
$revisions = Get-AzContainerAppRevision `
    -Name $appName `
    -ResourceGroupName $resourceGroup

$revisions | Format-Table Name, Active, TrafficWeight, Replicas, CreatedTime -AutoSize

# 确认新版本稳定后，切换全量流量到 v2
$fullCutArgs = @{
    Name              = $appName
    ResourceGroupName = $resourceGroup
    Configuration     = @{
        ActiveRevisionsMode = "Multiple"
        Ingress             = @{
            External   = $true
            TargetPort = 8080
            Traffic    = @(
                @{
                    RevisionName = "$appName--v2"
                    Weight       = 100
                }
            )
        }
    }
}
Update-AzContainerApp @fullCutArgs

Write-Host "全量切换完成: v2(100%)"

# 如果发现问题，一键回滚到 v1
# Update-AzContainerApp @fullCutArgs -Configuration @{
#     Ingress = @{
#         Traffic = @(@{ RevisionName = "$appName--v1"; Weight = 100 })
#     }
# }

# 配置基于 HTTP 并发的自动扩缩容
$scaleArgs = @{
    Name              = $appName
    ResourceGroupName = $resourceGroup
    Template          = @{
        Containers = @(
            @{
                Name  = "weather-api"
                Image = "$acrLoginServer/weather-api:v2.0.0"
                Resources = @{
                    Cpu    = "1.0"
                    Memory = "2.0Gi"
                }
            }
        )
        Scale = @{
            MinReplicas = 1
            MaxReplicas = 20
            Rules       = @(
                @{
                    Name = "http-concurrency"
                    Custom = @{
                        Type  = "http"
                        Metadata = @{
                            concurrentRequests = "100"
                        }
                    }
                }
                @{
                    Name = "cpu-utilization"
                    Custom = @{
                        Type  = "cpu"
                        Metadata = @{
                            type  = "Utilization"
                            value = "70"
                        }
                    }
                }
            )
        }
    }
}
Update-AzContainerApp @scaleArgs

Write-Host "自动扩缩容已配置: 1-20 副本，HTTP 并发阈值 100"

# 查询容器应用日志
$logQuery = @"
ContainerAppConsoleLogs_CL
| where ContainerAppName_s == '$appName'
| where TimeGenerated > ago(1h)
| project TimeGenerated, Log_s, RevisionName_s
| order by TimeGenerated desc
| limit 50
"@

$queryResult = Invoke-AzOperationalInsightsQuery `
    -WorkspaceId $workspace.CustomerId `
    -Query $logQuery

$queryResult.Results | Format-Table TimeGenerated, RevisionName_s, Log_s -AutoSize

# 配置监控告警：当副本数超过 15 时触发通知
$actionGroup = New-AzActionGroup `
    -ResourceGroupName $resourceGroup `
    -Name "ag-container-alerts" `
    -ShortName "caAlert"

$alertRule = New-AzMetricAlertRuleV2 `
    -Name "alert-high-scale" `
    -ResourceGroupName $resourceGroup `
    -WindowSize (New-TimeSpan -Minutes 5) `
    -Frequency (New-TimeSpan -Minutes 1) `
    -TargetResourceId (Get-AzContainerApp `
        -Name $appName `
        -ResourceGroupName $resourceGroup).Id `
    -Condition @{ `
        MetricName = "ReplicaCount"; `
        Operator   = "GreaterThan"; `
        Threshold  = 15 `
    } `
    -ActionGroupId $actionGroup.Id `
    -Severity 2

Write-Host "告警规则已创建: 副本数 > 15 时通知运维团队"

# 登录 Azure 账户
Connect-AzAccount

# 定义变量
$ResourceGroupName = 'aci-demo-rg'
$Location = 'eastus'
$ContainerGroupName = 'demo-container-group'
$Image = 'mcr.microsoft.com/aci/helloworld'

# 创建资源组
$rg = New-AzResourceGroup -Name $ResourceGroupName -Location $Location
Write-Host "资源组 '$($rg.ResourceGroupName)' 创建完成，位置：$($rg.Location)"

# 创建容器组
$containerGroup = New-AzContainerGroup `
    -ResourceGroupName $ResourceGroupName `
    -Name $ContainerGroupName `
    -Image $Image `
    -OsType 'Linux' `
    -Cpu 1 `
    -MemoryInGB 1 `
    -Port 80 `
    -IpAddressType 'Public'

Write-Host "容器组 '$ContainerGroupName' 已创建"

# 查询容器组状态
$status = Get-AzContainerGroup `
    -ResourceGroupName $ResourceGroupName `
    -Name $ContainerGroupName

Write-Host "容器状态：$($status.ProvisioningState)"
Write-Host "公共 IP：$($status.IpAddress)"
Write-Host "FQDN：$($status.Fqdn)"

# 定义安全引用变量
$ResourceGroupName = 'aci-demo-rg'
$ContainerGroupName = 'secure-app-group'

# 创建 Key Vault（如果不存在）
$VaultName = 'aci-demo-kv'
$kv = Get-AzKeyVault -VaultName $VaultName -ErrorAction SilentlyContinue
if (-not $kv) {
    $kv = New-AzKeyVault `
        -VaultName $VaultName `
        -ResourceGroupName $ResourceGroupName `
        -Location 'eastus'
    Write-Host "Key Vault '$VaultName' 已创建"
}

# 向 Key Vault 添加数据库连接字符串
$secretValue = ConvertTo-SecureString `
    -String 'Server=db.example.com;Database=appdb;User=appuser;Pwd=Str0ngP@ss!' `
    -AsPlainText -Force

Set-AzKeyVaultSecret `
    -VaultName $VaultName `
    -Name 'DatabaseConnectionString' `
    -SecretValue $secretValue

Write-Host "密钥已写入 Key Vault"

# 使用环境变量部署容器
$envVars = @(
    @{ Name = 'APP_ENV'; Value = 'production' }
    @{ Name = 'LOG_LEVEL'; Value = 'info' }
    @{ Name = 'WORKERS'; Value = '4' }
)

$containerGroup = New-AzContainerGroup `
    -ResourceGroupName $ResourceGroupName `
    -Name $ContainerGroupName `
    -Image 'nginx:latest' `
    -OsType 'Linux' `
    -Cpu 1 `
    -MemoryInGB 1.5 `
    -Port 80 `
    -IpAddressType 'Public' `
    -EnvironmentVariable $envVars

Write-Host "容器 '$ContainerGroupName' 已部署，含环境变量配置"

# 监控和清理变量
$ResourceGroupName = 'aci-demo-rg'
$ContainerGroupName = 'demo-container-group'

# 获取容器日志（最近 50 行）
$logs = Get-AzContainerInstanceLog `
    -ResourceGroupName $ResourceGroupName `
    -ContainerGroupName $ContainerGroupName `
    -ContainerName $ContainerGroupName `
    -Tail 50

Write-Host "=== 容器日志（最近 50 行）==="
Write-Host $logs

# 列出资源组中所有容器组的状态
$allContainers = Get-AzContainerGroup -ResourceGroupName $ResourceGroupName

foreach ($cg in $allContainers) {
    $startTime = $cg.Containers[0].InstanceView.CurrentState.StartTime
    Write-Host ("容器组：{0,-30} 状态：{1,-12} IP：{2}" -f `
        $cg.Name, `
        $cg.ProvisioningState, `
        $cg.IpAddress)
}

# 自动清理：删除运行超过 24 小时的容器组
$cutoff = (Get-Date).AddHours(-24)

foreach ($cg in $allContainers) {
    $startTime = $cg.Containers[0].InstanceView.CurrentState.StartTime
    if ($startTime -and $startTime -lt $cutoff) {
        Write-Host "清理过期容器组：$($cg.Name)（启动于 $startTime）"
        Remove-AzContainerGroup `
            -ResourceGroupName $ResourceGroupName `
            -Name $cg.Name `
            -Confirm:$false
    }
}

Write-Host "`n清理完成。剩余容器组："
$remaining = Get-AzContainerGroup -ResourceGroupName $ResourceGroupName
$remaining | ForEach-Object { Write-Host "  - $($_.Name)" }