AI 服务容器化与编排：Docker/K8s/GPU 调度/弹性伸缩

# ============ Stage 1: Build ============
FROM nvidia/cuda:12.4.1-cudnn-devel-ubuntu22.04 AS builder

ENV DEBIAN_FRONTEND=noninteractive \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

RUN apt-get update && apt-get install -y --no-install-recommends \
    python3.11 python3.11-venv python3-pip \
    && rm -rf /var/lib/apt/lists/*

RUN python3.11 -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"

COPY requirements.txt .
RUN pip install --no-cache-dir --upgrade pip && \
    pip install --no-cache-dir -r requirements.txt

# ============ Stage 2: Runtime ============
FROM nvidia/cuda:12.4.1-cudnn-runtime-ubuntu22.04

ENV DEBIAN_FRONTEND=noninteractive \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PATH="/opt/venv/bin:$PATH"

RUN apt-get update && apt-get install -y --no-install-recommends \
    python3.11 libgomp1 libgl1-mesa-glx \
    && rm -rf /var/lib/apt/lists/* \
    && ln -sf /usr/bin/python3.11 /usr/bin/python

COPY --from=builder /opt/venv /opt/venv

RUN groupadd -r aiservice && useradd -r -g aiservice aiservice
WORKDIR /app
COPY --chown=aiservice:aiservice ./src .

USER aiservice

EXPOSE 8000

HEALTHCHECK --interval=30s --timeout=10s --retries=3 \
    CMD curl -f http://localhost:8000/health || exit 1

CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]

# .dockerignore
.git
__pycache__
*.pyc
.pytest_cache
.mypy_cache
*.egg-info
.env
.env.*
models/checkpoints/*
!models/.gitkeep
data/
notebooks/

version: "3.9"

services:
  ai-api:
    build:
      context: .
      dockerfile: Dockerfile
    ports:
      - "8000:8000"
    environment:
      - DATABASE_URL=postgresql://aiuser:${PG_PASSWORD}@postgres:5432/ai_db
      - REDIS_URL=redis://redis:6379/0
      - QDRANT_URL=http://qdrant:6333
      - MODEL_PATH=/models
      - CUDA_VISIBLE_DEVICES=0
    volumes:
      - model-data:/models:ro
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [gpu]
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      qdrant:
        condition: service_started
    restart: unless-stopped
    networks:
      - ai-network

  postgres:
    image: pgvector/pgvector:pg16
    environment:
      POSTGRES_USER: aiuser
      POSTGRES_PASSWORD: ${PG_PASSWORD}
      POSTGRES_DB: ai_db
    volumes:
      - pg-data:/var/lib/postgresql/data
    ports:
      - "5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U aiuser -d ai_db"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - ai-network

  redis:
    image: redis:7-alpine
    command: redis-server --maxmemory 512mb --maxmemory-policy allkeys-lru
    ports:
      - "6379:6379"
    volumes:
      - redis-data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - ai-network

  qdrant:
    image: qdrant/qdrant:v1.12.1
    ports:
      - "6333:6333"
      - "6334:6334"
    volumes:
      - qdrant-data:/qdrant/storage
    environment:
      QDRANT__SERVICE__GRPC_PORT: 6334
    networks:
      - ai-network

volumes:
  model-data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /data/models
  pg-data:
  redis-data:
  qdrant-data:

networks:
  ai-network:
    driver: bridge

apiVersion: v1
kind: ConfigMap
metadata:
  name: ai-service-config
  namespace: ai-inference
data:
  MODEL_NAME: "Qwen/Qwen2.5-72B-Instruct"
  MAX_BATCH_SIZE: "32"
  MAX_SEQUENCE_LENGTH: "4096"
  LOG_LEVEL: "info"
  CONCURRENCY_WORKERS: "4"

---
apiVersion: v1
kind: Secret
metadata:
  name: ai-service-secrets
  namespace: ai-inference
type: Opaque
stringData:
  DATABASE_URL: "postgresql://aiuser:password@postgres-service:5432/ai_db"
  REDIS_URL: "redis://redis-service:6379/0"
  HF_TOKEN: "hf_xxxxxxxxxxxxxxxxxxxxxxxx"

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ai-api
  namespace: ai-inference
  labels:
    app: ai-api
    version: v1.2.0
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: ai-api
  template:
    metadata:
      labels:
        app: ai-api
        version: v1.2.0
    spec:
      containers:
        - name: ai-api
          image: registry.example.com/ai-api:v1.2.0
          ports:
            - containerPort: 8000
              protocol: TCP
          envFrom:
            - configMapRef:
                name: ai-service-config
            - secretRef:
                name: ai-service-secrets
          resources:
            requests:
              cpu: "4"
              memory: "16Gi"
              nvidia.com/gpu: "1"
            limits:
              cpu: "8"
              memory: "32Gi"
              nvidia.com/gpu: "1"
          volumeMounts:
            - name: model-cache
              mountPath: /models
              readOnly: true
          livenessProbe:
            httpGet:
              path: /health
              port: 8000
            initialDelaySeconds: 60
            periodSeconds: 30
            timeoutSeconds: 10
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /ready
              port: 8000
            initialDelaySeconds: 30
            periodSeconds: 10
            timeoutSeconds: 5
          startupProbe:
            httpGet:
              path: /health
              port: 8000
            failureThreshold: 30
            periodSeconds: 10
      volumes:
        - name: model-cache
          persistentVolumeClaim:
            claimName: model-pvc
      nodeSelector:
        accelerator: nvidia-gpu
      tolerations:
        - key: nvidia.com/gpu
          operator: Exists
          effect: NoSchedule

apiVersion: v1
kind: Service
metadata:
  name: ai-api-service
  namespace: ai-inference
spec:
  selector:
    app: ai-api
  ports:
    - port: 80
      targetPort: 8000
      protocol: TCP
  type: ClusterIP

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ai-api-ingress
  namespace: ai-inference
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
    nginx.ingress.kubernetes.io/streaming: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - api.example.com
      secretName: ai-api-tls
  rules:
    - host: api.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: ai-api-service
                port:
                  number: 80

# 部署 NVIDIA Device Plugin（DaemonSet）
kubectl apply -f https://raw.githubusercontent.com/NVIDIA/k8s-device-plugin/v0.17.0/deployments/static/nvidia-device-plugin.yml

# 验证 GPU 资源
kubectl get nodes -o json | jq '.items[] | {name: .metadata.name, gpu: .status.capacity["nvidia.com/gpu"]}'

# 启用 MIG（以 A100 为例）
nvidia-smi -i 0 -mig 1g.10gb

# 查看 MIG 实例
nvidia-smi mig -lgi

resources:
  limits:
    nvidia.com/mig-1g.10gb: 1

apiVersion: v1
kind: ConfigMap
metadata:
  name: time-slicing-config
  namespace: nvidia-device-plugin
data:
  any: |-
    version: v1
    flags:
      migStrategy: none
    sharing:
      timeSlicing:
        resources:
          - name: nvidia.com/gpu
            replicas: 4

apiVersion: v1
kind: Pod
metadata:
  name: inference-pod
spec:
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
          - matchExpressions:
              - key: nvidia.com/gpu.product
                operator: In
                values:
                  - "NVIDIA-A100-SXM4-80GB"

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: ai-api-hpa
  namespace: ai-inference
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: ai-api
  minReplicas: 2
  maxReplicas: 20
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
    - type: Resource
      resource:
        name: nvidia.com/gpu
        target:
          type: Utilization
          averageUtilization: 80
    - type: Pods
      pods:
        metric:
          name: requests_per_second
        target:
          type: AverageValue
          averageValue: "100"
  behavior:
    scaleUp:
      stabilizationWindowSeconds: 60
      policies:
        - type: Percent
          value: 50
          periodSeconds: 60
    scaleDown:
      stabilizationWindowSeconds: 300
      policies:
        - type: Percent
          value: 25
          periodSeconds: 120

apiVersion: autoscaling.k8s.io/v1
kind: VerticalPodAutoscaler
metadata:
  name: ai-api-vpa
  namespace: ai-inference
spec:
  targetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: ai-api
  updatePolicy:
    updateMode: "Auto"
  resourcePolicy:
    containerPolicies:
      - containerName: ai-api
        minAllowed:
          cpu: "2"
          memory: "8Gi"
        maxAllowed:
          cpu: "8"
          memory: "64Gi"
        controlledResources: ["cpu", "memory"]

apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
  name: ai-inference-scaledobject
  namespace: ai-inference
spec:
  scaleTargetRef:
    name: ai-api
  minReplicaCount: 1
  maxReplicaCount: 50
  cooldownPeriod: 300
  pollingInterval: 15
  triggers:
    - type: rabbitmq
      metadata:
        host: amqp://rabbitmq-service:5672
        queueName: inference-queue
        queueLength: "20"
        mode: QueueLength
        value: "20"
    - type: prometheus
      metadata:
        serverAddress: http://prometheus:9090
        metricName: inference_queue_depth
        query: |
          sum(inference_pending_requests{namespace="ai-inference"})
        threshold: "50"
        activationThreshold: "10"
    - type: cron
      metadata:
        timezone: Asia/Shanghai
        start: 0 8 * * 1-5
        end: 0 20 * * 1-5
        desiredReplicas: "10"

name: AI Service CI/CD

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
    branches: [main]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  CUDA_VERSION: "12.4"

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - name: Install dependencies
        run: |
          pip install -r requirements.txt -r requirements-dev.txt
      - name: Lint
        run: ruff check src/ && mypy src/
      - name: Unit tests
        run: pytest tests/unit -v --tb=short

  build-and-push:
    needs: test
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - name: Log in to Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=sha,prefix=

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  deploy:
    needs: build-and-push
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to K8s
        uses: azure/k8s-deploy@v5
        with:
          namespace: ai-inference
          manifests: |
            k8s/deployment.yaml
            k8s/service.yaml
            k8s/ingress.yaml
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }}
          strategy: canary
          percentage: 20

stages:
  - lint
  - test
  - build
  - deploy

variables:
  IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
  IMAGE_LATEST: $CI_REGISTRY_IMAGE:latest

lint:
  stage: lint
  image: python:3.11-slim
  script:
    - pip install ruff mypy
    - ruff check src/
    - mypy src/

unit-test:
  stage: test
  image: python:3.11-slim
  services:
    - redis:7-alpine
  script:
    - pip install -r requirements.txt -r requirements-dev.txt
    - pytest tests/unit -v --junitxml=report.xml
  artifacts:
    reports:
      junit: report.xml

build-image:
  stage: build
  image: docker:24
  services:
    - docker:24-dind
  before_script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
  script:
    - docker build
        --cache-from $IMAGE_LATEST
        --tag $IMAGE_TAG
        --tag $IMAGE_LATEST
        .
    - docker push $IMAGE_TAG
    - docker push $IMAGE_LATEST
  only:
    - main
    - tags

deploy-production:
  stage: deploy
  image: bitnami/kubectl:latest
  script:
    - kubectl set image deployment/ai-api
        ai-api=$IMAGE_TAG
        -n ai-inference
    - kubectl rollout status deployment/ai-api -n ai-inference --timeout=300s
  environment:
    name: production
    url: https://api.example.com
  only:
    - tags
  when: manual

# vLLM Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: vllm-qwen
  namespace: ai-inference
spec:
  replicas: 2
  selector:
    matchLabels:
      app: vllm-qwen
  template:
    metadata:
      labels:
        app: vllm-qwen
    spec:
      containers:
        - name: vllm
          image: vllm/vllm-openai:latest
          args:
            - "--model"
            - "Qwen/Qwen2.5-72B-Instruct"
            - "--tensor-parallel-size"
            - "2"
            - "--max-model-len"
            - "32768"
            - "--gpu-memory-utilization"
            - "0.9"
            - "--dtype"
            - "auto"
            - "--host"
            - "0.0.0.0"
            - "--port"
            - "8000"
          ports:
            - containerPort: 8000
          resources:
            limits:
              nvidia.com/gpu: "2"
              memory: "64Gi"
          env:
            - name: HF_TOKEN
              valueFrom:
                secretKeyRef:
                  name: ai-service-secrets
                  key: HF_TOKEN

apiVersion: apps/v1
kind: Deployment
metadata:
  name: triton-server
spec:
  replicas: 1
  selector:
    matchLabels:
      app: triton-server
  template:
    metadata:
      labels:
        app: triton-server
    spec:
      containers:
        - name: triton
          image: nvcr.io/nvidia/tritonserver:24.08-py3
          args:
            - "--model-repository"
            - "s3://model-bucket/model-repo"
            - "--http-port=8000"
            - "--grpc-port=8001"
            - "--metrics-port=8002"
            - "--load-model=embedding_model"
            - "--load-model=chat_model"
            - "--load-model=reranker_model"
          ports:
            - containerPort: 8000
            - containerPort: 8001
            - containerPort: 8002
          resources:
            limits:
              nvidia.com/gpu: "1"
          env:
            - name: AWS_ACCESS_KEY_ID
              valueFrom:
                secretKeyRef:
                  name: s3-credentials
                  key: access-key

                         ┌─────────────────────────────────────────────────┐
                         │              Kubernetes Cluster                  │
                         │                                                  │
  ┌──────┐    ┌──────┐   │   ┌─────────┐     ┌──────────────────────────┐  │
  │      │    │      │   │   │         │     │    GPU Node Pool          │  │
  │用户  │───▶│ CDN/ │───┼──▶│ Ingress │────▶│  ┌─────────┐             │  │
  │      │    │ WAF  │   │   │ (Nginx) │     │  │  vLLM   │  GPU: A100  │  │
  └──────┘    └──────┘   │   │         │     │  │  Pod 1  │  x2        │  │
                         │   └────┬────┘     │  └────┬────┘             │  │
                         │        │          │       │                   │  │
                         │        ▼          │  ┌────┴────┐             │  │
                         │   ┌─────────┐     │  │  vLLM   │  GPU: A100  │  │
                         │   │ Service │     │  │  Pod 2  │  x2        │  │
                         │   │ (ClusterIP)   │  └─────────┘             │  │
                         │   └────┬────┘     └──────────────────────────┘  │
                         │        │                                        │
                         │        │          ┌──────────────────────────┐  │
                         │        ├─────────▶│  Redis Cluster           │  │
                         │        │          │  (推理缓存/会话管理)       │  │
                         │        │          └──────────────────────────┘  │
                         │        │                                        │
                         │        ├─────────▶┌──────────────────────────┐  │
                         │        │          │  PostgreSQL + pgvector    │  │
                         │        │          │  (会话历史/向量检索)       │  │
                         │        │          └──────────────────────────┘  │
                         │        │                                        │
                         │        ├─────────▶┌──────────────────────────┐  │
                         │        │          │  Qdrant                   │  │
                         │        │          │  (向量数据库/RAG)          │  │
                         │        │          └──────────────────────────┘  │
                         │        │                                        │
                         │        └─────────▶┌──────────────────────────┐  │
                         │                   │  RabbitMQ/Kafka          │  │
                         │                   │  (异步推理任务队列)        │  │
                         │                   └──────────────────────────┘  │
                         │                                                  │
                         │   ┌──────────────────────────────────────────┐  │
                         │   │  控制平面                                   │  │
                         │   │  ┌────────┐ ┌──────┐ ┌───────────────┐  │  │
                         │   │  │  HPA   │ │ KEDA │ │ NVIDIA Plugin │  │  │
                         │   │  └────────┘ └──────┘ └───────────────┘  │  │
                         │   │  ┌────────┐ ┌──────┐ ┌───────────────┐  │  │
                         │   │  │  VPA   │ │CA/K  │ │ DCGM Exporter │  │  │
                         │   │  └────────┘ └──────┘ └───────────────┘  │  │
                         │   └──────────────────────────────────────────┘  │
                         └─────────────────────────────────────────────────┘