Spring Cloud 实战：微服务、网关、安全一体化

1
2
3
4

<dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-starter-gateway</artifactId>
</dependency>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

# application.yml
spring:
  cloud:
    gateway:
      routes:
        - id: user-service
          uri: lb://user-service           # lb:// = LoadBalancer 服务发现
          predicates:
            - Path=/api/user/**            # 路径匹配
          filters:
            - StripPrefix=2                # 去掉 /api/user 前缀
            - AddRequestHeader=X-Request-Id, ${UUID}
            - CircuitBreaker=myCircuitBreaker

        - id: order-service
          uri: lb://order-service
          predicates:
            - Path=/api/order/**
            - Method=POST,PUT
          filters:
            - StripPrefix=2
            - Retry=3                       # 重试 3 次

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

@Component
public class GlobalAuthFilter implements GlobalFilter, Ordered {

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        ServerHttpRequest request = exchange.getRequest();
        String token = request.getHeaders().getFirst("Authorization");

        // 1. 白名单（无需 token）
        String path = request.getPath().value();
        if (path.startsWith("/api/auth/") || path.startsWith("/api/public/")) {
            return chain.filter(exchange);
        }

        // 2. 校验 token
        if (token == null || !validateToken(token)) {
            ServerHttpResponse response = exchange.getResponse();
            response.setStatusCode(HttpStatus.UNAUTHORIZED);
            return response.setComplete();
        }

        // 3. 传递用户信息给下游服务
        ServerHttpRequest mutated = request.mutate()
            .header("X-User-Id", extractUserId(token))
            .build();
        return chain.filter(exchange.mutate().request(mutated).build());
    }

    @Override
    public int getOrder() {
        return -100;  // 数字越小越早执行
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

@Configuration
public class CorsConfig {

    @Bean
    public CorsWebFilter corsFilter() {
        CorsConfiguration config = new CorsConfiguration();
        config.addAllowedOriginPattern("*");
        config.addAllowedHeader("*");
        config.addAllowedMethod("*");
        config.setAllowCredentials(true);
        config.setMaxAge(3600L);

        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", config);
        return new CorsWebFilter(source);
    }
}

1
2
3
4
5
6
7
8

<dependency>
    <groupId>com.alibaba.cloud</groupId>
    <artifactId>spring-cloud-starter-alibaba-nacos-discovery</artifactId>
</dependency>
<dependency>
    <groupId>com.alibaba.cloud</groupId>
    <artifactId>spring-cloud-starter-alibaba-nacos-config</artifactId>
</dependency>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

spring:
  application:
    name: user-service
  cloud:
    nacos:
      discovery:
        server-addr: {{NACOS_HOST}}:8848
        namespace: prod
        username: {{NACOS_USER}}
        password: {{NACOS_PASSWORD}}
      config:
        server-addr: {{NACOS_HOST}}:8848
        file-extension: yaml
        refresh-enabled: true
        shared-configs:
          - data-id: common.yaml
            refresh: true

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

@RestController
@RefreshScope   // 关键注解：nacos 配置变更时自动刷新 @Value
public class OrderController {

    @Value("${order.timeout:30}")
    private int timeout;

    @GetMapping("/timeout")
    public String getTimeout() {
        return "当前超时时间: " + timeout + " 秒";
    }
}

1
2
3
4
5
6
7

# 节点 1
sh startup.sh -m standalone          # 单机模式（仅测试）
sh startup.sh -m cluster             # 集群模式（生产）

# application.properties
nacos.cluster.name=Cluster-A
nacos.member.list=192.168.1.1:8848,192.168.1.2:8848,192.168.1.3:8848

1
2
3
4

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

1
2
3
4
5
6

spring:
  security:
    user:
      name: admin
      password: {{ADMIN_PASSWORD}}   # 实际值从 Nacos 配置中心读取
      roles: ADMIN

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable())
            .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/auth/**", "/api/public/**").permitAll()
                .anyRequest().authenticated()
            )
            .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class);

        return http.build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

@Component
public class JwtAuthFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
            throws ServletException, IOException {
        String token = request.getHeader("Authorization");
        if (token != null && token.startsWith("Bearer ")) {
            String jwt = token.substring(7);
            try {
                Claims claims = Jwts.parser()
                    .verifyWith(Keys.hmacShaKeyFor(secret.getBytes()))
                    .build()
                    .parseSignedClaims(jwt)
                    .getPayload();

                String username = claims.getSubject();
                List<String> roles = claims.get("roles", List.class);

                List<SimpleGrantedAuthority> authorities = roles.stream()
                    .map(r -> new SimpleGrantedAuthority("ROLE_" + r))
                    .collect(Collectors.toList());

                UsernamePasswordAuthenticationToken auth =
                    new UsernamePasswordAuthenticationToken(username, null, authorities);
                SecurityContextHolder.getContext().setAuthentication(auth);
            } catch (Exception e) {
                // token 无效
            }
        }
        chain.doFilter(request, response);
    }
}

1
2
3
4

<dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-starter-openfeign</artifactId>
</dependency>

1
2
3
4
5
6
7
8
9

@FeignClient(name = "order-service", fallback = OrderClientFallback.class)
public interface OrderClient {

    @GetMapping("/api/order/{userId}")
    Result<List<Order>> listByUser(@PathVariable Long userId);

    @PostMapping("/api/order")
    Result<Order> create(@RequestBody OrderDTO order);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

@RestController
public class UserController {

    @Autowired
    private OrderClient orderClient;

    @GetMapping("/user/{id}/orders")
    public Result<List<Order>> getUserOrders(@PathVariable Long id) {
        return orderClient.listByUser(id);
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

@Component
public class OrderClientFallback implements OrderClient {

    @Override
    public Result<List<Order>> listByUser(Long userId) {
        return Result.fail("订单服务不可用，请稍后重试");
    }

    @Override
    public Result<Order> create(OrderDTO order) {
        return Result.fail("订单创建失败");
    }
}

1
2
3
4

<dependency>
    <groupId>com.alibaba.cloud</groupId>
    <artifactId>spring-cloud-starter-alibaba-sentinel</artifactId>
</dependency>

1
2
3
4
5

docker run -d \
  -p 8858:8858 \
  -p 8719:8719 \
  --name sentinel-dashboard \
  bladex/sentinel-dashboard:1.8.6

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

@PostConstruct
public void initFlowRules() {
    List<FlowRule> rules = new ArrayList<>();
    FlowRule rule = new FlowRule("userService");
    rule.setGrade(RuleConstant.FLOW_GRADE_QPS);
    rule.setCount(100);                // QPS 阈值
    rule.setLimitApp("default");
    rules.add(rule);
    FlowRuleManager.loadRules(rules);
}

1
2
3
4
5
6
7
8

<dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-starter-sleuth</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.zipkin</groupId>
    <artifactId>zipkin-reporter-brave</artifactId>
</dependency>

1
2
3
4
5
6

spring:
  zipkin:
    base-url: http://{{ZIPKIN_HOST}}:9411
  sleuth:
    sampler:
      probability: 0.1    # 采样率 10%

1
2
3
4

<dependency>
    <groupId>org.springframework.ai</groupId>
    <artifactId>spring-ai-openai-spring-boot-starter</artifactId>
</dependency>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

@RestController
public class ChatController {

    private final ChatClient chatClient;

    public ChatController(ChatClient.Builder builder) {
        this.chatClient = builder.build();
    }

    @GetMapping("/chat")
    public String chat(@RequestParam String message) {
        return chatClient.prompt()
            .user(message)
            .call()
            .content();
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

spring:
  cloud:
    stream:
      bindings:
        output:
          destination: orders
          content-type: application/json
      kafka:
        binder:
          brokers: kafka:9092
          configuration:
            compression.type: zstd       # 2024+ 默认压缩
            linger.ms: 20

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

Java 后端服务（ToB、传统企业）
├── JDK 17 / 21
├── Spring Boot 3.4 / 3.5
├── Spring Cloud 2024.0.x / 2025.0.x
├── Spring Cloud Alibaba 2023.0.x
│   ├── Nacos 2.3+ (注册 + 配置)
│   ├── Sentinel 1.8.8+ (熔断限流)
│   ├── Seata 2.x (分布式事务)
│   └── RocketMQ 5.x (消息)
├── Spring Cloud Gateway 4.x (网关)
├── OpenFeign 4.x (RPC)
├── Resilience4j 2.x (熔断，替代 Hystrix)
├── Micrometer + Prometheus + Grafana (监控)
├── OpenTelemetry (Tracing)
└── Spring AI 1.0 (AI 能力，可选)