微服务高并发限流熔断实战：Sentinel与Resilience4j双引擎方案

微服务高并发限流熔断实战：Sentinel与Resilience4j双引擎方案

微服务架构下，单个服务的过载会通过调用链迅速蔓延，引发级联故障。限流控制入口流量，熔断隔离故障节点，两者配合才能守住系统稳定性底线。Spring Boot微服务生态中有两个主流选择：阿里Sentinel（Java原生，控制台功能丰富）和Resilience4j（轻量级，函数式风格）。实际生产中两者各有短板——Sentinel的熔断恢复策略不够灵活，Resilience4j的限流规则热更新能力弱。这篇文章给出一个双引擎方案：用Sentinel做限流、Resilience4j做熔断，取长补短。

为什么需要双引擎

单引擎方案的痛点：

结论：Sentinel做限流有压倒性优势（规则热更新+丰富算法+控制台），Resilience4j做熔断更精细（半开策略+滑动窗口+函数式编排）。双引擎各取所长。

Sentinel限流配置

Maven依赖

<dependency>
  <groupId>com.alibaba.csp</groupId>
  <artifactId>sentinel-spring-cloud-gateway-adapter</artifactId>
  <version>1.8.8</version>
</dependency>
<dependency>
  <groupId>com.alibaba.csp</groupId>
  <artifactId>sentinel-datasource-nacos</artifactId>
  <version>1.8.8</version>
</dependency>

Gateway限流规则

@Configuration
public class SentinelGatewayConfig {
    public SentinelGatewayConfig() {
        initGatewayRules();
    }

    private void initGatewayRules() {
        Set<GatewayFlowRule> rules = new HashSet<>();

        // API路由限流：每秒最大2000请求
        GatewayFlowRule apiRule = new GatewayFlowRule("api-route")
            .setCount(2000)
            .setIntervalSec(1)
            .setControlBehavior(RuleConstant.CONTROL_BEHAVIOR_RATE_LIMITER)
            .setMaxQueueingTimeoutMs(500);  // 排队超时500ms

        // 热点参数限流：按userId维度限流
        GatewayFlowRule userRule = new GatewayFlowRule("api-route")
            .setCount(50)
            .setIntervalSec(1)
            .setParamItem(new GatewayParamItemItem()
                .setParseStrategy(SentinelGatewayConstants.PARAM_PARSE_STRATEGY_URL)
                .setFieldName("userId")
                .setPattern("\\d+")
            );

        rules.add(apiRule);
        rules.add(userRule);
        GatewayRuleManager.loadRules(rules);
    }
}

Nacos数据源实现规则热更新

@Bean
public ReadableDataSource<String, Set<GatewayFlowRule>> nacosDs() {
    // Nacos配置中心推送限流规则，Sentinel自动加载
    return new NacosDataSource<>(
        "localhost:8848",  // Nacos地址
        "sentinel-gateway",  // group
        "gateway-flow-rules",  // dataId
        source -> JSON.parseObject(source, 
            new TypeReference<Set<GatewayFlowRule>>(){})
    );
}

Resilience4j熔断配置

Maven依赖

<dependency>
  <groupId>io.github.resilience4j</groupId>
  <artifactId>resilience4j-spring-boot3</artifactId>
  <version>2.3.0</version>
</dependency>

application.yml配置

resilience4j:
  circuitbreaker:
    configs:
      default:
        slidingWindowType: COUNT_BASED
        slidingWindowSize: 100          # 滑动窗口大小
        minimumNumberOfCalls: 50        # 最小调用次数
        failureRateThreshold: 50        # 失败率阈值50%
        slowCallDurationThreshold: 3s   # 慢调用判定3秒
        slowCallRateThreshold: 60       # 慢调用率阈值60%
        waitDurationInOpenState: 30s    # 熔断开启等待30秒
        permittedNumberOfCallsInHalfOpenState: 10  # 半开状态放行10个请求
        automaticTransitionFromOpenToHalfOpenEnabled: true
    instances:
      orderService:
        baseConfig: default
        failureRateThreshold: 40        # 订单服务更敏感
        waitDurationInOpenState: 20s
      paymentService:
        baseConfig: default
        failureRateThreshold: 30        # 支付服务最敏感
        permittedNumberOfCallsInHalfOpenState: 5

双引擎集成方案

核心思路：Sentinel在Gateway层做限流（入口控制），Resilience4j在服务调用层做熔断（故障隔离）。两者通过Spring AOP编排：

@Service
public class OrderServiceClient {

    private final CircuitBreaker circuitBreaker;

    public OrderServiceClient(CircuitBreakerRegistry registry) {
        this.circuitBreaker = registry.circuitbreaker("orderService");
    }

    // Sentinel限流注解（Gateway已配置，这里是服务内部调用限流）
    @SentinelResource(value = "getOrder",
        blockHandler = "getOrderBlockHandler",
        fallback = "getOrderFallback")
    public Order getOrder(Long orderId) {
        // Resilience4j熔断包装
        return circuitBreaker.executeSupplier(() -> {
            return orderClient.getOrder(orderId);
        });
    }

    // Sentinel限流降级
    public Order getOrderBlockHandler(Long orderId, BlockException ex) {
        log.warn("Order service rate limited, orderId={}", orderId);
        return Order.empty();
    }

    // Resilience4j熔断降级
    public Order getOrderFallback(Long orderId, Throwable t) {
        log.warn("Order service circuit open, orderId={}", orderId, t);
        return Order.fromCache(orderId);
    }
}

两层防护的执行顺序：

请求 → Gateway Sentinel限流 → 服务调用 → Resilience4j熔断 → 目标服务
         ↓ 限流拒绝              ↓ 熔断开启
       返回429/排队等待        返回降级结果/快速失败

熔断恢复策略调优

熔断恢复是生产环境最容易出问题的环节。半开状态放行过多请求会导致刚恢复的服务再次过载，放行过少则恢复太慢。

渐进式恢复策略

@Component
public class GradualRecovery implements CircuitBreakerEventListener {
    
    private final AtomicInteger probeCount = new AtomicInteger(0);

    @Override
    public void onEvent(CircuitEvent event) {
        if (event.getEventType() == EventType.SUCCESSFUL_CALL
                && event.getStateTransition() == StateTransition.HALF_OPEN_TO_CLOSED) {
            // 从半开恢复到关闭后，渐进增加流量
            // 先50%流量，观察1分钟，再100%
            probeCount.set(0);
            scheduleGradualRecovery();
        }
    }

    private void scheduleGradualRecovery() {
        // 阶段1：50%流量运行60秒
        ScheduledExecutorService scheduler = Executors.newSingleThreadScheduledExecutor();
        scheduler.schedule(() -> {
            if (probeCount.incrementAndGet() < 100) {
                // 保持50%限流
                updateSentinelFlowRule(0.5);
            } else {
                // 阶段2：100%流量
                updateSentinelFlowRule(1.0);
            }
        }, 60, TimeUnit.SECONDS);
    }

    private void updateSentinelFlowRule(double ratio) {
        FlowRule rule = new FlowRule("orderService")
            .setCount((int)(BASE_QPS * ratio))
            .setControlBehavior(RuleConstant.CONTROL_BEHAVIOR_RATE_LIMITER);
        FlowRuleManager.loadRules(Collections.singletonList(rule));
    }
}

监控告警配置

Sentinel和Resilience4j的指标统一汇入Prometheus：

# Sentinel指标暴露（内置exporter）
management:
  endpoints:
    web:
      exposure:
        include: prometheus, sentinel

# Resilience4j指标配置
resilience4j:
  circuitbreaker:
    configs:
      default:
        registerHealthIndicator: true
        recordFailurePredicate: "io.github.resilience4j.core.Predicate"

# Prometheus告警规则
groups:
- name: circuit_breaker_alerts
  rules:
  - alert: CircuitBreakerOpen
    expr: resilience4j_circuitbreaker_state{state="open"} == 1
    for: 30s
    labels:
      severity: critical
    annotations:
      summary: "Circuit breaker {{ $labels.name }} is OPEN"
  - alert: HighRejectionRate
    expr: rate(sentinel_block_total[5m]) / rate(sentinel_total[5m]) > 0.1
    for: 2m
    labels:
      severity: warning
    annotations:
      summary: "Sentinel rejection rate > 10% on {{ $labels.resource }}"

双引擎方案的核心不是功能堆叠，而是职责分离。Sentinel负责流量控制，让系统在高压下优雅降级；Resilience4j负责故障隔离，让系统在下游异常时快速止损。两者在架构层级上天然互补——一个守入口，一个守出口。