Kev teeb tsa CD ntawm gitlab

Kuv ib zaug xav txog automating kev xa tawm ntawm kuv qhov project. gitlab.com ua siab zoo muab tag nrho cov cuab yeej rau qhov no, thiab tau kawg kuv txiav txim siab coj kom zoo dua ntawm nws, xam nws tawm thiab sau ntawv me me xa mus. Hauv tsab xov xwm no kuv qhia kuv qhov kev paub dhau los rau cov zej zog.

TL; DR

1. Teem VPS: lov tes taw hauv paus, nkag mus nrog tus password, nruab dockerd, teeb tsa ufw
2. Tsim daim ntawv pov thawj rau server thiab cov neeg siv khoom docs.docker.com/engine/security/https/#create-a-ca-server-and-client-keys-with-openssl Pab kom dockerd tswj ntawm tcp socket: tshem tawm -H fd: // kev xaiv los ntawm docker config.
3. Sau npe mus rau daim ntawv pov thawj hauv docker.json
4. Sau npe nyob rau hauv gitlab variables nyob rau hauv CI / CD teeb tsa nrog cov ntsiab lus ntawm daim ntawv pov thawj. Sau ib tsab ntawv .gitlab-ci.yml rau kev xa tawm.

Kuv yuav qhia tag nrho cov piv txwv ntawm Debian kev faib tawm.

Thawj VPS teeb tsa

Yog li koj yuav ib qho piv txwv ntawm DO, thawj qhov koj yuav tsum tau ua yog tiv thaiv koj lub server los ntawm kev ua phem rau sab nraud. Kuv yuav tsis ua pov thawj lossis lees paub dab tsi, Kuv tsuas yog qhia lub cav /var/log/messages ntawm kuv lub server virtual:

Cov Vijtsam

Ua ntej, nruab ufw firewall:

apt-get update && apt-get install ufw

Cia peb tso cai rau lub neej ntawd txoj cai: thaiv txhua qhov kev sib txuas nkag, tso cai rau txhua qhov kev sib txuas:

ufw default deny incoming
ufw default allow outgoing

Tseem ceeb: tsis txhob hnov ​​​​qab tso cai rau kev sib txuas ntawm ssh:

ufw allow OpenSSH

Cov syntax dav dav yog raws li hauv qab no: Tso cai rau kev sib txuas los ntawm chaw nres nkoj: ufw tso cai 12345, qhov twg 12345 yog tus lej chaw nres nkoj lossis lub npe ntawm qhov kev pabcuam. Tsis lees paub: ufw tsis lees paub 12345

Qhib lub firewall:

ufw enable

Peb tawm ntawm qhov kev sib kho thiab nkag mus dua ntawm ssh.

Ntxiv ib tus neeg siv, muab nws tus password, thiab ntxiv nws mus rau pawg sudo.

apt-get install sudo
adduser scoty
usermod -aG sudo scoty

Tom ntej no, raws li txoj kev npaj, koj yuav tsum lov tes taw tus password nkag. Txhawm rau ua qhov no, luam koj tus yuam sij ssh mus rau lub server:

ssh-copy-id [email protected]

Lub server ip yuav tsum yog koj li. Tam sim no sim nkag mus siv tus neeg siv koj tau tsim ua ntej; koj tsis tas yuav nkag mus rau tus password. Tom ntej no, hauv kev teeb tsa kev teeb tsa, hloov cov hauv qab no:

sudo nano /etc/ssh/sshd_config

disable password nkag mus:

PasswordAuthentication no

Restart sshd daemon:

sudo systemctl reload sshd

Tam sim no yog tias koj lossis lwm tus neeg sim nkag mus ua tus neeg siv hauv paus, nws yuav tsis ua haujlwm.

Tom ntej no, nruab dockerd, Kuv yuav tsis piav qhia txog cov txheej txheem ntawm no, txij li txhua yam tuaj yeem hloov pauv, ua raws li qhov txuas mus rau lub vev xaib raug cai thiab mus dhau cov kauj ruam ntawm kev txhim kho docker ntawm koj lub tshuab virtual: https://docs.docker.com/install/linux/docker-ce/debian/

Tsim daim ntawv pov thawj

Txhawm rau tswj tus docker daemon nyob deb, yuav tsum muaj kev sib txuas TLS encrypted. Ua li no, koj yuav tsum muaj daim ntawv pov thawj thiab tus yuam sij, uas yuav tsum tau tsim thiab xa mus rau koj lub tshuab tej thaj chaw deb. Ua raws li cov kauj ruam tau muab hauv cov lus qhia ntawm lub vev xaib official docker: https://docs.docker.com/engine/security/https/#create-a-ca-server-and-client-keys-with-openssl Tag nrho cov tsim tawm *.pem cov ntaub ntawv rau lub server, xws li ca.pem, server.pem, key.pem, yuav tsum muab tso rau hauv /etc/docker directory ntawm lub server.

Kev teeb tsa dockerd

Hauv docker daemon tso tsab ntawv, peb tshem tawm -H df: // kev xaiv, qhov kev xaiv no txiav txim siab seb tus tswv tsev twg lub docker daemon tuaj yeem tswj tau.

# At /lib/systemd/system/docker.service
[Service]
Type=notify
ExecStart=/usr/bin/dockerd

Tom ntej no, koj yuav tsum tsim cov ntaub ntawv teeb tsa, yog tias nws tseem tsis tau muaj, thiab qhia cov kev xaiv:

/etc/docker/docker.json

{
  "hosts": [
    "unix:///var/run/docker.sock",
    "tcp://0.0.0.0:2376"
  ],
  "labels": [
    "is-our-remote-engine=true"
  ],
  "tls": true,
  "tlscacert": "/etc/docker/ca.pem",
  "tlscert": "/etc/docker/server.pem",
  "tlskey": "/etc/docker/key.pem",
  "tlsverify": true
}

Cia peb tso cai rau kev sib txuas ntawm chaw nres nkoj 2376:

sudo ufw allow 2376

Cia peb rov pib dockerd nrog cov chaw tshiab:

sudo systemctl daemon-reload && sudo systemctl restart docker

Cia peb kuaj:

sudo systemctl status docker

Yog tias txhua yam yog "ntsuab", ces peb xav tias peb tau ua tiav kev teeb tsa docker ntawm lub server.

Teeb tsa kev xa khoom tas mus li ntawm gitlab

Txhawm rau kom tus neeg ua haujlwm Gitalaba tuaj yeem ua tiav cov lus txib ntawm Docker tus tswv tsev nyob deb, nws yuav tsum txiav txim siab yuav ua li cas thiab qhov twg yuav khaws daim ntawv pov thawj thiab tus yuam sij rau kev sib txuas encrypted nrog Dockerd. Kuv tau daws qhov teeb meem no los ntawm kev ntxiv cov hauv qab no rau cov hloov pauv hauv gitlbab nqis:

Spoiler lub npe

Tsuas yog tso tawm cov ntsiab lus ntawm daim ntawv pov thawj thiab qhov tseem ceeb ntawm miv: cat ca.pem. Luam thiab muab tso rau hauv cov nqi sib txawv.

Wb sau tsab ntawv rau kev xa tawm ntawm GitLab. Daim duab docker-in-docker (dind) yuav raug siv.

.gitlab-ci.yml

image:
  name: docker/compose:1.23.2
  # перепишем entrypoint , чтобы работало в dind
  entrypoint: ["/bin/sh", "-c"]

variables:
  DOCKER_HOST: tcp://docker:2375/
  DOCKER_DRIVER: overlay2

services:
  - docker:dind

stages:
  - deploy

deploy:
  stage: deploy
  script:
    - bin/deploy.sh # скрипт деплоя тут

Cov ntsiab lus ntawm cov ntawv xa mus nrog cov lus pom:

bin/deploy.sh

#!/usr/bin/env sh
# Падаем сразу, если возникли какие-то ошибки
set -e
# Выводим, то , что делаем
set -v

# 
DOCKER_COMPOSE_FILE=docker-compose.yml
# Куда деплоим
DEPLOY_HOST=185.241.52.28
# Путь для сертификатов клиента, то есть в нашем случае - gitlab-воркера
DOCKER_CERT_PATH=/root/.docker

# проверим, что в контейнере все имеется
docker info
docker-compose version

# создаем путь (сейчас работаем в клиенте - воркере gitlab'а)
mkdir $DOCKER_CERT_PATH
# изымаем содержимое переменных, при этом удаляем лишние символы добавленные при сохранении переменных.
echo "$CA_PEM" | tr -d 'r' > $DOCKER_CERT_PATH/ca.pem
echo "$CERT_PEM" | tr -d 'r' > $DOCKER_CERT_PATH/cert.pem
echo "$KEY_PEM" | tr -d 'r' > $DOCKER_CERT_PATH/key.pem
# на всякий случай даем только читать
chmod 400 $DOCKER_CERT_PATH/ca.pem
chmod 400 $DOCKER_CERT_PATH/cert.pem
chmod 400 $DOCKER_CERT_PATH/key.pem

# далее начинаем уже работать с удаленным docker-демоном. Собственно, сам деплой
export DOCKER_TLS_VERIFY=1
export DOCKER_HOST=tcp://$DEPLOY_HOST:2376

# проверим, что коннектится все успешно
docker-compose 
  -f $DOCKER_COMPOSE_FILE 
  ps

# логинимся в docker-регистри, тут можете указать свой "местный" регистри
docker login -u $DOCKER_USER -p $DOCKER_PASSWORD

docker-compose 
  -f $DOCKER_COMPOSE_FILE 
  pull app
# поднимаем приложение
docker-compose 
  -f $DOCKER_COMPOSE_FILE 
  up -d app

Qhov teeb meem tseem ceeb yog "rub" cov ntsiab lus ntawm daim ntawv pov thawj hauv daim ntawv ib txwm los ntawm gitlab CI / CD hloov pauv. Kuv tsis tuaj yeem paub tias yog vim li cas qhov kev sib txuas mus rau lub chaw taws teeb tswj tsis ua haujlwm. Ntawm tus tswv tsev kuv ntsia lub log sudo journalctl -u docker, muaj qhov yuam kev thaum tuav tes. Kuv txiav txim siab saib qhov uas feem ntau khaws cia hauv qhov sib txawv; ua qhov no, koj tuaj yeem zoo li no: miv -A $DOCKER_CERT_PATH/key.pem. Kuv kov yeej qhov yuam kev los ntawm kev ntxiv qhov kev tshem tawm ntawm lub carriage cim tr -d 'r'.

Tom ntej no, koj tuaj yeem ntxiv cov haujlwm tom qab tso tawm rau tsab ntawv ntawm koj qhov kev txiav txim siab. Koj tuaj yeem saib cov haujlwm ua haujlwm hauv kuv qhov chaw cia khoom https://gitlab.com/isqad/gitlab-ci-cd

Tau qhov twg los: www.hab.com