Talofa! Talu ai nei, o le tele o mea faigaluega faʻaautomatika ua faʻasalalau uma mo le fausiaina o ata Docker ma mo le faʻapipiʻiina i Kubernetes. I lenei tulaga, na ou filifili e taʻalo faʻatasi ma GitLab, suʻesuʻe maeʻaeʻa ona gafatia ma, ioe, faʻatulagaina le paipa.

O lenei galuega na musuia e le upega tafaʻilagi kubernetes.io, lea e gaosia mai fa'ailoga puna otometi, ma mo talosaga vaita'ele ta'itasi e lafo, e otometi lava ona fa'atupuina e le robot se fa'aaliga muamua o le 'upega tafa'ilagi ma au suiga ma tu'uina atu se feso'ota'iga mo le matamataina.

Sa ou taumafai e fausia se faiga tutusa mai le maasiasi, ae na fausia atoa i luga o le Gitlab CI ma meafaigaluega e leai se totogi e masani ona ou faʻaaogaina e faʻapipiʻi ai talosaga i Kubernetes. O le asō o le a mulimuli ane ou ta'u atu ia te oe nisi mea e uiga ia i latou.

O le a talanoaina e le tusiga meafaigaluega e pei o:
Hugo, qbec, kaniko, git-crypt и GitLab CI fa'atasi ai ma le fa'atupuina o si'osi'omaga malolosi.

Anotusi

1. Feiloai ia Hugo
2. Saunia le Dockerfile
3. Fa'amasani i le kaniko
4. Malamalama i le qbec
5. Taumafai Gitlab-runner ma Kubernetes-executor
6. Fa'apipi'i siata foeuli i le qbec
7. Faʻailoa git-crypt
8. Fausia se ata o mea faigaluega
9. O le matou paipa muamua ma le faʻapipiʻiina o ata e ala i pine
10. Otometi fa'aogaina
11. Meafaitino ma faʻapotopotoga pe a tulei i le matai
12. Siosiomaga malosi
13. Toe iloilo Apps

1. Malamalama ia Hugo

O se faʻataʻitaʻiga o la matou poloketi, o le a matou taumafai e fausia se nofoaga faʻasalalau faʻamaumauga na fausia i luga o Hugo. O Hugo o se fa'atupu mea fa'apitoa.

Mo i latou e le masani i afi eletise, o le a ou taʻu atu ia te oe sina mea itiiti e uiga ia i latou. E le pei o masini 'upega tafaʻilagi masani faʻatasi ma se faʻamaumauga ma nisi PHP, lea, pe a talosagaina e se tagata faʻaoga, faʻapipiʻi itulau i luga o le lele, o generators static ua mamanuina e fai si ese. Latou te faʻatagaina oe e suʻe punaoa, e masani lava o se seti o faila i Markdown faʻailoga ma faʻataʻitaʻiga autu, ona tuʻufaʻatasia lea i totonu o se upega tafaʻilagi maeʻa maeʻa.

O lona uiga, o se taunuuga, o le ae mauaina se fausaga faʻatonu ma se seti o faila faila HTML, lea e mafai ona e faʻapipiʻiina i soʻo se talimalo taugofie ma maua se upega tafaʻilagi galue.

E mafai ona e faʻapipiʻi Hugo i le lotoifale ma faʻataʻitaʻi:

Amataina se saite fou:

hugo new site docs.example.org

Ma i le taimi lava e tasi o le git repository:

cd docs.example.org
git init

E oʻo mai i le taimi nei, o la matou 'upega tafaʻilagi e mama ma ina ia mafai ona faʻaalia se mea i luga, e manaʻomia muamua ona matou faʻafesoʻotaʻi se autu; o se autu naʻo se seti o faʻataʻitaʻiga ma tulafono faʻapitoa e faʻatupuina ai la matou saite.

Mo le autu o le a matou faʻaaogaina aoao, lea, i loʻu manatu, e fetaui lelei mo se nofoaga faʻamaumauga.

Ou te fia gauai faapitoa atu i le mea moni tatou te le manaʻomia le teuina o faila autu i totonu o la tatou fale teu oloa; nai lo lena, e mafai ona tatou faʻafesoʻotaʻi faʻaoga git submodule:

git submodule add https://github.com/matcornic/hugo-theme-learn themes/learn

O le mea lea, o la matou fale teu oloa o le a naʻo faila e fesoʻotaʻi saʻo i la matou poloketi, ma o le autu fesoʻotaʻi o le a tumau pea o se fesoʻotaʻiga i se fale teu oloa ma se tautinoga i totonu, o lona uiga, e mafai ona toso mai i le amataga ma aua le fefe suiga le fetaui.

Tatou faasa'o le config config.toml:

baseURL = "http://docs.example.org/"
languageCode = "en-us"
title = "My Docs Site"
theme = "learn"

Ua i ai i le laasaga lea e mafai ona e tamoe:

hugo server

Ma i le tuatusi http://localhost:1313/ siaki la matou 'upega tafaʻilagi fou na faia, o suiga uma na faia i totonu o le lisi faʻafouina otometi le itulau tatala i le browser, faigofie tele!

Tatou taumafai e fai se itulau faavaa i totonu anotusi/_index.md:

# My docs site

## Welcome to the docs!

You will be very smart :-)

Ata o le itulau fou na faia

Ina ia fatuina se saite, naʻo le taʻavale:

hugo

Fa'amaumauga o fa'amaumauga lautele/ ma o le a avea ma au upega tafaʻilagi.
Ioe, o le ala, tatou vave fa'aopoopo i ai .gitignore:

echo /public > .gitignore

Aua nei galo e fai a matou suiga:

git add .
git commit -m "New site created"

2. Saunia le Dockerfile

Ua oʻo i le taimi e faʻamatala ai le fausaga o la matou fale teu oloa. E masani ona ou faʻaaogaina se mea e pei o:

.
├── deploy
│   ├── app1
│   └── app2
└── dockerfiles
    ├── image1
    └── image2

• faila faila/ - o loʻo i ai faʻamaumauga ma Dockerfiles ma mea uma e manaʻomia mo le fausiaina o tatou ata Docker.
• fa'apipi'i/ - o lo'o i ai fa'atonuga mo le fa'apipi'iina o a matou talosaga i Kubernetes

O le mea lea, o le a matou fatuina la matou Dockerfile muamua i luga o le ala dockerfiles/website/Dockerfile

FROM alpine:3.11 as builder
ARG HUGO_VERSION=0.62.0
RUN wget -O- https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_${HUGO_VERSION}_linux-64bit.tar.gz | tar -xz -C /usr/local/bin
ADD . /src
RUN hugo -s /src

FROM alpine:3.11
RUN apk add --no-cache darkhttpd
COPY --from=builder /src/public /var/www
ENTRYPOINT [ "/usr/bin/darkhttpd" ]
CMD [ "/var/www" ]

E pei ona e vaʻaia, o le Dockerfile e lua FROM, ua ta'ua lea avanoa fau-vaega fa'aopoopo ma faʻatagaina oe e faʻateʻaina mea uma e le manaʻomia mai le ata mulimuli o le docker.
O lea la, o le ata mulimuli o le a na'o le iai pogisahttpd (mamafa HTTP server) ma lautele/ - o mea o lo'o i totonu o la matou 'upega tafaʻilagi faʻavae.

Aua nei galo e fai a matou suiga:

git add dockerfiles/website
git commit -m "Add Dockerfile for website"

3. Ia iloa le kaniko

I le avea ai ma se fau ata Docker, na ou filifili e faʻaaoga kaniko, talu ai o lona faʻagaioiga e le manaʻomia ai se docker daemon, ma o le fausiaina lava ia e mafai ona faʻatinoina i luga o soʻo se masini ma e mafai ona teuina saʻo le cache i totonu o le resitala, ma faʻaumatia ai le manaʻoga e iai se teuina tumau.

Ina ia fausia le ata, naʻo le taʻavale le koneteina ma kaniko executor ma pasi atu i le tulaga o loʻo iai nei; e mafai foi ona faia i le lotoifale, e ala i le docker:

docker run -ti --rm 
  -v $PWD:/workspace 
  -v ~/.docker/config.json:/kaniko/.docker/config.json:ro 
  gcr.io/kaniko-project/executor:v0.15.0 
  --cache 
  --dockerfile=dockerfiles/website/Dockerfile 
  --destination=registry.gitlab.com/kvaps/docs.example.org/website:v0.0.1

le mea registry.gitlab.com/kvaps/docs.example.org/website - le igoa o lau faʻailoga faʻailoga; a maeʻa le fausiaina, o le a otometi lava ona faʻalauiloa i totonu o le resitala o le docker.

Parakalafa --cache faʻatagaina oe e faʻapipiʻi faʻamau i totonu o le resitala o loʻo tuʻuina atu; mo le faʻataʻitaʻiga na tuʻuina atu, o le a faʻasaoina i totonu registry.gitlab.com/kvaps/docs.example.org/website/cache, ae e mafai ona e faʻamaonia se isi auala e faʻaaoga ai le parakalafa --cache-repo.

Ata o le docker-registry

4. Ia iloa qbec

Qbec ose meafaigaluega fa'apipi'i e fa'ataga ai oe e fa'amatala fa'ailoa lau fa'aaliga tusi talosaga ma tu'u atu i Kubernetes. O le fa'aaogaina o le Jsonnet e fai ma fa'asologa autu e mafai ai e oe ona fa'afaigofie tele le fa'amatalaga o eseesega i le tele o si'osi'omaga, ma e toetoe lava a fa'ate'aina atoa le toe fai tulafono.

E mafai ona moni lenei mea i tulaga e te manaʻomia ai le faʻapipiʻiina o se talosaga i le tele o fuifui ma faʻamaufaʻailoga eseese ma manaʻo e faʻamatala manino i latou i Git.

Qbec e faʻatagaina foi oe e tuʻuina atu siata Helm e ala i le tuʻuina atu ia i latou o tapulaʻa manaʻomia ona faʻaogaina lea i le auala tutusa e pei o faʻaaliga masani, e aofia ai le mafai ona e faʻaogaina suiga eseese ia i latou, ma o lenei, i le isi itu, e mafai ai ona e faʻaumatia le manaʻoga e fa'aaoga le ChartMuseum. O lona uiga, e mafai ona e teuina ma tuʻu saʻo siata mai le git, le mea e iai.

E pei ona ou fai atu muamua, o le a matou teuina uma faʻapipiʻi i totonu o le lisi fa'apipi'i/:

mkdir deploy
cd deploy

Se'i amata la tatou talosaga muamua:

qbec init website
cd website

O lea la o le fausaga o la matou talosaga e pei o lenei:

.
├── components
├── environments
│   ├── base.libsonnet
│   └── default.libsonnet
├── params.libsonnet
└── qbec.yaml

sei o tatou tilotilo i le faila qbec.yaml:

apiVersion: qbec.io/v1alpha1
kind: App
metadata:
  name: website
spec:
  environments:
    default:
      defaultNamespace: docs
      server: https://kubernetes.example.org:8443
  vars: {}

O iinei tatou te matua fiafia i ai spec.siosiomaga, qbec ua uma ona fatuina se siosiomaga le lelei mo i matou ma ave le tuatusi server, faʻapea foʻi ma le igoa avanoa mai le matou kubeconfig o iai nei.
I le taimi nei pe a faʻapipiʻiina i Leai se totogi siosiomaga, qbec o le a faʻapipiʻiina i taimi uma naʻo le faʻapipiʻi Kubernetes faʻapipiʻi ma le igoa faʻapitoa, o lona uiga, e te le toe tau fesuiaʻi i le va o faʻamatalaga ma igoa avanoa e faʻatino ai se faʻaogaina.
Afai e manaʻomia, e mafai ona e faʻafouina i taimi uma tulaga i lenei faila.

O au siosiomaga uma o lo'o fa'amatalaina i totonu qbec.yaml, ma i le faila params.libsonnet, lea o loʻo taʻu mai ai le mea e maua ai faʻamaufaʻailoga mo latou.

O le isi mea matou te vaʻai i faʻamaumauga e lua:

• vaega / - o faʻaaliga uma mo la matou talosaga o le a teuina iinei; e mafai ona faʻamatalaina uma i le jsonnet ma faila masani yaml
• siosiomaga/ - o iinei o le a tatou faʻamatalaina uma fesuiaiga (parameters) mo o tatou siosiomaga.

Ona o le faaletonu e lua a matou faila:

• environments/base.libsonnet - o le a aofia ai taʻiala masani mo siosiomaga uma
• environments/default.libsonnet - o lo'o i ai fa'amaufa'ailoga ua fa'asili mo le si'osi'omaga Leai se totogi

tatou tatala environments/base.libsonnet ma faʻaopoopo faʻamau mo la tatou vaega muamua iina:

{
  components: {
    website: {
      name: 'example-docs',
      image: 'registry.gitlab.com/kvaps/docs.example.org/website:v0.0.1',
      replicas: 1,
      containerPort: 80,
      servicePort: 80,
      nodeSelector: {},
      tolerations: [],
      ingressClass: 'nginx',
      domain: 'docs.example.org',
    },
  },
}

Sei o tatou faia foi la tatou vaega muamua vaega/website.jsonnet:

local env = {
  name: std.extVar('qbec.io/env'),
  namespace: std.extVar('qbec.io/defaultNs'),
};
local p = import '../params.libsonnet';
local params = p.components.website;

[
  {
    apiVersion: 'apps/v1',
    kind: 'Deployment',
    metadata: {
      labels: { app: params.name },
      name: params.name,
    },
    spec: {
      replicas: params.replicas,
      selector: {
        matchLabels: {
          app: params.name,
        },
      },
      template: {
        metadata: {
          labels: { app: params.name },
        },
        spec: {
          containers: [
            {
              name: 'darkhttpd',
              image: params.image,
              ports: [
                {
                  containerPort: params.containerPort,
                },
              ],
            },
          ],
          nodeSelector: params.nodeSelector,
          tolerations: params.tolerations,
          imagePullSecrets: [{ name: 'regsecret' }],
        },
      },
    },
  },
  {
    apiVersion: 'v1',
    kind: 'Service',
    metadata: {
      labels: { app: params.name },
      name: params.name,
    },
    spec: {
      selector: {
        app: params.name,
      },
      ports: [
        {
          port: params.servicePort,
          targetPort: params.containerPort,
        },
      ],
    },
  },
  {
    apiVersion: 'extensions/v1beta1',
    kind: 'Ingress',
    metadata: {
      annotations: {
        'kubernetes.io/ingress.class': params.ingressClass,
      },
      labels: { app: params.name },
      name: params.name,
    },
    spec: {
      rules: [
        {
          host: params.domain,
          http: {
            paths: [
              {
                backend: {
                  serviceName: params.name,
                  servicePort: params.servicePort,
                },
              },
            ],
          },
        },
      ],
    },
  },
]

I totonu o lenei faila na matou faʻamatalaina vaega e tolu Kubernetes i le taimi e tasi, o mea nei: Deployment, tautua и Faʻailoga. Afai matou te mananaʻo, e mafai ona matou tuʻuina i latou i vaega eseese, ae i lenei tulaga o le a lava le tasi mo i tatou.

Faʻailoga jsonnet e talitutusa lava ma le json masani, i le mataupu faavae, o le json masani ua uma ona aoga jsonnet, o lea i le taimi muamua atonu e faigofie mo oe ona faʻaogaina auaunaga i luga ole laiga pei o yaml2json e fa'aliliu lau yaml masani i le json, po'o, afai o au vaega e le o iai ni fesuiaiga, ona mafai lea ona fa'amatalaina i foliga o le yaml masani.

A galulue ma jsonnet Ou te matua fautuaina le faʻapipiʻiina o se plugin mo lau faatonu

Mo se faʻataʻitaʻiga, o loʻo i ai se faʻapipiʻi mo vim vim-jsonnet, lea e ki ai le syntax faailoga ma otometi ona faatino jsonnet fmt taimi uma e te faʻasaoina (manaʻomia le faʻapipiʻiina o le jsonnet).

Ua saunia mea uma, ua mafai nei ona tatou amata faʻapipiʻi:

Ina ia vaʻai i mea ua tatou maua, tatou tamoʻe:

qbec show default

I le gaioiga, o le a e vaʻai i faʻaaliga yaml o le a faʻaogaina i le fuifui faaletonu.

Lelei, faʻaaoga nei:

qbec apply default

I le fa'aaliga o le a e va'ai pea i mea o le a faia i lau fuifui, qbec o le a fai atu ia te oe e te malilie i suiga e ala i le taina y o le a mafai ona e faʻamaonia ou faʻamoemoega.

O la matou talosaga ua saunia ma faʻapipiʻiina!

Afai e te faia ni suiga, e mafai lava ona e faia:

qbec diff default

e va'ai pe fa'afefea ona a'afia nei suiga ile fa'apipi'iina o lo'o iai nei

Aua nei galo e fai a matou suiga:

cd ../..
git add deploy/website
git commit -m "Add deploy for website"

5. Taumafai Gitlab-runner ma Kubernetes-executor

Se'i o'o mai talu ai nei na'o le masani na ou fa'aaogaina gitlab-runner i luga o se masini ua uma ona saunia (LXC container) ma atigi poʻo le docker-executor. I le taimi muamua, sa i ai le tele o tagata tamoʻe i le lalolagi atoa ua faʻamatalaina i la matou gitlab. Na latou aoina mai ata fa'atauga mo galuega uma.

Ae pei ona faʻaalia e le faʻataʻitaʻiga, o lenei filifiliga e le sili ona lelei, e le gata i le faʻaogaina ma le saogalemu. E sili atu ma sili atu ona sa'o fa'aleagaga le tu'u ese'ese tagata tamo'e fa'ata'oto mo galuega ta'itasi, po'o si'osi'omaga ta'itasi.

O le mea e lelei ai, e le o se faʻafitauli, talu ai o lea o le a matou faʻapipiʻi gitlab-runner tuusa'o o se vaega o la matou poloketi i totonu lava o Kubernetes.

Ua saunia e Gitlab se siata foeuli ua saunia mo le faʻaogaina o le gitlab-runner i Kubernetes. Pau lava la le mea e tatau ona e faia o le suʻeina faʻailoga lesitala mo le tatou poloketi i totonu Fa'atonu -> CI / CD -> Tagata tamo'e ma tuu atu i le foeuli:

helm repo add gitlab https://charts.gitlab.io

helm install gitlab-runner 
  --set gitlabUrl=https://gitlab.com 
  --set runnerRegistrationToken=yga8y-jdCusVDn_t4Wxc 
  --set rbac.create=true 
  gitlab/gitlab-runner

Afai:

• https://gitlab.com — le tuatusi o lau server Gitlab.
• yga8y-jdCusVDn_t4Wxc - fa'ailoga resitala mo lau poloketi.
• rbac.create=true - tuʻuina atu i le tagata tamoʻe le aofaʻi talafeagai o avanoa e mafai ai ona fatuina pods e faʻatino ai a tatou galuega e faʻaaoga ai le kubernetes-executor.

Afai e sa'o mea uma, e tatau ona e va'ai i se tagata tamo'e resitala i le vaega Tagata tamoe, i au faatulagaga o galuega faatino.

Ata o le tagata tamo'e faaopoopo

Pe faigofie ea? - ioe, e faigofie tele! Leai se fa'alavelave i le resitalaina ma le lima o tagata tamo'e, mai le taimi nei o le a fa'atupu ma fa'aumatia fa'atamaia.

6. Fa'apipi'i siata Helm ile QBEC

Talu ai na matou filifili e mafaufau gitlab-runner vaega o la matou poloketi, ua oʻo i le taimi e faʻamatala ai i totonu o le matou Git repository.

E mafai ona matou faʻamatalaina o se vaega eseese website, ae i le lumanaʻi matou te fuafua e faʻapipiʻi kopi eseese website e masani lava, e le pei gitlab-runner, lea o le a fa'apipi'iina na'o le tasi i le kulupu Kubernetes. Se'i o tatou amataina se isi talosaga mo ia:

cd deploy
qbec init gitlab-runner
cd gitlab-runner

O le taimi la lenei o le a matou le fa'amatalaina ma le lima ia vaega Kubernetes, ae o le a ave se siata Helm ua saunia. O se tasi o itu lelei o le qbec o le mafai lea ona tu'u sa'o siata Helm mai se fale teu oloa Git.

Sei o tatou faʻafesoʻotaʻi e faʻaaoga ai le git submodule:

git submodule add https://gitlab.com/gitlab-org/charts/gitlab-runner vendor/gitlab-runner

O lea la le lisi tagata fa'atau/gitlab-runner E i ai le matou fale teu oloa ma se siata mo gitlab-runner.

I se auala talitutusa, e mafai ona e faʻafesoʻotaʻi isi fale teu oloa, mo se faʻataʻitaʻiga, le faleoloa atoa ma siata aloaia https://github.com/helm/charts

Sei o tatou faamatalaina le vaega vaega/gitlab-runner.jsonnet:

local env = {
  name: std.extVar('qbec.io/env'),
  namespace: std.extVar('qbec.io/defaultNs'),
};
local p = import '../params.libsonnet';
local params = p.components.gitlabRunner;

std.native('expandHelmTemplate')(
  '../vendor/gitlab-runner',
  params.values,
  {
    nameTemplate: params.name,
    namespace: env.namespace,
    thisFile: std.thisFile,
    verbose: true,
  }
)

O le finauga muamua i expandHelmTemplate tatou pasi le ala i le siata, ona params.values, lea tatou te ave mai le si'osi'omaga tapula'a, ona sau ai lea o le mea ma

• igoaTemplate - fa'asa'oloto suafa
• igoa igoa — ua tuu atu le igoa i le foeuli
• lenei faila - o se parakalafa manaʻomia e pasia le ala i le faila o loʻo iai nei
• veape - faʻaalia le faʻatonuga mamanu foeuli faatasi ai ma finauga uma pe a tuuina atu le siata

Se'i o tatou fa'amatala ia ta'otoga mo la tatou vaega i totonu environments/base.libsonnet:

local secrets = import '../secrets/base.libsonnet';

{
  components: {
    gitlabRunner: {
      name: 'gitlab-runner',
      values: {
        gitlabUrl: 'https://gitlab.com/',
        rbac: {
          create: true,
        },
        runnerRegistrationToken: secrets.runnerRegistrationToken,
      },
    },
  },
}

Faʻalogo lelei runnerRegistrationToken matou te ave mai se faila i fafo mealilo/base.libsonnet, se'i tatou faia:

{
  runnerRegistrationToken: 'yga8y-jdCusVDn_t4Wxc',
}

Sei o tatou siaki pe aoga mea uma:

qbec show default

afai o loʻo lelei mea uma, ona mafai lea ona matou tapeina le matou faʻasalalauga muamua e ala i le Helm:

helm uninstall gitlab-runner

ma faʻapipiʻi i le auala lava e tasi, ae ala i le qbec:

qbec apply default

7. Folasaga ile git-crypt

Git-crypt o se meafaigaluega e mafai ai ona e setiina faʻamatalaga manino mo lau fale teu oloa.

I le taimi nei, o la matou faʻatonuga mo le gitlab-runner e pei o lenei:

.
├── components
│   ├── gitlab-runner.jsonnet
├── environments
│   ├── base.libsonnet
│   └── default.libsonnet
├── params.libsonnet
├── qbec.yaml
├── secrets
│   └── base.libsonnet
└── vendor
    └── gitlab-runner (submodule)

Ae o le teuina o mealilo i Git e le saogalemu, a ea? E tatau la ona tatou fa'aigoa lelei.

E masani lava, mo le lelei o se tasi fesuiaiga, e le talafeagai i taimi uma. E mafai ona e fesiitai mealilo i qbec ma e ala i fesuiaiga o le siosiomaga o lau faiga CI.
Ae e taua le maitauina o loʻo iai foʻi galuega faʻalavelave e mafai ona aofia ai le tele o isi mealilo; faʻafeiloaʻi uma i suiga o le siosiomaga o le a matua faigata lava.

E le gata i lea, i lenei tulaga o le a le mafai ona ou taʻuina atu ia te oe se meafaigaluega matagofie e pei o git-crypt.

git-crypt E faigofie foi ona e faʻatagaina oe e faʻasaoina le tala faasolopito atoa o mealilo, faʻapea foʻi ma faʻatusatusa, tuʻufaʻatasia ma foia feteʻenaʻiga i le auala lava e tasi e masani ona tatou faia i le tulaga o Git.

Mea muamua pe a uma ona faʻapipiʻi git-crypt matou te manaʻomia le fausiaina o ki mo la matou fale teu oloa:

git crypt init

Afai ei ai sau ki PGP, ona mafai loa lea ona e faʻaopoopoina oe lava o se tagata faigaluega mo lenei poloketi:

git-crypt add-gpg-user [email protected]

O le auala lea e mafai ai ona e faʻamalo i taimi uma lenei faleoloa e faʻaaoga ai lau ki faʻapitoa.

Afai e leai sau ki PGP ma e te le faʻamoemoeina, ona mafai lea ona e alu i le isi auala ma auina atu i fafo le ki o le poloketi:

git crypt export-key /path/to/keyfile

O le mea lea, so'o se tasi e i ai se fa'atau atu i fafo faila autu o le a mafai ona decrypt lau faleoloa.

Ua oo i le taimi e faatulaga ai la tatou mealilo muamua.
Sei ou faamanatu atu ia te oe o loo tatou i ai pea i le lisi deploy/gitlab-runner/, o lo'o i ai le matou lisi mealilo/, tatou faʻapipiʻi uma faila i totonu, mo lenei mea o le a tatou fatuina ai se faila mealilo/.gitattributes fa'atasi ai ma mea nei:

* filter=git-crypt diff=git-crypt
.gitattributes !filter !diff

E pei ona mafai ona vaʻaia mai le anotusi, o faila uma e ufiufi * o le a tulia git-crypt, vagana ai le tele .gitattributes

E mafai ona matou siakiina lenei mea e ala i le tamoe:

git crypt status -e

O le a avea ma lisi o faila uma i totonu o le faleteuoloa lea e mafai ai ona faʻamalamalama

Pau lava lena, o lea ua mafai nei ona matou faia ma le saogalemu a matou suiga:

cd ../..
git add .
git commit -m "Add deploy for gitlab-runner"

Ina ia poloka se fale teu oloa, tau lava o le tamoe:

git crypt lock

ma o le taimi lava lena o faila uma faʻailoga o le a liua i se mea binary, o le a le mafai ona faitau.
Ina ia decrypt le fale teu oloa, tamoe:

git crypt unlock

8. Fausia se ata o meafaigaluega

O se ata meafaigaluega o se ata ma meafaigaluega uma o le a matou faʻaogaina e faʻaogaina ai la matou poloketi. O le a faʻaaogaina e le Gitlab runner e faʻatino galuega faʻapipiʻi masani.

E faigofie mea uma iinei, tatou faia se mea fou faila faila / pusa meafaigaluega / Dockerfile fa'atasi ai ma mea nei:

FROM alpine:3.11

RUN apk add --no-cache git git-crypt

RUN QBEC_VER=0.10.3 
 && wget -O- https://github.com/splunk/qbec/releases/download/v${QBEC_VER}/qbec-linux-amd64.tar.gz 
     | tar -C /tmp -xzf - 
 && mv /tmp/qbec /tmp/jsonnet-qbec /usr/local/bin/

RUN KUBECTL_VER=1.17.0 
 && wget -O /usr/local/bin/kubectl 
      https://storage.googleapis.com/kubernetes-release/release/v${KUBECTL_VER}/bin/linux/amd64/kubectl 
 && chmod +x /usr/local/bin/kubectl

RUN HELM_VER=3.0.2 
 && wget -O- https://get.helm.sh/helm-v${HELM_VER}-linux-amd64.tar.gz 
     | tar -C /tmp -zxf - 
 && mv /tmp/linux-amd64/helm /usr/local/bin/helm

E pei ona mafai ona e vaʻaia, i lenei ata matou te faʻapipiʻiina uma mea aoga na matou faʻaaogaina e faʻaogaina ai la matou talosaga. Tatou te le manaomia iinei vagana ai kubectl, ae atonu e te manaʻo e taʻalo faʻatasi i le taimi o le faʻatulagaina o paipa.

E le gata i lea, ina ia mafai ona fesoʻotaʻi ma Kubernetes ma faʻapipiʻi i ai, e manaʻomia le faʻatulagaina o se matafaioi mo pods na gaosia e gitlab-runner.

Ina ia faia lenei mea, tatou alu i le lisi ma le gitlab-runner:

cd deploy/gitlab-runner

ma faaopoopo se vaega fou vaega/rbac.jsonnet:

local env = {
  name: std.extVar('qbec.io/env'),
  namespace: std.extVar('qbec.io/defaultNs'),
};
local p = import '../params.libsonnet';
local params = p.components.rbac;

[
  {
    apiVersion: 'v1',
    kind: 'ServiceAccount',
    metadata: {
      labels: {
        app: params.name,
      },
      name: params.name,
    },
  },
  {
    apiVersion: 'rbac.authorization.k8s.io/v1',
    kind: 'Role',
    metadata: {
      labels: {
        app: params.name,
      },
      name: params.name,
    },
    rules: [
      {
        apiGroups: [
          '*',
        ],
        resources: [
          '*',
        ],
        verbs: [
          '*',
        ],
      },
    ],
  },
  {
    apiVersion: 'rbac.authorization.k8s.io/v1',
    kind: 'RoleBinding',
    metadata: {
      labels: {
        app: params.name,
      },
      name: params.name,
    },
    roleRef: {
      apiGroup: 'rbac.authorization.k8s.io',
      kind: 'Role',
      name: params.name,
    },
    subjects: [
      {
        kind: 'ServiceAccount',
        name: params.name,
        namespace: env.namespace,
      },
    ],
  },
]

O le a matou faʻamatalaina foʻi vaega fou i totonu environments/base.libsonnet, lea e foliga mai nei:

local secrets = import '../secrets/base.libsonnet';

{
  components: {
    gitlabRunner: {
      name: 'gitlab-runner',
      values: {
        gitlabUrl: 'https://gitlab.com/',
        rbac: {
          create: true,
        },
        runnerRegistrationToken: secrets.runnerRegistrationToken,
        runners: {
          serviceAccountName: $.components.rbac.name,
          image: 'registry.gitlab.com/kvaps/docs.example.org/toolbox:v0.0.1',
        },
      },
    },
    rbac: {
      name: 'gitlab-runner-deploy',
    },
  },
}

Faʻalogo lelei $.components.rbac.name faasino i igoa mo vaega rbac

Sei o tatou siaki mea ua suia:

qbec diff default

ma faʻaoga a matou suiga i Kubernetes:

qbec apply default

E le gata i lea, aua nei galo e tuʻuina atu a matou suiga i le git:

cd ../..
git add dockerfiles/toolbox
git commit -m "Add Dockerfile for toolbox"
git add deploy/gitlab-runner
git commit -m "Configure gitlab-runner to use toolbox"

9. O la matou paipa muamua ma le faʻapotopotoga o ata e ala i faʻailoga

I le aʻa o le poloketi o le a matou fatuina .gitlab-ci.yml fa'atasi ai ma mea nei:

.build_docker_image:
  stage: build
  image:
    name: gcr.io/kaniko-project/executor:debug-v0.15.0
    entrypoint: [""]
  before_script:
    - echo "{"auths":{"$CI_REGISTRY":{"username":"$CI_REGISTRY_USER","password":"$CI_REGISTRY_PASSWORD"}}}" > /kaniko/.docker/config.json

build_toolbox:
  extends: .build_docker_image
  script:
    - /kaniko/executor --cache --context $CI_PROJECT_DIR/dockerfiles/toolbox --dockerfile $CI_PROJECT_DIR/dockerfiles/toolbox/Dockerfile --destination $CI_REGISTRY_IMAGE/toolbox:$CI_COMMIT_TAG
  only:
    refs:
      - tags

build_website:
  extends: .build_docker_image
  variables:
    GIT_SUBMODULE_STRATEGY: normal
  script:
    - /kaniko/executor --cache --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/dockerfiles/website/Dockerfile --destination $CI_REGISTRY_IMAGE/website:$CI_COMMIT_TAG
  only:
    refs:
      - tags

Faamolemole ia matau matou te faaaogaina GIT_SUBMODULE_STRATEGY: masani mo na galuega e te manaʻomia e faʻamalamalama manino ai le submodules aʻo leʻi faia.

Aua nei galo e fai a matou suiga:

git add .gitlab-ci.yml
git commit -m "Automate docker build"

Ou te manatu e mafai ona tatou taʻua ma le saogalemu lenei mea o se faʻamatalaga v0.0.1 ma faaopoopo le pine:

git tag v0.0.1

O le a matou fa'aopoopoina fa'ailoga i so'o se taimi matou te mana'omia ai le fa'atuina atu o se fa'amatalaga fou. O faʻailoga i ata Docker o le a nonoa i faʻailoga Git. O tuleiga ta'itasi ma se pine fou o le a amataina ai le fausiaina o ata i lenei pine.

Tatou fai git push --tags, ma seʻi o tatou vaʻavaʻai i la tatou paipa muamua:

Ata o le paipa muamua

E taua le faʻaalia o lou mafaufau i le mea moni o le faʻapotopotoga e ala i pine e talafeagai mo le fausiaina o ata o loʻo fai, ae e le talafeagai mo le faʻapipiʻiina o se talosaga i Kubernetes. Talu ai e mafai ona tuʻuina atu faʻailoga fou i tautinoga tuai, i lenei tulaga, o le amataina o le paipa mo latou o le a taʻitaʻia ai le faʻapipiʻiina o le kopi tuai.

Ina ia foia lenei faafitauli, e masani lava o le fausiaina o ata docker e nonoa i pine, ma le faʻapipiʻiina o le talosaga i se lala. aliʻi, lea o lo'o fa'ailogaina ai fa'aliliuga o ata ua aoina. O le mea lea e mafai ai ona e amataina le toe faʻafoʻi i se toe foʻi faigofie aliʻi- lala.

10. Otometi o le faʻapipiʻiina

Ina ia mafai e Gitlab-runner ona faʻasese a matou mealilo, matou te manaʻomia le auina atu i fafo o le fale teu oloa ma faʻaopopo i a matou suiga ole siosiomaga CI:

git crypt export-key /tmp/docs-repo.key
base64 -w0 /tmp/docs-repo.key; echo

Matou te faʻasaoina le laina iʻuga i Gitlab; e fai lenei mea, seʻi o tatou alu i la matou faʻatulagaga o galuega:
Fa'atonu -> CI / CD -> Fesuia'iga

Ma se'i tatou faia se suiga fou:

ituaiga
Key
tāua
puipuia
Masked
aotelega

File
GITCRYPT_KEY
<your string>
true (i le taimi o toleniga e te mafaia false)
true
All environments

Ata o le fesuiaiga faaopoopo

Ia tatou faafou la tatou .gitlab-ci.yml faaopoopo i ai:

.deploy_qbec_app:
  stage: deploy
  only:
    refs:
      - master

deploy_gitlab_runner:
  extends: .deploy_qbec_app
  variables:
    GIT_SUBMODULE_STRATEGY: normal
  before_script:
    - base64 -d "$GITCRYPT_KEY" | git-crypt unlock -
  script:
    - qbec apply default --root deploy/gitlab-runner --force:k8s-context __incluster__ --wait --yes

deploy_website:
  extends: .deploy_qbec_app
  script:
    - qbec apply default --root deploy/website --force:k8s-context __incluster__ --wait --yes

O iinei ua mafai ai ona matou faia ni filifiliga fou mo qbec:

• --root some/app - e mafai ai ona e fuafuaina le lisi o se talosaga patino
• --force:k8s-context __incluster__ - o se fa'ailoga fa'ataulaitu lea e fai mai o le fa'apipi'iina o le a tupu i totonu o le fuifui lava lea o lo'o tamo'e ai le gtilab-runner. E mana'omia lenei mea aua a leai o le a taumafai qbec e su'e se server Kubernetes talafeagai i lau kubeconfig
• --faatali - fa'amalosi qbec e fa'atali se'ia o'o atu a'oa'oga na te fa'atupuina i le tulaga Sauni ma fa'ato'a alu i fafo ma se fa'ailoga manuia.
• -ioe - na'o le fa'agata o le atigi feso'ota'iga E moʻi lava oe? pe a fa'atulagaina.

Aua nei galo e fai a matou suiga:

git add .gitlab-ci.yml
git commit -m "Automate deploy"

Ma ina ua mavae git tulei o le a matou vaʻai pe faʻapefea ona faʻapipiʻiina a matou talosaga:

Ata o le paipa lona lua

11. Meafaitino ma faʻapotopotoga pe a tulei i le matai

E masani lava, o laasaga o loʻo faʻamatalaina i luga e lava e fausia ma tuʻuina atu toetoe lava o soʻo se microservice, ae matou te le manaʻo e faʻaopoopo se pine i taimi uma matou te manaʻomia ai le faʻafouina o le saite. O le mea lea, o le a matou uia se auala e sili atu le malosi ma faʻatutuina se faʻapipiʻi faʻapipiʻi i totonu o le paranesi matai.

O le manatu e faigofie: o le taimi nei o le ata o tatou website o le a toe fausia i taimi uma e te tuleia i totonu aliʻi, ona fa'apipi'i otometi lea i Kubernetes.

Tatou fa'afouina nei galuega e lua i la tatou .gitlab-ci.yml:

build_website:
  extends: .build_docker_image
  variables:
    GIT_SUBMODULE_STRATEGY: normal
  script:
    - mkdir -p $CI_PROJECT_DIR/artifacts
    - /kaniko/executor --cache --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/dockerfiles/website/Dockerfile --destination $CI_REGISTRY_IMAGE/website:$CI_COMMIT_REF_NAME --digest-file $CI_PROJECT_DIR/artifacts/website.digest
  artifacts:
    paths:
      - artifacts/
  only:
    refs:
      - master
      - tags

deploy_website:
  extends: .deploy_qbec_app
  script:
    - DIGEST="$(cat artifacts/website.digest)"
    - qbec apply default --root deploy/website --force:k8s-context __incluster__ --wait --yes --vm:ext-str digest="$DIGEST"

Faamolemole ia matau ua matou faaopoopo se filo aliʻi к ref mo galuega build_website ma ua tatou faaaogaina nei $CI_COMMIT_REF_NAME nai lo $CI_COMMIT_TAG, o lona uiga, matou te tatalaina mai pine i Git ma o lenei o le a matou tuleia se ata ma le igoa o le lala commit na amataina le paipa. E taua le maitauina o lenei mea o le a aoga foi ma pine, lea e mafai ai ona matou faʻasaoina ata o se nofoaga ma se faʻamatalaga patino i le docker-registry.

Pe a le suia le igoa o le docker tag mo se lomiga fou o le saite, e tatau lava ona tatou faamatalaina suiga i Kubernetes, a leai o le a le toe faʻaaogaina le talosaga mai le ata fou, talu ai o le a le matauina ni suiga i le fa'aaliga fa'apipi'i.

Filifiliga —vm:ext-str digest=”$DIGEST” mo qbec - faʻatagaina oe e pasi se fesuiaiga i fafo i le jsonnet. Matou te mananaʻo e toe faʻapipiʻi i le fuifui ma faʻasalalauga taʻitasi o la matou talosaga. E le mafai ona toe faʻaogaina le igoa faʻailoga, lea e le mafai nei ona suia, talu ai e manaʻomia ona nonoa i se faʻamatalaga patino o le ata ma faʻaosoina le faʻapipiʻiina pe a suia.

O iinei o le a tatou fesoasoani ai i le mafai e Kaniko ona faʻasaoina se ata faʻapipiʻi i se faila (filifiliga --digest-file)
Ona matou faʻafeiloaʻi lea o le faila ma faitau i le taimi o le faʻapipiʻiina.

Se'i fa'afou le fa'asologa mo la tatou deploy/website/environments/base.libsonnet lea o le a foliga mai nei:

{
  components: {
    website: {
      name: 'example-docs',
      image: 'registry.gitlab.com/kvaps/docs.example.org/website@' + std.extVar('digest'),
      replicas: 1,
      containerPort: 80,
      servicePort: 80,
      nodeSelector: {},
      tolerations: [],
      ingressClass: 'nginx',
      domain: 'docs.example.org',
    },
  },
}

Ua mae'a, nei so'o se tautinoga i totonu aliʻi amataina le fausiaina o le ata o lo'o fa'atau mo website, ona faʻapipiʻi lea i Kubernetes.

Aua nei galo e fai a matou suiga:

git add .
git commit -m "Configure dynamic build"

O le a tatou siaki mulimuli ane git tulei e tatau ona tatou vaai i se mea e pei o lenei:

Ata o le paipa mo matai

I le mataupu faavae, tatou te le manaʻomia le toe faʻaleleia o le gitlab-runner i taʻitasi taʻitasi, seivagana, ioe, e leai se mea ua suia i lona faʻatulagaga, seʻi o tatou faʻaleleia i totonu. .gitlab-ci.yml:

deploy_gitlab_runner:
  extends: .deploy_qbec_app
  variables:
    GIT_SUBMODULE_STRATEGY: normal
  before_script:
    - base64 -d "$GITCRYPT_KEY" | git-crypt unlock -
  script:
    - qbec apply default --root deploy/gitlab-runner --force:k8s-context __incluster__ --wait --yes
  only:
    changes:
      - deploy/gitlab-runner/**/*

suiga o le a fa'atagaina oe e mata'ituina suiga i totonu deploy/gitlab-runner/ ma o le a faʻaosoina la tatou galuega pe a iai

Aua nei galo e fai a matou suiga:

git add .gitlab-ci.yml
git commit -m "Reduce gitlab-runner deploy"

git tulei, e sili atu:

Ata o le paipa fa'afou

12. Siosiomaga malosi

Ua o'o i le taimi e fa'avasega ai a tatou paipa ma si'osi'omaga malosi.

Muamua, tatou fa'afou le galuega build_website i totonu o tatou .gitlab-ci.yml, aveese le poloka mai ai ae, lea o le a faʻamalosia Gitlab e faʻaosoina i luga o soʻo se tautinoga i soʻo se lala:

build_website:
  extends: .build_docker_image
  variables:
    GIT_SUBMODULE_STRATEGY: normal
  script:
    - mkdir -p $CI_PROJECT_DIR/artifacts
    - /kaniko/executor --cache --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/dockerfiles/website/Dockerfile --destination $CI_REGISTRY_IMAGE/website:$CI_COMMIT_REF_NAME --digest-file $CI_PROJECT_DIR/artifacts/website.digest
  artifacts:
    paths:
      - artifacts/

Ona faafou lea o le galuega deploy_website, faaopoopo se poloka iina siosiomaga:

deploy_website:
  extends: .deploy_qbec_app
  environment:
    name: prod
    url: https://docs.example.org
  script:
    - DIGEST="$(cat artifacts/website.digest)"
    - qbec apply default --root deploy/website --force:k8s-context __incluster__ --wait --yes --vm:ext-str digest="$DIGEST"

Ole mea lea e mafai ai e Gitlab ona faʻafesoʻotaʻi le galuega gaosiga siosiomaga ma fa'aali le feso'ota'iga sa'o i ai.

Se'i o tatou fa'aopoopo nisi galuega se lua:

deploy_website:
  extends: .deploy_qbec_app
  environment:
    name: prod
    url: https://docs.example.org
  script:
    - DIGEST="$(cat artifacts/website.digest)"
    - qbec apply default --root deploy/website --force:k8s-context __incluster__ --wait --yes --vm:ext-str digest="$DIGEST"

deploy_review:
  extends: .deploy_qbec_app
  environment:
    name: review/$CI_COMMIT_REF_NAME
    url: http://$CI_ENVIRONMENT_SLUG.docs.example.org
    on_stop: stop_review
  script:
    - DIGEST="$(cat artifacts/website.digest)"
    - qbec apply review --root deploy/website --force:k8s-context __incluster__ --wait --yes --vm:ext-str digest="$DIGEST" --vm:ext-str subdomain="$CI_ENVIRONMENT_SLUG" --app-tag "$CI_ENVIRONMENT_SLUG"
  only:
    refs:
    - branches
  except:
    refs:
      - master

stop_review:
  extends: .deploy_qbec_app
  environment:
    name: review/$CI_COMMIT_REF_NAME
    action: stop
  stage: deploy
  before_script:
    - git clone "$CI_REPOSITORY_URL" master
    - cd master
  script:
    - qbec delete review --root deploy/website --force:k8s-context __incluster__ --yes --vm:ext-str digest="$DIGEST" --vm:ext-str subdomain="$CI_ENVIRONMENT_SLUG" --app-tag "$CI_ENVIRONMENT_SLUG"
  variables:
    GIT_STRATEGY: none
  only:
    refs:
    - branches
  except:
    refs:
      - master
  when: manual

O le a fa'alauiloa i luga o so'o se lala se'i vagana le matai ma o le a fa'apipi'i le fa'aaliga muamua o le saite.

Matou te vaʻai i se filifiliga fou mo qbec: --app-tag - e faʻatagaina oe e faʻailogaina faʻamatalaga faʻapipiʻi o le talosaga ma galue naʻo totonu o lenei pine; pe a fatuina ma faʻaumatia punaoa i Kubernetes, qbec o le a naʻo latou.
O le auala lea e le mafai ai ona tatou fatuina se siosiomaga ese mo iloiloga taitasi, ae na o le toe faʻaaogaina o le tasi.

O iinei foi tatou te faaaogaina qbec fa'aaoga iloiloga, nai lo le qbec fa'aoga faaletonu - o le taimi tonu lea o le a tatou taumafai ai e faʻamatala le eseesega mo o tatou siosiomaga (toe iloilo ma faʻaletonu):

Tatou faaopoopo toe iloilo siosiomaga i totonu deploy/website/qbec.yaml

spec:
  environments:
    review:
      defaultNamespace: docs
      server: https://kubernetes.example.org:8443

Ona matou faailoa atu lea i totonu deploy/website/params.libsonnet:

local env = std.extVar('qbec.io/env');
local paramsMap = {
  _: import './environments/base.libsonnet',
  default: import './environments/default.libsonnet',
  review: import './environments/review.libsonnet',
};

if std.objectHas(paramsMap, env) then paramsMap[env] else error 'environment ' + env + ' not defined in ' + std.thisFile

Ma tusi i lalo ta'iala masani mo i totonu deploy/website/environments/review.libsonnet:

// this file has the param overrides for the default environment
local base = import './base.libsonnet';
local slug = std.extVar('qbec.io/tag');
local subdomain = std.extVar('subdomain');

base {
  components+: {
    website+: {
      name: 'example-docs-' + slug,
      domain: subdomain + '.docs.example.org',
    },
  },
}

Se'i o tatou va'ai toto'a fo'i ile jobu taofi_toe iloilo, o le a faʻaosoina pe a tape le lala ma ina ia le taumafai le gitlab e siaki le faʻaaogaina GIT_STRATEGY: leai, mulimuli ane matou clone aliʻi- lala ma tape le iloiloga e ala i ai.
E fai si fenumiai, ae ou te lei mauaina se auala sili atu ona matagofie.
O le isi filifiliga o le tu'uina atu lea o iloiloga ta'itasi i se igoa o le faletalimalo, lea e mafai lava ona fa'aumatia atoa.

Aua nei galo e fai a matou suiga:

git add .
git commit -m "Enable automatic review"

git tulei, git siaki -b su'ega, git push origin test, siaki:

Ata o si'osi'omaga na faia i Gitlab

O lo'o galue mea uma? - lelei, tape le matou lala su'ega: matai siakiina git, git push origin : su'ega, matou te siakiina o galuega faʻamama le siosiomaga na galue e aunoa ma ni mea sese.

O iinei ou te fia faʻamalamalama vave o soʻo se tagata e faia i se poloketi e mafai ona fatuina lala, e mafai foi ona ia suia .gitlab-ci.yml faila ma avanoa fa'alilolilo suiga.
O le mea lea, e fautuaina malosi le faʻatagaina o latou faʻaoga mo na o lala puipuia, mo se faʻataʻitaʻiga i aliʻi, po'o le faia o se seti eseese o fesuiaiga mo siosiomaga taitasi.

13. Toe iloilo Apps

Toe iloilo Apps Ole mea lea ole GitLab e fa'atagaina oe e fa'aopoopo se fa'amau mo faila ta'itasi i totonu o le faleteuoloa e vave va'ai i ai i totonu o se siosiomaga fa'apipi'i.

Ina ia faʻaalia nei faʻamau, e tatau ona e fatuina se faila .gitlab/route-map.yml ma faʻamatalaina suiga uma o auala i totonu; i la matou tulaga o le a matua faigofie lava:

# Indices
- source: /content/(.+?)_index.(md|html)/ 
  public: '1'

# Pages
- source: /content/(.+?).(md|html)/ 
  public: '1/'

Aua nei galo e fai a matou suiga:

git add .gitlab/
git commit -m "Enable review apps"

git tulei, ma siaki:

Ata o le faamau Iloiloga App

Ua uma galuega!

Punaoa o poloketi:

• luga Gitlab: https://gitlab.com/kvaps/docs.example.org
• luga GitHub: https://github.com/kvaps/docs.example.org

Faafetai mo lou gauai mai, ou te faamoemoe na e fiafia i ai

puna: www.habr.com