Lumela! Haufinyane tjena, lisebelisoa tse ngata tse pholileng tsa automation li lokollotsoe ka bobeli bakeng sa ho aha litšoantšo tsa Docker le ho isoa ho Kubernetes. Tabeng ena, ke ile ka etsa qeto ea ho bapala le GitLab, ho ithuta ka botlalo bokhoni ba eona, 'me, ha e le hantle, ho theha pipeline.

Mosebetsi ona o bululetsoe ke webosaete hobernetes.io, e hlahisoang ke mohloli oa likhoutu ka tsela e iketsang, 'me bakeng sa kopo e' ngoe le e 'ngoe ea letamo e rometsoeng, roboto e iketsetsa mofuta oa ponelopele ea sebaka ka liphetoho tsa hau mme e fana ka sehokelo sa ho boha.

Ke lekile ho theha ts'ebetso e ts'oanang ho tloha qalong, empa e hahiloe ka botlalo ho Gitlab CI le lisebelisoa tsa mahala tseo ke tloaetseng ho li sebelisa ho tsamaisa lits'ebetso ho Kubernetes. Kajeno qetellong ke tla u bolella haholoanyane ka bona.

Sengoliloeng se tla tšohla lisebelisoa tse kang:
Hugo, qbec, kaniko, git-crypt и GitLab CI ka popo ya ditikoloho tse matla.

Litaba

1. Kopana le Hugo
2. Ho lokisa Dockerfile
3. Ho tseba kaniko
4. Ho tseba qbec
5. Ho leka Gitlab-runner le Kubernetes-molai
6. Ho tsamaisa lichate tsa Helm le qbec
7. Ho hlahisa git-crypt
8. Ho etsa setšoantšo sa lebokose la lithulusi
9. Pipe ea rona ea pele le kopano ea litšoantšo ka li-tag
10. Deployment automation
11. Lintho tse entsoeng ka matsoho le kopano ha u sutumelletsa ho tseba
12. Libaka tse matla
13. Hlahloba Lisebelisoa

1. Ho tsebana le Hugo

E le mohlala oa morero oa rona, re tla leka ho theha sebaka sa khatiso sa litokomane se hahiloeng ho Hugo. Hugo ke jenereithara ea litaba tse sa fetoheng.

Bakeng sa ba sa tsebeng lijenereithara tse tsitsitseng, ke tla u bolella ho eketsehileng ka tsona. Ho fapana le lienjineri tse tloaelehileng tsa sebaka sa marang-rang tse nang le database le PHP tse ling, tseo, ha li kopuoa ke mosebelisi, li hlahisa maqephe ka fofa, lijenereithara tse tsitsitseng li entsoe ka tsela e fapaneng hanyane. Ba u lumella ho nka mehloli, hangata sete ea lifaele ho Markdown markup le litempele tsa sehlooho, ebe u li bokella webosaeteng e felileng ka botlalo.

Ke hore, ka lebaka leo, u tla fumana sebopeho sa li-directory le sete sa lifaele tsa HTML tse hlahisitsoeng, tseo u ka li kenyang ho moeti leha e le ofe o theko e tlaase 'me u fumane sebaka sa marang-rang se sebetsang.

U ka kenya Hugo sebakeng sa heno 'me u e leke:

Ho qala sebaka se secha:

hugo new site docs.example.org

Mme ka nako e ts'oanang polokelo ea git:

cd docs.example.org
git init

Ho fihlela joale, sebaka sa rona sa marang-rang se hloekile 'me e le hore ho ka hlaha ntho e itseng ho sona, re lokela ho qala ka ho hokahanya sehlooho; sehlooho ke sete feela sa litempele le melao e boletsoeng eo sebaka sa rona se hlahisoang ka eona.

Bakeng sa sehlooho seo re tla se sebelisa ithutang, eo, ka maikutlo a ka, e loketseng ka ho feletseng bakeng sa sebaka sa litokomane.

Ke kopa ho ela hloko ka ho khetheha taba ea hore ha ho hlokahale hore re boloke lifaele tsa sehlooho sebakeng sa rona sa polokelo ea morero; ho e-na le hoo, re ka e hokahanya feela re sebelisa. git submodule:

git submodule add https://github.com/matcornic/hugo-theme-learn themes/learn

Kahoo, polokelo ea rona e tla ba le lifaele feela tse amanang ka kotloloho le morero oa rona, 'me sehlooho se hokahantsoeng se tla lula e le sehokelo sa polokelo e itseng le boitlamo ho sona, ke hore, se ka huleloa kamehla ho tsoa mohloling oa mantlha mme se sa ts'ohe. liphetoho tse sa tsamaisaneng.

Ha re lokiseng config config.toml:

baseURL = "http://docs.example.org/"
languageCode = "en-us"
title = "My Docs Site"
theme = "learn"

U se u ntse u le mothating ona u ka matha:

hugo server

Le atereseng http://localhost:1313/ sheba sebaka sa rona sa marang-rang se sa tsoa thehoa, liphetoho tsohle tse entsoeng ka har'a bukana li nchafatsa leqephe le bulehileng ho sebatli, li bonolo haholo!

Ha re leke ho theha leqephe la sekoahelo ho content/_index.md:

# My docs site

## Welcome to the docs!

You will be very smart :-)

Setšoantšo sa leqephe le sa tsoa etsoa

Ho etsa sebaka sa marang-rang, matha feela:

hugo

Litaba tsa bukana phatlalatsa/ mme e tla ba webosaete ea hau.
E, ka tsela, a re e kenye hang-hang .gitignore:

echo /public > .gitignore

Se ke oa lebala ho etsa liphetoho tsa rona:

git add .
git commit -m "New site created"

2. Ho lokisa Dockerfile

Ke nako ea ho hlalosa sebopeho sa polokelo ea rona. Hangata ke sebelisa ntho e kang:

.
├── deploy
│   ├── app1
│   └── app2
└── dockerfiles
    ├── image1
    └── image2

• dockerfiles/ - E na le li-directory tse nang le Dockerfiles le tsohle tse hlokahalang bakeng sa ho aha litšoantšo tsa rona tsa Docker.
• tsamaisa/ - e na le li-directory tsa ho romella likopo tsa rona ho Kubernetes

Kahoo, re tla theha Dockerfile ea rona ea pele tseleng dockerfiles/website/Dockerfile

FROM alpine:3.11 as builder
ARG HUGO_VERSION=0.62.0
RUN wget -O- https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_${HUGO_VERSION}_linux-64bit.tar.gz | tar -xz -C /usr/local/bin
ADD . /src
RUN hugo -s /src

FROM alpine:3.11
RUN apk add --no-cache darkhttpd
COPY --from=builder /src/public /var/www
ENTRYPOINT [ "/usr/bin/darkhttpd" ]
CMD [ "/var/www" ]

Joalokaha u bona, Dockerfile e na le tse peli HO TLOHA, tšobotsi ena e bitsoa moaho wa methati e mengata mme e o lumella ho kenyelletsa ntho e 'ngoe le e' ngoe e sa hlokahaleng setšoantšong sa ho qetela sa Docker.
Kahoo, setšoantšo sa ho qetela se tla ba le feela lefifihttpd (seva e bobebe ea HTTP) le phatlalatsa/ - Likahare tsa sebaka sa rona sa Marang-rang se entsoeng ka lipalo.

Se ke oa lebala ho etsa liphetoho tsa rona:

git add dockerfiles/website
git commit -m "Add Dockerfile for website"

3. Ho tseba kaniko

Joaloka sehahi sa setšoantšo sa docker, ke nkile qeto ea ho e sebelisa kaniko, kaha ts'ebetso ea eona ha e hloke daemon ea docker, 'me mohaho ka boeona o ka etsoa mochine ofe kapa ofe mme cache e ka bolokoa ka ho toba ho ngolisoang, kahoo e felisa tlhokahalo ea ho ba le polokelo e tsitsitseng e tsitsitseng.

Ho haha ​​setšoantšo, matha feela setshelo ka kaniko mophethahatsi 'me u e fetise moelelo oa hona joale oa kaho; sena se ka etsoa le sebakeng sa heno, ka docker:

docker run -ti --rm 
  -v $PWD:/workspace 
  -v ~/.docker/config.json:/kaniko/.docker/config.json:ro 
  gcr.io/kaniko-project/executor:v0.15.0 
  --cache 
  --dockerfile=dockerfiles/website/Dockerfile 
  --destination=registry.gitlab.com/kvaps/docs.example.org/website:v0.0.1

Moo registry.gitlab.com/kvaps/docs.example.org/website - lebitso la setšoantšo sa hau sa docker; kamora ho aha, e tla hlahisoa ka bo eona ho ngoliso ea docker.

Parameter --cache e u lumella ho boloka likarolo ho ngoliso ea docker; mohlala o fanoeng, li tla bolokoa ho tsona registry.gitlab.com/kvaps/docs.example.org/website/cache, empa u ka hlalosa tsela e 'ngoe u sebelisa parameter --cache-repo.

Setšoantšo sa skrini sa docker-registry

4. Ho tseba qbec

Qbec ke sesebelisoa sa phepelo se u lumellang hore u hlalose lipapatso tsa hau ka mokhoa o hlakileng le ho li romella ho Kubernetes. Ho sebelisa Jsonnet e le syntax ea sehlooho ho u lumella ho nolofatsa tlhaloso ea liphapang libakeng tse ngata, hape e batla e felisa ka ho feletseng ho pheta-pheta khoutu.

Sena e ka ba 'nete haholo maemong ao ho ona o hlokang ho kenya kopo ho lihlopha tse' maloa tse nang le li-parameter tse fapaneng 'me u batla ho li hlalosa ka mokhoa o hlakileng ho Git.

Qbec e boetse e u lumella ho fana ka lichate tsa Helm ka ho li fetisetsa liparamente tse hlokahalang ebe u li sebelisa ka tsela e ts'oanang le lipontšo tse tloaelehileng, ho kenyelletsa le hore u ka sebelisa liphetoho tse fapaneng ho tsona, 'me sena, se u lumella ho tlosa tlhoko ea sebelisa ChartMuseum. Ke hore, o ka boloka le ho fana ka lichate ka kotloloho ho tsoa ho git, moo li leng teng.

Joalokaha ke boletse pejana, re tla boloka li-deployments tsohle bukeng ea libuka tsamaisa/:

mkdir deploy
cd deploy

Ha re qaleng kopo ea rona ea pele:

qbec init website
cd website

Joale sebopeho sa ts'ebeliso ea rona se shebahala tjena:

.
├── components
├── environments
│   ├── base.libsonnet
│   └── default.libsonnet
├── params.libsonnet
└── qbec.yaml

ha re shebeng faele qbec.yaml:

apiVersion: qbec.io/v1alpha1
kind: App
metadata:
  name: website
spec:
  environments:
    default:
      defaultNamespace: docs
      server: https://kubernetes.example.org:8443
  vars: {}

Mona re thahasella haholo-holo spec.tikoloho, qbec e se e ntse e re thehile tikoloho ea kamehla mme e nkile aterese ea seva, hammoho le sebaka sa mabitso ho tloha ho kubeconfig ea rona ea hajoale.
Hona joale ha u tsamaisa ho ya kamehla tikoloho, qbec e tla lula e sebelisa feela sehlopha se boletsoeng sa Kubernetes le sebakeng se boletsoeng sa mabitso, ke hore, ha u sa tlameha ho fetoha lipakeng tsa maemo le libaka tsa mabitso e le hore u ka tsamaisa.
Haeba ho hlokahala, o ka lula o nchafatsa litlhophiso faeleng ena.

Litikoloho tsohle tsa hau li hlalositsoe ho qbec.yaml, le faeleng params.libsonnet, moo e bolelang hore na ba ka ba fumana hokae.

E latelang re bona li-directory tse peli:

• likarolo / - Lipontšo tsohle tsa ts'ebeliso ea rona li tla bolokoa mona; li ka hlalosoa ka bobeli ho jsonnet le lifaele tse tloaelehileng tsa yaml
• tikoloho/ - mona re tla hlalosa mefuta-futa (parameter) bakeng sa tikoloho ea rona.

Ka tloaelo re na le lifaele tse peli:

• tikoloho/base.libsonnet - e tla ba le liparamente tse tšoanang bakeng sa libaka tsohle
• tikoloho/default.libsonnet - e na le liparamente tse hlokomolohuoang tikolohong ya kamehla

ha re bule tikoloho/base.libsonnet 'me u kenye liparamente bakeng sa karolo ea rona ea pele moo:

{
  components: {
    website: {
      name: 'example-docs',
      image: 'registry.gitlab.com/kvaps/docs.example.org/website:v0.0.1',
      replicas: 1,
      containerPort: 80,
      servicePort: 80,
      nodeSelector: {},
      tolerations: [],
      ingressClass: 'nginx',
      domain: 'docs.example.org',
    },
  },
}

Hape ha re theheng karolo ea rona ea pele likarolo/websaete.jsonnet:

local env = {
  name: std.extVar('qbec.io/env'),
  namespace: std.extVar('qbec.io/defaultNs'),
};
local p = import '../params.libsonnet';
local params = p.components.website;

[
  {
    apiVersion: 'apps/v1',
    kind: 'Deployment',
    metadata: {
      labels: { app: params.name },
      name: params.name,
    },
    spec: {
      replicas: params.replicas,
      selector: {
        matchLabels: {
          app: params.name,
        },
      },
      template: {
        metadata: {
          labels: { app: params.name },
        },
        spec: {
          containers: [
            {
              name: 'darkhttpd',
              image: params.image,
              ports: [
                {
                  containerPort: params.containerPort,
                },
              ],
            },
          ],
          nodeSelector: params.nodeSelector,
          tolerations: params.tolerations,
          imagePullSecrets: [{ name: 'regsecret' }],
        },
      },
    },
  },
  {
    apiVersion: 'v1',
    kind: 'Service',
    metadata: {
      labels: { app: params.name },
      name: params.name,
    },
    spec: {
      selector: {
        app: params.name,
      },
      ports: [
        {
          port: params.servicePort,
          targetPort: params.containerPort,
        },
      ],
    },
  },
  {
    apiVersion: 'extensions/v1beta1',
    kind: 'Ingress',
    metadata: {
      annotations: {
        'kubernetes.io/ingress.class': params.ingressClass,
      },
      labels: { app: params.name },
      name: params.name,
    },
    spec: {
      rules: [
        {
          host: params.domain,
          http: {
            paths: [
              {
                backend: {
                  serviceName: params.name,
                  servicePort: params.servicePort,
                },
              },
            ],
          },
        },
      ],
    },
  },
]

Faeleng ena re hlalositse mekhatlo e meraro ea Kubernetes hang, tsena ke: dulang, Service и Ingress. Haeba re ne re batla, re ka li kenya ka likarolo tse fapaneng, empa mothating ona e le 'ngoe e tla lekana bakeng sa rona.

hokahanngoang jsonnet e ts'oana haholo le json e tloaelehileng, ha e le hantle, json e tloaelehileng e se e ntse e sebetsa jsonnet, kahoo qalong ho ka ba bonolo ho uena ho sebelisa lits'ebeletso tsa inthanete joalo ka yaml2json ho fetolela yaml ea hau e tloaelehileng hore e be json, kapa, haeba likarolo tsa hau li se na lintho tse fapaneng, li ka hlalosoa ka mokhoa oa yaml e tloaelehileng.

Ha u sebetsa le jsonnet Ke khothaletsa haholo ho kenya plugin bakeng sa mohlophisi oa hau

Ka mohlala, ho na le plugin bakeng sa vim vim-jsonnet, e bulelang tlhabollo ea syntax ebe e etsa ka bo eona jsonnet fmt nako le nako ha u boloka (e hloka hore jsonnet e kenngoe).

Tsohle li lokile, joale re ka qala ho tsamaisa:

Ho bona seo re nang le sona, a re mathe:

qbec show default

Ha u tsoa, ​​​​u tla bona li-manifest tsa yaml tse tla sebelisoa ho sehlopha sa kamehla.

E kholo, sebetsa hona joale:

qbec apply default

Ka tlhahiso u tla lula u bona se tla etsoa sehlopheng sa hau, qbec e tla u kopa ho lumellana le liphetoho ka ho thaepa. y o tla tseba ho tiisa maikemisetso a hao.

Sesebelisoa sa rona se se se loketse ebile se sebelisitsoe!

Haeba u etsa liphetoho, u ka etsa:

qbec diff default

ho bona hore na liphetoho tsena li tla ama phepelo ea hona joale joang

Se ke oa lebala ho etsa liphetoho tsa rona:

cd ../..
git add deploy/website
git commit -m "Add deploy for website"

5. Ho leka Gitlab-semathi se nang le Kubernetes-executor

Ho fihlela morao tjena ke ne ke sebelisa kamehla feela gitlab-semathi mochining o lokiselitsoeng esale pele (setshelo sa LXC) se nang le khetla kapa sephethahatsi sa docker. Qalong, re ne re e-na le limathi tse joalo tse 'maloa tse hlalositsoeng lefatšeng ka bophara ho gitlab ea rona. Ba ile ba bokella litšoantšo tsa docker bakeng sa merero eohle.

Empa joalo ka ha tloaelo e bonts'itse, khetho ena ha se eona e loketseng ka ho fetisisa, ka bobeli mabapi le ts'ebetso le polokeho. Ho molemo haholo ebile ho nepahetse haholo ho ba le limathi tse arohaneng tse romelloang projeke ka 'ngoe, kapa tikolohong ka 'ngoe.

Ka lehlohonolo, sena ha se bothata ho hang, kaha joale re tla tsamaisa gitlab-semathi ka kotloloho e le karolo ea morero oa rona ho Kubernetes.

Gitlab e fana ka chate ea helm e lokiselitsoeng ho tsamaisa gitlab-runner ho Kubernetes. Kahoo sohle seo u hlokang ho se etsa ke ho tseba letshwao la ngodiso bakeng sa morero oa rona ho Litlhophiso -> CI / CD -> Limathi mme o e fetisetse mokgweng.

helm repo add gitlab https://charts.gitlab.io

helm install gitlab-runner 
  --set gitlabUrl=https://gitlab.com 
  --set runnerRegistrationToken=yga8y-jdCusVDn_t4Wxc 
  --set rbac.create=true 
  gitlab/gitlab-runner

Moo:

• https://gitlab.com - aterese ea seva sa hau sa Gitlab.
• yga8y-jdCusVDn_t4Wxc - letšoao la ho ngolisa morero oa hau.
• rbac.create=nete - e fa semathi palo e hlokahalang ea litokelo tsa ho khona ho etsa li-pods ho etsa mesebetsi ea rona re sebelisa kubernetes-executor.

Haeba ntho e 'ngoe le e' ngoe e etsoa ka nepo, u lokela ho bona semathi se ngolisitsoeng karolong Bapalami, litlhophisong tsa projeke ea hau.

Setšoantšo sa skrini sa semathi se ekelitsoeng

Na ho bonolo hakaalo? - e, ho bonolo hakaalo! Ha ho sa tla ba le bothata ba ho ngolisa limathi ka letsoho, ho tloha joale ho ea pele limathi li tla etsoa le ho senngoa ka bohona.

6. Kenya lichate tsa Helm le QBEC

Kaha re entse qeto ea ho nahana gitlab-semathi karolo ea morero oa rona, ke nako ea ho e hlalosa sebakeng sa rona sa polokelo ea Git.

Re ka e hlalosa e le karolo e arohaneng websaeteng, empa nakong e tlang re rera ho romela likopi tse fapaneng websaeteng hangata haholo, ho fapana gitlab-semathi, e tla romelloa hang feela ka sehlopha sa Kubernetes. Kahoo ha re qaleng kopo e fapaneng bakeng sa eona:

cd deploy
qbec init gitlab-runner
cd gitlab-runner

Lekhetlong lena re ke ke ra hlalosa mekhatlo ea Kubernetes ka letsoho, empa re tla nka chate ea Helm e lokiselitsoeng. O mong oa melemo ea qbec ke bokhoni ba ho fana ka lichate tsa Helm ka kotloloho ho tsoa polokelong ea Git.

Ha re e hokahaneng re sebelisa git submodule:

git submodule add https://gitlab.com/gitlab-org/charts/gitlab-runner vendor/gitlab-runner

Joale directory morekisi/ gitlab-semathi Re na le polokelo e nang le chate bakeng sa gitlab-runner.

Ka mokhoa o ts'oanang, o ka hokahanya libaka tse ling tsa polokelo, mohlala, polokelo eohle le lichate tsa semmuso https://github.com/helm/charts

Ha re hlalose karolo likarolo/gitlab-runner.jsonnet:

local env = {
  name: std.extVar('qbec.io/env'),
  namespace: std.extVar('qbec.io/defaultNs'),
};
local p = import '../params.libsonnet';
local params = p.components.gitlabRunner;

std.native('expandHelmTemplate')(
  '../vendor/gitlab-runner',
  params.values,
  {
    nameTemplate: params.name,
    namespace: env.namespace,
    thisFile: std.thisFile,
    verbose: true,
  }
)

Khang ea pele ho expandHelmTemplate re fetisa tsela e eang chate, joale litekanyetso.litekanyetso, eo re e nkang ho li-parameter tsa tikoloho, ebe ho tla ntho le eona

• lebitsoTemplate — sehlooho sa tokollo
• namespace - sebaka sa mabitso se fetiselitsoe ho helm
• thisFile - paramethara e hlokahalang e fetisang tsela e eang faeleng ea hajoale
• verbose - e bonts'a taelo Helm template ka likhang tsohle ha ho etsoa chate

Joale a re ke re hlalose liparamente tsa karolo ea rona ho tikoloho/base.libsonnet:

local secrets = import '../secrets/base.libsonnet';

{
  components: {
    gitlabRunner: {
      name: 'gitlab-runner',
      values: {
        gitlabUrl: 'https://gitlab.com/',
        rbac: {
          create: true,
        },
        runnerRegistrationToken: secrets.runnerRegistrationToken,
      },
    },
  },
}

Ela hloko runnerRegistrationToken re nka ho tsoa faeleng ea kantle diphiri/base.libsonnet, ha re e theheng:

{
  runnerRegistrationToken: 'yga8y-jdCusVDn_t4Wxc',
}

Ha re hlahlobeng hore na tsohle lia sebetsa:

qbec show default

haeba tsohle li lokile, re ka hlakola tokollo ea rona e neng e rometsoe pele ka Helm:

helm uninstall gitlab-runner

'me u e sebelise ka tsela e tšoanang, empa ka qbec:

qbec apply default

7. Kenyelletso ea git-crypt

Git-crypt ke sesebelisoa se u lumellang ho theha encryption e hlakileng bakeng sa polokelo ea hau.

Hajoale, sebopeho sa rona sa directory bakeng sa gitlab-runner se shebahala tjena:

.
├── components
│   ├── gitlab-runner.jsonnet
├── environments
│   ├── base.libsonnet
│   └── default.libsonnet
├── params.libsonnet
├── qbec.yaml
├── secrets
│   └── base.libsonnet
└── vendor
    └── gitlab-runner (submodule)

Empa ho boloka liphiri ho Git ha hoa sireletseha, na ha ho joalo? Kahoo re hloka ho li koahela ka mokhoa o nepahetseng.

Hangata, molemong oa phetoho e le 'ngoe, sena hase kamehla se utloahalang. U ka fetisetsa liphiri ho qbec le ka mefuta e fapaneng ea tikoloho ea sistimi ea hau ea CI.
Empa ke habohlokoa ho hlokomela hore ho boetse ho na le merero e rarahaneng e ka ba le liphiri tse ling tse ngata; ho li fetisetsa kaofela ka mefuta-futa ea tikoloho ho tla ba thata haholo.

Ho feta moo, tabeng ena nke ke ka khona ho u bolella ka sesebelisoa se babatsehang joalo ka git-crypt.

git-crypt E boetse e loketse hobane e u lumella ho boloka histori eohle ea liphiri, hammoho le ho bapisa, ho kopanya le ho rarolla likhohlano ka tsela e tšoanang le eo re tloaetseng ho e etsa tabeng ea Git.

Ntho ea pele ka mor'a ho kenya git-crypt re hloka ho hlahisa linotlolo bakeng sa polokelo ea rona:

git crypt init

Haeba u na le senotlolo sa PGP, u ka itlhahisa hang-hang u le mohokahanyi oa morero ona:

git-crypt add-gpg-user [email protected]

Ka tsela ena o ka lula o hlakola polokelo ena o sebelisa senotlolo sa hau sa lekunutu.

Haeba u sena senotlolo sa PGP 'me u sa e lebella, u ka ea ka tsela e' ngoe 'me ua romela senotlolo sa morero:

git crypt export-key /path/to/keyfile

Kahoo, mang kapa mang ea nang le thepa e romelloang kantle ho naha keyfile e tla khona ho hlakola polokelo ea hau.

Ke nako ea ho theha lekunutu la rona la pele.
E-re ke u hopotse hore re ntse re le bukeng deploy/gitlab-runner/, moo re nang le directory liphiri/, ha re kenyelle lifaele tsohle tse ho eona, bakeng sa sena re tla etsa faele diphiri/.gitattributes ka litaba tse latelang:

* filter=git-crypt diff=git-crypt
.gitattributes !filter !diff

Joalokaha ho ka bonoa ho tsoa ho litaba, lifaele tsohle li koahetsoe * e tla khannoa ka git-crypt, ntle le tse ngata .gitattributes

Re ka hlahloba sena ka ho matha:

git crypt status -e

Sephetho e tla ba lethathamo la lifaele tsohle tse polokelong eo encryption e nolofalitsoeng ho eona

Ke phetho, joale re ka etsa liphetoho tsa rona ka mokhoa o sireletsehileng:

cd ../..
git add .
git commit -m "Add deploy for gitlab-runner"

Ho thibela polokelo, matha feela:

git crypt lock

'me hang-hang lifaele tsohle tse patiloeng li tla fetoha ntho ea binary, ho ke ke ha khoneha ho li bala.
Ho hlakola polokelo, tsamaisa:

git crypt unlock

8. Etsa setšoantšo sa lebokose la lithulusi

Setšoantšo sa lebokose la lithulusi ke setšoantšo se nang le lisebelisoa tsohle tseo re tla li sebelisa ho tsamaisa morero oa rona. E tla sebelisoa ke semathi sa Gitlab ho etsa mesebetsi e tloaelehileng ea ho tsamaisa.

Tsohle li bonolo mona, ha re theheng e ncha dockerfiles/toolbox/Dockerfile ka litaba tse latelang:

FROM alpine:3.11

RUN apk add --no-cache git git-crypt

RUN QBEC_VER=0.10.3 
 && wget -O- https://github.com/splunk/qbec/releases/download/v${QBEC_VER}/qbec-linux-amd64.tar.gz 
     | tar -C /tmp -xzf - 
 && mv /tmp/qbec /tmp/jsonnet-qbec /usr/local/bin/

RUN KUBECTL_VER=1.17.0 
 && wget -O /usr/local/bin/kubectl 
      https://storage.googleapis.com/kubernetes-release/release/v${KUBECTL_VER}/bin/linux/amd64/kubectl 
 && chmod +x /usr/local/bin/kubectl

RUN HELM_VER=3.0.2 
 && wget -O- https://get.helm.sh/helm-v${HELM_VER}-linux-amd64.tar.gz 
     | tar -C /tmp -zxf - 
 && mv /tmp/linux-amd64/helm /usr/local/bin/helm

Joalokaha u bona, setšoantšong sena re kenya lisebelisoa tsohle tseo re neng re li sebelisa ho tsamaisa ts'ebeliso ea rona. Ha re e hloke mona ntle le haeba kubctl, empa o kanna oa batla ho bapala le eona nakong ea ho seta lipeipi.

Hape, e le hore re khone ho buisana le Kubernetes le ho e fetisetsa ho eona, re hloka ho lokisa karolo ea li-pods tse hlahisoang ke gitlab-runner.

Ho etsa sena, ha re ee bukeng e nang le gitlab-runner:

cd deploy/gitlab-runner

mme o kenye karolo e ntjha likarolo/rbac.jsonnet:

local env = {
  name: std.extVar('qbec.io/env'),
  namespace: std.extVar('qbec.io/defaultNs'),
};
local p = import '../params.libsonnet';
local params = p.components.rbac;

[
  {
    apiVersion: 'v1',
    kind: 'ServiceAccount',
    metadata: {
      labels: {
        app: params.name,
      },
      name: params.name,
    },
  },
  {
    apiVersion: 'rbac.authorization.k8s.io/v1',
    kind: 'Role',
    metadata: {
      labels: {
        app: params.name,
      },
      name: params.name,
    },
    rules: [
      {
        apiGroups: [
          '*',
        ],
        resources: [
          '*',
        ],
        verbs: [
          '*',
        ],
      },
    ],
  },
  {
    apiVersion: 'rbac.authorization.k8s.io/v1',
    kind: 'RoleBinding',
    metadata: {
      labels: {
        app: params.name,
      },
      name: params.name,
    },
    roleRef: {
      apiGroup: 'rbac.authorization.k8s.io',
      kind: 'Role',
      name: params.name,
    },
    subjects: [
      {
        kind: 'ServiceAccount',
        name: params.name,
        namespace: env.namespace,
      },
    ],
  },
]

Re tla boela re hlalose liparamente tse ncha ho tikoloho/base.libsonnet, eo hona joale e shebahalang tjena:

local secrets = import '../secrets/base.libsonnet';

{
  components: {
    gitlabRunner: {
      name: 'gitlab-runner',
      values: {
        gitlabUrl: 'https://gitlab.com/',
        rbac: {
          create: true,
        },
        runnerRegistrationToken: secrets.runnerRegistrationToken,
        runners: {
          serviceAccountName: $.components.rbac.name,
          image: 'registry.gitlab.com/kvaps/docs.example.org/toolbox:v0.0.1',
        },
      },
    },
    rbac: {
      name: 'gitlab-runner-deploy',
    },
  },
}

Ela hloko $.components.rbac.name e bua ka lebitso bakeng sa karolo rbac

Ha re hlahlobe hore na ho fetohile eng:

qbec diff default

'me re sebelise liphetoho tsa rona ho Kubernetes:

qbec apply default

Hape, u se ke oa lebala ho etsa liphetoho tsa rona ho git:

cd ../..
git add dockerfiles/toolbox
git commit -m "Add Dockerfile for toolbox"
git add deploy/gitlab-runner
git commit -m "Configure gitlab-runner to use toolbox"

9. Pipe ea rona ea pele le kopano ea litšoantšo ka li-tag

Motso oa morero oo re tla o theha .gitlab-ci.yml ka litaba tse latelang:

.build_docker_image:
  stage: build
  image:
    name: gcr.io/kaniko-project/executor:debug-v0.15.0
    entrypoint: [""]
  before_script:
    - echo "{"auths":{"$CI_REGISTRY":{"username":"$CI_REGISTRY_USER","password":"$CI_REGISTRY_PASSWORD"}}}" > /kaniko/.docker/config.json

build_toolbox:
  extends: .build_docker_image
  script:
    - /kaniko/executor --cache --context $CI_PROJECT_DIR/dockerfiles/toolbox --dockerfile $CI_PROJECT_DIR/dockerfiles/toolbox/Dockerfile --destination $CI_REGISTRY_IMAGE/toolbox:$CI_COMMIT_TAG
  only:
    refs:
      - tags

build_website:
  extends: .build_docker_image
  variables:
    GIT_SUBMODULE_STRATEGY: normal
  script:
    - /kaniko/executor --cache --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/dockerfiles/website/Dockerfile --destination $CI_REGISTRY_IMAGE/website:$CI_COMMIT_TAG
  only:
    refs:
      - tags

Ka kopo hlokomela hore re sebelisa GIT_SUBMODULE_STRATEGY: e tloaelehileng bakeng sa mesebetsi eo o hlokang ho qala ka ho hlaka li-submodule pele o etsoa.

Se ke oa lebala ho etsa liphetoho tsa rona:

git add .gitlab-ci.yml
git commit -m "Automate docker build"

Ke nahana hore re ka bitsa mofuta ona ka mokhoa o sireletsehileng v0.0.1 ebe o kenya tag:

git tag v0.0.1

Re tla kenya li-tag neng kapa neng ha re hloka ho lokolla mofuta o mocha. Li-tag ho litšoantšo tsa Docker li tla tlamelloa ho li-tag tsa Git. Ntho e 'ngoe le e' ngoe e nang le tag e ncha e tla qala kaho ea litšoantšo ka tag ena.

Ha re e etse git push --tags, 'me ha re shebeng lipeipi tsa rona tsa pele:

Setšoantšo sa skrine sa pipeline ea pele

Ke habohlokoa ho lebisa tlhokomelo ea hau tabeng ea hore kopano ka li-tag e loketse ho haha ​​​​litšoantšo tsa li-docker, empa ha ea lokela ho kenya kopo ho Kubernetes. Kaha li-tag tse ncha li ka abeloa mesebetsi ea khale, tabeng ena, ho qala pipeline bakeng sa bona ho tla lebisa ho romelloeng ha mofuta oa khale.

Ho rarolla bothata bona, hangata moaho oa litšoantšo tsa docker o tlameletsoe ho li-tag, le ho romelloa ha kopo lekaleng. mong'a, eo ho eona mefuta ea litšoantšo tse bokelitsoeng e leng hardcoded. Mona ke moo o ka qalang ho khutlisa ka mokhoa o bonolo oa ho khutlisa mong'a- makala.

10. Boiketsetso ba ho tsamaisa

E le hore Gitlab-runner e tsebe ho hlakola liphiri tsa rona, re tla hloka ho romella senotlolo sa polokelo ebe re se kenyelletsa ho mefuta ea rona ea tikoloho ea CI:

git crypt export-key /tmp/docs-repo.key
base64 -w0 /tmp/docs-repo.key; echo

Re tla boloka mohala o hlahang ho Gitlab; ho etsa sena, a re ee ho litlhophiso tsa projeke ea rona:
Litlhophiso -> CI / CD -> Liphetoho

Mme ha re theheng phetoho e ncha:

Type
Key
latela boleng ba
E sirelelitsoe
Ho pata
Boholo

File
GITCRYPT_KEY
<your string>
true (nakong ea koetliso u ka khona false)
true
All environments

Setšoantšo sa skrini sa phapang e ekelitsoeng

Joale ha re ntlafatse ea rona .gitlab-ci.yml ho phaella ho eona:

.deploy_qbec_app:
  stage: deploy
  only:
    refs:
      - master

deploy_gitlab_runner:
  extends: .deploy_qbec_app
  variables:
    GIT_SUBMODULE_STRATEGY: normal
  before_script:
    - base64 -d "$GITCRYPT_KEY" | git-crypt unlock -
  script:
    - qbec apply default --root deploy/gitlab-runner --force:k8s-context __incluster__ --wait --yes

deploy_website:
  extends: .deploy_qbec_app
  script:
    - qbec apply default --root deploy/website --force:k8s-context __incluster__ --wait --yes

Mona re nolofalitse likhetho tse 'maloa tse ncha bakeng sa qbec:

• --root some/app - e u lumella ho tseba lethathamo la sesebelisoa se ikhethileng
• --force:k8s-context __incluster__ - ena ke phetoho ea boselamose e bolelang hore ho tsamaisoa ho tla etsahala sehlopheng se le seng seo gtilab-runner e sebetsang ho sona. Sena sea hlokahala hobane ho seng joalo qbec e tla leka ho fumana seva e loketseng ea Kubernetes ho kubeconfig ea hau
• -- ema - e qobella qbec ho ema ho fihlela lisebelisuoa tseo e li bōpang li kena boemong bo Lokisitsoeng 'me ka mor'a moo li tsoe ka khoutu ea ho tsoa e atlehileng.
• — ho joalo - e tima feela khetla e sebetsang U na le bonnete? ha e tsamaisoa.

Se ke oa lebala ho etsa liphetoho tsa rona:

git add .gitlab-ci.yml
git commit -m "Automate deploy"

Mme kamora git Push re tla bona kamoo likopo tsa rona li sebelisitsoeng kateng:

Screenshot ea pipeline ea bobeli

11. Lintho tse entsoeng ka matsoho le kopano ha u sutumelletsa ho tseba

Ka tloaelo, mehato e hlalositsoeng ka holimo e lekane ho haha ​​​​le ho fana ka hoo e batlang e le microservice, empa ha re batle ho kenya tag nako le nako ha re hloka ho ntlafatsa sebaka sa marang-rang. Ka hona, re tla nka tsela e matla haholoanyane 'me re thehe mokhoa oa ho tsamaisa digest lekaleng le leholo.

Khopolo e bonolo: joale setšoantšo sa rona websaeteng e tla hahuoa bocha nako le nako ha o kena mong'a, ebe o sebelisa ka bo eona ho Kubernetes.

Ha re ntlafatse mesebetsi ena e 'meli ho rona .gitlab-ci.yml:

build_website:
  extends: .build_docker_image
  variables:
    GIT_SUBMODULE_STRATEGY: normal
  script:
    - mkdir -p $CI_PROJECT_DIR/artifacts
    - /kaniko/executor --cache --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/dockerfiles/website/Dockerfile --destination $CI_REGISTRY_IMAGE/website:$CI_COMMIT_REF_NAME --digest-file $CI_PROJECT_DIR/artifacts/website.digest
  artifacts:
    paths:
      - artifacts/
  only:
    refs:
      - master
      - tags

deploy_website:
  extends: .deploy_qbec_app
  script:
    - DIGEST="$(cat artifacts/website.digest)"
    - qbec apply default --root deploy/website --force:k8s-context __incluster__ --wait --yes --vm:ext-str digest="$DIGEST"

Ka kopo hlokomela hore re kentse khoele mong'a к Ref bakeng sa mesebetsi build_websaete 'me re sebelisa hona joale $CI_COMMIT_REF_NAME sebakeng sa $CI_COMMIT_TAG, ke hore, ha re sa tlamelloa ho li-tag ho Git 'me joale re tla sutumelletsa setšoantšo se nang le lebitso la lekala la boipelaetso le qalileng pipeline. Ke habohlokoa ho hlokomela hore sena se tla sebetsa le li-tag, tse tla re lumella ho boloka linepe tsa sebaka sa marang-rang se nang le mofuta o itseng ho registry ea docker.

Ha lebitso la tag ea "docker" bakeng sa mofuta o mocha oa sebaka sa marang-rang le ka se fetohe, re ntse re tlameha ho hlalosa liphetoho ho Kubernetes, ho seng joalo e ke ke ea khutlisetsa kopo ho tsoa setšoantšong se secha, kaha e ke ke ea hlokomela liphetoho lifensetereng. bonahatsa.

Khetho -vm: ext-str digest = "$ DIGEST" bakeng sa qbec - e u lumella ho fetisa phapang ea kantle ho jsonnet. Re batla hore e sebelisoe bocha ka har'a sehlopha ka nako e 'ngoe le e 'ngoe e lokolloang ea kopo ea rona. Re ke ke ra hlola re sebelisa lebitso la tag, leo hona joale le ke keng la fetoha, kaha re hloka ho tlamelloa ho mofuta o itseng oa setšoantšo mme re qale ho romelloa ha se fetoha.

Mona re tla thusoa ke bokhoni ba Kaniko ba ho boloka setšoantšo sa digest faeleng (khetho --digest-file)
Joale re tla fetisetsa faele ena ebe re e bala ka nako ea ho tsamaisoa.

Ha re ntlafatse liparamente tsa rona deploy/website/environments/base.libsonnet e tla shebahala tjena:

{
  components: {
    website: {
      name: 'example-docs',
      image: 'registry.gitlab.com/kvaps/docs.example.org/website@' + std.extVar('digest'),
      replicas: 1,
      containerPort: 80,
      servicePort: 80,
      nodeSelector: {},
      tolerations: [],
      ingressClass: 'nginx',
      domain: 'docs.example.org',
    },
  },
}

E entsoe, joale, leha e le mang a kenye letsoho mong'a e qala kaho ea setšoantšo sa docker bakeng sa websaeteng, ebe o e fetisetsa ho Kubernetes.

Se ke oa lebala ho etsa liphetoho tsa rona:

git add .
git commit -m "Configure dynamic build"

Re tla hlahloba hamorao git Push re lokela ho bona ntho e kang ena:

Setšoantšo sa skrini sa pipeline bakeng sa master

Ha e le hantle, ha ho hlokahale hore re sebelise gitlab-runner hape ka push e 'ngoe le e' ngoe, ntle le haeba, ehlile, ha ho letho le fetohileng tlhophisong ea eona, a re e lokiseng. .gitlab-ci.yml:

deploy_gitlab_runner:
  extends: .deploy_qbec_app
  variables:
    GIT_SUBMODULE_STRATEGY: normal
  before_script:
    - base64 -d "$GITCRYPT_KEY" | git-crypt unlock -
  script:
    - qbec apply default --root deploy/gitlab-runner --force:k8s-context __incluster__ --wait --yes
  only:
    changes:
      - deploy/gitlab-runner/**/*

liphetoho e tla u lumella ho beha leihlo liphetoho ho deploy/gitlab-runner/ mme e tla qala mosebetsi oa rona ha feela o le teng

Se ke oa lebala ho etsa liphetoho tsa rona:

git add .gitlab-ci.yml
git commit -m "Reduce gitlab-runner deploy"

git Push, ho molemo:

Setšoantšo sa skrini sa pipeline e ntlafalitsoeng

12. Libaka tse matla

Ke nako ea ho fapanyetsana lipeipi tsa rona ka tikoloho e matla.

Taba ea pele, a re ntlafatse mosebetsi build_websaete ho tsa rona .gitlab-ci.yml, ho tlosa boloko ho eona feela, e tla qobella Gitlab ho e qala boitlamo bofe kapa bofe lekaleng lefe kapa lefe:

build_website:
  extends: .build_docker_image
  variables:
    GIT_SUBMODULE_STRATEGY: normal
  script:
    - mkdir -p $CI_PROJECT_DIR/artifacts
    - /kaniko/executor --cache --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/dockerfiles/website/Dockerfile --destination $CI_REGISTRY_IMAGE/website:$CI_COMMIT_REF_NAME --digest-file $CI_PROJECT_DIR/artifacts/website.digest
  artifacts:
    paths:
      - artifacts/

Ebe u ntlafatsa mosebetsi deploy_websaete, eketsa boloko moo tikoloho e khahlang:

deploy_website:
  extends: .deploy_qbec_app
  environment:
    name: prod
    url: https://docs.example.org
  script:
    - DIGEST="$(cat artifacts/website.digest)"
    - qbec apply default --root deploy/website --force:k8s-context __incluster__ --wait --yes --vm:ext-str digest="$DIGEST"

Sena se tla lumella Gitlab ho amahanya mosebetsi le tlhahiso tikoloho le ho bontsha sehokelo se nepahetseng ho yona.

Joale ha re kenye mesebetsi e meng e 'meli:

deploy_website:
  extends: .deploy_qbec_app
  environment:
    name: prod
    url: https://docs.example.org
  script:
    - DIGEST="$(cat artifacts/website.digest)"
    - qbec apply default --root deploy/website --force:k8s-context __incluster__ --wait --yes --vm:ext-str digest="$DIGEST"

deploy_review:
  extends: .deploy_qbec_app
  environment:
    name: review/$CI_COMMIT_REF_NAME
    url: http://$CI_ENVIRONMENT_SLUG.docs.example.org
    on_stop: stop_review
  script:
    - DIGEST="$(cat artifacts/website.digest)"
    - qbec apply review --root deploy/website --force:k8s-context __incluster__ --wait --yes --vm:ext-str digest="$DIGEST" --vm:ext-str subdomain="$CI_ENVIRONMENT_SLUG" --app-tag "$CI_ENVIRONMENT_SLUG"
  only:
    refs:
    - branches
  except:
    refs:
      - master

stop_review:
  extends: .deploy_qbec_app
  environment:
    name: review/$CI_COMMIT_REF_NAME
    action: stop
  stage: deploy
  before_script:
    - git clone "$CI_REPOSITORY_URL" master
    - cd master
  script:
    - qbec delete review --root deploy/website --force:k8s-context __incluster__ --yes --vm:ext-str digest="$DIGEST" --vm:ext-str subdomain="$CI_ENVIRONMENT_SLUG" --app-tag "$CI_ENVIRONMENT_SLUG"
  variables:
    GIT_STRATEGY: none
  only:
    refs:
    - branches
  except:
    refs:
      - master
  when: manual

Li tla hlahisoa ha li sutumetsoa makaleng afe kapa afe ntle le master mme li tla fana ka mofuta oa ponelopele ea sebaka seo.

Re bona khetho e ncha bakeng sa qbec: --app-tag - e u lumella ho tšoaea mefuta e kentsoeng ea ts'ebeliso le ho sebetsa feela ka har'a tag ena; ha u theha le ho senya lisebelisoa ho Kubernetes, qbec e tla sebetsa le bona feela.
Ka tsela ena re ke ke ra theha tikoloho e arohaneng bakeng sa tlhahlobo ka 'ngoe, empa re sebelisa e tšoanang hape.

Mona re boetse re sebelisa qbec sebelisa tlhahlobo, sebakeng sa qbec sebetsa kamehla - ena ke eona nako eo ka eona re tla leka ho hlalosa liphapang tsa tikoloho ea rona (tlhahlobo le kamehla):

Ha re eketse tekolo botjha tikoloho ka deploy/website/qbec.yaml

spec:
  environments:
    review:
      defaultNamespace: docs
      server: https://kubernetes.example.org:8443

Joale re tla e phatlalatsa ka hare deploy/website/params.libsonnet:

local env = std.extVar('qbec.io/env');
local paramsMap = {
  _: import './environments/base.libsonnet',
  default: import './environments/default.libsonnet',
  review: import './environments/review.libsonnet',
};

if std.objectHas(paramsMap, env) then paramsMap[env] else error 'environment ' + env + ' not defined in ' + std.thisFile

Ebe u ngola li-parameter tse tloaelehileng bakeng sa eona deploy/website/environments/review.libsonnet:

// this file has the param overrides for the default environment
local base = import './base.libsonnet';
local slug = std.extVar('qbec.io/tag');
local subdomain = std.extVar('subdomain');

base {
  components+: {
    website+: {
      name: 'example-docs-' + slug,
      domain: subdomain + '.docs.example.org',
    },
  },
}

A re ke re shebisise mosebetsi oa jobu emisa_tlhahlobo, e tla qala ha lekala le hlakotsoe 'me e le hore gitlab e se ke ea leka ho e hlahloba e sebelisoa. GIT_STRATEGY: ha ho letho, hamorao re clone mong'a-kala le ho hlakola tlhahlobo ka eona.
Ke ntho e ferekanyang hanyane, empa ha ke so fumane tsela e ntle ho feta.
Khetho e 'ngoe e ka ba ho fetisetsa tlhahlobo e' ngoe le e 'ngoe sebakeng sa mabitso sa hotele, se ka heletsoang ka linako tsohle.

Se ke oa lebala ho etsa liphetoho tsa rona:

git add .
git commit -m "Enable automatic review"

git Push, git Checkout -b teko, git push origin test, hlahloba:

Setšoantšo sa skrini sa libaka tse entsoeng ho Gitlab

Tsohle di sebetsa? - e kholo, hlakola lekala la rona la liteko: git Checkout mong'a, git push origin :test, re hlahloba hore na mesebetsi ea ho tlosa tikoloho e sebelitse ntle le liphoso.

Mona ke rata ho hlakisa hang-hang hore moqapi ofe kapa ofe mosebetsing a ka etsa makala, a ka boela a fetoha .gitlab-ci.yml faele le ho fihlella mefuta e fapaneng ea lekunutu.
Ka hona, ho kgothaletswa ka matla ho lumella tšebeliso ea bona feela bakeng sa makala a sirelelitsoeng, mohlala ho mong'a, kapa theha sete e arohaneng ea lintho tse fapaneng bakeng sa tikoloho ka 'ngoe.

13. Hlahloba Lisebelisoa

Hlahloba Lisebelisoa Ena ke karolo ea GitLab e u lumellang hore u kenye konopo bakeng sa faele e 'ngoe le e' ngoe e polokelong ea polokelo ho e sheba kapele sebakeng se behiloeng.

E le hore likonopo tsena li hlahe, u lokela ho etsa faele .gitlab/route-map.yml 'me u hlalose liphetoho tsohle tsa tsela ho eona; molemong oa rona e tla ba bonolo haholo:

# Indices
- source: /content/(.+?)_index.(md|html)/ 
  public: '1'

# Pages
- source: /content/(.+?).(md|html)/ 
  public: '1/'

Se ke oa lebala ho etsa liphetoho tsa rona:

git add .gitlab/
git commit -m "Enable review apps"

git Push, 'me u hlahlobe:

Setšoantšo sa skrine sa konopo ea Tlhahlobo ea App

Mosebetsi o felile!

Mehloli ea morero:

• ho Gitlab: https://gitlab.com/kvaps/docs.example.org
• ho GitHub: https://github.com/kvaps/docs.example.org

Ke leboha tlhokomelo ea hau, ke tšepa hore u e ratile

Source: www.habr.com