🥇 Ṣiṣeto CD nipasẹ gitlab

Mo ronu lẹẹkan nipa adaṣe imuṣiṣẹ ti iṣẹ akanṣe mi. gitlab.com ni inu rere pese gbogbo awọn irinṣẹ fun eyi, ati pe dajudaju Mo pinnu lati lo nipa sisọ jade ati kikọ iwe afọwọkọ imuṣiṣẹ kekere kan. Ninu nkan yii, Mo pin iriri mi pẹlu agbegbe.

TL; DR

Ṣeto VPS: mu gbongbo kuro, iwọle ọrọ igbaniwọle, fi sori ẹrọ dockerd, tunto ufw
Ṣe awọn iwe-ẹri fun olupin ati alabara docs.docker.com/engine/security/https/#create-a-ca-server-and-client-keys-with-openssl Mu iṣakoso dockerd ṣiṣẹ nipasẹ iho tcp: yọkuro aṣayan -H fd: // lati atunto docker.
Ṣeto awọn ọna si awọn iwe-ẹri ni docker.json
Forukọsilẹ ninu awọn oniyipada gitlab ninu awọn eto CI / CD pẹlu awọn akoonu ti awọn iwe-ẹri. Kọ iwe afọwọkọ .gitlab-ci.yml fun imuṣiṣẹ.

Emi yoo fi gbogbo awọn apẹẹrẹ han lori pinpin Debian.

Eto VPS akọkọ

Nibi ti o ti ra ohun apẹẹrẹ fun apẹẹrẹ lori DO, Ohun akọkọ lati ṣe ni lati daabobo olupin rẹ lati aye ita ibinu. Emi kii yoo jẹri tabi sọ ohunkohun, Emi yoo kan ṣafihan / var/log/awọn ifiranṣẹ log ti olupin foju mi:

Иншот

Ni akọkọ, fi sori ẹrọ ogiriina ufw:

apt-get update && apt-get install ufw

Mu eto imulo aiyipada ṣiṣẹ: dènà gbogbo awọn asopọ ti nwọle, gba gbogbo awọn asopọ ti njade lọwọ:

ufw default deny incoming
ufw default allow outgoing

Pataki: maṣe gbagbe lati gba asopọ laaye nipasẹ ssh:

ufw allow OpenSSH

Sintasi gbogbogbo ni: Gba asopọ laaye lori ibudo: ufw laaye 12345, nibiti 12345 jẹ nọmba ibudo tabi orukọ iṣẹ. Kọ: ufw sẹ 12345

Tan ogiriina:

ufw enable

A jade kuro ni igba ati wọle lẹẹkansi nipasẹ ssh.

Ṣafikun olumulo kan, fi ọrọ igbaniwọle fun u, ki o ṣafikun si ẹgbẹ sudo.

apt-get install sudo
adduser scoty
usermod -aG sudo scoty

Nigbamii, ni ibamu si ero naa, o yẹ ki o mu iwọle iwọle kuro. Lati ṣe eyi, daakọ bọtini ssh rẹ si olupin naa:

ssh-copy-id [email protected]

ip ti olupin gbọdọ jẹ tirẹ. Bayi gbiyanju lati wọle labẹ olumulo ti o ṣẹda tẹlẹ, iwọ ko nilo lati tẹ ọrọ igbaniwọle sii mọ. Nigbamii, ninu awọn eto atunto, yi atẹle naa pada:

sudo nano /etc/ssh/sshd_config

pa wiwọle ọrọigbaniwọle:

PasswordAuthentication no

Tun sshd daemon bẹrẹ:

sudo systemctl reload sshd

Bayi ti iwọ tabi ẹlomiran ba gbiyanju lati wọle bi gbongbo, yoo kuna.

Nigbamii ti, a fi dockerd sori ẹrọ, Emi kii yoo ṣe apejuwe ilana naa nibi, nitori ohun gbogbo le ti yipada tẹlẹ, tẹle ọna asopọ si oju opo wẹẹbu osise ki o lọ nipasẹ awọn igbesẹ ti fifi docker sori ẹrọ foju rẹ: https://docs.docker.com/install/linux/docker-ce/debian/

Ijẹrisi Iran

Lati ṣakoso daemon docker latọna jijin, asopọ TLS ti paroko kan nilo. Lati ṣe eyi, o nilo lati ni ijẹrisi ati bọtini kan ti o nilo lati ṣe ina ati gbe lọ si ẹrọ latọna jijin rẹ. Tẹle awọn igbesẹ ti a fun ni awọn itọnisọna lori oju opo wẹẹbu docker osise: https://docs.docker.com/engine/security/https/#create-a-ca-server-and-client-keys-with-openssl Gbogbo awọn faili * .pem ti ipilẹṣẹ fun olupin naa, eyun cap.pem, server.pem, key.pem, yẹ ki o gbe sinu itọsọna /etc/docker lori olupin naa.

docker setup

Ninu iwe afọwọkọ ibẹrẹ docker daemon, yọkuro aṣayan -H df: // aṣayan, aṣayan yii sọ iru agbalejo daemon docker le ni iṣakoso lori.

# At /lib/systemd/system/docker.service
[Service]
Type=notify
ExecStart=/usr/bin/dockerd

Nigbamii, ṣẹda faili eto ti ko ba si tẹlẹ ki o ṣeto awọn aṣayan:

/etc/docker/docker.json

{
  "hosts": [
    "unix:///var/run/docker.sock",
    "tcp://0.0.0.0:2376"
  ],
  "labels": [
    "is-our-remote-engine=true"
  ],
  "tls": true,
  "tlscacert": "/etc/docker/ca.pem",
  "tlscert": "/etc/docker/server.pem",
  "tlskey": "/etc/docker/key.pem",
  "tlsverify": true
}

Gba awọn asopọ laaye lori ibudo 2376:

sudo ufw allow 2376

Tun dockerd bẹrẹ pẹlu awọn eto titun:

sudo systemctl daemon-reload && sudo systemctl restart docker

Jẹ ki a ṣayẹwo:

sudo systemctl status docker

Ti ohun gbogbo ba jẹ alawọ ewe, lẹhinna a ro pe a ti tunto docker ni aṣeyọri lori olupin naa.

Ṣiṣeto ifijiṣẹ lemọlemọfún lori gitlab

Ni ibere fun oṣiṣẹ gitalab lati ni anfani lati ṣiṣẹ awọn aṣẹ lori agbalejo docker latọna jijin, o nilo lati pinnu bii ati ibiti o ti le fipamọ awọn iwe-ẹri ati bọtini kan fun asopọ ti paroko si dockerd. Mo yanju iṣoro yii nipa kikọ nirọrun si awọn oniyipada ninu awọn eto gitlbab:

akole apanirun

Kan jade awọn akoonu ti awọn iwe-ẹri ati bọtini nipasẹ ologbo: cat ca.pem. Daakọ ati lẹẹmọ sinu awọn iye oniyipada.

Jẹ ki a kọ iwe afọwọkọ kan fun imuṣiṣẹ nipasẹ gitlab. Aworan docker-in-docker (dind) yoo ṣee lo.

.gitlab-ci.yml

image:
  name: docker/compose:1.23.2
  # перепишем entrypoint , чтобы работало в dind
  entrypoint: ["/bin/sh", "-c"]

variables:
  DOCKER_HOST: tcp://docker:2375/
  DOCKER_DRIVER: overlay2

services:
  - docker:dind

stages:
  - deploy

deploy:
  stage: deploy
  script:
    - bin/deploy.sh # скрипт деплоя тут

Awọn akoonu ti iwe afọwọkọ imuṣiṣẹ pẹlu awọn asọye:

bin/deploy.sh

#!/usr/bin/env sh
# Падаем сразу, если возникли какие-то ошибки
set -e
# Выводим, то , что делаем
set -v

# 
DOCKER_COMPOSE_FILE=docker-compose.yml
# Куда деплоим
DEPLOY_HOST=185.241.52.28
# Путь для сертификатов клиента, то есть в нашем случае - gitlab-воркера
DOCKER_CERT_PATH=/root/.docker

# проверим, что в контейнере все имеется
docker info
docker-compose version

# создаем путь (сейчас работаем в клиенте - воркере gitlab'а)
mkdir $DOCKER_CERT_PATH
# изымаем содержимое переменных, при этом удаляем лишние символы добавленные при сохранении переменных.
echo "$CA_PEM" | tr -d 'r' > $DOCKER_CERT_PATH/ca.pem
echo "$CERT_PEM" | tr -d 'r' > $DOCKER_CERT_PATH/cert.pem
echo "$KEY_PEM" | tr -d 'r' > $DOCKER_CERT_PATH/key.pem
# на всякий случай даем только читать
chmod 400 $DOCKER_CERT_PATH/ca.pem
chmod 400 $DOCKER_CERT_PATH/cert.pem
chmod 400 $DOCKER_CERT_PATH/key.pem

# далее начинаем уже работать с удаленным docker-демоном. Собственно, сам деплой
export DOCKER_TLS_VERIFY=1
export DOCKER_HOST=tcp://$DEPLOY_HOST:2376

# проверим, что коннектится все успешно
docker-compose 
  -f $DOCKER_COMPOSE_FILE 
  ps

# логинимся в docker-регистри, тут можете указать свой "местный" регистри
docker login -u $DOCKER_USER -p $DOCKER_PASSWORD

docker-compose 
  -f $DOCKER_COMPOSE_FILE 
  pull app
# поднимаем приложение
docker-compose 
  -f $DOCKER_COMPOSE_FILE 
  up -d app

Iṣoro akọkọ ni lati “fa jade” awọn akoonu ti awọn iwe-ẹri ni fọọmu deede lati awọn oniyipada gitlab CI / CD. Emi ko le mọ idi ti asopọ si agbalejo latọna jijin ko ṣiṣẹ. Mo wo sudo journalctl -u docker log lori agbalejo naa, aṣiṣe kan wa pẹlu mimuwo. Mo pinnu lati wo ohun ti a fipamọ sori gbogbo awọn oniyipada, fun eyi o le rii ologbo -A $DOCKER_CERT_PATH/key.pem. Bori ašiše nipa fifi yiyọ kuro ti ohun kikọ silẹ tr -d 'r'.

Siwaju sii, o le ṣafikun awọn iṣẹ-ṣiṣe lẹhin-itusilẹ si iwe afọwọkọ ni lakaye rẹ. O le ṣayẹwo ẹya iṣẹ ni ibi ipamọ mi https://gitlab.com/isqad/gitlab-ci-cd

orisun: www.habr.com

Eto CD nipasẹ gitlab

TL; DR

Eto VPS akọkọ

Ijẹrisi Iran

docker setup

Ṣiṣeto ifijiṣẹ lemọlemọfún lori gitlab

Fi ọrọìwòye kun Fagilee esi