Add GitOps stack for abrban.com with Gitea Actions CI/CD.
Build and Deploy Platform / build-push-deploy (push) Has been cancelled
Build and Deploy Platform / build-push-deploy (push) Has been cancelled
Harbor in-cluster builds via Kaniko, ArgoCD auto-sync, and production Helm values for abrban.com domains. Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
keyhan
Executable
+36
@@ -0,0 +1,36 @@
|
||||
#!/usr/bin/env bash
|
||||
# Route registry.abrban.com pulls to harbor-core (HTTP) for proxy-cache support.
|
||||
set -euo pipefail
|
||||
|
||||
NS="${NS:-kube-system}"
|
||||
NODE="${NODE:-abr}"
|
||||
HARBOR_CORE_IP="${HARBOR_CORE_IP:-$(kubectl -n cloudhost get svc harbor-core -o jsonpath='{.spec.clusterIP}')}"
|
||||
REG_USER="${REG_USER:-harbor_registry_user}"
|
||||
REG_PASS="${REG_PASS:-$(kubectl -n cloudhost get secret harbor-core -o jsonpath='{.data.REGISTRY_CREDENTIAL_PASSWORD}' | base64 -d)}"
|
||||
|
||||
kubectl -n "${NS}" delete pod k3s-registries-setup --ignore-not-found
|
||||
|
||||
kubectl -n "${NS}" run k3s-registries-setup \
|
||||
--image=rancher/mirrored-library-busybox:1.36.1 \
|
||||
--restart=Never \
|
||||
--overrides="$(cat <<EOF
|
||||
{
|
||||
"apiVersion": "v1",
|
||||
"spec": {
|
||||
"nodeName": "${NODE}",
|
||||
"hostNetwork": true,
|
||||
"containers": [{
|
||||
"name": "setup",
|
||||
"image": "rancher/mirrored-library-busybox:1.36.1",
|
||||
"securityContext": {"privileged": true},
|
||||
"command": ["sh", "-ec", "mkdir -p /host/etc/rancher/k3s && cat > /host/etc/rancher/k3s/registries.yaml <<'REGEOF'\nmirrors:\n registry.abrban.com:\n endpoint:\n - http://${HARBOR_CORE_IP}\n \\\"registry.cloudhost-builds.svc.cluster.local:5000\\\":\n endpoint:\n - \\\"http://127.0.0.1:30500\\\"\nconfigs:\n registry.abrban.com:\n auth:\n username: ${REG_USER}\n password: ${REG_PASS}\n \\\"${HARBOR_CORE_IP}\\\":\n auth:\n username: ${REG_USER}\n password: ${REG_PASS}\n \\\"registry.cloudhost-builds.svc.cluster.local:5000\\\":\n auth:\n username: admin\n password: \\\"\\\"\n \\\"127.0.0.1:30500\\\":\n auth:\n username: admin\n password: \\\"\\\"\nREGEOF\nnsenter -t 1 -m -u -n -i -- systemctl restart k3s 2>/dev/null || true\necho k3s-restarted\nsleep 30"],
|
||||
"volumeMounts": [{"name": "host", "mountPath": "/host"}]
|
||||
}],
|
||||
"volumes": [{"name": "host", "hostPath": {"path": "/"}}]
|
||||
}
|
||||
}
|
||||
EOF
|
||||
)"
|
||||
|
||||
kubectl -n "${NS}" wait --for=condition=Ready pod/k3s-registries-setup --timeout=180s || true
|
||||
kubectl -n "${NS}" logs k3s-registries-setup
|
||||
Executable
+36
@@ -0,0 +1,36 @@
|
||||
#!/usr/bin/env bash
|
||||
# Deploy platform via Helm only — images must already be in Harbor (built by Gitea Actions / Kaniko).
|
||||
set -euo pipefail
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
||||
NAMESPACE="${NAMESPACE:-cloudhost}"
|
||||
RELEASE="${RELEASE:-cloudhost}"
|
||||
VALUES="${VALUES:-${ROOT}/gitops/platform/values-abrban.yaml}"
|
||||
TAG="${TAG:-}"
|
||||
|
||||
if [[ -z "${TAG}" ]]; then
|
||||
TAG="$(grep -E '^\s+tag:' "${VALUES}" | head -1 | sed 's/.*tag: *"\?\([^"]*\)"\?.*/\1/')"
|
||||
fi
|
||||
|
||||
if [[ -z "${TAG}" || "${TAG}" == "1.0.0" ]]; then
|
||||
echo "ERROR: No image tag set. Build in-cluster first:" >&2
|
||||
echo " ./scripts/trigger-platform-build.sh" >&2
|
||||
echo "Or set TAG=... after CI has pushed images." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "==> Helm upgrade ${RELEASE} (tag=${TAG})"
|
||||
helm upgrade --install "${RELEASE}" "${ROOT}/backend/helm/cloudhost-platform" \
|
||||
-n "${NAMESPACE}" \
|
||||
-f "${VALUES}" \
|
||||
--set createNamespace=false \
|
||||
--set global.storageClass=local-path \
|
||||
--set images.backend.tag="${TAG}" \
|
||||
--set images.frontend.tag="${TAG}" \
|
||||
--timeout 15m \
|
||||
--wait
|
||||
|
||||
kubectl -n "${NAMESPACE}" rollout status deploy/cloudhost-backend --timeout=300s
|
||||
kubectl -n "${NAMESPACE}" rollout status deploy/cloudhost-frontend --timeout=300s
|
||||
|
||||
echo "==> Done (tag=${TAG})"
|
||||
Executable
+6
@@ -0,0 +1,6 @@
|
||||
#!/usr/bin/env bash
|
||||
# DEPRECATED — use Harbor proxy-cache instead (see gitops/README.md).
|
||||
# Harbor projects: proxy-dockerhub, proxy-quay, proxy-k8s, proxy-gitea, proxy-gcr
|
||||
echo "ERROR: Do not use this script. Harbor proxy-cache pulls upstream images on demand." >&2
|
||||
echo "See gitops/README.md and RUNBOOK-HARBOR.fa.md" >&2
|
||||
exit 1
|
||||
Executable
+78
@@ -0,0 +1,78 @@
|
||||
#!/usr/bin/env bash
|
||||
# Trigger in-cluster Kaniko build → Harbor. No local docker build/push.
|
||||
set -euo pipefail
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
||||
NAMESPACE="${BUILD_NAMESPACE:-cloudhost-builds}"
|
||||
JOB_NAME="${JOB_NAME:-build-platform-images}"
|
||||
GIT_REPO="${GIT_REPO:-http://gitea-http.gitea.svc.cluster.local:3000/abrban/cloud-host.git}"
|
||||
GIT_REF="${GIT_REF:-main}"
|
||||
IMAGE_TAG="${IMAGE_TAG:-$(date +%Y%m%d-%H%M)}"
|
||||
|
||||
echo "==> Applying Kaniko build job (tag=${IMAGE_TAG}, ref=${GIT_REF})"
|
||||
kubectl -n "${NAMESPACE}" delete job "${JOB_NAME}" --ignore-not-found
|
||||
|
||||
kubectl apply -f - <<EOF
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: ${JOB_NAME}
|
||||
namespace: ${NAMESPACE}
|
||||
spec:
|
||||
ttlSecondsAfterFinished: 3600
|
||||
backoffLimit: 1
|
||||
template:
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
imagePullSecrets:
|
||||
- name: registry-pull-secret
|
||||
initContainers:
|
||||
- name: git-clone
|
||||
image: registry.abrban.com/proxy-dockerhub/alpine/git:2.43.0
|
||||
command:
|
||||
- sh
|
||||
- -ec
|
||||
- |
|
||||
git clone --depth=1 --branch "${GIT_REF}" "${GIT_REPO}" /workspace
|
||||
ls -la /workspace
|
||||
volumeMounts:
|
||||
- name: workspace
|
||||
mountPath: /workspace
|
||||
containers:
|
||||
- name: kaniko
|
||||
image: registry.abrban.com/proxy-gcr/kaniko-project/executor:v1.23.2
|
||||
command:
|
||||
- sh
|
||||
- -ec
|
||||
- |
|
||||
set -eux
|
||||
REG="harbor-registry.cloudhost.svc.cluster.local:5000/abrban"
|
||||
/kaniko/executor \
|
||||
--dockerfile=/workspace/backend/Dockerfile \
|
||||
--context=dir:///workspace/backend \
|
||||
--destination="${REG}/cloudhost-backend:${IMAGE_TAG}" \
|
||||
--insecure --skip-tls-verify
|
||||
/kaniko/executor \
|
||||
--dockerfile=/workspace/frontend/Dockerfile \
|
||||
--context=dir:///workspace/frontend \
|
||||
--build-arg=NEXT_PUBLIC_API_URL=https://api.abrban.com \
|
||||
--destination="${REG}/cloudhost-frontend:${IMAGE_TAG}" \
|
||||
--insecure --skip-tls-verify
|
||||
echo "BUILT_TAG=${IMAGE_TAG}"
|
||||
volumeMounts:
|
||||
- name: workspace
|
||||
mountPath: /workspace
|
||||
volumes:
|
||||
- name: workspace
|
||||
emptyDir: {}
|
||||
EOF
|
||||
|
||||
echo "==> Waiting for build job..."
|
||||
kubectl -n "${NAMESPACE}" wait --for=condition=complete "job/${JOB_NAME}" --timeout=45m
|
||||
|
||||
echo "==> Updating values-abrban.yaml tag to ${IMAGE_TAG}"
|
||||
sed -i.bak "s|tag: \".*\"|tag: \"${IMAGE_TAG}\"|g" "${ROOT}/gitops/platform/values-abrban.yaml"
|
||||
rm -f "${ROOT}/gitops/platform/values-abrban.yaml.bak"
|
||||
|
||||
echo "==> Build complete. Deploy with:"
|
||||
echo " TAG=${IMAGE_TAG} ./scripts/gitops-deploy.sh"
|
||||
Reference in New Issue
Block a user