Fix CI runner: seed images to abrban/, kubectl via alpine init, Kaniko Jobs for builds.
Build and Deploy Platform / build-and-deploy (push) Failing after 15s
Build and Deploy Platform / build-and-deploy (push) Failing after 15s
Harbor proxy-cache works from core API but containerd can't use it directly, so all runner images are seeded to abrban/ project. Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
keyhan
@@ -1,50 +1,127 @@
|
||||
name: Build and Deploy Platform
|
||||
on:
|
||||
push:
|
||||
branches: [main, master]
|
||||
branches: [main]
|
||||
paths-ignore:
|
||||
- "gitops/platform/values-abrban.yaml"
|
||||
- "**.md"
|
||||
workflow_dispatch:
|
||||
|
||||
env:
|
||||
# Push via internal Harbor registry (no creds needed from runner pod)
|
||||
REGISTRY_INTERNAL: harbor-registry.cloudhost.svc.cluster.local:5000
|
||||
REGISTRY: registry.abrban.com
|
||||
BACKEND_IMAGE: abrban/cloudhost-backend
|
||||
FRONTEND_IMAGE: abrban/cloudhost-frontend
|
||||
REGISTRY: harbor-registry.cloudhost.svc.cluster.local:5000
|
||||
PROJECT: abrban
|
||||
BUILD_NS: cloudhost-builds
|
||||
|
||||
jobs:
|
||||
build-push-deploy:
|
||||
runs-on: abrban-kaniko
|
||||
build-and-deploy:
|
||||
runs-on: abrban-builder
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set image tag
|
||||
shell: bash
|
||||
shell: sh
|
||||
run: |
|
||||
SHA="${GITHUB_SHA:-$(git rev-parse HEAD)}"
|
||||
echo "IMAGE_TAG=$(date +%Y%m%d-%H%M)-${SHA:0:8}" >> "$GITHUB_ENV"
|
||||
TAG="$(date +%Y%m%d-%H%M)-$(echo $SHA | cut -c1-8)"
|
||||
echo "IMAGE_TAG=${TAG}" >> "$GITHUB_ENV"
|
||||
echo "Build tag: ${TAG}"
|
||||
|
||||
- name: Build backend (Kaniko)
|
||||
- name: Build backend image (Kaniko Job)
|
||||
shell: sh
|
||||
run: |
|
||||
/kaniko/executor \
|
||||
--context=./backend \
|
||||
--dockerfile=./backend/Dockerfile \
|
||||
--destination="${REGISTRY_INTERNAL}/${BACKEND_IMAGE}:${IMAGE_TAG}" \
|
||||
--insecure \
|
||||
--skip-tls-verify
|
||||
cat <<ENDJOB | kubectl apply -f -
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: build-backend-${IMAGE_TAG}
|
||||
namespace: ${BUILD_NS}
|
||||
spec:
|
||||
ttlSecondsAfterFinished: 600
|
||||
backoffLimit: 1
|
||||
template:
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
imagePullSecrets:
|
||||
- name: registry-pull-secret
|
||||
initContainers:
|
||||
- name: clone
|
||||
image: ${REGISTRY}/${PROJECT}/act-runner:0.2.11
|
||||
command: ["sh", "-c", "git clone --depth=1 --branch main http://gitea-http.gitea.svc.cluster.local:3000/abrban/cloud-host.git /workspace"]
|
||||
volumeMounts:
|
||||
- name: ws
|
||||
mountPath: /workspace
|
||||
containers:
|
||||
- name: kaniko
|
||||
image: ${REGISTRY}/${PROJECT}/kaniko-executor:v1.27.6-debug
|
||||
command:
|
||||
- /kaniko/executor
|
||||
args:
|
||||
- --dockerfile=/workspace/backend/Dockerfile
|
||||
- --context=dir:///workspace/backend
|
||||
- --destination=${REGISTRY}/${PROJECT}/cloudhost-backend:${IMAGE_TAG}
|
||||
- --insecure
|
||||
- --skip-tls-verify
|
||||
volumeMounts:
|
||||
- name: ws
|
||||
mountPath: /workspace
|
||||
volumes:
|
||||
- name: ws
|
||||
emptyDir: {}
|
||||
ENDJOB
|
||||
echo "Waiting for backend build..."
|
||||
kubectl -n ${BUILD_NS} wait --for=condition=complete job/build-backend-${IMAGE_TAG} --timeout=20m
|
||||
echo "Backend build done"
|
||||
|
||||
- name: Build frontend (Kaniko)
|
||||
- name: Build frontend image (Kaniko Job)
|
||||
shell: sh
|
||||
run: |
|
||||
/kaniko/executor \
|
||||
--context=./frontend \
|
||||
--dockerfile=./frontend/Dockerfile \
|
||||
--build-arg=NEXT_PUBLIC_API_URL=https://api.abrban.com \
|
||||
--destination="${REGISTRY_INTERNAL}/${FRONTEND_IMAGE}:${IMAGE_TAG}" \
|
||||
--insecure \
|
||||
--skip-tls-verify
|
||||
cat <<ENDJOB | kubectl apply -f -
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: build-frontend-${IMAGE_TAG}
|
||||
namespace: ${BUILD_NS}
|
||||
spec:
|
||||
ttlSecondsAfterFinished: 600
|
||||
backoffLimit: 1
|
||||
template:
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
imagePullSecrets:
|
||||
- name: registry-pull-secret
|
||||
initContainers:
|
||||
- name: clone
|
||||
image: ${REGISTRY}/${PROJECT}/act-runner:0.2.11
|
||||
command: ["sh", "-c", "git clone --depth=1 --branch main http://gitea-http.gitea.svc.cluster.local:3000/abrban/cloud-host.git /workspace"]
|
||||
volumeMounts:
|
||||
- name: ws
|
||||
mountPath: /workspace
|
||||
containers:
|
||||
- name: kaniko
|
||||
image: ${REGISTRY}/${PROJECT}/kaniko-executor:v1.27.6-debug
|
||||
command:
|
||||
- /kaniko/executor
|
||||
args:
|
||||
- --dockerfile=/workspace/frontend/Dockerfile
|
||||
- --context=dir:///workspace/frontend
|
||||
- --build-arg=NEXT_PUBLIC_API_URL=https://api.abrban.com
|
||||
- --destination=${REGISTRY}/${PROJECT}/cloudhost-frontend:${IMAGE_TAG}
|
||||
- --insecure
|
||||
- --skip-tls-verify
|
||||
volumeMounts:
|
||||
- name: ws
|
||||
mountPath: /workspace
|
||||
volumes:
|
||||
- name: ws
|
||||
emptyDir: {}
|
||||
ENDJOB
|
||||
echo "Waiting for frontend build..."
|
||||
kubectl -n ${BUILD_NS} wait --for=condition=complete job/build-frontend-${IMAGE_TAG} --timeout=20m
|
||||
echo "Frontend build done"
|
||||
|
||||
- name: Update GitOps values
|
||||
shell: bash
|
||||
shell: sh
|
||||
run: |
|
||||
sed -i "s|tag: \"[^\"]*\"|tag: \"${IMAGE_TAG}\"|g" gitops/platform/values-abrban.yaml
|
||||
git config user.email "ci@abrban.com"
|
||||
@@ -53,9 +130,6 @@ jobs:
|
||||
git diff --cached --quiet || git commit -m "ci: deploy platform ${IMAGE_TAG}"
|
||||
|
||||
- name: Push GitOps update
|
||||
shell: bash
|
||||
env:
|
||||
GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
shell: sh
|
||||
run: |
|
||||
git remote set-url origin "https://oauth2:${GITEA_TOKEN}@git.abrban.com/abrban/cloud-host.git"
|
||||
git push origin HEAD:main
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
# Gitea Actions runner — host mode + Kaniko (no docker.sock; k3s uses containerd)
|
||||
# Gitea Actions runner — host mode (no docker.sock; k3s uses containerd)
|
||||
# Runner creates Kaniko Jobs in cloudhost-builds for image builds.
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
@@ -8,6 +9,37 @@ type: Opaque
|
||||
stringData:
|
||||
token: "nL63VkZEyqpCNFdF3AMM9wzQLdLlATUvXSe5Tj0R"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: gitea-act-runner
|
||||
namespace: gitea
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: gitea-act-runner
|
||||
rules:
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create", "get", "watch", "list", "delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "pods/log"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: gitea-act-runner
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: gitea-act-runner
|
||||
namespace: gitea
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: gitea-act-runner
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
@@ -23,23 +55,32 @@ spec:
|
||||
labels:
|
||||
app: gitea-act-runner
|
||||
spec:
|
||||
serviceAccountName: gitea-act-runner
|
||||
imagePullSecrets:
|
||||
- name: registry-pull-secret
|
||||
initContainers:
|
||||
- name: kaniko-bin
|
||||
image: registry.abrban.com/abrban/kaniko-executor:v1.23.2
|
||||
- name: install-kubectl
|
||||
image: registry.abrban.com/abrban/alpine:3
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: ["sh", "-c", "cp /kaniko/executor /kaniko-bin/executor && chmod +x /kaniko-bin/executor"]
|
||||
env:
|
||||
- name: HTTPS_PROXY
|
||||
value: "http://builder:BeeldiOr!12009@45.129.38.203:9911"
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
wget -q "https://dl.k8s.io/release/v1.35.0/bin/linux/amd64/kubectl" -O /tools/kubectl
|
||||
chmod +x /tools/kubectl
|
||||
volumeMounts:
|
||||
- name: kaniko-bin
|
||||
mountPath: /kaniko-bin
|
||||
- name: tools
|
||||
mountPath: /tools
|
||||
containers:
|
||||
- name: runner
|
||||
image: registry.abrban.com/abrban/act-runner:0.2.11
|
||||
imagePullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: GITEA_INSTANCE_URL
|
||||
value: https://git.abrban.com
|
||||
value: http://gitea-http.gitea.svc.cluster.local:3000
|
||||
- name: GITEA_RUNNER_REGISTRATION_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
@@ -48,10 +89,15 @@ spec:
|
||||
- name: GITEA_RUNNER_NAME
|
||||
value: k8s-abr-runner
|
||||
- name: GITEA_RUNNER_LABELS
|
||||
value: abrban-kaniko:host
|
||||
value: abrban-builder:host
|
||||
volumeMounts:
|
||||
- name: kaniko-bin
|
||||
mountPath: /kaniko
|
||||
- name: tools
|
||||
mountPath: /usr/local/bin/kubectl
|
||||
subPath: kubectl
|
||||
- name: runner-data
|
||||
mountPath: /data
|
||||
volumes:
|
||||
- name: kaniko-bin
|
||||
- name: tools
|
||||
emptyDir: {}
|
||||
- name: runner-data
|
||||
emptyDir: {}
|
||||
|
||||
@@ -14,7 +14,8 @@ spec:
|
||||
- name: registry-pull-secret
|
||||
containers:
|
||||
- name: skopeo
|
||||
image: registry.abrban.com/proxy-quay/skopeo/stable:latest
|
||||
image: quay.io/skopeo/stable:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: registry-egress-proxy
|
||||
@@ -24,10 +25,11 @@ spec:
|
||||
- |
|
||||
set -eux
|
||||
DEST="docker://harbor-registry.cloudhost.svc.cluster.local:5000/abrban"
|
||||
skopeo copy --dest-tls-verify=false \
|
||||
docker://docker.gitea.com/gitea/act_runner:0.2.11 \
|
||||
CREDS="harbor_registry_user:harbor_registry_password"
|
||||
skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
|
||||
docker://docker.io/gitea/act_runner:0.2.11 \
|
||||
"${DEST}/act-runner:0.2.11"
|
||||
skopeo copy --dest-tls-verify=false \
|
||||
skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
|
||||
docker://gcr.io/kaniko-project/executor:v1.23.2 \
|
||||
"${DEST}/kaniko-executor:v1.23.2"
|
||||
echo SEED_OK
|
||||
|
||||
Reference in New Issue
Block a user