keyhan
6d9cd89cc5
Document server-side rollout (values, Sealed Secrets, logging, greenfield reset) with environment variables so any cluster can follow the same steps. Co-authored-by: Cursor <cursoragent@cursor.com>
95 lines
4.5 KiB
Markdown
95 lines
4.5 KiB
Markdown
# GitOps stack for abrban.com
|
|
|
|
> **راهنمای استقرار از صفر (هر محیط):** [`RUNBOOK-DEPLOY.fa.md`](../RUNBOOK-DEPLOY.fa.md) — متغیرها، values، Sealed Secrets، logging، deploy، greenfield reset.
|
|
|
|
## DNS (A record → cluster IP `78.157.39.52`)
|
|
|
|
| Host | Purpose |
|
|
|------|---------|
|
|
| `abrban.com` | Landing / frontend |
|
|
| `panel.abrban.com` | Authenticated panel |
|
|
| `api.abrban.com` | Backend API |
|
|
| `registry.abrban.com` | Harbor |
|
|
| `git.abrban.com` | Gitea |
|
|
| `argocd.abrban.com` | Argo CD |
|
|
|
|
## Harbor proxy-cache (بدون mirror دستی)
|
|
|
|
Harbor ایمیجهای upstream را on-demand میکشد و cache میکند:
|
|
|
|
| پروژه Harbor | upstream | مثال |
|
|
|--------------|----------|------|
|
|
| `proxy-dockerhub` | docker.io | `registry.abrban.com/proxy-dockerhub/alpine/git:2.43.0` |
|
|
| `proxy-quay` | quay.io | `registry.abrban.com/proxy-quay/argoproj/argocd:v3.4.4` |
|
|
| `proxy-k8s` | registry.k8s.io | CSI sidecarها |
|
|
| `proxy-gitea` | docker.gitea.com | `registry.abrban.com/proxy-gitea/gitea:1.26.1-rootless` |
|
|
| `proxy-gcr` | gcr.io | `registry.abrban.com/proxy-gcr/kaniko-project/executor:v1.23.2` |
|
|
| `abrban` | — | ایمیجهای ساختهشده (backend/frontend) |
|
|
|
|
اولین pull هر ایمیج کمی طول میکشد (Harbor از upstream میکشد). **نیازی به Job skopeo جداگانه نیست.**
|
|
|
|
k3s باید `registry.abrban.com` را به Harbor داخلی route کند:
|
|
|
|
```bash
|
|
./scripts/apply-k3s-registries.sh
|
|
```
|
|
|
|
## Install order
|
|
|
|
```bash
|
|
# 1. k3s → Harbor داخلی (بدون Traefik timeout)
|
|
./scripts/apply-k3s-registries.sh
|
|
|
|
# 2. Argo CD
|
|
helm upgrade --install argocd argo/argo-cd -n argocd --create-namespace \
|
|
-f gitops/argocd/values-bootstrap.yaml --timeout 15m --wait
|
|
|
|
# 3. Gitea (ایمیجها از Harbor proxy-gitea)
|
|
helm upgrade --install gitea gitea-charts/gitea -n gitea --create-namespace \
|
|
-f gitops/gitea/values.yaml --timeout 15m --wait
|
|
|
|
# 4. TLS + registry + egress secrets در namespaceهای argocd/gitea/cloudhost-builds
|
|
for ns in argocd gitea cloudhost-builds; do
|
|
kubectl -n cloudhost get secret abrban-wildcard-tls -o yaml | sed "s/namespace: cloudhost/namespace: ${ns}/" | kubectl apply -f -
|
|
kubectl -n cloudhost get secret registry-pull-secret -o yaml | sed "s/namespace: cloudhost/namespace: ${ns}/" | kubectl apply -f -
|
|
done
|
|
for ns in gitea cloudhost-builds; do
|
|
kubectl -n cloudhost get secret registry-egress-proxy -o yaml | sed "s/namespace: cloudhost/namespace: ${ns}/" | kubectl apply -f -
|
|
done
|
|
|
|
# 5. Seed ایمیجهای CI در Harbor abrban/ (یکبار — الزامی قبل از Pipeline)
|
|
kubectl apply -f gitops/jobs/seed-ci-images.yaml
|
|
kubectl -n cloudhost wait --for=condition=complete job/seed-ci-images --timeout=15m
|
|
|
|
# 6. Sealed Secrets controller
|
|
helm repo add sealed-secrets https://bitnami.github.io/sealed-secrets
|
|
helm upgrade --install sealed-secrets sealed-secrets/sealed-secrets \
|
|
-n kube-system -f gitops/sealed-secrets/values.yaml --timeout 10m --wait
|
|
|
|
# 7. git push سورس به Gitea
|
|
# git remote add gitea https://git.abrban.com/abrban/cloud-host.git
|
|
# git push gitea main
|
|
# ریپوی GitOps: https://git.abrban.com/abrban/cloud-host-gitops (SealedSecretها + values)
|
|
|
|
# 8. Gitea Actions runner
|
|
# توکن ثبت: SealedSecret در cloud-host-gitops/sealed-secrets/gitea-act-runner-token.yaml
|
|
kubectl apply -f gitops/gitea/act-runner.yaml
|
|
|
|
# 9. Argo CD Application (multi-source: chart از cloud-host، values از cloud-host-gitops)
|
|
kubectl apply -f gitops/argocd/application-platform.yaml
|
|
|
|
# 10. اولین deploy: push به main → Gitea Actions → Argo CD sync (جریان عادی)
|
|
# برای bootstrap دستی: TAG=... ./scripts/gitops-deploy.sh
|
|
```
|
|
|
|
## CI/CD
|
|
|
|
Gitea Actions: [.gitea/workflows/build-deploy.yaml](../.gitea/workflows/build-deploy.yaml)
|
|
|
|
Push به `main` → **تست Jest** → Kaniko → push به `abrban/` → کامیت tag در ریپوی [cloud-host-gitops](https://git.abrban.com/abrban/cloud-host-gitops) → ArgoCD sync.
|
|
|
|
- **استقرار اولیه از صفر:** [`RUNBOOK-DEPLOY.fa.md`](../RUNBOOK-DEPLOY.fa.md) (فاز ۲–۷)
|
|
- مقادیر Production: [`platform/values-abrban.example.yaml`](platform/values-abrban.example.yaml) → کپی به gitops و ویرایش
|
|
- SealedSecretهای نمونه: [`sealed-secrets/abrban-platform-secrets.example.yaml`](sealed-secrets/abrban-platform-secrets.example.yaml)، [`sealed-secrets/elasticsearch-credentials.example.yaml`](sealed-secrets/elasticsearch-credentials.example.yaml)
|
|
- Pipeline و rollback: [RUNBOOK-CICD.fa.md](../RUNBOOK-CICD.fa.md)
|