Files

T

Build and Deploy Platform / build-and-deploy (push) Failing after 20m1s

Details

ci: split GitOps state into cloud-host-gitops repo, add Sealed Secrets, fix pipeline auth

- Workflow now pushes image tags to the separate cloud-host-gitops repo
  (no more CI loop risk) and authenticates via CI_TOKEN secret
- Fix undefined ${REGISTRY} in Kaniko jobs, add concurrency group,
  targeted tag update, and mounted kaniko-harbor-auth docker config
- Argo CD Application is now multi-source (chart from cloud-host,
  values from cloud-host-gitops)
- Remove plaintext runner token and proxy credentials from manifests;
  secrets are now SealedSecrets in the gitops repo

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-07-02 14:10:46 +03:30

3.7 KiB

Raw Blame History

GitOps stack for abrban.com

DNS (A record → cluster IP `78.157.39.52`)

Host	Purpose
`abrban.com`	Landing / frontend
`panel.abrban.com`	Authenticated panel
`api.abrban.com`	Backend API
`registry.abrban.com`	Harbor
`git.abrban.com`	Gitea
`argocd.abrban.com`	Argo CD

Harbor proxy-cache (بدون mirror دستی)

Harbor ایمیج‌های upstream را on-demand می‌کشد و cache می‌کند:

پروژه Harbor	upstream	مثال
`proxy-dockerhub`	docker.io	`registry.abrban.com/proxy-dockerhub/alpine/git:2.43.0`
`proxy-quay`	quay.io	`registry.abrban.com/proxy-quay/argoproj/argocd:v3.4.4`
`proxy-k8s`	registry.k8s.io	CSI sidecarها
`proxy-gitea`	docker.gitea.com	`registry.abrban.com/proxy-gitea/gitea:1.26.1-rootless`
`proxy-gcr`	gcr.io	`registry.abrban.com/proxy-gcr/kaniko-project/executor:v1.23.2`
`abrban`	—	ایمیج‌های ساخته‌شده (backend/frontend)

اولین pull هر ایمیج کمی طول می‌کشد (Harbor از upstream می‌کشد). نیازی به Job skopeo جداگانه نیست.

k3s باید registry.abrban.com را به Harbor داخلی route کند:

./scripts/apply-k3s-registries.sh

Install order

# 1. k3s → Harbor داخلی (بدون Traefik timeout)
./scripts/apply-k3s-registries.sh

# 2. Argo CD
helm upgrade --install argocd argo/argo-cd -n argocd --create-namespace \
  -f gitops/argocd/values-bootstrap.yaml --timeout 15m --wait

# 3. Gitea (ایمیج‌ها از Harbor proxy-gitea)
helm upgrade --install gitea gitea-charts/gitea -n gitea --create-namespace \
  -f gitops/gitea/values.yaml --timeout 15m --wait

# 4. TLS + registry secrets در namespaceهای argocd/gitea/cloudhost-builds
for ns in argocd gitea cloudhost-builds; do
  kubectl -n cloudhost get secret abrban-wildcard-tls -o yaml | sed "s/namespace: cloudhost/namespace: ${ns}/" | kubectl apply -f -
  kubectl -n cloudhost get secret registry-pull-secret -o yaml | sed "s/namespace: cloudhost/namespace: ${ns}/" | kubectl apply -f -
done

# پروکسی egress برای act-runner (دانلود kubectl در initContainer)
kubectl -n cloudhost get secret registry-egress-proxy -o yaml | sed 's/namespace: cloudhost/namespace: gitea/' | kubectl apply -f -

# 5. git push سورس به Gitea (نه docker push)
#    git remote add gitea https://git.abrban.com/abrban/cloud-host.git
#    git push gitea main

# 6. اولین build در کلاستر (Kaniko → abrban/)
./scripts/trigger-platform-build.sh

# 7. Deploy
./scripts/gitops-deploy.sh

# 8. Gitea Actions runner
#    توکن ثبت: SealedSecret در ریپوی cloud-host-gitops (sealed-secrets/gitea-act-runner-token.yaml)
#    یا دستی: kubectl -n gitea create secret generic gitea-act-runner-token --from-literal=token='<TOKEN>'
kubectl apply -f gitops/gitea/act-runner.yaml

# 9. Argo CD Application
kubectl apply -f gitops/argocd/application-platform.yaml

CI/CD

Gitea Actions: .gitea/workflows/build-deploy.yaml

Push به main → Kaniko → push به abrban/ → کامیت tag در ریپوی cloud-host-gitops → ArgoCD sync.

مقادیر Production در ریپوی جدا abrban/cloud-host-gitops است (platform/values-abrban.yaml)؛ Application به‌صورت multi-source تعریف شده.
Secretهای CI به‌صورت SealedSecret در همان ریپو هستند (کنترلر در kube-system، values در gitops/sealed-secrets/values.yaml).
مستند کامل: RUNBOOK-CICD.fa.md

3.7 KiB Raw Blame History