Day 28 — 測試部署作業：gitlab ci - iT 邦幫忙::一起幫忙解決難題，拯救 IT 人的一天

2022 iThome 鐵人賽

DAY 28

DevOps

前端轉生～到了實驗室就要養幾隻可愛鯨魚：自架 Kubernetes 迷航日記系列第 28 篇

Day 28 — 測試部署作業：gitlab ci

14th鐵人賽 kubernetes gitlab gitlab-ci

Time

2022-10-12 23:22:15

2330 瀏覽

分享至

可愛鯨魚

鯨魚飄啊飄～貨櫃到底能不能部署上去呢
圖片來源：Docker (@Docker) / Twitter

GitLab 與 Runner

GitLab & Runner
圖片來源：架設 GitLab CI Runner - iT 邦幫忙::一起幫忙解決難題，拯救 IT 人的一天

Runner 服務

使用指令向 GitLab 註冊 Runner 後，產生設定檔 config.toml，Runner 根據設定檔啟動服務，GitLab 確認 Runner 狀態

產生 Pipeline

當 project 推送更新後，GitLab 依照 .gitlab-ci.yml 檔案產生 Pipeline

Runner 執行 Job

GitLab 依照每個 Job 規定的 Tag，分配給符合 Tag 的 Runner 執行

runner execute job

Runner 必須包含 Job 訂定的 Tag，否則會被判定無法處理該 Job

Runner 執行指令

Runner 接續執行 Job 設定的動作

gitlab runner 設定

回頭看 gitlab 的設定檔 values.yaml，其實就有安裝了 gitlab runner，就直接使用 Kuberntes executor 吧～

若要自己安裝可以另外看看 Install Runner

進入專案 Settings > CI/CD > Runners 可以看到有一個可用的 Runner

自簽憑證的 gitlab 設定項目

但因為是自簽憑證、gitlab 外又有自己掛了 Traefik 做 Ingress Controller，需要再額外設定

建立自己的 gitlab-runner-helper image，將 ca.crt 放進 image

FROM registry.gitlab.com/gitlab-org/gitlab-runner/gitlab-runner-helper:alpine-latest-x86_64-bbcb5aba

RUN apk update >/dev/null   \
    apk add ca-certificates > /dev/null \
    rm -rf /var/cache/apk/*

COPY ca.crt /usr/local/share/ca-certificates/ca.crt

RUN update-ca-certificates --fresh > /dev/nul

RUN rm /usr/local/share/ca-certificates/ca.crt

build & push to registry (Harbor)

$ docker build -t harbor.example.domain.com/library/gitlab-runner-helper:x86_64-bbcb5aba .
$ docker push harbor.example.domain.com/library/gitlab-runner-helper:x86_64-bbcb5aba

建立一個 secret 放憑證
注意 filename 必須符合 <gitlab.host>.crt

kubectl create secret -n gitlab generic gitlab-tls \
    --from-file=ca.crt \
    --from-file=gitlab.example.domain.com.crt=example.domain.com.pem \
    --from-file=minio.example.domain.com.crt=example.domain.com.pem \
    --from-file=harbor.example.domain.com.crt=example.domain.com.pem

gitlab-runner 設定項目

certsSecretName: 指定 secret
hostAliases: 自己指定 gitlab 網址到 Traefik 的外部 ip
runners.config:
- 指定 runners.kubernetes 的 helper_image
- runners.kubernetes.host_aliases 設定 job 會用到的網址

gitlab-runner:
  install: true
  certsSecretName: gitlab-tls
  hostAliases:
  - hostnames:
    - "gitlab.example.domain.com"
    - "minio.example.domain.com"
    - "harbor.example.domain.com"
    ip: "10.1.0.1"
  rbac:
    create: true
  runners:
    locked: false
    config: |
      [[runners]]
        url = "https://gitlab.example.domain.com"
        [runners.kubernetes]
        image = "ubuntu:18.04"
        helper_image = "harbor.example.domain.com/library/gitlab-runner-helper:x86_64-bbcb5aba"
        [[runners.kubernetes.host_aliases]]
          IP = "10.1.0.1"
          Hostnames = ["gitlab.example.domain.com", "harbor.example.domain.com", "minio.example.domain.com"]
        [runners.kubernetes.volumes]
          [[runners.kubernetes.volumes.secret]]
            name = "gitlab-tls"
            mount_path = "/etc/gitlab-runner/certs/"
            read_only = true
        {{- if .Values.global.minio.enabled }}
        [runners.cache]
          Type = "s3"
          Path = "gitlab-runner"
          Shared = true
          [runners.cache.s3]
            ServerAddress = {{ include "gitlab-runner.cache-tpl.s3ServerAddress" . }}
            BucketName = "runner-cache"
            BucketLocation = "us-east-1"
            Insecure = false
        {{ end }}
  podAnnotations:
    gitlab.com/prometheus_scrape: "true"
    gitlab.com/prometheus_port: 9252

gitlab ci

.gitlab-ci.yml

以下方 .gitlab-ci.yml 為例，分為2個 stage 和3個 job

test:
- react-app-unit-test: 做 react app 單元測試
build:
- build-react-app: 打包 react app 成實體檔案並上傳儲存到 gitlab artifacts
- build-image: 使用 kaniko 透過 Dockerfile 打包 react app 並推送到 registry (這裡使用自架的 Harbor)

stages:
  - test
  - build

cache:
  paths:
    - node_modules/


react-app-unit-test:
  stage: test
  image: node:15
  script:
    - npm install
    - npm run test

build-react-app:
  stage: build
  image: node:15
  script:
    - npm install
    - npm run build
  artifacts:
    paths:
      - dist/


build-image:
  stage: build
  image:
    name: gcr.io/kaniko-project/executor:v1.9.0-debug
    entrypoint: [""]
  before_script:
    - mkdir -p /kaniko/.docker
    - echo "{\"auths\":{\"${CI_HARBOR}\":{\"username\":\"${CI_HARBOR_USERNAME}\",\"password\":\"${CI_HARBOR_PASSWORD}\"}}}" > /kaniko/.docker/config.json
  script:
    - /kaniko/executor
      --context "${CI_PROJECT_DIR}"
      --dockerfile "${CI_PROJECT_DIR}/Dockerfile"
      --destination "${CI_HARBOR}/${CI_PROJECT_PATH}:${CI_COMMIT_SHORT_SHA}"
      --registry-certificate "${CI_HARBOR}=/etc/gitlab-runner/certs/${CI_HARBOR}.crt"