jenkins
This commit is contained in:
Yvan
Vendored
+50
-20
@@ -16,6 +16,9 @@ pipeline {
|
||||
BIN_NAME = 'kratos-admin' // Makefile build 的产物名
|
||||
// 当前单节点部署固定使用单副本，避免首次初始化和 hostPath 数据共享产生竞争。
|
||||
KRA_REPLICAS = '1'
|
||||
// 中间件按环境开关；关闭时对应工作负载缩容到 0，不创建运行 Pod。
|
||||
KRA_DEPLOY_MYSQL = 'true'
|
||||
KRA_DEPLOY_REDIS = 'true'
|
||||
KRA_FRONTEND_NODEPORT = '30080'
|
||||
KRA_BACKEND_NODEPORT = '30081'
|
||||
KRA_MYSQL_IMAGE = 'docker.m.daocloud.io/library/mysql:8.4'
|
||||
@@ -33,7 +36,7 @@ pipeline {
|
||||
CRED_JWT_SIGNING_KEY = 'kra-jwt-signing-key'
|
||||
|
||||
// k8s 清单渲染白名单：只替换列出的变量，避免误伤清单内 shell 变量（如 probe 里的 $MYSQL_ROOT_PASSWORD）
|
||||
K8S_RENDER_VARS = '$KRA_APP $KRA_NAMESPACE $KRA_ENV $KRA_BACKEND_IMAGE $KRA_FRONTEND_IMAGE $KRA_REPLICAS $KRA_FRONTEND_NODEPORT $KRA_BACKEND_NODEPORT $KRA_MYSQL_IMAGE $KRA_REDIS_IMAGE $BIN_NAME'
|
||||
K8S_RENDER_VARS = '$KRA_APP $KRA_NAMESPACE $KRA_ENV $KRA_BACKEND_IMAGE $KRA_FRONTEND_IMAGE $KRA_REPLICAS $KRA_DEPLOY_MYSQL $KRA_DEPLOY_REDIS $KRA_MYSQL_REPLICAS $KRA_REDIS_REPLICAS $KRA_MYSQL_WAIT_IMAGE $KRA_FRONTEND_NODEPORT $KRA_BACKEND_NODEPORT $KRA_MYSQL_IMAGE $KRA_REDIS_IMAGE $BIN_NAME'
|
||||
}
|
||||
|
||||
stages {
|
||||
@@ -156,11 +159,23 @@ pipeline {
|
||||
|
||||
stage('Deploy to Rancher cluster') {
|
||||
steps {
|
||||
withCredentials([file(credentialsId: "${env.KUBECONFIG_CREDENTIALS}", variable: 'KUBECONFIG_FILE'),
|
||||
string(credentialsId: env.CRED_MYSQL_PASSWORD, variable: 'KRA_MYSQL_ROOT_PASSWORD'),
|
||||
string(credentialsId: env.CRED_JWT_SIGNING_KEY, variable: 'KRA_JWT_SIGNING_KEY'),
|
||||
usernamePassword(credentialsId: env.CRED_HARBOR_PUSH, usernameVariable: 'HARBOR_USER', passwordVariable: 'HARBOR_PASSWORD')]) {
|
||||
sh '''
|
||||
script {
|
||||
if (!(env.KRA_DEPLOY_MYSQL in ['true', 'false'])) {
|
||||
error("KRA_DEPLOY_MYSQL must be true or false: ${env.KRA_DEPLOY_MYSQL}")
|
||||
}
|
||||
if (!(env.KRA_DEPLOY_REDIS in ['true', 'false'])) {
|
||||
error("KRA_DEPLOY_REDIS must be true or false: ${env.KRA_DEPLOY_REDIS}")
|
||||
}
|
||||
def credentialBindings = [
|
||||
file(credentialsId: "${env.KUBECONFIG_CREDENTIALS}", variable: 'KUBECONFIG_FILE'),
|
||||
string(credentialsId: env.CRED_JWT_SIGNING_KEY, variable: 'KRA_JWT_SIGNING_KEY'),
|
||||
usernamePassword(credentialsId: env.CRED_HARBOR_PUSH, usernameVariable: 'HARBOR_USER', passwordVariable: 'HARBOR_PASSWORD')
|
||||
]
|
||||
if (env.KRA_DEPLOY_MYSQL == 'true') {
|
||||
credentialBindings << string(credentialsId: env.CRED_MYSQL_PASSWORD, variable: 'KRA_MYSQL_ROOT_PASSWORD')
|
||||
}
|
||||
withCredentials(credentialBindings) {
|
||||
sh '''
|
||||
set -eu
|
||||
export KUBECONFIG="$KUBECONFIG_FILE"
|
||||
umask 077
|
||||
@@ -175,11 +190,13 @@ pipeline {
|
||||
--from-file=.dockerconfigjson="$DOCKER_CONFIG_DIR/config.json" \\
|
||||
--dry-run=client -o yaml | kubectl apply -f -
|
||||
docker --config "$DOCKER_CONFIG_DIR" logout "$REGISTRY" >/dev/null 2>&1 || true
|
||||
test -n "$KRA_MYSQL_ROOT_PASSWORD" || { echo 'MySQL root password credential is empty' >&2; exit 1; }
|
||||
printf '%s' "$KRA_MYSQL_ROOT_PASSWORD" > "$TMP_DIR/mysql-root-password"
|
||||
kubectl -n "$KRA_NAMESPACE" create secret generic "${APP_NAME}-runtime" \\
|
||||
--from-file=mysql-root-password="$TMP_DIR/mysql-root-password" \\
|
||||
--dry-run=client -o yaml | kubectl apply -f -
|
||||
if [ "$KRA_DEPLOY_MYSQL" = 'true' ]; then
|
||||
test -n "$KRA_MYSQL_ROOT_PASSWORD" || { echo 'MySQL root password credential is empty' >&2; exit 1; }
|
||||
printf '%s' "$KRA_MYSQL_ROOT_PASSWORD" > "$TMP_DIR/mysql-root-password"
|
||||
kubectl -n "$KRA_NAMESPACE" create secret generic "${APP_NAME}-runtime" \\
|
||||
--from-file=mysql-root-password="$TMP_DIR/mysql-root-password" \\
|
||||
--dry-run=client -o yaml | kubectl apply -f -
|
||||
fi
|
||||
test -n "$KRA_JWT_SIGNING_KEY" || { echo 'JWT signing key credential is empty' >&2; exit 1; }
|
||||
if [ "$(printf '%s' "$KRA_JWT_SIGNING_KEY" | wc -l)" -ne 0 ]; then
|
||||
echo 'JWT signing key credential must be a single line' >&2
|
||||
@@ -197,26 +214,39 @@ pipeline {
|
||||
export KRA_APP="$APP_NAME"
|
||||
export KRA_BACKEND_IMAGE="$REGISTRY/$IMAGE_REPO-backend:$IMAGE_TAG"
|
||||
export KRA_FRONTEND_IMAGE="$REGISTRY/$IMAGE_REPO-frontend:$IMAGE_TAG"
|
||||
case "$KRA_DEPLOY_MYSQL" in
|
||||
true) export KRA_MYSQL_REPLICAS=1; export KRA_MYSQL_WAIT_IMAGE="$KRA_MYSQL_IMAGE" ;;
|
||||
false) export KRA_MYSQL_REPLICAS=0; export KRA_MYSQL_WAIT_IMAGE="$KRA_BACKEND_IMAGE" ;;
|
||||
*) echo 'KRA_DEPLOY_MYSQL must be true or false' >&2; exit 1 ;;
|
||||
esac
|
||||
case "$KRA_DEPLOY_REDIS" in
|
||||
true) export KRA_REDIS_REPLICAS=1 ;;
|
||||
false) export KRA_REDIS_REPLICAS=0 ;;
|
||||
*) echo 'KRA_DEPLOY_REDIS must be true or false' >&2; exit 1 ;;
|
||||
esac
|
||||
RENDERED_MANIFEST="$TMP_DIR/manifest.yaml"
|
||||
envsubst "$K8S_RENDER_VARS" < deploy/k8s/kra.yaml > "$RENDERED_MANIFEST"
|
||||
MYSQL_SERVICE_IP=$(kubectl -n "$KRA_NAMESPACE" get service "${APP_NAME}-mysql" -o jsonpath='{.spec.clusterIP}' 2>/dev/null || true)
|
||||
if [ -n "$MYSQL_SERVICE_IP" ] && [ "$MYSQL_SERVICE_IP" != 'None' ]; then
|
||||
if [ "$KRA_DEPLOY_MYSQL" = 'true' ] && [ -n "$MYSQL_SERVICE_IP" ] && [ "$MYSQL_SERVICE_IP" != 'None' ]; then
|
||||
echo "${APP_NAME}-mysql already exists as a ClusterIP Service; delete it during a maintenance window before switching to headless mode" >&2
|
||||
exit 1
|
||||
fi
|
||||
kubectl apply --dry-run=server -f "$RENDERED_MANIFEST"
|
||||
kubectl apply -f "$RENDERED_MANIFEST"
|
||||
RUNTIME_SECRET_VERSION=$(kubectl -n "$KRA_NAMESPACE" get secret "${APP_NAME}-runtime" -o jsonpath='{.metadata.resourceVersion}')
|
||||
PATCH_FILE="$TMP_DIR/mysql-patch.json"
|
||||
printf '{"spec":{"template":{"metadata":{"annotations":{"kra.dev/runtime-secret-version":"%s"}}}}}\n' \\
|
||||
"$RUNTIME_SECRET_VERSION" > "$PATCH_FILE"
|
||||
kubectl -n "$KRA_NAMESPACE" patch statefulset "${APP_NAME}-mysql" --type=merge \\
|
||||
--patch-file="$PATCH_FILE"
|
||||
kubectl -n "$KRA_NAMESPACE" rollout status statefulset/${APP_NAME}-mysql --timeout=10m
|
||||
if [ "$KRA_DEPLOY_MYSQL" = 'true' ]; then
|
||||
RUNTIME_SECRET_VERSION=$(kubectl -n "$KRA_NAMESPACE" get secret "${APP_NAME}-runtime" -o jsonpath='{.metadata.resourceVersion}')
|
||||
PATCH_FILE="$TMP_DIR/mysql-patch.json"
|
||||
printf '{"spec":{"template":{"metadata":{"annotations":{"kra.dev/runtime-secret-version":"%s"}}}}}\n' \\
|
||||
"$RUNTIME_SECRET_VERSION" > "$PATCH_FILE"
|
||||
kubectl -n "$KRA_NAMESPACE" patch statefulset "${APP_NAME}-mysql" --type=merge \\
|
||||
--patch-file="$PATCH_FILE"
|
||||
kubectl -n "$KRA_NAMESPACE" rollout status statefulset/${APP_NAME}-mysql --timeout=10m
|
||||
fi
|
||||
kubectl -n "$KRA_NAMESPACE" rollout status deployment/${APP_NAME}-redis --timeout=10m
|
||||
kubectl -n "$KRA_NAMESPACE" rollout status deployment/${APP_NAME}-backend --timeout=10m
|
||||
kubectl -n "$KRA_NAMESPACE" rollout status deployment/${APP_NAME}-frontend --timeout=10m
|
||||
'''
|
||||
'''
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user