jenkins
This commit is contained in:
Yvan
@@ -1,12 +1,12 @@
|
||||
# 后端配置文件模板。
|
||||
# 部署人员将其放置到 K8s 节点的 /var/lib/<APP_NAME>/conf/config.yaml（默认 kra 项目为 /var/lib/kra/conf/config.yaml），
|
||||
# 并执行 chown -R 1000:1000 /var/lib/<APP_NAME>/conf（容器内运行用户为 UID/GID 1000）。
|
||||
# Jenkins 会用 APP_NAME 渲染本文件，并通过 ConfigMap/初始化容器写入共享配置 PVC。
|
||||
# 容器内运行用户为 UID/GID 1000，初始化向导会把运行时配置写回本文件。
|
||||
#
|
||||
# 说明：
|
||||
# - data.database 保持为空：应用启动后首页会出现"前往初始化"，
|
||||
# 在初始化页面填写数据库连接后，框架会自动把连接配置写回本文件。
|
||||
# - data.redis.addr 指向集群内 Redis Service（<APP_NAME>-redis:6379）。
|
||||
# - admin.app.env / admin.app.app_id 按项目实际值修改。
|
||||
# - admin.app.env / admin.app.app_id / admin.jwt.issuer 由 Jenkins 按项目和分支渲染。
|
||||
server:
|
||||
http:
|
||||
network: tcp
|
||||
@@ -31,7 +31,7 @@ data:
|
||||
redis:
|
||||
network: tcp
|
||||
name: default
|
||||
addr: kra-redis:6379
|
||||
addr: ${APP_NAME}-redis:6379
|
||||
password: ""
|
||||
db: 0
|
||||
use_cluster: false
|
||||
@@ -43,7 +43,7 @@ admin:
|
||||
signing_key: ""
|
||||
expires_time: 604800s
|
||||
buffer_time: 86400s
|
||||
issuer: kra
|
||||
issuer: ${APP_NAME}
|
||||
system:
|
||||
use_redis: false
|
||||
use_multipoint: false
|
||||
@@ -67,5 +67,5 @@ admin:
|
||||
mode: whitelist
|
||||
whitelist: []
|
||||
app:
|
||||
app_id: kra
|
||||
env: production
|
||||
app_id: ${APP_NAME}
|
||||
env: ${KRA_ENV}
|
||||
|
||||
+94
-13
@@ -7,6 +7,7 @@
|
||||
# KRA_BACKEND_NODEPORT node port for the backend debug service
|
||||
# KRA_MYSQL_IMAGE mysql server image
|
||||
# KRA_REDIS_IMAGE redis server image
|
||||
# KRA_SHARED_STORAGE_CLASS RWX storage class for config and uploads
|
||||
# KRA_BACKEND_IMAGE backend image built by Jenkins
|
||||
# KRA_FRONTEND_IMAGE frontend image built by Jenkins
|
||||
# BIN_NAME backend binary name inside the image
|
||||
@@ -84,6 +85,20 @@ spec:
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: ${KRA_APP}-mysql
|
||||
namespace: ${KRA_NAMESPACE}
|
||||
spec:
|
||||
clusterIP: None
|
||||
selector:
|
||||
app.kubernetes.io/name: ${KRA_APP}-mysql
|
||||
ports:
|
||||
- name: mysql
|
||||
port: 3306
|
||||
targetPort: mysql
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: ${KRA_APP}-redis
|
||||
namespace: ${KRA_NAMESPACE}
|
||||
@@ -114,10 +129,25 @@ spec:
|
||||
app.kubernetes.io/name: ${KRA_APP}-redis
|
||||
app.kubernetes.io/part-of: ${KRA_APP}
|
||||
spec:
|
||||
initContainers:
|
||||
- name: prepare-redis-storage
|
||||
image: ${KRA_REDIS_IMAGE}
|
||||
imagePullPolicy: IfNotPresent
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
command: ["sh", "-c"]
|
||||
args:
|
||||
- chown -R redis:redis /data
|
||||
volumeMounts:
|
||||
- name: redis-data
|
||||
mountPath: /data
|
||||
containers:
|
||||
- name: redis
|
||||
image: ${KRA_REDIS_IMAGE}
|
||||
imagePullPolicy: IfNotPresent
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
ports:
|
||||
- name: redis
|
||||
containerPort: 6379
|
||||
@@ -173,7 +203,33 @@ spec:
|
||||
app.kubernetes.io/name: ${KRA_APP}-backend
|
||||
app.kubernetes.io/part-of: ${KRA_APP}
|
||||
spec:
|
||||
# /data/conf 由部署人员预先放置 config.yaml（见 deploy/k8s/config.example.yaml），
|
||||
securityContext:
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
initContainers:
|
||||
- name: initialize-shared-storage
|
||||
image: ${KRA_BACKEND_IMAGE}
|
||||
imagePullPolicy: Always
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
command: ["sh", "-c"]
|
||||
args:
|
||||
- >-
|
||||
mkdir -p /data/conf /app/uploads;
|
||||
if [ ! -f /data/conf/config.yaml ]; then
|
||||
cp /bootstrap/config.yaml /data/conf/config.yaml;
|
||||
fi;
|
||||
chmod u+rwX,g+rwX /data/conf /data/conf/config.yaml /app/uploads
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /data/conf
|
||||
- name: uploads
|
||||
mountPath: /app/uploads
|
||||
- name: config-template
|
||||
mountPath: /bootstrap
|
||||
readOnly: true
|
||||
# /data/conf 由初始化容器从 ConfigMap 初始化到共享 PVC，
|
||||
# 目录必须可写：初始化向导会把数据库连接写回该文件。
|
||||
imagePullSecrets:
|
||||
- name: harbor-registry
|
||||
@@ -198,16 +254,12 @@ spec:
|
||||
env:
|
||||
# 数据库连接不在这里注入：应用启动时未配置数据库会进入 bootstrap 模式，
|
||||
# 首页出现"前往初始化"，由 /init/initdb 建表、写入种子数据并持久化连接配置。
|
||||
# 只注入 JWT 签名密钥；Redis 地址已在下方 config.yaml 中指定。
|
||||
- name: KRA_ADMIN_JWT_SIGNING_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: ${KRA_APP}-runtime
|
||||
key: jwt-signing-key
|
||||
# JWT 签名密钥由 /data/conf/config.yaml 唯一管理，避免环境变量覆盖管理页面的配置变更；
|
||||
# Redis 地址已在下方 config.yaml 中指定。
|
||||
- name: KRA_ADMIN_SYSTEM_USE_REDIS
|
||||
value: "true"
|
||||
volumeMounts:
|
||||
- name: conf
|
||||
- name: config
|
||||
mountPath: /data/conf
|
||||
- name: uploads
|
||||
mountPath: /app/uploads
|
||||
@@ -235,12 +287,41 @@ spec:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
volumes:
|
||||
- name: conf
|
||||
hostPath:
|
||||
path: /var/lib/${KRA_APP}/conf
|
||||
type: DirectoryOrCreate
|
||||
- name: config
|
||||
persistentVolumeClaim:
|
||||
claimName: ${KRA_APP}-config
|
||||
- name: uploads
|
||||
emptyDir: {}
|
||||
persistentVolumeClaim:
|
||||
claimName: ${KRA_APP}-uploads
|
||||
- name: config-template
|
||||
configMap:
|
||||
name: ${KRA_APP}-config-template
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: ${KRA_APP}-config
|
||||
namespace: ${KRA_NAMESPACE}
|
||||
spec:
|
||||
storageClassName: ${KRA_SHARED_STORAGE_CLASS}
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: ${KRA_APP}-uploads
|
||||
namespace: ${KRA_NAMESPACE}
|
||||
spec:
|
||||
storageClassName: ${KRA_SHARED_STORAGE_CLASS}
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 20Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
|
||||
@@ -14,6 +14,3 @@ type: Opaque
|
||||
stringData:
|
||||
# 替换为随机值；不要把真实密码提交进 Git。
|
||||
mysql-root-password: "CHANGE_ME_TO_A_RANDOM_VALUE"
|
||||
database-source: "root:CHANGE_ME_TO_A_RANDOM_VALUE@tcp(<APP_NAME>-mysql:3306)/<APP_NAME>?charset=utf8mb4&parseTime=True&loc=Local"
|
||||
redis-addr: "<APP_NAME>-redis:6379"
|
||||
jwt-signing-key: "CHANGE_ME_TO_A_LONG_RANDOM_VALUE"
|
||||
|
||||
Reference in New Issue
Block a user