This commit is contained in:
Your Name
+53
-102
@@ -1,118 +1,69 @@
|
||||
name: Deploy im-server (k3s test cluster)
|
||||
name: Deploy im-server production
|
||||
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- pro
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
image_tag:
|
||||
description: '镜像tag，默认为 test（与集群 kustomization 里的 newTag 一致）'
|
||||
required: false
|
||||
|
||||
concurrency:
|
||||
group: production-im-server
|
||||
cancel-in-progress: false
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
env:
|
||||
REGISTRY: git.olns.shop
|
||||
IMAGE: git.olns.shop/pro/im_server
|
||||
SERVICE: im-server
|
||||
DEPLOY_HOST: 145.223.69.9
|
||||
DEPLOY_USER: olns-deploy
|
||||
|
||||
jobs:
|
||||
deploy:
|
||||
runs-on: deploy-host
|
||||
timeout-minutes: 60
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: 确定镜像tag
|
||||
id: vars
|
||||
- name: Log in to Gitea Container Registry
|
||||
env:
|
||||
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
||||
run: |
|
||||
TAG="${{ github.event.inputs.image_tag }}"
|
||||
[ -z "$TAG" ] && TAG=test
|
||||
echo "tag=$TAG" >> "$GITHUB_OUTPUT"
|
||||
set -euo pipefail
|
||||
printf '%s' "$REGISTRY_TOKEN" | docker login "$REGISTRY" -u admin --password-stdin
|
||||
|
||||
- name: 登录镜像仓库
|
||||
run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.118im.com -u admin --password-stdin
|
||||
|
||||
- name: 构建并推送镜像(从本仓库源码编译，不是官方预编译包)
|
||||
- name: Build and push image
|
||||
env:
|
||||
GITHUB_SHA: ${{ github.sha }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
SHORT_SHA="$(printf '%.12s' "$GITHUB_SHA")"
|
||||
docker build -f docker/tinode/Dockerfile.build \
|
||||
-t git.118im.com/im_team/im-server:${{ steps.vars.outputs.tag }} .
|
||||
docker push git.118im.com/im_team/im-server:${{ steps.vars.outputs.tag }}
|
||||
-t "${IMAGE}:pro" -t "${IMAGE}:${SHORT_SHA}" .
|
||||
docker push "$IMAGE:pro"
|
||||
docker push "$IMAGE:$SHORT_SHA"
|
||||
|
||||
- name: 部署到k3s测试集群
|
||||
- name: Deploy Compose service
|
||||
env:
|
||||
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
||||
DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
|
||||
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
||||
run: |
|
||||
mkdir -p ~/.kube
|
||||
echo "${{ secrets.KUBECONFIG }}" > ~/.kube/config
|
||||
chmod 600 ~/.kube/config
|
||||
kubectl set resources statefulset/im-server -n im-server-system -c im-server \
|
||||
--requests=cpu=2,memory=512Mi --limits=cpu=2,memory=1Gi
|
||||
kubectl set env statefulset/im-server -n im-server-system -c im-server \
|
||||
CLUSTER_PROXY_TO_MASTER_BUFFER=4096 \
|
||||
CLUSTER_PROXY_TO_MASTER_WORKERS=16 \
|
||||
CLUSTER_PROXY_TO_MASTER_ENQUEUE_TIMEOUT_MS=300 \
|
||||
CLUSTER_ROUTE_RETRIES=3 \
|
||||
CLUSTER_ROUTE_RETRY_BACKOFF_MS=25 \
|
||||
MYSQL_MAX_OPEN_CONNS=24 \
|
||||
MYSQL_MAX_IDLE_CONNS=8 \
|
||||
MYSQL_REGISTRY_MAX_OPEN_CONNS=4 \
|
||||
MYSQL_REGISTRY_MAX_IDLE_CONNS=2 \
|
||||
MYSQL_CONN_MAX_LIFETIME_SECONDS=1800
|
||||
kubectl patch statefulset/im-server -n im-server-system --type=strategic -p \
|
||||
'{"spec":{"template":{"spec":{"containers":[{"name":"im-server","readinessProbe":{"httpGet":{"path":"/healthz","port":6060},"timeoutSeconds":3,"periodSeconds":10,"failureThreshold":3},"livenessProbe":{"httpGet":{"path":"/livez","port":6060},"timeoutSeconds":3,"periodSeconds":20,"failureThreshold":3}}]}}}}'
|
||||
if kubectl auth can-i get services -n im-server-system >/dev/null 2>&1 && \
|
||||
kubectl auth can-i patch services -n im-server-system >/dev/null 2>&1; then
|
||||
kubectl patch service/im-server -n im-server-system --type=merge -p \
|
||||
'{"spec":{"sessionAffinity":"None"}}'
|
||||
else
|
||||
echo "::warning::ci-deployer cannot get/patch Service; skipped sessionAffinity update"
|
||||
fi
|
||||
if kubectl auth can-i get ingresses.networking.k8s.io -n im-server-system >/dev/null 2>&1 && \
|
||||
kubectl auth can-i patch ingresses.networking.k8s.io -n im-server-system >/dev/null 2>&1 && \
|
||||
kubectl get ingress/im-server -n im-server-system >/dev/null 2>&1; then
|
||||
kubectl annotate ingress/im-server -n im-server-system --overwrite \
|
||||
nginx.ingress.kubernetes.io/load-balance=least_conn
|
||||
else
|
||||
echo "::warning::ci-deployer cannot manage Ingress/im-server or it does not exist; skipped least_conn update"
|
||||
fi
|
||||
kubectl rollout restart statefulset/im-server -n im-server-system
|
||||
if ! kubectl rollout status statefulset/im-server -n im-server-system --timeout=300s; then
|
||||
echo "::error::im-server rollout did not become ready within 300 seconds"
|
||||
kubectl get statefulset/im-server -n im-server-system -o wide || true
|
||||
kubectl get pods -n im-server-system -l app=im-server -o wide || true
|
||||
kubectl describe statefulset/im-server -n im-server-system || true
|
||||
for pod in $(kubectl get pods -n im-server-system -l app=im-server -o name 2>/dev/null); do
|
||||
echo "===== ${pod} describe ====="
|
||||
kubectl describe -n im-server-system "${pod}" || true
|
||||
echo "===== ${pod} current log ====="
|
||||
kubectl logs -n im-server-system "${pod}" -c im-server --tail=200 || true
|
||||
echo "===== ${pod} previous log ====="
|
||||
kubectl logs -n im-server-system "${pod}" -c im-server --previous --tail=200 || true
|
||||
done
|
||||
if kubectl auth can-i list events -n im-server-system >/dev/null 2>&1; then
|
||||
echo "===== recent events ====="
|
||||
kubectl get events -n im-server-system --sort-by=.lastTimestamp | tail -100 || true
|
||||
fi
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Waiting for ArgoCD reconciliation before validating effective settings"
|
||||
sleep 60
|
||||
request_cpu="$(kubectl get statefulset/im-server -n im-server-system -o \
|
||||
jsonpath='{.spec.template.spec.containers[?(@.name=="im-server")].resources.requests.cpu}')"
|
||||
request_memory="$(kubectl get statefulset/im-server -n im-server-system -o \
|
||||
jsonpath='{.spec.template.spec.containers[?(@.name=="im-server")].resources.requests.memory}')"
|
||||
limit_cpu="$(kubectl get statefulset/im-server -n im-server-system -o \
|
||||
jsonpath='{.spec.template.spec.containers[?(@.name=="im-server")].resources.limits.cpu}')"
|
||||
limit_memory="$(kubectl get statefulset/im-server -n im-server-system -o \
|
||||
jsonpath='{.spec.template.spec.containers[?(@.name=="im-server")].resources.limits.memory}')"
|
||||
liveness="$(kubectl get statefulset/im-server -n im-server-system -o \
|
||||
jsonpath='{.spec.template.spec.containers[?(@.name=="im-server")].livenessProbe.httpGet.path}')"
|
||||
mysql_max_open="$(kubectl get statefulset/im-server -n im-server-system -o \
|
||||
jsonpath='{.spec.template.spec.containers[?(@.name=="im-server")].env[?(@.name=="MYSQL_MAX_OPEN_CONNS")].value}')"
|
||||
mysql_max_idle="$(kubectl get statefulset/im-server -n im-server-system -o \
|
||||
jsonpath='{.spec.template.spec.containers[?(@.name=="im-server")].env[?(@.name=="MYSQL_MAX_IDLE_CONNS")].value}')"
|
||||
mysql_registry_max_open="$(kubectl get statefulset/im-server -n im-server-system -o \
|
||||
jsonpath='{.spec.template.spec.containers[?(@.name=="im-server")].env[?(@.name=="MYSQL_REGISTRY_MAX_OPEN_CONNS")].value}')"
|
||||
mysql_registry_max_idle="$(kubectl get statefulset/im-server -n im-server-system -o \
|
||||
jsonpath='{.spec.template.spec.containers[?(@.name=="im-server")].env[?(@.name=="MYSQL_REGISTRY_MAX_IDLE_CONNS")].value}')"
|
||||
mysql_conn_max_lifetime="$(kubectl get statefulset/im-server -n im-server-system -o \
|
||||
jsonpath='{.spec.template.spec.containers[?(@.name=="im-server")].env[?(@.name=="MYSQL_CONN_MAX_LIFETIME_SECONDS")].value}')"
|
||||
echo "effective requests=${request_cpu}/${request_memory} limits=${limit_cpu}/${limit_memory} liveness=${liveness} mysql=${mysql_max_open}/${mysql_max_idle} registry=${mysql_registry_max_open}/${mysql_registry_max_idle} lifetime=${mysql_conn_max_lifetime}"
|
||||
if [ "${request_cpu}" != "2" ] || [ "${request_memory}" != "512Mi" ] || \
|
||||
[ "${limit_cpu}" != "2" ] || [ "${limit_memory}" != "1Gi" ] || \
|
||||
[ "${liveness}" != "/livez" ] || [ "${mysql_max_open}" != "24" ] || \
|
||||
[ "${mysql_max_idle}" != "8" ] || [ "${mysql_registry_max_open}" != "4" ] || \
|
||||
[ "${mysql_registry_max_idle}" != "2" ] || [ "${mysql_conn_max_lifetime}" != "1800" ]; then
|
||||
echo "::error::ArgoCD reverted StatefulSet resources/probes/MySQL pools. Apply deploy/argocd/im-server-test/statefulset-performance-patch.yaml to the im-server-test source."
|
||||
exit 1
|
||||
fi
|
||||
set -euo pipefail
|
||||
install -d -m 700 "$HOME/.ssh"
|
||||
KEY_FILE="$(mktemp "$HOME/.ssh/olns-deploy.XXXXXX")"
|
||||
cleanup() {
|
||||
shred -u "$KEY_FILE" 2>/dev/null || true
|
||||
}
|
||||
trap cleanup EXIT
|
||||
printf '%s\n' "$DEPLOY_SSH_KEY" > "$KEY_FILE"
|
||||
chmod 600 "$KEY_FILE"
|
||||
printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
|
||||
chmod 600 "$HOME/.ssh/known_hosts"
|
||||
SSH_ARGS=(-i "$KEY_FILE" -o BatchMode=yes -o StrictHostKeyChecking=yes)
|
||||
printf '%s' "$REGISTRY_TOKEN" | ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
|
||||
"docker login git.olns.shop -u admin --password-stdin"
|
||||
ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
|
||||
"cd /opt/olns && docker compose pull im-server && docker compose up -d --no-deps --wait im-server"
|
||||
|
||||
@@ -0,0 +1,39 @@
|
||||
from pathlib import Path
|
||||
import unittest
|
||||
|
||||
|
||||
WORKFLOW = Path(__file__).resolve().parents[1] / ".gitea/workflows/deploy.yml"
|
||||
|
||||
|
||||
class DeployWorkflowContractTest(unittest.TestCase):
|
||||
@classmethod
|
||||
def setUpClass(cls):
|
||||
cls.workflow = WORKFLOW.read_text(encoding="utf-8")
|
||||
|
||||
def test_targets_pro_branch_and_single_runner(self):
|
||||
self.assertIn("push:", self.workflow)
|
||||
self.assertIn("- pro", self.workflow)
|
||||
self.assertIn("workflow_dispatch:", self.workflow)
|
||||
self.assertIn("runs-on: deploy-host", self.workflow)
|
||||
self.assertIn("concurrency:", self.workflow)
|
||||
|
||||
def test_builds_and_pushes_pro_image(self):
|
||||
self.assertIn("git.olns.shop/pro/im_server", self.workflow)
|
||||
self.assertIn("docker push", self.workflow)
|
||||
self.assertIn(":pro", self.workflow)
|
||||
|
||||
def test_deploys_compose_service_with_pinned_host_key(self):
|
||||
self.assertIn("DEPLOY_SSH_KEY", self.workflow)
|
||||
self.assertIn("DEPLOY_KNOWN_HOSTS", self.workflow)
|
||||
self.assertIn("StrictHostKeyChecking=yes", self.workflow)
|
||||
self.assertIn("docker compose pull im-server", self.workflow)
|
||||
self.assertIn("docker compose up -d --no-deps --wait im-server", self.workflow)
|
||||
|
||||
def test_removes_old_kubernetes_and_registry_targets(self):
|
||||
self.assertNotIn("kubectl", self.workflow)
|
||||
self.assertNotIn("KUBECONFIG", self.workflow)
|
||||
self.assertNotIn("git.118im.com", self.workflow)
|
||||
|
||||
if __name__ == "__main__":
|
||||
unittest.main()
|
||||
|
||||
Reference in New Issue
Block a user