From cebc88295096921f168649b2af941b3fa8717dc5 Mon Sep 17 00:00:00 2001 From: vzaytsev Date: Fri, 25 Oct 2024 13:36:32 +0300 Subject: [PATCH] Added build dir Added integrations with k8s Added support for multiple stands --- .gitignore | 4 +- README.md | 0 build/Dockerfile | 39 ++++++++++++ build/Jenkinsfile | 62 +++++++++++++++++++ build/auth.config.tmpl | 19 ++++++ build/microservice.yaml.tmpl | 116 +++++++++++++++++++++++++++++++++++ build/vars/dev.yaml | 23 +++++++ build/vars/master.yaml | 23 +++++++ 8 files changed, 285 insertions(+), 1 deletion(-) create mode 100644 README.md create mode 100644 build/Dockerfile create mode 100644 build/Jenkinsfile create mode 100644 build/auth.config.tmpl create mode 100644 build/microservice.yaml.tmpl create mode 100644 build/vars/dev.yaml create mode 100644 build/vars/master.yaml diff --git a/.gitignore b/.gitignore index d356eab..f4dd556 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,3 @@ -etc/info/ \ No newline at end of file +etc/info/ + +build/manifests/ \ No newline at end of file diff --git a/README.md b/README.md new file mode 100644 index 0000000..e69de29 diff --git a/build/Dockerfile b/build/Dockerfile new file mode 100644 index 0000000..73b0245 --- /dev/null +++ b/build/Dockerfile @@ -0,0 +1,39 @@ +# lucee6 +#FROM ortussolutions/commandbox:lucee5-light-alpine-3.9.2 +FROM ortussolutions/commandbox:lucee5-alpine-3.9.2 + +RUN apk add argon2-dev + +COPY . ${APP_DIR}/api/ + +# Get chain certificates by splitted certificates +WORKDIR /usr/local/share/ca-certificates/ +RUN openssl s_client -showcerts -verify 5 -connect acme.mgmt.nubes.ru:443 < /dev/null | awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/{ if(/BEGIN CERTIFICATE/){a++}; out="acme"a".pem"; print >out}' +#RUN openssl s_client -showcerts -verify 5 -connect jenkins-master1.adl.nubes.ru:443 < /dev/null | awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/{ if(/BEGIN CERTIFICATE/){a++}; out="jenkins"a".pem"; print >out}' + +RUN for i in $(ls); do keytool -noprompt -deststorepass "changeit" -importcert -file $i -keystore /usr/lib/serverHome/WEB-INF/lucee-server/context/security/cacerts -alias "nubes-$i"; done +RUN update-ca-certificates + +WORKDIR ${APP_DIR} +RUN box server set runwar.console.appenderLayout=JSONTemplateLayout +RUN box server set runwar.console.appenderLayoutOptions.pattern="{\"level\":\"%-5p\",\"timestamp\":\"%d{ISO8601}\",\"logger\":\"%c\",\"message\":\"%m\"}%n" + +# set jvm memory +RUN box server set JVM.heapSize=1G + +#RUN box server set runwar.console.appenderLayoutOptions.pattern="[%-5p] %d{dd MMM yyyy HH:mm:ss.SSS} %c: %m%n" +RUN box server set web.accessLogEnable=true +RUN box server set web.log.file=console +RUN box server set web.log.level=DEBUG +#RUN box server set runwar.console.appenderLayout=net.minidev.json.writer.JsonWriter + +RUN box server set web.accessLogEnable=true +RUN box touch /usr/lib/serverHome/logs/access.txt + +#RUN box touch /usr/lib/serverHome/logs/access.txt +# Get submodules PostgreSql +RUN wget https://ext.lucee.org/org.postgresql.jdbc-42.6.0.lex -P /usr/lib/serverHome/WEB-INF/lucee-server/deploy + +EXPOSE 8080 + +#CMD /usr/lib/build/run.sh \ No newline at end of file diff --git a/build/Jenkinsfile b/build/Jenkinsfile new file mode 100644 index 0000000..828dae5 --- /dev/null +++ b/build/Jenkinsfile @@ -0,0 +1,62 @@ +@Library(['jlib']) _ + +node("docker") { + // Временная метка в логе Jenkins + timestamps() { + // Цветные букавы в логе Jenkins + ansiColor("xterm"){ + // Получаем актуальную версию репы, где лежит пайп + checkout scm + + stage("Prepare environments") { + if (env.BRANCH_NAME == 'master') + envConfig = "build/vars/master.yaml" + else if (env.BRANCH_NAME == 'dev') + envConfig = "build/vars/dev.yaml" + else + error("Unsupported branch: ${env.BRANCH_NAME}") + + support.getVarsV2(envConfig) + println "Success prepare" + } + + stage("Build image") { + println "Start building image ${env.registryContainerName}:${env.version}" + + app = docker.build("${env.registryContainerName}:${env.version}", "--no-cache -f ./build/Dockerfile .") + + println "Start uploading image ${env.registryContainerName}:${env.version} to Nexus" + docker.withRegistry("https://${registryUrl}", "nexus-jenkins-cred") { + app.push("${env.version}") + app.push("latest") + } + + } + + stage("Update version in Kubernetes") { + dir ("build") { + // Надо создать пачку кредов в Jenkins, а также пространство с кредами подключения в Vault + creds = ["auth", "certificate", "key", "k8scluster", "endpoint"] + + creds.each { cred -> + withCredentials([vaultString(credentialsId: "${env.registryContainerName}-${cred}-${stand}", variable: "key")]) { + env."${cred}" = key + } + } + convertJinja("auth.config.tmpl", "auth.config") + convertJinja("microservice.yaml.tmpl", "microservice.yaml") + + sh "kubectl --kubeconfig=auth.config get pods --namespace ${env.namespace}" + sh "kubectl --kubeconfig=auth.config apply -f microservice.yaml" + } + } + + println "Success build job. Now start cleanup" + + cleanWs( + deleteDirs: true, + disableDeferredWipeout: true + ) + } + } +} diff --git a/build/auth.config.tmpl b/build/auth.config.tmpl new file mode 100644 index 0000000..d398e39 --- /dev/null +++ b/build/auth.config.tmpl @@ -0,0 +1,19 @@ +apiVersion: v1 +clusters: +- cluster: + certificate-authority-data: {{ auth }} + server: {{ endpoint }} + name: {{ k8scluster }} +contexts: +- context: + cluster: {{ k8scluster }} + user: deck-api-admin + name: deck-api-admin-context +current-context: deck-api-admin-context +kind: Config +preferences: {} +users: +- name: deck-api-admin + user: + client-certificate-data: {{ certificate }} + client-key-data: {{ key }} diff --git a/build/microservice.yaml.tmpl b/build/microservice.yaml.tmpl new file mode 100644 index 0000000..c3364be --- /dev/null +++ b/build/microservice.yaml.tmpl @@ -0,0 +1,116 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: {{ appName }} + stand: {{ stand }} + name: {{ appName }} + namespace: {{ namespace }} +spec: + replicas: 1 + selector: + matchLabels: + app: {{ appName }} + stand: {{ stand }} + template: + metadata: + labels: + app: {{ appName }} + stand: {{ stand }} + spec: + containers: + - image: {{ registryUrl }}/{{ registryContainerName }}:{{ version }} + imagePullPolicy: IfNotPresent + name: commandbox-lucee + ports: + - containerPort: {{ appPort }} + protocol: TCP + readinessProbe: + failureThreshold: 3 + initialDelaySeconds: 10 + periodSeconds: 30 + successThreshold: 1 + timeoutSeconds: 2 + httpGet: + path: / + port: {{ appPort }} + scheme: HTTP + livenessProbe: + failureThreshold: 3 + initialDelaySeconds: 30 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + tcpSocket: + port: {{ appPort }} + resources: + requests: + cpu: 500m + memory: 1024Mi + limits: + cpu: 500m + memory: 1024Mi +# envFrom: +# - secretRef: +# name: deploymentSecrets + volumeMounts: + - name: app-logs + mountPath: /usr/lib/serverHome/logs/ + - image: drn.tst.nubes.ru/fluent-bit:2.2.1 + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + cpu: 100m + memory: 256Mi + imagePullPolicy: IfNotPresent + name: sidecar-filebeat + volumeMounts: + - name: app-logs + mountPath: /usr/lib/serverHome/logs/ + - name: fluentbit-config + mountPath: /fluent-bit/etc/ + volumes: + - name: app-logs + - name: fluentbit-config + configMap: + name: {{ fbConfigMap }} +--- +apiVersion: v1 +kind: Service +metadata: + name: {{ appName }} + namespace: {{ namespace }} + labels: + app: {{ appName }} +spec: + ports: + - port: {{ appPort }} + protocol: TCP + selector: + app: {{ appName }} +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ appName }} + namespace: {{ namespace }} +spec: + ingressClassName: nginx + rules: + - host: {{ domainName }} + http: + paths: + - backend: + service: + name: {{ appName }} + port: + number: {{ appPort }} + path: / + pathType: Prefix + tls: + - hosts: + - {{ domainName }} + secretName: api-deck-tls diff --git a/build/vars/dev.yaml b/build/vars/dev.yaml new file mode 100644 index 0000000..ed3f628 --- /dev/null +++ b/build/vars/dev.yaml @@ -0,0 +1,23 @@ +main: + stand: "dev" # метка стенда + registryUrl: "drn.tst.nubes.ru" # Где хранится приложение + registryContainerName: "deck-api" # Наименование приложения в Nexus + appName: "api" # наименование контейнера в K8S + namespace: "deck-test" # Namespace приложения, где он будет развёрнут + appPort: 8080 # Порт, на котором работает приложение + +domain: + domainName: "deck-api-test.ngcloud.ru" # Имя публикации + +fluentBit: + fbConfigMap: fluentbit-configmap-api + +version: + release: 0 + major: 0 + minor: "{{ BUILD_NUMBER }}" + version: "{{ release }}.{{ major }}.{{ minor }}" + +# Если понадобится делать envFromSecret +# jsonSecrets: +# VUE_APP_BACKEND_HOST: "{{ domainName }}" \ No newline at end of file diff --git a/build/vars/master.yaml b/build/vars/master.yaml new file mode 100644 index 0000000..9aac776 --- /dev/null +++ b/build/vars/master.yaml @@ -0,0 +1,23 @@ +main: + stand: "prod" # метка стенда + registryUrl: "drn.tst.nubes.ru" # Где хранится приложение + registryContainerName: "deck-api" # Наименование приложения в Nexus + appName: "api" # наименование контейнера в K8S + namespace: "deck" # Namespace приложения, где он будет развёрнут + appPort: 8080 # Порт, на котором работает приложение + +domain: + domainName: "deck-api.ngcloud.ru" # Имя публикации + +fluentBit: + fbConfigMap: fluentbit-configmap-api + +version: + release: 0 + major: 0 + minor: "{{ BUILD_NUMBER }}" + version: "{{ release }}.{{ major }}.{{ minor }}" + +# Если понадобится делать envFromSecret +# jsonSecrets: +# VUE_APP_BACKEND_HOST: "{{ domainName }}" \ No newline at end of file