From 7f62c601df8daae5552e4a724a1edef56f739a93 Mon Sep 17 00:00:00 2001 From: George Stykalin Date: Wed, 15 May 2024 20:28:53 +0300 Subject: [PATCH] add docker building in pipeline --- .gitlab-ci.yml | 42 ++++ README.md | 13 ++ ansible.cfg | 22 ++ build/README.md | 5 + build/debian/DEBIAN/control | 5 + build/docker/.dockerignore | 4 + build/docker/Dockerfile | 28 +++ build/version.txt | 1 + internal/config/modules_observability.go | 6 + .../observability/metrics-server.yml.tmpl | 203 ++++++++++++++++++ internal/templates/helm_apps.go | 1 + .../group_vars/k8s_cluster/addons.yml | 202 ++++++++++++++++- kubespray/inventory/hosts | 2 +- 13 files changed, 532 insertions(+), 2 deletions(-) create mode 100644 .gitlab-ci.yml create mode 100644 ansible.cfg create mode 100644 build/README.md create mode 100644 build/debian/DEBIAN/control create mode 100644 build/docker/.dockerignore create mode 100644 build/docker/Dockerfile create mode 100644 build/version.txt create mode 100644 internal/resources/templates/helm-apps/releases/observability/metrics-server.yml.tmpl diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml new file mode 100644 index 0000000..213d905 --- /dev/null +++ b/.gitlab-ci.yml @@ -0,0 +1,42 @@ +variables: + DOCKER_IMAGE: harbor.kvazaric.ru/kube-forge/kube-forge + KANIKO_IMAGE: harbor.kvazaric.ru/postgres-tasks/kaniko_executor:debug + KANIKO_CONTEXT: ${CI_PROJECT_DIR} + +stages: + - build + +build-docker: + variables: + DOCKERFILE_PATH: Dockerfile + IMAGE_DESTINATION: image + stage: build + image: + name: ${KANIKO_IMAGE} + entrypoint: [""] + allow_failure: true + tags: + - build + - docker + before_script: + - mkdir -p /kaniko/.docker + - echo "${DOCKER_AUTH_CONFIG}" > /kaniko/.docker/config.json + - VERSION=$(cat ${CI_PROJECT_DIR}/build/version.txt) + script: + - | + /kaniko/executor --context "${KANIKO_CONTEXT}" \ + --dockerfile ${CI_PROJECT_DIR}/build/docker/Dockerfile \ + --destination "${DOCKER_IMAGE}:{VERSION}-${CI_COMMIT_SHORT_SHA}" + dependencies: [] + rules: + - changes: + - build/docker/**/* + - cmd/**/* + - internal/**/* + - kubespray/**/* + - go.sum + - go.mod + - requirements.txt + - ansible.cfg + if: $CI_COMMIT_REF_NAME =~ /^(main)$/ + when: always diff --git a/README.md b/README.md index e69de29..e0e357f 100644 --- a/README.md +++ b/README.md @@ -0,0 +1,13 @@ +## Устнановка + +### Docker-образ + +## Примеры запуска + +### Docker-образ + +```shell +docker run -v $(pwd)/config.yaml:/application/config.yaml \ + -v $(pwd)/id_rsa:/root/.ssh/id_rsa \ + -v $(pwd)/config:/root/.ssh/config apply +``` diff --git a/ansible.cfg b/ansible.cfg new file mode 100644 index 0000000..3687ad0 --- /dev/null +++ b/ansible.cfg @@ -0,0 +1,22 @@ +[ssh_connection] +pipelining=True +ssh_args = -o ControlMaster=auto -o ControlPersist=30m -o ConnectionAttempts=100 -o UserKnownHostsFile=/dev/null +#control_path = ~/.ssh/ansible-%%r@%%h:%%p +[defaults] +# https://github.com/ansible/ansible/issues/56930 (to ignore group names with - and .) +force_valid_group_names = ignore + +host_key_checking=False +gathering = smart +fact_caching = jsonfile +fact_caching_connection = /tmp +fact_caching_timeout = 86400 +stdout_callback = dense +display_skipped_hosts = no +library = ./library +callbacks_enabled = profile_tasks,ara_default +roles_path = roles:$VIRTUAL_ENV/usr/local/share/kubespray/roles:$VIRTUAL_ENV/usr/local/share/ansible/roles:/usr/share/kubespray/roles +deprecation_warnings=False +inventory_ignore_extensions = ~, .orig, .bak, .ini, .cfg, .retry, .pyc, .pyo, .creds, .gpg +[inventory] +ignore_patterns = artifacts, credentials diff --git a/build/README.md b/build/README.md new file mode 100644 index 0000000..343c925 --- /dev/null +++ b/build/README.md @@ -0,0 +1,5 @@ +## Сборка Docker + +## Сборка Linux + +### Debian diff --git a/build/debian/DEBIAN/control b/build/debian/DEBIAN/control new file mode 100644 index 0000000..caaf13c --- /dev/null +++ b/build/debian/DEBIAN/control @@ -0,0 +1,5 @@ +Package: kube-forge +Version: 1.0 +Architecture: amd64 +Maintainer: Kvazaric +Description: A program to install Kubernetes-based platform to facilitate the development, desting and dperation of Ccntainerized applications \ No newline at end of file diff --git a/build/docker/.dockerignore b/build/docker/.dockerignore new file mode 100644 index 0000000..8d1c206 --- /dev/null +++ b/build/docker/.dockerignore @@ -0,0 +1,4 @@ +k8s-admin.conf +docs +*/build +examples \ No newline at end of file diff --git a/build/docker/Dockerfile b/build/docker/Dockerfile new file mode 100644 index 0000000..6cc95de --- /dev/null +++ b/build/docker/Dockerfile @@ -0,0 +1,28 @@ +## Install dependencies +FROM python:3.12 as deps + +WORKDIR /application +COPY ./requirements.txt ./ + +RUN apt-get update -y && \ + apt-get install sshpass -y && \ + pip3 install -r requirements.txt + +## Build executable +FROM golang:alpine as builder + +WORKDIR /application +COPY go.mod go.sum ./ +RUN go mod download + +WORKDIR /application +COPY . . +RUN CGO_ENABLED=0 GOOS=linux go build -v -o kube-forge ./cmd/main/main.go + +FROM deps + +WORKDIR /application +COPY . . +COPY --from=builder /application/kube-forge /application/kube-forge + +ENTRYPOINT ["./kube-forge", "-c", "config.yaml", "-d", "."] diff --git a/build/version.txt b/build/version.txt new file mode 100644 index 0000000..9f8e9b6 --- /dev/null +++ b/build/version.txt @@ -0,0 +1 @@ +1.0 \ No newline at end of file diff --git a/internal/config/modules_observability.go b/internal/config/modules_observability.go index 1fd68ca..75e5f36 100644 --- a/internal/config/modules_observability.go +++ b/internal/config/modules_observability.go @@ -137,6 +137,12 @@ type Monitoring struct { Image string `yaml:"image" env-default:"prom/node-exporter"` Tag string `yaml:"tag" env-default:"v1.5.0"` } `yaml:"node"` + MetricsServer struct { + ChartRef string `yaml:"chart_ref" env-default:"kube-forge/metrics-server"` + ChartVersion string `yaml:"chart_version" env-default:"3.12.1"` + Image string `yaml:"image" env-default:"registry.k8s.io/metrics-server/metrics-server"` + Tag string `yaml:"tag" env-default:""` + } } type Visualization struct { diff --git a/internal/resources/templates/helm-apps/releases/observability/metrics-server.yml.tmpl b/internal/resources/templates/helm-apps/releases/observability/metrics-server.yml.tmpl new file mode 100644 index 0000000..fbe9a54 --- /dev/null +++ b/internal/resources/templates/helm-apps/releases/observability/metrics-server.yml.tmpl @@ -0,0 +1,203 @@ +- name: metrics-server + namespace: kube-system + create_namespace: true + chart_ref: {{ .Modules.Observability.Monitoring.MetricsServer.ChartRef }} + chart_version: {{ .Modules.Observability.Monitoring.MetricsServer.ChartVersion }} + {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} + release_state: "present" + {{- else }} + release_state: "absent" + {{- end }} + values: + image: + repository: {{.Modules.Observability.Monitoring.MetricsServer.Image }} + tag: "{{ .Modules.Observability.Monitoring.MetricsServer.Tag }}" + pullPolicy: IfNotPresent + + imagePullSecrets: [] + # - name: registrySecretName + + nameOverride: "" + fullnameOverride: "" + + serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + # The list of secrets mountable by this service account. + # See https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets + secrets: [] + + rbac: + # Specifies whether RBAC resources should be created + create: true + pspEnabled: false + + apiService: + create: true + # Annotations to add to the API service + annotations: {} + # Specifies whether to skip TLS verification + insecureSkipTLSVerify: true + # The PEM encoded CA bundle for TLS verification + caBundle: "" + + commonLabels: {} + podLabels: + "app.kubernetes.io/component": "metrics-server" + podAnnotations: {} + + podSecurityContext: {} + + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + capabilities: + drop: + - ALL + + priorityClassName: system-cluster-critical + + containerPort: 10250 + + hostNetwork: + # Specifies if metrics-server should be started in hostNetwork mode. + # + # You would require this enabled if you use alternate overlay networking for pods and + # API server unable to communicate with metrics-server. As an example, this is required + # if you use Weave network on EKS + enabled: false + + replicas: 1 + + revisionHistoryLimit: + + updateStrategy: {} + # type: RollingUpdate + # rollingUpdate: + # maxSurge: 0 + # maxUnavailable: 1 + + podDisruptionBudget: + # https://kubernetes.io/docs/tasks/run-application/configure-pdb/ + enabled: false + minAvailable: + maxUnavailable: + + defaultArgs: + - --cert-dir=/tmp + - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname + - --kubelet-use-node-status-port + - --metric-resolution=15s + - --kubelet-insecure-tls + + args: [] + + livenessProbe: + httpGet: + path: /livez + port: https + scheme: HTTPS + initialDelaySeconds: 0 + periodSeconds: 10 + failureThreshold: 3 + + readinessProbe: + httpGet: + path: /readyz + port: https + scheme: HTTPS + initialDelaySeconds: 20 + periodSeconds: 10 + failureThreshold: 3 + + service: + type: ClusterIP + port: 443 + annotations: {} + labels: {} + # Add these labels to have metrics-server show up in `kubectl cluster-info` + # kubernetes.io/cluster-service: "true" + # kubernetes.io/name: "Metrics-server" + + addonResizer: + enabled: false + image: + repository: registry.k8s.io/autoscaling/addon-resizer + tag: 1.8.20 + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + capabilities: + drop: + - ALL + resources: + requests: + cpu: 40m + memory: 25Mi + limits: + cpu: 40m + memory: 25Mi + nanny: + cpu: 0m + extraCpu: 1m + memory: 0Mi + extraMemory: 2Mi + minClusterSize: 100 + pollPeriod: 300000 + threshold: 5 + + metrics: + enabled: true + + serviceMonitor: + enabled: true + additionalLabels: {} + interval: 1m + scrapeTimeout: 10s + metricRelabelings: [] + relabelings: [] + + # See https://github.com/kubernetes-sigs/metrics-server#scaling + resources: + requests: + cpu: 100m + memory: 200Mi + # limits: + # cpu: + # memory: + + extraVolumeMounts: [] + + extraVolumes: [] + + nodeSelector: {} + + tolerations: [] + + affinity: {} + + topologySpreadConstraints: [] + + dnsConfig: {} + + # Annotations to add to the deployment + deploymentAnnotations: {} + + schedulerName: "" + + tmpVolume: + emptyDir: {} + diff --git a/internal/templates/helm_apps.go b/internal/templates/helm_apps.go index cf90c4c..1d6c294 100644 --- a/internal/templates/helm_apps.go +++ b/internal/templates/helm_apps.go @@ -14,6 +14,7 @@ var HELM_APPS_TEMPLATES = [...]string{ "templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl", "templates/helm-apps/releases/observability/fluent-operator.yml.tmpl", "templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl", + "templates/helm-apps/releases/observability/metrics-server.yml.tmpl", "templates/helm-apps/releases/observability/tempo.yml.tmpl", "templates/helm-apps/releases/observability/loki.yml.tmpl", "templates/helm-apps/releases/observability/observability.yml.tmpl", diff --git a/kubespray/inventory/group_vars/k8s_cluster/addons.yml b/kubespray/inventory/group_vars/k8s_cluster/addons.yml index 1fbab7d..764a160 100644 --- a/kubespray/inventory/group_vars/k8s_cluster/addons.yml +++ b/kubespray/inventory/group_vars/k8s_cluster/addons.yml @@ -3101,6 +3101,206 @@ releases: repository: busybox tag: latest + - name: metrics-server + namespace: kube-system + create_namespace: true + chart_ref: kube-forge/metrics-server + chart_version: 3.12.1 + release_state: "present" + values: + image: + repository: registry.k8s.io/metrics-server/metrics-server + tag: "" + pullPolicy: IfNotPresent + + imagePullSecrets: [] + # - name: registrySecretName + + nameOverride: "" + fullnameOverride: "" + + serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + # The list of secrets mountable by this service account. + # See https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets + secrets: [] + + rbac: + # Specifies whether RBAC resources should be created + create: true + pspEnabled: false + + apiService: + create: true + # Annotations to add to the API service + annotations: {} + # Specifies whether to skip TLS verification + insecureSkipTLSVerify: true + # The PEM encoded CA bundle for TLS verification + caBundle: "" + + commonLabels: {} + podLabels: + "app.kubernetes.io/component": "metrics-server" + podAnnotations: {} + + podSecurityContext: {} + + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + capabilities: + drop: + - ALL + + priorityClassName: system-cluster-critical + + containerPort: 10250 + + hostNetwork: + # Specifies if metrics-server should be started in hostNetwork mode. + # + # You would require this enabled if you use alternate overlay networking for pods and + # API server unable to communicate with metrics-server. As an example, this is required + # if you use Weave network on EKS + enabled: false + + replicas: 1 + + revisionHistoryLimit: + + updateStrategy: {} + # type: RollingUpdate + # rollingUpdate: + # maxSurge: 0 + # maxUnavailable: 1 + + podDisruptionBudget: + # https://kubernetes.io/docs/tasks/run-application/configure-pdb/ + enabled: false + minAvailable: + maxUnavailable: + + defaultArgs: + - --cert-dir=/tmp + - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname + - --kubelet-use-node-status-port + - --metric-resolution=15s + - --kubelet-insecure-tls + + args: [] + + livenessProbe: + httpGet: + path: /livez + port: https + scheme: HTTPS + initialDelaySeconds: 0 + periodSeconds: 10 + failureThreshold: 3 + + readinessProbe: + httpGet: + path: /readyz + port: https + scheme: HTTPS + initialDelaySeconds: 20 + periodSeconds: 10 + failureThreshold: 3 + + service: + type: ClusterIP + port: 443 + annotations: {} + labels: {} + # Add these labels to have metrics-server show up in `kubectl cluster-info` + # kubernetes.io/cluster-service: "true" + # kubernetes.io/name: "Metrics-server" + + addonResizer: + enabled: false + image: + repository: registry.k8s.io/autoscaling/addon-resizer + tag: 1.8.20 + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + capabilities: + drop: + - ALL + resources: + requests: + cpu: 40m + memory: 25Mi + limits: + cpu: 40m + memory: 25Mi + nanny: + cpu: 0m + extraCpu: 1m + memory: 0Mi + extraMemory: 2Mi + minClusterSize: 100 + pollPeriod: 300000 + threshold: 5 + + metrics: + enabled: true + + serviceMonitor: + enabled: true + additionalLabels: {} + interval: 1m + scrapeTimeout: 10s + metricRelabelings: [] + relabelings: [] + + # See https://github.com/kubernetes-sigs/metrics-server#scaling + resources: + requests: + cpu: 100m + memory: 200Mi + # limits: + # cpu: + # memory: + + extraVolumeMounts: [] + + extraVolumes: [] + + nodeSelector: {} + + tolerations: [] + + affinity: {} + + topologySpreadConstraints: [] + + dnsConfig: {} + + # Annotations to add to the deployment + deploymentAnnotations: {} + + schedulerName: "" + + tmpVolume: + emptyDir: {} + + - name: tempo namespace: observability create_namespace: true @@ -4213,7 +4413,7 @@ releases: server.insecure: true secret: - argocdServerAdminPassword: $2a$10$emopmT/u2bzVYRDmFQnyH.xLNrVsLkqn61BDfx4Evzq.V8OfApXa2 + argocdServerAdminPassword: $2a$10$fjTEgJLT1tC82Z8rxrnJBegIoLFXBvpbdbbCvqSONU34yD2w6H.wS repositories: # add default helm-repository from harbor diff --git a/kubespray/inventory/hosts b/kubespray/inventory/hosts index 65af680..a1b1d21 100644 --- a/kubespray/inventory/hosts +++ b/kubespray/inventory/hosts @@ -20,4 +20,4 @@ kube_node [all:vars] ansible_connection=ssh ansible_user=sre-admin -ansible_ssh_private_key_file=/home/sre-admin/.ssh/id_rsa +ansible_ssh_private_key_file=/root/.ssh/id_rsa