Add Kubernetes deployment configurations

- Add deployment.yaml with imagePullSecrets and env configuration
- Add service.yaml with NodePort configuration
- Configure Spring Boot environment variables from ConfigMap and Secrets
- Ensures proper image pull authentication from private registry

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -0,0 +1,100 @@
+name: lpt-be Build & Deploy
+
+on:
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: '部署环境'
+        required: true
+        type: choice
+        options:
+          - dev
+          - prod
+
+env:
+  REGISTRY: 192.168.123.199:5000
+  APP: lpt-be
+  REPO_URL: http://git.cat-shark.xyz/cat-shark/lpt-be.git
+
+jobs:
+  build-and-deploy:
+    runs-on: ubuntu-latest
+    container:
+      image: maven:3.9-eclipse-temurin-17
+      volumes:
+        - maven-cache:/root/.m2
+    steps:
+      - name: Checkout code
+        run: |
+          git clone $REPO_URL .
+          git checkout ${{ gitea.sha }}
+
+      - name: Install Docker CLI
+        run: |
+          apt-get update -qq
+          apt-get install -y -qq docker.io
+          which docker || echo "Docker not in PATH"
+          ls -la /usr/bin/docker || echo "Docker binary not found"
+          docker --version || echo "Docker command failed"
+
+      - name: Build with Maven
+        run: mvn clean package -DskipTests -B
+
+      - name: Login to Docker Registry
+        run: |
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login $REGISTRY -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+
+      - name: Build & Push Docker image
+        run: |
+          TAG=${{ gitea.sha }}-$(date +%s)
+          docker build -t $REGISTRY/$APP:$TAG -t $REGISTRY/$APP:${{ inputs.environment }} .
+          docker push $REGISTRY/$APP:$TAG
+          docker push $REGISTRY/$APP:${{ inputs.environment }}
+          echo "IMAGE_TAG=$TAG" >> $GITHUB_ENV
+
+      - name: Setup kubectl
+        run: |
+          curl -sLO "https://dl.k8s.io/release/v1.30.0/bin/linux/amd64/kubectl"
+          chmod +x kubectl
+          mv kubectl /usr/local/bin/
+          mkdir -p ~/.kube
+          echo "${{ secrets.KUBECONFIG_B64 }}" | base64 -d > ~/.kube/config
+
+      - name: Create/Update imagePullSecret
+        run: |
+          kubectl create secret docker-registry regcred \
+            --docker-server=$REGISTRY \
+            --docker-username="${{ secrets.REGISTRY_USERNAME }}" \
+            --docker-password="${{ secrets.REGISTRY_PASSWORD }}" \
+            -n lpt-${{ inputs.environment }} \
+            --dry-run=client -o yaml | kubectl apply -f -
+
+      - name: Deploy to K8s
+        run: |
+          kubectl set image deployment/$APP $APP=$REGISTRY/$APP:$IMAGE_TAG -n lpt-${{ inputs.environment }} --record
+          kubectl rollout status deployment/$APP -n lpt-${{ inputs.environment }} --timeout=5m
+
+      - name: Debug on failure
+        if: failure()
+        run: |
+          echo "=== Deployment Status ==="
+          kubectl get deployment $APP -n lpt-${{ inputs.environment }}
+          echo ""
+          echo "=== Pod Status ==="
+          kubectl get pods -n lpt-${{ inputs.environment }} -l app=$APP
+          echo ""
+          echo "=== Recent Events ==="
+          kubectl get events -n lpt-${{ inputs.environment }} --sort-by='.lastTimestamp' | tail -20
+          echo ""
+          echo "=== Pod Describe (latest) ==="
+          POD=$(kubectl get pods -n lpt-${{ inputs.environment }} -l app=$APP --sort-by=.metadata.creationTimestamp -o jsonpath='{.items[-1].metadata.name}')
+          kubectl describe pod $POD -n lpt-${{ inputs.environment }} || true
+          echo ""
+          echo "=== Pod Logs (latest) ==="
+          kubectl logs $POD -n lpt-${{ inputs.environment }} --tail=50 || true
+
+      - name: Rollback on failure
+        if: failure()
+        run: |
+          kubectl rollout undo deployment/$APP -n lpt-${{ inputs.environment }}
+          kubectl rollout status deployment/$APP -n lpt-${{ inputs.environment }}

Jenkinsfile

@@ -1,7 +1,7 @@
 pipeline {
-    agent none  // 全局不指定，局部自己声明
+    agent none
     environment {
-        IMAGE_NAME = 'lpt-prod:0.0'
+        IMAGE_NAME = "lpt-prod:${env.GIT_COMMIT?.take(8) ?: '0.0'}"
         CONTAINER_NAME = 'LPT-prod'
         CONTAINER_PORT = '8888'
     }
@@ -31,23 +31,24 @@ pipeline {
                 sh '''
                   docker network create traefik-public || true
                   docker rm -f $CONTAINER_NAME || true
-                  docker run -d --name $CONTAINER_NAME --network mysql-prod_mysql-prod \\
+                  docker run -d --name $CONTAINER_NAME \
-                  --restart=always \\
+                  --network traefik-public \
-                   -e SPRING_PROFILES_ACTIVE=prod \\
+                  --restart=always \
-                      --label "traefik.enable=true" \\
+                   -e SPRING_PROFILES_ACTIVE=prod \
-                      --label "traefik.docker.network=traefik-public" \\
+                      --label "traefik.enable=true" \
-                      --label 'traefik.http.routers.lpt-api.rule=Host(`lpt.cat-shark.xyz`) && PathPrefix(`/api`)' \\
+                      --label "traefik.docker.network=traefik-public" \
-                      --label "traefik.http.routers.lpt-api.entrypoints=websecure" \\
+                      --label 'traefik.http.routers.lpt-api.rule=Host(`lpt.cat-shark.xyz`) && PathPrefix(`/api`)' \
-                      --label "traefik.http.routers.lpt-api.tls.certresolver=le" \\
+                      --label "traefik.http.routers.lpt-api.entrypoints=websecure" \
-                      --label "traefik.http.routers.lpt-api.priority=100" \\
+                      --label "traefik.http.routers.lpt-api.tls.certresolver=le" \
-                      --label "traefik.http.routers.lpt-api.service=lpt-api" \\
+                      --label "traefik.http.routers.lpt-api.priority=100" \
-                      --label "traefik.http.routers.lpt-api.middlewares=lpt-api-strip" \\
+                      --label "traefik.http.routers.lpt-api.service=lpt-api" \
-                      --label "traefik.http.middlewares.lpt-api-strip.stripprefix.prefixes=/api" \\
+                      --label "traefik.http.routers.lpt-api.middlewares=lpt-api-strip" \
-                      --label "traefik.http.services.lpt-api.loadbalancer.server.port=$CONTAINER_PORT" \\
+                      --label "traefik.http.middlewares.lpt-api-strip.stripprefix.prefixes=/api" \
-                      --log-driver=loki \\
+                      --label "traefik.http.services.lpt-api.loadbalancer.server.port=$CONTAINER_PORT" \
-                      --log-opt loki-url="http://192.168.123.199:3100/loki/api/v1/push" \\
+                      --log-driver=loki \
+                      --log-opt loki-url="http://192.168.123.199:3100/loki/api/v1/push" \
                    $IMAGE_NAME
-                  docker network connect traefik-public $CONTAINER_NAME || true
+                  docker network connect mysql-prod_mysql-prod $CONTAINER_NAME || true
                 '''
             }
         }
@@ -57,7 +58,7 @@ pipeline {
             steps {
                 script {
                     def lastStatus = ''
-                    timeout(time: 60, unit: 'SECONDS') {
+                    timeout(time: 120, unit: 'SECONDS') {
                         waitUntil {
                             def status = sh(
                                     script: "docker inspect -f '{{.State.Health.Status}}' $CONTAINER_NAME || echo 'unhealthy'",
@@ -74,5 +75,12 @@ pipeline {
                 }
             }
         }
+
+        stage('清理旧镜像') {
+            agent any
+            steps {
+                sh 'docker image prune -af --filter "until=168h" || true'
+            }
+        }
     }
 }

k8s/deployment.yaml

@@ -0,0 +1,73 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: lpt-be
+  namespace: lpt-dev
+  labels:
+    app: lpt-be
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: lpt-be
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+  template:
+    metadata:
+      labels:
+        app: lpt-be
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: lpt-be
+          image: 192.168.123.199:5000/lpt-be:dev
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 8888
+          env:
+            - name: SPRING_PROFILES_ACTIVE
+              value: dev
+            - name: SPRING_DATASOURCE_URL
+              valueFrom:
+                configMapKeyRef:
+                  name: lpt-config
+                  key: SPRING_DATASOURCE_URL
+            - name: SPRING_DATASOURCE_USERNAME
+              value: root
+            - name: SPRING_DATASOURCE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: lpt-secrets
+                  key: mysql-root-password
+            - name: LPT_AI-SERVICE_URL
+              valueFrom:
+                configMapKeyRef:
+                  name: lpt-config
+                  key: LPT_AI-SERVICE_URL
+          resources:
+            requests:
+              cpu: 250m
+              memory: 512Mi
+            limits:
+              cpu: "1"
+              memory: 1Gi
+          livenessProbe:
+            httpGet:
+              path: /actuator/health
+              port: 8888
+            initialDelaySeconds: 60
+            periodSeconds: 30
+            timeoutSeconds: 10
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /actuator/health
+              port: 8888
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3

k8s/service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: lpt-be
+  namespace: lpt-dev
+  labels:
+    app: lpt-be
+spec:
+  type: NodePort
+  selector:
+    app: lpt-be
+  ports:
+    - port: 8888
+      targetPort: 8888
+      nodePort: 30082
+      protocol: TCP