cat-shark/lpt-fe
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): force regcred imagePullSecrets

Browse Source
This commit is contained in:
cat-shark
2026-07-20 23:29:10 +08:00
parent d1210db1a7
commit e446cde225
1 changed files with 67 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/deploy.yml
+67 -14
View File
@@ -69,7 +69,14 @@ jobs:
- name: Login to Docker Registry
run: |
set -euo pipefail
echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "$REGISTRY" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
USER="${{ secrets.REGISTRY_USERNAME }}"
PASS="${{ secrets.REGISTRY_PASSWORD }}"
if [ -z "$USER" ] || [ -z "$PASS" ]; then
echo "ERROR: REGISTRY_USERNAME / REGISTRY_PASSWORD 未配置或为空"
echo "请在 Gitea 仓库 Settings → Secrets 中配置后重试"
exit 1
fi
echo "$PASS" | docker login "$REGISTRY" -u "$USER" --password-stdin
- name: Build & Push Docker image
run: |
@@ -104,25 +111,56 @@ jobs:
- name: Setup kubectl
run: |
set -euo pipefail
if [ -z "${{ secrets.KUBECONFIG_B64 }}" ]; then
echo "ERROR: KUBECONFIG_B64 未配置或为空"
exit 1
fi
curl -sLO "https://dl.k8s.io/release/v1.30.0/bin/linux/amd64/kubectl"
chmod +x kubectl
mv kubectl /usr/local/bin/
echo "${{ secrets.KUBECONFIG_B64 }}" | base64 -d > /tmp/kubeconfig
kubectl --kubeconfig=/tmp/kubeconfig cluster-info >/dev/null
- name: Create/Update imagePullSecret
run: |
set -euo pipefail
ENV="${{ inputs.environment }}"
NS="lpt-$ENV"
USER="${{ secrets.REGISTRY_USERNAME }}"
PASS="${{ secrets.REGISTRY_PASSWORD }}"
if [ -z "$USER" ] || [ -z "$PASS" ]; then
echo "ERROR: REGISTRY_USERNAME / REGISTRY_PASSWORD 为空，无法创建 regcred"
exit 1
fi
# 确保 namespace 存在
kubectl --kubeconfig=/tmp/kubeconfig get ns "$NS" >/dev/null 2>&1 \
|| kubectl --kubeconfig=/tmp/kubeconfig create ns "$NS"
# 删除旧 secret 再重建，避免 type/字段残留
kubectl --kubeconfig=/tmp/kubeconfig delete secret regcred -n "$NS" --ignore-not-found
kubectl --kubeconfig=/tmp/kubeconfig create secret docker-registry regcred \
--docker-server="$REGISTRY" \
--docker-username="${{ secrets.REGISTRY_USERNAME }}" \
--docker-password="${{ secrets.REGISTRY_PASSWORD }}" \
-n "lpt-${{ inputs.environment }}" \
--dry-run=client -o yaml | kubectl --kubeconfig=/tmp/kubeconfig apply -f -
--docker-username="$USER" \
--docker-password="$PASS" \
-n "$NS"
# 校验 .dockerconfigjson 非空
LEN=$(kubectl --kubeconfig=/tmp/kubeconfig get secret regcred -n "$NS" \
-o jsonpath='{.data.\.dockerconfigjson}' | wc -c)
if [ "${LEN// /}" -lt 10 ]; then
echo "ERROR: regcred 创建后 .dockerconfigjson 异常（len=$LEN）"
exit 1
fi
echo "regcred OK in $NS (dockerconfigjson len≈$LEN)"
# 强制 Deployment 使用 imagePullSecrets（集群存量可能缺失）
kubectl --kubeconfig=/tmp/kubeconfig patch deployment "$APP" -n "$NS" \
--type=strategic \
-p '{"spec":{"template":{"spec":{"imagePullSecrets":[{"name":"regcred"}]}}}}'
echo "patched deployment/$APP imagePullSecrets=regcred"
- name: Deploy to K8s
run: |
set -euo pipefail
ENV="${{ inputs.environment }}"
NS="lpt-$ENV"
IMAGE_TAG="${IMAGE_TAG:-}"
if [ -z "$IMAGE_TAG" ] && [ -f image_tag.txt ]; then
IMAGE_TAG="$(cat image_tag.txt)"
@@ -134,33 +172,48 @@ jobs:
echo "ERROR: IMAGE_TAG 为空，无法部署"
exit 1
fi
echo "Deploying $REGISTRY/$APP:$IMAGE_TAG -> namespace lpt-$ENV"
# 确认 Deployment 已挂 regcred
PULL_SECRET=$(kubectl --kubeconfig=/tmp/kubeconfig get deployment "$APP" -n "$NS" \
-o jsonpath='{.spec.template.spec.imagePullSecrets[0].name}' 2>/dev/null || true)
if [ "$PULL_SECRET" != "regcred" ]; then
echo "ERROR: deployment/$APP 未配置 imagePullSecrets=regcred（当前='$PULL_SECRET'）"
exit 1
fi
echo "Deploying $REGISTRY/$APP:$IMAGE_TAG -> namespace $NS"
kubectl --kubeconfig=/tmp/kubeconfig set image "deployment/$APP" \
"$APP=$REGISTRY/$APP:$IMAGE_TAG" \
-n "lpt-$ENV" --record
-n "$NS" --record
kubectl --kubeconfig=/tmp/kubeconfig rollout status "deployment/$APP" \
-n "lpt-$ENV" --timeout=5m
-n "$NS" --timeout=5m
- name: Debug on failure
if: failure()
run: |
ENV="${{ inputs.environment }}"
NS="lpt-$ENV"
echo "=== Deployment Status ==="
kubectl --kubeconfig=/tmp/kubeconfig get deployment "$APP" -n "lpt-$ENV" || true
kubectl --kubeconfig=/tmp/kubeconfig get deployment "$APP" -n "$NS" -o wide || true
echo ""
echo "=== imagePullSecrets on Deployment ==="
kubectl --kubeconfig=/tmp/kubeconfig get deployment "$APP" -n "$NS" \
-o jsonpath='{.spec.template.spec.imagePullSecrets}' || true
echo ""
echo "=== regcred secret ==="
kubectl --kubeconfig=/tmp/kubeconfig get secret regcred -n "$NS" -o yaml 2>&1 | head -20 || true
echo ""
echo "=== Pod Status ==="
kubectl --kubeconfig=/tmp/kubeconfig get pods -n "lpt-$ENV" -l "app=$APP" || true
kubectl --kubeconfig=/tmp/kubeconfig get pods -n "$NS" -l "app=$APP" || true
echo ""
echo "=== Recent Events ==="
kubectl --kubeconfig=/tmp/kubeconfig get events -n "lpt-$ENV" --sort-by='.lastTimestamp' | tail -20 || true
kubectl --kubeconfig=/tmp/kubeconfig get events -n "$NS" --sort-by='.lastTimestamp' | tail -20 || true
echo ""
echo "=== Pod Describe (latest) ==="
POD=$(kubectl --kubeconfig=/tmp/kubeconfig get pods -n "lpt-$ENV" -l "app=$APP" --sort-by=.metadata.creationTimestamp -o jsonpath='{.items[-1].metadata.name}' 2>/dev/null || true)
POD=$(kubectl --kubeconfig=/tmp/kubeconfig get pods -n "$NS" -l "app=$APP" --sort-by=.metadata.creationTimestamp -o jsonpath='{.items[-1].metadata.name}' 2>/dev/null || true)
if [ -n "${POD:-}" ]; then
kubectl --kubeconfig=/tmp/kubeconfig describe pod "$POD" -n "lpt-$ENV" || true
kubectl --kubeconfig=/tmp/kubeconfig describe pod "$POD" -n "$NS" || true
echo ""
echo "=== Pod Logs (latest) ==="
kubectl --kubeconfig=/tmp/kubeconfig logs "$POD" -n "lpt-$ENV" --tail=50 || true
kubectl --kubeconfig=/tmp/kubeconfig logs "$POD" -n "$NS" --tail=50 || true
fi
- name: Rollback on failure