基于ArgoCD + Harbor + Kubernetes GitOps的自动化部署实践

1、概述

Gitlab部署代码仓库和构建仓库，提交dockerfile到代码仓库，自动构建镜像推送至harbor，更新构建仓库中的yaml文件后，argocd检测到构建仓库变更，从harbor下载镜像，并部署到k8s。

2、创建代码仓库

准备dockerfile

FROM  192.168.40.15:5005/mygroup/dockerproject/nginx:alpine
RUN echo "Hello Docker Build in GitLab CI 10" > /usr/share/nginx/html/index.html

准备构建文件 .gitlab-ci.yml

build使用的docker:latest、docker:dind来自harbor

stages:
  - build
  - push
  - deploy

build:
  tags:
    - docker
  stage: build
  image: $DOCKER_IMAGE
  services:
    - $DOCKER_DIND
  script:
    - docker build -t $IMAGE_FULL_NAME:$IMAGE_TAG .

push:
  tags:
    - docker
  stage: push
  script:
    - docker login $HARBOR_URL -u $HARBOR_USER -p $HARBOR_PASSWORD
    - docker push $IMAGE_FULL_NAME:$IMAGE_TAG

deploy:
  tags:
    - docker
  stage: deploy
  script:
    - git clone http://$GIT_USER:$GIT_TOKEN@$GIT_REPO
    - cd $MANIFEST_PATH
    - sed -i "s|image:.*|image: $IMAGE_FULL_NAME:$IMAGE_TAG|g" deployment.yaml
    - git config --global user.email "$GIT_EMAIL"
    - git config --global user.name "$GIT_NAME"
    - git add .
    - git commit -m "update image tag to $IMAGE_TAG"
    - git push

配置变量

Instance（全局变量）
gitlab--管理员--设置--CI/CD--变量

DOCKER_IMAGE  core.harbor.domain/library/docker:latest
DOCKER_DIND   core.harbor.domain/library/docker:dind

Group（项目组变量）
gitlab--项目--具体项目--设置--CI/CD--变量

HARBOR_URL        core.harbor.domain
HARBOR_USER       admin
HARBOR_PASSWORD   xxxxxx

Project（项目变量）
gitlab--项目--具体项目--设置--CI/CD--变量

PROJECT_NAME       myproject
IMAGE_NAME         nginx
IMAGE_TAG          latest
IMAGE_FULL_NAME    core.harbor.domain/myproject/nginx
GIT_REPO           192.168.40.15/k8s/k8s-manifests.git
MANIFEST_PATH      k8s-manifests/nginx
GIT_TOKEN          glpat-xxxxxxx
GIT_USER           root
GIT_EMAIL          ci@gitlab.com
GIT_NAME           gitlab-ci

3、创建构建仓库

deployment.yaml

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      imagePullSecrets:
      - name: my-harbor-download
      containers:
      - name: nginx
        image: core.harbor.domain/myproject/nginx:latest
        ports:
        - containerPort: 80

service.yaml

---
apiVersion: v1
kind: Service
metadata:
  name: nginx-service
  namespace: default
  labels:
    app: nginx-service
spec:
  ports:
    - port: 80
  selector:
    app: nginx

4、创建Application

创建token

目的是授权argocd访问gitlab仓库。否则创建application会提示repository not accessible，argocd不能访问gitlab仓库
gitlab--用户头像--偏好设置--访问令牌--new token
ArgoCD UI → Settings → Repositories → Connect Repo--VIA HTTP/HTTPS--password 填token

创建application

在ArgoCD Web UI 使用yaml文件创建 Application

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: nginx-demo
  namespace: argocd
spec:
  project: default
  source:
    repoURL: 'http://192.168.40.15/k8s/k8s-manifests.git'
    targetRevision: HEAD
    path: nginx
  destination:
    server: 'https://kubernetes.default.svc'
    namespace: default
  syncPolicy:
    automated:
      prune: true
      selfHeal: true