Week 08: GitOps 与自动化

app-repo/           # 应用代码仓库
├── src/
├── Dockerfile
└── .github/workflows/ci.yml

config-repo/        # 配置仓库
├── base/
│   ├── deployment.yaml
│   ├── service.yaml
│   └── kustomization.yaml
├── overlays/
│   ├── dev/
│   ├── staging/
│   └── prod/
└── .github/workflows/promote.yml

main     → production
staging  → staging
develop  → development

main 分支
├── environments/
│   ├── dev/
│   ├── staging/
│   └── prod/

v1.0.0 → 触发 prod 部署
v1.0.0-rc.1 → 触发 staging 部署

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/org/config-repo
    targetRevision: main
    path: environments/prod
  destination:
    server: https://kubernetes.default.svc
    namespace: my-app
  syncPolicy:
    automated:
      prune: true      # 删除不在 Git 中的资源
      selfHeal: true   # 自动修复漂移
    syncOptions:
      - CreateNamespace=true

apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
  name: app-config
  namespace: flux-system
spec:
  url: https://github.com/org/config-repo
  ref:
    branch: main
  interval: 1m
  secretRef:
    name: git-credentials

apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: my-app
  namespace: flux-system
spec:
  sourceRef:
    kind: GitRepository
    name: app-config
  path: environments/prod
  interval: 5m
  prune: true
  healthChecks:
    - apiVersion: apps/v1
      kind: Deployment
      name: my-app
      namespace: my-app

# 安装
brew install sops

# 创建 .sops.yaml 配置
cat > .sops.yaml <<EOF
creation_rules:
  - path_regex: .*secrets.*\.yaml
    age: age1...public_key
EOF

# 加密文件
sops -e secrets.yaml > secrets.enc.yaml

# 解密文件
sops -d secrets.enc.yaml > secrets.yaml

# 直接编辑加密文件
sops secrets.enc.yaml

apiVersion: v1
kind: Secret
metadata:
  name: my-secret
data:
  password: ENC[AES256_GCM,data:...,iv:...,tag:...,type:str]
sops:
  age:
    - recipient: age1...
      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
        ...
        -----END AGE ENCRYPTED FILE-----

# 安装
kubectl apply -f https://github.com/bitnami-labs/sealed-secrets/releases/.../controller.yaml

# 获取公钥
kubeseal --fetch-cert > pub-sealed-secrets.pem

# 加密 Secret
kubeseal --format yaml < secret.yaml > sealed-secret.yaml

name: Update Image Version

on:
  workflow_dispatch:
    inputs:
      image_tag:
        description: 'Image tag to deploy'
        required: true

jobs:
  update:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          repository: org/config-repo
          token: ${{ secrets.GITHUB_TOKEN }}
      
      - name: Update image tag
        run: |
          cd environments/prod
          kustomize edit set image app=registry/app:${{ inputs.image_tag }}
      
      - name: Commit and Push
        run: |
          git config user.name "github-actions"
          git config user.email "actions@github.com"
          git add -A
          git commit -m "chore: update image to ${{ inputs.image_tag }}"
          git push

apiVersion: image.toolkit.fluxcd.io/v1beta1
kind: ImageRepository
metadata:
  name: app
spec:
  image: registry/app
  interval: 1m

---
apiVersion: image.toolkit.fluxcd.io/v1beta1
kind: ImagePolicy
metadata:
  name: app
spec:
  imageRepositoryRef:
    name: app
  policy:
    semver:
      range: ">=1.0.0"

---
apiVersion: image.toolkit.fluxcd.io/v1beta1
kind: ImageUpdateAutomation
metadata:
  name: app
spec:
  sourceRef:
    kind: GitRepository
    name: app-config
  git:
    commit:
      author:
        name: fluxcdbot
        email: fluxcd@users.noreply.github.com
      messageTemplate: 'chore: update image to {{.NewTag}}'
  update:
    path: ./environments/prod

# ArgoCD 验证签名
apiVersion: argoproj.io/v1alpha1
kind: Application
spec:
  source:
    repoURL: https://github.com/org/config-repo
    targetRevision: main
    signatureVerification:
      enabled: true
      signatureKeys:
        - gpg:
            privateKeySecret:
              name: argocd-gpg-keys
              key: private.asc

# 查看谁在什么时候做了什么变更
git log --oneline --author="Alice" -- environments/prod/

# 查看特定文件的变更历史
git log -p -- environments/prod/deployment.yaml