104 lines
2.9 KiB
YAML
104 lines
2.9 KiB
YAML
apiVersion: tekton.dev/v1
|
|
kind: Pipeline
|
|
metadata:
|
|
name: fastapi-ci
|
|
namespace: tekton-ci
|
|
spec:
|
|
params:
|
|
- name: git-url
|
|
type: string
|
|
- name: git-revision
|
|
type: string
|
|
- name: image-tag
|
|
type: string
|
|
workspaces:
|
|
- name: source
|
|
tasks:
|
|
|
|
# 1. 拉取代码
|
|
- name: git-clone
|
|
taskRef:
|
|
name: git-clone
|
|
params:
|
|
- name: url
|
|
value: $(params.git-url)
|
|
- name: revision
|
|
value: $(params.git-revision)
|
|
workspaces:
|
|
- name: output
|
|
workspace: source
|
|
|
|
# 2. 单元测试
|
|
- name: pytest
|
|
runAfter: [git-clone]
|
|
taskSpec:
|
|
steps:
|
|
- name: test
|
|
image: python:3.10-slim
|
|
script: |
|
|
cd $(workspaces.source.path)
|
|
pip install -r requirements.txt
|
|
pytest app/test_main.py -v
|
|
workspaces:
|
|
- name: source
|
|
workspace: source
|
|
|
|
# 3. 构建并推送镜像 (Docker CLI, 需宿主机 docker socket，限 k8smaster)
|
|
- name: build-and-push
|
|
runAfter: [pytest]
|
|
taskSpec:
|
|
nodeSelector:
|
|
kubernetes.io/hostname: k8smaster
|
|
steps:
|
|
- name: docker-build-push
|
|
image: docker:cli
|
|
env:
|
|
- name: DOCKER_HOST
|
|
value: unix:///var/run/docker.sock
|
|
script: |
|
|
cd $(workspaces.source.path)
|
|
docker build -t registry.plfai.cn/fastapi-demo:$(params.image-tag) .
|
|
cat $(workspaces.dockerconfig.path)/.dockerconfigjson | \
|
|
docker login registry.plfai.cn -u k3s --password-stdin 2>/dev/null || true
|
|
docker push registry.plfai.cn/fastapi-demo:$(params.image-tag)
|
|
volumeMounts:
|
|
- name: docker-sock
|
|
mountPath: /var/run/docker.sock
|
|
volumes:
|
|
- name: docker-sock
|
|
hostPath:
|
|
path: /var/run/docker.sock
|
|
type: Socket
|
|
workspaces:
|
|
- name: source
|
|
workspace: source
|
|
|
|
# 4. 镜像漏洞扫描 (可选，trivy 镜像可能不可达)
|
|
- name: trivy-scan
|
|
runAfter: [build-and-push]
|
|
taskSpec:
|
|
steps:
|
|
- name: scan
|
|
image: alpine
|
|
script: |
|
|
echo "Trivy scan skipped (offline). Image: registry.plfai.cn/fastapi-demo:$(params.image-tag)"
|
|
echo "Run: trivy image --severity=HIGH,CRITICAL registry.plfai.cn/fastapi-demo:$(params.image-tag)"
|
|
|
|
# 5. 更新部署清单 (GitOps)
|
|
- name: gitops-update
|
|
runAfter: [trivy-scan]
|
|
taskSpec:
|
|
steps:
|
|
- name: update-image
|
|
image: alpine/git
|
|
script: |
|
|
git clone $(params.git-url) /workspace/repo
|
|
cd /workspace/repo
|
|
sed -i "s|image: registry.plfai.cn/fastapi-demo:.*|image: registry.plfai.cn/fastapi-demo:$(params.image-tag)|" \
|
|
k8s/deployment.yaml
|
|
git config user.email "tekton@plfai.cn"
|
|
git config user.name "Tekton CI"
|
|
git add k8s/deployment.yaml
|
|
git commit -m "ci: update image to $(params.image-tag) [skip ci]"
|
|
git push origin main
|