CI/CD加速開發與佈署的關鍵策略

# 建置階段
FROM python:3.11-slim AS builder

WORKDIR /app

COPY requirements.txt .
RUN pip wheel --no-cache-dir --no-deps --wheel-dir /app/wheels -r requirements.txt

# 最終階段
FROM python:3.11-slim

WORKDIR /app

# 僅複製必要檔案
COPY --from=builder /app/wheels /wheels
COPY --from=builder /app/requirements.txt .
RUN pip install --no-cache /wheels/*

COPY ./src .

CMD ["python", "app.py"]

build-image:
  stage: build
  image:
    name: gcr.io/kaniko-project/executor:debug
    entrypoint: [""]
  script:
    - mkdir -p /kaniko/.docker
    - echo "{\"auths\":{\"${CI_REGISTRY}\":{\"username\":\"${CI_REGISTRY_USER}\",\"password\":\"${CI_REGISTRY_PASSWORD}\"}}}" > /kaniko/.docker/config.json
    - /kaniko/executor --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/Dockerfile --destination $CI_REGISTRY_IMAGE:$CI_COMMIT_TAG
  only:
    - tags

# 在中央範本函式庫義的分享CI設定
.build_template:
  stage: build
  image:
    name: gcr.io/kaniko-project/executor:debug
    entrypoint: [""]
  script:
    - mkdir -p /kaniko/.docker
    - echo "{\"auths\":{\"${CI_REGISTRY}\":{\"username\":\"${CI_REGISTRY_USER}\",\"password\":\"${CI_REGISTRY_PASSWORD}\"}}}" > /kaniko/.docker/config.json
    - /kaniko/executor --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/Dockerfile --destination $CI_REGISTRY_IMAGE:$CI_COMMIT_TAG
  only:
    - tags

# 在具體專案的.gitlab-ci.yml中
include:
  - project: 'ci-templates/gitlab-ci-templates'
    ref: master
    file: '/templates/build.yml'

build-image:
  extends: .build_template
  # 專案特定的覆寫設定可以在這裡增加

## 共用成品階段
FROM registry.examle.ru/infra/ubuntu-base:common AS common_artifact

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

# 下載建置工具
RUN su app -c 'wget --quiet https://repo1.maven.org/maven2/com/google/javascript/closure-compiler/v.../closure-compiler-v....jar -O  /opt/closure-tools/compiler.jar --no-check-certificate'

# 複製應用程式碼
COPY --chown=app:app . /app

# 設定資料函式庫引數
ARG db_string
ARG db_user_name
ARG db_password
ARG db_host
ARG db_port
ARG db_name

# 設定主機解析並執行PHP命令
RUN echo "${db_host}  pgsql.db" >> /etc/hosts && \
    /usr/bin/php some commads

# 複製並執行JavaScript最小化指令碼
COPY --chown=app:app ./.infra/files/js_min.sh /app/js_min.sh
RUN su app -c '/bin/bash /app/js_min.sh'

WORKDIR /app/somedir/protected
RUN su app -c '/bin/bash gulpc'

### 前端階段
FROM registry.examle.ru/infra/nginx-upstream-limit:nginx-gc AS frontend

# 複製前端設定檔
COPY ./.infra/files/frontend/nginx.conf /etc/nginx/nginx.conf
COPY ./.infra/files/frontend/content /app/somedir/content
COPY . /app

# 清理不需要的目錄及檔案
RUN rm -rf /app/somedir/protected/modules \
    /app/somedir/protected/resource \
    /app/somedir/js \
    /app/_sql/sqlLocalizationUpdate*

# 從共用成品階段複製必要檔案
COPY --from=common_artifact /app/somedir/protected/modules /app/somedir/protected/modules
COPY --from=common_artifact /app/somedir/protected/resource /app/somedir/protected/resource
COPY --from=common_artifact /app/somedir/js /app/somedir/js
COPY --from=common_artifact /app/_sql/sqlLocalizationUpdate* /app/_sql/

## 後端階段
FROM registry.examle.ru/infra/ubuntu-base:backend AS backend

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

# 設定地區和語言
ENV LC_ALL=ru_RU.UTF-8
ENV LANG=ru_RU.UTF-8

# 複製並設定字型
COPY --chown=app:app ./.infra/files/backend/fonts /usr/share/fonts/TTF
RUN chown -R app:app /usr/share/fonts/TTF && chmod -R 0755 /usr/share/fonts/TTF

# 複製各種設定檔
COPY ./.infra/files/frontend/wp_content /app/somedir/wp-content
COPY --chown=app:app ./.infra/files/somedir/cron.d /etc/cron.d
COPY --chown=app:app ./.infra/files/somedir/somedir /etc/somedir
COPY --chown=app:app ./.infra/files/somedir/d /etc/service/d
COPY --chown=app:app ./.infra/files/somedir/supercronic_run /etc/service/supercronic/run
COPY --chown=app:app ./.infra/files/backend/php-fpm.conf /etc/php/7.4/fpm/php-fpm.conf
COPY --chown=app:app ./.infra/files/backend/php.ini /etc/php/7.4/cli/php.ini
COPY --chown=app:app ./.infra/files/backend/php-fpm.ini /etc/php/7.4/fpm/php.ini
COPY --chown=app:app . /app

WORKDIR /app

# 清理不需要的目錄並設定許可權
RUN rm -rf /app/somedir/protected/modules \
    /app/somedir/protected/resource \
    /app/somedir/js \
    /app/_sql/sqlLocalizationUpdate* && \
    mkdir -p /app/somedir/protected/runtime && \
    chown -R app:app /app/somedir/protected/runtime

# 從共用成品階段複製必要檔案
COPY --from=common_artifact --chown=app:app /app/somedir/protected/modules /app/somedir/protected/modules
COPY --from=common_artifact --chown=app:app /app/somedir/protected/resource /app/somedir/protected/resource
COPY --from=common_artifact --chown=app:app /app/somedir/js /app/somedir/js
COPY --from=common_artifact --chown=app:app /app/_sql/sqlLocalizationUpdate* /app/_sql/

ci-templates/
├── build/
│   └── kaniko-build-template.yml
├── test/
│   └── test-template.yml
├── deploy/
│   └── argo-deploy-template.yml
└── .gitlab-ci.yml

stages:
  - build

include:
  - local: stage-ci.yml

.build:
  stage: build
  image:
    name: registry-url/infra/kaniko-executor:v1.16.0-debug
    entrypoint: [""]
  script:
    - mkdir -p /kaniko/.docker
    - cat ${CR_CONFIG} > /kaniko/.docker/config.json
    - touch new-test
    - echo "test" >> new-test
    - >
      /kaniko/executor
      --context "${CI_PROJECT_DIR}"
      --dockerfile "${DOCKERFILE}"
      --destination "registry-url/${REGISTRY}/${IMAGE}"
      --cache=true
      --cache-repo "registry-url/${REGISTRY}/${CI_PROJECT_NAME}-cache"

build_dev:
  extends: 
    - .build
  variables:
    REGISTRY: $CR_AGENCY_DEV_ID
    CR_CONFIG: $CR_AGENCY_DEV_CONFIG
    IMAGE: ${CI_PROJECT_NAME}:${CI_COMMIT_SHORT_SHA}
  rules:
    - if: $CI_COMMIT_BRANCH =~ /^feature\/.*/
    - if: $CI_COMMIT_BRANCH == "develop"
  cache:
    policy: push

build_prod:
  extends: 
    - .build
  variables:
    REGISTRY: $CR_AGENCY_PROD_ID
    CR_CONFIG: $CR_AGENCY_PROD_CONFIG
    IMAGE: ${CI_PROJECT_NAME}:${CI_COMMIT_TAG}
  rules:
    - if: $CI_COMMIT_TAG != null

build_stage:
  extends: 
    - .build
  variables:
    REGISTRY: $CR_AGENCY_PROD_ID
    CR_CONFIG: $CR_AGENCY_PROD_CONFIG
    IMAGE: ${CI_PROJECT_NAME}:${CI_COMMIT_TAG}
  rules:
    - if: '$CI_COMMIT_REF_NAME == "staging"'

include:
  - project: 'ci-templates'
    file: 'build/kaniko-build-template.yml'

# 定義構建觸發條件

workflow:
  rules:
    - if: '$CI_COMMIT_REF_NAME == "main"'
    - if: '$CI_COMMIT_REF_NAME == "staging"'
    - if: '$CI_COMMIT_REF_NAME == "develop"'

# ArgoCD 一般設定

global:
  image:
    repository: argoproj/argocd
    tag: v2.9.0 # 請使用最新的 ArgoCD 版本
  installCRDs: true

# ArgoCD 伺服器設定

server:
  service:
    type: ClusterIP
    port: 80

  # ArgoCD UI 的 Ingress 設定

  ingress:
    enabled: true
    annotations:
      kubernetes.io/ingress.class: nginx
      cert-manager.io/cluster-issuer: "letsencrypt-prod" # 選用，若使用 cert-manager 管理 TLS
    hosts:
      - host: argo.example.com
        paths:
          - /
    tls:
      - secretName: argocd-tls
        hosts:
          - argo.example.com

# 安全性設定

# ArgoCD 伺服器的資源定義

controller:
  resources:
    limits:
      cpu: 500m
      memory: 512Mi
    requests:
      cpu: 250m
      memory: 256Mi

repoServer:
  resources:
    limits:
      cpu: 500m
      memory: 512Mi
    requests:
      cpu: 250m
      memory: 256Mi

# 專案同步設定

applicationSet:
  enabled: true

# 使用者 RBAC 選項

rbacConfig:
  policy.default: role:readonly
  scopes: "[groups]"

# 自動建立管理員帳號與密碼

initialAdminPassword: "supersecretpassword"

helm repo add argo https://argoproj.github.io/argo-helm
helm repo update

helm install argo-cd argo/argo-cd --namespace argocd --create-namespace -f values.yaml

app:
  name: "my-app"
  version: "1.0.0"

image:
  repository: "my-registry/my-app"
  tag: "latest"
  pullPolicy: "IfNotPresent"

replicaCount: 2
service:
  type: "ClusterIP"
  port: 80

ingress:
  enabled: true
  annotations: {}
  hosts:
    - host: "my-app.example.com"
      paths:
        - "/"
  tls: []

resources:
  limits:
    cpu: 100m
    memory: 128Mi

  requests:
    cpu: 50m
    memory: 64Mi

stages:
  - deploy

.deploy_template: &deploy_template
  image: bitnami/kubectl:latest
  script:
    - kubectl config set-cluster $K8S_CLUSTER --server=$K8S_SERVER --insecure-skip-tls-verify=true
    - kubectl config set-credentials $K8S_USER --token=$K8S_TOKEN
    - kubectl config set-context $K8S_CONTEXT --cluster=$K8S_CLUSTER --user=$K8S_USER
    - kubectl config use-context $K8S_CONTEXT
    - argocd app sync my-app --prune --timeout 300

# 佈署至正式環境

deploy_prod:
  <<: *deploy_template
  stage: deploy
  environment:
    name: production
  script:
    - argocd app sync my-app-prod --prune --timeout 300
  rules:
    - if: '$CI_COMMIT_REF_NAME == "main"'

# 佈署至預備環境

deploy_stage:
  <<: *deploy_template
  stage: deploy
  environment:
    name: staging
  script:
    - argocd app sync my-app-stage --prune --timeout 300
  rules:
    - if: '$CI_COMMIT_REF_NAME == "staging"'

# 佈署至開發環境

deploy_dev:
  <<: *deploy_template
  stage: deploy
  environment:
    name: development
  script:
    - argocd app sync my-app-dev --prune --timeout 300
  rules:
    - if: '$CI_COMMIT_REF_NAME == "develop"'

include:
  - local: 'argo-deploy-template.yml'

workflow:
  rules:
    - if: '$CI_COMMIT_REF_NAME == "main"'
    - if: '$CI_COMMIT_REF_NAME == "staging"'
    - if: '$CI_COMMIT_REF_NAME == "develop"'

variables:
  ARGOCD_AUTH_TOKEN: ${ARGOCD_AUTH_TOKEN}
  ARGOCD_SERVER: argocd.example.com
  K8S_CLUSTER: kubernetes
  K8S_SERVER: https://kubernetes.example.com
  K8S_TOKEN: ${K8S_TOKEN}
  K8S_CONTEXT: deployment-context

stages:
  - validate
  - build
  - test
  - deploy

# 驗證 Kubernetes 資源定義
validate:
  stage: validate
  image: garethr/kubeval
  script:
    - kubeval --strict k8s/*.yaml
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH'

# 構建與推播 Docker 映像檔
build:
  stage: build
  image: docker:20.10.16
  services:
    - docker:20.10.16-dind
  script:
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
    - |
      if [[ "$CI_COMMIT_REF_NAME" == "main" ]]; then
        docker tag $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA $CI_REGISTRY_IMAGE:latest
        docker push $CI_REGISTRY_IMAGE:latest
      fi

# ArgoCD 佈署範本（改良版）
.deploy_template: &deploy_template
  image: argoproj/argocd-cli:latest
  before_script:
    - argocd login $ARGOCD_SERVER --auth-token $ARGOCD_AUTH_TOKEN --grpc-web
  after_script:
    - |
      if [ $? -ne 0 ]; then
        echo "佈署失敗，正在回報至 Slack..."
        # 這裡可以加入 Slack 通知程式碼
      fi

# k8s/argocd-apps/production.yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app-prod
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://gitlab.example.com/my-group/my-app.git
    targetRevision: main
    path: k8s/overlays/production
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true
      selfHeal: true

k8s/
├── base/
│   ├── deployment.yaml
│   ├── service.yaml
│   └── kustomization.yaml
└── overlays/
    ├── development/
    │   ├── kustomization.yaml
    │   └── patch.yaml
    ├── staging/
    │   ├── kustomization.yaml
    │   └── patch.yaml
    └── production/
        ├── kustomization.yaml
        └── patch.yaml

deploy_prod:
  <<: *deploy_template
  stage: deploy
  environment:
    name: production
    url: https://my-app.example.com
  script:
    - argocd app sync my-app-prod --prune --timeout 300
    - argocd app wait my-app-prod --health --timeout 300
    - |
      if [ $? -eq 0 ]; then
        curl -X POST -H 'Content-type: application/json' --data '{"text":"成功佈署到生產環境"}' $SLACK_WEBHOOK_URL
      else
        curl -X POST -H 'Content-type: application/json' --data '{"text":"生產環境佈署失敗"}' $SLACK_WEBHOOK_URL
        exit 1
      fi
  rules:
    - if: '$CI_COMMIT_REF_NAME == "main"'

# 動態生成 PostgreSQL 資料函式庫憑證
$ vault read database/creds/readonly-role
Key                Value
---                -----
lease_id           database/creds/readonly-role/abc123
lease_duration     1h
lease_renewable    true
password           A1a-xyzpdq987
username           v-token-readonly-a1b2c3d4e5

helm repo add hashicorp https://helm.releases.hashicorp.com
helm repo update

server:
  # 啟用高用性模式
  ha:
    enabled: true
    replicas: 3
  
  # 服務設定
  service:
    type: ClusterIP

  # Ingress 設定，提供 Web UI 存取
  ingress:
    enabled: true
    annotations:
      kubernetes.io/ingress.class: nginx
      cert-manager.io/cluster-issuer: "letsencrypt-prod"  # 如果使用 cert-manager
    hosts:
      - host: vault.example.com
        paths:
          - /
    tls:
      - hosts:
          - vault.example.com
        secretName: vault-tls

  # Vault 伺服器額外設定
  extraConfig: |
    listener "tcp" {
      address = "0.0.0.0:8200"
      tls_disable = 1
    }
    storage "file" {
      path = "/vault/data"
    }
    ui = true

  # 資源限制
  resources:
    limits:
      cpu: 500m
      memory: 512Mi
    requests:
      cpu: 250m
      memory: 256Mi

helm install vault hashicorp/vault --namespace vault --create-namespace -f values.yaml

# 進入 Vault Pod
kubectl exec -it vault-0 -n vault -- /bin/sh

# 初始化 Vault
vault operator init

# 解封 Vault (需使用初始化產生的解封金鑰)
vault operator unseal <Unseal Key 1>
vault operator unseal <Unseal Key 2>
vault operator unseal <Unseal Key 3>

stages:
  - build

# Vault 存取範本
.vault_template: &vault_template
  image: hashicorp/vault:latest
  before_script:
    - vault login $VAULT_TOKEN
    - echo "已從 Vault 成功登入並準備取得機密"

# 生產環境建置
build_prod:
  <<: *vault_template
  stage: build
  environment:
    name: production
  script:
    - export DB_PASSWORD=$(vault kv get -field=password secret/prod/db-creds)
    - echo "成功從 Vault 取得生產環境資料函式庫"
    - ./build.sh
  rules:
    - if: '$CI_COMMIT_REF_NAME == "main"'

# 預備環境建置
build_stage:
  <<: *vault_template
  stage: build
  environment:
    name: staging
  script:
    - export DB_PASSWORD=$(vault kv get -field=password secret/staging/db-creds)
    - echo "成功從 Vault 取得預備環境資料函式庫"
    - ./build.sh
  rules:
    - if: '$CI_COMMIT_REF_NAME == "staging"'

# 開發環境建置
build_dev:
  <<: *vault_template
  stage: build
  environment:
    name: development
  script:
    - export DB_PASSWORD=$(vault kv get -field=password secret/dev/db-creds)
    - echo "成功從 Vault 取得開發環境資料函式庫"
    - ./build.sh
  rules:
    - if: '$CI_COMMIT_REF_NAME == "develop"'

VAULT_TOKEN: hvs.xxxxxxxxxxxxxxxx
VAULT_ADDR: https://vault.example.com

# gitlab-ci-dev.hcl
path "secret/data/dev/*" {
  capabilities = ["read"]
}

# gitlab-ci-staging.hcl
path "secret/data/staging/*" {
  capabilities = ["read"]
}

# gitlab-ci-prod.hcl
path "secret/data/prod/*" {
  capabilities = ["read"]
}

vault policy write gitlab-ci-dev gitlab-ci-dev.hcl
vault policy write gitlab-ci-staging gitlab-ci-staging.hcl
vault policy write gitlab-ci-prod gitlab-ci-prod.hcl

# 開發環境權杖
vault token create -policy=gitlab-ci-dev -display-name=gitlab-ci-dev

# 預備環境權杖
vault token create -policy=gitlab-ci-staging -display-name=gitlab-ci-staging

# 生產環境權杖
vault token create -policy=gitlab-ci-prod -display-name=gitlab-ci-prod

.vault_approle_template: &vault_approle_template
  image: hashicorp/vault:latest
  before_script:
    - export VAULT_ADDR=$VAULT_ADDR
    - VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id=$VAULT_ROLE_ID secret_id=$VAULT_SECRET_ID)
    - export VAULT_TOKEN

# 增加 HashiCorp 的 Helm 儲存函式庫elm repo add hashicorp https://helm.releases.hashicorp.com

# 更新儲存函式庫elm repo update

server:
  # 啟用高用性模式
  ha:
    enabled: true
    replicas: 3
    
  # 設定 Ingress
  ingress:
    enabled: true
    hosts:
      - host: vault.example.com
        paths: ["/"]
        
  # 設定持久化儲存
  dataStorage:
    enabled: true
    size: 10Gi
    storageClass: "standard"
    
  # 初始化服務設定
  service:
    enabled: true
    
  # 設定 Vault UI
  ui:
    enabled: true
    serviceType: "ClusterIP"
    
  # 設定 Vault 的網路策略
  extraLabels:
    app: vault

# 建立專用的名稱空間
kubectl create namespace vault

# 安裝 Vault
helm install vault hashicorp/vault -f values.yaml -n vault

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: vault-ingress
  namespace: vault
  annotations:
    kubernetes.io/ingress.class: nginx
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  tls:
  - hosts:
    - vault.example.com
    secretName: vault-tls
  rules:
  - host: vault.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: vault
            port:
              number: 8200

# 初始化 Vault，這會產生金鑰和根權杖
kubectl exec -it vault-0 -n vault -- vault operator init

# 使用產生的金鑰解封 Vault（需要重複此步驟至少 3 次，使用不同的金鑰）
kubectl exec -it vault-0 -n vault -- vault operator unseal <金鑰1>
kubectl exec -it vault-0 -n vault -- vault operator unseal <金鑰2>
kubectl exec -it vault-0 -n vault -- vault operator unseal <金鑰3>

# 設定 Vault 地址
export VAULT_ADDR=https://vault.example.com

# 登入 Vault
vault login <根權杖>

# 啟用 KV 引擎版本 2
vault secrets enable -version=2 kv

# gitlab-ci-policy.hcl
path "kv/data/dev/*" {
  capabilities = ["read"]
}

path "kv/data/staging/*" {
  capabilities = ["read"]
}

path "kv/data/prod/*" {
  capabilities = ["read"]
}

# 建立策略
vault policy write gitlab-ci gitlab-ci-policy.hcl

# 啟用 Kubernetes 認證
vault auth enable kubernetes

# 設定 Kubernetes 認證
vault write auth/kubernetes/config \
    kubernetes_host="https://kubernetes.default.svc" \
    kubernetes_ca_cert="$(kubectl config view --raw --minify --flatten --output='jsonpath={.clusters[].cluster.certificate-authority-data}' | base64 --decode)"

# 建立角色
vault write auth/kubernetes/role/gitlab-ci \
    bound_service_account_names=gitlab-runner \
    bound_service_account_namespaces=gitlab-runner \
    policies=gitlab-ci \
    ttl=1h

# 儲存開發環境的資料函式庫
vault kv put kv/dev/db-creds username=dev_user password=dev_password

# 儲存測試環境的資料函式庫
vault kv put kv/staging/db-creds username=stage_user password=stage_password

# 儲存生產環境的資料函式庫
vault kv put kv/prod/db-creds username=prod_user password=prod_password

# vault-secrets-template.yml
.vault_secrets:
  before_script:
    - apt-get update && apt-get install -y curl jq
    - curl -LO https://releases.hashicorp.com/vault/1.9.0/vault_1.9.0_linux_amd64.zip
    - apt-get install -y unzip
    - unzip vault_1.9.0_linux_amd64.zip -d /usr/local/bin/
    - export VAULT_ADDR=https://vault.example.com
    - export VAULT_TOKEN=$(curl -s -X POST -H "Content-Type: application/json" -d '{"jwt": "'"$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)"'", "role": "gitlab-ci"}' https://vault.example.com/v1/auth/kubernetes/login | jq -r '.auth.client_token')

# kaniko-build-template.yml
.kaniko_build:
  image: gcr.io/kaniko-project/executor:latest
  script:
    - /kaniko/executor 
      --context $CI_PROJECT_DIR 
      --dockerfile $CI_PROJECT_DIR/Dockerfile 
      --destination $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG 
      --cache=true

# argo-deploy-template.yml
.argo_deploy:
  image: bitnami/kubectl:latest
  script:
    - kubectl config set-cluster $K8S_CLUSTER --server=$K8S_SERVER --insecure-skip-tls-verify=true
    - kubectl config set-credentials $K8S_USER --token=$K8S_TOKEN
    - kubectl config set-context $K8S_CONTEXT --cluster=$K8S_CLUSTER --user=$K8S_USER
    - kubectl config use-context $K8S_CONTEXT
    - argocd app sync $APP_NAME --prune --timeout 300

# 引入所有範本
include:
  - local: 'kaniko-build-template.yml'
  - local: 'argo-deploy-template.yml'
  - local: 'vault-secrets-template.yml'

# 定義管道階段
stages:
  - build
  - deploy

# 定義工作流程觸發條件
workflow:
  rules:
    - if: '$CI_COMMIT_REF_NAME == "main"'
    - if: '$CI_COMMIT_REF_NAME == "staging"'
    - if: '$CI_COMMIT_REF_NAME == "develop"'

# 生產環境建構作業
build_prod:
  stage: build
  extends: .kaniko_build
  before_script:
    # 首先執行 Vault 機密範本的指令碼
    - !reference [.vault_secrets, before_script]
    # 從 Vault 取得生產環境機密
    - vault login $VAULT_TOKEN
    - export DB_PASSWORD=$(vault kv get -field=password kv/prod/db-creds)
  environment:
    name: production
## 現代化CI/CD流程的五大關鍵要素

在當今快速發展的軟體開發環境中，持續整合與持續佈署(CI/CD)已經從單純的自動化工具演變成企業技術策略的核心組成部分。隨著雲端技術與容器化的普及，CI/CD流程也變得更加複雜與精細。在這篇文章中，玄貓將分享現代CI/CD流程中不可或缺的關鍵元素，以及如何整合各種工具來建立安全、高效的佈署管道。

### 現代CI/CD流程的核心挑戰

在開始探討之前，我們需要理解當今CI/CD面臨的主要挑戰。過去幾年間，我在輔導多家企業建立CI/CD流程時發現，大多數團隊面臨的困境已經從「如何自動化建置和佈署」轉變為「如何確保這個過程的安全性、可靠性和可擴充套件性」。

現代CI/CD流程需要解決以下核心問題：

1. 如何安全管理敏感的存取憑證和機密資訊
2. 如何確保建置環境的安全性和隔離性
3. 如何使佈署流程適應不同環境的設定需求
4. 如何在保持彈性的同時維持一致性
5. 如何在整個流程中實施有效的控制和監控機制

### 機密管理：CI/CD安全的根本

機密管理是整個CI/CD流程安全性的根本。在實際開發環境中，我們經常需要處理API金鑰、資料函式庫、私有儲存函式庫取許可權等敏感資訊。不當的機密管理可能導致嚴重的安全漏洞。

在這方面，HashiCorp Vault已成為業界領先的解決方案。它提供了完整的機密生命週期管理，包括：

```hcl
# Vault政策範例 - 限制CI/CD管道對特定機密的存取
path "secret/data/ci-cd/production/database" {
  capabilities = ["read"]
}

path "secret/data/ci-cd/production/api-keys" {
  capabilities = ["read"]
}

# 拒絕存取其他路徑
path "secret/*" {
  capabilities = ["deny"]
}

build:
  stage: build
  image:
    name: gcr.io/kaniko-project/executor:v1.9.1-debug
    entrypoint: [""]
  script:
    - mkdir -p /kaniko/.docker
    - echo "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"$CI_REGISTRY_USER\",\"password\":\"$CI_REGISTRY_PASSWORD\"}}}" > /kaniko/.docker/config.json
    - >-
      /kaniko/executor
      --context "${CI_PROJECT_DIR}"
      --dockerfile "${CI_PROJECT_DIR}/Dockerfile"
      --destination "${CI_REGISTRY_IMAGE}:${CI_COMMIT_SHA}"
      --destination "${CI_REGISTRY_IMAGE}:latest"
      --cache=true
  only:
    - main

# base/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - deployment.yaml
  - service.yaml

# overlays/production/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - ../../base
patchesStrategicMerge:
  - deployment-patch.yaml
configMapGenerator:
  - name: app-config
    files:
      - config.properties

# overlays/production/deployment-patch.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  replicas: 5
  template:
    spec:
      containers:
      - name: my-app
        resources:
          limits:
            memory: 512Mi
            cpu: "1"
          requests:
            memory: 256Mi
            cpu: "0.5"

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-application
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/my-org/my-app-config.git
    targetRevision: HEAD
    path: overlays/production
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
    - CreateNamespace=true

stages:
  - test
  - build
  - deploy

unit-tests:
  stage: test
  image: node:16-alpine
  script:
    - npm ci
    - npm test

integration-tests:
  stage: test
  image: node:16-alpine
  script:
    - npm ci
    - npm run test:integration

build-image:
  stage: build
  image:
    name: gcr.io/kaniko-project/executor:v1.9.1-debug
    entrypoint: [""]
  script:
    - mkdir -p /kaniko/.docker
    - echo "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"$CI_REGISTRY_USER\",\"password\":\"$CI_REGISTRY_PASSWORD\"}}}" > /kaniko/.docker/config.json
    - |
      /kaniko/executor \
        --context "${CI_PROJECT_DIR}" \
        --dockerfile "${CI_PROJECT_DIR}/Dockerfile" \
        --destination "${CI_REGISTRY_IMAGE}:${CI_COMMIT_SHA}" \
        --cache=true
  only:
    - main
    - tags

update-deployment:
  stage: deploy
  image: alpine:3.15
  script:
    - apk add --no-cache git openssh-client
    - mkdir -p ~/.ssh
    - echo "$DEPLOY_KEY" | tr -d '\r' > ~/.ssh/id_rsa
    - chmod 600 ~/.ssh/id_rsa
    - ssh-keyscan -H gitlab.com >> ~/.ssh/known_hosts
    - git config --global user.email "ci@example.com"
    - git config --global user.name "GitLab CI"
    - git clone git@gitlab.com:my-org/my-app-config.git
    - cd my-app-config
    - sed -i "s|image: ${CI_REGISTRY_IMAGE}:.*|image: ${CI_REGISTRY_IMAGE}:${CI_COMMIT_SHA}|g" overlays/production/deployment-patch.yaml
    - git add overlays/production/deployment-patch.yaml
    - git commit -m "Update production image to ${CI_COMMIT_SHA}" || echo "No changes"
    - git push
  only:
    - main