70 lines
2.5 KiB
YAML
70 lines
2.5 KiB
YAML
# 复制到配置仓 .gitea/workflows/sync-consul.yml
|
||
# push master → prod Consul；push test → test Consul
|
||
name: Sync Consul Config
|
||
|
||
on:
|
||
push:
|
||
branches: [master, test]
|
||
|
||
jobs:
|
||
sync:
|
||
runs-on: k3s-host
|
||
steps:
|
||
- name: Checkout and sync
|
||
run: |
|
||
set -euxo pipefail
|
||
REF="${{ gitea.ref_name }}"
|
||
case "$REF" in
|
||
test) TARGET=test ;;
|
||
master) TARGET=prod ;;
|
||
*) echo "unsupported branch: $REF"; exit 1 ;;
|
||
esac
|
||
|
||
case "$TARGET" in
|
||
test)
|
||
export KUBECONFIG=/etc/rancher/k3s/k3s-test.yaml
|
||
export NAMESPACE=test
|
||
# 内网 NodePort（consul-ci）；安全组仅 42→13:30850
|
||
export CONSUL_HTTP_ADDR="${TEST_CONSUL_HTTP_ADDR:-http://172.16.16.13:30850}"
|
||
;;
|
||
*)
|
||
export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
|
||
export NAMESPACE=prod
|
||
unset CONSUL_HTTP_ADDR
|
||
;;
|
||
esac
|
||
if [[ ! -f "$KUBECONFIG" ]]; then
|
||
echo "FAIL: missing KUBECONFIG=$KUBECONFIG host=$(hostname) uid=$(id -u)"
|
||
ls -la /etc/rancher/k3s/ /root/.kube/ 2>/dev/null || true
|
||
exit 1
|
||
fi
|
||
# 暂时关闭改配置后自动重启 API
|
||
# export RESTART_APIS=1
|
||
export RESTART_APIS=0
|
||
|
||
REPO="${{ gitea.repository }}"
|
||
SHA="${{ gitea.sha }}"
|
||
test -n "$REPO" && [[ "$REPO" == */* ]]
|
||
test -n "$SHA"
|
||
|
||
echo "TARGET=$TARGET REF=$REF NAMESPACE=$NAMESPACE"
|
||
|
||
GITEA_HTTP="https://git.ideship.com"
|
||
WORK="/data/ci-build/config-${TARGET}"
|
||
GITEA_USER="$(kubectl --kubeconfig=/etc/rancher/k3s/k3s.yaml -n prod get secret kaniko-git -o jsonpath='{.data.GITEA_USER}' | base64 -d)"
|
||
GIT_TOKEN="$(kubectl --kubeconfig=/etc/rancher/k3s/k3s.yaml -n prod get secret kaniko-git -o jsonpath='{.data.GIT_TOKEN}' | base64 -d)"
|
||
GITEA_USER="${GITEA_USER:-gitea}"
|
||
|
||
rm -rf "$WORK"
|
||
mkdir -p "$WORK"
|
||
cd "$WORK"
|
||
git init -q
|
||
git remote add origin "${GITEA_HTTP}/${REPO}.git"
|
||
AUTH_B64="$(printf '%s:%s' "$GITEA_USER" "$GIT_TOKEN" | base64 | tr -d '\n\r ')"
|
||
git -c http.extraHeader="Authorization: Basic ${AUTH_B64}" \
|
||
fetch --depth 1 --quiet --no-tags origin "$SHA"
|
||
git checkout --force --quiet FETCH_HEAD
|
||
|
||
chmod +x scripts/sync-to-consul.sh
|
||
./scripts/sync-to-consul.sh
|