From 7bc15e7e9dc1e28bd911f084a61826031504b0b6 Mon Sep 17 00:00:00 2001 From: xiaoliutral Date: Wed, 2 Sep 2026 17:45:46 +0800 Subject: [PATCH 1/5] Update master.yml --- .github/workflows/master.yml | 61 ++++++++++++++---------------------- 1 file changed, 24 insertions(+), 37 deletions(-) diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml index 140f127..d4d7b80 100644 --- a/.github/workflows/master.yml +++ b/.github/workflows/master.yml @@ -1,5 +1,6 @@ -# 复制到 itfx 仓库: .github/workflows/deploy.yml -# Secrets: TCR_USERNAME, TCR_PASSWORD, SSH_HOST(42), SSH_USERNAME, SSH_PASSWORD +# 复制到 itfx: .github/workflows/deploy.yml +# Secrets: SSH_HOST(42), SSH_USERNAME, SSH_PASSWORD +# 集群: ./scripts/16-setup-kaniko.sh name: Build and Deploy on: @@ -7,52 +8,38 @@ on: branches: [master] env: - TCR_REGISTRY: ccr.ccs.tencentyun.com - TCR_NAMESPACE: ideship + GIT_URL: https://github.com/xiaoliutral/itfx.git + DOCKERFILE: src/InterfaceForward.Api/Dockerfile IMAGE_NAME: interfaceforward_api DEPLOY_NAME: interfaceforward-api CONTAINER_NAME: interfaceforward-api - DOCKERFILE: src/InterfaceForward.Api/Dockerfile + TCR_REGISTRY: ccr.ccs.tencentyun.com + TCR_NAMESPACE: ideship jobs: - build-deploy: + deploy: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - - uses: docker/setup-buildx-action@v3 - - - name: Login to TCR - uses: docker/login-action@v3 - with: - registry: ${{ env.TCR_REGISTRY }} - username: ${{ secrets.TCR_USERNAME }} - password: ${{ secrets.TCR_PASSWORD }} - - - name: Build and push - uses: docker/build-push-action@v5 - with: - context: . - file: ${{ env.DOCKERFILE }} - push: true - tags: | - ${{ env.TCR_REGISTRY }}/${{ env.TCR_NAMESPACE }}/${{ env.IMAGE_NAME }}:${{ github.sha }} - ${{ env.TCR_REGISTRY }}/${{ env.TCR_NAMESPACE }}/${{ env.IMAGE_NAME }}:latest - # 👇 关键：开启缓存，复用 Docker 各层 - cache-from: type=gha - cache-to: type=gha,mode=max - # 👇 配置镜像加速（国内必选） - build-args: | - BUILDKIT_DOCKER_REGISTRY_MIRROR=https://mirror.ccs.tencentyun.com - - - name: Deploy to k3s + - name: Kaniko build + deploy uses: appleboy/ssh-action@v1.0.3 with: host: ${{ secrets.SSH_HOST }} username: ${{ secrets.SSH_USERNAME }} password: ${{ secrets.SSH_PASSWORD }} script: | + set -e export KUBECONFIG=/etc/rancher/k3s/k3s.yaml - IMG="${{ env.TCR_REGISTRY }}/${{ env.TCR_NAMESPACE }}/${{ env.IMAGE_NAME }}:${{ github.sha }}" - kubectl -n prod set image deploy/${{ env.DEPLOY_NAME }} ${{ env.CONTAINER_NAME }}="$IMG" - kubectl -n prod rollout status deploy/${{ env.DEPLOY_NAME }} --timeout=180s + cd /data/k3s + TAG="${{ github.sha }}" + IMG="${{ env.TCR_REGISTRY }}/${{ env.TCR_NAMESPACE }}/${{ env.IMAGE_NAME }}:${TAG}" + + ./scripts/ci-kaniko-build.sh \ + "${{ env.GIT_URL }}" \ + "${{ env.DOCKERFILE }}" \ + "${{ env.IMAGE_NAME }}" \ + "${TAG}" \ + "${TAG}" + + kubectl -n prod set image "deploy/${{ env.DEPLOY_NAME }}" \ + "${{ env.CONTAINER_NAME }}=${IMG}" + kubectl -n prod rollout status "deploy/${{ env.DEPLOY_NAME }}" --timeout=180s From f7d6ce64ec870044dec5e3ca7136867658920505 Mon Sep 17 00:00:00 2001 From: xiaoliutral Date: Wed, 2 Sep 2026 17:53:33 +0800 Subject: [PATCH 2/5] Update master.yml --- .github/workflows/master.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml index d4d7b80..b099ae1 100644 --- a/.github/workflows/master.yml +++ b/.github/workflows/master.yml @@ -23,9 +23,9 @@ jobs: - name: Kaniko build + deploy uses: appleboy/ssh-action@v1.0.3 with: - host: ${{ secrets.SSH_HOST }} - username: ${{ secrets.SSH_USERNAME }} - password: ${{ secrets.SSH_PASSWORD }} + host: ${{ secrets.SSH_K3S_HOST }} + username: ${{ secrets.SSH_K3S_HOST }} + password: ${{ secrets.SSH_K3S_HOST }} script: | set -e export KUBECONFIG=/etc/rancher/k3s/k3s.yaml From f77dc9077330610ef68b1416e7fe18dcc1e2db07 Mon Sep 17 00:00:00 2001 From: xiaoliutral Date: Wed, 2 Sep 2026 17:57:30 +0800 Subject: [PATCH 3/5] Update master.yml --- .github/workflows/master.yml | 178 ++++++++++++++++++++++++++++++++--- 1 file changed, 165 insertions(+), 13 deletions(-) diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml index b099ae1..10a2eb5 100644 --- a/.github/workflows/master.yml +++ b/.github/workflows/master.yml @@ -1,11 +1,27 @@ -# 复制到 itfx: .github/workflows/deploy.yml -# Secrets: SSH_HOST(42), SSH_USERNAME, SSH_PASSWORD -# 集群: ./scripts/16-setup-kaniko.sh +# 复制到 itfx 仓库: .github/workflows/deploy.yml +# +# 集群一次性准备（在 42 上）: +# GIT_TOKEN=... TCR_USERNAME=... TCR_PASSWORD=... ./scripts/16-setup-kaniko.sh +# +# GitHub Secrets（本仓 Settings → Secrets）: +# SSH_K3S_HOST — 42 公网 IP +# SSH_K3S_USERNAME — 一般 root +# SSH_K3S_PASSWORD — SSH 密码 +# +# 排障：看哪个 step 红了 +# 1 print-info — 仅输出变量，几乎不会挂 +# 2 check-cluster — SSH / kubeconfig / 节点不通 +# 3 check-secrets — 未跑 16-setup-kaniko，或 Secret 名不对 +# 4 kaniko-build — 拉代码 / Dockerfile / 推 TCR（看 Job 日志） +# 5 set-image — Deployment 名或容器名不对 +# 6 rollout — 镜像拉不下来 / 探针失败 / 资源不够 +# name: Build and Deploy on: push: branches: [master] + workflow_dispatch: env: GIT_URL: https://github.com/xiaoliutral/itfx.git @@ -15,31 +31,167 @@ env: CONTAINER_NAME: interfaceforward-api TCR_REGISTRY: ccr.ccs.tencentyun.com TCR_NAMESPACE: ideship + K3S_DIR: /data/k3s + KUBECONFIG: /etc/rancher/k3s/k3s.yaml + NAMESPACE: prod jobs: deploy: runs-on: ubuntu-latest steps: - - name: Kaniko build + deploy + # ── 0. 本机算出 TAG / 完整镜像名（不 SSH）──────────────── + - name: "0. print build info" + id: info + run: | + TAG="${{ github.sha }}" + IMG="${{ env.TCR_REGISTRY }}/${{ env.TCR_NAMESPACE }}/${{ env.IMAGE_NAME }}:${TAG}" + echo "tag=${TAG}" >> "$GITHUB_OUTPUT" + echo "image=${IMG}" >> "$GITHUB_OUTPUT" + echo "======= build info =======" + echo "repo = ${{ github.repository }}" + echo "ref = ${{ github.ref_name }}" + echo "sha = ${TAG}" + echo "git_url = ${{ env.GIT_URL }}" + echo "dockerfile = ${{ env.DOCKERFILE }}" + echo "image = ${IMG}" + echo "deploy = ${{ env.NAMESPACE }}/deploy/${{ env.DEPLOY_NAME }}" + echo "==========================" + + # ── 1. SSH + 集群是否通 ───────────────────────────────── + - name: "1. check cluster (SSH + kubectl)" uses: appleboy/ssh-action@v1.0.3 with: host: ${{ secrets.SSH_K3S_HOST }} - username: ${{ secrets.SSH_K3S_HOST }} - password: ${{ secrets.SSH_K3S_HOST }} + username: ${{ secrets.SSH_K3S_USERNAME }} + password: ${{ secrets.SSH_K3S_PASSWORD }} + script_stop: true script: | - set -e - export KUBECONFIG=/etc/rancher/k3s/k3s.yaml - cd /data/k3s - TAG="${{ github.sha }}" - IMG="${{ env.TCR_REGISTRY }}/${{ env.TCR_NAMESPACE }}/${{ env.IMAGE_NAME }}:${TAG}" + set -euo pipefail + export KUBECONFIG="${{ env.KUBECONFIG }}" + echo "==> whoami: $(whoami) @ $(hostname)" + echo "==> kubeconfig: ${KUBECONFIG}" + test -f "${KUBECONFIG}" || { echo "FAIL: 找不到 ${KUBECONFIG}"; exit 1; } + test -d "${{ env.K3S_DIR }}" || { echo "FAIL: 找不到 ${{ env.K3S_DIR }}，请把 k3s 清单同步到该目录"; exit 1; } + test -x "${{ env.K3S_DIR }}/scripts/ci-kaniko-build.sh" || { + echo "FAIL: 缺少可执行脚本 ${{ env.K3S_DIR }}/scripts/ci-kaniko-build.sh" + ls -la "${{ env.K3S_DIR }}/scripts/" || true + exit 1 + } + echo "==> nodes:" + kubectl get nodes -o wide + echo "==> namespace ${{ env.NAMESPACE }}:" + kubectl get ns "${{ env.NAMESPACE }}" + echo "==> deploy/${{ env.DEPLOY_NAME }}:" + kubectl -n "${{ env.NAMESPACE }}" get deploy "${{ env.DEPLOY_NAME }}" -o wide + # ── 2. Kaniko 凭据是否已创建 ──────────────────────────── + - name: "2. check kaniko secrets" + uses: appleboy/ssh-action@v1.0.3 + with: + host: ${{ secrets.SSH_K3S_HOST }} + username: ${{ secrets.SSH_K3S_USERNAME }} + password: ${{ secrets.SSH_K3S_PASSWORD }} + script_stop: true + script: | + set -euo pipefail + export KUBECONFIG="${{ env.KUBECONFIG }}" + NS="${{ env.NAMESPACE }}" + echo "==> 检查 Secret（由 16-setup-kaniko.sh 创建）" + kubectl -n "$NS" get secret kaniko-git -o jsonpath='{.metadata.name}{" keys="}{.data}{"\n"}' >/dev/null \ + && echo "OK secret/kaniko-git" \ + || { echo "FAIL: 缺少 secret/kaniko-git — 在 42 执行: GIT_TOKEN=... ./scripts/16-setup-kaniko.sh"; exit 1; } + kubectl -n "$NS" get secret kaniko-docker-config >/dev/null \ + && echo "OK secret/kaniko-docker-config" \ + || { echo "FAIL: 缺少 secret/kaniko-docker-config — TCR 账号未写入"; exit 1; } + echo "==> build 节点:" + kubectl get nodes -l role=build -o wide + COUNT="$(kubectl get nodes -l role=build --no-headers 2>/dev/null | wc -l | tr -d ' ')" + if [[ "${COUNT}" == "0" ]]; then + echo "FAIL: 没有 role=build 节点，Kaniko Job 会 Pending" + kubectl get nodes --show-labels + exit 1 + fi + + # ── 3. Kaniko 构建并推 TCR（最慢，失败看 Job 日志）───── + - name: "3. kaniko build & push" + uses: appleboy/ssh-action@v1.0.3 + with: + host: ${{ secrets.SSH_K3S_HOST }} + username: ${{ secrets.SSH_K3S_USERNAME }} + password: ${{ secrets.SSH_K3S_PASSWORD }} + command_timeout: 50m + script_stop: true + script: | + set -euo pipefail + export KUBECONFIG="${{ env.KUBECONFIG }}" + cd "${{ env.K3S_DIR }}" + TAG="${{ steps.info.outputs.tag }}" + echo "==> 开始 Kaniko: ${{ env.IMAGE_NAME }}:${TAG}" + echo " 失败时在 42 执行:" + echo " kubectl -n ${{ env.NAMESPACE }} get job -l app=kaniko" + echo " kubectl -n ${{ env.NAMESPACE }} logs -l job-name=... -c git" + echo " kubectl -n ${{ env.NAMESPACE }} logs -l job-name=... -c kaniko" ./scripts/ci-kaniko-build.sh \ "${{ env.GIT_URL }}" \ "${{ env.DOCKERFILE }}" \ "${{ env.IMAGE_NAME }}" \ "${TAG}" \ "${TAG}" + echo "==> 镜像已推送: ${{ steps.info.outputs.image }}" - kubectl -n prod set image "deploy/${{ env.DEPLOY_NAME }}" \ + # ── 4. 改 Deployment 镜像 ─────────────────────────────── + - name: "4. set deployment image" + uses: appleboy/ssh-action@v1.0.3 + with: + host: ${{ secrets.SSH_K3S_HOST }} + username: ${{ secrets.SSH_K3S_USERNAME }} + password: ${{ secrets.SSH_K3S_PASSWORD }} + script_stop: true + script: | + set -euo pipefail + export KUBECONFIG="${{ env.KUBECONFIG }}" + NS="${{ env.NAMESPACE }}" + IMG="${{ steps.info.outputs.image }}" + echo "==> 当前镜像:" + kubectl -n "$NS" get deploy "${{ env.DEPLOY_NAME }}" \ + -o jsonpath='{.spec.template.spec.containers[?(@.name=="${{ env.CONTAINER_NAME }}")].image}{"\n"}' + echo "==> 设为: ${IMG}" + kubectl -n "$NS" set image "deploy/${{ env.DEPLOY_NAME }}" \ "${{ env.CONTAINER_NAME }}=${IMG}" - kubectl -n prod rollout status "deploy/${{ env.DEPLOY_NAME }}" --timeout=180s + echo "==> 已更新:" + kubectl -n "$NS" get deploy "${{ env.DEPLOY_NAME }}" \ + -o jsonpath='{.spec.template.spec.containers[?(@.name=="${{ env.CONTAINER_NAME }}")].image}{"\n"}' + + # ── 5. 等待滚动发布 ───────────────────────────────────── + - name: "5. wait rollout" + uses: appleboy/ssh-action@v1.0.3 + with: + host: ${{ secrets.SSH_K3S_HOST }} + username: ${{ secrets.SSH_K3S_USERNAME }} + password: ${{ secrets.SSH_K3S_PASSWORD }} + command_timeout: 5m + script_stop: true + script: | + set -euo pipefail + export KUBECONFIG="${{ env.KUBECONFIG }}" + NS="${{ env.NAMESPACE }}" + DEP="${{ env.DEPLOY_NAME }}" + echo "==> rollout status..." + if ! kubectl -n "$NS" rollout status "deploy/${DEP}" --timeout=180s; then + echo "FAIL: rollout 超时/失败，诊断信息如下" + kubectl -n "$NS" get deploy,rs,pods -l app="${DEP}" -o wide || \ + kubectl -n "$NS" get pods -o wide | grep -E "${DEP}|NAME" || true + kubectl -n "$NS" describe deploy "${DEP}" | tail -60 || true + POD="$(kubectl -n "$NS" get pods -l app="${DEP}" -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)" + if [[ -n "${POD}" ]]; then + echo "==> events for ${POD}:" + kubectl -n "$NS" describe pod "${POD}" | tail -40 || true + echo "==> logs:" + kubectl -n "$NS" logs "${POD}" --tail=80 || true + fi + exit 1 + fi + echo "==> pods:" + kubectl -n "$NS" get pods -o wide | grep -E "${DEP}|NAME" || \ + kubectl -n "$NS" get pods -o wide + echo "OK deployed ${{ steps.info.outputs.image }}" From 0442e335f6911f749808f95b1fbe826380153121 Mon Sep 17 00:00:00 2001 From: xiaoliutral Date: Wed, 2 Sep 2026 18:44:59 +0800 Subject: [PATCH 4/5] Update master.yml --- .github/workflows/master.yml | 170 +++++------------------------------ 1 file changed, 24 insertions(+), 146 deletions(-) diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml index 10a2eb5..c99fc1c 100644 --- a/.github/workflows/master.yml +++ b/.github/workflows/master.yml @@ -1,20 +1,7 @@ -# 复制到 itfx 仓库: .github/workflows/deploy.yml +# 复制到 itfx: .github/workflows/deploy.yml # -# 集群一次性准备（在 42 上）: -# GIT_TOKEN=... TCR_USERNAME=... TCR_PASSWORD=... ./scripts/16-setup-kaniko.sh -# -# GitHub Secrets（本仓 Settings → Secrets）: -# SSH_K3S_HOST — 42 公网 IP -# SSH_K3S_USERNAME — 一般 root -# SSH_K3S_PASSWORD — SSH 密码 -# -# 排障：看哪个 step 红了 -# 1 print-info — 仅输出变量，几乎不会挂 -# 2 check-cluster — SSH / kubeconfig / 节点不通 -# 3 check-secrets — 未跑 16-setup-kaniko，或 Secret 名不对 -# 4 kaniko-build — 拉代码 / Dockerfile / 推 TCR（看 Job 日志） -# 5 set-image — Deployment 名或容器名不对 -# 6 rollout — 镜像拉不下来 / 探针失败 / 资源不够 +# Secrets: SSH_K3S_HOST / SSH_K3S_USERNAME / SSH_K3S_PASSWORD +# 集群一次: GIT_TOKEN=... TCR_USERNAME=... TCR_PASSWORD=... ./scripts/16-setup-kaniko.sh # name: Build and Deploy @@ -39,132 +26,39 @@ jobs: deploy: runs-on: ubuntu-latest steps: - # ── 0. 本机算出 TAG / 完整镜像名（不 SSH）──────────────── - - name: "0. print build info" + - name: Show image tag id: info run: | TAG="${{ github.sha }}" IMG="${{ env.TCR_REGISTRY }}/${{ env.TCR_NAMESPACE }}/${{ env.IMAGE_NAME }}:${TAG}" echo "tag=${TAG}" >> "$GITHUB_OUTPUT" echo "image=${IMG}" >> "$GITHUB_OUTPUT" - echo "======= build info =======" - echo "repo = ${{ github.repository }}" - echo "ref = ${{ github.ref_name }}" - echo "sha = ${TAG}" - echo "git_url = ${{ env.GIT_URL }}" - echo "dockerfile = ${{ env.DOCKERFILE }}" - echo "image = ${IMG}" - echo "deploy = ${{ env.NAMESPACE }}/deploy/${{ env.DEPLOY_NAME }}" - echo "==========================" + echo "Will build: ${IMG}" - # ── 1. SSH + 集群是否通 ───────────────────────────────── - - name: "1. check cluster (SSH + kubectl)" - uses: appleboy/ssh-action@v1.0.3 - with: - host: ${{ secrets.SSH_K3S_HOST }} - username: ${{ secrets.SSH_K3S_USERNAME }} - password: ${{ secrets.SSH_K3S_PASSWORD }} - script_stop: true - script: | - set -euo pipefail - export KUBECONFIG="${{ env.KUBECONFIG }}" - echo "==> whoami: $(whoami) @ $(hostname)" - echo "==> kubeconfig: ${KUBECONFIG}" - test -f "${KUBECONFIG}" || { echo "FAIL: 找不到 ${KUBECONFIG}"; exit 1; } - test -d "${{ env.K3S_DIR }}" || { echo "FAIL: 找不到 ${{ env.K3S_DIR }}，请把 k3s 清单同步到该目录"; exit 1; } - test -x "${{ env.K3S_DIR }}/scripts/ci-kaniko-build.sh" || { - echo "FAIL: 缺少可执行脚本 ${{ env.K3S_DIR }}/scripts/ci-kaniko-build.sh" - ls -la "${{ env.K3S_DIR }}/scripts/" || true - exit 1 - } - echo "==> nodes:" - kubectl get nodes -o wide - echo "==> namespace ${{ env.NAMESPACE }}:" - kubectl get ns "${{ env.NAMESPACE }}" - echo "==> deploy/${{ env.DEPLOY_NAME }}:" - kubectl -n "${{ env.NAMESPACE }}" get deploy "${{ env.DEPLOY_NAME }}" -o wide - - # ── 2. Kaniko 凭据是否已创建 ──────────────────────────── - - name: "2. check kaniko secrets" - uses: appleboy/ssh-action@v1.0.3 - with: - host: ${{ secrets.SSH_K3S_HOST }} - username: ${{ secrets.SSH_K3S_USERNAME }} - password: ${{ secrets.SSH_K3S_PASSWORD }} - script_stop: true - script: | - set -euo pipefail - export KUBECONFIG="${{ env.KUBECONFIG }}" - NS="${{ env.NAMESPACE }}" - echo "==> 检查 Secret（由 16-setup-kaniko.sh 创建）" - kubectl -n "$NS" get secret kaniko-git -o jsonpath='{.metadata.name}{" keys="}{.data}{"\n"}' >/dev/null \ - && echo "OK secret/kaniko-git" \ - || { echo "FAIL: 缺少 secret/kaniko-git — 在 42 执行: GIT_TOKEN=... ./scripts/16-setup-kaniko.sh"; exit 1; } - kubectl -n "$NS" get secret kaniko-docker-config >/dev/null \ - && echo "OK secret/kaniko-docker-config" \ - || { echo "FAIL: 缺少 secret/kaniko-docker-config — TCR 账号未写入"; exit 1; } - echo "==> build 节点:" - kubectl get nodes -l role=build -o wide - COUNT="$(kubectl get nodes -l role=build --no-headers 2>/dev/null | wc -l | tr -d ' ')" - if [[ "${COUNT}" == "0" ]]; then - echo "FAIL: 没有 role=build 节点，Kaniko Job 会 Pending" - kubectl get nodes --show-labels - exit 1 - fi - - # ── 3. Kaniko 构建并推 TCR（最慢，失败看 Job 日志）───── - - name: "3. kaniko build & push" - uses: appleboy/ssh-action@v1.0.3 + # 最长一步：git 拉代码 + Kaniko 构建推 TCR，日志实时跟出来 + - name: Build image (Kaniko logs) + uses: appleboy/ssh-action@v1.2.0 with: host: ${{ secrets.SSH_K3S_HOST }} username: ${{ secrets.SSH_K3S_USERNAME }} password: ${{ secrets.SSH_K3S_PASSWORD }} command_timeout: 50m + request_pty: true script_stop: true script: | - set -euo pipefail - export KUBECONFIG="${{ env.KUBECONFIG }}" - cd "${{ env.K3S_DIR }}" - TAG="${{ steps.info.outputs.tag }}" - echo "==> 开始 Kaniko: ${{ env.IMAGE_NAME }}:${TAG}" - echo " 失败时在 42 执行:" - echo " kubectl -n ${{ env.NAMESPACE }} get job -l app=kaniko" - echo " kubectl -n ${{ env.NAMESPACE }} logs -l job-name=... -c git" - echo " kubectl -n ${{ env.NAMESPACE }} logs -l job-name=... -c kaniko" + set -euxo pipefail + export KUBECONFIG=${{ env.KUBECONFIG }} + cd ${{ env.K3S_DIR }} + chmod +x scripts/ci-kaniko-build.sh ./scripts/ci-kaniko-build.sh \ "${{ env.GIT_URL }}" \ "${{ env.DOCKERFILE }}" \ "${{ env.IMAGE_NAME }}" \ - "${TAG}" \ - "${TAG}" - echo "==> 镜像已推送: ${{ steps.info.outputs.image }}" + "${{ steps.info.outputs.tag }}" \ + "${{ steps.info.outputs.tag }}" - # ── 4. 改 Deployment 镜像 ─────────────────────────────── - - name: "4. set deployment image" - uses: appleboy/ssh-action@v1.0.3 - with: - host: ${{ secrets.SSH_K3S_HOST }} - username: ${{ secrets.SSH_K3S_USERNAME }} - password: ${{ secrets.SSH_K3S_PASSWORD }} - script_stop: true - script: | - set -euo pipefail - export KUBECONFIG="${{ env.KUBECONFIG }}" - NS="${{ env.NAMESPACE }}" - IMG="${{ steps.info.outputs.image }}" - echo "==> 当前镜像:" - kubectl -n "$NS" get deploy "${{ env.DEPLOY_NAME }}" \ - -o jsonpath='{.spec.template.spec.containers[?(@.name=="${{ env.CONTAINER_NAME }}")].image}{"\n"}' - echo "==> 设为: ${IMG}" - kubectl -n "$NS" set image "deploy/${{ env.DEPLOY_NAME }}" \ - "${{ env.CONTAINER_NAME }}=${IMG}" - echo "==> 已更新:" - kubectl -n "$NS" get deploy "${{ env.DEPLOY_NAME }}" \ - -o jsonpath='{.spec.template.spec.containers[?(@.name=="${{ env.CONTAINER_NAME }}")].image}{"\n"}' - - # ── 5. 等待滚动发布 ───────────────────────────────────── - - name: "5. wait rollout" - uses: appleboy/ssh-action@v1.0.3 + - name: Deploy + uses: appleboy/ssh-action@v1.2.0 with: host: ${{ secrets.SSH_K3S_HOST }} username: ${{ secrets.SSH_K3S_USERNAME }} @@ -172,26 +66,10 @@ jobs: command_timeout: 5m script_stop: true script: | - set -euo pipefail - export KUBECONFIG="${{ env.KUBECONFIG }}" - NS="${{ env.NAMESPACE }}" - DEP="${{ env.DEPLOY_NAME }}" - echo "==> rollout status..." - if ! kubectl -n "$NS" rollout status "deploy/${DEP}" --timeout=180s; then - echo "FAIL: rollout 超时/失败，诊断信息如下" - kubectl -n "$NS" get deploy,rs,pods -l app="${DEP}" -o wide || \ - kubectl -n "$NS" get pods -o wide | grep -E "${DEP}|NAME" || true - kubectl -n "$NS" describe deploy "${DEP}" | tail -60 || true - POD="$(kubectl -n "$NS" get pods -l app="${DEP}" -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)" - if [[ -n "${POD}" ]]; then - echo "==> events for ${POD}:" - kubectl -n "$NS" describe pod "${POD}" | tail -40 || true - echo "==> logs:" - kubectl -n "$NS" logs "${POD}" --tail=80 || true - fi - exit 1 - fi - echo "==> pods:" - kubectl -n "$NS" get pods -o wide | grep -E "${DEP}|NAME" || \ - kubectl -n "$NS" get pods -o wide - echo "OK deployed ${{ steps.info.outputs.image }}" + set -euxo pipefail + export KUBECONFIG=${{ env.KUBECONFIG }} + IMG="${{ steps.info.outputs.image }}" + kubectl -n ${{ env.NAMESPACE }} set image deploy/${{ env.DEPLOY_NAME }} \ + ${{ env.CONTAINER_NAME }}=${IMG} + kubectl -n ${{ env.NAMESPACE }} rollout status deploy/${{ env.DEPLOY_NAME }} --timeout=180s + kubectl -n ${{ env.NAMESPACE }} get pods -l app=${{ env.DEPLOY_NAME }} -o wide From bbe9a3a9a63a8085e1aa1625f2f738abb780f7f0 Mon Sep 17 00:00:00 2001 From: xiaoliutral Date: Thu, 3 Sep 2026 11:16:09 +0800 Subject: [PATCH 5/5] Update master.yml --- .github/workflows/master.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml index c99fc1c..89d3885 100644 --- a/.github/workflows/master.yml +++ b/.github/workflows/master.yml @@ -1,7 +1,11 @@ # 复制到 itfx: .github/workflows/deploy.yml # # Secrets: SSH_K3S_HOST / SSH_K3S_USERNAME / SSH_K3S_PASSWORD -# 集群一次: GIT_TOKEN=... TCR_USERNAME=... TCR_PASSWORD=... ./scripts/16-setup-kaniko.sh +# 集群: +# GIT_TOKEN=... TCR_USERNAME=... TCR_PASSWORD=... ./scripts/16-setup-kaniko.sh +# ./scripts/17-test-github-access.sh # 选 GIT_FETCH_MODE / KANIKO_NODE_ROLE +# +# 构建全程在集群 Pod 内完成（git + kaniko），Actions 只 SSH 触发并跟日志 # name: Build and Deploy @@ -26,7 +30,7 @@ jobs: deploy: runs-on: ubuntu-latest steps: - - name: Show image tag + - name: Show image id: info run: | TAG="${{ github.sha }}" @@ -35,7 +39,6 @@ jobs: echo "image=${IMG}" >> "$GITHUB_OUTPUT" echo "Will build: ${IMG}" - # 最长一步：git 拉代码 + Kaniko 构建推 TCR，日志实时跟出来 - name: Build image (Kaniko logs) uses: appleboy/ssh-action@v1.2.0 with: