gitea/sidata
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases Wiki Activity

ci: setup Dockerfile, GitLab CI pipeline, and Helm chart for Rancher

Browse Source
This commit is contained in:
gitea
2026-09-02 13:50:47 +07:00
parent 5d9ce5e660
commit 1efc053cb8
10 changed files with 434 additions and 356 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitlab-ci.yml
+28 -140
View File
@@ -3,149 +3,37 @@ stages:
- deploy
variables:
GIT_STRATEGY: none
IMAGE: 10.15.39.186:8083/eosbpkd/sidata
TAG: $CI_COMMIT_SHORT_SHA
KUBE_NAMESPACE: sidata-prod
HELM_RELEASE: sidata
BUILDAH_ISOLATION: "chroot"
STORAGE_DRIVER: "vfs"
http_proxy: "http://10.15.3.20:80"
https_proxy: "http://10.15.3.20:80"
HTTP_PROXY: "http://10.15.3.20:80"
HTTPS_PROXY: "http://10.15.3.20:80"
no_proxy: "127.0.0.1,localhost,10.15.39.168,10.15.39.186,10.15.39.0/24,10.42.0.0/16,10.43.0.0/16,.jakarta.go.id"
NO_PROXY: "127.0.0.1,localhost,10.15.39.168,10.15.39.186,10.15.39.0/24,10.42.0.0/16,10.43.0.0/16,.jakarta.go.id"
NEXUS_PULL_REGISTRY: "10.15.39.186:8083"
NEXUS_PUSH_REGISTRY: "10.15.39.186:8081"
IMAGE_NAME: "sidata"
# =========================================================
# BUILD IMAGE VIA BUILDAH
# =========================================================
build:
build_image:
stage: build
image: 10.15.39.186:8083/buildah:stable
tags:
- skpp
before_script:
- echo '0. FETCHING CODE MANUALLY VIA HTTP WITH CI_JOB_TOKEN'
- git config --global http.sslVerify false
- git clone http://gitlab-ci-token:${CI_JOB_TOKEN}@10.15.39.187/izuddin/sidata.git . || git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.dashboard-bpkd.drc-bpkd.data-center.id/izuddin/sidata.git .
- git checkout $CI_COMMIT_SHA
image: docker:24.0.5
services:
- name: docker:24.0.5-dind
command:
- "--insecure-registry=10.15.39.186:8081"
- "--insecure-registry=10.15.39.186:8083"
script:
- echo '1. MENERAPKAN PENGATURAN REGISTRY'
- mkdir -p ~/.config/containers
- |
cat <<EOF > ~/.config/containers/registries.conf
unqualified-search-registries = ["docker.io", "10.15.39.186:8084"]
- docker login -u "$NEXUS_USER" -p "$NEXUS_PASSWORD" $NEXUS_PULL_REGISTRY
- docker login -u "$NEXUS_USER" -p "$NEXUS_PASSWORD" $NEXUS_PUSH_REGISTRY
- docker build -t $NEXUS_PUSH_REGISTRY/$IMAGE_NAME:$CI_COMMIT_SHA -t $NEXUS_PUSH_REGISTRY/$IMAGE_NAME:latest .
- docker push $NEXUS_PUSH_REGISTRY/$IMAGE_NAME:$CI_COMMIT_SHA
- docker push $NEXUS_PUSH_REGISTRY/$IMAGE_NAME:latest
only:
- main
- master
[[registry]]
location = "10.15.39.186:8083"
insecure = true
[[registry]]
location = "10.15.39.186:8084"
insecure = true
[[registry]]
location = "docker.io"
insecure = false
EOF
- echo '2. LOGIN TO NEXUS REGISTRY'
- echo "$NEXUS_PASSWORD" | buildah login --tls-verify=false -u "$NEXUS_USERNAME" --password-stdin 10.15.39.186:8083
- echo '3. STARTING BUILDAH BUILD'
- buildah bud --tls-verify=false --storage-driver=vfs --isolation=chroot --build-arg http_proxy=$http_proxy --build-arg https_proxy=$https_proxy -t $IMAGE:$TAG -t $IMAGE:latest .
- echo '4. PUSHING TO NEXUS'
- buildah push --tls-verify=false --storage-driver=vfs $IMAGE:$TAG
- buildah push --tls-verify=false --storage-driver=vfs $IMAGE:latest
# =========================================================
# DEPLOY VIA HELM & KUBECTL
# =========================================================
deploy:
deploy_rancher:
stage: deploy
image:
name: alpine/k8s:1.29.1
entrypoint: [""]
tags:
- skpp
before_script:
- echo '0. FETCHING CODE MANUALLY VIA HTTP WITH CI_JOB_TOKEN'
- git config --global http.sslVerify false
- git clone http://gitlab-ci-token:${CI_JOB_TOKEN}@10.15.39.187/izuddin/sidata.git . || git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.dashboard-bpkd.drc-bpkd.data-center.id/izuddin/sidata.git .
- git checkout $CI_COMMIT_SHA
image: alpine/helm:3.12.0
script:
- echo '1. SETUP KUBECONFIG LOKAL & BYPASS PROXY'
- unset http_proxy https_proxy HTTP_PROXY HTTPS_PROXY
- export NO_PROXY="*"
- export no_proxy="*"
- mkdir -p ./kubeconfig-dir
- echo "$KUBECONFIG_B64" | base64 -d > ./kubeconfig-dir/config
- sed -i 's|127.0.0.1|10.15.39.168|g' ./kubeconfig-dir/config
- chmod 600 ./kubeconfig-dir/config
- export KUBECONFIG=$(pwd)/kubeconfig-dir/config
- echo '2. TEST CONNECTION TO RKE2'
- kubectl version --client --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
- kubectl get nodes --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
- kubectl create namespace $KUBE_NAMESPACE --dry-run=client -o yaml | kubectl apply -f - --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
- echo '3. VALIDASI TEMPLATE HELM (DEBUG)'
- helm template $HELM_RELEASE ./helm/sidata --namespace $KUBE_NAMESPACE --debug
- echo '3.5. CLEAN UNMANAGED SERVICE JIKA BENTROK'
- kubectl delete service sidata-service -n $KUBE_NAMESPACE --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true || true
- echo '4. DEPLOYING APPS VIA HELM'
- |
helm upgrade --install $HELM_RELEASE ./helm/sidata \
--kube-apiserver https://10.15.39.168:6443 \
--kube-insecure-skip-tls-verify \
--namespace $KUBE_NAMESPACE \
--force \
--set image.repository=$IMAGE \
--set image.tag=$TAG \
--set-string podAnnotations.rolloutTimestamp="$(date +%s)" \
--set service.type=NodePort \
--set service.nodePort=32185 \
--set service.name=sidata-service \
--set-string extraEnv.APP_ENV="production" \
--set-string extraEnv.APP_DEBUG="false" \
--set-string extraEnv.FORCE_HTTPS="true" \
--set-string extraEnv.APP_KEY="base64:HiyJqrnWz8zB6WUCXTVb6lZsC3EraX/vFIn66Hx/dVM=" \
--set-string extraEnv.APP_URL="https://sidata.dashboard-bpkd.drc-bpkd.data-center.id" \
--set-string extraEnv.ASSET_URL="https://sidata.dashboard-bpkd.drc-bpkd.data-center.id" \
--set-string extraEnv.SESSION_DRIVER="file" \
--set-string extraEnv.SESSION_SECURE_COOKIE="true"
- echo '5. CHECK REAL NODEPORT STATUS'
- kubectl get svc -n $KUBE_NAMESPACE --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
- echo '6. CHECK STATUS ROLLOUT'
- kubectl rollout status deployment/$HELM_RELEASE -n $KUBE_NAMESPACE --timeout=180s --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true || kubectl rollout status deployment/$HELM_RELEASE-sidata -n $KUBE_NAMESPACE --timeout=180s --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
- echo '7. AUTO CLEAR LARAVEL CACHE ON POD'
- |
sleep 5
POD_NAME=$(kubectl get pods -n $KUBE_NAMESPACE -l app=$HELM_RELEASE --field-selector=status.phase=Running --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
if [ -z "$POD_NAME" ]; then
POD_NAME=$(kubectl get pods -n $KUBE_NAMESPACE -l app.kubernetes.io/instance=$HELM_RELEASE --field-selector=status.phase=Running --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
fi
if [ -n "$POD_NAME" ]; then
echo "Executing Artisan Clear Cache on Pod: $POD_NAME"
kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan config:clear || true
kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan route:clear || true
kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan cache:clear || true
kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan view:clear || true
kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan view:cache || true
else
echo "Warning: No running pod found for Artisan commands execution, skipping."
fi
after_script:
- echo "Cleaning up sensitive temporary files..."
- rm -rf ./kubeconfig-dir
- mkdir -p ~/.kube
- echo "$KUBECONFIG_DATA" | base64 -d > ~/.kube/config
- helm upgrade --install sidata ./helm/sidata
--namespace default
--set image.tag=$CI_COMMIT_SHA
only:
- main
- master