stages: - build - deploy variables: IMAGE: 10.15.39.186:8083/eosbpkd/sidata TAG: $CI_COMMIT_SHORT_SHA KUBE_NAMESPACE: sidata-prod HELM_RELEASE: sidata BUILDAH_ISOLATION: "chroot" STORAGE_DRIVER: "vfs" http_proxy: "http://10.15.3.20:80" https_proxy: "http://10.15.3.20:80" HTTP_PROXY: "http://10.15.3.20:80" HTTPS_PROXY: "http://10.15.3.20:80" no_proxy: "127.0.0.1,localhost,10.15.39.168,10.15.39.186,10.15.39.0/24,10.42.0.0/16,10.43.0.0/16,.jakarta.go.id" NO_PROXY: "127.0.0.1,localhost,10.15.39.168,10.15.39.186,10.15.39.0/24,10.42.0.0/16,10.43.0.0/16,.jakarta.go.id" # ========================================================= # BUILD IMAGE VIA BUILDAH # ========================================================= build: stage: build image: 10.15.39.186:8083/buildah:stable tags: - skpp script: - echo '1. MENERAPKAN PENGATURAN REGISTRY' - mkdir -p ~/.config/containers - | cat < ~/.config/containers/registries.conf unqualified-search-registries = ["docker.io", "10.15.39.186:8084"] [[registry]] location = "10.15.39.186:8083" insecure = true [[registry]] location = "10.15.39.186:8084" insecure = true [[registry]] location = "docker.io" insecure = false EOF - echo '2. LOGIN TO NEXUS REGISTRY' - echo "$NEXUS_PASSWORD" | buildah login --tls-verify=false -u "$NEXUS_USERNAME" --password-stdin 10.15.39.186:8083 - echo '3. STARTING BUILDAH BUILD' - buildah bud --tls-verify=false --storage-driver=vfs --isolation=chroot --build-arg http_proxy=$http_proxy --build-arg https_proxy=$https_proxy -t $IMAGE:$TAG -t $IMAGE:latest . - echo '4. PUSHING TO NEXUS' - buildah push --tls-verify=false --storage-driver=vfs $IMAGE:$TAG - buildah push --tls-verify=false --storage-driver=vfs $IMAGE:latest # ========================================================= # DEPLOY VIA HELM & KUBECTL # ========================================================= deploy: stage: deploy image: name: alpine/k8s:1.29.1 entrypoint: [""] tags: - skpp script: - echo '1. SETUP KUBECONFIG LOKAL & BYPASS PROXY' - unset http_proxy https_proxy HTTP_PROXY HTTPS_PROXY - export NO_PROXY="*" - export no_proxy="*" - mkdir -p ./kubeconfig-dir - echo "$KUBECONFIG_B64" | base64 -d > ./kubeconfig-dir/config - sed -i 's|127.0.0.1|10.15.39.168|g' ./kubeconfig-dir/config - chmod 600 ./kubeconfig-dir/config - export KUBECONFIG=$(pwd)/kubeconfig-dir/config - echo '2. TEST CONNECTION TO RKE2' - kubectl version --client --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true - kubectl get nodes --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true - kubectl create namespace $KUBE_NAMESPACE --dry-run=client -o yaml | kubectl apply -f - --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true - echo '3. VALIDASI TEMPLATE HELM (DEBUG)' - helm template $HELM_RELEASE ./helm/sidata --namespace $KUBE_NAMESPACE --debug - echo '3.5. CLEAN UNMANAGED SERVICE JIKA BENTROK' # Menghapus service non-helm (hasil manual kubectl expose tadi) agar peluncuran Helm bersih - kubectl delete service sidata-service -n $KUBE_NAMESPACE --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true || true - echo '4. DEPLOYING APPS VIA HELM' - | helm upgrade --install $HELM_RELEASE ./helm/sidata \ --kube-apiserver https://10.15.39.168:6443 \ --kube-insecure-skip-tls-verify \ --namespace $KUBE_NAMESPACE \ --force \ --set image.repository=$IMAGE \ --set image.tag=$TAG \ --set-string podAnnotations.rolloutTimestamp="$(date +%s)" \ --set service.type=NodePort \ --set service.nodePort=32185 \ --set service.name=sidata-service \ --set-string extraEnv.APP_ENV="production" \ --set-string extraEnv.APP_DEBUG="false" \ --set-string extraEnv.FORCE_HTTPS="true" \ --set-string extraEnv.APP_KEY="base64:HiyJqrnWz8zB6WUCXTVb6lZsC3EraX/vFIn66Hx/dVM=" \ --set-string extraEnv.APP_URL="https://data-center.id" \ --set-string extraEnv.ASSET_URL="https://data-center.id" \ --set-string extraEnv.SESSION_DRIVER="file" \ --set-string extraEnv.SESSION_SECURE_COOKIE="true" - echo '5. CHECK REAL NODEPORT STATUS' - kubectl get svc -n $KUBE_NAMESPACE --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true - echo '6. CHECK STATUS ROLLOUT' - kubectl rollout status deployment/$HELM_RELEASE -n $KUBE_NAMESPACE --timeout=180s --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true || kubectl rollout status deployment/$HELM_RELEASE-sidata -n $KUBE_NAMESPACE --timeout=180s --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true - echo '7. AUTO CLEAR LARAVEL CACHE ON POD' - | sleep 5 POD_NAME=$(kubectl get pods -n $KUBE_NAMESPACE -l app=$HELM_RELEASE --field-selector=status.phase=Running --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true) if [ -z "$POD_NAME" ]; then POD_NAME=$(kubectl get pods -n $KUBE_NAMESPACE -l app.kubernetes.io/instance=$HELM_RELEASE --field-selector=status.phase=Running --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true) fi if [ -n "$POD_NAME" ]; then echo "Executing Artisan Clear Cache on Pod: $POD_NAME" kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan config:clear || true kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan route:clear || true kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan cache:clear || true kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan view:clear || true else echo "Warning: No running pod found for Artisan commands execution, skipping." fi after_script: - echo "Cleaning up sensitive temporary files..." - rm -rf ./kubeconfig-dir