74 lines
3.2 KiB
YAML
74 lines
3.2 KiB
YAML
clone:
|
|
git:
|
|
image: woodpeckerci/plugin-git
|
|
|
|
steps:
|
|
- name: build-and-push
|
|
image: gcr.io/kaniko-project/executor:v1.23.2-debug
|
|
environment:
|
|
ZOT_USERNAME:
|
|
from_secret: ZOT_USERNAME
|
|
ZOT_PASSWORD:
|
|
from_secret: ZOT_PASSWORD
|
|
commands:
|
|
- mkdir -p /kaniko/.docker
|
|
# Authenticate kaniko against the zot registry. The username:password
|
|
# pair is base64-encoded into the Docker config.json auth field.
|
|
- >-
|
|
printf '{"auths":{"registry.be.kaien.ru":{"auth":"%s"}}}'
|
|
"$(printf '%s:%s' "$ZOT_USERNAME" "$ZOT_PASSWORD" | base64 | tr -d '\n')"
|
|
> /kaniko/.docker/config.json
|
|
# Publish an immutable per-commit tag (full CI_COMMIT_SHA) as the
|
|
# primary tag, plus :latest as a convenience alias. The version baked
|
|
# into the binary via ldflags matches the SHA. Kaniko pushes both in
|
|
# one build.
|
|
- >-
|
|
/kaniko/executor
|
|
--context "$CI_WORKSPACE"
|
|
--dockerfile "$CI_WORKSPACE/Dockerfile"
|
|
--build-arg VERSION=$CI_COMMIT_SHA
|
|
--destination "registry.be.kaien.ru/woodpecker_mcp/woodpecker_mcp:$CI_COMMIT_SHA"
|
|
--destination "registry.be.kaien.ru/woodpecker_mcp/woodpecker_mcp:latest"
|
|
when:
|
|
- branch: master
|
|
event: [push, manual]
|
|
|
|
- name: deploy
|
|
image: alpine:latest
|
|
entrypoint: ["/bin/sh", "-c", 'printf "%s" "$CI_SCRIPT" | base64 -d > /tmp/woodpecker-script.sh && exec /bin/sh -e /tmp/woodpecker-script.sh']
|
|
environment:
|
|
SSH_PRIVATE_KEY:
|
|
from_secret: SSH_PRIVATE_KEY
|
|
DEPLOY_HOST:
|
|
from_secret: DEPLOY_HOST
|
|
DEPLOY_USER:
|
|
from_secret: DEPLOY_USER
|
|
ZOT_USERNAME:
|
|
from_secret: ZOT_USERNAME
|
|
ZOT_PASSWORD:
|
|
from_secret: ZOT_PASSWORD
|
|
commands:
|
|
- apk add --no-cache openssh-client gettext
|
|
- eval $(ssh-agent -s)
|
|
- mkdir -p ~/.ssh && chmod 700 ~/.ssh
|
|
- echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
|
|
- chmod 600 ~/.ssh/id_rsa
|
|
- ssh-add ~/.ssh/id_rsa
|
|
- ssh-keyscan -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts
|
|
- chmod 644 ~/.ssh/known_hosts
|
|
- echo "$ZOT_PASSWORD" | ssh $DEPLOY_USER@$DEPLOY_HOST "docker login registry.be.kaien.ru -u $ZOT_USERNAME --password-stdin"
|
|
# Pull the immutable SHA tag (also verifies it exists in the registry).
|
|
- ssh -n $DEPLOY_USER@$DEPLOY_HOST "docker pull registry.be.kaien.ru/woodpecker_mcp/woodpecker_mcp:$CI_COMMIT_SHA"
|
|
- ssh $DEPLOY_USER@$DEPLOY_HOST "kubectl --kubeconfig /etc/kubernetes/admin.conf apply -f -" < woodpecker-mcp-sealed.yaml
|
|
# Render placeholders (incl. CI_COMMIT_SHA) via the existing envsubst flow
|
|
# and apply. The image string now changes every commit, so kubectl apply
|
|
# alone triggers a rollout — no manual rollout restart needed.
|
|
- envsubst < k8s-deploy.yaml | ssh $DEPLOY_USER@$DEPLOY_HOST "kubectl --kubeconfig /etc/kubernetes/admin.conf apply -f -"
|
|
- ssh -n $DEPLOY_USER@$DEPLOY_HOST "kubectl --kubeconfig /etc/kubernetes/admin.conf -n mcp-servers rollout status deployment/woodpecker-mcp --timeout=120s"
|
|
- ssh -n $DEPLOY_USER@$DEPLOY_HOST "docker image prune -f"
|
|
depends_on:
|
|
- build-and-push
|
|
when:
|
|
- branch: master
|
|
event: [push, manual]
|