Kubernetes与持续集成/持续部署(CI/CD)最佳实践

张

张建站

2026/6/10 19:45:12

10分钟阅读

Kubernetes与持续集成/持续部署(CI/CD)最佳实践1. CI/CD核心概念1.1 什么是CI/CDCI/CD是持续集成Continuous Integration和持续部署Continuous Deployment的缩写是一种自动化软件开发流程用于频繁、可靠地将代码变更交付到生产环境。1.2 CI/CD的关键环节持续集成代码提交后自动构建和测试持续交付将构建产物准备就绪可手动部署到生产环境持续部署自动将构建产物部署到生产环境2. CI/CD工具选择2.1 常用CI/CD工具工具类型特点Jenkins自动化服务器高度可定制丰富的插件生态GitLab CI集成CI/CD与GitLab代码仓库深度集成GitHub Actions云原生CI/CD与GitHub无缝集成支持矩阵构建CircleCI云CI/CD快速、可扩展支持容器化Travis CI云CI/CD配置简单适合开源项目Argo CDGitOps工具基于Git的声明式部署Flux CDGitOps工具云原生支持Kubernetes3. Jenkins与Kubernetes集成3.1 Jenkins安装与配置# 安装Jenkins helm repo add jenkins https://charts.jenkins.io helm install jenkins jenkins/jenkins -n jenkins --create-namespace # 获取Jenkins管理员密码 kubectl get secret jenkins -n jenkins -o jsonpath{.data.jenkins-admin-password} | base64 -d # 访问Jenkins kubectl port-forward svc/jenkins 8080:8080 -n jenkins3.2 Jenkins Pipeline配置Jenkinsfilepipeline { agent { kubernetes { yaml apiVersion: v1 kind: Pod spec: containers: - name: build image: maven:3.8.4-jdk-11 command: [cat] tty: true - name: docker image: docker:20.10.17 command: [cat] tty: true volumeMounts: - name: docker-socket mountPath: /var/run/docker.sock volumes: - name: docker-socket hostPath: path: /var/run/docker.sock } } stages { stage(Checkout) { steps { checkout scm } } stage(Build) { steps { container(build) { sh mvn clean package } } } stage(Docker Build) { steps { container(docker) { sh docker build -t myapp:${BUILD_NUMBER} . sh docker tag myapp:${BUILD_NUMBER} myapp:latest } } } stage(Deploy to Kubernetes) { steps { container(docker) { sh kubectl apply -f k8s/deployment.yaml sh kubectl rollout status deployment/myapp } } } } post { always { echo Pipeline completed } success { echo Pipeline succeeded } failure { echo Pipeline failed } } }4. GitLab CI与Kubernetes集成4.1 GitLab CI配置.gitlab-ci.ymlstages: - build - test - deploy variables: DOCKER_IMAGE: myapp K8S_NAMESPACE: default build: stage: build image: docker:20.10.17 services: - docker:20.10.17-dind script: - docker build -t ${DOCKER_IMAGE}:${CI_COMMIT_SHORT_SHA} . - docker tag ${DOCKER_IMAGE}:${CI_COMMIT_SHORT_SHA} ${DOCKER_IMAGE}:latest - docker login -u ${CI_REGISTRY_USER} -p ${CI_REGISTRY_PASSWORD} ${CI_REGISTRY} - docker push ${DOCKER_IMAGE}:${CI_COMMIT_SHORT_SHA} - docker push ${DOCKER_IMAGE}:latest test: stage: test image: maven:3.8.4-jdk-11 script: - mvn test deploy: stage: deploy image: bitnami/kubectl:latest script: - kubectl config use-context ${KUBE_CONTEXT} - kubectl set image deployment/myapp myapp${DOCKER_IMAGE}:${CI_COMMIT_SHORT_SHA} -n ${K8S_NAMESPACE} - kubectl rollout status deployment/myapp -n ${K8S_NAMESPACE} environment: name: production only: - main5. GitHub Actions与Kubernetes集成5.1 GitHub Actions配置.github/workflows/cicd.ymlname: CI/CD Pipeline on: push: branches: [ main ] pull_request: branches: [ main ] jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkoutv3 - name: Set up JDK 11 uses: actions/setup-javav3 with: java-version: 11 distribution: adopt - name: Build with Maven run: mvn clean package - name: Build Docker image run: docker build -t myapp:${{ github.sha }} . - name: Login to Docker Hub uses: docker/login-actionv2 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} - name: Push Docker image run: | docker tag myapp:${{ github.sha }} myapp:latest docker push myapp:${{ github.sha }} docker push myapp:latest deploy: needs: build runs-on: ubuntu-latest steps: - uses: actions/checkoutv3 - name: Set up kubectl uses: azure/setup-kubectlv3 with: version: v1.24.0 - name: Configure kubectl run: | echo ${{ secrets.KUBE_CONFIG }} | base64 -d kubeconfig kubectl config use-context my-cluster - name: Deploy to Kubernetes run: | kubectl set image deployment/myapp myappmyapp:${{ github.sha }} -n default kubectl rollout status deployment/myapp -n default6. GitOps与Kubernetes集成6.1 Argo CD安装与配置# 安装Argo CD kubectl create namespace argocd kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml # 获取Argo CD管理员密码 kubectl get secret argocd-initial-admin-secret -n argocd -o jsonpath{.data.password} | base64 -d # 访问Argo CD kubectl port-forward svc/argocd-server 8080:443 -n argocd6.2 Argo CD应用配置application.yamlapiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: myapp namespace: argocd spec: project: default source: repoURL: https://github.com/myorg/myapp targetRevision: HEAD path: k8s destination: server: https://kubernetes.default.svc namespace: default syncPolicy: automated: prune: true selfHeal: true syncOptions: - CreateNamespacetrue7. CI/CD最佳实践7.1 代码质量保障代码静态分析使用SonarQube进行代码质量检查配置代码风格检查工具自动化测试单元测试集成测试端到端测试7.2 构建与部署最佳实践构建优化使用缓存加速构建多阶段构建减小镜像大小使用构建矩阵并行测试部署策略蓝绿部署金丝雀发布滚动更新环境管理开发环境测试环境预生产环境生产环境7.3 安全性最佳实践** secrets管理**使用Vault或云厂商的密钥管理服务避免在代码中硬编码密钥定期轮换密钥镜像安全扫描镜像漏洞使用可信的基础镜像定期更新镜像权限管理最小权限原则使用RBAC控制访问定期审查权限8. 实际应用场景8.1 微服务CI/CD流程多服务CI/CD配置# .gitlab-ci.yml stages: - build - test - deploy variables: DOCKER_REGISTRY: registry.example.com .services: - name: docker:20.10.17-dind command: [--experimental] build-api: stage: build image: docker:20.10.17 services: !reference [.services] script: - cd api - docker build -t ${DOCKER_REGISTRY}/api:${CI_COMMIT_SHORT_SHA} . - docker push ${DOCKER_REGISTRY}/api:${CI_COMMIT_SHORT_SHA} only: changes: - api/**/* build-frontend: stage: build image: docker:20.10.17 services: !reference [.services] script: - cd frontend - docker build -t ${DOCKER_REGISTRY}/frontend:${CI_COMMIT_SHORT_SHA} . - docker push ${DOCKER_REGISTRY}/frontend:${CI_COMMIT_SHORT_SHA} only: changes: - frontend/**/* deploy-api: stage: deploy image: bitnami/kubectl:latest script: - kubectl set image deployment/api api${DOCKER_REGISTRY}/api:${CI_COMMIT_SHORT_SHA} - kubectl rollout status deployment/api only: changes: - api/**/* deploy-frontend: stage: deploy image: bitnami/kubectl:latest script: - kubectl set image deployment/frontend frontend${DOCKER_REGISTRY}/frontend:${CI_COMMIT_SHORT_SHA} - kubectl rollout status deployment/frontend only: changes: - frontend/**/*8.2 多环境部署环境配置文件# k8s/environments/dev/deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: myapp namespace: dev spec: replicas: 2 # ... # k8s/environments/prod/deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: myapp namespace: prod spec: replicas: 5 # ...GitHub Actions多环境部署# .github/workflows/cicd.yml name: CI/CD Pipeline on: push: branches: - main - develop jobs: build: # ... deploy-dev: needs: build if: github.ref refs/heads/develop # ... deploy-prod: needs: build if: github.ref refs/heads/main # ...9. 故障排查与监控9.1 CI/CD pipeline监控Jenkins监控安装Prometheus插件配置Grafana仪表板GitLab CI监控使用GitLab的CI/CD管道仪表板配置webhook通知GitHub Actions监控使用GitHub Actions的状态页面配置通知9.2 常见问题解决构建失败检查依赖项检查代码质量检查构建环境部署失败检查Kubernetes集群状态检查资源配额检查网络连接镜像拉取失败检查镜像仓库权限检查网络连接检查镜像标签10. 总结CI/CD是现代软件开发的重要实践它可以显著提高开发效率和代码质量。通过与Kubernetes集成可以实现更加自动化、可靠的部署流程。关键要点选择适合的CI/CD工具配置合理的Pipeline流程实施GitOps最佳实践注重代码质量和安全性建立完善的监控和故障排查机制通过以上最佳实践可以构建更加高效、可靠的CI/CD流程为Kubernetes应用的开发和部署提供有力支持。