nginx-oss: add role, job, ci_pipeline

.github/workflows/setup-nginx-oss-with-existed-vhost.yml

@@ -0,0 +1,51 @@
+name: setup nginx-oss with existed vhost 
+
+on:
+  workflow_dispatch:
+    branches: [ 'main' ]
+
+env:
+  DNS_AK: ${{ secrets.DNS_AK }}
+  DNS_SK: ${{ secrets.DNS_SK }}
+  SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+
+defaults:
+  run:
+    working-directory: ./playbook
+
+jobs:
+  k3s-cluster:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: run playbook
+        shell: bash
+        run: |
+          export ANSIBLE_HOST_KEY_CHECKING=False
+          sudo apt install jq ansible -y
+
+          mkdir -pv ~/.ssh/
+          cat > ~/.ssh/id_rsa << EOF
+          ${SSH_PRIVATE_KEY}
+          EOF
+          sudo chmod 0400 ~/.ssh/id_rsa
+          md5sum ~/.ssh/id_rsa
+
+          mkdir -pv hosts/ 
+          cat > hosts/inventory << EOF
+          [master]
+          vpn.onwalk.net               ansible_host=43.206.90.100
+          
+          [all:vars]
+          ansible_port=22
+          ansible_ssh_user=ubuntu
+          ansible_ssh_private_key_file=~/.ssh/id_rsa
+          ansible_host_key_checking=False
+          dns_ak=$DNS_AK
+          dns_sk=$DNS_SK
+          ingress_ip=43.206.90.100
+          EOF
+          #ansible-playbook -i hosts/inventory jobs/init_k3s_cluster -D
+          ansible-playbook -i hosts/inventory jobs/init_nginx_oss -D

playbook/jobs/init_nginx_oss

@@ -0,0 +1,18 @@
+- name: setup nginx-oss
+  hosts: all
+  user: root
+  become: yes
+  gather_facts: yes
+  tasks:
+    - include_role:
+        name: nginx-oss
+      vars:
+        group: master
+        namespace: nginx
+        domain: onwalk.net
+        auto_issuance: true
+        update_secret: true  
+        tls:
+          - secret_name: nginx-tls
+            keyfile: /etc/sl/onwalk.net.key
+            certfile: /etc.ssl/onwalk.net.pem

playbook/roles/nginx-oss/tasks/main.yml

@@ -0,0 +1,11 @@
+- name: Prep NameSpace
+  shell: "kubectl create namespace nginx || echo true"
+
+- name: Sync deploy yaml
+  template: src=templates/{{ item }}  dest=/tmp/{{ item }} owner=root group=root mode=0644 force=yes unsafe_writes=yes
+  with_items:
+    - mirrors-nginx.yaml
+
+- name: Setup Mirrors Server
+  shell: "kubectl apply -f /tmp/mirrors-nginx.yaml"
+  when: inventory_hostname in groups[group]

playbook/roles/nginx-oss/templates/.gitignore

@@ -0,0 +1,2 @@
+/clickhouse-keeper-k8s.iml
+/.idea/

playbook/roles/nginx-oss/templates/mirrors-nginx.yaml

@@ -0,0 +1,137 @@
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    meta.helm.sh/release-name: mirrors
+    meta.helm.sh/release-namespace: nginx
+  labels:
+    app.kubernetes.io/instance: mirrors
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: nginx
+    app.kubernetes.io/version: 1.16.0
+    helm.sh/chart: nginx-0.1.0
+  name: mirrors-nginx
+  namespace: nginx
+spec:
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+  - IPv4
+  ipFamilyPolicy: SingleStack
+  ports:
+  - name: http
+    port: 80
+    protocol: TCP
+    targetPort: http
+  selector:
+    app.kubernetes.io/instance: mirrors
+    app.kubernetes.io/name: nginx
+  sessionAffinity: None
+  type: ClusterIP
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/instance: mirrors
+    app.kubernetes.io/name: nginx
+  name: mirrors-nginx
+  namespace: nginx
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: mirrors
+      app.kubernetes.io/name: nginx
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/instance: mirrors
+        app.kubernetes.io/name: nginx
+    spec:
+      containers:
+      - image: nginx:latest
+        imagePullPolicy: Always
+        name: nginx
+        ports:
+        - containerPort: 80
+          name: http
+          protocol: TCP
+        resources: {}
+        securityContext: {}
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /etc/nginx/
+          name: nginx-config
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - configMap:
+          defaultMode: 420
+          name: nginx-config
+        name: nginx-config
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nginx-config
+  namespace: nginx
+data:
+  nginx.conf: |
+    user  nginx;
+    worker_processes  auto;
+    error_log  /var/log/nginx/error.log notice;
+    pid        /var/run/nginx.pid;
+    events {
+      worker_connections  1024;
+    }
+    http {
+      server {
+        listen 80;
+        server_name mirrors.onwalk.net;
+        autoindex on;
+        index index.html index.htm index.nginx-debian.html;
+        location / {
+          proxy_set_header       Host nginx-s3.oss-cn-shanghai.aliyuncs.com;
+          proxy_pass             http://nginx-s3.oss-cn-shanghai.aliyuncs.com;
+        }
+      }
+    }
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  generation: 2
+  labels:
+    app.kubernetes.io/instance: mirrors
+    app.kubernetes.io/name: nginx
+  name: mirrors-nginx
+  namespace: nginx
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: mirrors.onwalk.net
+    http:
+      paths:
+      - backend:
+          service:
+            name: mirrors-nginx
+            port:
+              number: 80
+        path: /
+        pathType: ImplementationSpecific
+  tls:
+  - hosts:
+    - mirrors.onwalk.net
+    secretName: nginx-tls