From e2f9c2e6398389b8efec6d36fbb3947031a2f129 Mon Sep 17 00:00:00 2001 From: Haitao Pan Date: Thu, 11 May 2023 17:15:10 +0800 Subject: [PATCH] nginx-oss: add role, job, ci_pipeline --- .../setup-nginx-oss-with-existed-vhost.yml | 51 +++++++ playbook/jobs/init_nginx_oss | 18 +++ playbook/roles/nginx-oss/tasks/main.yml | 11 ++ playbook/roles/nginx-oss/templates/.gitignore | 2 + .../nginx-oss/templates/mirrors-nginx.yaml | 137 ++++++++++++++++++ 5 files changed, 219 insertions(+) create mode 100644 .github/workflows/setup-nginx-oss-with-existed-vhost.yml create mode 100644 playbook/jobs/init_nginx_oss create mode 100755 playbook/roles/nginx-oss/tasks/main.yml create mode 100644 playbook/roles/nginx-oss/templates/.gitignore create mode 100644 playbook/roles/nginx-oss/templates/mirrors-nginx.yaml diff --git a/.github/workflows/setup-nginx-oss-with-existed-vhost.yml b/.github/workflows/setup-nginx-oss-with-existed-vhost.yml new file mode 100644 index 00000000..c0de8e79 --- /dev/null +++ b/.github/workflows/setup-nginx-oss-with-existed-vhost.yml @@ -0,0 +1,51 @@ +name: setup nginx-oss with existed vhost + +on: + workflow_dispatch: + branches: [ 'main' ] + +env: + DNS_AK: ${{ secrets.DNS_AK }} + DNS_SK: ${{ secrets.DNS_SK }} + SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }} + +defaults: + run: + working-directory: ./playbook + +jobs: + k3s-cluster: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v3 + + - name: run playbook + shell: bash + run: | + export ANSIBLE_HOST_KEY_CHECKING=False + sudo apt install jq ansible -y + + mkdir -pv ~/.ssh/ + cat > ~/.ssh/id_rsa << EOF + ${SSH_PRIVATE_KEY} + EOF + sudo chmod 0400 ~/.ssh/id_rsa + md5sum ~/.ssh/id_rsa + + mkdir -pv hosts/ + cat > hosts/inventory << EOF + [master] + vpn.onwalk.net ansible_host=43.206.90.100 + + [all:vars] + ansible_port=22 + ansible_ssh_user=ubuntu + ansible_ssh_private_key_file=~/.ssh/id_rsa + ansible_host_key_checking=False + dns_ak=$DNS_AK + dns_sk=$DNS_SK + ingress_ip=43.206.90.100 + EOF + #ansible-playbook -i hosts/inventory jobs/init_k3s_cluster -D + ansible-playbook -i hosts/inventory jobs/init_nginx_oss -D diff --git a/playbook/jobs/init_nginx_oss b/playbook/jobs/init_nginx_oss new file mode 100644 index 00000000..15d1d035 --- /dev/null +++ b/playbook/jobs/init_nginx_oss @@ -0,0 +1,18 @@ +- name: setup nginx-oss + hosts: all + user: root + become: yes + gather_facts: yes + tasks: + - include_role: + name: nginx-oss + vars: + group: master + namespace: nginx + domain: onwalk.net + auto_issuance: true + update_secret: true + tls: + - secret_name: nginx-tls + keyfile: /etc/sl/onwalk.net.key + certfile: /etc.ssl/onwalk.net.pem diff --git a/playbook/roles/nginx-oss/tasks/main.yml b/playbook/roles/nginx-oss/tasks/main.yml new file mode 100755 index 00000000..25867ef1 --- /dev/null +++ b/playbook/roles/nginx-oss/tasks/main.yml @@ -0,0 +1,11 @@ +- name: Prep NameSpace + shell: "kubectl create namespace nginx || echo true" + +- name: Sync deploy yaml + template: src=templates/{{ item }} dest=/tmp/{{ item }} owner=root group=root mode=0644 force=yes unsafe_writes=yes + with_items: + - mirrors-nginx.yaml + +- name: Setup Mirrors Server + shell: "kubectl apply -f /tmp/mirrors-nginx.yaml" + when: inventory_hostname in groups[group] diff --git a/playbook/roles/nginx-oss/templates/.gitignore b/playbook/roles/nginx-oss/templates/.gitignore new file mode 100644 index 00000000..a194b200 --- /dev/null +++ b/playbook/roles/nginx-oss/templates/.gitignore @@ -0,0 +1,2 @@ +/clickhouse-keeper-k8s.iml +/.idea/ diff --git a/playbook/roles/nginx-oss/templates/mirrors-nginx.yaml b/playbook/roles/nginx-oss/templates/mirrors-nginx.yaml new file mode 100644 index 00000000..84a39d18 --- /dev/null +++ b/playbook/roles/nginx-oss/templates/mirrors-nginx.yaml @@ -0,0 +1,137 @@ +apiVersion: v1 +kind: Service +metadata: + annotations: + meta.helm.sh/release-name: mirrors + meta.helm.sh/release-namespace: nginx + labels: + app.kubernetes.io/instance: mirrors + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: nginx + app.kubernetes.io/version: 1.16.0 + helm.sh/chart: nginx-0.1.0 + name: mirrors-nginx + namespace: nginx +spec: + internalTrafficPolicy: Cluster + ipFamilies: + - IPv4 + ipFamilyPolicy: SingleStack + ports: + - name: http + port: 80 + protocol: TCP + targetPort: http + selector: + app.kubernetes.io/instance: mirrors + app.kubernetes.io/name: nginx + sessionAffinity: None + type: ClusterIP +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/instance: mirrors + app.kubernetes.io/name: nginx + name: mirrors-nginx + namespace: nginx +spec: + progressDeadlineSeconds: 600 + replicas: 1 + revisionHistoryLimit: 10 + selector: + matchLabels: + app.kubernetes.io/instance: mirrors + app.kubernetes.io/name: nginx + strategy: + rollingUpdate: + maxSurge: 25% + maxUnavailable: 25% + type: RollingUpdate + template: + metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: mirrors + app.kubernetes.io/name: nginx + spec: + containers: + - image: nginx:latest + imagePullPolicy: Always + name: nginx + ports: + - containerPort: 80 + name: http + protocol: TCP + resources: {} + securityContext: {} + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + volumeMounts: + - mountPath: /etc/nginx/ + name: nginx-config + dnsPolicy: ClusterFirst + restartPolicy: Always + schedulerName: default-scheduler + securityContext: {} + terminationGracePeriodSeconds: 30 + volumes: + - configMap: + defaultMode: 420 + name: nginx-config + name: nginx-config +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: nginx-config + namespace: nginx +data: + nginx.conf: | + user nginx; + worker_processes auto; + error_log /var/log/nginx/error.log notice; + pid /var/run/nginx.pid; + events { + worker_connections 1024; + } + http { + server { + listen 80; + server_name mirrors.onwalk.net; + autoindex on; + index index.html index.htm index.nginx-debian.html; + location / { + proxy_set_header Host nginx-s3.oss-cn-shanghai.aliyuncs.com; + proxy_pass http://nginx-s3.oss-cn-shanghai.aliyuncs.com; + } + } + } +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + generation: 2 + labels: + app.kubernetes.io/instance: mirrors + app.kubernetes.io/name: nginx + name: mirrors-nginx + namespace: nginx +spec: + ingressClassName: nginx + rules: + - host: mirrors.onwalk.net + http: + paths: + - backend: + service: + name: mirrors-nginx + port: + number: 80 + path: / + pathType: ImplementationSpecific + tls: + - hosts: + - mirrors.onwalk.net + secretName: nginx-tls