基于Gitee的Kubernetes持续交付流水线构建指南

核心架构

graph LR
A[Gitee代码仓] -->|Webhook触发| B(CI/CD工具)
B --> C{流水线阶段}
C --> D[代码构建]
C --> E[镜像打包]
C --> F[K8s部署]
F --> G[生产集群]

关键步骤实现

1. Gitee Webhook配置

   • 在Gitee仓库设置中创建Webhook，指向CI/CD工具（如Jenkins/GitLab CI）
   • 触发事件：Push Events + Merge Requests

2. CI/CD流水线定义（Jenkinsfile示例）

pipeline {
    agent any
    stages {
        stage('Build') {
            steps {
                sh 'mvn clean package'  // Java示例
            }
        }
        stage('Docker Build') {
            steps {
                script {
                    docker.build("registry.cn-hangzhou.aliyuncs.com/myapp:${env.BUILD_ID}")
                }
            }
        }
        stage('K8s Deploy') {
            steps {
                sh 'kubectl apply -f k8s/deployment.yaml --namespace=prod'
            }
        }
    }
}

1. Kubernetes部署清单

# deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
      - name: app
        image: registry.cn-hangzhou.aliyuncs.com/myapp:$IMAGE_TAG  # 由CI注入
        ports:
        - containerPort: 8080
---
# service.yaml
apiVersion: v1
kind: Service
metadata:
  name: myapp-service
spec:
  selector:
    app: myapp
  ports:
    - protocol: TCP
      port: 80
      targetPort: 8080
  type: LoadBalancer

关键优化点

1. 镜像安全扫描

   # 在Docker Build阶段添加
   trivy image --exit-code 1 registry.cn-hangzhou.aliyuncs.com/myapp:$TAG
   

2. 金丝雀发布策略

   # 使用K8s原生Canary
   spec:
     strategy:
       canary:
         steps:
         - setWeight: 20
         - pause: {duration: 1h}
   

3. HPA自动扩缩容

   apiVersion: autoscaling/v2
   kind: HorizontalPodAutoscaler
   spec:
     metrics:
     - type: Resource
       resource:
         name: cpu
         target:
           type: Utilization
           averageUtilization: 60
   

监控体系集成

• 日志收集：Fluentd + Elasticsearch
• 指标监控：Prometheus + Grafana
• 告警规则示例：

  sum(rate(container_cpu_usage_seconds_total{namespace="prod"}[5m])) > 0.8
  

最佳实践：

1. 使用$环境变量分离不同环境配置
2. 通过Kustomize管理多环境部署
3. 在Gitee MR流程中强制要求SonarQube质量门禁
4. 定期清理旧镜像：kubectl exec registry-pod -- garbage-collect /etc/docker/registry/config.yml