云原生环境中的CI/CD最佳实践

键盘鼓手苏苏

1118人浏览 · 2026-04-16 11:23:44

键盘鼓手苏苏 · 2026-04-16 11:23:44 发布

云原生环境中的CI/CD最佳实践

🔥 硬核开场

各位技术老铁，今天咱们聊聊云原生环境中的CI/CD最佳实践。别跟我扯那些理论，直接上干货！在云原生时代，CI/CD已经成为企业级应用开发和部署的核心流程。不了解云原生环境中的CI/CD最佳实践？那你的开发效率可能会大打折扣，部署过程也会充满风险。

📋 核心概念

CI/CD的定义

CI/CD是持续集成（Continuous Integration）和持续部署（Continuous Deployment）的缩写，它是一种软件开发实践，通过自动化的构建、测试和部署流程，提高开发效率和代码质量。

云原生CI/CD的特点

容器化：使用容器作为构建和部署的基本单位
自动化：通过自动化脚本和工具实现全流程自动化
可扩展性：支持大规模、分布式的构建和部署
弹性：根据需求自动调整资源
可观测性：提供详细的构建和部署日志

🚀 实践指南

1. Jenkins部署与配置

Jenkins安装

# 安装Jenkins
helm repo add jenkins https://charts.jenkins.io
helm repo update
helm install jenkins jenkins/jenkins --namespace jenkins --create-namespace

# 获取Jenkins密码
kubectl get secret -n jenkins jenkins -o jsonpath="{.data.jenkins-admin-password}" | base64 --decode

Jenkins流水线配置

pipeline {
    agent {
        kubernetes {
            yaml '''
apiVersion: v1
kind: Pod
spec:
  containers:
  - name: build
    image: node:14
    command:
    - cat
    tty: true
  - name: docker
    image: docker:19.03
    command:
    - cat
    tty: true
    volumeMounts:
    - name: docker-socket
      mountPath: /var/run/docker.sock
  volumes:
  - name: docker-socket
    hostPath:
      path: /var/run/docker.sock
'''
        }
    }
    stages {
        stage('Build') {
            steps {
                container('build') {
                    sh 'npm install'
                    sh 'npm run build'
                }
            }
        }
        stage('Test') {
            steps {
                container('build') {
                    sh 'npm run test'
                }
            }
        }
        stage('Deploy') {
            steps {
                container('docker') {
                    sh 'docker build -t my-app:latest .'
                    sh 'docker push my-app:latest'
                    sh 'kubectl apply -f deployment.yaml'
                }
            }
        }
    }
}

2. GitLab CI/CD配置

GitLab CI/CD配置文件

stages:
  - build
  - test
  - deploy

variables:
  DOCKER_DRIVER: overlay2
  DOCKER_TLS_CERTDIR: ""

build:
  stage: build
  image: node:14
  script:
    - npm install
    - npm run build
  artifacts:
    paths:
      - dist/

 test:
  stage: test
  image: node:14
  script:
    - npm install
    - npm run test

deploy:
  stage: deploy
  image: docker:19.03
  services:
    - docker:dind
  script:
    - docker build -t my-app:latest .
    - docker push my-app:latest
    - kubectl apply -f deployment.yaml
  only:
    - master

3. GitHub Actions配置

GitHub Actions工作流配置

name: CI/CD Pipeline

on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
    - name: Set up Node.js
      uses: actions/setup-node@v2
      with:
        node-version: '14'
    - name: Install dependencies
      run: npm install
    - name: Build
      run: npm run build
    - name: Test
      run: npm run test
    - name: Build and push Docker image
      uses: docker/build-push-action@v2
      with:
        context: .
        push: true
        tags: my-app:latest
    - name: Deploy to Kubernetes
      uses: steebchen/kubectl@v2.0.0
      with:
        config: ${{ secrets.KUBE_CONFIG }}
        command: apply -f deployment.yaml

4. Argo CD部署与配置

Argo CD安装

# 安装Argo CD
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# 获取Argo CD密码
kubectl get secret -n argocd argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 --decode

Argo CD应用配置

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/my-org/my-app.git
    targetRevision: HEAD
    path: k8s
  destination:
    server: https://kubernetes.default.svc
    namespace: default
  syncPolicy:
    automated:
      selfHeal: true
      prune: true

5. 镜像仓库管理

Harbor部署

# 安装Harbor
helm repo add harbor https://helm.goharbor.io
helm repo update
helm install harbor harbor/harbor --namespace harbor --create-namespace

镜像扫描配置

apiVersion: v1
kind: ConfigMap
metadata:
  name: harbor-scan-config
  namespace: harbor
data:
  scan.yaml: |
    version: 1.0
    scan:
      scheduled:
        enabled: true
        cron: "0 0 * * *"
      vulnerability:
        enabled: true
        severity:
          - critical
          - high