實戰 GitOps：使用 k3s、ArgoCD 與 GitHub Actions 部署私有 Python 服務#

1
my-python-service/
2
├── app.py
3
├── requirements.txt
4
├── Dockerfile
5
└── k8s/
6
    ├── deployment.yaml
7
    └── service.yaml

1
from flask import Flask
2
import os
3

4
app = Flask(__name__)
5

6
@app.route('/')
7
def hello():
8
    version = os.environ.get('VERSION', 'v1')
9
    return f"Hello from Private Python Service! Version: {version}\n"
10

11
if __name__ == '__main__':
12
    app.run(host='0.0.0.0', port=5000)

1
flask

1
FROM python:3.9-slim
2

3
WORKDIR /app
4
COPY requirements.txt .
5
RUN pip install -r requirements.txt
6
COPY app.py .
7

8
CMD ["python", "app.py"]

1
apiVersion: apps/v1
2
kind: Deployment
3
metadata:
4
  name: python-private-service
5
  namespace: default
6
spec:
7
  replicas: 1
8
  selector:
9
    matchLabels:
10
      app: python-private
11
  template:
12
    metadata:
13
      labels:
14
        app: python-private
15
    spec:
16
      containers:
17
      - name: app
18
        image: ghcr.io/<YOUR_GITHUB_USER>/python-private-service:latest
19
        ports:
20
        - containerPort: 5000
21
        env:
22
        - name: VERSION
23
          value: "v1"

1
apiVersion: v1
2
kind: Service
3
metadata:
4
  name: python-private-service
5
  namespace: default
6
spec:
7
  selector:
8
    app: python-private
9
  ports:
10
    - protocol: TCP
11
      port: 80
12
      targetPort: 5000
13
  type: ClusterIP  # 關鍵：ClusterIP 確保不對外公開 IP

1
    spec:
2
      imagePullSecrets:
3
      - name: ghcr-secret
4
      containers:
5
      ...

1
name: CI/CD Pipeline
2

3
on:
4
  push:
5
    branches: [ "main" ]
6
    paths-ignore:
7
      - 'k8s/**'  # 避免修改 k8s yaml 後再次觸發 CI 造成無限迴圈
8

9
env:
10
  REGISTRY: ghcr.io
11
  IMAGE_NAME: ${{ github.repository }}
12

13
jobs:
14
  build-and-push:
15
    runs-on: ubuntu-latest
16
    permissions:
17
      contents: write # 需要寫入權限來更新 manifest
18
      packages: write
19

20
    steps:
21
      - name: Checkout repository
22
        uses: actions/checkout@v3
23

24
      - name: Log in to the Container registry
25
        uses: docker/login-action@v2
26
        with:
27
          registry: ${{ env.REGISTRY }}
28
          username: ${{ github.actor }}
29
          password: ${{ secrets.GITHUB_TOKEN }}
30

31
      - name: Build and push Docker image
32
        uses: docker/build-push-action@v4
33
        with:
34
          context: .
35
          push: true
36
          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
37

38
      - name: Update Kubernetes Manifest
39
        run: |
40
          # 設定 Git 使用者 (用於 commit)
41
          git config --global user.name "GitHub Actions"
42
          git config --global user.email "actions@github.com"
43

44
          # 更新 deployment.yaml 中的 image tag
45
          # 這裡使用 sed 來替換 image 欄位
46
          sed -i "s|image: .*|image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}|g" k8s/deployment.yaml
47

48
          # 提交變更
49
          git add k8s/deployment.yaml
50
          git commit -m "chore: update image tag to ${{ github.sha }}"
51
          git push

1
Hello from Private Python Service! Version: v1