# 2. 工具部署
# 安装Argo CD
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# 3. 仓库配置
# 创建配置仓库
git init my-cluster-config
cd my-cluster-config

# 4. 应用配置
# 创建应用配置文件
kubectl create -f application.yaml

# 5. 部署应用
# 提交配置到Git仓库
git add .
git commit -m “Add application configuration”
git push origin main

# 6. 验证部署
# 访问Argo CD UI
# 查看应用状态

# 7. 应用效果
# 自动化部署
# 配置一致性
# 快速回滚
# 详细的变更历史

# 部署脚本
cat > gitops-kubernetes.sh << 'EOF' #!/bin/bash # daily_check.sh # from:www.itpux.com.qq113257174.wx:itpux-com # web: `http://www.fgedu.net.cn` # 安装Argo CD kubectl create namespace argocd kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml # 等待Argo CD就绪 kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=argocd-server -n argocd # 暴露Argo CD服务 kubectl patch svc argocd-server -n argocd -p '{"spec": {"type": "LoadBalancer"}}' # 获取初始密码 echo "Argo CD初始密码: $(kubectl get secret argocd-initial-admin-secret -n argocd -o jsonpath="{.data.password}" | base64 -d)" EOF # 运行部署脚本 bash gitops-kubernetes.sh

# 2. 仓库配置
# 创建配置仓库
git init my-multi-env-config
cd my-multi-env-config

# 3. 目录结构
mkdir -p config/base
mkdir -p config/overlays/development
mkdir -p config/overlays/staging
mkdir -p config/overlays/production

# 4. 基础配置
# 创建基础部署配置
cat > config/base/deployment.yaml << 'EOF' apiVersion: apps/v1 kind: Deployment metadata: name: my-app labels: app: my-app spec: replicas: 2 selector: matchLabels: app: my-app template: metadata: labels: app: my-app spec: containers: - name: my-app image: my-app:latest ports: - containerPort: 8080 EOF # 5. 环境特定配置 # 开发环境 cat > config/overlays/development/kustomization.yaml << 'EOF' apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization bases: - ../../base patches: - patch.yaml EOF cat > config/overlays/development/patch.yaml << 'EOF' apiVersion: apps/v1 kind: Deployment metadata: name: my-app spec: replicas: 1 template: spec: containers: - name: my-app image: my-app:dev EOF # 6. 应用配置 # 创建Argo CD应用 cat > applications.yaml << 'EOF' apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: my-app-dev namespace: argocd spec: project: default source: repoURL: https://github.com/my-org/my-multi-env-config.git targetRevision: main path: config/overlays/development destination: server: https://kubernetes.default.svc namespace: development syncPolicy: automated: prune: true selfHeal: true --- apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: my-app-staging namespace: argocd spec: project: default source: repoURL: https://github.com/my-org/my-multi-env-config.git targetRevision: main path: config/overlays/staging destination: server: https://kubernetes.default.svc namespace: staging syncPolicy: automated: prune: true selfHeal: true --- apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: my-app-prod namespace: argocd spec: project: default source: repoURL: https://github.com/my-org/my-multi-env-config.git targetRevision: main path: config/overlays/production destination: server: https://kubernetes.default.svc namespace: production syncPolicy: automated: prune: true selfHeal: true EOF # 7. 应用部署 kubectl apply -f applications.yaml # 8. 应用效果 # 多环境一致配置 # 自动化部署 # 环境间平滑升级 # 快速回滚能力 # 部署脚本 cat > gitops-multi-env.sh << 'EOF' #!/bin/bash # 创建命名空间 kubectl create namespace development kubectl create namespace staging kubectl create namespace production # 应用配置 kubectl apply -f applications.yaml # 验证部署 kubectl get applications -n argocd EOF # 运行部署脚本 bash gitops-multi-env.sh

# 2. 安全配置
# 代码安全检查
# 配置GitHub Actions工作流
cat > .github/workflows/security-scan.yml << 'EOF' name: Security Scan on: push: branches: [ main ] pull_request: branches: [ main ] jobs: security-scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 - name: Run Trivy vulnerability scanner uses: aquasecurity/trivy-action@master with: image-ref: 'my-app:latest' format: 'table' exit-code: '1' EOF # 3. 镜像安全扫描 # 配置镜像扫描 cat > .github/workflows/image-scan.yml << 'EOF' name: Image Scan on: push: branches: [ main ] jobs: image-scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 - name: Build and scan image run: | docker build -t my-app:latest . trivy image my-app:latest EOF # 4. 配置安全审计 # 使用Git Hooks cat > .git/hooks/pre-commit << 'EOF' #!/bin/bash # 检查配置文件中的敏感信息 grep -r "password\|secret\|token" --include="*.yaml" --include="*.yml" --include="*.json" . if [ $? -eq 0 ]; then echo "Error: Sensitive information found in configuration files" exit 1 fi EOF chmod +x .git/hooks/pre-commit # 5. 访问控制 # 配置Git仓库权限 # 配置Argo CD RBAC cat > argocd-rbac-cm.yaml << 'EOF' apiVersion: v1 kind: ConfigMap metadata: name: argocd-rbac-cm namespace: argocd data: policy.csv: | p, role:admin, applications, *, */*, allow p, role:developer, applications, sync, */*, allow p, role:developer, applications, get, */*, allow g, team-admin, role:admin g, team-dev, role:developer EOF kubectl apply -f argocd-rbac-cm.yaml # 6. 应用效果 # 代码安全检查 # 镜像安全扫描 # 配置安全审计 # 严格的访问控制 # 部署脚本 cat > gitops-security.sh << 'EOF' #!/bin/bash # 配置Git Hooks cp pre-commit .git/hooks/ chmod +x .git/hooks/pre-commit # 配置Argo CD RBAC kubectl apply -f argocd-rbac-cm.yaml # 配置GitHub Actions mkdir -p .github/workflows cp security-scan.yml .github/workflows/ cp image-scan.yml .github/workflows/ EOF # 运行部署脚本 bash gitops-security.sh