gateway(nginx) + manager(python 標準ライブラリ) + セッションごとの使い捨て Pod + reaper CronJob の構成。ブラウザ(PC/スマホ)からアクセスし、セッション単位で 独立した Alpine コンテナに Git リポジトリ(GitHub/Gitea など)をチェックアウトして 編集・検証・プッシュする。無操作が続いたセッションは Pod ごと自動破棄。 - セキュリティ: セッション NS 分離 / restricted PodSecurity / RBAC はセッション NS の pods,services のみの Role / セッション Pod は SA トークン非マウント・非 root・ readOnlyRootFilesystem・drop ALL caps・seccomp / NetworkPolicy で egress を DNS+HTTPS+SSH に限定 / Git ホスト allow-list / ResourceQuota+LimitRange - ライフサイクル: idleTimeout(Pod 内ウォッチドッグ + manager 回収) / maxLifetime (activeDeadlineSeconds) / maxSessions / 予備の孤児掃除 CronJob - 認証: token(既定) / basic / forward(外部SSO) / none。WebSocket は Cookie トークン - Claude 認証: ANTHROPIC_API_KEY または CLAUDE_CODE_OAUTH_TOKEN - CI: helm-release.yaml(未リリース版のみ tag+release+publish) / image-update-and-release.yaml(週次 npm 追従) / session-image.yaml(multi-arch build) - files/ 実体を .Files.Get で ConfigMap 化。helm lint / template 検証済み
132 lines
5.2 KiB
YAML
132 lines
5.2 KiB
YAML
# .gitea/workflows/helm-release.yaml
|
|
# プロジェクトへの変更(main への push)時に実行。
|
|
# Chart.yaml の version が「まだリリースされていない」場合のみ、
|
|
# タグ作成 → Gitea リリース → Helm チャート publish を行う。
|
|
# 既にリリース済みのバージョンなら lint のみで終了する(再 publish しない)。
|
|
|
|
name: Helm Chart Release
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- master
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
REGISTRY_URL: https://git.cafepieters.com
|
|
OWNER: helmchart
|
|
|
|
jobs:
|
|
release-chart:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v3
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Install Helm
|
|
uses: azure/setup-helm@v3
|
|
with:
|
|
version: 'v3.16.4'
|
|
|
|
- name: Ensure jq
|
|
run: command -v jq >/dev/null 2>&1 || (sudo apt-get update -qq && sudo apt-get install -y -qq jq)
|
|
|
|
- name: Get chart info
|
|
id: info
|
|
run: |
|
|
set -e
|
|
CHART_NAME=$(grep '^name:' Chart.yaml | awk '{print $2}')
|
|
CHART_VERSION=$(grep '^version:' Chart.yaml | awk '{print $2}' | tr -d '"')
|
|
echo "name=${CHART_NAME}" >> $GITHUB_OUTPUT
|
|
echo "version=${CHART_VERSION}" >> $GITHUB_OUTPUT
|
|
echo "Chart: ${CHART_NAME} ${CHART_VERSION}"
|
|
|
|
- name: Lint
|
|
run: helm lint .
|
|
|
|
- name: Check whether this version is already released
|
|
id: check
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
run: |
|
|
set -e
|
|
V="v${{ steps.info.outputs.version }}"
|
|
# 1) Gitea リリースの有無
|
|
REL_ID=$(curl -s -H "Authorization: token ${GITEA_TOKEN}" \
|
|
"${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/tags/${V}" | jq -r '.id // empty')
|
|
# 2) Package Registry 上の有無
|
|
PKG_HTTP=$(curl -s -o /dev/null -w '%{http_code}' \
|
|
-u "${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_TOKEN }}" \
|
|
"${REGISTRY_URL}/api/packages/${OWNER}/helm/${{ steps.info.outputs.name }}/${{ steps.info.outputs.version }}")
|
|
|
|
if [ -n "$REL_ID" ] || [ "$PKG_HTTP" = "200" ]; then
|
|
echo "release_needed=false" >> $GITHUB_OUTPUT
|
|
echo "既に ${V} はリリース済み(release_id=${REL_ID:-none}, pkg_http=${PKG_HTTP})。publish をスキップします。"
|
|
else
|
|
echo "release_needed=true" >> $GITHUB_OUTPUT
|
|
echo "${V} は未リリース。リリースを実行します。"
|
|
fi
|
|
|
|
- name: Package
|
|
if: steps.check.outputs.release_needed == 'true'
|
|
run: |
|
|
set -e
|
|
helm package .
|
|
echo "CHART_FILE=$(ls ${{ steps.info.outputs.name }}-*.tgz)" >> $GITHUB_ENV
|
|
|
|
- name: Create Git tag
|
|
if: steps.check.outputs.release_needed == 'true'
|
|
run: |
|
|
set -e
|
|
git config user.name "Claude"
|
|
git config user.email "claude@cafepieters.com"
|
|
V="v${{ steps.info.outputs.version }}"
|
|
if git rev-parse "$V" >/dev/null 2>&1; then
|
|
echo "tag $V exists, skip"
|
|
else
|
|
git tag -a "$V" -m "Release $V"
|
|
git push origin "$V"
|
|
fi
|
|
|
|
- name: Create Gitea release
|
|
if: steps.check.outputs.release_needed == 'true'
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
run: |
|
|
set -e
|
|
V="v${{ steps.info.outputs.version }}"
|
|
BODY="${{ steps.info.outputs.name }} Helm Chart ${V}"
|
|
RID=$(curl -s -X POST -H "Authorization: token ${GITEA_TOKEN}" -H "Content-Type: application/json" \
|
|
-d "{\"tag_name\":\"${V}\",\"name\":\"${V}\",\"body\":\"${BODY}\"}" \
|
|
"${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases" | jq -r '.id // empty')
|
|
if [ -z "$RID" ]; then
|
|
RID=$(curl -s -H "Authorization: token ${GITEA_TOKEN}" \
|
|
"${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/tags/${V}" | jq -r '.id // empty')
|
|
fi
|
|
curl --fail-with-body -X POST -H "Authorization: token ${GITEA_TOKEN}" \
|
|
-H "Content-Type: application/gzip" --data-binary "@${CHART_FILE}" \
|
|
"${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/${RID}/assets?name=${CHART_FILE}"
|
|
echo "Gitea release ${V} 作成完了"
|
|
|
|
- name: Publish to Gitea Package Registry
|
|
if: steps.check.outputs.release_needed == 'true'
|
|
run: |
|
|
set -e
|
|
curl --fail-with-body -u "${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_TOKEN }}" \
|
|
-X POST --upload-file "${CHART_FILE}" \
|
|
"${REGISTRY_URL}/api/packages/${OWNER}/helm/api/charts"
|
|
echo "✅ ${CHART_FILE} を publish しました"
|
|
|
|
- name: Summary
|
|
if: always()
|
|
run: |
|
|
echo "================================"
|
|
echo "Chart : ${{ steps.info.outputs.name }} ${{ steps.info.outputs.version }}"
|
|
echo "Released : ${{ steps.check.outputs.release_needed }}"
|
|
echo "================================"
|
|
echo "helm repo add cafepieters ${REGISTRY_URL}/api/packages/${OWNER}/helm"
|
|
echo "helm repo update && helm install my-${{ steps.info.outputs.name }} cafepieters/${{ steps.info.outputs.name }}"
|