如何从 Gitlab 和 Helm 部署到 minikube答案

【问题标题】：How to deploy on minikube from Gitlab and Helm如何从 Gitlab 和 Helm 部署到 minikube
【发布时间】：2022-08-21 02:25:04
【问题描述】：

我正在尝试使用 gitlab-ci 管道在我的本地 minikube 上部署一个 java spring 项目.. 但我一直在

ERROR: Job failed (system failure): prepare environment: setting up credentials: secrets is forbidden: User \"system:serviceaccount:maverick:default\" cannot create resource \"secrets\" in API group \"\" in the namespace \"maverick\". Check https://docs.gitlab.com/runner/shells/index.html#shell-profile-loading for more information

我在 \"maverick\" 命名空间上安装了 gitlab-runner

apiVersion: v1
kind: ServiceAccount
metadata:
  name: gitlab-runner
  namespace: maverick
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: gitlab-runner
  namespace: maverick
rules:
  - apiGroups: [\"\"]
    resources: [\"pods\"]
    verbs: [\"list\", \"get\", \"watch\", \"create\", \"delete\"]
  - apiGroups: [\"\"]
    resources: [\"pods/exec\"]
    verbs: [\"create\"]
  - apiGroups: [\"\"]
    resources: [\"pods/log\"]
    verbs: [\"get\"]
  - apiGroups: [\"\"]
    resources: [\"pods/attach\"]
    verbs: [\"list\", \"get\", \"create\", \"delete\", \"update\"]
  - apiGroups: [\"\"]
    resources: [\"secrets\"]
    verbs: [\"list\", \"get\", \"create\", \"delete\", \"update\"]
  - apiGroups: [\"\"]
    resources: [\"configmaps\"]
    verbs: [\"list\", \"get\", \"watch\", \"create\", \"delete\"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: gitlab-runner
  namespace: maverick
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: maverick
subjects:
- namespace: maverick
  kind: ServiceAccount
  name: gitlab-runner

和价值观

gitlabUrl: https://gitlab.com/
runnerRegistrationToken: \".... my token .... \"

runners:
  privileged: false
  tags: k8s
  serviceAccountName: gitlab-runner

我的 gitlab-ci.yml 是这样的：

docker-build-job:
  stage: docker-build
  image: $MAVEN_IMAGE
  script:
    - mvn jib:build -Djib.to.image=${CI_REGISTRY_IMAGE}:latest -Djib.to.auth.username=${CI_REGISTRY_USER} -Djib.to.auth.password=${CI_REGISTRY_PASSWORD}

deploy-job:
  image: alpine/helm:3.2.1
  stage: deploy
  tags:
    - k8s
  script:
    - helm upgrade ${APP_NAME} ./charts --install --values=./charts/values.yaml --namespace ${APP_NAME}
  rules:
    - if: $CI_COMMIT_BRANCH == \'master\'
      when: always

图表文件夹中的 deployment.yaml 如下所示：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: maverick
  namespace: maverick
spec:
  replicas: 1
  selector:
    matchLabels:
      app: maverick
  template:
    metadata:
      labels:
        app: maverick
    spec:
      containers:
        - name: maverick
          image: registry.gitlab.com/gfalco77/maverick:latest
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8001
      imagePullSecrets:
        - name: registry-credentials
---
apiVersion: v1
kind: Service
metadata:
  name: maverick
spec:
  ports:
    - name: maverick
      port: 8001
      targetPort: 8001
      protocol: TCP
  selector:
    app: maverick

还有一个我根据https://chris-vermeulen.com/using-gitlab-registry-with-kubernetes/ 创建的注册表凭据，它们安装在特立独行的命名空间中

apiVersion: v1
kind: Secret
metadata:
  name: registry-credentials
  namespace: maverick
type: kubernetes.io/dockerconfigjson
data:
  .dockerconfigjson: .. base64 creds ..

我可以看到 gitlab-runner 对 apigroup \\"\\" 具有创建权限。但它似乎仍然无法从注册表中下载图像，不知道出了什么问题？

提前致谢

我很困惑——“本地”是指 minikube 部署在您的笔记本电脑/台式机上运行，而不是在服务器上？这看起来 GitLab 无法通过主机进行身份验证，这完全有道理——GitLab 无法将某些东西部署到您的笔记本电脑上。也许我遗漏了一些东西，或者你已经从构建中排除了一堆配置？
或者 GitLab runner 是否安装在同一个 minikube 部署中？
是的，它是我笔记本电脑上的本地 minikube .. Gitlab-runner 安装在特立独行的命名空间中，它在 Gitlab.com 中可见，所以我认为它可以在本地部署！？除非这是不可能的，否则我该怎么做？
我的意思是，当我在笔记本电脑上运行 minikube start 时，我可以在 Settings/Runners 中看到已注册的 gitlab-runner，它安装在 minikube 上。我认为它应该能够从容器注册表中提取图像，或者不能！？
如果我运行 kubectl auth can-i get secret -n maverick --as=system:serviceaccount:maverick:default 我得到一个 NO

标签： kubernetes deployment gitlab-ci helm3

【解决方案1】：

问题解决了添加以下 ClusterRole 和 ClusterRoleBinding，尤其是第二个名称为“default”的在此之后 gitlab 中的工作继续，然后尝试使用用户 system:serviceaccount:maverick:gitlab-runner ，但它在我需要弄清楚的其他事情上失败了

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cluster-admin
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["list", "get", "watch", "create", "delete"]
  - apiGroups: [""]
    resources: ["pods/exec"]
    verbs: ["create"]
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get"]
  - apiGroups: [""]
    resources: ["pods/attach"]
    verbs: ["list", "get", "create", "delete", "update"]
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["list", "watch", "get", "create", "delete", "update"]
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["list", "get", "watch", "create", "delete", "update"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cluster-admin-role
subjects:
  - kind: ServiceAccount
    name: gitlab-runner
    namespace: maverick
roleRef: # referring to your ClusterRole
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cluster-admin-role
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: default
    namespace: maverick

【讨论】：