Александр Зимин
2fb39f7ac5
Single registry for all clusters — staging (161), prod (142), local dev. - Removed registry.k8s.265.nstart.local (no longer needed) - Removed --insecure-registry flag from DinD service - Wait-loop for DinD readiness before docker login (fixes race that caused 'Cannot connect to the Docker daemon' on first build command) - Inlined docker login into the publish_script (kept tied to the build, not a separate before_script that ran before DinD was ready)
154 lines
4.5 KiB
YAML
154 lines
4.5 KiB
YAML
# =============================================================
|
|
# Ordinis — build & push images.
|
|
# Runner mirror'ит Docker Hub (DOCKER_AUTH_CONFIG в runner config),
|
|
# поэтому image: repo.nstart.cloud/library/maven:... работает напрямую.
|
|
# Все образы пушатся в repo.nstart.cloud/terravault/ — единый registry
|
|
# для всех кластеров (staging 161, prod 142, локальный dev).
|
|
# =============================================================
|
|
|
|
stages:
|
|
- test
|
|
- build
|
|
- publish
|
|
- trigger-deploy
|
|
|
|
variables:
|
|
MAVEN_OPTS: "-Dmaven.repo.local=$CI_PROJECT_DIR/.m2/repository -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn"
|
|
MAVEN_CLI_OPTS: "-B -ntp --batch-mode"
|
|
IMAGE_TAG: $CI_COMMIT_REF_SLUG-$CI_COMMIT_SHORT_SHA
|
|
REGISTRY: repo.nstart.cloud
|
|
IMAGE_REPO: terravault
|
|
DOCKER_BUILDKIT: "1"
|
|
|
|
cache:
|
|
key:
|
|
files: ["pom.xml"]
|
|
paths:
|
|
- .m2/repository
|
|
|
|
# Default retry для всех jobs — runner image pull mirror flaky
|
|
default:
|
|
retry:
|
|
max: 2
|
|
when:
|
|
- runner_system_failure
|
|
- stuck_or_timeout_failure
|
|
- script_failure
|
|
|
|
# ─── TEST ──────────────────────────────────────
|
|
maven-test:
|
|
stage: test
|
|
image: repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21
|
|
script:
|
|
- mvn $MAVEN_CLI_OPTS verify
|
|
artifacts:
|
|
when: always
|
|
reports:
|
|
junit: '**/target/surefire-reports/TEST-*.xml'
|
|
expire_in: 1 week
|
|
|
|
# ─── BUILD (Maven jars) ────────────────────────
|
|
maven-package:
|
|
stage: build
|
|
image: repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21
|
|
script:
|
|
- mvn $MAVEN_CLI_OPTS package -DskipTests
|
|
artifacts:
|
|
paths:
|
|
- "**/target/*.jar"
|
|
- ordinis-migrations/src/main/resources/db/changelog/**
|
|
expire_in: 1 day
|
|
|
|
# ─── PUBLISH (Docker images) ───────────────────
|
|
.docker_base: &docker_base
|
|
stage: publish
|
|
image: repo.nstart.cloud/library/docker:26
|
|
services:
|
|
- name: repo.nstart.cloud/library/docker:26-dind
|
|
alias: docker
|
|
command: ["--tls=false"]
|
|
variables:
|
|
DOCKER_HOST: tcp://docker:2375
|
|
DOCKER_TLS_CERTDIR: ""
|
|
DOCKER_BUILDKIT: "1"
|
|
|
|
# Build & push в repo.nstart.cloud (corp Harbor) — единый registry для всех окружений.
|
|
# DinD должен быть готов когда запускается script. Wait-loop защищает от race.
|
|
.publish_script: &publish_script |
|
|
for i in $(seq 1 30); do docker info >/dev/null 2>&1 && break; sleep 1; done
|
|
echo "$REGISTRY_PASSWORD" | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
|
|
IMG="$REGISTRY/$IMAGE_REPO/$SVC"
|
|
docker build -f "$DOCKERFILE" \
|
|
-t "$IMG:$IMAGE_TAG" -t "$IMG:latest" -t "$IMG:$CI_COMMIT_REF_SLUG" \
|
|
--build-arg BUILDKIT_INLINE_CACHE=1 \
|
|
"$BUILD_CONTEXT"
|
|
docker push "$IMG:$IMAGE_TAG"
|
|
docker push "$IMG:latest"
|
|
docker push "$IMG:$CI_COMMIT_REF_SLUG"
|
|
|
|
docker-app:
|
|
<<: *docker_base
|
|
needs: [maven-package]
|
|
variables:
|
|
SVC: ordinis-app
|
|
DOCKERFILE: ordinis-app/Dockerfile
|
|
BUILD_CONTEXT: .
|
|
script:
|
|
- *publish_script
|
|
|
|
docker-read-api:
|
|
<<: *docker_base
|
|
needs: [maven-package]
|
|
variables:
|
|
SVC: ordinis-read-api
|
|
DOCKERFILE: ordinis-read-api/Dockerfile
|
|
BUILD_CONTEXT: .
|
|
script:
|
|
- *publish_script
|
|
|
|
docker-projection-writer:
|
|
<<: *docker_base
|
|
needs: [maven-package]
|
|
variables:
|
|
SVC: ordinis-projection-writer
|
|
DOCKERFILE: ordinis-projection-writer/Dockerfile
|
|
BUILD_CONTEXT: .
|
|
script:
|
|
- *publish_script
|
|
|
|
docker-migrations:
|
|
<<: *docker_base
|
|
needs: [maven-package]
|
|
variables:
|
|
SVC: ordinis-migrations
|
|
DOCKERFILE: ordinis-migrations/Dockerfile
|
|
BUILD_CONTEXT: ordinis-migrations/
|
|
script:
|
|
- *publish_script
|
|
|
|
# ─── TRIGGER DEPLOY (downstream pipeline) ──────
|
|
trigger-deploy-staging:
|
|
stage: trigger-deploy
|
|
trigger:
|
|
project: 2-6/2-6-4/terravault/ordinis-infra
|
|
branch: main
|
|
strategy: depend
|
|
variables:
|
|
UPSTREAM_IMAGE_TAG: $IMAGE_TAG
|
|
DEPLOY_ENV: staging
|
|
rules:
|
|
- if: '$CI_COMMIT_BRANCH == "main"'
|
|
|
|
trigger-deploy-prod:
|
|
stage: trigger-deploy
|
|
trigger:
|
|
project: 2-6/2-6-4/terravault/ordinis-infra
|
|
branch: main
|
|
strategy: depend
|
|
variables:
|
|
UPSTREAM_IMAGE_TAG: $IMAGE_TAG
|
|
DEPLOY_ENV: prod
|
|
rules:
|
|
- if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+$/'
|
|
when: manual
|