k8s与CICD--利用flux部署应用到kubernetes

摘要：前言一直在思考部署应用到的姿势，之前介绍过，个人感觉把记录数据放到中不是特别好。可以帮助你安全地更新应用。部署到中注意事项由于需要从仓库中拉取代码，所以会有一个的问题。注意文件并没有一项。

一直在思考部署应用到k8s的姿势，之前介绍过helm，个人感觉helm把记录数据放到k8s中不是特别好。最近发现了weave的flux项目(A tool for deploying container images to Kubernetes services)。

先上图，大致看一下flux的理念。

1：flux可以和任意你喜欢的CI工具搭配比如：Drone,CircleCI,gitlabCI等。实际上flux做了CD的环节。

2：flux可以帮助你安全地更新应用。一般会遇到更新过程出错的问题，在flux实现中，每个部署的应用的yaml文件存储在git仓库里，所以每次更改都可以追踪，所以也能精确回滚到任何一个历史版本。这点我是觉得非常好的。当应用需要更新镜像的时候，有以下几个步骤：

Clone the repository

Find the deployment files that use the image in question (there may be more than one, since we have e.g., sidecar containers that use the same image)

Update a few fields in each file, in slightly different ways (e.g., put the image name in the template, and the tag part of the image name in a version label)

Commit and push the change back to Git

如果只是更新镜像，其实有更简单的操作：

$ fluxctl release --service=sock-shop/front-end --update-all-images
Submitting release job...
Release job submitted, ID cc08f78c-0e66-24a9-9215-82c80cc646c3
Status: Complete.
Here"s what happened:
1. Submitted job.
2. Calculating release actions.
3. Release latest images to sock-shop/front-end
4. Clone the config repo.
5. Clone OK.
6. Update 1 images(s) in the resource definition file for sock-shop/front-end: front-end (weaveworksdemos/front-end:0.2.0 -> weaveworksdemos/front-end:7f511af2d21fd601b86b3bed7baa6adfa9c8c669).
7. Update pod controller OK.
8. Commit and push the config repo.
9. Pushed commit: Release latest images to sock-shop/front-end
10. Regrade 1 service(s): sock-shop/front-end.
Took 55.810622454s

此处会引出和drone结合的想法。这一点在总结里会详细阐述。

3： flux很好解决了可视化的问题，通过几个指令就能清楚知道正在发生的。flux有controller的概念。

$ fluxctl list-services --namespace=sock-shop
SERVICE                 CONTAINER   IMAGE                           RELEASE  POLICY
sock-shop/cart          cart        weaveworksdemos/cart:0.3.0                   
sock-shop/cart-db       cart-db     mongo                                        
sock-shop/catalogue     catalogue   weaveworksdemos/catalogue:0.2.0              
sock-shop/catalogue-db  catalogue-db  weaveworksdemos/catalogue-db:0.2.0         
sock-shop/front-end     front-end   weaveworksdemos/front-end:0.2.0              
sock-shop/orders        orders      weaveworksdemos/orders:0.3.0                 
sock-shop/orders-db     orders-db   mongo                                        
sock-shop/payment       payment     weaveworksdemos/payment:0.3.0                
sock-shop/queue-master  queue-master  weaveworksdemos/queue-master:0.3.0         
sock-shop/rabbitmq      rabbitmq    rabbitmq:3                                   
sock-shop/shipping      shipping    weaveworksdemos/shipping:0.3.0               
sock-shop/user          user        weaveworksdemos/user:0.3.0                   
sock-shop/user-db       user-db     weaveworksdemos/user-db:0.3.0

$ fluxctl list-images --service=sock-shop/front-end
SERVICE             CONTAINER  IMAGE                                  CREATED
sock-shop/front-end  front-end  weaveworksdemos/front-end                    
                     |   7f511af2d21fd601b86b3bed7baa6adfa9c8c669  18 Nov 16 16:00 UTC
                     |   latest                                    18 Nov 16 16:00 UTC
                     |   snapshot                                  18 Nov 16 16:00 UTC
                     |   16007ffffdd86b2ebb41d8880c53b77580cab13f02  18 Nov 16 11:23 UTC
                     |   a0eaf8c8ffc0b81c2199adaf7d67466891bb3205  17 Nov 16 10:22 UTC
                     |   1b664cc81d9cf25b213000686a9e8d6477ae1b06  16 Nov 16 20:31 UTC
                     |   ce1efe59c32d3c53344defdda4d5b643272022b8  16 Nov 16 20:29 UTC
                     |   4c33b216ae902ad89b9c3ca30a99a44833d16d5b  10 Nov 16 21:34 UTC
                     |   7015587783bc8f7a9c3d5cfa51e5a257fe188c4b  10 Nov 16 11:34 UTC
                     |   4d3ea2896c81e40a630d36cdc29ce740e7617016  10 Nov 16 11:30 UTC
                     :                                           
                     "-> 0.2.0                                     09 Nov 16 10:26 UTC

4：flux实际上可以做到完全自动检测git仓库中yaml文件的变化以及registry中镜像的更新，进而自动部署。
It is most useful when used as a deployment tool at the end of a Continuous Delivery pipeline. Flux will make sure that your new container images and config changes are propagated to the cluster。
大意就是，利用flux作为cd pipeline中最后一个环节，可以很好地解决镜像更新或是yaml文件更新。

由于fluxd需要从git仓库中拉取代码，所以会有一个ssh key的问题。
注意flux-secret.yaml文件：

---
apiVersion: v1
kind: Secret
metadata:
  name: flux-git-deploy
type: Opaque

并没有data一项。实际上，flux默认会给我们生成一个key。

然后可以执行

$ fluxctl identity
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1fndADrb1fp6a+7QusXMU9qI2CNodLyMR82/6Li8rAstUCMRI9SjThAAbzyIfuCX61YCjWGj6qHyPusmfOssErbs7+rs6Q3y0RrACZT7w4HTgODX4aXGMigVY+IztpDv+XYztTqLCwMVfsrQWvo/WrtbltCdjzTP3gR7nWriPzCks3KbEFZkk4bCISJzV19RBCQzJBlE6afOAreCCdhooy80zmWOmHqc+OVDbAVTOC5Bcht/EaHNXGCwcHijiNd0MPah6OKI+gG/eDB2OLixdhoNTzeEYN6vB5Y/wwNuH/m29y46EM6mfXuq6KkD+/YT9J0XiTx

就可以获得到public key。这个时候复制到github 仓库的 deploy key即可。

1：如何与drone结合？
首先我是认可将yaml存储在git仓库中，做版本控制。
实际上flux类似于helm，分为fluxd和一个命令行工具fluxctl，fluxd相当于server部署在k8s集群中。那么将fluxctl做成一个drone的插件。放在drone pipeline中最后一步。类似于现在很多helm插件的玩法。
这个插件只需要完成更新镜像的功能即可。毕竟整个pipeline中，更新代码到仓库中触发编译，构建，推送新镜像到harbor，最终对于k8s集群，只需要应用替换新的镜像即可。所以不需要去监听registry这个功能。也不需要关注git中yaml的变化，拉取最新的即可。
具体实现思路：

将新的镜像name和要更新的目标，以及yaml文件路径等作为drone插件的输入参数

然后执行下面的类似命令

$ fluxctl release --controller=default:deployment/helloworld --update-image=quay.io/weaveworks/helloworld:master-a000001
Submitting release ...
Commit pushed: 33ce4e3
Applied 33ce4e38048f4b787c583e64505485a13c8a7836
CONTROLLER                     STATUS   UPDATES
default:deployment/helloworld  success  helloworld: quay.io/weaveworks/helloworld:master-9a16ff945b9e -> master-a000001

$ fluxctl list-images --controller default:deployment/helloworld
CONTROLLER                     CONTAINER   IMAGE                          CREATED
default:deployment/helloworld  helloworld  quay.io/weaveworks/helloworld
                                           |   master-9a16ff945b9e        20 Jul 16 13:19 UTC
                                           |   master-b31c617a0fe3        20 Jul 16 13:19 UTC
                                           |   master-a000002             12 Jul 16 17:17 UTC
                                           "-> master-a000001             12 Jul 16 17:16 UTC
                               sidecar     quay.io/weaveworks/sidecar
                                           "-> master-a000002             23 Aug 16 10:05 UTC
                                               master-a000001             23 Aug 16 09:53 UTC

2：抛开drone，对于整个paas平台。flux提供的自动监控registry和yaml git 仓库的功能，也能丰富用户的各种玩法。

3：接下来就是drone-flux插件。该插件是我实现本想法而实现的的一个插件。