K8s CI/CD 架构实战

云原生时代业务从月级版本变为分钟级交付，传统"人工打包 + 手动 kubectl apply"已无法满足高频发布、多环境隔离、可回滚可追溯、自动化安全的需求。

架构概览

CI 阶段：构建与镜像管理

Jenkins Pipeline

pipeline {
  agent any
  environment {
    REGISTRY = "harbor.mycorp.local"
    IMAGE_NAME = "myapp"
    VERSION = "${env.BUILD_NUMBER}"
  }
  stages {
    stage('Checkout') {
      steps { git branch: 'main', url: 'https://gitlab.mycorp.local/myapp.git' }
    }
    stage('Build & Test') {
      steps { sh 'mvn clean package -DskipTests' }
    }
    stage('Docker Build & Push') {
      steps {
        sh """
          docker build -t ${REGISTRY}/${IMAGE_NAME}:${VERSION} .
          docker push ${REGISTRY}/${IMAGE_NAME}:${VERSION}
        """
      }
    }
    stage('Update Helm Values') {
      steps {
        sh """
          git clone https://gitlab.mycorp.local/helm-charts.git
          cd helm-charts && sed -i "s/tag:.*/tag: ${VERSION}/" values.yaml
          git commit -am "Release ${VERSION}" && git push
        """
      }
    }
  }
}

代码质量门禁（SonarQube）

CI 流水线中集成静态代码分析，质量不达标阻断构建：

stage('SonarQube Analysis') {
  steps {
    withSonarQubeEnv('SonarQube') {
      sh 'mvn sonar:sonar'
    }
  }
}
stage('Quality Gate') {
  steps {
    timeout(time: 5, unit: 'MINUTES') {
      waitForQualityGate abortPipeline: true
    }
  }
}

安全扫描

stage('Security Scan') {
  steps {
    sh 'trivy image --exit-code 1 --severity HIGH,CRITICAL ${REGISTRY}/${IMAGE_NAME}:${VERSION}'
  }
}

CD 阶段：GitOps 持续部署

Argo CD 部署模式

Argo CD 监听 Git 仓库中的 Helm Chart 变更，自动同步到 K8s 集群：

# 安装 Argo CD
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# 创建 Application
argocd app create myapp \
  --repo https://gitlab.mycorp.local/helm-charts.git \
  --path charts/myapp \
  --dest-server https://kubernetes.default.svc \
  --dest-namespace production \
  --sync-policy automated \
  --auto-prune

Argo CD 同步策略

Helm 多环境管理

charts/
└── myapp/
    ├── Chart.yaml
    ├── values.yaml          # 默认值
    ├── values-dev.yaml      # 开发环境
    ├── values-staging.yaml  # 预发布环境
    └── values-prod.yaml     # 生产环境

部署命令：

# 安装到开发环境
helm upgrade --install myapp ./charts/myapp -f values-dev.yaml -n dev

# 生产环境（带灰度策略）
helm upgrade --install myapp ./charts/myapp -f values-prod.yaml -n production

多环境隔离策略

# values-prod.yaml
replicaCount: 3
image:
  tag: "v2.5.1"
resources:
  limits:
    cpu: "2"
    memory: 4Gi
ingress:
  enabled: true
  host: myapp.mycorp.com

# values-staging.yaml
replicaCount: 1
resources:
  limits:
    cpu: "500m"
    memory: 1Gi
ingress:
  enabled: true
  host: myapp-staging.mycorp.local

发布策略

完整 CI/CD 流程

Git Push → CI Pipeline（构建/测试/扫描/打包）→ Push Image → Update Helm Values
                                                              ↓
                                           Argo CD 检测变更 → Sync to K8s

关联页面