init
This commit is contained in:
154
07-advanced/01-cicd/.github/workflows/policy-ci.yaml
vendored
Normal file
154
07-advanced/01-cicd/.github/workflows/policy-ci.yaml
vendored
Normal file
@@ -0,0 +1,154 @@
|
||||
name: Kyverno Policy CI
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
branches:
|
||||
- main
|
||||
paths:
|
||||
- 'policies/**'
|
||||
- 'k8s/**'
|
||||
- 'helm/**'
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
paths:
|
||||
- 'policies/**'
|
||||
|
||||
jobs:
|
||||
# -------------------------------------------------------
|
||||
# JOB 1: Линтинг и тестирование политик
|
||||
# -------------------------------------------------------
|
||||
test-policies:
|
||||
name: Test Kyverno Policies
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Install Kyverno CLI
|
||||
uses: kyverno/action-install-cli@v0.2.0
|
||||
with:
|
||||
release: 'v1.11.4'
|
||||
|
||||
- name: Verify Kyverno CLI
|
||||
run: kyverno version
|
||||
|
||||
- name: Lint policies (validate YAML structure)
|
||||
run: |
|
||||
find policies/ -name '*.yaml' -exec kubectl apply \
|
||||
--dry-run=client -f {} \; 2>&1 | \
|
||||
grep -v "^$" | \
|
||||
tee lint-results.txt
|
||||
# Завершиться с ошибкой если есть failures
|
||||
grep -q "error\|Error" lint-results.txt && exit 1 || exit 0
|
||||
|
||||
- name: Run Kyverno tests
|
||||
run: |
|
||||
kyverno test policies/ \
|
||||
--detailed-results \
|
||||
2>&1 | tee test-results.txt
|
||||
# Проверить что все тесты прошли
|
||||
grep -q "Tests Summary" test-results.txt || exit 1
|
||||
grep "Passed" test-results.txt
|
||||
# Завершиться с ошибкой если есть Failed тесты
|
||||
grep -q "^Failed: [^0]" test-results.txt && exit 1 || exit 0
|
||||
|
||||
- name: Upload test results
|
||||
uses: actions/upload-artifact@v4
|
||||
if: always()
|
||||
with:
|
||||
name: kyverno-test-results
|
||||
path: test-results.txt
|
||||
|
||||
# -------------------------------------------------------
|
||||
# JOB 2: Проверка Kubernetes манифестов против политик
|
||||
# -------------------------------------------------------
|
||||
validate-manifests:
|
||||
name: Validate K8s Manifests
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Install Helm
|
||||
uses: azure/setup-helm@v4
|
||||
with:
|
||||
version: 'v3.14.0'
|
||||
|
||||
- name: Install Kyverno CLI
|
||||
uses: kyverno/action-install-cli@v0.2.0
|
||||
with:
|
||||
release: 'v1.11.4'
|
||||
|
||||
- name: Generate manifests from Helm
|
||||
run: |
|
||||
helm template my-app ./helm/my-app \
|
||||
-f helm/my-app/values-production.yaml \
|
||||
--namespace production \
|
||||
> /tmp/rendered-manifests.yaml
|
||||
|
||||
- name: Validate manifests against policies
|
||||
run: |
|
||||
kyverno apply policies/ \
|
||||
--resource /tmp/rendered-manifests.yaml \
|
||||
--detailed-results \
|
||||
--table \
|
||||
2>&1 | tee kyverno-apply-results.txt
|
||||
|
||||
# Завершиться с ошибкой если есть FAIL
|
||||
grep -q "^| FAIL" kyverno-apply-results.txt && exit 1 || exit 0
|
||||
|
||||
- name: Comment PR with violations
|
||||
if: failure() && github.event_name == 'pull_request'
|
||||
uses: actions/github-script@v7
|
||||
with:
|
||||
script: |
|
||||
const fs = require('fs');
|
||||
const results = fs.readFileSync('kyverno-apply-results.txt', 'utf8');
|
||||
const body = `## ❌ Kyverno Policy Violations\n\n` +
|
||||
`Следующие манифесты нарушают политики безопасности:\n\n` +
|
||||
`\`\`\`\n${results}\`\`\`\n\n` +
|
||||
`Исправьте нарушения перед merge.`;
|
||||
github.rest.issues.createComment({
|
||||
issue_number: context.issue.number,
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
body: body
|
||||
});
|
||||
|
||||
# -------------------------------------------------------
|
||||
# JOB 3: Деплой политик в staging (только main ветка)
|
||||
# -------------------------------------------------------
|
||||
deploy-staging:
|
||||
name: Deploy Policies to Staging
|
||||
runs-on: ubuntu-latest
|
||||
needs: [test-policies, validate-manifests]
|
||||
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
|
||||
environment: staging
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Install Helm
|
||||
uses: azure/setup-helm@v4
|
||||
|
||||
- name: Configure kubectl
|
||||
run: |
|
||||
echo "${{ secrets.STAGING_KUBECONFIG }}" | \
|
||||
base64 -d > /tmp/kubeconfig
|
||||
echo "KUBECONFIG=/tmp/kubeconfig" >> $GITHUB_ENV
|
||||
|
||||
- name: Deploy policies via Helm
|
||||
run: |
|
||||
helm upgrade --install kyverno-policies \
|
||||
./05-variables/03-templates/kyverno-policies \
|
||||
--namespace kyverno \
|
||||
-f ./05-variables/03-templates/kyverno-policies/values-staging.yaml \
|
||||
--wait \
|
||||
--timeout 5m
|
||||
|
||||
- name: Verify deployment
|
||||
run: |
|
||||
kubectl get clusterpolicies \
|
||||
-l helm.sh/chart=kyverno-policies-1.0.0 \
|
||||
-o wide
|
||||
153
07-advanced/01-cicd/README.md
Normal file
153
07-advanced/01-cicd/README.md
Normal file
@@ -0,0 +1,153 @@
|
||||
# Урок 7.1 — Интеграция с CI/CD пайплайнами
|
||||
|
||||
## Файлы
|
||||
|
||||
| Файл | Описание |
|
||||
|------|----------|
|
||||
| `.github/workflows/policy-ci.yaml` | GitHub Actions: тест + валидация + деплой |
|
||||
| `argocd-application.yaml` | ArgoCD Application для GitOps деплоя |
|
||||
|
||||
## Kyverno CLI — локальная проверка
|
||||
|
||||
```bash
|
||||
# Установка
|
||||
brew install kyverno # macOS
|
||||
# или
|
||||
curl -LO https://github.com/kyverno/kyverno/releases/latest/download/kyverno-cli_linux_amd64.tar.gz
|
||||
tar -xzf kyverno-cli_*.tar.gz && sudo mv kyverno /usr/local/bin/
|
||||
|
||||
kyverno version
|
||||
|
||||
# Проверить манифест против политики (без кластера)
|
||||
kyverno apply \
|
||||
../../02-validation/01-resource-validation/require-resource-limits.yaml \
|
||||
--resource ../../02-validation/01-resource-validation/test-resources/pod-no-limits.yaml
|
||||
|
||||
# Проверить папку политик против папки манифестов
|
||||
kyverno apply ../../02-validation/ \
|
||||
--resource ./test-k8s-manifests/ \
|
||||
--table \
|
||||
--detailed-results
|
||||
|
||||
# Запустить тесты
|
||||
kyverno test ../../02-validation/01-resource-validation/tests/
|
||||
```
|
||||
|
||||
## Локальная симуляция CI pipeline
|
||||
|
||||
```bash
|
||||
# 1. Сгенерировать манифесты из Helm
|
||||
helm template my-app ./helm-chart/ \
|
||||
-f ./helm-chart/values-production.yaml \
|
||||
> /tmp/manifests.yaml
|
||||
|
||||
# 2. Запустить Kyverno проверку
|
||||
kyverno apply ../../02-validation/ \
|
||||
--resource /tmp/manifests.yaml \
|
||||
--table 2>&1 | tee results.txt
|
||||
|
||||
# 3. Проверить наличие нарушений
|
||||
if grep -q "^| FAIL" results.txt; then
|
||||
echo "❌ Policy violations found!"
|
||||
cat results.txt
|
||||
exit 1
|
||||
else
|
||||
echo "✅ All policies passed"
|
||||
fi
|
||||
```
|
||||
|
||||
## Тестовые манифесты для CI
|
||||
|
||||
```bash
|
||||
mkdir -p test-k8s-manifests
|
||||
|
||||
# Манифест с нарушениями — pipeline должен упасть
|
||||
cat > test-k8s-manifests/bad-deployment.yaml <<EOF
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: bad-app
|
||||
namespace: default
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: bad-app
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: bad-app
|
||||
spec:
|
||||
containers:
|
||||
- name: app
|
||||
image: nginx:latest # нарушение: latest тег
|
||||
# нет resources # нарушение: нет limits
|
||||
EOF
|
||||
|
||||
# Запустить проверку — должна быть ошибка
|
||||
kyverno apply ../../02-validation/ \
|
||||
--resource test-k8s-manifests/bad-deployment.yaml \
|
||||
--table
|
||||
# Ожидаем: FAIL для disallow-latest-tag и require-resource-limits
|
||||
```
|
||||
|
||||
## Настройка GitOps с ArgoCD
|
||||
|
||||
```bash
|
||||
# Предварительно установите ArgoCD
|
||||
kubectl create namespace argocd
|
||||
kubectl apply -n argocd \
|
||||
-f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
|
||||
|
||||
# Применить Application
|
||||
kubectl apply -f argocd-application.yaml
|
||||
|
||||
# Проверить статус синхронизации
|
||||
kubectl get application kyverno-policies -n argocd
|
||||
|
||||
# Принудительная синхронизация
|
||||
argocd app sync kyverno-policies
|
||||
|
||||
# История деплоев
|
||||
argocd app history kyverno-policies
|
||||
|
||||
# Откат к предыдущей версии
|
||||
argocd app rollback kyverno-policies 1
|
||||
```
|
||||
|
||||
## CODEOWNERS для политик
|
||||
|
||||
```bash
|
||||
# Создать файл для контроля ревью изменений в политиках
|
||||
cat > .github/CODEOWNERS <<EOF
|
||||
# Изменения в security политиках — обязательное ревью от security team
|
||||
policies/02-validation/02-security/** @company/security-team
|
||||
|
||||
# Изменения в generation политиках — platform team
|
||||
policies/04-generation/** @company/platform-team
|
||||
|
||||
# Helm chart — оба
|
||||
policies/05-variables/03-templates/** @company/platform-team @company/security-team
|
||||
EOF
|
||||
```
|
||||
|
||||
## JUnit отчёт для CI систем
|
||||
|
||||
```bash
|
||||
# Kyverno CLI может генерировать JUnit XML
|
||||
kyverno test policies/ \
|
||||
--junit-report kyverno-junit.xml
|
||||
|
||||
# GitLab CI — загрузка артефакта
|
||||
# artifacts:
|
||||
# reports:
|
||||
# junit: kyverno-junit.xml
|
||||
|
||||
# GitHub Actions — публикация результатов
|
||||
# uses: dorny/test-reporter@v1
|
||||
# with:
|
||||
# artifact: kyverno-junit
|
||||
# name: Kyverno Tests
|
||||
# path: kyverno-junit.xml
|
||||
# reporter: java-junit
|
||||
```
|
||||
39
07-advanced/01-cicd/argocd-application.yaml
Normal file
39
07-advanced/01-cicd/argocd-application.yaml
Normal file
@@ -0,0 +1,39 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: kyverno-policies
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "1" # применить после установки Kyverno (wave 0)
|
||||
spec:
|
||||
project: platform
|
||||
|
||||
source:
|
||||
repoURL: https://github.com/company/platform-policies.git
|
||||
targetRevision: main
|
||||
path: 05-variables/03-templates/kyverno-policies
|
||||
helm:
|
||||
valueFiles:
|
||||
- values.yaml
|
||||
- values-production.yaml
|
||||
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: kyverno
|
||||
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: true # удалять политики удалённые из Git
|
||||
selfHeal: true # восстанавливать при ручных изменениях
|
||||
syncOptions:
|
||||
- ServerSideApply=true # нужно для CRD-based ресурсов
|
||||
- CreateNamespace=true
|
||||
retry:
|
||||
limit: 3
|
||||
backoff:
|
||||
duration: 30s
|
||||
factor: 2
|
||||
maxDuration: 3m
|
||||
|
||||
# Уведомления (если настроен argocd-notifications)
|
||||
# Добавьте аннотации для Slack/Teams/Email нотификаций
|
||||
Reference in New Issue
Block a user