Installation et configuration¶

# /home/actrunner/data/config.yaml
log:
  level: info

runner:
  file: /data/.runner
  capacity: 4          # jobs en parallele
  timeout: 3h
  labels:
    - "ubuntu-latest:docker://node:20-bookworm"
    - "self-hosted:host"

cache:
  enabled: true
  dir: /cache
  host:
    port: 0            # port aleatoire

container:
  network: host
  privileged: false     # jamais de conteneur privilegie
  options: |
    --memory=4g
    --cpus=2
  valid_volumes:
    - /home/actrunner/cache

# clusters/production/flux-system/kustomize-controller-patch.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kustomize-controller
  namespace: flux-system
spec:
  template:
    spec:
      containers:
        - name: manager
          args:
            - --events-addr=http://notification-controller.flux-system.svc.cluster.local./
            - --watch-all-namespaces=true
            - --feature-gates=DetectDrift=true,CorrectDrift=true

# .gitea/workflows/ci.yaml
name: CI Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  REGISTRY: harbor.example.com
  IMAGE_NAME: org/myapp

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set image tag
        id: tag
        run: |
          if [ "${{ github.event_name }}" = "push" ]; then
            echo "TAG=${GITHUB_SHA::8}" >> $GITHUB_OUTPUT
          else
            echo "TAG=pr-${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
          fi

      - name: Build image
        run: |
          podman build -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.TAG }} .

      - name: Run unit tests
        run: |
          podman run --rm \
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.TAG }} \
            make test

      - name: Scan with Trivy
        run: |
          trivy image --exit-code 1 --severity HIGH,CRITICAL \
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.TAG }}

      - name: Login to Harbor
        if: github.event_name == 'push'
        run: |
          podman login ${{ env.REGISTRY }} \
            -u ${{ secrets.HARBOR_USER }} \
            -p ${{ secrets.HARBOR_PASSWORD }}

      - name: Push image
        if: github.event_name == 'push'
        run: |
          podman push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.TAG }}

  update-manifests:
    needs: build
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout manifests
        uses: actions/checkout@v4
        with:
          repository: org/manifests
          token: ${{ secrets.GITEA_DEPLOY_TOKEN }}

      - name: Update image tag
        run: |
          TAG="${GITHUB_SHA::8}"
          cd overlays/production
          kustomize edit set image \
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${TAG}

      - name: Commit and push
        run: |
          git config user.name "gitea-actions"
          git config user.email "ci@example.com"
          git add -A
          git commit -m "chore: update myapp image to ${GITHUB_SHA::8}"
          git push

# clusters/production/myapp.yaml
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: myapp-production
  namespace: flux-system
spec:
  interval: 5m
  retryInterval: 2m
  timeout: 3m
  prune: true
  force: false

  sourceRef:
    kind: GitRepository
    name: manifests

  path: ./overlays/production

  targetNamespace: app-production

  healthChecks:
    - apiVersion: apps/v1
      kind: Deployment
      name: myapp
      namespace: app-production

  patches:
    - patch: |
        apiVersion: kustomize.config.k8s.io/v1beta1
        kind: Kustomization
        metadata:
          name: not-used
      target:
        kind: Namespace

# clusters/production/myapp-staging.yaml
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: myapp-staging
  namespace: flux-system
spec:
  interval: 5m
  prune: true
  sourceRef:
    kind: GitRepository
    name: manifests
  path: ./overlays/staging
  targetNamespace: app-staging
  healthChecks:
    - apiVersion: apps/v1
      kind: Deployment
      name: myapp
      namespace: app-staging
---
# clusters/production/myapp-production.yaml
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: myapp-production
  namespace: flux-system
spec:
  interval: 10m
  prune: true
  sourceRef:
    kind: GitRepository
    name: manifests
  path: ./overlays/production
  targetNamespace: app-production
  # Production : depend du staging
  dependsOn:
    - name: myapp-staging
  healthChecks:
    - apiVersion: apps/v1
      kind: Deployment
      name: myapp
      namespace: app-production

# clusters/production/myapp-helm.yaml
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
  name: myapp-charts
  namespace: flux-system
spec:
  interval: 1h
  url: https://harbor.example.com/chartrepo/org
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: myapp
  namespace: app-production
spec:
  interval: 10m
  chart:
    spec:
      chart: myapp
      version: ">=1.0.0 <2.0.0"
      sourceRef:
        kind: HelmRepository
        name: myapp-charts
        namespace: flux-system
  values:
    image:
      repository: harbor.example.com/org/myapp
      tag: latest
    replicas: 3
  upgrade:
    remediation:
      retries: 3

# clusters/production/myapp-image-automation.yaml
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImageRepository
metadata:
  name: myapp
  namespace: flux-system
spec:
  image: harbor.example.com/org/myapp
  interval: 5m
  secretRef:
    name: harbor-credentials
---
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImagePolicy
metadata:
  name: myapp
  namespace: flux-system
spec:
  imageRepositoryRef:
    name: myapp
  policy:
    semver:
      range: ">=1.0.0 <2.0.0"
---
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImageUpdateAutomation
metadata:
  name: myapp
  namespace: flux-system
spec:
  interval: 5m
  sourceRef:
    kind: GitRepository
    name: manifests
  git:
    checkout:
      ref:
        branch: main
    commit:
      author:
        name: flux-automation
        email: flux@example.com
      messageTemplate: "chore: update myapp image to {{.NewTag}}"
    push:
      branch: main
  update:
    path: ./overlays/production
    strategy: Setters

# overlays/production/deployment.yaml
spec:
  containers:
    - name: myapp
      image: harbor.example.com/org/myapp:1.0.0 # {"$imagepolicy": "flux-system:myapp"}