Argo CICD 权限配置
1. ECR pull 权限配置
获取token
aws ecr get-login-password --region ap-northeast-1创建权限secrets
kubectl create secret docker-registry regcred --docker-server=https://xxxxxxx.dkr.ecr.ap-northeast-1.amazonaws.com --docker-username=AWS --docker-password=xxxxxxxxxxxxxxxxxxxxxxVNGs4TTFIS3k4cTFYeDNXdzMxck1TY3dPdEJTRGRGMUJGS2hpc2tmMG92L2ptM3J1Zm01SUd3NklWZGRIK3VwMkhlcHg0eE5Hc3lGTlEydjIwY3ZWRms5SUczTStBditneXBUNm5QcEhLemQvZ0VtK1ZYWkxnK3U5Z0lrUHQwSjZMdHQ5YjhlK2NMakxZTXRnTDByc1ozRG5scmF5YitYRm1ncHordTBmQzJwcGdycURRM3RiQ1JEV2c5K2VNTStBcDJ3MEhnSXE3R3AzUUMySjFoMndQdGxRbm9lSW9qSHBUaTRmdjIxxxxxxxxxxxxxxxxxxxxxxSt4eG1WMXRZd0RIbCt5MXgrSFdZcFcxd1ZGekEzc3FhU3VORkM0VkZ3UHBrRzQvV1k3S213OGJqREJ0VGhXZDFuNzRXbnlvakc4K0g3ZmZkcVpmRk1pSjZhMm9JWnVublBPTmp3NGFZRzFGQmFrSVFxSTdnS1ByMDlBcUNNS1NCZTN1VWI4UlpRY3hNM1VoSGpCUmsraExIU2ZDYkNaSzhRZlRiNHRSSGV6VnVmLzVUNzRHxxxxxxxxxxxxxxxxxxxxxx1RuYjRpMWxHc1lxRkR2dzlXYW5qVG9QcWZ4K0ZuUXVmRFpVdGxxxxxxxxxxxxxxxxxxxxxx9kTVBjUWEzR3NZVGp6RFF0U3hpc0MxV29rT0hiTUF0UXNSS3VhcDVJSDFhaTg5cDU5VHNvQXE4ZFoyRUJsc1dSTDBLVW1pVi9qbjVrUEsyZ1oxL2dTVFVYZTl6MGxSVXRGUmtEK1lEVjFGeDU2SVBxVEdDcjBUMlVRZXdMV3h1QXZVS0wrbVNjMFN1RzkzM3pLVnhGNGdBbjlzclV6L1U2VU16MjVuenFRTjAyWkhnWFdmT1k4R0RMVCtpRkVtbnYwUkNORWhWTWM3NEh0ZDV5TDZ5dUVWWTlHN2FKbVpOQVJ1b3hab0ViK0p5WUQwUVM2WjZEK3NFSmREMWwxeUVnSVFUVFAwWHU5eXEwaGg1T1pmU2hxxxxxxxxxxxxxxxxxxxxxxhlMTBuNXhSZFVpMUhkTXQ5eSt5U2VFSkNhUlVXSHJ6RWRVU25wTmRESFpLUlYvMjR0ZU5JV3QrTmNyUllFWUE2SnA1SmxVS1VieXpCc2d4ZnNIY01KQU1tZGQ0SzJkWm1nWFl1Y1hkY0kzN0tHRml0TVV5NmJCMG1iN25GTytDaE5Way8rQVZyNFB3a1dOcjF1ZDZJMW9DbXcxVlZFOWl6M0cxTFFYRjFDWFZoK29aUUtRRDlodDQxxxxxxxxxxxxxxxxxxxxxxYUlPN1JNalovQ0lvZGY5a24zQzUxaEVoek1IN0tyN2p6MkJsd0o5RFJ6THVWTVVEQiIsImRhdGFrZXkiOiJBUUVCQUhnQU1mS0RsSW9wQzZ6czBiTWRScllTSGEvQzM5a0NyY1A4a1ZwckU5ZitrUUFBQUg0d2ZBWUpLb1pJaHZjTkFRY0dvRzh3YlFJQkFEQm9CZ2txaGtpRzl3MEJCd0V3SGdZSllJWklBV1VEQkFFdU1CRUVEQXVYNzlrSjgrQ3JkT2w1c0FJQkVJQTdYbE9Xb3d2TWk1bnQ5ZWExbmRsRjdPUlgraG40RmEwZkJiVXFnZXZ2eXdTRxxxxxxxxxxxxxxxxxxxxxxhWcmM1YUtjPSIsInZlcnNpb24iOiIyIiwidHlwZSI6IkRBVEFfS0VZIiwiZXhwaXJhdGlvbiI6MTYyNjgxNzQxOX0= --docker-email=YOUREMAIL@ADDRESS -n argo通过imagePullSecrets
triggers:
- template:
name: build-workflow-trigger
argoWorkflow:
group: argoproj.io
version: v1alpha1
resource: workflows
operation: submit
source:
resource:
apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
generateName: buildbebuildkit-
namespace: argo
spec:
# serviceAccountName: operate-workflow-sa
entrypoint: main
onExit: exit-handler
imagePullSecrets:
- name: regcred或者
entrypoint: main
onExit: exit-handler
imagePullSecrets:
- name: regcred2. 如果需要手动向ECR上传
aws ecr get-login-password --region ap-northeast-1 | docker login --username AWS --password-stdin xxxxxx.dkr.ecr.ap-northeast-1.amazonaws.com3. 使用Kaniko上传到ECR
4. Github 权限
创建secrets
apiVersion: v1
data:
password: xxxxxx=
username: xxxxxxxxx
kind: Secret
metadata:
name: github-creds
namespace: default
type: Opaque
然后引用
- name: clone
inputs:
artifacts:
- name: argo-source
path: /src
git:
repo: '{{workflow.parameters.repo}}'
revision: '{{workflow.parameters.branch}}'
usernameSecret:
name: github-creds
key: username
passwordSecret:
name: github-creds
key: password如果要在环境变量中引用可以使用
- name: deploy
inputs:
parameters:
- name: depfileyaml
container:
name: ''
image: 'xxxxxxx.dkr.ecr.ap-northeast-1.amazonaws.com/xxxxxx'
command:
- /main.sh
args:
- '{{inputs.parameters.depfileyaml}}'
workingDir: /
env:
- name: GIT_URL
valueFrom:
secretKeyRef:
key: mykey
name: giturl
apiVersion: v1
data:
mykey: xxxxxxxxxxxxxxxx
kind: Secret
metadata:
name: giturl
namespace: default
type: Opaque
