1
// Jenkinsfile
2
pipeline {
3
    agent any
4

5
    environment {
6
        DOCKER_IMAGE = "myapp:${BUILD_NUMBER}"
7
        REGISTRY = "registry.example.com"
8
    }
9

10
    stages {
11
        stage('Build') {
12
            steps {
13
                sh 'mvn clean package -DskipTests=false'
14
            }
15
        }
16

17
        stage('Test') {
18
            parallel {
19
                stage('Unit Tests') {
20
                    steps {
21
                        sh 'mvn test'
22
                    }
23
                }
24
                stage('Integration Tests') {
25
                    steps {
26
                        sh 'mvn verify -DskipUnitTests'
27
                    }
28
                }
29
            }
30
        }
31

32
        stage('Security Scan') {
33
            steps {
34
                sh 'trivy image --severity HIGH,CRITICAL ${REGISTRY}/${DOCKER_IMAGE}'
35
            }
36
        }
37

38
        stage('Build Image') {
39
            steps {
40
                sh '''
41
                    docker build -t ${REGISTRY}/${DOCKER_IMAGE} .
42
                    docker push ${REGISTRY}/${DOCKER_IMAGE}
43
                '''
44
            }
45
        }
46

47
        stage('Deploy to Staging') {
48
            steps {
49
                sh '''
50
                    kubectl config use-context staging
51
                    kubectl set image deployment/myapp myapp=${REGISTRY}/${DOCKER_IMAGE}
52
                '''
53
            }
54
        }
55

56
        stage('Smoke Test') {
57
            steps {
58
                sh 'curl -f https://staging.example.com/health || exit 1'
59
            }
60
        }
61

62
        stage('Deploy to Production') {
63
            when {
64
                branch 'main'
65
            }
66
            steps {
67
                input message: 'Approve deployment?', ok: 'Deploy'
68
                sh '''
69
                    kubectl config use-context production
70
                    kubectl set image deployment/myapp myapp=${REGISTRY}/${DOCKER_IMAGE}
71
                '''
72
            }
73
        }
74
    }
75

76
    post {
77
        always {
78
            cleanWs()
79
        }
80
        failure {
81
            slackSend channel: '#alerts', message: "Build ${BUILD_NUMBER} failed"
82
        }
83
    }
84
}

1
// Jenkinsfile 最佳实践
2
pipeline {
3
    options {
4
        buildDiscarder(logRotator(numToKeepStr: '10'))
5
        timeout(time: 30, unit: 'MINUTES')
6
        disableConcurrentBuilds()
7
    }
8

9
    parameters {
10
        string(name: 'DEPLOY_ENV', defaultValue: 'staging',
11
                description: 'Deployment environment')
12
        booleanParam(name: 'RUN_SONAR', defaultValue: true,
13
                description: 'Run SonarQube scan')
14
    }
15

16
    environment {
17
        APP_NAME = 'myapp'
18
        REGISTRY = 'registry.example.com'
19
    }
20
}

1
# Dockerfile 多阶段构建
2
# 构建阶段
3
FROM maven:3.9-eclipse-temurin-17 AS builder
4
WORKDIR /app
5
COPY pom.xml .
6
RUN mvn dependency:go-offline
7
COPY src ./src
8
RUN mvn clean package -DskipTests
9

10
# 运行阶段
11
FROM eclipse-temurin:17-jre-alpine
12
WORKDIR /app
13

14
# 从构建阶段复制
15
COPY --from=builder /app/target/*.jar app.jar
16

17
# 安全配置
18
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
19
USER appuser
20

21
# 健康检查
22
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
23
    CMD wget -qO- http://localhost:8080/health || exit 1
24

25
ENTRYPOINT ["java", "-jar", "app.jar"]

1
# ArgoCD Application
2
apiVersion: argoproj.io/v1alpha1
3
kind: Application
4
metadata:
5
  name: myapp
6
  namespace: argocd
7
spec:
8
  project: default
9
  source:
10
    repoURL: https://github.com/org/myapp
11
    targetRevision: HEAD
12
    path: deploy/helm
13
    helm:
14
      valueFiles:
15
        - values.yaml
16
      parameters:
17
        - name: image.tag
18
          value: latest
19
  destination:
20
    server: https://kubernetes.default.svc
21
    namespace: production
22
  syncPolicy:
23
    automated:
24
      prune: true
25
      selfHeal: true
26
      allowEmpty: false
27
    syncOptions:
28
      - CreateNamespace=true
29
    retry:
30
      limit: 5
31
      backoff:
32
        duration: 5s
33
        factor: 2
34
        maxDuration: 3m

1
# 金丝雀部署
2
apiVersion: argoproj.io/v1alpha1
3
kind: Rollout
4
metadata:
5
  name: myapp-rollout
6
spec:
7
  replicas: 10
8
  strategy:
9
    canary:
10
      steps:
11
        - setWeight: 10
12
        - pause: { duration: 10m }
13
        - setWeight: 30
14
        - pause: { duration: 10m }
15
        - setWeight: 50
16
        - pause: { duration: 10m }
17
        - setWeight: 80
18
        - pause: { duration: 10m }
19
        - setWeight: 100
20
      canaryMetadata:
21
        labels:
22
          role: canary
23
      stableMetadata:
24
        labels:
25
          role: stable
26
      canaryService:
27
        name: myapp-canary
28
      stableService:
29
        name: myapp-stable