VPN na CI runner: shin tunnel din yana rayuwa bayan build?
CI runner din da ake rabawa yana rike da hanyoyi da matakai tsakanin ayyuka. Tsara yanayin VPN kafin aikin, yayin sa da bayan sa, kuma tsaftace hadin da aikin ya mallaka kawai.
Aikin turawa yana haduwa, yana kwafe kayan aikin sa, sannan yana ba da rahoton nasara. Tunnel din da ya bude na iya kasancewa a bude lokacin da wani aiki ya fara, kuma hanyar da ya canja ta dukan host din ne. Sakamakon build yana bayyana umarnin, ba yanayin da ya baro a baya ba. Dauki VPN a matsayin albarkatu mai tsawon rayuwa, ba a matsayin layi daya a farkon mataki ba.
Me kuma ke gudana a wannan host
Jenkins node na iya tafiyar da masu aiwatarwa da yawa a lokaci daya, kuma aikin da ke canja hanyoyin host, saitunan resolver ko hadin tsarin gaba daya yana canja su ga kowa. Ko wani aiki zai lura da hakan ya dogara da manufar hanyoyi da tacewa, ba kan wata ka'ida ta gama gari game da VPN ba. Samun damar repository, samun damar kayan aiki da tashar kulawa bukatu daban-daban ne da runner din har yanzu yake bukata. Kara su cikin jerin wuraren turawa kafin ka zabi cikakken tunnel.
Idan tashar kulawa za ta tsallake tunnel din, dole ne kirar ta fadi hakan da gangan. Gano hakan yayin dawo baya ba shiri ba ne. Rubuta jerin biyu: abin da aikin dole ya isa a asirce, da abin da runner din dole ya isa ko ta yaya.
Shin wannan aikin yana bukatar damar asiri kwata-kwata?
Tambaya kafin kara tunnel din ko matakin build din yana bukatarsa. Wakilin turawa na asiri zai iya dauko kayan aikin da aka amince da su kuma ya yi turawar, wanda ke rike matakin build na gama gari a wajen cibiyar sadarwar asiri. Wannan rabo yawanci ya fi arha fiye da koya wa kowane matakin build tafiya ta tunnel.
Zabi iyakar daga tsarin aiki, ba daga al'ada ba. Idan amsar ita ce a'a, sauran wannan shafin ba lallai ba ne, kuma wannan ita ce mafi kyawun sakamako da ake da shi.
Yanayin da wani aiki ya gada
Bayyana abin da ya kamata ya zama gaskiya kafin aikin, yayin da yake da damar asiri, da kuma bayan ya kare, har da sokewa. Yanayin karshe shi ne wanda aka fi barin a fakaice, kuma shi ne wanda wani aiki ke gadawa. Rubuta shi kusa da pipeline maimakon barin shi a tunanin wani.
| Moment | What proves it | What leaks if it is skipped |
|---|---|---|
| Job start: pre-flight route check | The route table shows no tunnel from an earlier job, and the profile list is empty | A stale route sends deployment traffic into a dead tunnel |
| Job end: disconnect and shred | The profile is down and the temporary key file is gone | The next job inherits an open tunnel and a usable credential |
| Cancelled job: reboot or disposal | The host is replaced or rebooted before the next job starts | A killed process leaves the tunnel up with no owner |
Wakili na musamman ko na yar da za a zubar yana saukaka aiwatar da wadannan iyakoki. Akwati ko filin suna yana taimakawa ne kawai idan tsarin cibiyar sadarwa da izininsa sun kebe canjin da gaske.
Dakatar da hadin, ba shirin ba
Yi amfani da hanyar kammalawa ta pipeline don rufe hadin da wannan aikin ya fara da kuma cire takardun shaidarsa na wucin gadi. Kada ka daidaita matakai da sunan shiri a host din da wasu ayyuka ke amfani da shi; dakatar da takamaiman hadin maimakon haka. Umarnin biyu da ke kasa su ne dukan tsaftacewa, kuma babu daya da ya dogara da samun mataki.
vpn-cli disconnect --profile "$PROFILE"
rm -f "$RUNNER_TEMP/client.key"Kammalawa ba kebewa ba ce: runner din da ya mutu yana rike da tunnel din da ya bude, kuma matakin da aka dakatar da karfi yana tsallake katangar gaba daya. Shi ya sa umarnin tsaftacewa shi kadai ba zai iya zama dukan kirar ba. Ga yadda yake kasawa a aikace: an soke aikin turawa a matakin kwafi, katangar kammalawa ba ta taba gudana ba, kuma wani aiki a kan wannan host din ya fara da budadden tunnel da hanyar da ke nufin cibiyar sadarwar da ba zai iya isa ba. Rashin yana kama da matsalar 'DNS' a build na gaba, sa'o'i bayan aikin da ya haifar da ita ya kare.
Rubuta sunan bayanin martaba da hanyar takardar shaida a cikin fitar da aikin. Umarnin cire hadi kawai ba tare da wani mai ganowa ba yana da wahalar dubawa daga baya. Layin log din kuma shi ne ke tabbatar da katangar ta gudana lokacin da wani bincike na gaba ya tambaya.
Ba aikin host din da babu wani da ke amfani da shi
Kayan aiki na yar da za a zubar yana kawar da matsalar gado maimakon sarrafa ta. Sabon wakili ga kowane aiki yana farawa ba tare da hanya, bayanin martaba ko takardun shaidar wani ba, kuma lalatarsa tana tsaftace duk abin da aikin ya bari. Wannan yana da tsada fiye da kowane build, kuma shi ne gaskiya farashin iyaka da bai dogara da lambar tsaftacewa ba. Ga ayyukan da suka shafi cibiyoyin sadarwar samarwa, yawanci ita ce hanya mafi arha da zarar an kidaya abubuwan da suka faru.
Inda dole runner din da ake rabawa ya tsaya, gwada kasawa da sokewa da kulawa kamar yadda aka yi kwafin nasara. Gwajin ya kamata ya nuna abin da wani aiki zai gani idan an soke wannan a tsakiya. Aikin yana karewa ne lokacin da damarsa da yanayinsa na wucin gadi suka kare, ba lokacin da umarnin kwafi ya dawo sifili ba.