VPN-ga CI runner: tunnel-ku ma ka sii jiraa build-ka?
CI runner la wadaago wuxuu hawlo u dhexeeya ku hayaa waddooyin iyo habab. Qorsheeyso xaaladaha VPN-ga ka hor hawsha, inta ay socoto iyo ka dib, oo nadiifi kaliya xiriirka hawshu leedahay.
Hawsha deployment-ka ayaa isku xirta, artifact-keeda koobiyeystaa oo sheegta guul. Tunnel-ka ay furtay ayaa weli shaqeyn kara marka hawsha xigta bilaabato, waddada ay beddeshayna waxaa leh host-ka oo dhan. Natiijada build-ku waxay qeexdaa amarka, ma aha xaaladda uu ka tagay. U tixgeli VPN-ga sida kheyraad leh muddo nololeed, ma aha sida hal saf oo bilowga marxalad.
Maxaa kale oo ku socda host-kan
Node-ka Jenkins wuxuu wada shaqeyn karaa dhowr executor, hawsha beddesha waddooyinka host-ka, dejinta resolver-ka ama xiriirka nidaamka oo dhan waxay u beddeshaa qof walba. In hawsha kale taas aragto waxay ku xiran tahay siyaasadda waddooyinka iyo shaandhaynta, ma aha qaanuun guud oo VPN-yada ku saabsan. Helitaanka repository-ga, helitaanka artifact-ka iyo kanaalka kontoroolka waa shuruudo gaar ah oo runner-ku weli u baahan yahay. Ku dar liiska meelaha deployment-ka ka hor intaadan dooran tunnel buuxa.
Haddii kanaalka kontoroolka uu dhex marayo tunnel-ka, nashqaddu waa inay si ula kac ah taas u sheegto. In taas la ogaado inta rollback-ka socda ma aha qorshe. Qor labada liis: waxa hawshu si gaar ah u gaarayso iyo waxa runner-ku si kasta u gaarayso.
Hawshan miyay u baahan tahay gelitaan gaar ah haba yaraatee?
Weydii ka hor intaadan tunnel-ka ku darin haddii marxaladda build-ku u baahan tahay. Agent deployment oo gaar ah ayaa soo qaadan kara artifact la ansixiyay oo sameyn kara deployment-ka, taas oo marxaladda build-ka guud ka ilaalinaysa shabakadda gaarka ah. Kala qaybintaas ayaa caadi ahaan ka jaban in tallaabo kasta oo build-ka ah la baro inay tunnel-ka dhex marto.
Xadka ka dooro habka shaqada halkii aad ka dooran lahayd caado. Haddii jawaabtu tahay maya, qaybta kale ee boggan waa mid aan loo baahnayn, taasna waa natiijada ugu fiican ee la heli karo.
Xaaladda hawsha xigta dhaxasho
Qeex waxa run ahaan u ahaan lahaa hawsha ka hor, inta ay hayso gelitaan gaar ah, iyo ka dib marka ay dhammaato, oo ay ku jirto baajinta. Xaaladda dhammaadka ayaa ah tan inta badan si cad loo sheegto, waana tan hawsha xigta dhaxasho. Ku qor pipeline-ka agtiisa halkii aad kaga tegi lahayd xusuusta qof.
| Moment | What proves it | What leaks if it is skipped |
|---|---|---|
| Job start: pre-flight route check | The route table shows no tunnel from an earlier job, and the profile list is empty | A stale route sends deployment traffic into a dead tunnel |
| Job end: disconnect and shred | The profile is down and the temporary key file is gone | The next job inherits an open tunnel and a usable credential |
| Cancelled job: reboot or disposal | The host is replaced or rebooted before the next job starts | A killed process leaves the tunnel up with no owner |
Agent u gaar ah ama hal-mar ah ayaa xadkaas ka dhigaya mid fudud in la dhaqan geliyo. Container ama namespace waxay caawiyaan kaliya haddii habaynta shabakadeeda iyo mudnaanteedu si dhab ah u go'doomiso isbeddelka.
Jooji xiriirka, ma aha barnaamijka
Isticmaal waddada dhammaystirka pipeline-ka si aad u xirto xiriirka hawshan bilowday oo aad uga saarto aqoonsigeeda ku meel gaadhka ah. Ha isbarbar dhiggin habab magaca barnaamijka ku salaysan host-ka ay hawlo kale isticmaalaan; jooji xiriirka gaar ah. Labada amarro ee hoose waa nadiifinta oo dhan, midkoodna kuma xirna helitaanka hab.
vpn-cli disconnect --profile "$PROFILE"
rm -f "$RUNNER_TEMP/client.key"Dhammaystirku ma aha go'doomin: runner-ka dhinta wuxuu hayaa tunnel-ka uu furay, habka si xoog ah loo joojiyayna gebi ahaan buu uga boodaa block-ka. Taasi waa sababta amarka nadiifinta keligiis uusan noqon karin nashqadda oo dhan. Sidan ayaa ficil ahaan ugu guuldarraysta: hawsha deployment-ka waxaa la baajiyay tallaabada koobinta, block-ka dhammaystirka waligiis ma shaqeeyo, hawsha xigta ee isla host-ka waxay bilaabataa tunnel nool iyo waddo tilmaamaysa shabakad ay gaari karin. Guuldarraysta waxay u ekaataa dhibaato 'DNS' ah build-ka xiga, saacado ka dib markii hawshii sababtay ay dhammaatay.
Ku qor magaca profile-ka iyo waddada aqoonsiga natiijada hawsha. Amarka furitaanka ee qaawan oo aan aqoonsi lahayn waa adag tahay in mustaqbalka la xisaabtamo. Safka log-ka ayaa sidoo kale caddeeya in block-ku shaqeeyay marka baaritaan dambe weydiiyo.
Siin hawsha host aan qof kale isticmaalin
Kaabayaasha hal-mar ah waxay tirtiraan dhibaatada dhaxalka halkii ay maamuli lahaayeen. Agent cusub hawsha kasta wuxuu bilaabmaa waddo la'aan, profile la'aan iyo aqoonsi qof kale la'aan, burburintiisuna waxay nadiifisaa wax kasta oo hawshu ka tagtay. Taasi build kasta waa qaali, waana qiimaha daacadda ah ee xad aan ku xirnayn koodhka nadiifinta. Hawlaha taabta shabakadaha production-ka, caadi ahaan waa doorashada ka jaban marka shilalka la tiriya.
Halka runner la wadaago uu ku sii jiri doono, tijaabi guuldarrada iyo baajinta si taxadar leh sida koobinta guuleysatay. Tijaabadu waa inay muujiso waxa hawsha xigta arki lahayd haddii tan badhtamaha laga baajiyo. Hawshu dhammaatay marka gelitaankeeda iyo xaaladdeeda ku meel gaadhka ah ay dhammaadeen, ma aha marka amarka koobintu eber soo celiyo.