GitHub Actions ma gaaro VPN-kaaga: runner u gaar ah ama tunnel

Tallaabadaada deploy waxay ku hakataa hostname gudaha ah halka isla amarkaas si degdeg ah kaaga jawaabo laptop-kaaga, iyo client build-ka labada mishiin waa isku mid. Job-ku wuxuu ku socdaa runner uu GitHub martigeliyo: mishiin farsamo oo loo abuuray isla job-kaas gudaha daruuraha GitHub, oo aan waddo u lahayn booska cinwaannadaada gaarka ah, oo aan lahayn resolver diiwaan gelin aagga gudaha iyo aan lahayn shahaado uu endpoint-ka gaarka ahi aqbali doono. Kaliya laba nashqad ayaa ku habboon xaddidaaddaas, mana jirto mid la shidi karo mustaqbalka iyada oo aan workflow-ga dib loo dhisin. Dooro inta u dhaxaysa ka hor inta aan la gaarin khadka ugu horreeya YAML, maxaa yeelay guuritaanka dambe wuxuu ka qaalisan yahay isku dayga ugu horreeya.

Doorashadu waxay u dhaxaysaa runner la dhigo halka shabakaddu hore u dhammaato iyo tunnel jira oo kaliya hal job. Labaduba sannado ayay qaadeen deploy product, waxayna ku guuldareystaan siyaabo kala duwan.

Xaggee xadka dhab ahaan yaal

Wax kasta oo aad laptop-ka ku rakibto waxay ku joogtaa laptop-ka, wax kasta oo aad job-ka intiisa ku rakibto waxay la lunto runner-ka. Ma jiro namespace shabakadeed joogto ah oo client-ku ku dhegi karo inta u dhaxaysa socodka, sidaas darteed socod kastaa wuxuu ka bilaabmaa isla xaaladdaas aan la gaari karin. Azure waxay diiwaangelisay xadkan agent-yada Microsoft martigeliso, halkaas oo xiriirada VPN iyo ExpressRoute ee shabakadaha gaarka ah aan la taageerayn, runner-yada GitHub martigeliyana waxay qaadaan isla noocaas xaddidaadda, ma aha hannaan gaar ah. U akhri sidatan sifo badeeco ah, ma aha cillad la dhaafi karo.

Ma jiro dejinta repository oo tan dabacsaysa. Calaamadda job-ka ayaa go'aamisa poolka shaqada qaata, calaamad martigeliyana waxay ka dhigan tahay mishiin ka baxsan xadkaaga socodka oo dhan.

Sidaas darteed gaaritaanka gaarka ah waa inuu ka yimaado shay aad leedahay. Runner la dhigay halka shabakaddu hore u dhammaato, ama tunnel nool hal job. Qaybta kale ee maqaalku waxay ka hadlaysaa si ula kac ah u bixin mid ka mid ah labadaas, halkii aad ka heli lahayd biilka product-ka.

Go'aanso iyadoo eegaysa inta jeer ee socodka, ma aha caadada

Isticmaal runner u gaar ah gudaha VPC ama shabakadda xafiiska marka deploy-yadu dhowr jeer maalintii yimaadaan, marka job-ku taabto in ka badan hal port gaar ah, ama marka kooxda platform hore u maamusho patch-ka iyo wareegga aqoonsiga. Job-ka mishiinkaas wuxuu u xalliyaa oo u jiheeyaa sida host kale oo ka dambeeya firewall-ka. Shaqada shabakaddu hal mar bay dhacdaa, xilliga rakibidda, ma aha socod kasta.

Ka dhis tunnel-ka gudaha job-ka marka gelitaanku naadir yahay oo aadan rabin agent cimri dheer oo aqoonsi ku haysta shabakaddaada. Job-ku wuxuu noqdaa client shabakadeed u gaar ah dhowr daqiiqo oo waxba kama tago, taas oo inta badan yihiin ujeeddada oo dhan.

Qiyaas kharashka tunnel-ka ka hor inta aadan dooran. Socod kastaa wuxuu bixiyaa sameynta profile-ka, bilaabista client-ka, diyaargarowga iyo duminta. Tunnel kor u soo baxa laakiin aan waligiis la xaqiijin waxay soo saartaa deploy badhka ku guuldareysta oo xaaladda gaarka ah uga tagta qaab aan cidna qorsheynin. Isku dayga dambe ayaa dhif ah inuu nadiif noqdo, guuldarada labaadna inta badan waxaa lagu eedeeyaa nooca client-ka.

Qorista profile-ka si tallaabadu uusan u jabin karin

Hayso profile-yada iyo aqoonsiga meel ka baxsan repository-ka oo ka samee secret-ka tallaabada u baahan. Nidaamka ayaa go'aamiya haddii job-ku noolaan doono: fayl lagu abuuray sudo waxaa iska leh root, shell-ka tallaabada ee aan mudnaanta lahayn ma qori karo mar dambe.

- name: Bring up OpenVPN
  run: |
    umask 077
    profile="$RUNNER_TEMP/client.ovpn"
    printf '%s\n' "$VPN_PROFILE" > "$profile"
    : > "$RUNNER_TEMP/openvpn.log"
    printf '%s\n' "$VPN_CREDENTIALS" > "$RUNNER_TEMP/credentials.txt"
    sudo openvpn --daemon openvpn-job \
      --config "$profile" \
      --auth-user-pass "$RUNNER_TEMP/credentials.txt" \
      --writepid "$RUNNER_TEMP/openvpn.pid" \
      --log "$RUNNER_TEMP/openvpn.log"

Labada faahfaahin ee block-kaas waxay u jiraan tallaabooyinka dambe. umask 077 awgeed profile-ku wuxuu ku dhacaa qaabka 0600 oo uu leeyahay isticmaalaha runner-ka, sudo weli wuu akhrin karaa, client-kuna log-kiisa wuxuu ku qoraa fayl uu runner-ku hore u leeyahay, sidaas darteed wareegga diyaargarowga wuxuu akhrin karaa log-kaas isagoo aan u baahnayn sudo labaad. --writepid wuxuu diiwaangelinayaa PID-ka uu dumintu bartilmaameedsan doonto.

Profile ku xaqiijiya shahaado client wuxuu u baahan yahay furaha si la mid ah loo qoray, profile static-challenge-na wuxuu u baahan yahay qaabka auth ee u dhigma. Profile-yada riixa doorashooyinka DNS waxay u baahan yihiin openvpn-systemd-resolved Ubuntu iyo Debian, maxaa yeelay riixitaanka keligiis waxba kama beddelo sawirka aasaasiga ah.

Diyaargarowgu waa baaritaan, ma aha joogitaan

Sleep go'an wuxuu socdaa ilaa daqiiqada concentrator-ku gaabiyo, ka dibna tallaabada deploy waxay socotaa ka hor inta aan waddadu jirin. Guuldaradu waxay markaas ka soo baxdaa gudaha qalabka deploy sida timeout ku ah host-ka gaarka ah, taas oo wax ka sheegayn tunnel-ka.

- name: Await private endpoint
  run: |
    for attempt in $(seq 1 30); do
      if getent hosts private.example.internal > /dev/null && \
         timeout 3 bash -c 'exec 3<>/dev/tcp/private.example.internal/8443' 2>/dev/null; then
        echo "endpoint answered after $attempt attempts"
        exit 0
      fi
      sleep 2
    done
    grep -Ei 'error|verify|auth' "$RUNNER_TEMP/openvpn.log" | tail -40
    exit 1

Wareeggu wuxuu fiiriyaa laba shay maxaa yeelay mid kastaaba wuxuu noqon karaa qaybta jabtay. getent hosts wuxuu caddeeyaa in resolver-ka la riixay uu ka jawaabo magacaas, furitaanka socket-kana wuxuu caddeeyaa in wax ku dhageysanayaan port-ka uu deploy-ku isticmaali doono; profile waddo kaliya leh wuxuu u baahan yahay cinwaanka dhabta ah iyo in la tirtiro khadka getent.

Marka wareeggu dhamaado, log-ku waa waxa kaliya ee kala sooca saddex cilladood oo kala duwan: shahaado la diiday, qaab auth khaldan iyo waddo aan waligeed iman. Shaandhaynta ka hor tail waxay haysaa natiijadaas gaaban oo ku filan in la akhriyo inta job-ku weli guuldareysto. Akhri qaladka ugu horreeya ee ha akhrin khadka ugu dambeeya, maxaa yeelay client-ka aan xaqiijin karin wuu is celiyaa ilaa wareeggu iska dhiro. ip -4 route show dev tun0 wuxuu ka jawaabaa su'aasha fudud ee ah in waddo la riixay iyo in kale, wuxuuna ku kacaa hal khad isla wareeggaas.

Dumin iyo su'aasha artifact-ka

Ku soo afjar job-ka tallaabad ku ilaalisan if: always() oo fulisa sudo kill "$(sudo cat "$RUNNER_TEMP/openvpn.pid")" oo aan wax kale fulin. Runner u gaar ah oo la wadaago waligaa ha ku dilin magaca hannaanka: job kale wuxuu yeelan karaa client isla binary iyo doodaha la mid ah. Guuldaradu markaas waxay ku dhacdaa job-ka labaad socday, log-kiisuna wuxuu tilmaamaa workflow aan waxba khaldan gelin.

Ilaalintu waa muhiim maxaa yeelay deploy guuldareystay weli wuxuu ka taga tunnel nool. La'aanta always() tallaabada nadiifinta waa la boodaa isla marka loo baahan yahay, socodka xigana wuxuu ka bilaabmaa client hore u xiran.

Hal su'aal ayaa hadhay ka hor inta aadan qaadan mid ka mid ah labada nashqad: ma u baahan tahay tallaabada build waddo gaar ah? Agent deployment oo hore u fadhiya shabakadda gudaha wuxuu soo jiidan karaa artifact la ansixiyay, taas oo build-yada caadiga ah ka fogaanaysa waddada gaarka ah. Job-yo yar oo tunnel haysta waxay ka dhigan tahay meelo yar oo waddo duug ah ku dhuuman karto.