I-GitHub Actions ayifinyeleli i-VPN yakho: i-runner yakho noma umhubhe

Isinyathelo sakho se-deploy silenga phezu kwe-hostname yangaphakathi kuyilapho umyalo ofanayo uphendula ngokushesha kusuka kukhompyutha yakho, futhi i-client build kuyo yomibili imishini iyafana. I-job igijima ku-runner esingathwe yi-GitHub: umshini wokufakelwa owakhiwe ngenxa yaleyo job eyodwa ngaphakathi kwefu le-GitHub, ngaphandle komzila ongena endaweni yakho yamakheli yangasese, ngaphandle kombhalo we-resolver wesifunda sangaphakathi nangaphandle kwesitifiketi i-endpoint yangasese engayamukela. Amaqhinga amabili kuphela ahambisana nalowo mkhawulo, futhi alikho nelilodwa ongalivula kamuva ngaphandle kokwakha kabusha i-workflow. Khetha phakathi kwabo ngaphambi komugqa wokuqala we-YAML, ngoba ukuthuthela kamuva kubiza kakhulu kunomzamo wokuqala.

Ukukhetha kuphakathi kwe-runner ebekwe lapho inethiwekhi isiphelela khona nomhubhe ophila isikhathi se-job eyodwa. Kokubili sekuthwele ama-deploy okukhiqiza iminyaka eminingi, futhi kwehluleka ngezindlela ezihlukile.

Uphi umngcele ngempela

Konke okufaka kukhompyutha kuyama kukhompyutha, futhi konke okufaka ngesikhathi se-job kuyanyamalala kanye ne-runner. Akukho namespace yenethiwekhi ehlala njalo i-client engabambelela kuyo phakathi kokugijima, ngakho ukugijima ngakunye kuqala esimweni esifanayo esingafinyeleleki. I-Azure ibhala lo mngcele kuma-agent asingathwe yi-Microsoft, lapho ukuxhumana kwe-VPN ne-ExpressRoute kungena kunethiwekhi yangasese kungasekelwa, futhi ama-runner asingathwe yi-GitHub athwala uhlobo olufanayo lomkhawulo hhayi indlela ehlukile. Kufunde njengesici somkhiqizo, hhayi njengesiphambeko okufanele usigweme.

Akukho silungiselelo se-repository esikhulula lokhu. Ilebula ye-job inquma ukuthi iyiphi i-pool ethatha umsebenzi, futhi ilebula esingathiwe isho umshini ongaphandle komngcele wakho ngaso sonke isikhathi sokugijima.

Ngakho ukufinyeleleka kwangasese kufanele kuvele entweni oyiphethe. I-runner ebekwe lapho inethiwekhi isiphelela khona, noma umhubhe ophila i-job eyodwa. Ingxenye esele yesihloko ikhuluma ngokukhokhela ngamabomu enye yalezi, esikhundleni sokuthola ibhili ekukhiqizeni.

Nquma ngokuvama kokugijima, hhayi ngokujwayela

Sebenzisa i-runner yakho ngaphakathi kwe-VPC noma inethiwekhi yasehhovisi lapho ama-deploy efika izikhathi eziningi ngosuku, lapho i-job ithinta i-port yangasese engaphezu kweyodwa, noma lapho ithimba lepulatifomu selivele liphethe ukulungisa namarobhothi ezitifiketi. I-job kuleyo mshini ixazulula futhi ihambisa umzila njenganoma iyiphi enye i-host engemuva kwe-firewall. Umsebenzi wenethiwekhi wenzeka kanye, ngesikhathi sokufaka, hhayi kukho konke ukugijima.

Yakha umhubhe ngaphakathi kwe-job lapho ukufinyelela kuyenzeka ngezikhathi ezithile futhi ungafuni i-agent ephila isikhathi eside ephethe isitifiketi kungena kunethiwekhi yakho. I-job iba iklayenti layo lenethiwekhi imizuzu embalwa futhi ayishiye lutho ngemuva, okuvamise ukuba yiyo yonke injongo.

Linganisela izindleko zomhubhe ngaphambi kokuwukhetha. Ukugijima ngakunye kukhokhela ukwenziwa kweprofayela, ukuqalisa iklayenti, ukulungela nokuhlakazwa. Umhubhe ophuma kodwa ongakaze uqinisekiswe ukhiqiza i-deploy ehluleka phakathi nendlela futhi ishiye isimo sangasese ngesimo okungekho muntu owahlela. Umzamo wokuphinda ngemuva kwalokho awuvamisile ukuba mhlophe, futhi ukwehluleka kwesibili kuvame ukubekwa ethanjeni lenguqulo yeklayenti.

Ukubhala iphrofayela ukuze isinyathelo singakwazi ukunqanyulwa

Gcina amaphrofayela nezitifiketi ngaphandle kwerepository futhi uzenze zivela ku-secret esinyathelweni esizidingayo. Ukulandelana kunquma ukuthi i-job izophila yini: ifayela elenziwe ngaphansi kwe-sudo lingelika-root, futhi i-shell yesinyathelo engenamalungelo ayikwazi ukubhala kulo.

- name: Bring up OpenVPN
  run: |
    umask 077
    profile="$RUNNER_TEMP/client.ovpn"
    printf '%s\n' "$VPN_PROFILE" > "$profile"
    : > "$RUNNER_TEMP/openvpn.log"
    printf '%s\n' "$VPN_CREDENTIALS" > "$RUNNER_TEMP/credentials.txt"
    sudo openvpn --daemon openvpn-job \
      --config "$profile" \
      --auth-user-pass "$RUNNER_TEMP/credentials.txt" \
      --writepid "$RUNNER_TEMP/openvpn.pid" \
      --log "$RUNNER_TEMP/openvpn.log"

Kokubili imininingwane kulelo block kungokwezinyathelo ezizayo. Uma kusetshenziswa umask 077, iphrofayela ifika kumodi engu-0600 futhi ingeyomsebenzisi we-runner, i-sudo isengayifunda, futhi iklayenti libhala ilogi yalo efayeleni i-runner esivele inalo, ngakho umjikelezo wokulungela ungafunda lelo logi ngaphandle kwe-sudo yesibili. --writepid ibhala i-PID umhlakazo ozobhekana nayo.

Iphrofayela ezifakazela ngesitifiketi sekhayenti idinga ukhiye wayo obhalwe ngendlela efanayo, futhi iphrofayela ye-static-challenge idinga imodi ye-auth ehambisanayo. Amaphrofayela aphusha izinketho ze-DNS adinga openvpn-systemd-resolved ku-Ubuntu naku-Debian, ngoba ukushiya kukodwa akushintshi lutho kusithombe sesisekelo.

Ukulungela kuwukuhlola, hhayi ukuma

I-sleep ebekiwe ihlala kwaze kwaba yisikhathi lapho i-concentrator inensa khona, bese isinyathelo se-deploy sigijima ngaphambi kokuba umzila ube khona. Ukwehluleka ke kuvela ngaphakathi kwethuluzi le-deploy njenge-timeout eya ku-host yangasese, lokho okungasho lutho ngomhubhe.

- name: Await private endpoint
  run: |
    for attempt in $(seq 1 30); do
      if getent hosts private.example.internal > /dev/null && \
         timeout 3 bash -c 'exec 3<>/dev/tcp/private.example.internal/8443' 2>/dev/null; then
        echo "endpoint answered after $attempt attempts"
        exit 0
      fi
      sleep 2
    done
    grep -Ei 'error|verify|auth' "$RUNNER_TEMP/openvpn.log" | tail -40
    exit 1

Umjikelezo ubheka izinto ezimbili ngoba noma yikuphi kungaba yingxenye ephukile. getent hosts ifakazela ukuthi i-resolver eshiyiwe iphendula ngalelo gama, futhi ukuvulwa kwe-socket kufakazela ukuthi kukhona okulalelayo ku-port ezosetshenziswa yi-deploy; iphrofayela enomzila kuphela idinga ikheli langempela kanye nomugqa getent osusiwe.

Lapho umjikelezo uphela khona, ilogi iyona kuphela ehlukanisa iziphambeko ezintathu ezihlukene: isitifiketi esenqatshiwe, imodi ye-auth engalungile nomzila ongakaze ufike. Ukuhlunga ngaphambi kwe-tail kugcina lokho kuphuma kukufushane ngokwanele ukuba kufundwe ngesikhathi i-job isahluleka. Funda iphutha lokuqala hhayi umugqa wokugcina, ngoba iklayenti elingakwazi ukuzifakazela liziphindaphinda kuze kube umjikelezo unikezela. ip -4 route show dev tun0 iphendula umbuzo olula wokuthi ngabe umzila washitshwa nhlobo yini, futhi kubiza umugqa owodwa kulo mjikelezo.

Ukuhlakaza kanye nombuzo we-artifact

Vala i-job ngesinyathelo esivikelwe ngu if: always() esisebenzisa sudo kill "$(sudo cat "$RUNNER_TEMP/openvpn.pid")" futhi akukho okunye. Ku-runner yakho eyabiwe ungabulali ngaso sonke isikhathi ngegama lenqubo: enye i-job ingaba neklayenti eline-binary efanayo nezimpikiswano ezifanayo. Ukwehluleka khona kuwela ku-job egijime yesibili, futhi ilogi yayo ikhomba i-workflow engazange yenza iphutha.

Isivikelo sibalulekile ngoba i-deploy ehlulekile isashiya umhubhe ophilayo. Ngaphandle kokusebenzisa always() isinyathelo sokuhlanza siyatshitshwa ngaso leso sikhathi lapho sifuneka khona, futhi ukugijima okulandelayo kuqala kubhekene neklayenti esivele ixhunyiwe.

Umbuzo owodwa usale ngaphambi kokwamukela noma yiluphi lwamaqhinga amabili: ingabe isigaba se-build sidinga umzila wangasese nhlobo? I-agent ye-deployment esivele ihlezi ngaphakathi kwenethiwekhi ingadonsa i-artifact egunyaziwe, futhi lokho kugcina ama-build avamile kude nomzila wangasese. Ama-job ambalwa aphethe umhubhe asho izindawo ezimbalwa lapho umzila omdala ungacasha khona.