feat(k8s): 新增 core 真应用(前端+Django API+Celery worker)构建与部署

- core/frontend: Vite 多阶段镜像 + nginx 同源反代 /api,/admin,/static(零 CORS) - core/backend: Django gunicorn 镜像 + entrypoint(自动 migrate/collectstatic)+ WhiteNoise - k8s/core: api/worker/web Deployment+Service + ingress(airshelf-web.airlabs.art) - workflow: 追加 core 前后端 build/push,从 core/backend/.env 套生产覆盖生成 env Secret 后部署 - .gitignore 放行 core/backend/.env;.env 白名单加入 airshelf-web 域名 - 含前端 WIP 还原改动 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-05 10:21:41 +08:00
parent cfdcd84a30
commit d41e487f08
37 changed files with 4108 additions and 456 deletions
@@ -27,6 +27,7 @@ jobs:
            echo "CR_ORG=prod" >> $GITHUB_ENV
            echo "DEPLOY_ENV=production" >> $GITHUB_ENV
            echo "DOMAIN_WEB=airshelf.airlabs.art" >> $GITHUB_ENV
+            echo "DOMAIN_CORE=airshelf-web.airlabs.art" >> $GITHUB_ENV
          elif [[ "${{ github.ref_name }}" == "dev" ]]; then
            echo "IMAGE_TAG=dev-${BUILD_DATE}-${SHORT_SHA}" >> $GITHUB_ENV
            echo "CR_SERVER_ACTIVE=${{ secrets.CR_SERVER }}" >> $GITHUB_ENV
@@ -35,6 +36,7 @@ jobs:
            echo "CR_ORG=dev" >> $GITHUB_ENV
            echo "DEPLOY_ENV=development" >> $GITHUB_ENV
            echo "DOMAIN_WEB=airshelf.test.airlabs.art" >> $GITHUB_ENV
+            echo "DOMAIN_CORE=airshelf-web.test.airlabs.art" >> $GITHUB_ENV
          fi

      - name: Login to Volcano Engine CR
@@ -63,6 +65,50 @@ jobs:
          done
          [ $ok -eq 1 ] || { echo "ERROR: web push failed after 3 attempts"; exit 1; }

+      - name: Build and Push Core API (Django)
+        id: build_core_api
+        run: |
+          set -o pipefail
+          ok=0
+          for attempt in 1 2 3; do
+            echo "Build core-api attempt $attempt/3..."
+            DOCKER_BUILDKIT=0 docker build \
+              --tag ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/airshelf-core-api:${{ env.IMAGE_TAG }} \
+              --tag ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/airshelf-core-api:latest \
+              "./core/backend" 2>&1 | tee /tmp/build-core-api.log && { ok=1; break; }
+            echo "Attempt $attempt failed, retrying in 10s..." && sleep 10
+          done
+          [ $ok -eq 1 ] || { echo "ERROR: core-api build failed after 3 attempts"; exit 1; }
+          ok=0
+          for attempt in 1 2 3; do
+            docker push ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/airshelf-core-api:${{ env.IMAGE_TAG }} && \
+            docker push ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/airshelf-core-api:latest && { ok=1; break; }
+            echo "Push attempt $attempt failed, retrying in 10s..." && sleep 10
+          done
+          [ $ok -eq 1 ] || { echo "ERROR: core-api push failed after 3 attempts"; exit 1; }
+
+      - name: Build and Push Core Web (React/Vite)
+        id: build_core_web
+        run: |
+          set -o pipefail
+          ok=0
+          for attempt in 1 2 3; do
+            echo "Build core-web attempt $attempt/3..."
+            DOCKER_BUILDKIT=0 docker build \
+              --tag ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/airshelf-core-web:${{ env.IMAGE_TAG }} \
+              --tag ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/airshelf-core-web:latest \
+              "./core/frontend" 2>&1 | tee /tmp/build-core-web.log && { ok=1; break; }
+            echo "Attempt $attempt failed, retrying in 10s..." && sleep 10
+          done
+          [ $ok -eq 1 ] || { echo "ERROR: core-web build failed after 3 attempts"; exit 1; }
+          ok=0
+          for attempt in 1 2 3; do
+            docker push ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/airshelf-core-web:${{ env.IMAGE_TAG }} && \
+            docker push ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/airshelf-core-web:latest && { ok=1; break; }
+            echo "Push attempt $attempt failed, retrying in 10s..." && sleep 10
+          done
+          [ $ok -eq 1 ] || { echo "ERROR: core-web push failed after 3 attempts"; exit 1; }
+
      - name: Setup Kubectl
        run: |
          if ! command -v kubectl &>/dev/null; then
@@ -94,12 +140,32 @@ jobs:
          echo "Environment: ${{ env.DEPLOY_ENV }}"
          CR_IMAGE="${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}"

-          # Replace image placeholders
+          # Replace image placeholders (PRD design site)
          sed -i "s|\${CI_REGISTRY_IMAGE}/airshelf-web:latest|${CR_IMAGE}/airshelf-web:${{ env.IMAGE_TAG }}|g" k8s/web-deployment.yaml

          # Replace domain placeholder in ingress
          sed -i "s|airshelf.airlabs.art|${{ env.DOMAIN_WEB }}|g" k8s/ingress.yaml

+          # ===== Core (real app) image + domain substitution =====
+          sed -i "s|\${CI_REGISTRY_IMAGE}/airshelf-core-api:latest|${CR_IMAGE}/airshelf-core-api:${{ env.IMAGE_TAG }}|g" k8s/core/api-deployment.yaml k8s/core/worker-deployment.yaml
+          sed -i "s|\${CI_REGISTRY_IMAGE}/airshelf-core-web:latest|${CR_IMAGE}/airshelf-core-web:${{ env.IMAGE_TAG }}|g" k8s/core/web-deployment.yaml
+          sed -i "s|airshelf-web.airlabs.art|${{ env.DOMAIN_CORE }}|g" k8s/core/ingress.yaml
+
+          # ===== Build core env file: core/backend/.env + production overrides =====
+          # Source of truth is core/backend/.env (committed; real MySQL + managed Redis + TOS + ARK).
+          # Override only the env-specific bits; DB_BIND_ADDRESS is dropped (dev LAN IP
+          # has no NIC in-cluster), settings -> production, hosts/CSRF/CORS -> the domain.
+          grep -vE '^\s*(#|$)' core/backend/.env \
+            | grep -vE '^(DJANGO_SETTINGS_MODULE|DJANGO_DEBUG|DB_BIND_ADDRESS|DJANGO_ALLOWED_HOSTS|DJANGO_CSRF_TRUSTED_ORIGINS|CORS_ALLOWED_ORIGINS)=' \
+            > /tmp/core.env
+          {
+            echo "DJANGO_SETTINGS_MODULE=airshelf.settings.production"
+            echo "DJANGO_DEBUG=false"
+            echo "DJANGO_ALLOWED_HOSTS=airshelf-web.airlabs.art,${{ env.DOMAIN_CORE }},localhost,127.0.0.1"
+            echo "DJANGO_CSRF_TRUSTED_ORIGINS=https://airshelf-web.airlabs.art,https://${{ env.DOMAIN_CORE }}"
+            echo "CORS_ALLOWED_ORIGINS=https://airshelf-web.airlabs.art,https://${{ env.DOMAIN_CORE }}"
+          } >> /tmp/core.env
+
          # All kubectl operations with retry (K3s 内网连接可能抖动)
          export KUBECTL_TIMEOUT="--request-timeout=4s"

@@ -114,16 +180,32 @@ jobs:
                --docker-password="${{ env.CR_PASSWORD_ACTIVE }}" \
                --dry-run=client -o yaml | kubectl $KUBECTL_TIMEOUT apply -f -

-              # Apply manifests
+              # Core backend env secret (real MySQL / managed Redis / TOS / ARK)
+              kubectl $KUBECTL_TIMEOUT create secret generic airshelf-core-env \
+                --from-env-file=/tmp/core.env \
+                --dry-run=client -o yaml | kubectl $KUBECTL_TIMEOUT apply -f -
+
+              # Apply manifests — shared infra
              kubectl $KUBECTL_TIMEOUT apply -f k8s/cert-manager-issuer.yaml
              kubectl $KUBECTL_TIMEOUT apply -f k8s/redirect-https-middleware.yaml
+
+              # PRD design site
              kubectl $KUBECTL_TIMEOUT apply -f k8s/web-deployment.yaml
              kubectl $KUBECTL_TIMEOUT apply -f k8s/ingress.yaml

+              # Core real app (api + celery worker + web + ingress)
+              kubectl $KUBECTL_TIMEOUT apply -f k8s/core/api-deployment.yaml
+              kubectl $KUBECTL_TIMEOUT apply -f k8s/core/worker-deployment.yaml
+              kubectl $KUBECTL_TIMEOUT apply -f k8s/core/web-deployment.yaml
+              kubectl $KUBECTL_TIMEOUT apply -f k8s/core/ingress.yaml
+
              # Preserve real client IP
              kubectl $KUBECTL_TIMEOUT patch svc traefik -n kube-system -p '{"spec":{"externalTrafficPolicy":"Local"}}' 2>/dev/null || true

              kubectl $KUBECTL_TIMEOUT rollout restart deployment/airshelf-web
+              kubectl $KUBECTL_TIMEOUT rollout restart deployment/airshelf-core-api
+              kubectl $KUBECTL_TIMEOUT rollout restart deployment/airshelf-core-worker
+              kubectl $KUBECTL_TIMEOUT rollout restart deployment/airshelf-core-web
            } 2>&1 | tee /tmp/deploy.log && { ok=1; break; }
            echo "Attempt $attempt failed, retrying in 30s..."
            sleep 30
@@ -143,6 +225,16 @@ jobs:
            if [ -f /tmp/build.log ]; then
              BUILD_LOG=$(tail -50 /tmp/build.log | sed 's/"/\\"/g' | sed ':a;N;$!ba;s/\n/\\n/g')
            fi
+          elif [[ "${{ steps.build_core_api.outcome }}" == "failure" ]]; then
+            FAILED_STEP="build"
+            if [ -f /tmp/build-core-api.log ]; then
+              BUILD_LOG=$(tail -50 /tmp/build-core-api.log | sed 's/"/\\"/g' | sed ':a;N;$!ba;s/\n/\\n/g')
+            fi
+          elif [[ "${{ steps.build_core_web.outcome }}" == "failure" ]]; then
+            FAILED_STEP="build"
+            if [ -f /tmp/build-core-web.log ]; then
+              BUILD_LOG=$(tail -50 /tmp/build-core-web.log | sed 's/"/\\"/g' | sed ':a;N;$!ba;s/\n/\\n/g')
+            fi
          elif [[ "${{ steps.deploy.outcome }}" == "failure" ]]; then
            FAILED_STEP="deploy"
            if [ -f /tmp/deploy.log ]; then