## 前言

CI/CD 的终点站是 K8s。本篇从零开始搭建一条"代码提交 → 镜像构建 → 自动部署到 K8s → 健康检查 → 失败自动回滚"的完整流水线。跟着做完，你就有了生产可用的 K8s 部署自动化能力。

---

## 一、前置准备

### K8s 集群配置

```bash
# 在 GitLab Runner 所在节点配置 kubeconfig
# 方式1：ServiceAccount + RBAC（推荐）

# 创建专用 ServiceAccount
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: ServiceAccount
metadata:
  name: gitlab-deployer
  namespace: myapp-prod
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: gitlab-deployer-role
  namespace: myapp-prod
rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["get", "list", "watch", "update", "patch"]
  - apiGroups: [""]
    resources: ["services", "configmaps", "secrets", "pods", "pods/log"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: gitlab-deployer-binding
  namespace: myapp-prod
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: gitlab-deployer-role
subjects:
  - kind: ServiceAccount
    name: gitlab-deployer
    namespace: myapp-prod
EOF

# 生成 kubeconfig
CLUSTER_NAME=$(kubectl config view --minify -o jsonpath='{.clusters[0].name}')
SERVER_URL=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
SA_TOKEN=$(kubectl -n myapp-prod create token gitlab-deployer)
CA_CERT=$(kubectl -n myapp-prod get secret gitlab-deployer-token -o jsonpath='{.data.ca\.crt}' | base64 -d)

cat <<EOF > kubeconfig-gitlab
apiVersion: v1
kind: Config
clusters:
  - name: ${CLUSTER_NAME}
    cluster:
      server: ${SERVER_URL}
      certificate-authority-data: $(echo $CA_CERT | base64 -w 0)
contexts:
  - name: gitlab-context
    context:
      cluster: ${CLUSTER_NAME}
      namespace: myapp-prod
      user: gitlab-deployer
current-context: gitlab-context
users:
  - name: gitlab-deployer
    user:
      token: ${SA_TOKEN}
EOF
```

将 `kubeconfig-gitlab` 的内容上传到 GitLab → Settings → CI/CD → Variables：
- Key: `KUBECONFIG_PROD`
- Type: File
- Protected: ✓

---

## 二、部署模板

### K8s 部署清单模板

```yaml
# deploy/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  labels:
    app: myapp
spec:
  replicas: 4
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
      - name: app
        image: registry.mycompany.com/myapp:latest  # CI 中会被替换
        ports:
        - containerPort: 8080
        env:
        - name: SPRING_PROFILES_ACTIVE
          valueFrom:
            configMapKeyRef:
              name: app-config
              key: active-profile
        resources:
          requests:
            cpu: 500m
            memory: 512Mi
          limits:
            cpu: 1000m
            memory: 1Gi
        readinessProbe:
          httpGet:
            path: /actuator/health/readiness
            port: 8080
          initialDelaySeconds: 15
          periodSeconds: 5
          failureThreshold: 3
        livenessProbe:
          httpGet:
            path: /actuator/health/liveness
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
          failureThreshold: 3
        lifecycle:
          preStop:
            exec:
              command: ["sh", "-c", "sleep 10"]  # 优雅关闭
```

### GitLab CI 部署 Job

```yaml
.deploy-k8s:
  image: 
    name: bitnami/kubectl:1.29
    entrypoint: [""]
  variables:
    KUBECONFIG: $KUBECONFIG_PATH
  before_script:
    - export KUBECONFIG=$KUBECONFIG_PATH
  script:
    # 替换镜像标签
    - sed -i "s|registry.mycompany.com/myapp:latest|$IMAGE:$TAG|g" deploy/deployment.yaml
    # 应用配置
    - kubectl apply -f deploy/ -n $NAMESPACE
    # 等待滚动更新完成
    - kubectl rollout status deployment/myapp -n $NAMESPACE --timeout=$TIMEOUT
    # 健康验证
    - |
      for i in $(seq 1 12); do
        READY=$(kubectl get deployment myapp -n $NAMESPACE -o jsonpath='{.status.readyReplicas}')
        DESIRED=$(kubectl get deployment myapp -n $NAMESPACE -o jsonpath='{.status.replicas}')
        if [ "$READY" = "$DESIRED" ]; then
          echo "All $READY pods are ready"
          break
        fi
        echo "Waiting for pods to be ready ($READY/$DESIRED)..."
        sleep 10
      done
      if [ "$READY" != "$DESIRED" ]; then
        echo "Deployment failed: only $READY of $DESIRED pods ready"
        kubectl rollout undo deployment/myapp -n $NAMESPACE
        exit 1
      fi
  after_script:
    - rm -f $KUBECONFIG_PATH  # 清理 kubeconfig
```

---

## 三、金丝雀部署

### 配置金丝雀部署

```yaml
# 金丝雀部署：先更新1个Pod，观察指标，再全量更新
deploy-canary:
  extends: .deploy-k8s
  stage: deploy-prod
  environment:
    name: production
  variables:
    NAMESPACE: "myapp-prod"
    IMAGE: "$REGISTRY/myapp"
    TAG: "$CI_COMMIT_SHORT_SHA"
    KUBECONFIG_PATH: "$KUBECONFIG_PROD"
    TIMEOUT: "300s"
  script:
    # 1. 记录当前镜像版本（用于回滚）
    - OLD_IMAGE=$(kubectl get deployment myapp -n $NAMESPACE -o jsonpath='{.spec.template.spec.containers[0].image}')
    - echo "Old image: $OLD_IMAGE"
    
    # 2. 金丝雀部署：更新1个Pod
    - sed -i "s|registry.mycompany.com/myapp:latest|$IMAGE:$TAG|g" deploy/deployment.yaml
    - kubectl apply -f deploy/ -n $NAMESPACE
    - kubectl scale deployment myapp -n $NAMESPACE --replicas=5  # 多出1个新版本Pod
    
    # 3. 等待金丝雀Pod就绪
    - kubectl rollout status deployment/myapp -n $NAMESPACE --timeout=300s
    
    # 4. 观察错误率（通过Prometheus查询）
    - |
      sleep 120  # 观察2分钟
      ERROR_RATE=$(curl -s "http://prometheus:9090/api/v1/query" \
        --data-urlencode "query=sum(rate(http_requests_total{namespace=\"$NAMESPACE\",status=~\"5..\"}[2m]))" \
        | jq -r '.data.result[0].value[1] // "0"')
      echo "Error rate: $ERROR_RATE"
      
      if [ $(awk "BEGIN {print ($ERROR_RATE > 0.05)}") -eq 1 ]; then
        echo "Error rate too high! Rolling back..."
        kubectl set image deployment/myapp app=$OLD_IMAGE -n $NAMESPACE
        kubectl scale deployment myapp -n $NAMESPACE --replicas=4
        exit 1
      fi
    
    # 5. 全量更新
    - kubectl scale deployment myapp -n $NAMESPACE --replicas=4
  rules:
    - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/
```

---

## 四、配置与密钥管理

### ConfigMap 管理

```yaml
# CI 中自动更新 ConfigMap
update-config:
  stage: deploy
  image: bitnami/kubectl:1.29
  script:
    # 从 GitLab Variable 加载配置文件
    - cp $APP_CONFIG app-config.yaml
    # 创建/更新 ConfigMap
    - kubectl create configmap app-config \
        --from-file=config.yaml=app-config.yaml \
        -n $NAMESPACE --dry-run=client -o yaml | \
        kubectl apply -f -
```

### Secret 管理（Sealed Secrets）

```yaml
# 不要在 CI 中直接创建明文 Secret
# 使用 Sealed Secrets 或 External Secrets

# 使用 SOPS 加密配置
deploy-secrets:
  stage: deploy
  image: 
    name: mozilla/sops:latest
    entrypoint: [""]
  script:
    # 解密加密的 Secret 配置
    - sops --decrypt deploy/secrets.enc.yaml > secrets.yaml
    - kubectl apply -f secrets.yaml -n $NAMESPACE
    - rm -f secrets.yaml  # 立即删除明文
```

---

## 五、部署后验证

### 端到端验证

```yaml
verify-deployment:
  stage: verify
  image: curlimages/curl:latest
  needs: [deploy-canary]
  script:
    # 等待服务可用
    - |
      for i in $(seq 1 30); do
        STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://myapp.com/actuator/health)
        if [ "$STATUS" = "200" ]; then
          echo "Service is healthy"
          break
        fi
        echo "Waiting for service (status=$STATUS)..."
        sleep 10
      done
      if [ "$STATUS" != "200" ]; then
        echo "Service health check failed"
        exit 1
      fi
    
    # 功能冒烟测试
    - |
      RESPONSE=$(curl -s -X POST https://myapp.com/api/orders \
        -H "Content-Type: application/json" \
        -d '{"productId":"test","quantity":1}')
      ORDER_ID=$(echo $RESPONSE | jq -r '.id')
      if [ -z "$ORDER_ID" ]; then
        echo "Smoke test failed: $RESPONSE"
        exit 1
      fi
      echo "Smoke test passed: order $ORDER_ID created"
```

### 自动回滚

```yaml
auto-rollback:
  stage: verify
  image: bitnami/kubectl:1.29
  needs: [verify-deployment]
  when: on_failure  # 前面的 Job 失败时执行
  script:
    - kubectl rollout undo deployment/myapp -n myapp-prod
    - kubectl rollout status deployment/myapp -n myapp-prod
    - |
      curl -X POST $ALERT_WEBHOOK \
        -H "Content-Type: application/json" \
        -d "{\"msgtype\":\"text\",\"text\":{\"content\":\"Deployment failed and rolled back: $CI_COMMIT_SHORT_SHA\"}}"
```

---

## 六、本篇要点回顾

1. 用 ServiceAccount + RBAC 给 CI 最小权限，kubeconfig 作为 File 类型变量
2. `kubectl rollout status` + readinessProbe 实现零停机滚动更新
3. 金丝雀部署：先更新1个Pod → 观察指标 → 全量更新或自动回滚
4. Secret 用 Sealed Secrets 或 SOPS 加密，不在 CI 中明文操作
5. 部署后做端到端冒烟测试，失败自动回滚 + 通知

**下一篇预告**：《安全扫描集成：SAST、DAST 与依赖扫描配置》——从部署回到安全，学习如何在 CI 流水线中集成安全扫描能力。

CI/CD 的终点站是 K8s。本篇从零开始搭建一条"代码提交 → 镜像构建 → 自动部署到 K8s → 健康检查 → 失败自动回滚"的完整流水线。跟着做完，你就有了生产可用的 K8s 部署自动化能力。

【CI/CD·GitLab篇】与 Kubernetes 集成：自动化部署到 K8s 集群

研发部经理

数据库

基于GitLab CI与K8s构建生产级自动化部署流水线，涵盖RBAC权限配置、滚动更新、金丝雀发布、健康检查及失败自动回滚。通过kubectl rollout status与readinessProbe实现零停机部署，集成SealedSecrets加密与端到端冒烟测试，确保部署安全可靠。

2026上云采购 | AI焕新·智启新局

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

EdgeOne AI 安全实战专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

【CI/CD·GitLab篇】与 Kubernetes 集成：自动化部署到 K8s 集群-腾讯云开发者社区-腾讯云

【CI/CD·GitLab篇】与 Kubernetes 集成：自动化部署到 K8s 集群

【CI/CD·GitLab篇】与 Kubernetes 集成：自动化部署到 K8s 集群

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐