Continuous deployment of containerized applications using GitLab

GitLab is a tool for continuous integration (CI).

This tutorial describes:

• Building an application into a Docker container.
• Deploying an application from a container in a Yandex Managed Service for Kubernetes cluster via GitLab using the Yandex Cloud tools.

Each commit to GitLab is followed by:

• Running a pipeline that includes steps to build the Docker image.
• Applying a new Managed Service for Kubernetes cluster configuration specifying the application to deploy.

To set up the required infrastructure for storing source code, building the Docker image, and deploying the application, follow these steps:

1. Get your cloud ready.

   1. Review the list of required paid resources.

2. Set up your infrastructure.

3. Create a GitLab instance.

4. Configure GitLab.

5. Create a test application.

6. Create a GitLab Runner.

7. Set up Kubernetes authentication in GitLab.

8. Configure the CI pipeline.

9. Check the result.

If you no longer need the resources you created, delete them.

Get your cloud readyGet your cloud ready

Sign up for Yandex Cloud and create a billing account:

1. Navigate to the management console and log in to Yandex Cloud or create a new account.
2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one and link a cloud to it.

If you have an active billing account, you can create or select a folder for your infrastructure on the cloud page.

Learn more about clouds and folders here.

Required paid resourcesRequired paid resources

Infrastructure support costs include fees for the following resources:

• Disks and continuously running VMs (see Yandex Compute Cloud pricing).
• Dynamic public IP address assigned (see Yandex Virtual Private Cloud pricing).
• Storing the created Docker images (see Container Registry pricing).
• Using a Managed Service for Kubernetes master (see Managed Service for Kubernetes pricing).

Set up your infrastructureSet up your infrastructure

Install additional dependenciesInstall additional dependencies

Install the following tools in the local environment:

• jq, a JSON stream processor.
• kubectl, command-line tool. Configure it to work with the new Managed Service for Kubernetes cluster.

Create a GitLab instanceCreate a GitLab instance

Create either a Managed Service for GitLab instance or a VM with a GitLab image in the same cloud network as the Managed Service for Kubernetes cluster.

Configure GitLabConfigure GitLab

To configure GitLab and get ready for continuous integration (CI), create a new project and enter the CI authentication data:

Create a test applicationCreate a test application

Create a test application that can be deployed in a Yandex Managed Service for Kubernetes cluster:

1. Add a Dockerfile to your project:

   1. Log in to GitLab.

   2. Open the GitLab project.

   3. Click in the repository navigation bar and select New file from the drop-down menu.

   4. Name the file Dockerfile and add the following code to it:

      FROM alpine:3.10
      CMD echo "Hello"
      

   5. Add a comment in the Commit message field: Dockerfile for test application.

   6. Click Commit changes.

2. Add a manifest for creating Managed Service for Kubernetes cluster resources to your project:

   1. Open the GitLab project.

   2. Click in the repository navigation bar and select New file from the drop-down menu.

   3. Name your file k8s.yaml:

      k8s.yaml

      apiVersion: v1
      kind: Namespace
      metadata:
        name: hello-world
      ---
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: hello-world-deployment
        namespace: hello-world
      spec:
        replicas: 1
        selector:
          matchLabels:
            app: hello
        template:
          metadata:
            namespace: hello-world
            labels:
              app: hello
          spec:
            containers:
              - name: hello-world
                image: __VERSION__
                imagePullPolicy: Always
      

   4. Add a comment in the Commit message field: Docker image deployment config.

   5. Click Commit changes.

Create a GitLab RunnerCreate a GitLab Runner

To run build tasks in your Yandex Managed Service for Kubernetes cluster, create a GitLab Runner.To do this, install GitLab Runner by following this guide.

Once it is installed, you can run automated builds within your Managed Service for Kubernetes cluster.

For more information about installing and running GitLab Runner, see this GitLab article.

Set up Kubernetes authentication in GitLabSet up Kubernetes authentication in GitLab

You can set up authentication in GitLab using a Kubernetes service account token or the GitLab Agent application:

Configure the CI pipelineConfigure the CI pipeline

1. Create GitLab environment variables:

   1. In GitLab, navigate to Settings in the left-hand panel and select CI/CD from the pop-up list.

   2. Click Expand next to Variables.

   3. Add the following environment variables depending on the Kubernetes authentication method in GitLab:

      Service account token

      GitLab Agent

      • KUBE_URL: Managed Service for Kubernetes master address. You can get it using the following command:

        yc managed-kubernetes cluster get <cluster_ID_or_name> --format=json \
           | jq -r .master.endpoints.external_v4_endpoint
        

      • KUBE_TOKEN: Token that GitLab will use to apply the configuration. Use the token you got earlier.
      • CI_REGISTRY: Address of the previously created registry in cr.yandex/<registry_ID> format.
      • CI_REGISTRY_KEY: Key that GitLab will use to access the registry. Copy the contents of the previously obtained key.json static key file to access the registry.

      To add a variable:

      • Click Add variable.
      • In the window that opens, specify a variable name in the Key field and its value in the Value field.
      • Click Add variable.

2. Create a CI pipeline configuration file:

   1. Open the gitlab-test project.

   2. Click in the repository navigation bar and select New file from the drop-down menu.

   3. Name your file .gitlab-ci.yml. Add steps to build and push the Docker image and update the application configuration in the Managed Service for Kubernetes cluster. The file structure depends on the Kubernetes authentication method in GitLab:

      Service account token

      GitLab Agent

      • To build a container via kaniko without using the GitLab Runner privileged mode:

        .gitlab-ci.yml

        stages:
          - build
          - deploy
        
        build:
          stage: build
          image:
            name: gcr.io/kaniko-project/executor:debug
            entrypoint: [""]
          script:
            - mkdir -p /kaniko/.docker
            - echo "{\"auths\":{\"${CI_REGISTRY}\":{\"auth\":\"$(echo -n "json_key:${CI_REGISTRY_KEY}" | base64 | tr -d '\n' )\"}}}" > /kaniko/.docker/config.json
            - >-
              /kaniko/executor
              --context "${CI_PROJECT_DIR}"
              --dockerfile "${CI_PROJECT_DIR}/Dockerfile"
              --destination "${CI_REGISTRY}/${CI_PROJECT_PATH}:${CI_COMMIT_SHORT_SHA}"
        
        deploy:
          image: gcr.io/cloud-builders/kubectl:latest
          stage: deploy
          script:
            - kubectl config set-cluster k8s --server="$KUBE_URL" --insecure-skip-tls-verify=true
            - kubectl config set-credentials admin --token="$KUBE_TOKEN"
            - kubectl config set-context default --cluster=k8s --user=admin
            - kubectl config use-context default
            - sed -i "s,__VERSION__,${CI_REGISTRY}/${CI_PROJECT_PATH}:${CI_COMMIT_SHORT_SHA}," k8s.yaml
            - kubectl apply -f k8s.yaml
        

      • To build a container via docker:dind using the GitLab Runner privileged mode:

        .gitlab-ci.yml

        stages:
          - build
          - deploy
        
        image: docker:20.10.16
        
        variables:
          DOCKER_HOST: tcp://docker:2376
          DOCKER_TLS_CERTDIR: "/certs"
          DOCKER_TLS_VERIFY: 1
          DOCKER_CERT_PATH: "$DOCKER_TLS_CERTDIR/client"
          DOCKER_DRIVER: overlay2
        
        services:
          - docker:20.10.16-dind
        
        before_script:
          - for try in {1..10}; do sleep 0.5; docker info && break ; done
        
        build:
          stage: build
          script:
            - echo "${CI_REGISTRY_KEY}" | docker login ${CI_REGISTRY} -u json_key --password-stdin
            - >-
              docker build
              "${CI_PROJECT_DIR}"
              --file "${CI_PROJECT_DIR}/Dockerfile"
              --tag "${CI_REGISTRY}/${CI_PROJECT_PATH}:${CI_COMMIT_SHORT_SHA}"
            - docker push "${CI_REGISTRY}/${CI_PROJECT_PATH}:${CI_COMMIT_SHORT_SHA}"
        
        deploy:
          image: gcr.io/cloud-builders/kubectl:latest
          stage: deploy
          script:
            - kubectl config set-cluster k8s --server="$KUBE_URL" --insecure-skip-tls-verify=true
            - kubectl config set-credentials admin --token="$KUBE_TOKEN"
            - kubectl config set-context default --cluster=k8s --user=admin
            - kubectl config use-context default
            - sed -i "s,__VERSION__,${CI_REGISTRY}/${CI_PROJECT_PATH}:${CI_COMMIT_SHORT_SHA}," k8s.yaml
            - kubectl apply -f k8s.yaml
        

      • To build a container via kaniko without using the GitLab Runner privileged mode:

        .gitlab-ci.yml

        stages:
          - build
          - deploy
        
        build:
          stage: build
          image:
            name: gcr.io/kaniko-project/executor:debug
            entrypoint: [""]
          script:
            - mkdir -p /kaniko/.docker
            - echo "{\"auths\":{\"${CI_REGISTRY}\":{\"auth\":\"$(echo -n "json_key:${CI_REGISTRY_KEY}" | base64 | tr -d '\n' )\"}}}" > /kaniko/.docker/config.json
            - >-
              /kaniko/executor \
              --context "${CI_PROJECT_DIR}" \
              --dockerfile "${CI_PROJECT_DIR}/Dockerfile" \
              --destination "${CI_REGISTRY}/${CI_PROJECT_PATH}:${CI_COMMIT_SHORT_SHA}"
        
        deploy:
          image: bitnamilegacy/kubectl:latest
          stage: deploy
          script:
            - kubectl config use-context ${CI_PROJECT_PATH}:<GitLab_agent_name>
            - cat k8s.yaml | sed -e "s,__VERSION__,${CI_REGISTRY}/${CI_PROJECT_PATH}:${CI_COMMIT_SHORT_SHA}," | kubectl apply -f -
        

      • To build a container via docker:dind using the GitLab Runner privileged mode:

        .gitlab-ci.yml

        stages:
          - build
          - deploy
        
        image: docker:20.10.16
        
        variables:
          DOCKER_HOST: tcp://docker:2376
          DOCKER_TLS_CERTDIR: "/certs"
          DOCKER_TLS_VERIFY: 1
          DOCKER_CERT_PATH: "$DOCKER_TLS_CERTDIR/client"
          DOCKER_DRIVER: overlay2
        
        services:
          - docker:20.10.16-dind
        
        before_script:
          - for try in {1..10}; do sleep 0.5; docker info && break ; done
        
        build:
          stage: build
          script:
            - echo "${CI_REGISTRY_KEY}" | docker login ${CI_REGISTRY} -u json_key --password-stdin
            - >-
              docker build
              "${CI_PROJECT_DIR}"
              --file "${CI_PROJECT_DIR}/Dockerfile"
              --tag "${CI_REGISTRY}/${CI_PROJECT_PATH}:${CI_COMMIT_SHORT_SHA}"
            - docker push "${CI_REGISTRY}/${CI_PROJECT_PATH}:${CI_COMMIT_SHORT_SHA}"
        
        deploy:
          image:
            name: bitnamilegacy/kubectl:latest
            entrypoint: [""]
          stage: deploy
          script:
            - kubectl config use-context ${CI_PROJECT_PATH}:<GitLab_agent_name>
            - cat k8s.yaml | sed -e "s,__VERSION__,${CI_REGISTRY}/${CI_PROJECT_PATH}:${CI_COMMIT_SHORT_SHA}," | kubectl apply -f -
        

      Replace <GitLab_agent_name> with the name of the agent in Managed Service for GitLab.

   4. Add a comment in the Commit message field: CI scripts.

   5. Click Commit changes.

   The .gitlab-ci.yml file describes the following two steps of the project build process:

   • Building a Docker image using Dockerfile and pushing the image to Container Registry.
   • Setting up an environment to work with Kubernetes and applying the k8s.yaml configuration to the Managed Service for Kubernetes cluster. This way, the application is deployed to the previously created Managed Service for Kubernetes cluster.

Check the resultCheck the result

1. After you save the .gitlab-ci.yml configuration file, the build pipeline will start. To check its results, select Build on the left-hand panel in the gitlab-test project, then select Pipelines from the drop-down menu, and wait for both build stages to complete successfully.

2. To check how the application is running in your Managed Service for Kubernetes cluster, view its container logs:

   kubectl logs deployment/hello-world-deployment -n hello-world
   

   Result:

   Hello
   

Delete the resources you createdDelete the resources you created

Some resources are not free of charge. Delete the resources you no longer need to avoid paying for them:

1. Delete the created Docker images.

2. Delete the Managed Service for Kubernetes cluster and Container Registry:

   Manually

   Terraform

   1. Delete the Managed Service for Kubernetes cluster.
   2. Delete the Container Registry.
   3. Delete the created subnets and networks.
   4. Delete the created service accounts.

   1. In the terminal window, go to the directory containing the infrastructure plan.

      Warning

      Make sure the directory has no Terraform manifests with the resources you want to keep. Terraform deletes all resources that were created using the manifests in the current directory.

   2. Delete resources:

      1. Run this command:

         terraform destroy
         

      2. Confirm deleting the resources and wait for the operation to complete.

      All the resources described in the Terraform manifests will be deleted.

3. Delete the created GitLab VM or Managed Service for GitLab instance.

See alsoSee also

• Creating test VMs using GitLab CI.