Continuous Deployment in GitHub Actions

Image by Chris Pagan

Assalamu’alaikum Warahmatullah Wabarakatuh,

Setelah kita membuat script CI, waktunya kita membuat script untuk CD nya, tapi sebelum itu kita harus men-setting secret, yang nantinya akan kita gunakan untuk upload artifact docker images ke GitHub Container Registry dan melakukan remote SSH ke kubernetes master-nodes.

Pertama kita masuk ke setting repository :

Kemudian kita masuk kepada menu secrets

Dan jika kita telah menambahkan secrets kita bisa lanjut menuliskan CD scriptnya

Okeh kita langsung saja masuk ke script CD nya.

name: CI Build and CD to Kubernetes Cluster
on:
push: {}
jobs:
# Build Docker Images
Build:
name: Build Docker Images
runs-on: ubuntu-latest
env:
GO111MODULE: on
steps:
- name: Checkout Repo
uses: actions/checkout@v2
- name: Set up QEMU
uses: docker/setup-qemu-action@v1
- uses: satackey/action-docker-layer-caching@v0.0.11
continue-on-error: true
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v1
- name: Login to GitHub Container Registry
uses: docker/login-action@v1
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
password: ${{ secrets.TOKEN }}
- name: Build and push
uses: docker/build-push-action@v2
with:
context: .
platforms: linux/amd64,linux/arm64
push: true
tags: ghcr.io/mrofisr/simple:latest
# Scanning Docker Images
DockerImagesScan:
name: Scanning Docker Images
needs: [Build]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- name: Build an image from Dockerfile
run: docker build -t ghcr.io/mrofisr/simple:latest .
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: "ghcr.io/mrofisr/simple:latest"
format: "template"
template: "@/contrib/sarif.tpl"
output: "trivy-results.sarif"
severity: 'CRITICAL,HIGH'
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v1
with:
sarif_file: "trivy-results.sarif"
# Deploy to Kubernetes Cluster
DeployToKubernetes:
name: Deploy To Kubernetes
needs: [DockerImagesScan]
runs-on: ubuntu-latest
steps:
- uses: appleboy/ssh-action@master
with:
host: ${{ secrets.SSH_HOST }}
username: ${{ secrets.SSH_USERNAME }}
key: ${{ secrets.SSH_KEY }}
port: ${{ secrets.SSH_PORT }}
script: |
cd simple
git pull
cd kubernetes
kubectl delete all --all -n backend
kubectl delete namespace backend
kubectl apply -f namespace.yaml
kubectl apply -f deployment.yaml
kubectl apply -f autoscale.yaml
kubectl get all -n backend

Penjelasan :

Build Docker Images

Pada tahap ini kita akan membuat task / jobs yang akan melakukan build Dockerfile kita menjadi docker images, kemudian setelah itu hasil docker images yang sudah dibuild akan di upload ke GitHub Container Registry

Scanning Docker Images

Kemudian setelah berhasil membuat docker images, kita akan melakukan vulnerability scanning pada docker images tersebut, disini saya menggunakan trivy, trivy merupakan tools yang digunakan untuk scanning pada container images, file systems, dan Git repositories. Apabila ada celah keamanan pada docker images yang kita miliki, maka trivy akan menginfokan pada tab security

Deploy to Kubernetes Cluster

Dan pada tahap terakhir, kita akan melakukan deploy docker images kita ke Kubernetes Cluster yang sudah kita buat.

namespace.yaml

apiVersion: v1
kind: Namespace
metadata:
name: backend

deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
name: simple-go-api
namespace: backend
spec:
selector:
matchLabels:
run: simple-go-api
template:
metadata:
labels:
run: simple-go-api
spec:
securityContext:
runAsUser: 10001
containers:
- name: simple-go-api
image: ghcr.io/mrofisr/simple:latest
ports:
- containerPort: 3000
resources:
limits:
cpu: 500m
requests:
cpu: 200m
---
apiVersion: v1
kind: Service
metadata:
name: simple-go-api
namespace: backend
labels:
run: simple-go-api
spec:
type: LoadBalancer
ports:
- name: http
port: 3000
targetPort: 3000
nodePort: 31000
protocol: TCP
selector:
run: simple-go-api

autoscalling.yaml

apiVersion: autoscaling/v2beta2
kind: HorizontalPodAutoscaler
metadata:
name: simple-go-api
namespace: backend
spec:
scaleTargetRef:
apiVersion: apps/v1
kind: Deployment
name: simple-go-api
minReplicas: 1
maxReplicas: 5
metrics:
- type: Resource
resource:
name: cpu
target:
type: Utilization
averageUtilization: 50

setelah semua proses berhasil maka output atau hasilnya akan seperti ini :

Testing Horizontal Pod AutoScalling

Dan yang tahap terakhir kita akan melakukan testing pada HPA yang sudah kita buat, disini saya menggunakan Apache Benchmark untuk melakukan testing.

Testing :

mrofisr@mrofisr ~ % ab -n 10000 -c 1000 http://34.124.208.75:31000/quotes
This is ApacheBench, Version 2.3 <$Revision: 1879490 $>
Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Licensed to The Apache Software Foundation, http://www.apache.org/
Benchmarking 34.124.208.75 (be patient)
Completed 1000 requests
Completed 2000 requests
Completed 3000 requests
Completed 4000 requests
^C
Server Software:
Server Hostname:        34.124.208.75
Server Port:            31000
Document Path:          /quotes
Document Length:        224 bytes
Concurrency Level:      1000
Time taken for tests:   60.828 seconds
Complete requests:      4845
Failed requests:        4795
(Connect: 0, Receive: 0, Length: 4795, Exceptions: 0)
Total transferred:      1819471 bytes
HTML transferred:       1291366 bytes
Requests per second:    79.65 [#/sec] (mean)
Time per request:       12554.697 [ms] (mean)
Time per request:       12.555 [ms] (mean, across all concurrent requests)
Transfer rate:          29.21 [Kbytes/sec] received
Connection Times (ms)
min  mean[+/-sd] median   max
Connect:       28  404 468.1    288    3500
Processing:   305 10650 2602.1  11615   14534
Waiting:      305 10649 2601.9  11615   14534
Total:        352 11054 2581.8  11930   14895
Percentage of the requests served within a certain time (ms)
50%  11929
66%  12199
75%  12457
80%  12610
90%  12817
95%  13069
98%  13320
99%  14064
100%  14895 (longest request)

Before :

After :

After CPU usages normal :

Penjelasan :

Pada kasus ini saya membuat sebuah kondisi apabila penggunaan CPU melebihi 50% maka Kubernetes akan menggandakan podnya menjadi 4 buah pod agar proses aplikasi tetap berjalan dengan lancar.

Sekian, Terimakasih~

About me

I’m Muhammad Abdur Rofi Maulidin, a DevOps Engineer passionate about optimizing software development processes by supporting cloud infrastructure management like kubernetes orchestration, and automations. Dedicated to support the reliability, availability, and performance of systems by implementing SLI/SLO based on performance monitoring for business requirement.

Feel free to keep in touch with me:

• LinkedIn: https://www.linkedin.com/in/mrofisr/
• Twitter: https://twitter.com/mrofisr_
• Telegram: https://t.me/@mrofisr

Let’s go to the cloud 🚀

Free Palestine 🇵🇸