150 lines
5.5 KiB
YAML
150 lines
5.5 KiB
YAML
name: Deploy Environment & Migrate Data (Data Sync)
|
||
|
||
# =============================================================================
|
||
# IaC ↔ 数据流单向迁移流水线
|
||
# 1. 动态 Provision (基于 Terraform 创建新环境)
|
||
# 2. 部署基础服务 (Bootstrap 部署，跑空环境)
|
||
# 3. 生产环境克隆与单向同步 (通过 site_migration Ansible 角色)
|
||
# =============================================================================
|
||
|
||
on:
|
||
workflow_dispatch:
|
||
inputs:
|
||
infra_ref:
|
||
description: "ai-workspace-infra git ref"
|
||
required: false
|
||
default: "main"
|
||
type: string
|
||
source_host:
|
||
description: "源环境 IP 或域名 (用于导出数据)"
|
||
required: true
|
||
default: "install.svc.plus"
|
||
type: string
|
||
source_domain_base:
|
||
description: "源环境域名后缀 (例如 svc.plus)"
|
||
required: true
|
||
default: "svc.plus"
|
||
type: string
|
||
target_domain_base:
|
||
description: "新环境域名后缀 (用于参数化替换，如 onwalk.net)"
|
||
required: true
|
||
default: "onwalk.net"
|
||
type: string
|
||
run_provision_and_deploy:
|
||
description: "是否执行 Provision 和基础环境 Deploy? (如果只迁移数据则取消勾选)"
|
||
required: false
|
||
default: true
|
||
type: boolean
|
||
|
||
permissions:
|
||
contents: read
|
||
id-token: write
|
||
|
||
concurrency:
|
||
group: deploy-env-migration
|
||
cancel-in-progress: false
|
||
|
||
env:
|
||
VAULT_ADDR: https://vault.svc.plus
|
||
VAULT_ROLE: github-actions-xworkspace-console
|
||
VAULT_KV: kv/data/CICD
|
||
PLAYBOOKS_DIR: infra/playbooks
|
||
|
||
jobs:
|
||
# ---------------------------------------------------------------------------
|
||
# 步骤 1: 基础设施配置与启动 (Provision)
|
||
# [可直接参考 deploy-ai-workspace-iac.yaml 中的 provision]
|
||
# ---------------------------------------------------------------------------
|
||
provision:
|
||
name: Provision New Environment (Terraform)
|
||
if: ${{ github.event.inputs.run_provision_and_deploy == 'true' }}
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- name: Checkout infra
|
||
uses: actions/checkout@v7
|
||
with:
|
||
repository: ai-workspace-infra/iac_modules
|
||
ref: ${{ github.event.inputs.infra_ref }}
|
||
path: infra/iac_modules
|
||
|
||
- name: Load Vault secrets
|
||
id: vault
|
||
uses: hashicorp/vault-action@v4
|
||
with:
|
||
url: ${{ env.VAULT_ADDR }}
|
||
method: jwt
|
||
role: ${{ env.VAULT_ROLE }}
|
||
secrets: |
|
||
${{ env.VAULT_KV }} VULTR_API_KEY | VULTR_API_KEY ;
|
||
|
||
# 省略实际 Terraform Apply 步骤 (参考原有 IAC 流水线)...
|
||
- name: Placeholder for Terraform Apply
|
||
run: echo "Terraform applies new infrastructure and outputs target IPs..."
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# 步骤 2: 基础环境安装 (Bootstrap Deploy)
|
||
# ---------------------------------------------------------------------------
|
||
deploy_base:
|
||
name: Deploy Base Services
|
||
needs: provision
|
||
if: ${{ github.event.inputs.run_provision_and_deploy == 'true' }}
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- name: Placeholder for Ansible Base Deploy
|
||
run: echo "Run on-host-bootstrap.sh on new nodes..."
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# 步骤 3: 全站单向数据流迁移与环境恢复 (Data Migration)
|
||
# ---------------------------------------------------------------------------
|
||
data_migration:
|
||
name: Migrate Site Data (Source -> Target)
|
||
needs: deploy_base
|
||
# 即使不执行 Provision，也可以单独触发纯数据同步
|
||
if: ${{ always() }}
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- name: Checkout playbooks
|
||
uses: actions/checkout@v7
|
||
with:
|
||
repository: ai-workspace-infra/playbooks
|
||
ref: ${{ github.event.inputs.infra_ref }}
|
||
path: infra/playbooks
|
||
|
||
- name: Install Ansible
|
||
run: pip install --quiet ansible
|
||
|
||
- name: Load Vault secrets for SSH
|
||
id: vault
|
||
uses: hashicorp/vault-action@v4
|
||
with:
|
||
url: ${{ env.VAULT_ADDR }}
|
||
method: jwt
|
||
role: ${{ env.VAULT_ROLE }}
|
||
secrets: |
|
||
${{ env.VAULT_KV }} SSH_PRIVATE_DEPLOY_KEY_B64 | ANSIBLE_SSH_KEY_B64
|
||
|
||
- name: Configure SSH Key
|
||
run: |
|
||
mkdir -p ~/.ssh
|
||
printf '%s' "${{ steps.vault.outputs.ANSIBLE_SSH_KEY_B64 }}" | base64 -d > ~/.ssh/id_deploy
|
||
chmod 600 ~/.ssh/id_deploy
|
||
|
||
- name: Generate Migration Inventory
|
||
run: |
|
||
# 模拟从 IAC 或人工输入中获取 target_ip (这里假定 target_ip 是通过环境变量或输入传入)
|
||
TARGET_IP="new_env_ip_placeholder"
|
||
echo "[migration_source]" > inventory_migration.ini
|
||
echo "${{ github.event.inputs.source_host }} ansible_user=root ansible_ssh_private_key_file=~/.ssh/id_deploy" >> inventory_migration.ini
|
||
echo "" >> inventory_migration.ini
|
||
echo "[migration_target]" >> inventory_migration.ini
|
||
echo "${TARGET_IP} ansible_user=root ansible_ssh_private_key_file=~/.ssh/id_deploy" >> inventory_migration.ini
|
||
|
||
- name: Run Ansible Site Migration Playbook
|
||
working-directory: ${{ env.PLAYBOOKS_DIR }}
|
||
run: |
|
||
ansible-playbook \
|
||
-i ../inventory_migration.ini \
|
||
migrate_site.yml \
|
||
-e "target_domain=${{ github.event.inputs.target_domain_base }}" \
|
||
-e "migration_flow.source.domain_base=${{ github.event.inputs.source_domain_base }}"
|