fix build dev

.gitea/workflows/deploy.yaml

@@ -3,102 +3,130 @@ name: Build and Deploy
 on:
   push:
     branches:
-      - main
       - master
+      - dev
 
 jobs:
   build-and-deploy:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        run: |
+          git clone --depth=1 --branch=${{ github.ref_name }} https://gitea.airlabs.art/${{ github.repository }}.git .
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-        with:
-          config-inline: |
-            [registry."docker.io"]
-              mirrors = ["https://docker.m.daocloud.io", "https://docker.1panel.live", "https://hub.rat.dev"]
+      - name: Set environment by branch
+        run: |
+          SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
+          BUILD_DATE=$(date +%Y%m%d)
 
-      - name: Login to Huawei Cloud SWR
-        uses: docker/login-action@v2
-        with:
-          registry: ${{ secrets.SWR_SERVER }}
-          username: ${{ secrets.SWR_USERNAME }}
-          password: ${{ secrets.SWR_PASSWORD }}
+          if [[ "${{ github.ref_name }}" == "master" ]]; then
+            echo "IMAGE_TAG=prod-${BUILD_DATE}-${SHORT_SHA}" >> $GITHUB_ENV
+            echo "CR_ORG=prod" >> $GITHUB_ENV
+            echo "DEPLOY_ENV=production" >> $GITHUB_ENV
+            echo "DOMAIN_API=airflow-studio-api.airlabs.art" >> $GITHUB_ENV
+            echo "DOMAIN_WEB=airflow-studio.airlabs.art" >> $GITHUB_ENV
+            echo "REDIS_URL=redis://zyc:Zyc188208@redis-shzlf5t46gjvow7ua.redis.ivolces.com:6379/0" >> $GITHUB_ENV
+          elif [[ "${{ github.ref_name }}" == "dev" ]]; then
+            echo "IMAGE_TAG=dev-${BUILD_DATE}-${SHORT_SHA}" >> $GITHUB_ENV
+            echo "CR_ORG=dev" >> $GITHUB_ENV
+            echo "DEPLOY_ENV=development" >> $GITHUB_ENV
+            echo "DOMAIN_API=airflow-studio-api.test.airlabs.art" >> $GITHUB_ENV
+            echo "DOMAIN_WEB=airflow-studio.test.airlabs.art" >> $GITHUB_ENV
+            echo "REDIS_URL=redis://zyc:Zyc188208@redis-shzlsczo52dft8mia.redis.ivolces.com:6379/0" >> $GITHUB_ENV
+          fi
+
+      - name: Login to Volcano Engine CR
+        run: |
+          echo "${{ secrets.CR_PASSWORD }}" | docker login --username "${{ secrets.CR_USERNAME }}" --password-stdin ${{ secrets.CR_SERVER }}
 
       - name: Build and Push Backend
         id: build_backend
         run: |
           set -o pipefail
-          docker buildx build \
-            --push \
-            --no-cache \
-            --provenance=false \
-            --tag ${{ secrets.SWR_SERVER }}/${{ secrets.SWR_ORG }}/video-backend:latest \
+          DOCKER_BUILDKIT=0 docker build \
+            --tag ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/video-backend:${{ env.IMAGE_TAG }} \
+            --tag ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/video-backend:latest \
             ./backend 2>&1 | tee /tmp/build.log
+          docker push ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/video-backend:${{ env.IMAGE_TAG }}
+          docker push ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/video-backend:latest
 
       - name: Build and Push Web
         id: build_web
         run: |
           set -o pipefail
-          docker buildx build \
-            --push \
-            --provenance=false \
-            --tag ${{ secrets.SWR_SERVER }}/${{ secrets.SWR_ORG }}/video-web:latest \
+          DOCKER_BUILDKIT=0 docker build \
+            --tag ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/video-web:${{ env.IMAGE_TAG }} \
+            --tag ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/video-web:latest \
             ./web 2>&1 | tee -a /tmp/build.log
+          docker push ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/video-web:${{ env.IMAGE_TAG }}
+          docker push ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/video-web:latest
 
-      - name: Setup SSH
+      - name: Setup Kubectl
+        run: kubectl version --client
+
+      - name: Set kubeconfig
         run: |
-          mkdir -p ~/.ssh
-          echo "${{ secrets.K3S_SSH_KEY }}" > ~/.ssh/id_rsa
-          chmod 600 ~/.ssh/id_rsa
-          ssh-keyscan -H ${{ secrets.K3S_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
+          mkdir -p $HOME/.kube
+          if [[ "${{ github.ref_name }}" == "master" ]]; then
+            echo "${{ secrets.VOLCANO_PROD_KUBE_CONFIG }}" > $HOME/.kube/config
+          elif [[ "${{ github.ref_name }}" == "dev" ]]; then
+            echo "${{ secrets.VOLCANO_TEST_KUBE_CONFIG }}" > $HOME/.kube/config
+          fi
+          chmod 600 $HOME/.kube/config
 
-      - name: Deploy to K3s via SSH
+      - name: Deploy to K3s
         id: deploy
         run: |
-          SWR_IMAGE="${{ secrets.SWR_SERVER }}/${{ secrets.SWR_ORG }}"
+          echo "Environment: ${{ env.DEPLOY_ENV }}"
+          CR_IMAGE="${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}"
 
-          # Replace image placeholders in yaml files
-          sed -i "s|\${CI_REGISTRY_IMAGE}/video-backend:latest|${SWR_IMAGE}/video-backend:latest|g" k8s/backend-deployment.yaml
-          sed -i "s|\${CI_REGISTRY_IMAGE}/video-backend:latest|${SWR_IMAGE}/video-backend:latest|g" k8s/celery-deployment.yaml
-          sed -i "s|\${CI_REGISTRY_IMAGE}/video-web:latest|${SWR_IMAGE}/video-web:latest|g" k8s/web-deployment.yaml
+          # Replace image placeholders
+          sed -i "s|\${CI_REGISTRY_IMAGE}/video-backend:latest|${CR_IMAGE}/video-backend:${{ env.IMAGE_TAG }}|g" k8s/backend-deployment.yaml
+          sed -i "s|\${CI_REGISTRY_IMAGE}/video-backend:latest|${CR_IMAGE}/video-backend:${{ env.IMAGE_TAG }}|g" k8s/celery-deployment.yaml
+          sed -i "s|\${CI_REGISTRY_IMAGE}/video-web:latest|${CR_IMAGE}/video-web:${{ env.IMAGE_TAG }}|g" k8s/web-deployment.yaml
 
-          # Copy k8s manifests to server
-          scp -o StrictHostKeyChecking=no k8s/backend-deployment.yaml k8s/web-deployment.yaml k8s/ingress.yaml k8s/celery-deployment.yaml root@${{ secrets.K3S_HOST }}:/tmp/
+          # Replace domain placeholders in ingress
+          sed -i "s|airflow-studio-api.airlabs.art|${{ env.DOMAIN_API }}|g" k8s/ingress.yaml
+          sed -i "s|airflow-studio.airlabs.art|${{ env.DOMAIN_WEB }}|g" k8s/ingress.yaml
 
-          # Create/update secrets and apply manifests on server
+          # Replace DB config for production
+          if [[ "${{ env.DEPLOY_ENV }}" == "production" ]]; then
+            sed -i "s|mysql-8351f937d637.rds.ivolces.com|mysqld9bb4e81696d.rds.ivolces.com|g" k8s/backend-deployment.yaml
+            sed -i "s|mysql-8351f937d637.rds.ivolces.com|mysqld9bb4e81696d.rds.ivolces.com|g" k8s/celery-deployment.yaml
+          fi
+
+          # Replace CORS origin
+          sed -i "s|https://airflow-studio.airlabs.art|https://${{ env.DOMAIN_WEB }}|g" k8s/backend-deployment.yaml
+
+          # Replace Redis URL by environment
+          sed -i "s|redis://zyc:Zyc188208@redis-shzlsczo52dft8mia.redis.ivolces.com:6379/0|${{ env.REDIS_URL }}|g" k8s/backend-deployment.yaml
+          sed -i "s|redis://zyc:Zyc188208@redis-shzlsczo52dft8mia.redis.ivolces.com:6379/0|${{ env.REDIS_URL }}|g" k8s/celery-deployment.yaml
+
+          # Create/update secrets (业务密钥，DB 已写在 yaml 里)
+          kubectl create secret generic video-backend-secrets \
+            --from-literal=ARK_API_KEY='${{ secrets.ARK_API_KEY }}' \
+            --from-literal=TOS_ACCESS_KEY='${{ secrets.TOS_ACCESS_KEY }}' \
+            --from-literal=TOS_SECRET_KEY='${{ secrets.TOS_SECRET_KEY }}' \
+            --from-literal=DJANGO_SECRET_KEY='${{ secrets.DJANGO_SECRET_KEY }}' \
+            --from-literal=ALIYUN_SMS_ACCESS_KEY='${{ secrets.ALIYUN_SMS_ACCESS_KEY }}' \
+            --from-literal=ALIYUN_SMS_ACCESS_SECRET='${{ secrets.ALIYUN_SMS_ACCESS_SECRET }}' \
+            --dry-run=client -o yaml | kubectl apply -f -
+
+          # Apply manifests
           set -o pipefail
-          ssh -o StrictHostKeyChecking=no root@${{ secrets.K3S_HOST }} << ENDSSH
-            export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
+          {
+            kubectl apply -f k8s/backend-deployment.yaml
+            kubectl apply -f k8s/celery-deployment.yaml
+            kubectl apply -f k8s/web-deployment.yaml
+            kubectl apply -f k8s/ingress.yaml
 
-            kubectl create secret generic video-backend-secrets \
-              --from-literal=ARK_API_KEY='${{ secrets.ARK_API_KEY }}' \
-              --from-literal=TOS_ACCESS_KEY='${{ secrets.TOS_ACCESS_KEY }}' \
-              --from-literal=TOS_SECRET_KEY='${{ secrets.TOS_SECRET_KEY }}' \
-              --from-literal=DJANGO_SECRET_KEY='${{ secrets.DJANGO_SECRET_KEY }}' \
-              --from-literal=DB_HOST='${{ secrets.DB_HOST }}' \
-              --from-literal=DB_USER='${{ secrets.DB_USER }}' \
-              --from-literal=DB_PASSWORD='${{ secrets.DB_PASSWORD }}' \
-              --from-literal=ALIYUN_SMS_ACCESS_KEY='${{ secrets.ALIYUN_SMS_ACCESS_KEY }}' \
-              --from-literal=ALIYUN_SMS_ACCESS_SECRET='${{ secrets.ALIYUN_SMS_ACCESS_SECRET }}' \
-              --dry-run=client -o yaml | kubectl apply -f -
-
-            kubectl apply -f /tmp/backend-deployment.yaml
-            kubectl apply -f /tmp/celery-deployment.yaml
-            kubectl apply -f /tmp/web-deployment.yaml
-            kubectl apply -f /tmp/ingress.yaml
-
-            # Preserve real client IP: disable SNAT on Traefik
+            # Preserve real client IP
             kubectl patch svc traefik -n kube-system -p '{"spec":{"externalTrafficPolicy":"Local"}}' 2>/dev/null || true
 
             kubectl rollout restart deployment/video-backend
             kubectl rollout restart deployment/celery-worker
             kubectl rollout restart deployment/video-web
-
-            rm -f /tmp/backend-deployment.yaml /tmp/web-deployment.yaml /tmp/ingress.yaml /tmp/celery-deployment.yaml
-          ENDSSH
+          } 2>&1 | tee /tmp/deploy.log
 
       # ===== Log Center: failure reporting =====
       - name: Report failure to Log Center
@@ -137,7 +165,7 @@ jobs:
             -H "Content-Type: application/json" \
             -d "{
               \"project_id\": \"video_backend\",
-              \"environment\": \"${{ github.ref_name }}\",
+              \"environment\": \"${{ env.DEPLOY_ENV }}\",
               \"level\": \"ERROR\",
               \"source\": \"${SOURCE}\",
               \"commit_hash\": \"${{ github.sha }}\",

k8s/backend-deployment.yaml

@@ -14,8 +14,6 @@ spec:
       labels:
         app: video-backend
     spec:
-      imagePullSecrets:
-      - name: swr-secret
       containers:
       - name: video-backend
         image: ${CI_REGISTRY_IMAGE}/video-backend:latest
@@ -34,29 +32,20 @@ spec:
             secretKeyRef:
               name: video-backend-secrets
               key: DJANGO_SECRET_KEY
-        # Database (Aliyun RDS)
+        # Database (Volcano Engine RDS - 默认测试环境，生产环境通过 CI 替换)
         - name: DB_HOST
-          valueFrom:
-            secretKeyRef:
-              name: video-backend-secrets
-              key: DB_HOST
+          value: "mysql-8351f937d637.rds.ivolces.com"
         - name: DB_NAME
           value: "video_auto"
         - name: DB_USER
-          valueFrom:
-            secretKeyRef:
-              name: video-backend-secrets
-              key: DB_USER
+          value: "zyc"
         - name: DB_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: video-backend-secrets
-              key: DB_PASSWORD
+          value: "Zyc188208"
         - name: DB_PORT
           value: "3306"
         # Redis (Celery broker)
         - name: REDIS_URL
-          value: "redis://:vAhRnAA6VMco@redis-cngzyc2r77ka16g7a.redis.ivolces.com:6379/0"
+          value: "redis://zyc:Zyc188208@redis-shzlsczo52dft8mia.redis.ivolces.com:6379/0"
         # CORS
         - name: CORS_ALLOWED_ORIGINS
           value: "https://airflow-studio.airlabs.art"

k8s/celery-deployment.yaml

@@ -14,8 +14,6 @@ spec:
       labels:
         app: celery-worker
     spec:
-      imagePullSecrets:
-      - name: swr-secret
       containers:
       - name: celery-worker
         image: ${CI_REGISTRY_IMAGE}/video-backend:latest
@@ -35,25 +33,16 @@ spec:
               key: DJANGO_SECRET_KEY
         # Redis
         - name: REDIS_URL
-          value: "redis://:vAhRnAA6VMco@redis-cngzyc2r77ka16g7a.redis.ivolces.com:6379/0"
-        # Database (Aliyun RDS)
+          value: "redis://zyc:Zyc188208@redis-shzlsczo52dft8mia.redis.ivolces.com:6379/0"
+        # Database (Volcano Engine RDS - 默认测试环境，生产环境通过 CI 替换)
         - name: DB_HOST
-          valueFrom:
-            secretKeyRef:
-              name: video-backend-secrets
-              key: DB_HOST
+          value: "mysql-8351f937d637.rds.ivolces.com"
         - name: DB_NAME
           value: "video_auto"
         - name: DB_USER
-          valueFrom:
-            secretKeyRef:
-              name: video-backend-secrets
-              key: DB_USER
+          value: "zyc"
         - name: DB_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: video-backend-secrets
-              key: DB_PASSWORD
+          value: "Zyc188208"
         - name: DB_PORT
           value: "3306"
         # TOS (from Secret)

k8s/cert-manager-issuer.yaml

@@ -12,4 +12,4 @@ spec:
     solvers:
     - http01:
         ingress:
-          class: alb
+          class: traefik

k8s/web-deployment.yaml

@@ -14,8 +14,6 @@ spec:
       labels:
         app: video-web
     spec:
-      imagePullSecrets:
-      - name: swr-secret
       containers:
       - name: video-web
         image: ${CI_REGISTRY_IMAGE}/video-web:latest