云原生与容器--CI/CD 流水线设计实践

系列导读：本篇将深入讲解 CI/CD 流水线的设计与最佳实践。

一、CI/CD 概述

1.1 什么是 CI/CD？

┌─────────────────────────────────────────────────────────────┐ │ CI/CD 流程 │ ├─────────────────────────────────────────────────────────────┤ │ │ │ 代码提交 ──► CI ──► CD ──► 生产环境 │ │ │ │ │ │ ▼ ▼ │ │ 构建 部署 │ │ 测试 发布 │ │ 扫描 监控 │ │ │ └─────────────────────────────────────────────────────────────┘

1.2 CI/CD 工具对比

二、GitOps 实践

2.1 GitOps 原则

1. 声明式：所有配置都是声明式的 2. 版本化：Git 作为单一事实来源 3. 自动化：自动应用变更 4. 持续协调：持续监控状态差异

2.2 GitOps 工作流

┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │ 应用仓库 │ ──► │ 配置仓库 │ ──► │ ArgoCD │ │ (代码) │ │ (清单) │ │ (同步) │ └─────────────┘ └─────────────┘ └─────────────┘ │ ▼ ┌─────────────┐ │ Kubernetes │ └─────────────┘

三、Jenkins 流水线

3.1 Jenkinsfile

// Jenkinsfilepipeline{agent any environment{REGISTRY='registry.example.com'IMAGE_NAME='order-service'IMAGE_TAG="${env.BUILD_NUMBER}"}stages{stage('Checkout'){steps{checkout scm}}stage('Build'){steps{sh'./mvnw clean package -DskipTests'}}stage('Test'){steps{sh'./mvnw test'}post{always{junit'**/target/surefire-reports/*.xml'}}}stage('SonarQube'){steps{withSonarQubeEnv('SonarQube'){sh'./mvnw sonar:sonar'}}}stage('Build Image'){steps{sh"docker build -t${REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}."}}stage('Push Image'){steps{withCredentials([usernamePassword(credentialsId:'registry-credentials',usernameVariable:'USER',passwordVariable:'PASS')]){sh"docker login -u${USER}-p${PASS}${REGISTRY}"sh"docker push${REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}"}}}stage('Deploy to Dev'){steps{sh"kubectl set image deployment/${IMAGE_NAME}${IMAGE_NAME}=${REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}-n dev"}}stage('Deploy to Prod'){when{branch'main'}input{message"Deploy to Production?"ok"Deploy"}steps{sh"kubectl set image deployment/${IMAGE_NAME}${IMAGE_NAME}=${REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}-n prod"}}}post{success{slackSend(color:'good',message:"Build${IMAGE_TAG}succeeded!")}failure{slackSend(color:'danger',message:"Build${IMAGE_TAG}failed!")}}}

四、GitLab CI/CD

4.1 .gitlab-ci.yml

stages:-build-test-package-deployvariables:REGISTRY:registry.example.comIMAGE_NAME:order-servicebuild:stage:buildimage:maven:3.8-openjdk-11script:-mvn clean package-DskipTestsartifacts:paths:-target/*.jarexpire_in:1 hourtest:stage:testimage:maven:3.8-openjdk-11script:-mvn testartifacts:reports:junit:target/surefire-reports/*.xmlsonarqube:stage:testimage:maven:3.8-openjdk-11script:-mvn sonar:sonar-Dsonar.host.url=$SONAR_URL-Dsonar.login=$SONAR_TOKENdocker-build:stage:packageimage:docker:latestservices:-docker:dindscript:-docker login-u $REGISTRY_USER-p $REGISTRY_PASS $REGISTRY-docker build-t $REGISTRY/$IMAGE_NAME:$CI_COMMIT_SHA .-docker push $REGISTRY/$IMAGE_NAME:$CI_COMMIT_SHAdeploy-dev:stage:deployimage:bitnami/kubectl:latestscript:-kubectl set image deployment/$IMAGE_NAME $IMAGE_NAME=$REGISTRY/$IMAGE_NAME:$CI_COMMIT_SHA-n devenvironment:name:developmentonly:-developdeploy-prod:stage:deployimage:bitnami/kubectl:latestscript:-kubectl set image deployment/$IMAGE_NAME $IMAGE_NAME=$REGISTRY/$IMAGE_NAME:$CI_COMMIT_SHA-n prodenvironment:name:productionwhen:manualonly:-main

五、最佳实践

5.1 分支策略

main (生产) │ ├── develop (开发) │ │ │ ├── feature/xxx (功能) │ ├── feature/yyy │ │ │ └── release/x.x (发布) │ └── hotfix/xxx (修复)

5.2 流水线原则

1. 快速反馈：CI 阶段 < 10分钟 2. 自动化测试：单元测试 + 集成测试 3. 安全扫描：代码扫描 + 镜像扫描 4. 环境隔离：Dev → Test → Staging → Prod 5. 回滚机制：一键回滚

5.3 质量门禁

# 质量门禁配置quality-gates:unit-test-coverage:80%sonar-quality-gate:truesecurity-vulnerabilities:0 criticaldocker-image-scan:pass

总结

✅CI/CD 概述：持续集成、持续部署
✅GitOps 实践：声明式、版本化
✅Jenkins 流水线：Jenkinsfile 配置
✅GitLab CI/CD：.gitlab-ci.yml 配置
✅最佳实践：分支策略、质量门禁

下篇预告：云原生架构设计模式

作者：刘~浪地球
系列：云原生与容器（四）
更新时间：2026-04-15