# -*- coding: utf-8 -*- """ safety-eval-service 一键发布到开发环境 K8s 脚本 ================================================ 在本地 Windows 执行，自动完成: 本地 Maven 编译 (可选) -> 上传 JAR -> 远程 Docker build -> 推送 ACR -> 更新 K8s Deployment -> 滚动重启 -> 校验 Pod 状态 与 docs/build-tools/build_push.py 的区别: build_push.py 只构建并推送镜像，最后只"打印" kubectl 命令； 本脚本会真正执行 K8s 部署、滚动更新并校验结果。 前置条件: - Python 3 + paramiko (pip install paramiko) - 本地已编译好 JAR，或加 --build 让脚本自动 mvn 编译 用法: # 最简单: 自动查找项目 JAR 并发布 (推荐) python push_to_dev.py # 指定 JAR 路径 python push_to_dev.py --jar "D:\\workspace\\code\\safety-eval-service\\safety-eval-start\\target\\safety-eval-start-1.0-SNAPSHOT.jar" # 先本地编译再发布 python push_to_dev.py --build # 自定义版本序号 (默认自动递增当天序号) python push_to_dev.py --version 3 # 只更新 K8s (镜像已存在，只触发滚动重启) python push_to_dev.py --deploy-only --image <完整镜像地址> # 跳过 K8s 部署，只构建推送镜像 python push_to_dev.py --no-deploy 示例输出镜像: jjb-registry-registry.cn-hangzhou.cr.aliyuncs.com/ali_img_ns/prod-aly-ota-dragon-jjb-saas-safety-eval:ota-20260707-1 """ import argparse import os import subprocess import sys import time from datetime import datetime import paramiko # ==================== 配置区 ==================== # K8s Master (SSH) MASTER = "192.168.20.100" SSH_USER = "root" SSH_PASSWD = "Zcloud@zcloud100" # 杭州 ACR (K8s image-pull-secret 指向此处，必须用这个仓库) ACR_REGISTRY = "jjb-registry-registry.cn-hangzhou.cr.aliyuncs.com" ACR_NAMESPACE = "ali_img_ns" ACR_USER = "10952138@qq.com" ACR_PASS = "idurCT!rIq9EzISD" # K8s 部署信息 K8S_NAMESPACE = "jjb-dragon" DEPLOY_NAME = "jjb-saas-safety-eval-deploy" # Deployment 名称 CONTAINER_NAME = "jjb-saas-safety-eval-app" # 容器名称 KUBECTL = "/usr/bin/kubectl" # 镜像命名 APP_NAME = "jjb-saas-safety-eval" ENV_PREFIX = "ota" # 环境前缀 # 项目本地路径 (默认为脚本所在目录的上一级) PROJECT_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__))) # JAR 相对路径 JAR_REL = os.path.join("safety-eval-start", "target", "safety-eval-start-1.0-SNAPSHOT.jar") # 远程构建目录 REMOTE_BUILD_DIR = f"/tmp/docker-build-{APP_NAME}" # 脚本自带的 Dockerfile (与 docs/build-tools/Dockerfile 一致: CentOS7 + JDK1.8.0_202) SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__)) DOCKERFILE_PATH = os.path.join(SCRIPT_DIR, "Dockerfile") # 若 push 目录没有 Dockerfile，则回退到 docs/build-tools/Dockerfile if not os.path.exists(DOCKERFILE_PATH): DOCKERFILE_PATH = os.path.join( PROJECT_DIR, "docs", "build-tools", "Dockerfile" ) # ==================== 工具函数 ==================== def ssh_exec(client, cmd, timeout=600, quiet=False): """执行 SSH 命令并打印结果，返回 (stdout, stderr, exit_code)。""" if not quiet: print(f" $ {cmd[:150]}{'...' if len(cmd) > 150 else ''}") stdin, stdout, stderr = client.exec_command(cmd, timeout=timeout) out = stdout.read().decode("utf-8", errors="replace") err = stderr.read().decode("utf-8", errors="replace") exit_code = stdout.channel.recv_exit_status() if not quiet: if out.strip(): for line in out.strip().split("\n")[-15:]: print(f" {line}") if err.strip(): # 过滤掉 docker 下载进度噪音 important = [ l for l in err.strip().split("\n") if not any(x in l for x in ["Downloading", "Downloaded", "Extracting", "Progress", "WARNING! --password", "Login Succeeded"]) ] if important: print(f" [stderr] {'; '.join(important[:5])}") return out.strip(), err.strip(), exit_code def upload_with_progress(sftp, local, remote): """带进度条的上传。""" size_mb = os.path.getsize(local) / 1024 / 1024 start = time.time() last_pct = [-1] def progress(transferred, total): pct = int(transferred * 100 / total) if pct >= last_pct[0] + 10: last_pct[0] = pct mb = transferred / 1024 / 1024 elapsed = time.time() - start speed = mb / elapsed if elapsed > 0 else 0 print(f" {pct}% ({mb:.1f} MB) - {speed:.1f} MB/s") sftp.put(local, remote, callback=progress) elapsed = time.time() - start print(f" 上传完成: {elapsed:.1f}s ({size_mb / elapsed:.1f} MB/s)") def find_local_jar(project_dir): """自动查找项目 JAR 包。""" candidate = os.path.join(project_dir, JAR_REL) if os.path.exists(candidate): return os.path.abspath(candidate) # 兜底: 在 safety-eval-start/target 下找最大的 jar (非 *.original) target_dir = os.path.join(project_dir, "safety-eval-start", "target") if os.path.isdir(target_dir): jars = [os.path.join(target_dir, f) for f in os.listdir(target_dir) if f.endswith(".jar") and not f.endswith(".jar.original")] if jars: jars.sort(key=os.path.getsize, reverse=True) return os.path.abspath(jars[0]) return None def local_mvn_build(project_dir): """在本地执行 Maven 编译。""" print("[0/7] 本地 Maven 编译 (mvn clean package -DskipTests)...") cmd = ["mvn", "clean", "package", "-DskipTests"] print(f" $ {' '.join(cmd)}") print(" (编译日志较多，仅显示关键输出...)") try: proc = subprocess.run( cmd, cwd=project_dir, shell=(os.name == "nt"), capture_output=True, text=True, encoding="utf-8", errors="replace" ) except FileNotFoundError: print(" ERROR: 未找到 mvn 命令，请确认本地已安装 Maven 并加入 PATH。") sys.exit(1) # 打印最后的关键行 tail = (proc.stdout or "").strip().split("\n")[-25:] for line in tail: print(f" {line}") if proc.returncode != 0: print("\n ERROR: Maven 编译失败！") if proc.stderr: print(proc.stderr[-1000:]) sys.exit(1) print(" Maven 编译成功。") def next_version_suffix(client): """查询 master 上当天已存在的镜像 tag，自动递增序号。""" date_tag = datetime.now().strftime("%Y%m%d") prefix = f"{ENV_PREFIX}-{date_tag}-" # 查询本应用当天已构建的 tag (docker images 第二列为 Tag) repo_filter = f"prod-aly-{ENV_PREFIX}-dragon-{APP_NAME}" out, _, _ = ssh_exec( client, f"docker images --format '{{{{.Repository}}}}:{{{{.Tag}}}}' " f"| grep '{repo_filter}' | awk -F: '{{print $NF}}'", quiet=True, ) used = set() for line in out.split("\n"): line = line.strip() if line.startswith(prefix): num_part = line[len(prefix):] if num_part.isdigit(): used.add(int(num_part)) return max(used) + 1 if used else 1 # ==================== 主流程 ==================== def main(): parser = argparse.ArgumentParser( description="safety-eval-service 一键发布到开发环境 K8s", formatter_class=argparse.RawDescriptionHelpFormatter, epilog=__doc__, ) parser.add_argument("--jar", default=None, help="本地 JAR 路径 (不指定则自动查找)") parser.add_argument("--build", action="store_true", help="发布前先执行本地 mvn 编译") parser.add_argument("--version", default=None, help="镜像版本序号 (默认自动递增)") parser.add_argument("--app", default=APP_NAME, help=f"应用名 (默认: {APP_NAME})") parser.add_argument("--prefix", default=ENV_PREFIX, help=f"环境前缀 (默认: {ENV_PREFIX})") parser.add_argument("--no-deploy", action="store_true", help="只构建推送镜像，不部署 K8s") parser.add_argument("--deploy-only", action="store_true", help="只更新 K8s (需配合 --image 指定已存在的镜像)") parser.add_argument("--image", default=None, help="指定完整镜像地址 (配合 --deploy-only)") parser.add_argument("--restart", action="store_true", help="只重启 K8s (不改镜像，等同 rollout restart)") parser.add_argument("--dry-run", action="store_true", help="只打印计划，不实际执行") args = parser.parse_args() global APP_NAME, ENV_PREFIX APP_NAME = args.app ENV_PREFIX = args.prefix # ---- 仅重启 ---- if args.restart: do_k8s_restart(args.dry_run) return # ---- 仅部署 (镜像已存在) ---- if args.deploy_only: if not args.image: print("ERROR: --deploy-only 需要配合 --image <完整镜像地址>") sys.exit(1) do_k8s_deploy(args.image, args.dry_run) return # ==================== 完整流程: 编译+构建+推送+部署 ==================== date_tag = datetime.now().strftime("%Y%m%d") # [0] 本地编译 (可选) if args.build: local_mvn_build(PROJECT_DIR) # [1] 定位 JAR jar_local = args.jar or find_local_jar(PROJECT_DIR) if not jar_local or not os.path.exists(jar_local): print(f"ERROR: 未找到 JAR 文件: {jar_local or '(未自动发现)'}") print(f" 可用 --jar 指定路径，或加 --build 自动编译。") sys.exit(1) jar_size_mb = os.path.getsize(jar_local) / 1024 / 1024 jar_name = os.path.basename(jar_local) # ---- 连接 master 以确定版本号 ---- print("\n连接 K8s Master 节点...") client = paramiko.SSHClient() client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) client.connect(MASTER, username=SSH_USER, password=SSH_PASSWD, timeout=30) print(f" SSH 已连接: {MASTER}") version_suffix = args.version or next_version_suffix(client) image_tag = f"{ENV_PREFIX}-{date_tag}-{version_suffix}" full_image = (f"{ACR_REGISTRY}/{ACR_NAMESPACE}/" f"prod-aly-{ENV_PREFIX}-dragon-{APP_NAME}:{image_tag}") # ---- 打印发布计划 ---- print("\n" + "=" * 66) print(" safety-eval-service 一键发布到开发环境") print("=" * 66) print(f" JAR: {jar_local} ({jar_size_mb:.1f} MB)") print(f" 应用: {APP_NAME}") print(f" 镜像 Tag: {image_tag}") print(f" 完整镜像: {full_image}") print(f" K8s: {K8S_NAMESPACE}/{DEPLOY_NAME}") print(f" Master: {MASTER}") print("=" * 66) if args.dry_run: print("\n[DRY RUN] 以上为发布计划，未实际执行。") client.close() return # [2] 准备远程目录 + 上传 JAR print(f"\n[1/6] 上传 JAR 到 master ({jar_size_mb:.1f} MB)...") ssh_exec(client, f"rm -rf {REMOTE_BUILD_DIR} && mkdir -p {REMOTE_BUILD_DIR}/target", quiet=True) sftp = client.open_sftp() remote_jar = f"{REMOTE_BUILD_DIR}/target/{jar_name}" upload_with_progress(sftp, jar_local, remote_jar) # 上传 Dockerfile print(" 上传 Dockerfile...") if os.path.exists(DOCKERFILE_PATH): sftp.put(DOCKERFILE_PATH, f"{REMOTE_BUILD_DIR}/Dockerfile") else: # 回退: 用 heredoc 写入标准模板 print(" (未找到本地 Dockerfile，使用 master 上的模板)") ssh_exec(client, f"cp /opt/docker-templates/Dockerfile {REMOTE_BUILD_DIR}/Dockerfile " f"2>/dev/null || true", quiet=True) sftp.close() # [3] 准备构建上下文 (复制 JDK) print("\n[2/6] 准备构建上下文 (复制 JDK)...") ssh_exec(client, f"cp -r /opt/jdk1.8.0_202 {REMOTE_BUILD_DIR}/", timeout=120) ssh_exec(client, f"du -sh {REMOTE_BUILD_DIR}/") # [4] Docker build print("\n[3/6] 构建 Docker 镜像...") out, err, code = ssh_exec( client, f"docker build -t '{full_image}' {REMOTE_BUILD_DIR}", timeout=600 ) if code != 0: print("\nERROR: Docker build 失败！") client.close() sys.exit(1) # [5] 登录 + 推送 ACR print("\n[4/6] 推送镜像到杭州 ACR...") ssh_exec(client, f"echo '{ACR_PASS}' | docker login --username={ACR_USER} " f"--password-stdin {ACR_REGISTRY}", quiet=True) out, err, code = ssh_exec(client, f"docker push '{full_image}'", timeout=900) if code != 0: print("\nERROR: Docker push 失败！") client.close() sys.exit(1) ssh_exec(client, f"docker images | grep '{APP_NAME}' | head -5") # 清理远程构建目录 ssh_exec(client, f"rm -rf {REMOTE_BUILD_DIR}", quiet=True) if args.no_deploy: client.close() print("\n" + "=" * 66) print(" 构建推送完成 (--no-deploy 已跳过 K8s 部署)") print("=" * 66) print(f"\n 镜像地址: {full_image}\n") return # [6] 部署到 K8s print("\n[5/6] 部署到 K8s...") do_k8s_deploy(full_image, dry_run=False, client=client) # [7] 校验 print("\n[6/6] 校验 Pod 状态...") verify_rollout(client) client.close() print("\n" + "=" * 66) print(" 发布完成！") print("=" * 66) print(f" 镜像: {full_image}") print(f" 服务: safety-eval-service (Nacos: {K8S_NAMESPACE})") print(f" 网关: http://192.168.20.100:30140/safety-eval/ (Header: filterGatewaName: cqanquan)") print("=" * 66) def do_k8s_deploy(full_image, dry_run, client=None): """更新 K8s Deployment 镜像并触发滚动更新。""" own_client = client is None if own_client: client = paramiko.SSHClient() client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) client.connect(MASTER, username=SSH_USER, password=SSH_PASSWD, timeout=30) # 检查 Deployment 是否存在 out, _, code = ssh_exec( client, f"{KUBECTL} get deployment {DEPLOY_NAME} -n {K8S_NAMESPACE} --ignore-not-found", quiet=True, ) deploy_exists = code == 0 and DEPLOY_NAME in out if dry_run: print(f" [DRY RUN] 将更新镜像: {full_image}") if own_client: client.close() return if deploy_exists: # 更新镜像 print(f" 更新 Deployment 镜像...") out, err, code = ssh_exec( client, f"{KUBECTL} set image deployment/{DEPLOY_NAME} " f"{CONTAINER_NAME}={full_image} -n {K8S_NAMESPACE}" ) if code != 0: print(f" ERROR: kubectl set image 失败: {err}") if own_client: client.close() sys.exit(1) else: # 首次部署: 用 docs/deploy 下的 yaml 创建 print(f" Deployment 不存在，尝试 apply 部署 yaml...") deploy_yaml = f"/tmp/{DEPLOY_NAME}.yaml" local_yaml = os.path.join(PROJECT_DIR, "docs", "deploy", "safety-eval-deploy.yaml") if os.path.exists(local_yaml): sftp = client.open_sftp() sftp.put(local_yaml, deploy_yaml) sftp.close() # 先替换镜像为本次构建的镜像 ssh_exec(client, f"sed -i 's|image: .*|image: {full_image}|' {deploy_yaml}", quiet=True) ssh_exec(client, f"{KUBECTL} apply -f {deploy_yaml} -n {K8S_NAMESPACE}") ssh_exec(client, f"rm -f {deploy_yaml}", quiet=True) else: print(" ERROR: Deployment 不存在且找不到部署 yaml，请先手动创建 Deployment。") if own_client: client.close() sys.exit(1) if own_client: client.close() def do_k8s_restart(dry_run): """仅重启 K8s (不改镜像)。""" print("=" * 66) print(f" 重启 K8s Deployment: {K8S_NAMESPACE}/{DEPLOY_NAME}") print("=" * 66) if dry_run: print(" [DRY RUN] 将执行 rollout restart") return client = paramiko.SSHClient() client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) client.connect(MASTER, username=SSH_USER, password=SSH_PASSWD, timeout=30) print("\n触发滚动重启...") ssh_exec(client, f"{KUBECTL} rollout restart deployment/{DEPLOY_NAME} -n {K8S_NAMESPACE}") verify_rollout(client) client.close() def verify_rollout(client): """等待滚动更新完成并打印 Pod 状态与最近日志。""" print(" 等待滚动更新完成 (最多 300s)...") out, err, code = ssh_exec( client, f"{KUBECTL} rollout status deployment/{DEPLOY_NAME} " f"-n {K8S_NAMESPACE} --timeout=300s", timeout=320, ) if code != 0: print(f" ⚠ 滚动更新未完成或超时: {err}") print(" 最近事件:") ssh_exec(client, f"{KUBECTL} get events -n {K8S_NAMESPACE} --sort-by=.metadata.creationTimestamp " f"| grep -i 'safety-eval' | tail -15") # Pod 状态 print("\n Pod 状态:") ssh_exec(client, f"{KUBECTL} get pods -n {K8S_NAMESPACE} -o wide | grep 'safety-eval' | head -10") # 最近日志 print("\n 最近启动日志 (最后 40 行):") ssh_exec(client, f"{KUBECTL} logs deployment/{DEPLOY_NAME} -n {K8S_NAMESPACE} --tail=40") if __name__ == "__main__": main()