DevOps全链路实战 | 第 4 天：GitLab CE 自托管部署：代码仓库与项目管理平台

# 查看 K8s 节点资源使用情况

kubectl top nodes

# GitLab 最低配置要求：

# CPU: 4 核可用

# 内存: 8GB 可用

# 存储: 100GB SSD

# 推荐生产配置：8 核 CPU / 16GB 内存 / 200GB SSD

# 确认节点是否有 taint 导致 Pod 无法调度

kubectl describe nodes | grep -A5 Taints

# 确认 StorageClass 已就绪（前序文章已部署）

kubectl get sc

# 预期输出：

# NAME PROVISIONER RECLAIMPOLICY

# local-storage kubernetes.io/no-provisioner Delete

# ceph-block-rbd rook-ceph.rbd.csi.ceph.com Delete

# 规划域名解析（以 stellardata.top 为例）

# 需要的子域名：

# gitlab.stellardata.top → GitLab Web 服务

# minio.stellardata.top → 内置对象存储（用于 LFS/上传附件）

#

# 查看现有 Ingress Controller 的外部 IP

kubectl -n kube-system get svc traefik

# 将 gitlab.stellardata.top 的 A 记录指向该外部 IP

# 添加 GitLab 官方 Helm Chart 仓库

helm repo add gitlab https://charts.gitlab.io/

helm repo update

# 查询可用版本

helm search repo gitlab/gitlab –versions | head -5

# 预期输出：

# gitlab/gitlab 8.9.2 17.8.2 GitLab is the most comprehensive…

# gitlab-values.yaml

global:

edition: CE

hosts:

domain: stellardata.top

gitlab:

name: gitlab.stellardata.top

https: true

ingress:

class: traefik

annotations:

traefik.ingress.kubernetes.io/router.entrypoints: websecure

traefik.ingress.kubernetes.io/router.tls: "true"

tls:

enabled: true

certmanager:

install: false

nginx-ingress:

enabled: false

redis:

install: true

resources:

requests:

cpu: 500m

memory: 1Gi

postgresql:

install: true

resources:

requests:

cpu: 500m

memory: 1Gi

minio:

install: true

resources:

requests:

cpu: 250m

memory: 256Mi

gitlab-runner:

install: false

webservice:

resources:

requests:

cpu: 1

memory: 3.5Gi

limits:

memory: 5Gi

sidekiq:

resources:

requests:

cpu: 500m

memory: 1Gi

gitaly:

resources:

requests:

cpu: 500m

memory: 512Mi

# 创建命名空间

kubectl create namespace gitlab

# 执行 Helm 部署

helm install gitlab gitlab/gitlab

-n gitlab

-f gitlab-values.yaml

–timeout 15m

–version 8.9.2

# 实时监控部署进度

kubectl -n gitlab get pods -w

# 等待所有 Pod 就绪（约 5-10 分钟）

kubectl -n gitlab wait –for=condition=Ready pods –all

-n gitlab –timeout=600s

# 最终状态确认

kubectl -n gitlab get pods

# 预期输出：

# NAME READY STATUS RESTARTS

# gitlab-gitaly-0 1/1 Running 0

# gitlab-minio-xxxxx 1/1 Running 0

# gitlab-postgresql-0 1/1 Running 0

# gitlab-redis-master-0 1/1 Running 0

# gitlab-sidekiq-all-in-1-v2-xxxx 1/1 Running 0

# gitlab-webservice-default-xxxx 1/1 Running 0

# gitlab-workhorse-xxxxx 1/1 Running 0

# 获取 root 用户初始密码

kubectl -n gitlab get secret gitlab-gitlab-initial-root-password

-o jsonpath="{.data.password}" | base64 -d

# 输出示例：4xK9mP2vQ8rT1nB7sW3dF6hJ0lY5cZ

# 查看 Ingress 访问入口

kubectl -n gitlab get ingress

# NAME CLASS HOSTS ADDRESS

# gitlab-webservice traefik gitlab.stellardata.top 10.0.0.50

# 创建 DevOps 全链路专用 Group

curl -k –request POST "https://gitlab.stellardata.top/api/v4/groups"

–header "PRIVATE-TOKEN: <your-access-token>"

–header "Content-Type: application/json"

–data '{"name": "devops-chain", "path": "devops-chain", "visibility": "private"}'

# 在 Group 下创建示例项目

curl -k –request POST "https://gitlab.stellardata.top/api/v4/projects"

–header "PRIVATE-TOKEN: <your-access-token>"

–header "Content-Type: application/json"

–data '{"name": "demo-app", "path": "demo-app", "namespace_id": 2, "visibility": "private", "initialize_with_readme": true}'

# 在 GitLab Web 界面操作：

# User Settings → Access Tokens → Create new token

# Name: ci-deploy-token

# Scopes: api, read_repository, write_repository

# 记录生成的 Token（仅显示一次）

# 验证 Token 可用性

curl -k –header "PRIVATE-TOKEN: <your-token>"

"https://gitlab.stellardata.top/api/v4/user"

# 预期返回 JSON：

# {"id":1,"username":"root","name":"Administrator",…}

# 在开发机上生成 ed25519 SSH Key

ssh-keygen -t ed25519 -C "devops@stellardata.top"

-f ~/.ssh/gitlab_key -N ""

# 查看并复制公钥

cat ~/.ssh/gitlab_key.pub

# 添加到 GitLab：

# User Settings → SSH Keys → Add SSH Key → 粘贴公钥 → Add Key

# 测试 SSH 连接

ssh -i ~/.ssh/gitlab_key -T git@gitlab.stellardata.top

# 预期输出：

# Welcome to GitLab, @root!

# 克隆仓库

git clone git@gitlab.stellardata.top:devops-chain/demo-app.git

cd demo-app

# 创建项目目录结构

mkdir -p src/app deploy/k8s

# 编写 FastAPI 应用

cat > src/app/main.py << 'PYEOF'

from fastapi import FastAPI

import os

app = FastAPI(title="DevOps Chain Demo")

VERSION = os.getenv("APP_VERSION", "1.0.0")

@app.get("/health")

def health():

return {"status": "ok", "version": VERSION}

@app.get("/")

def root():

return {"message": "Hello from DevOps Chain", "version": VERSION}

PYEOF

# 编写 Dockerfile

cat > Dockerfile << 'DEOF'

FROM python:3.12-slim

WORKDIR /app

COPY src/app/ .

RUN pip install –no-cache-dir fastapi uvicorn

EXPOSE 8000

CMD ["uvicorn", "main:app", "–host", "0.0.0.0", "–port", "8000"]

DEOF

# 编写 .gitignore

cat > .gitignore << 'GEOF'

__pycache__/

*.pyc

.env

.venv/

*.egg-info/

GEOF

# 提交并推送代码

git add .

git commit -m "feat: 初始化 demo-app 项目结构与 FastAPI 应用"

git push origin main

# 通过 API 确认代码已推送

curl -k –header "PRIVATE-TOKEN: <your-token>"

"https://gitlab.stellardata.top/api/v4/projects/2/repository/tree"

# 预期返回 JSON：

# [{"name":"Dockerfile","type":"blob"}, …]

# 查看 Pod 事件

kubectl -n gitlab describe pod <pod-name> | tail -20

# 检查 PVC 状态

kubectl -n gitlab get pvc

# 若 PVC 处于 Pending，确认 StorageClass 可用且容量充足

# 查看 Webservice Pod 日志

kubectl -n gitlab logs -l app=webservice –tail=50

# 检查 Pod 重启情况

kubectl -n gitlab get pods | grep webservice

# 若 RESTARTS 大于 0，通常是内存不足导致 OOMKilled

# 解决方案：调大 webservice.resources.requests.memory

# 检查 Ingress TLS Secret

kubectl -n gitlab get ingress -o yaml | grep -A10 tls

# 如使用 cert-manager 自动签发

kubectl get certificate -n gitlab

kubectl describe certificate gitlab-wildcard-tls -n gitlab

# 手动管理证书方式——创建 TLS Secret

kubectl create secret tls gitlab-tls

–cert=fullchain.pem

–key=privkey.pem

-n gitlab