From 6d7cd108d3eb7871e523eb14bc33bfa2a9e32074 Mon Sep 17 00:00:00 2001
From: luochen570 <1160510664@qq.com>
Date: Sun, 31 May 2026 03:36:25 +0800
Subject: [PATCH] ci: deploy Hugo blog to k3s via Podman + k8s API

- Use Podman (daemonless) instead of Docker for building images
- kubeconfig stored as Gitea secret KUBECONFIG_B64
- RBAC: hugo-deployer SA for k8s API access
- Gitea Registry enabled for container storage
---
 .gitea/workflows/deploy.yml | 57 ++++++++++++++++++++++++++-----------
 .gitignore                  |  1 +
 deploy/deploy.sh            | 47 ++++++++++++++++++++++++++++++
 3 files changed, 88 insertions(+), 17 deletions(-)
 create mode 100755 deploy/deploy.sh

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 1f3de8d..b5c7468 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -14,7 +14,6 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      packages: write
 
     steps:
       - name: Checkout
@@ -29,26 +28,50 @@ jobs:
       - name: Hugo Build
         run: hugo --minify
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+      - name: Install Podman
+        run: |
+          apt-get update -qq
+          apt-get install -y -qq podman fuse-overlayfs
+          # Configure Podman for Gitea Registry
+          mkdir -p /etc/containers/registries.conf.d
+          cat > /etc/containers/registries.conf.d/gitea-registry.conf <<REGCFG
+          [[registry]]
+          location = "${{ env.REGISTRY }}"
+          insecure = true
+          REGCFG
 
-      - name: Login to Gitea Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: luochen570
-          password: ${{ secrets.REGISTRY_TOKEN }}
+      - name: Build and Push with Podman
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          # Login to Gitea Registry
+          echo "$REGISTRY_TOKEN" | \
+            podman login ${{ env.REGISTRY }} -u luochen570 --password-stdin
 
-      - name: Build and Push Docker Image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          push: true
-          tags: |
-            ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }}
+          # Build image (daemonless!)
+          podman build -t ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }} .
+          podman tag ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }} \
             ${{ env.REGISTRY }}/${{ env.IMAGE }}:latest
 
+          # Push
+          podman push ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }}
+          podman push ${{ env.REGISTRY }}/${{ env.IMAGE }}:latest
+
       - name: Deploy to k3s
+        env:
+          KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
         run: |
-          kubectl set image deployment/hugo-blog -n hugo \
+          # Decode kubeconfig
+          echo "$KUBECONFIG_B64" | base64 -d > /tmp/kubeconfig.json
+
+          # Download kubectl
+          curl -fsSLO "https://dl.k8s.io/release/v1.32.0/bin/linux/amd64/kubectl"
+          chmod +x kubectl
+
+          # Rollout new image
+          ./kubectl --kubeconfig /tmp/kubeconfig.json \
+            set image deployment/hugo-blog -n hugo \
             nginx=${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }}
+
+          ./kubectl --kubeconfig /tmp/kubeconfig.json \
+            rollout status deployment/hugo-blog -n hugo --timeout=120s
diff --git a/.gitignore b/.gitignore
index 6f07aca..bf9ff7d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,3 +15,4 @@ Thumbs.db
 # Hugo cache
 .hugo_build.lock
 resources/_gen/
+deploy/kubeconfig.json
diff --git a/deploy/deploy.sh b/deploy/deploy.sh
new file mode 100755
index 0000000..b95b160
--- /dev/null
+++ b/deploy/deploy.sh
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# hugo-blog deploy script
+# Runs on UC server: git pull -> hugo -> docker build+push -> kubectl rollout
+set -euo pipefail
+
+REPO_DIR="/root/hugo-blog"
+REGISTRY="git.luochen570.cn"
+IMAGE="luochen570/hugo-blog"
+NAMESPACE="hugo"
+DEPLOYMENT="hugo-blog"
+
+cd "$REPO_DIR"
+
+# 1. Pull latest
+echo "=== Pull latest ==="
+git fetch origin main
+LOCAL=$(git rev-parse HEAD)
+REMOTE=$(git rev-parse origin/main)
+if [ "$LOCAL" = "$REMOTE" ]; then
+  echo "Already up to date ($LOCAL). Nothing to do."
+  exit 0
+fi
+git merge --ff-only origin/main
+
+SHA=$(git rev-parse --short HEAD)
+echo "New commit: $SHA"
+
+# 2. Hugo build
+echo "=== Hugo build ==="
+hugo --minify -d public/
+
+# 3. Docker build and push
+echo "=== Docker build ==="
+docker build -t $REGISTRY/$IMAGE:$SHA -t $REGISTRY/$IMAGE:latest .
+
+echo "=== Docker push ==="
+docker login $REGISTRY -u luochen570 --password-stdin < ~/.config/gitea/token
+docker push $REGISTRY/$IMAGE:$SHA
+docker push $REGISTRY/$IMAGE:latest
+
+# 4. Deploy to k3s
+echo "=== k3s rollout ==="
+kubectl set image deployment/$DEPLOYMENT -n $NAMESPACE \
+  nginx=$REGISTRY/$IMAGE:$SHA
+kubectl rollout status deployment/$DEPLOYMENT -n $NAMESPACE --timeout=120s
+
+echo "=== Done: $SHA ==="