Gitlab CICD sets wrong service url in the production environment

Question

After production deployment the application has not the endpoint of the environment.url from the .gitlab-ci.yml, but a combination of the groupname, projectname and basedomain: <groupname>-<projectname>.basedomain.

The Gitlab project belongs to a Gitlab group, which has an Kubernetes cluster. De group has a basedomain which is used in the .gitlab-ci.yml:

//part of .gitlab-ci.yml

... 

apply production secret configuration:
    stage: prepare-deploy
    extends: .auto-deploy
    needs: ["build", "generate production configuration"]
    dependencies:
        - generate production configuration
    script:
        - auto-deploy check_kube_domain
        - auto-deploy download_chart
        - auto-deploy ensure_namespace
        - kubectl create secret generic tasker-secrets-development --from-file=config.tar --dry-run -o yaml | kubectl apply -f -
    environment:
        name: production
        url: http://app.$KUBE_INGRESS_BASE_DOMAIN
        action: prepare
    rules:
        - if: '$CI_COMMIT_BRANCH == "master"'

...

I expected http://app.$KUBE_INGRESS_BASE_DOMAIN as the endpoint for the application.

The Ingress (I removed the minio part):



apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: {{ template "fullname" . }}
  labels:
    app: {{ template "appname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version| replace "+" "_" }}"
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
  annotations:
    cert-manager.io/cluster-issuer: {{ .Values.leIssuer }}
    acme.cert-manager.io/http01-edit-in-place: "true"
{{- if .Values.ingress.annotations }}
{{ toYaml .Values.ingress.annotations | indent 4 }}
{{- end }}
{{- with .Values.ingress.modSecurity }}
{{- if .enabled }}
    nginx.ingress.kubernetes.io/modsecurity-transaction-id: "$server_name-$request_id"
    nginx.ingress.kubernetes.io/modsecurity-snippet: |
      SecRuleEngine {{ .secRuleEngine | default "DetectionOnly" | title }}
{{- range $rule := .secRules }}
{{ (include "secrule" $rule) | indent 6 }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.prometheus.metrics }}
    nginx.ingress.kubernetes.io/server-snippet: |-
      location /metrics {
          deny all;
      }

{{- end }}
spec:
{{- if .Values.ingress.tls.enabled }}
  tls:
  - hosts:
{{- if .Values.service.commonName }}
    - {{ template "hostname" .Values.service.commonName }}
{{- end }}
    - {{ template "hostname" .Values.service.url }} <<<<<<<<<<<<<<<<<<<
{{- if .Values.service.additionalHosts }}
{{- range $host := .Values.service.additionalHosts }}
    - {{ $host }}
{{- end -}}
{{- end }}
    secretName: {{ .Values.ingress.tls.secretName | default (printf "%s-cert" (include "fullname" .)) }}
{{- end }}
  rules:
  - host: {{ template "hostname" .Values.service.url }} <<<<<<<<<<<<<<<<<
    http:
      &httpRule
      paths:
      - path: /
        backend:
          serviceName: {{ template "fullname" . }}
          servicePort: {{ .Values.service.externalPort }}
{{- if .Values.service.commonName }}
  - host: {{ template "hostname" .Values.service.commonName }}
    http:
      <<: *httpRule
{{- end -}}
{{- if .Values.service.additionalHosts }}
{{- range $host := .Values.service.additionalHosts }}
  - host: {{ $host }}
    http:
      <<: *httpRule
{{- end -}}
{{- end -}}

What I have done so far:

removed deployment from cluster, cleared the Gitlab runners cache, cleared the Gitlab cluster cache. Deleted the environment (stop and delete). Created a new environment 'production' with the right URL 'Operations>Environments>production>Edit'. After push the url has been replaced with the wrong one.
hard coded the url in Ingress (at the arrows in the snippet), it worked
changed the value in gitlab-ci.yml without http://. No result.
check the use of 'apply production secret configuration' in the gitlab-ci.yml, by adding echo 'message!'. Conclusion: this part of the file is used for production
A CICD variable Settings>CICD: GITLAB_ENVIRONMENT_URL. No effect.

UPDATE: Maybe the .Values.gitlab.app is used for the URL.

score 0 · Answer 1 · answered Feb 13 '21 at 15:11

The file .gitlab-ci.yml includes a template which overrides the value.

//.gitlab-ci.yml  


include:
  - template: Jobs/Deploy.gitlab-ci.yml  # https://gitlab.com/gitlab-org/gitlab-foss/blob/master/lib/gitlab/ci/templates/Jobs/Deploy.gitlab-ci.yml

The override in the template:


.production: &production_template
  extends: .auto-deploy
  stage: production
  script:
    - auto-deploy check_kube_domain
    - auto-deploy download_chart
    - auto-deploy ensure_namespace
    - auto-deploy initialize_tiller
    - auto-deploy create_secret
    - auto-deploy deploy
    - auto-deploy delete canary
    - auto-deploy delete rollout
    - auto-deploy persist_environment_url
  environment:
    name: production
    url: http://$CI_PROJECT_PATH_SLUG.$KUBE_INGRESS_BASE_DOMAIN <<<<<<<<<<<<<<
  artifacts:
    paths: [environment_url.txt, tiller.log]
    when: always

Gitlab CICD sets wrong service url in the production environment

1 Answers1