From 1cec655168ec159dde38ec244045f81992e777df Mon Sep 17 00:00:00 2001 From: OG T Date: Mon, 30 Mar 2026 01:30:49 +0800 Subject: [PATCH] =?UTF-8?q?fix(security):=20P0=20=E7=A7=BB=E9=99=A4=20sudo?= =?UTF-8?q?=20=E5=AF=86=E7=A2=BC=E6=98=8E=E6=96=87?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 2026-03-30 ogt: 首席架構師審查 P0 修復 問題: cd.yaml 含明文 sudo 密碼 修復: 改用 ${{ secrets.SUDO_PASSWORD }} ⚠️ 需要在 Gitea 設定 SUDO_PASSWORD secret! Co-Authored-By: Claude Opus 4.5 --- .gitea/workflows/cd.yaml | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml index db8c1cbfc..518020e2c 100644 --- a/.gitea/workflows/cd.yaml +++ b/.gitea/workflows/cd.yaml @@ -87,6 +87,7 @@ jobs: - name: Deploy to K8s env: SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_KEY }} + SUDO_PASSWORD: ${{ secrets.SUDO_PASSWORD }} run: | mkdir -p ~/.ssh echo "$SSH_PRIVATE_KEY" > ~/.ssh/deploy_key @@ -95,21 +96,22 @@ jobs: set -e export KUBECONFIG=/etc/rancher/k3s/k3s.yaml - echo "0936223270" | sudo -S kubectl set image deployment/awoooi-api \ + # 2026-03-30 ogt: P0 安全修復 - 使用 secret 而非明文密碼 + echo "$SUDO_PASSWORD" | sudo -S kubectl set image deployment/awoooi-api \ api=192.168.0.110:5000/awoooi/api:${{ github.sha }} \ -n awoooi-prod - echo "0936223270" | sudo -S kubectl set image deployment/awoooi-web \ + echo "$SUDO_PASSWORD" | sudo -S kubectl set image deployment/awoooi-web \ web=192.168.0.110:5000/awoooi/web:${{ github.sha }} \ -n awoooi-prod - echo "0936223270" | sudo -S kubectl set image deployment/awoooi-worker \ + echo "$SUDO_PASSWORD" | sudo -S kubectl set image deployment/awoooi-worker \ worker=192.168.0.110:5000/awoooi/api:${{ github.sha }} \ -n awoooi-prod - echo "0936223270" | sudo -S kubectl rollout status deployment/awoooi-api -n awoooi-prod --timeout=120s - echo "0936223270" | sudo -S kubectl rollout status deployment/awoooi-web -n awoooi-prod --timeout=120s - echo "0936223270" | sudo -S kubectl rollout status deployment/awoooi-worker -n awoooi-prod --timeout=120s + echo "$SUDO_PASSWORD" | sudo -S kubectl rollout status deployment/awoooi-api -n awoooi-prod --timeout=120s + echo "$SUDO_PASSWORD" | sudo -S kubectl rollout status deployment/awoooi-web -n awoooi-prod --timeout=120s + echo "$SUDO_PASSWORD" | sudo -S kubectl rollout status deployment/awoooi-worker -n awoooi-prod --timeout=120s echo "✅ 部署完成" DEPLOY