wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 4 Packages Projects Releases Wiki Activity

fix(security): P0 移除 sudo 密碼明文

Browse Source 
2026-03-30 ogt: 首席架構師審查 P0 修復

問題: cd.yaml 含明文 sudo 密碼
修復: 改用 ${{ secrets.SUDO_PASSWORD }}

⚠️ 需要在 Gitea 設定 SUDO_PASSWORD secret!

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
OG T
2026-03-30 01:30:49 +08:00
parent 9145faf24b
commit 1cec655168
1 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
.gitea/workflows/cd.yaml
View File

@@ -87,6 +87,7 @@ jobs:
- name: Deploy to K8s - name: Deploy to K8s
env: env:
SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_KEY }} SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
SUDO_PASSWORD: ${{ secrets.SUDO_PASSWORD }}
run: | run: |
mkdir -p ~/.ssh mkdir -p ~/.ssh
echo "$SSH_PRIVATE_KEY" > ~/.ssh/deploy_key echo "$SSH_PRIVATE_KEY" > ~/.ssh/deploy_key
@@ -95,21 +96,22 @@ jobs:
set -e set -e
export KUBECONFIG=/etc/rancher/k3s/k3s.yaml export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
echo "0936223270" | sudo -S kubectl set image deployment/awoooi-api \ # 2026-03-30 ogt: P0 安全修復 - 使用 secret 而非明文密碼
echo "$SUDO_PASSWORD" | sudo -S kubectl set image deployment/awoooi-api \
api=192.168.0.110:5000/awoooi/api:${{ github.sha }} \ api=192.168.0.110:5000/awoooi/api:${{ github.sha }} \
-n awoooi-prod -n awoooi-prod
echo "0936223270" | sudo -S kubectl set image deployment/awoooi-web \ echo "$SUDO_PASSWORD" | sudo -S kubectl set image deployment/awoooi-web \
web=192.168.0.110:5000/awoooi/web:${{ github.sha }} \ web=192.168.0.110:5000/awoooi/web:${{ github.sha }} \
-n awoooi-prod -n awoooi-prod
echo "0936223270" | sudo -S kubectl set image deployment/awoooi-worker \ echo "$SUDO_PASSWORD" | sudo -S kubectl set image deployment/awoooi-worker \
worker=192.168.0.110:5000/awoooi/api:${{ github.sha }} \ worker=192.168.0.110:5000/awoooi/api:${{ github.sha }} \
-n awoooi-prod -n awoooi-prod
echo "0936223270" | sudo -S kubectl rollout status deployment/awoooi-api -n awoooi-prod --timeout=120s echo "$SUDO_PASSWORD" | sudo -S kubectl rollout status deployment/awoooi-api -n awoooi-prod --timeout=120s
echo "0936223270" | sudo -S kubectl rollout status deployment/awoooi-web -n awoooi-prod --timeout=120s echo "$SUDO_PASSWORD" | sudo -S kubectl rollout status deployment/awoooi-web -n awoooi-prod --timeout=120s
echo "0936223270" | sudo -S kubectl rollout status deployment/awoooi-worker -n awoooi-prod --timeout=120s echo "$SUDO_PASSWORD" | sudo -S kubectl rollout status deployment/awoooi-worker -n awoooi-prod --timeout=120s
echo "✅ 部署完成" echo "✅ 部署完成"
DEPLOY DEPLOY