AKS で git-sync を使って Azure Files に複製するときの試行錯誤

https://username@dev.azure.com/organizationName/ProjectName/_git/dev-files-sync

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: files-sync # アプリケーションの名前
spec:
  destination:
    namespace: default # デプロイ先のネームスペース
    server: https://kubernetes.default.svc # デプロイ先のクラスター
  project: default # Argo CD のプロジェクト名
  source:
    path: manifests # Git リポジトリ内のマニフェストファイルがあるパス
    repoURL: https://username@dev.azure.com/organizationName/ProjectName/_git/dev-files-sync
    targetRevision: HEAD # Git リポジトリのリビジョン
  syncPolicy:
    automated: # 自動同期を有効にする
      prune: false # クラスター内の不要なリソースを削除する
      selfHeal: true # クラスター内のリソースの状態を修復する

apiVersion: v1
kind: Pod
metadata:
  name: git-repo-sync # ポッドの名前
spec:
  containers:
  - name: git-repo-sync # コンテナの名前
    image: argoproj/gitops-agent # GitOps エンジンを提供するイメージ
    args:
    - /bin/sh
    - -c
    - |
      git clone https://<PAT>@dev.azure.com/organizationName/ProjectName/_git/dev-files-sync /mnt/sync-files # Git リポジトリを Azure Files にクローンする
      cd /mnt/sync-files # クローンしたディレクトリに移動する
      gitops --repo-url https://<PAT>@dev.azure.com/organizationName/ProjectName/_git/dev-files-sync --branch main --path . --dest-path /mnt/sync-files # GitOps エンジンを起動する
    volumeMounts:
    - name: azurefile # ボリュームの名前
      mountPath: /mnt/sync-files # マウント先のパス
  volumes:
  - name: azurefile # ボリュームの名前
    persistentVolumeClaim:
      claimName: azurefile # 永続ボリュームクレームの名前

apiVersion: v1
kind: PersistentVolume
metadata:
  annotations:
    pv.kubernetes.io/provisioned-by: file.csi.azure.com
  name: azurefile
spec:
  capacity:
    storage: 5Gi
  accessModes:
    - ReadWriteMany
  persistentVolumeReclaimPolicy: Retain
  storageClassName: azurefile-csi
  csi:
    driver: file.csi.azure.com
    readOnly: false
    volumeHandle: unique-volumeid  # make sure this volumeid is unique for every identical share in the cluster
    volumeAttributes:
      resourceGroup: MC_rg_2
      shareName: files-sync // ファイル共有名
    nodeStageSecretRef:
      name: azure-secret
      namespace: default
  mountOptions:
    - dir_mode=0777
    - file_mode=0777
    - uid=0
    - gid=0
    - noperm

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: azurefile
spec:
  accessModes:
    - ReadWriteMany
  storageClassName: azurefile-csi
  volumeName: azurefile
  resources:
    requests:
      storage: 5Gi

kubectl create secret generic azure-secret --from-literal=azurestorageaccountname=<ストレージ名> --from-literal=azurestorageaccountkey=<ストレージキー>

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ .Release.Name }}-deployment
  namespace: {{ default "staging" .Release.Namespace }}
  labels:
    app: {{ .Values.label.app }}
spec:
  replicas: 1
  selector:
    matchLabels:
      app: {{ .Values.label.app }}
  template:
    metadata:
      labels:
        app: {{ .Values.label.app }}
    spec:
      containers:
        - name: {{ .Release.Name }}
          image: {{ .Values.image.registry }}.azurecr.io/{{ .Values.image.name }}:{{ default "latest" .Values.image.tag }}
          resources:
            requests:
              cpu: 300m
              memory: 512Mi
          ports:
            - containerPort: 8080
          volumeMounts:
            - name: azurefile
              mountPath: /mnt/sync-files
      volumes:
        - name: azurefile
          persistentVolumeClaim:
            claimName: azurefile

apiVersion: v1
kind: Service
metadata:
  name: {{ .Release.Name }}
  namespace: {{ default "staging" .Release.Namespace }}
spec:
  selector:
    app: {{ .Values.label.app }}
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: 8080
  type: ClusterIP

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {{ .Release.Name }}
  namespace: {{ default "staging" .Release.Namespace }}
  annotations:
    kubernetes.io/ingress.class: addon-http-application-routing
spec:
  rules:
    - host: <AKSのサブドメイン>.{{ .Values.dns.name }}
      http:
        paths:
          - backend:
              service:
                name: {{ .Release.Name }}
                port:
                  name: http
            path: /
            pathType: Prefix

label:
  app: main-app
image:
  registry: ACRのリポジトリ名
  name: imageの名前
  tag: latest
dns:
  name: *****.japaneast.aksapp.io

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ .Release.Name }}-deployment
  namespace: {{ default "staging" .Release.Namespace }}
  labels:
    app: {{ .Values.label.app }}
spec:
  replicas: 1
  selector:
    matchLabels:
      app: {{ .Values.label.app }}
  template:
    metadata:
      labels:
        app: {{ .Values.label.app }}
    spec:
      containers:
        - name: {{ .Release.Name }}
          image: {{ .Values.image.registry }}.azurecr.io/{{ .Values.image.name }}:{{ default "latest" .Values.image.tag }}
          resources:
            requests:
              cpu: 300m
              memory: 512Mi
          ports:
            - containerPort: 8080
          volumeMounts:
            - name: azurefile
              mountPath: /mnt/sync-files
        - name: git-sync # サイドカーコンテナの名前
          image: registry.k8s.io/git-sync/git-sync:v4.1.0 # git-sync
          securityContext: # セキュリティコンテキストを追加する
            runAsUser: 0 # ユーザーIDを0にする
            runAsGroup: 0 # グループIDを0にする
          volumeMounts:
            - name: azurefile # メインコンテナと同じボリュームをマウントする
              mountPath: /mnt/sync-files # マウント先のディレクトリ
          args:
            - --repo=https://<PAT>@dev.azure.com/organizationName/ProjectName/_git/dev-files-sync
            - --depth=1
            - --period=30s
            - --ref=main
            - --link=current
            - --root=/mnt/sync-files
      volumes:
        - name: azurefile
          persistentVolumeClaim:
            claimName: azurefile # AzureFilesのCSIドライバーを使ってプロビジョニングされたファイル共有を参照するPVCの名前

          securityContext: # セキュリティコンテキストを追加する
            runAsUser: 0 # ユーザーIDを0にする
            runAsGroup: 0 # グループIDを0にする

Usage of /git-sync:
      --add-user                          add a record to /etc/passwd for the current UID/GID (needed to use SSH with an arbitrary UID)
      --askpass-url string                a URL to query for git credentials (username=<value> and password=<value>)
      --cookie-file                       use a git cookiefile (/etc/git-secret/cookie_file) for authentication
      --credential credentialSlice        one or more credentials (see --man for details) available for authentication (default [])
      --depth int                         create a shallow clone with history truncated to the specified number of commits (default 1)
      --error-file string                 the path (absolute or relative to --root) to an optional file into which errors will be written (defaults to disabled)
      --exechook-backoff duration         the time to wait before retrying a failed exechook (default 3s)
      --exechook-command string           an optional command to be run when syncs complete (must be idempotent)
      --exechook-timeout duration         the timeout for the exechook (default 30s)
      --git string                        the git command to run (subject to PATH search, mostly for testing) (default "git")
      --git-config string                 additional git config options in 'section.var1:val1,"section.sub.var2":"val2"' format
      --git-gc string                     git garbage collection behavior: one of 'auto', 'always', 'aggressive', or 'off' (default "always")
      --group-write                       ensure that all data (repo, worktrees, etc.) is group writable
  -h, --help                              print help text and exit
      --http-bind string                  the bind address (including port) for git-sync's HTTP endpoint
      --http-metrics                      enable metrics on git-sync's HTTP endpoint
      --http-pprof                        enable the pprof debug endpoints on git-sync's HTTP endpoint
      --link string                       the path (absolute or relative to --root) at which to create a symlink to the directory holding the checked-out files (defaults to the leaf dir of --repo)
      --man                               print the full manual and exit
      --max-failures int                  the number of consecutive failures allowed before aborting (-1 will retry forever
      --one-time                          exit after the first sync
      --password string                   the password or personal access token to use for git auth (prefer --password-file or this env var)
      --password-file string              the file from which the password or personal access token for git auth will be sourced
      --period duration                   how long to wait between syncs, must be >= 10ms; --wait overrides this (default 10s)
      --ref string                        the git revision (branch, tag, or hash) to sync (default "HEAD")
      --repo string                       the git repository to sync (required) (default "https://5h4quzpeia6wn5v273bxxp5xjzqfraltxi6iofeimsjvcy6g7kna@dev.azure.com/mtisoldev/MobileConvert/_git/dev-mcp-site-config")
      --root string                       the root directory for git-sync operations (required) (default "/git")
      --sparse-checkout-file string       the path to a sparse-checkout file
      --ssh-key-file stringArray          the SSH key(s) to use (default [/etc/git-secret/ssh])
      --ssh-known-hosts                   enable SSH known_hosts verification (default true)
      --ssh-known-hosts-file string       the known_hosts file to use (default "/etc/git-secret/known_hosts")
      --stale-worktree-timeout duration   how long to retain non-current worktrees
      --submodules string                 git submodule behavior: one of 'recursive', 'shallow', or 'off' (default "recursive")
      --sync-on-signal string             sync on receipt of the specified signal (e.g. SIGHUP)
      --sync-timeout duration             the total time allowed for one complete sync, must be >= 10ms; --timeout overrides this (default 2m0s)
      --touch-file string                 the path (absolute or relative to --root) to an optional file which will be touched whenever a sync completes (defaults to disabled)
      --username string                   the username to use for git auth
  -v, --verbose int                       logs at this V level and lower will be printed
      --version                           print the version and exit
      --webhook-backoff duration          the time to wait before retrying a failed webhook (default 3s)
      --webhook-method string             the HTTP method for the webhook (default "POST")
      --webhook-success-status int        the HTTP status code indicating a successful webhook (0 disables success checks (default 200)
      --webhook-timeout duration          the timeout for the webhook (default 1s)
      --webhook-url string                a URL for optional webhook notifications when syncs complete (must be idempotent)

helm list
helm install リリース名 .
helm upgrade リリース名 .
helm uninstall リリース名
helm history リリース名

# pod のリスト
kubectl get pods

# deploy したpod の詳細を確認
kubectl describe pod リリース名

# アプリケーションがマウントしているボリュームの中の確認
kubectl exec リリース名-deployment-********** -- ls -l /mnt/files-sync

# サイドカー(git-sync)のログ取得
kubectl logs pod名 -c git-sync

# 変更を適用
kubectl apply -f azurefiles-pv.yaml

# シークレットの削除
kubectl delete secret azure-secret