216 lines
8.3 KiB
YAML
216 lines
8.3 KiB
YAML
name: Deploy / Update K8s Apps
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
paths:
|
|
- "k8s/apps/**.tfvars"
|
|
|
|
env:
|
|
TOFU_VERSION: "1.9.0"
|
|
TOFU_WORKING_DIR: "k8s"
|
|
|
|
jobs:
|
|
detect-changes:
|
|
name: Detect changed K8s tfvars
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
added_modified: ${{ steps.diff.outputs.added_modified }}
|
|
deleted: ${{ steps.diff.outputs.deleted }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 2
|
|
|
|
- name: Compute diff
|
|
id: diff
|
|
run: |
|
|
ADDED_MODIFIED=$(git diff --name-only --diff-filter=ACM HEAD~1 HEAD -- 'k8s/apps/*.tfvars' | jq -R -s -c 'split("\n") | map(select(length > 0))')
|
|
DELETED=$(git diff --name-only --diff-filter=D HEAD~1 HEAD -- 'k8s/apps/*.tfvars' | jq -R -s -c 'split("\n") | map(select(length > 0))')
|
|
echo "added_modified=$ADDED_MODIFIED" >> "$GITHUB_OUTPUT"
|
|
echo "deleted=$DELETED" >> "$GITHUB_OUTPUT"
|
|
|
|
# ─── Deploy / Update ──────────────────────────────────────────────────────
|
|
deploy:
|
|
name: Deploy ${{ matrix.tfvars }}
|
|
needs: detect-changes
|
|
if: ${{ needs.detect-changes.outputs.added_modified != '[]' }}
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
tfvars: ${{ fromJson(needs.detect-changes.outputs.added_modified) }}
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install OpenTofu
|
|
run: |
|
|
curl -fsSL https://get.opentofu.org/install-opentofu.sh | sh -s -- --install-method standalone --opentofu-version ${{ env.TOFU_VERSION }}
|
|
|
|
- name: Install gopass
|
|
run: |
|
|
curl -fsSL https://github.com/gopasspw/gopass/releases/latest/download/gopass-linux-amd64.tar.gz | tar xz
|
|
sudo mv gopass /usr/local/bin/
|
|
|
|
- name: Configure gopass
|
|
env:
|
|
GOPASS_GPG_KEY: ${{ secrets.GOPASS_GPG_KEY }}
|
|
GOPASS_STORE_REPO: ${{ secrets.GOPASS_STORE_REPO }}
|
|
run: |
|
|
echo "$GOPASS_GPG_KEY" | gpg --batch --import
|
|
gopass clone "$GOPASS_STORE_REPO"
|
|
|
|
- name: Resolve app name from tfvars filename
|
|
id: app
|
|
run: |
|
|
APP=$(basename "${{ matrix.tfvars }}" .tfvars)
|
|
echo "name=$APP" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Fetch kubeconfig from gopass
|
|
run: |
|
|
# Adjust the gopass path to match your store layout.
|
|
# The cluster name can be embedded in the tfvars or derived from the app name.
|
|
gopass show -o "infra/kubeconfigs/${{ steps.app.outputs.name }}" > /tmp/kubeconfig
|
|
chmod 600 /tmp/kubeconfig
|
|
|
|
- name: Fetch secrets from gopass
|
|
id: secrets
|
|
run: |
|
|
RABBITMQ_PASSWORD=$(gopass show -o "apps/${{ steps.app.outputs.name }}/rabbitmq_password" 2>/dev/null || echo "")
|
|
LOKI_AUTH_TOKEN=$(gopass show -o "apps/${{ steps.app.outputs.name }}/loki_token" 2>/dev/null || echo "")
|
|
echo "::add-mask::$RABBITMQ_PASSWORD"
|
|
echo "::add-mask::$LOKI_AUTH_TOKEN"
|
|
echo "rabbitmq_password=$RABBITMQ_PASSWORD" >> "$GITHUB_OUTPUT"
|
|
echo "loki_auth_token=$LOKI_AUTH_TOKEN" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: tofu init
|
|
working-directory: ${{ env.TOFU_WORKING_DIR }}
|
|
env:
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.SEAWEED_ACCESS_KEY }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.SEAWEED_SECRET_KEY }}
|
|
run: |
|
|
tofu init \
|
|
-backend-config="bucket=tofu-state" \
|
|
-backend-config="key=apps-k8s/${{ steps.app.outputs.name }}.tfstate" \
|
|
-backend-config="endpoint=${{ secrets.SEAWEED_S3_ENDPOINT }}" \
|
|
-backend-config="region=us-east-1" \
|
|
-backend-config="force_path_style=true"
|
|
|
|
- name: Select or create workspace
|
|
working-directory: ${{ env.TOFU_WORKING_DIR }}
|
|
run: |
|
|
tofu workspace select "${{ steps.app.outputs.name }}" \
|
|
|| tofu workspace new "${{ steps.app.outputs.name }}"
|
|
|
|
- name: tofu apply
|
|
working-directory: ${{ env.TOFU_WORKING_DIR }}
|
|
env:
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.SEAWEED_ACCESS_KEY }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.SEAWEED_SECRET_KEY }}
|
|
run: |
|
|
tofu apply -auto-approve \
|
|
-var-file="../${{ matrix.tfvars }}" \
|
|
-var="kubeconfig_path=/tmp/kubeconfig" \
|
|
-var="rabbitmq_password=${{ steps.secrets.outputs.rabbitmq_password }}" \
|
|
-var="loki_auth_token=${{ steps.secrets.outputs.loki_auth_token }}"
|
|
|
|
- name: Cleanup
|
|
if: always()
|
|
run: rm -f /tmp/kubeconfig
|
|
|
|
# ─── Destroy (tfvars file deleted) ────────────────────────────────────────
|
|
destroy:
|
|
name: Destroy ${{ matrix.tfvars }}
|
|
needs: detect-changes
|
|
if: ${{ needs.detect-changes.outputs.deleted != '[]' }}
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
tfvars: ${{ fromJson(needs.detect-changes.outputs.deleted) }}
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
# Checkout previous commit to recover the deleted tfvars file
|
|
ref: ${{ github.event.before }}
|
|
|
|
- name: Install OpenTofu
|
|
run: |
|
|
curl -fsSL https://get.opentofu.org/install-opentofu.sh | sh -s -- --install-method=standalone --opentofu-version=${{ env.TOFU_VERSION }}
|
|
|
|
- name: Install gopass
|
|
run: |
|
|
curl -fsSL https://github.com/gopasspw/gopass/releases/latest/download/gopass-linux-amd64.tar.gz | tar xz
|
|
sudo mv gopass /usr/local/bin/
|
|
|
|
- name: Configure gopass
|
|
env:
|
|
GOPASS_GPG_KEY: ${{ secrets.GOPASS_GPG_KEY }}
|
|
GOPASS_STORE_REPO: ${{ secrets.GOPASS_STORE_REPO }}
|
|
run: |
|
|
echo "$GOPASS_GPG_KEY" | gpg --batch --import
|
|
gopass clone "$GOPASS_STORE_REPO"
|
|
|
|
- name: Resolve app name
|
|
id: app
|
|
run: |
|
|
APP=$(basename "${{ matrix.tfvars }}" .tfvars)
|
|
echo "name=$APP" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Fetch kubeconfig from gopass
|
|
run: |
|
|
gopass show -o "infra/kubeconfigs/${{ steps.app.outputs.name }}" > /tmp/kubeconfig
|
|
chmod 600 /tmp/kubeconfig
|
|
|
|
- name: Fetch secrets from gopass
|
|
id: secrets
|
|
run: |
|
|
RABBITMQ_PASSWORD=$(gopass show -o "apps/${{ steps.app.outputs.name }}/rabbitmq_password" 2>/dev/null || echo "")
|
|
LOKI_AUTH_TOKEN=$(gopass show -o "apps/${{ steps.app.outputs.name }}/loki_token" 2>/dev/null || echo "")
|
|
echo "::add-mask::$RABBITMQ_PASSWORD"
|
|
echo "::add-mask::$LOKI_AUTH_TOKEN"
|
|
echo "rabbitmq_password=$RABBITMQ_PASSWORD" >> "$GITHUB_OUTPUT"
|
|
echo "loki_auth_token=$LOKI_AUTH_TOKEN" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: tofu init
|
|
working-directory: ${{ env.TOFU_WORKING_DIR }}
|
|
env:
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.SEAWEED_ACCESS_KEY }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.SEAWEED_SECRET_KEY }}
|
|
run: |
|
|
tofu init \
|
|
-backend-config="bucket=tofu-state" \
|
|
-backend-config="key=apps-k8s/${{ steps.app.outputs.name }}.tfstate" \
|
|
-backend-config="endpoint=${{ secrets.SEAWEED_S3_ENDPOINT }}" \
|
|
-backend-config="region=us-east-1" \
|
|
-backend-config="force_path_style=true"
|
|
|
|
- name: Select workspace
|
|
working-directory: ${{ env.TOFU_WORKING_DIR }}
|
|
run: tofu workspace select "${{ steps.app.outputs.name }}"
|
|
|
|
- name: tofu destroy
|
|
working-directory: ${{ env.TOFU_WORKING_DIR }}
|
|
env:
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.SEAWEED_ACCESS_KEY }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.SEAWEED_SECRET_KEY }}
|
|
run: |
|
|
tofu destroy -auto-approve \
|
|
-var-file="../${{ matrix.tfvars }}" \
|
|
-var="kubeconfig_path=/tmp/kubeconfig" \
|
|
-var="rabbitmq_password=${{ steps.secrets.outputs.rabbitmq_password }}" \
|
|
-var="loki_auth_token=${{ steps.secrets.outputs.loki_auth_token }}"
|
|
|
|
- name: Delete workspace
|
|
working-directory: ${{ env.TOFU_WORKING_DIR }}
|
|
run: |
|
|
tofu workspace select default
|
|
tofu workspace delete "${{ steps.app.outputs.name }}"
|
|
|
|
- name: Cleanup
|
|
if: always()
|
|
run: rm -f /tmp/kubeconfig
|