mirror of
https://github.com/kerberos-io/deployment.git
synced 2026-11-08 20:40:26 +00:00
Cédric VerstraetenandCopilot
913706fe3f
Pin the signed multiarchitecture digest, route unchanged external ports to HTTP 8080, enforce restricted security context and mount writable config/tmp volumes. Exercise a legacy upgrade and ConfigMap-backed settings after pod replacement on kind. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
84 lines
3.7 KiB
YAML
84 lines
3.7 KiB
YAML
name: Validate Kustomize, Garage and Factory on kind
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
pull_request:
|
|
schedule:
|
|
- cron: "0 0 * * *" # This will run the workflow every day at midnight UTC
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: ${{ matrix.os }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os: [ubuntu-22.04, ubuntu-24.04]
|
|
#kind: [v0.21.0, v0.22.0, v0.23.0, v0.24.0, v0.25.0]
|
|
kind: [v0.25.0]
|
|
steps:
|
|
- name: Create kind
|
|
uses: helm/kind-action@v1
|
|
with:
|
|
version: ${{ matrix.kind }}
|
|
- name: Print Kubernetes Version
|
|
run: |
|
|
kubectl version
|
|
- name: Test kind
|
|
run: |
|
|
kubectl get no
|
|
kubectl get pods -A -o wide
|
|
kubectl get sc
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
- name: Render base Kustomize manifests
|
|
run: kubectl kustomize base > "$RUNNER_TEMP/base.yaml"
|
|
- name: Use Kind storage provisioner
|
|
run: |
|
|
kubectl get storageclass standard -o json |
|
|
jq '{apiVersion,kind,metadata:{name:"ssd-hostpath"},provisioner,parameters,volumeBindingMode,reclaimPolicy}' |
|
|
kubectl apply -f -
|
|
- name: Install Garage and test persistent S3 access
|
|
run: |
|
|
bash scripts/install-garage.sh
|
|
bash scripts/check-garage.sh
|
|
credential_hash="$(kubectl -n garage get secret garage-credentials -o jsonpath='{.data}' | sha256sum)"
|
|
bash scripts/install-garage.sh
|
|
test "$credential_hash" = "$(kubectl -n garage get secret garage-credentials -o jsonpath='{.data}' | sha256sum)"
|
|
bash scripts/check-garage.sh --restart
|
|
- name: Install legacy Factory and upgrade the actual base
|
|
run: |
|
|
kubectl apply -f base/namespaces/kerberos-factory.yaml
|
|
kubectl apply -f base/factory/kerberos-factory-clusterrole.yaml
|
|
kubectl create --dry-run=client -n kerberos-factory -f base/factory/kerberos-factory-deployment.yaml -o json |
|
|
jq '
|
|
del(.spec.template.spec.securityContext, .spec.template.spec.volumes) |
|
|
.spec.template.spec.containers[0] |= (
|
|
.image = "ghcr.io/uug-ai/factory:v2.0.11" |
|
|
.ports = [{"containerPort":80,"protocol":"TCP"}] |
|
|
del(.securityContext, .volumeMounts, .startupProbe, .readinessProbe, .livenessProbe) |
|
|
.env |= map(
|
|
if .name == "K8S_PROXY" then .value = "http://localhost:80"
|
|
elif .name == "PORT" then .value = "80"
|
|
else . end))' |
|
|
kubectl apply -n kerberos-factory -f -
|
|
kubectl create --dry-run=client -n kerberos-factory -f base/factory/kerberos-factory-service.yaml -o json |
|
|
jq '.spec.ports[0].targetPort = 80' |
|
|
kubectl apply -n kerberos-factory -f -
|
|
kubectl -n kerberos-factory rollout status deployment/factory --timeout=300s
|
|
kubectl apply -k base/factory
|
|
bash scripts/check-factory.sh
|
|
- name: Collect deployment diagnostics
|
|
if: failure()
|
|
run: bash scripts/diagnose-deployment.sh
|
|
- name: Send Slack Notification on Success
|
|
if: success()
|
|
env:
|
|
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
|
|
run: |
|
|
bash scripts/notify-slack.sh "✅ Kustomize deployment successful on ${{ matrix.os }} (${{ matrix.kind }}) - triggered by ${{ github.actor }}"
|
|
- name: Send Slack Notification on Failure
|
|
if: failure()
|
|
env:
|
|
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
|
|
run: |
|
|
bash scripts/notify-slack.sh "❌ Kustomize deployment failed on ${{ matrix.os }} (${{ matrix.kind }}) - <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View logs>" |