96 lines
3.6 KiB
YAML
96 lines
3.6 KiB
YAML
name: deploy-sol-public-edge
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
paths:
|
|
- environments/sol/public-edge/**
|
|
- .gitea/workflows/deploy-sol-public-edge.yaml
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
apply:
|
|
runs-on: k3s-deploy
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Materialize kubeconfig
|
|
env:
|
|
K3S_KUBECONFIG_B64: ${{ secrets.K3S_KUBECONFIG_B64 }}
|
|
run: |
|
|
test -n "$K3S_KUBECONFIG_B64"
|
|
printf '%s' "$K3S_KUBECONFIG_B64" | base64 -d >/tmp/kubeconfig
|
|
chmod 600 /tmp/kubeconfig
|
|
|
|
- name: Install kubectl
|
|
run: |
|
|
curl -fsSL -o /tmp/kubectl https://dl.k8s.io/release/v1.34.6/bin/linux/amd64/kubectl
|
|
install -m 0755 /tmp/kubectl /usr/local/bin/kubectl
|
|
kubectl version --client
|
|
|
|
- name: Apply public edge resources
|
|
env:
|
|
KUBECONFIG: /tmp/kubeconfig
|
|
run: |
|
|
kubectl apply -f environments/sol/public-edge/cert-manager-namespace.yaml
|
|
kubectl apply -f environments/sol/public-edge/cert-manager-helmchart.yaml
|
|
kubectl apply -f environments/sol/public-edge/traefik-helmchart.yaml
|
|
|
|
- name: Wait for cert-manager
|
|
env:
|
|
KUBECONFIG: /tmp/kubeconfig
|
|
run: |
|
|
for attempt in $(seq 1 60); do
|
|
if kubectl -n cert-manager get deploy cert-manager cert-manager-cainjector cert-manager-webhook >/dev/null 2>&1; then
|
|
break
|
|
fi
|
|
sleep 5
|
|
done
|
|
kubectl -n cert-manager rollout status deploy/cert-manager --timeout=300s
|
|
kubectl -n cert-manager rollout status deploy/cert-manager-cainjector --timeout=300s
|
|
kubectl -n cert-manager rollout status deploy/cert-manager-webhook --timeout=300s
|
|
|
|
- name: Wait for traefik
|
|
env:
|
|
KUBECONFIG: /tmp/kubeconfig
|
|
run: |
|
|
for attempt in $(seq 1 60); do
|
|
if kubectl -n kube-system get ds traefik >/dev/null 2>&1; then
|
|
break
|
|
fi
|
|
sleep 5
|
|
done
|
|
kubectl -n kube-system rollout status ds/traefik --timeout=300s
|
|
|
|
- name: Wait for issuer
|
|
env:
|
|
KUBECONFIG: /tmp/kubeconfig
|
|
run: |
|
|
kubectl wait --for=condition=Established crd/certificates.cert-manager.io --timeout=300s
|
|
kubectl apply -f environments/sol/public-edge/letsencrypt-prod-clusterissuer.yaml
|
|
kubectl apply -f environments/sol/public-edge/trade-frontend-public-ingress.yaml
|
|
kubectl wait --for=jsonpath='{.status.conditions[?(@.type=="Ready")].status}'=True clusterissuer/letsencrypt-prod --timeout=300s
|
|
|
|
- name: Verify HTTP ingress
|
|
env:
|
|
KUBECONFIG: /tmp/kubeconfig
|
|
run: |
|
|
kubectl -n trade-r001-canary get ingress trade-frontend-public -o wide
|
|
curl -fsS --resolve trade.mpabi.pl:80:149.50.96.162 http://trade.mpabi.pl/healthz
|
|
|
|
- name: Report TLS state
|
|
env:
|
|
KUBECONFIG: /tmp/kubeconfig
|
|
run: |
|
|
resolved_ip="$(getent ahostsv4 trade.mpabi.pl | awk 'NR==1 {print $1}')"
|
|
echo "resolved_ip=${resolved_ip:-<none>}"
|
|
kubectl -n trade-r001-canary get certificate,order,challenge || true
|
|
if [ "${resolved_ip:-}" = "149.50.96.162" ]; then
|
|
kubectl -n trade-r001-canary wait --for=jsonpath='{.status.conditions[?(@.type=="Ready")].status}'=True certificate/trade-mpabi-pl-tls --timeout=600s
|
|
curl -fsS --resolve trade.mpabi.pl:443:149.50.96.162 https://trade.mpabi.pl/healthz
|
|
else
|
|
echo "DNS still does not point trade.mpabi.pl to 149.50.96.162; skipped TLS readiness gate."
|
|
fi
|