130 lines
5 KiB
YAML
130 lines
5 KiB
YAML
name: Django Helm GitOps Deploy
|
||
|
||
on:
|
||
push:
|
||
branches: [ "main" ]
|
||
workflow_dispatch:
|
||
inputs:
|
||
deploy_prod:
|
||
description: "Nach erfolgreichem Test auch auf Produktion (Talos) deployen?"
|
||
type: boolean
|
||
default: true
|
||
|
||
#on:
|
||
# push:
|
||
# branches: [ "main" ]
|
||
# workflow_dispatch:
|
||
|
||
jobs:
|
||
# ---------------------------------------------------------------------------
|
||
# 1. Build + Test (k3s) – wie bisher
|
||
# ---------------------------------------------------------------------------
|
||
build-and-test:
|
||
runs-on: ubuntu-latest
|
||
container: catthehacker/ubuntu:act-latest
|
||
steps:
|
||
- name: Checkout Code
|
||
uses: actions/checkout@v4
|
||
|
||
# HINWEIS: Das Terraform-Binary wird über das globale Runner-Volume (:ro)
|
||
# vollautomatisch und manipulationssicher nach /usr/local/bin/terraform injiziert.
|
||
|
||
- name: Trust Local Nginx Certificate Inside Container
|
||
run: |
|
||
mkdir -p /usr/local/share/ca-certificates/
|
||
cp nginx_ssl/nginx.crt /usr/local/share/ca-certificates/nginx-sandbox.crt 2>/dev/null || echo "Nutze Workspace-Zertifikat"
|
||
update-ca-certificates
|
||
|
||
- name: Log in to Local Registry
|
||
run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login localhost:3005 -u ${{ github.actor }} --password-stdin
|
||
|
||
# Ein Build, zwei Tags
|
||
- name: Build Django Image
|
||
run: |
|
||
docker build \
|
||
-t localhost:3005/${{ github.repository }}:${{ github.sha }} \
|
||
-t localhost:3005/${{ github.repository }}:latest .
|
||
|
||
- name: Push Django Image
|
||
run: |
|
||
docker push localhost:3005/${{ github.repository }}:${{ github.sha }}
|
||
docker push localhost:3005/${{ github.repository }}:latest
|
||
|
||
- name: Prepare Kubernetes Access (k3s)
|
||
run: |
|
||
echo "${{ secrets.KUBECONFIG_DATA }}" > ./kind_kubeconfig
|
||
chmod 600 ./kind_kubeconfig
|
||
|
||
- name: Terraform Deploy (test / k3s)
|
||
run: |
|
||
terraform --version
|
||
terraform init -reconfigure -backend-config=envs/test.backend.hcl
|
||
terraform apply -auto-approve \
|
||
-var-file=envs/test.tfvars \
|
||
-var="app_version=${{ github.sha }}"
|
||
|
||
- name: Verify App Health (test)
|
||
run: |
|
||
sleep 15
|
||
curl --fail -L --connect-timeout 5 -H "Host: boday-it.ch" http://local-k3s-platform:80/ || exit 1
|
||
echo "Test (k3s) OK"
|
||
|
||
- name: Publish Map to cloudmon Dashboard (test)
|
||
run: |
|
||
terraform show -json > plan.json
|
||
curl -X POST \
|
||
-H "Authorization: Bearer ${{ secrets.CLOUDMON_TOKEN }}" \
|
||
-H "Content-Type: application/json" \
|
||
-H "Host: cloudmon.local" \
|
||
--data-binary @plan.json \
|
||
"http://local-k3s-platform:80/api/v1/push/?repo=${{ github.repository }}&env=test"
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# 2. Produktion (Talos) – nur wenn Test grün ist; gleiches Image (Git-SHA)
|
||
# ---------------------------------------------------------------------------
|
||
deploy-prod:
|
||
needs: build-and-test
|
||
if: github.event_name == 'push' || inputs.deploy_prod
|
||
runs-on: ubuntu-latest
|
||
container: catthehacker/ubuntu:act-latest
|
||
steps:
|
||
- name: Checkout Code
|
||
uses: actions/checkout@v4
|
||
|
||
- name: Prepare Kubernetes Access (Talos)
|
||
run: |
|
||
echo "${{ secrets.KUBECONFIG_TALOS }}" > ./talos_kubeconfig
|
||
chmod 600 ./talos_kubeconfig
|
||
|
||
- name: Terraform Deploy (prod / Talos)
|
||
env:
|
||
TF_VAR_django_secret_key: ${{ secrets.PROD_DJANGO_SECRET_KEY }}
|
||
TF_VAR_postgres_password: ${{ secrets.PROD_POSTGRES_PASSWORD }}
|
||
run: |
|
||
terraform init -reconfigure -backend-config=envs/prod.backend.hcl
|
||
terraform apply -auto-approve \
|
||
-var-file=envs/prod.tfvars \
|
||
-var="app_version=${{ github.sha }}"
|
||
|
||
# Erster Lauf: Longhorn-Volume + initdb dauern länger -> mit Retries
|
||
- name: Verify App Health (prod)
|
||
run: |
|
||
for i in $(seq 1 12); do
|
||
if curl --fail -sL --connect-timeout 5 -o /dev/null -H "Host: boday-it.ch" http://${{ vars.TALOS_INGRESS_IP }}/; then
|
||
echo "Prod (Talos) OK"; exit 0
|
||
fi
|
||
echo "Noch nicht erreichbar, Versuch $i/12"; sleep 10
|
||
done
|
||
exit 1
|
||
|
||
- name: Publish Map to cloudmon Dashboard (prod)
|
||
run: |
|
||
# show -json enthält sensitive Werte im Klartext -> Prod-Secrets vor dem Versand entfernen
|
||
terraform show -json | jq 'del(.. | .set_sensitive?)' > plan.json
|
||
! grep -qF "${{ secrets.PROD_POSTGRES_PASSWORD }}" plan.json || { echo "Secret im JSON gefunden, Abbruch"; exit 1; }
|
||
curl -X POST \
|
||
-H "Authorization: Bearer ${{ secrets.CLOUDMON_TOKEN }}" \
|
||
-H "Content-Type: application/json" \
|
||
-H "Host: cloudmon.local" \
|
||
--data-binary @plan.json \
|
||
"http://local-k3s-platform:80/api/v1/push/?repo=${{ github.repository }}&env=prod"
|