Deploy to Dev #258
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy to Dev | |
| on: | |
| workflow_run: | |
| workflows: [Release] | |
| types: [completed] | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| id-token: write | |
| concurrency: | |
| group: deploy-dev-gke | |
| cancel-in-progress: false | |
| jobs: | |
| deploy: | |
| if: (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main') || github.event.workflow_run.conclusion == 'success' | |
| runs-on: ubuntu-latest | |
| env: | |
| KELOS_NAMESPACE: ${{ vars.KELOS_NAMESPACE || 'default' }} | |
| GCP_PROJECT_ID: gjkim-400213 | |
| GKE_CLUSTER_NAME: gjkim | |
| GKE_CLUSTER_LOCATION: asia-northeast3 | |
| GCP_SERVICE_ACCOUNT_EMAIL: kelos-gh-action@gjkim-400213.iam.gserviceaccount.com | |
| GCP_WORKLOAD_IDENTITY_PROVIDER: projects/317215297044/locations/global/workloadIdentityPools/github/providers/kelos | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: go.mod | |
| - name: Build CLI | |
| run: make build WHAT=cmd/kelos | |
| - name: Authenticate to Google Cloud | |
| uses: google-github-actions/auth@v2 | |
| with: | |
| workload_identity_provider: ${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }} | |
| service_account: ${{ env.GCP_SERVICE_ACCOUNT_EMAIL }} | |
| - name: Configure GKE credentials | |
| uses: google-github-actions/get-gke-credentials@v2 | |
| with: | |
| cluster_name: ${{ env.GKE_CLUSTER_NAME }} | |
| location: ${{ env.GKE_CLUSTER_LOCATION }} | |
| project_id: ${{ env.GCP_PROJECT_ID }} | |
| - name: Apply github-webhook-secret | |
| env: | |
| KELOS_WEBHOOK_SECRET: ${{ secrets.KELOS_WEBHOOK_SECRET }} | |
| KELOS_GITHUB_APP_ID: ${{ secrets.KELOS_GITHUB_APP_ID }} | |
| KELOS_GITHUB_APP_INSTALLATION_ID: ${{ secrets.KELOS_GITHUB_APP_INSTALLATION_ID }} | |
| KELOS_GITHUB_APP_PRIVATE_KEY: ${{ secrets.KELOS_GITHUB_APP_PRIVATE_KEY }} | |
| run: | | |
| # Apply the full github-webhook-secret from repo secrets so the | |
| # workflow is self-sufficient and the secret state is portable to | |
| # other clusters. Holds both the HMAC WEBHOOK_SECRET and the | |
| # GitHub App credentials the webhook server uses to resolve | |
| # .Branch for issue_comment events on pull requests. | |
| KEY_FILE=$(mktemp) | |
| trap 'rm -f "$KEY_FILE"' EXIT | |
| printf '%s' "$KELOS_GITHUB_APP_PRIVATE_KEY" > "$KEY_FILE" | |
| kubectl create secret generic github-webhook-secret \ | |
| --namespace kelos-system \ | |
| --from-literal=WEBHOOK_SECRET="$KELOS_WEBHOOK_SECRET" \ | |
| --from-literal=appID="$KELOS_GITHUB_APP_ID" \ | |
| --from-literal=installationID="$KELOS_GITHUB_APP_INSTALLATION_ID" \ | |
| --from-file=privateKey="$KEY_FILE" \ | |
| --dry-run=client -o yaml \ | |
| | kubectl apply -f - | |
| - name: Install kelos | |
| run: | | |
| cat > /tmp/kelos-dev-values.yaml <<'EOF' | |
| image: | |
| tag: main | |
| pullPolicy: Always | |
| spawner: | |
| resources: | |
| requests: "cpu=100m,memory=128Mi" | |
| ghproxy: | |
| cacheTTL: 50s | |
| resources: | |
| requests: "cpu=10m,memory=64Mi" | |
| controller: | |
| resources: | |
| requests: | |
| cpu: 10m | |
| memory: 64Mi | |
| limits: | |
| cpu: 500m | |
| memory: 128Mi | |
| # NOTE: webhookServer.gateway is intentionally left at chart default | |
| # (disabled). The dev cluster already has a Gateway | |
| # (kelos-webhook-gateway) and HTTPRoute (kelos-webhook-route) applied | |
| # out of band — they use GKE CertMap via | |
| # networking.gke.io/certmap annotation, which the chart's gateway | |
| # template cannot express. Managing them via helm would fight the | |
| # out-of-band config, so they stay manual. | |
| webhookServer: | |
| sources: | |
| github: | |
| enabled: true | |
| secretName: github-webhook-secret | |
| githubSecretName: github-webhook-secret | |
| resources: | |
| requests: | |
| cpu: 100m | |
| memory: 128Mi | |
| EOF | |
| bin/kelos install -f /tmp/kelos-dev-values.yaml | |
| kubectl rollout restart deployment/kelos-controller-manager -n kelos-system | |
| kubectl rollout status deployment/kelos-controller-manager -n kelos-system --timeout=120s | |
| kubectl rollout restart deployment -l kelos.dev/component=ghproxy -n "${KELOS_NAMESPACE}" | |
| kubectl rollout restart deployment -l kelos.dev/component=spawner -n "${KELOS_NAMESPACE}" | |
| kubectl rollout restart deployment/kelos-webhook-github -n kelos-system | |
| kubectl rollout status deployment -l kelos.dev/component=ghproxy -n "${KELOS_NAMESPACE}" --timeout=120s | |
| kubectl rollout status deployment -l kelos.dev/component=spawner -n "${KELOS_NAMESPACE}" --timeout=120s | |
| kubectl rollout status deployment/kelos-webhook-github -n kelos-system --timeout=120s | |
| - name: Apply PodMonitoring | |
| run: | | |
| kubectl apply -f - <<EOF | |
| apiVersion: monitoring.googleapis.com/v1 | |
| kind: PodMonitoring | |
| metadata: | |
| name: kelos-controller | |
| namespace: kelos-system | |
| labels: | |
| app.kubernetes.io/name: kelos | |
| app.kubernetes.io/component: manager | |
| spec: | |
| selector: | |
| matchLabels: | |
| app.kubernetes.io/name: kelos | |
| app.kubernetes.io/component: manager | |
| endpoints: | |
| - port: metrics | |
| interval: 30s | |
| --- | |
| apiVersion: monitoring.googleapis.com/v1 | |
| kind: PodMonitoring | |
| metadata: | |
| name: kelos-spawner | |
| namespace: ${KELOS_NAMESPACE} | |
| labels: | |
| kelos.dev/name: kelos | |
| kelos.dev/component: spawner | |
| spec: | |
| selector: | |
| matchLabels: | |
| kelos.dev/name: kelos | |
| kelos.dev/component: spawner | |
| matchExpressions: | |
| - key: job-name | |
| operator: DoesNotExist | |
| endpoints: | |
| - port: metrics | |
| interval: 30s | |
| --- | |
| apiVersion: monitoring.googleapis.com/v1 | |
| kind: PodMonitoring | |
| metadata: | |
| name: ghproxy | |
| namespace: ${KELOS_NAMESPACE} | |
| labels: | |
| kelos.dev/name: kelos | |
| kelos.dev/component: ghproxy | |
| spec: | |
| selector: | |
| matchLabels: | |
| kelos.dev/name: kelos | |
| kelos.dev/component: ghproxy | |
| endpoints: | |
| - port: metrics | |
| interval: 30s | |
| --- | |
| apiVersion: monitoring.googleapis.com/v1 | |
| kind: PodMonitoring | |
| metadata: | |
| name: kelos-webhook-github | |
| namespace: kelos-system | |
| labels: | |
| app.kubernetes.io/name: kelos | |
| app.kubernetes.io/component: webhook-github | |
| spec: | |
| selector: | |
| matchLabels: | |
| app.kubernetes.io/name: kelos | |
| app.kubernetes.io/component: webhook-github | |
| endpoints: | |
| - port: metrics | |
| interval: 30s | |
| EOF | |
| - name: Apply self-development resources | |
| run: kubectl apply -f self-development/ -n "${KELOS_NAMESPACE}" |