-
Notifications
You must be signed in to change notification settings - Fork 20
136 lines (117 loc) · 4.64 KB
/
assembly-production-deployment-automation.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
name: production-deployment-automation
on:
push:
branches:
- 'master'
env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}
jobs:
build_image:
name: Build Image
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- name: Checkout Repo
uses: actions/checkout@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2
- name: Login to Container Registry
uses: docker/login-action@v2
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Extract Metadata for Docker
id: meta
uses: docker/metadata-action@v4
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
tags: |
event=push,type=sha,format=short
event=tag,type=ref
- name: Fetch Version
id: version
run: echo "RELEASE_VERSION=$(echo ${GITHUB_REF#refs/tags/})" >> $GITHUB_OUTPUT
- name: Build and Push Docker Image
uses: docker/build-push-action@v3
with:
context: .
push: true
platforms: linux/amd64
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha, scope=assembly-nuxt
cache-to: type=gha, scope=assembly-nuxt, mode=max
- name: Update Deployment file
run: |
#!/bin/bash
set -e
set -o pipefail
# Convert this to small case
MATCH="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
MATCH=${MATCH,,}
# Write the contents to a file
echo "${{ steps.meta.outputs.tags }}" > tmp
# Check if there is a vX.Y.Z | v.X.Y tag
TAG=$({ grep -Poh "$MATCH:v\d+.\d+.?(\d+)?" tmp || true; })
# If there is not, Go back to using sha-<short-commit-hash>
if [ -z "${TAG}" ]; then
TAG=$({ grep -Poh "$MATCH:sha-.+" tmp || true; })
fi
RESP=$({ grep -Poh '<IMAGE>' deployments/assembly-nuxt.assembly.instadapp.io.production.yml || true; })
if [ -z "${RESP}" ]; then
echo "deployments/assembly-nuxt.assembly.instadapp.io.production.yml does not contain <IMAGE> marker"
exit 1;
fi
sed -i "s|<IMAGE>|$TAG|" deployments/assembly-nuxt.assembly.instadapp.io.production.yml
RESP=$({ grep -Poh '<VAULTADDR>' deployments/assembly-nuxt.assembly.instadapp.io.production.yml || true; })
if [ -z "${RESP}" ]; then
echo "deployments/assembly-nuxt.assembly.instadapp.io.production.yml does not contain <VAULTADDR> marker"
exit 1;
fi
sed -i "s|<VAULTADDR>|${{ secrets.VAULT_ADDR }}|" deployments/assembly-nuxt.assembly.instadapp.io.production.yml
RESP=$({ grep -Poh '<VAULTNS>' deployments/assembly-nuxt.assembly.instadapp.io.production.yml || true; })
if [ -z "${RESP}" ]; then
echo "deployments/assembly-nuxt.assembly.instadapp.io.production.yml does not contain <VAULTNS> marker"
exit 1;
fi
sed -i "s|<VAULTNS>|${{ secrets.VAULT_NS }}|" deployments/assembly-nuxt.assembly.instadapp.io.production.yml
- name: Upload Deployment file
uses: actions/upload-artifact@v3
with:
name: k8s-deployment-config
path: deployments/assembly-nuxt.assembly.instadapp.io.production.yml
retention-days: 1
deploy:
name: Deploy to Production
runs-on: ubuntu-latest
environment:
name: 'Production'
url: 'https://assembly.instadapp.io'
needs: build_image
permissions:
contents: read
packages: read
steps:
- name: Fetch Deployment file
id: download
uses: actions/download-artifact@v3
with:
name: k8s-deployment-config
- name: Read CA Certificate
run: |
# Write CA to disk
#!/bin/sh
echo ${{ secrets.NYC_KUBERNETES_CERTIFICATE }} | base64 -d > ca.crt
- name: Deploy to NYC Cluster
run: kubectl apply -f ${{ steps.download.outputs.download-path }} --kubeconfig=/dev/null --server="${{ secrets.NYC_KUBERNETES_ADDRESS }}" --token="${{ secrets.NYC_KUBERNETES_TOKEN }}" --certificate-authority=ca.crt
- name: Verify NYC Deployment
run: kubectl rollout status deployment/assembly-nuxt --server="${{ secrets.NYC_KUBERNETES_ADDRESS }}" --token="${{ secrets.NYC_KUBERNETES_TOKEN }}" --certificate-authority=ca.crt
- name: Erase CA Certificate
run: |
# Erase CA from disk
#!/bin/sh
rm ca.crt