96e1825629
- .gitea/workflows/deploy.yaml: PRs run a server-side dry-run; pushes to main apply the kustomization and wait for all rollouts. Modeled on socktop-webterm's pipeline; uses the same KUBECONFIG secret convention and gitea-deployer ServiceAccount. - rbac/gitea-deployer.yaml: ClusterRole/Binding (admin bootstrap, outside the root kustomization) — repo resource kinds only, no secrets access, no delete verbs, no RBAC escalation. Applied to the cluster 2026-07-26. - One-time env->secretKeyRef migration executed against the cluster; README updated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
96 lines
3.0 KiB
YAML
96 lines
3.0 KiB
YAML
name: Validate and Deploy to K3s
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
|
|
jobs:
|
|
validate:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install kubectl
|
|
run: |
|
|
if ! command -v kubectl &> /dev/null; then
|
|
ARCH=$(uname -m)
|
|
if [ "$ARCH" = "aarch64" ]; then
|
|
ARCH="arm64"
|
|
elif [ "$ARCH" = "x86_64" ]; then
|
|
ARCH="amd64"
|
|
fi
|
|
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/${ARCH}/kubectl"
|
|
chmod +x kubectl
|
|
sudo mv kubectl /usr/local/bin/
|
|
fi
|
|
kubectl version --client
|
|
|
|
- name: Configure kubectl
|
|
run: |
|
|
mkdir -p $HOME/.kube
|
|
echo "${{ secrets.KUBECONFIG }}" | base64 -d > $HOME/.kube/config
|
|
chmod 600 $HOME/.kube/config
|
|
|
|
- name: Server-side dry-run of full kustomization
|
|
run: |
|
|
kubectl apply -k . --dry-run=server
|
|
|
|
deploy:
|
|
needs: validate
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name != 'pull_request'
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install kubectl
|
|
run: |
|
|
if ! command -v kubectl &> /dev/null; then
|
|
ARCH=$(uname -m)
|
|
if [ "$ARCH" = "aarch64" ]; then
|
|
ARCH="arm64"
|
|
elif [ "$ARCH" = "x86_64" ]; then
|
|
ARCH="amd64"
|
|
fi
|
|
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/${ARCH}/kubectl"
|
|
chmod +x kubectl
|
|
sudo mv kubectl /usr/local/bin/
|
|
fi
|
|
kubectl version --client
|
|
|
|
- name: Configure kubectl
|
|
run: |
|
|
mkdir -p $HOME/.kube
|
|
echo "${{ secrets.KUBECONFIG }}" | base64 -d > $HOME/.kube/config
|
|
chmod 600 $HOME/.kube/config
|
|
|
|
- name: Apply kustomization
|
|
run: |
|
|
kubectl apply -k .
|
|
|
|
- name: Wait for rollouts
|
|
run: |
|
|
set -e
|
|
kubectl rollout status deploy/bitwarden-vaultwarden -n bitwarden --timeout=10m
|
|
kubectl rollout status deploy/searxng-1723974683 -n default --timeout=10m
|
|
kubectl rollout status deploy/home-assistant -n home-assistant --timeout=15m
|
|
kubectl rollout status deploy/nginx -n nginx --timeout=10m
|
|
kubectl rollout status deploy/pihole -n pihole --timeout=10m
|
|
kubectl rollout status deploy/unbound -n pihole --timeout=10m
|
|
kubectl rollout status deploy/unifiedstreaming -n unified-streaming --timeout=10m
|
|
|
|
- name: Deployment summary
|
|
if: always()
|
|
run: |
|
|
echo "## Deployment Summary" >> $GITHUB_STEP_SUMMARY
|
|
echo '```' >> $GITHUB_STEP_SUMMARY
|
|
for ns in bitwarden default home-assistant nginx pihole unified-streaming; do
|
|
kubectl get deployments -n $ns >> $GITHUB_STEP_SUMMARY || true
|
|
done
|
|
echo '```' >> $GITHUB_STEP_SUMMARY
|