jasonwitty
dde8b17fc4
The deploy job only waited on the deployments that existed when it was written, so a broken rollout of either new app would have been reported as a successful deploy. Also records the two new secrets in the bootstrap table, and the two traps found while adding these: dashwise publishes :latest for amd64 only, and a server-side dry run of a brand new namespace reports every resource inside it as missing until the namespace exists. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
106 lines
3.6 KiB
YAML
106 lines
3.6 KiB
YAML
name: Validate and Deploy to K3s
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
|
|
jobs:
|
|
validate:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install kubectl
|
|
run: |
|
|
if ! command -v kubectl &> /dev/null; then
|
|
ARCH=$(uname -m)
|
|
if [ "$ARCH" = "aarch64" ]; then
|
|
ARCH="arm64"
|
|
elif [ "$ARCH" = "x86_64" ]; then
|
|
ARCH="amd64"
|
|
fi
|
|
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/${ARCH}/kubectl"
|
|
chmod +x kubectl
|
|
sudo mv kubectl /usr/local/bin/
|
|
fi
|
|
kubectl version --client
|
|
|
|
- name: Configure kubectl
|
|
run: |
|
|
if [ -z "${{ secrets.KUBECONFIG }}" ]; then
|
|
echo "::error::Repo Actions secret KUBECONFIG is not set (Settings -> Actions -> Secrets). Without it kubectl silently falls back to localhost:8080."
|
|
exit 1
|
|
fi
|
|
mkdir -p $HOME/.kube
|
|
echo "${{ secrets.KUBECONFIG }}" | base64 -d > $HOME/.kube/config
|
|
chmod 600 $HOME/.kube/config
|
|
kubectl config current-context
|
|
|
|
- name: Server-side dry-run of full kustomization
|
|
run: |
|
|
kubectl apply -k . --dry-run=server
|
|
|
|
deploy:
|
|
needs: validate
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name != 'pull_request'
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install kubectl
|
|
run: |
|
|
if ! command -v kubectl &> /dev/null; then
|
|
ARCH=$(uname -m)
|
|
if [ "$ARCH" = "aarch64" ]; then
|
|
ARCH="arm64"
|
|
elif [ "$ARCH" = "x86_64" ]; then
|
|
ARCH="amd64"
|
|
fi
|
|
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/${ARCH}/kubectl"
|
|
chmod +x kubectl
|
|
sudo mv kubectl /usr/local/bin/
|
|
fi
|
|
kubectl version --client
|
|
|
|
- name: Configure kubectl
|
|
run: |
|
|
if [ -z "${{ secrets.KUBECONFIG }}" ]; then
|
|
echo "::error::Repo Actions secret KUBECONFIG is not set (Settings -> Actions -> Secrets). Without it kubectl silently falls back to localhost:8080."
|
|
exit 1
|
|
fi
|
|
mkdir -p $HOME/.kube
|
|
echo "${{ secrets.KUBECONFIG }}" | base64 -d > $HOME/.kube/config
|
|
chmod 600 $HOME/.kube/config
|
|
kubectl config current-context
|
|
|
|
- name: Apply kustomization
|
|
run: |
|
|
kubectl apply -k .
|
|
|
|
- name: Wait for rollouts
|
|
run: |
|
|
set -e
|
|
kubectl rollout status deploy/bitwarden-vaultwarden -n bitwarden --timeout=10m
|
|
kubectl rollout status deploy/searxng-1723974683 -n default --timeout=10m
|
|
kubectl rollout status deploy/home-assistant -n home-assistant --timeout=15m
|
|
kubectl rollout status deploy/nginx -n nginx --timeout=10m
|
|
kubectl rollout status deploy/pihole -n pihole --timeout=10m
|
|
kubectl rollout status deploy/unbound -n pihole --timeout=10m
|
|
kubectl rollout status deploy/unifiedstreaming -n unified-streaming --timeout=10m
|
|
|
|
- name: Deployment summary
|
|
if: always()
|
|
run: |
|
|
echo "## Deployment Summary" >> $GITHUB_STEP_SUMMARY
|
|
echo '```' >> $GITHUB_STEP_SUMMARY
|
|
for ns in bitwarden default dashwise home-assistant nginx pihole tududi unified-streaming; do
|
|
kubectl get deployments -n $ns >> $GITHUB_STEP_SUMMARY || true
|
|
done
|
|
echo '```' >> $GITHUB_STEP_SUMMARY
|