From a0878cf30ef3c636eaffd06fc1cfeb19e1ad271e Mon Sep 17 00:00:00 2001 From: ahmza Date: Sat, 22 Aug 2026 00:21:17 +0000 Subject: [PATCH] pissing me off --- .gitea/workflows/build-docker-images.yml | 163 +++++++---------------- 1 file changed, 48 insertions(+), 115 deletions(-) diff --git a/.gitea/workflows/build-docker-images.yml b/.gitea/workflows/build-docker-images.yml index 557df58..74a499a 100644 --- a/.gitea/workflows/build-docker-images.yml +++ b/.gitea/workflows/build-docker-images.yml @@ -103,162 +103,95 @@ jobs: with: version: 'v1.36.2' - - name: Configure Kubernetes access + - name: Configure Kubernetes CA env: - KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }} KUBE_CA_B64: ${{ secrets.KUBE_CA_B64 }} run: | set -euo pipefail - if [ -z "${KUBE_TOKEN:-}" ]; then - echo "::error::KUBE_TOKEN is empty" - exit 1 - fi - - if [ -z "${KUBE_CA_B64:-}" ]; then - echo "::error::KUBE_CA_B64 is empty" - exit 1 - fi - - KUBECONFIG_PATH="${RUNNER_TEMP}/blog-kubeconfig" - CA_PATH="${RUNNER_TEMP}/kubernetes-ca.crt" - printf '%s' "$KUBE_CA_B64" \ | base64 -d \ - > "$CA_PATH" + > "${RUNNER_TEMP}/kubernetes-ca.crt" - kubectl config \ - --kubeconfig="$KUBECONFIG_PATH" \ - set-cluster talos-prod \ - --server=https://10.10.10.210:6443 \ - --tls-server-name=k8s-api.ahmza.com \ - --certificate-authority="$CA_PATH" \ - --embed-certs=true + chmod 600 "${RUNNER_TEMP}/kubernetes-ca.crt" - kubectl config \ - --kubeconfig="$KUBECONFIG_PATH" \ - set-credentials gitea-blog-deployer \ - --token="$KUBE_TOKEN" + echo "KUBE_CA=${RUNNER_TEMP}/kubernetes-ca.crt" >> "$GITHUB_ENV" - kubectl config \ - --kubeconfig="$KUBECONFIG_PATH" \ - set-context blog-deployer@talos-prod \ - --cluster=talos-prod \ - --user=gitea-blog-deployer \ - --namespace=blog-ahmza-com - - kubectl config \ - --kubeconfig="$KUBECONFIG_PATH" \ - use-context blog-deployer@talos-prod - - chmod 600 "$KUBECONFIG_PATH" - - echo "KUBECONFIG=$KUBECONFIG_PATH" >> "$GITHUB_ENV" - - echo - echo "Kubernetes configuration:" - echo -n " API server: " - kubectl config \ - --kubeconfig="$KUBECONFIG_PATH" \ - view --minify \ - -o jsonpath='{.clusters[0].cluster.server}' - echo - - echo -n " Context: " - kubectl config \ - --kubeconfig="$KUBECONFIG_PATH" \ - current-context - - echo - - # Check that a bearer token really made it into the generated config - # without printing the token itself. - TOKEN_LENGTH="$( - kubectl config \ - --kubeconfig="$KUBECONFIG_PATH" \ - view --raw --minify \ - -o jsonpath='{.users[0].user.token}' \ - | wc -c - )" - - echo " Token length: $TOKEN_LENGTH" - - if [ "$TOKEN_LENGTH" -lt 100 ]; then - echo "::error::Generated kubeconfig does not contain a valid-looking token" - exit 1 - fi - - - name: Verify Kubernetes access + - name: Verify Kubernetes access + env: + KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }} run: | set -euo pipefail - echo "Testing authenticated API access..." - kubectl -n blog-ahmza-com get deployment blog + kubectl \ + --server=https://10.10.10.210:6443 \ + --tls-server-name=k8s-api.ahmza.com \ + --certificate-authority="$KUBE_CA" \ + --token="$KUBE_TOKEN" \ + -n blog-ahmza-com \ + get deployment blog echo - echo "Testing intended permissions..." + echo "RBAC checks:" - if kubectl auth can-i patch deployments \ + kubectl \ + --server=https://10.10.10.210:6443 \ + --tls-server-name=k8s-api.ahmza.com \ + --certificate-authority="$KUBE_CA" \ + --token="$KUBE_TOKEN" \ + auth can-i patch deployments \ -n blog-ahmza-com - then - echo "OK: deployment patch permitted" - else - echo "::error::Deployment patch unexpectedly denied" - exit 1 - fi - echo - echo "Testing privilege boundary..." - - if kubectl auth can-i get secrets \ + kubectl \ + --server=https://10.10.10.210:6443 \ + --tls-server-name=k8s-api.ahmza.com \ + --certificate-authority="$KUBE_CA" \ + --token="$KUBE_TOKEN" \ + auth can-i get secrets \ -n blog-ahmza-com - then - echo "::error::CI account unexpectedly has Secret read access" - exit 1 - else - echo "OK: Secret read correctly denied" - fi - name: Deploy to Kubernetes env: + KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }} IMAGE: tea.ahmza.com/ahmza/blog-ahmza-com:${{ gitea.event.head_commit.id }} run: | set -euo pipefail - echo "Deploying image:" + k() { + kubectl \ + --server=https://10.10.10.210:6443 \ + --tls-server-name=k8s-api.ahmza.com \ + --certificate-authority="$KUBE_CA" \ + --token="$KUBE_TOKEN" \ + -n blog-ahmza-com \ + "$@" + } + + echo "Deploying:" echo " $IMAGE" - kubectl -n blog-ahmza-com \ - set image deployment/blog \ + k set image deployment/blog \ blog="$IMAGE" - if ! kubectl -n blog-ahmza-com \ - rollout status deployment/blog \ - --timeout=5m - then - echo "::error::New deployment failed. Rolling back." + if ! k rollout status deployment/blog --timeout=5m; then + echo "::error::Deployment failed; rolling back" - kubectl -n blog-ahmza-com \ - rollout undo deployment/blog - - kubectl -n blog-ahmza-com \ - rollout status deployment/blog \ - --timeout=5m + k rollout undo deployment/blog + k rollout status deployment/blog --timeout=5m exit 1 fi echo - echo "Deployment complete:" - kubectl -n blog-ahmza-com get pods -o wide + k get pods -o wide echo - echo "Running image:" - kubectl -n blog-ahmza-com \ - get deployment blog \ + echo -n "Running image: " + k get deployment blog \ -o jsonpath='{.spec.template.spec.containers[?(@.name=="blog")].image}' echo + - name: NetBird diagnostics & disconnect # Runs even on failure: captures final state for debugging and tears the # peer down so stale 'gitea-actions-blog' peers don't pile up.