ahmza/blog-ahmza-com
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pissing me off

Browse Source
This commit is contained in:
ahmza
2026-08-22 00:21:17 +00:00
parent f28aca8484
commit a0878cf30e
1 changed files with 48 additions and 115 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/build-docker-images.yml
+47 -114
View File
@@ -103,162 +103,95 @@ jobs:
with:
version: 'v1.36.2'
- name: Configure Kubernetes access
- name: Configure Kubernetes CA
env:
KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
KUBE_CA_B64: ${{ secrets.KUBE_CA_B64 }}
run: |
set -euo pipefail
if [ -z "${KUBE_TOKEN:-}" ]; then
echo "::error::KUBE_TOKEN is empty"
exit 1
fi
if [ -z "${KUBE_CA_B64:-}" ]; then
echo "::error::KUBE_CA_B64 is empty"
exit 1
fi
KUBECONFIG_PATH="${RUNNER_TEMP}/blog-kubeconfig"
CA_PATH="${RUNNER_TEMP}/kubernetes-ca.crt"
printf '%s' "$KUBE_CA_B64" \
| base64 -d \
> "$CA_PATH"
> "${RUNNER_TEMP}/kubernetes-ca.crt"
kubectl config \
--kubeconfig="$KUBECONFIG_PATH" \
set-cluster talos-prod \
--server=https://10.10.10.210:6443 \
--tls-server-name=k8s-api.ahmza.com \
--certificate-authority="$CA_PATH" \
--embed-certs=true
chmod 600 "${RUNNER_TEMP}/kubernetes-ca.crt"
kubectl config \
--kubeconfig="$KUBECONFIG_PATH" \
set-credentials gitea-blog-deployer \
--token="$KUBE_TOKEN"
kubectl config \
--kubeconfig="$KUBECONFIG_PATH" \
set-context blog-deployer@talos-prod \
--cluster=talos-prod \
--user=gitea-blog-deployer \
--namespace=blog-ahmza-com
kubectl config \
--kubeconfig="$KUBECONFIG_PATH" \
use-context blog-deployer@talos-prod
chmod 600 "$KUBECONFIG_PATH"
echo "KUBECONFIG=$KUBECONFIG_PATH" >> "$GITHUB_ENV"
echo
echo "Kubernetes configuration:"
echo -n " API server: "
kubectl config \
--kubeconfig="$KUBECONFIG_PATH" \
view --minify \
-o jsonpath='{.clusters[0].cluster.server}'
echo
echo -n " Context: "
kubectl config \
--kubeconfig="$KUBECONFIG_PATH" \
current-context
echo
# Check that a bearer token really made it into the generated config
# without printing the token itself.
TOKEN_LENGTH="$(
kubectl config \
--kubeconfig="$KUBECONFIG_PATH" \
view --raw --minify \
-o jsonpath='{.users[0].user.token}' \
| wc -c
)"
echo " Token length: $TOKEN_LENGTH"
if [ "$TOKEN_LENGTH" -lt 100 ]; then
echo "::error::Generated kubeconfig does not contain a valid-looking token"
exit 1
fi
echo "KUBE_CA=${RUNNER_TEMP}/kubernetes-ca.crt" >> "$GITHUB_ENV"
- name: Verify Kubernetes access
env:
KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
run: |
set -euo pipefail
echo "Testing authenticated API access..."
kubectl -n blog-ahmza-com get deployment blog
kubectl \
--server=https://10.10.10.210:6443 \
--tls-server-name=k8s-api.ahmza.com \
--certificate-authority="$KUBE_CA" \
--token="$KUBE_TOKEN" \
-n blog-ahmza-com \
get deployment blog
echo
echo "Testing intended permissions..."
echo "RBAC checks:"
if kubectl auth can-i patch deployments \
kubectl \
--server=https://10.10.10.210:6443 \
--tls-server-name=k8s-api.ahmza.com \
--certificate-authority="$KUBE_CA" \
--token="$KUBE_TOKEN" \
auth can-i patch deployments \
-n blog-ahmza-com
then
echo "OK: deployment patch permitted"
else
echo "::error::Deployment patch unexpectedly denied"
exit 1
fi
echo
echo "Testing privilege boundary..."
if kubectl auth can-i get secrets \
kubectl \
--server=https://10.10.10.210:6443 \
--tls-server-name=k8s-api.ahmza.com \
--certificate-authority="$KUBE_CA" \
--token="$KUBE_TOKEN" \
auth can-i get secrets \
-n blog-ahmza-com
then
echo "::error::CI account unexpectedly has Secret read access"
exit 1
else
echo "OK: Secret read correctly denied"
fi
- name: Deploy to Kubernetes
env:
KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
IMAGE: tea.ahmza.com/ahmza/blog-ahmza-com:${{ gitea.event.head_commit.id }}
run: |
set -euo pipefail
echo "Deploying image:"
k() {
kubectl \
--server=https://10.10.10.210:6443 \
--tls-server-name=k8s-api.ahmza.com \
--certificate-authority="$KUBE_CA" \
--token="$KUBE_TOKEN" \
-n blog-ahmza-com \
"$@"
}
echo "Deploying:"
echo " $IMAGE"
kubectl -n blog-ahmza-com \
set image deployment/blog \
k set image deployment/blog \
blog="$IMAGE"
if ! kubectl -n blog-ahmza-com \
rollout status deployment/blog \
--timeout=5m
then
echo "::error::New deployment failed. Rolling back."
if ! k rollout status deployment/blog --timeout=5m; then
echo "::error::Deployment failed; rolling back"
kubectl -n blog-ahmza-com \
rollout undo deployment/blog
kubectl -n blog-ahmza-com \
rollout status deployment/blog \
--timeout=5m
k rollout undo deployment/blog
k rollout status deployment/blog --timeout=5m
exit 1
fi
echo
echo "Deployment complete:"
kubectl -n blog-ahmza-com get pods -o wide
k get pods -o wide
echo
echo "Running image:"
kubectl -n blog-ahmza-com \
get deployment blog \
echo -n "Running image: "
k get deployment blog \
-o jsonpath='{.spec.template.spec.containers[?(@.name=="blog")].image}'
echo
- name: NetBird diagnostics & disconnect
# Runs even on failure: captures final state for debugging and tears the
# peer down so stale 'gitea-actions-blog' peers don't pile up.