will it actually work now ?
This commit is contained in:
@@ -105,82 +105,128 @@ jobs:
|
||||
|
||||
- name: Configure Kubernetes access
|
||||
env:
|
||||
KUBE_CONFIG_B64: ${{ secrets.TALOS_PROD_KUBE_CONFIG }}
|
||||
KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
|
||||
KUBE_CA_B64: ${{ secrets.KUBE_CA_B64 }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
if [ -z "${KUBE_CONFIG_B64:-}" ]; then
|
||||
echo "::error::KUBE_CONFIG secret is empty or unavailable"
|
||||
if [ -z "${KUBE_TOKEN:-}" ]; then
|
||||
echo "::error::KUBE_TOKEN is empty"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
KUBECONFIG_PATH="${RUNNER_TEMP}/gitea-blog-kubeconfig"
|
||||
if [ -z "${KUBE_CA_B64:-}" ]; then
|
||||
echo "::error::KUBE_CA_B64 is empty"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
printf '%s' "$KUBE_CONFIG_B64" \
|
||||
KUBECONFIG_PATH="${RUNNER_TEMP}/blog-kubeconfig"
|
||||
CA_PATH="${RUNNER_TEMP}/kubernetes-ca.crt"
|
||||
|
||||
printf '%s' "$KUBE_CA_B64" \
|
||||
| base64 -d \
|
||||
> "$KUBECONFIG_PATH"
|
||||
> "$CA_PATH"
|
||||
|
||||
chmod 600 "$KUBECONFIG_PATH"
|
||||
|
||||
echo "Available contexts:"
|
||||
kubectl config \
|
||||
--kubeconfig="$KUBECONFIG_PATH" \
|
||||
get-contexts
|
||||
set-cluster talos-prod \
|
||||
--server=https://10.10.10.210:6443 \
|
||||
--tls-server-name=k8s-api.ahmza.com \
|
||||
--certificate-authority="$CA_PATH" \
|
||||
--embed-certs=true
|
||||
|
||||
kubectl config \
|
||||
--kubeconfig="$KUBECONFIG_PATH" \
|
||||
set-credentials gitea-blog-deployer \
|
||||
--token="$KUBE_TOKEN"
|
||||
|
||||
kubectl config \
|
||||
--kubeconfig="$KUBECONFIG_PATH" \
|
||||
set-context blog-deployer@talos-prod \
|
||||
--cluster=talos-prod \
|
||||
--user=gitea-blog-deployer \
|
||||
--namespace=blog-ahmza-com
|
||||
|
||||
kubectl config \
|
||||
--kubeconfig="$KUBECONFIG_PATH" \
|
||||
use-context blog-deployer@talos-prod
|
||||
|
||||
# Make this kubeconfig explicit for every later workflow step.
|
||||
chmod 600 "$KUBECONFIG_PATH"
|
||||
|
||||
echo "KUBECONFIG=$KUBECONFIG_PATH" >> "$GITHUB_ENV"
|
||||
|
||||
echo "Kubeconfig decoded successfully."
|
||||
|
||||
# Safe diagnostics: these do NOT print the bearer token.
|
||||
echo -n "Context: "
|
||||
KUBECONFIG="$KUBECONFIG_PATH" kubectl config current-context
|
||||
|
||||
echo
|
||||
echo "Kubernetes configuration:"
|
||||
echo -n " API server: "
|
||||
KUBECONFIG="$KUBECONFIG_PATH" \
|
||||
kubectl config view --minify \
|
||||
kubectl config \
|
||||
--kubeconfig="$KUBECONFIG_PATH" \
|
||||
view --minify \
|
||||
-o jsonpath='{.clusters[0].cluster.server}'
|
||||
echo
|
||||
|
||||
echo -n " Context: "
|
||||
kubectl config \
|
||||
--kubeconfig="$KUBECONFIG_PATH" \
|
||||
current-context
|
||||
|
||||
echo
|
||||
|
||||
# Check that a bearer token really made it into the generated config
|
||||
# without printing the token itself.
|
||||
TOKEN_LENGTH="$(
|
||||
kubectl config \
|
||||
--kubeconfig="$KUBECONFIG_PATH" \
|
||||
view --raw --minify \
|
||||
-o jsonpath='{.users[0].user.token}' \
|
||||
| wc -c
|
||||
)"
|
||||
|
||||
echo " Token length: $TOKEN_LENGTH"
|
||||
|
||||
if [ "$TOKEN_LENGTH" -lt 100 ]; then
|
||||
echo "::error::Generated kubeconfig does not contain a valid-looking token"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Verify Kubernetes access
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
echo "Using kubeconfig: $KUBECONFIG"
|
||||
|
||||
echo -n "API server: "
|
||||
kubectl config view --minify \
|
||||
-o jsonpath='{.clusters[0].cluster.server}'
|
||||
echo
|
||||
|
||||
echo -n "Context: "
|
||||
kubectl config current-context
|
||||
|
||||
echo
|
||||
echo "RBAC checks:"
|
||||
|
||||
printf 'patch deployment: '
|
||||
kubectl auth can-i patch deployments \
|
||||
-n blog-ahmza-com
|
||||
|
||||
printf 'read secrets: '
|
||||
kubectl auth can-i get secrets \
|
||||
-n blog-ahmza-com
|
||||
|
||||
echo
|
||||
echo "Testing authenticated API access..."
|
||||
kubectl -n blog-ahmza-com get deployment blog
|
||||
|
||||
echo
|
||||
echo "Testing intended permissions..."
|
||||
|
||||
if kubectl auth can-i patch deployments \
|
||||
-n blog-ahmza-com
|
||||
then
|
||||
echo "OK: deployment patch permitted"
|
||||
else
|
||||
echo "::error::Deployment patch unexpectedly denied"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo
|
||||
echo "Testing privilege boundary..."
|
||||
|
||||
if kubectl auth can-i get secrets \
|
||||
-n blog-ahmza-com
|
||||
then
|
||||
echo "::error::CI account unexpectedly has Secret read access"
|
||||
exit 1
|
||||
else
|
||||
echo "OK: Secret read correctly denied"
|
||||
fi
|
||||
|
||||
- name: Deploy to Kubernetes
|
||||
env:
|
||||
IMAGE: tea.ahmza.com/ahmza/blog-ahmza-com:${{ gitea.event.head_commit.id }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
echo "Deploying $IMAGE"
|
||||
echo "Deploying image:"
|
||||
echo " $IMAGE"
|
||||
|
||||
kubectl -n blog-ahmza-com \
|
||||
set image deployment/blog \
|
||||
@@ -190,7 +236,7 @@ jobs:
|
||||
rollout status deployment/blog \
|
||||
--timeout=5m
|
||||
then
|
||||
echo "::error::Deployment failed; rolling back"
|
||||
echo "::error::New deployment failed. Rolling back."
|
||||
|
||||
kubectl -n blog-ahmza-com \
|
||||
rollout undo deployment/blog
|
||||
@@ -202,8 +248,17 @@ jobs:
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo
|
||||
echo "Deployment complete:"
|
||||
kubectl -n blog-ahmza-com get pods -o wide
|
||||
|
||||
echo
|
||||
echo "Running image:"
|
||||
kubectl -n blog-ahmza-com \
|
||||
get deployment blog \
|
||||
-o jsonpath='{.spec.template.spec.containers[?(@.name=="blog")].image}'
|
||||
echo
|
||||
|
||||
- name: NetBird diagnostics & disconnect
|
||||
# Runs even on failure: captures final state for debugging and tears the
|
||||
# peer down so stale 'gitea-actions-blog' peers don't pile up.
|
||||
|
||||
Reference in New Issue
Block a user