propogate
This commit is contained in:
Jun-te Kim
parent
7849e6141a
commit
322bfd9be1
1 changed files with 48 additions and 218 deletions
266
.github/workflows/stripe-to-invoice.yml
vendored
266
.github/workflows/stripe-to-invoice.yml
vendored
|
|
@ -10,13 +10,15 @@ on:
|
|||
- "*"
|
||||
workflow_dispatch:
|
||||
|
||||
env:
|
||||
POSTGRES_DB: stripe_invoice
|
||||
|
||||
jobs:
|
||||
# --------------------------------------------------
|
||||
# BUILD IMAGE
|
||||
# --------------------------------------------------
|
||||
build:
|
||||
runs-on: ubuntu-22.04
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
|
|
@ -41,44 +43,18 @@ jobs:
|
|||
tags: docker.io/kimjunte/stripe_to_invoice:${{ env.GITHUB_REF_SLUG }}
|
||||
|
||||
# --------------------------------------------------
|
||||
# DEPLOY POSTGRES (DEV + PROD)
|
||||
# DEPLOY POSTGRES
|
||||
# --------------------------------------------------
|
||||
deploy-db:
|
||||
name: Deploy Postgres (PV + PVC + Deployment)
|
||||
runs-on: mealcraft-runners
|
||||
needs: build
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Install kubectl
|
||||
run: |
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y curl ca-certificates gettext
|
||||
curl -LO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
|
||||
sudo install -m 0755 kubectl /usr/local/bin/kubectl
|
||||
|
||||
- name: Configure kubeconfig (in-cluster)
|
||||
run: |
|
||||
KUBE_HOST="https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT"
|
||||
SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
|
||||
CA_CERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||
|
||||
kubectl config set-cluster microk8s \
|
||||
--server="$KUBE_HOST" \
|
||||
--certificate-authority="$CA_CERT"
|
||||
|
||||
kubectl config set-credentials runner --token="$SA_TOKEN"
|
||||
|
||||
kubectl config set-context runner-context \
|
||||
--cluster=microk8s \
|
||||
--user=runner
|
||||
|
||||
kubectl config use-context runner-context
|
||||
- uses: ./.github/actions/kubectl-setup
|
||||
|
||||
- name: Decide environment
|
||||
run: |
|
||||
if [[ "$GITHUB_REF" == refs/heads/main || "$GITHUB_REF" == refs/tags/* || "$GITHUB_REF" == refs/heads/release/* ]]; then
|
||||
if [[ "$GITHUB_REF" == refs/heads/release/* || "$GITHUB_REF" == refs/tags/* ]]; then
|
||||
echo "ENV=prod" >> $GITHUB_ENV
|
||||
echo "NAMESPACE=default" >> $GITHUB_ENV
|
||||
echo "PG_VOLUME=stripe_invoice_prod" >> $GITHUB_ENV
|
||||
|
|
@ -93,57 +69,26 @@ jobs:
|
|||
export ENV NAMESPACE PG_VOLUME
|
||||
envsubst < db/k8s/postgres/stripe-to-invoice-db.yaml | kubectl apply -f -
|
||||
|
||||
|
||||
# --------------------------------------------------
|
||||
# APPLY DB + APP SECRETS
|
||||
# --------------------------------------------------
|
||||
secrets:
|
||||
name: Apply runtime secrets
|
||||
runs-on: mealcraft-runners
|
||||
needs: deploy-db
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Install kubectl
|
||||
run: |
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y curl ca-certificates gettext
|
||||
curl -LO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
|
||||
sudo install -m 0755 kubectl /usr/local/bin/kubectl
|
||||
|
||||
- name: Configure kubeconfig (in-cluster)
|
||||
run: |
|
||||
KUBE_HOST="https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT"
|
||||
SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
|
||||
CA_CERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||
|
||||
kubectl config set-cluster microk8s \
|
||||
--server="$KUBE_HOST" \
|
||||
--certificate-authority="$CA_CERT"
|
||||
|
||||
kubectl config set-credentials runner --token="$SA_TOKEN"
|
||||
|
||||
kubectl config set-context runner-context \
|
||||
--cluster=microk8s \
|
||||
--user=runner
|
||||
|
||||
kubectl config use-context runner-context
|
||||
- uses: ./.github/actions/kubectl-setup
|
||||
|
||||
- name: Decide environment
|
||||
run: |
|
||||
if [[ "$GITHUB_REF" == refs/heads/main || "$GITHUB_REF" == refs/tags/* || "$GITHUB_REF" == refs/heads/release/* ]]; then
|
||||
echo "ENV=prod" >> $GITHUB_ENV
|
||||
echo "NAMESPACE=default" >> $GITHUB_ENV
|
||||
echo "RUNTIME_SECRET=postgres-prod" >> $GITHUB_ENV
|
||||
if [[ "$ENV" == "prod" ]]; then
|
||||
echo "POSTGRES_HOST=postgres-prod.default.svc.cluster.local" >> $GITHUB_ENV
|
||||
echo "POSTGRES_DB=stripe_invoice" >> $GITHUB_ENV
|
||||
echo "RUNTIME_SECRET=postgres-prod" >> $GITHUB_ENV
|
||||
echo "NAMESPACE=default" >> $GITHUB_ENV
|
||||
else
|
||||
echo "ENV=dev" >> $GITHUB_ENV
|
||||
echo "NAMESPACE=dev" >> $GITHUB_ENV
|
||||
echo "RUNTIME_SECRET=postgres-dev" >> $GITHUB_ENV
|
||||
echo "POSTGRES_HOST=postgres-dev.dev.svc.cluster.local" >> $GITHUB_ENV
|
||||
echo "POSTGRES_DB=stripe_invoice" >> $GITHUB_ENV
|
||||
echo "RUNTIME_SECRET=postgres-dev" >> $GITHUB_ENV
|
||||
echo "NAMESPACE=dev" >> $GITHUB_ENV
|
||||
fi
|
||||
|
||||
- name: Apply DB secret
|
||||
|
|
@ -155,159 +100,66 @@ jobs:
|
|||
if [[ "$ENV" == "prod" ]]; then
|
||||
USER="$PROD_POSTGRES_USER"
|
||||
PASS="$PROD_POSTGRES_PASSWORD"
|
||||
RUNTIME_SECRET=postgres-prod
|
||||
NAMESPACE=default
|
||||
else
|
||||
USER="$DEV_POSTGRES_USER"
|
||||
PASS="$DEV_POSTGRES_PASSWORD"
|
||||
RUNTIME_SECRET=postgres-dev
|
||||
NAMESPACE=dev
|
||||
fi
|
||||
|
||||
DATABASE_URL="postgres://${USER}:${PASS}@${POSTGRES_HOST}:5432/${POSTGRES_DB}?sslmode=disable"
|
||||
|
||||
kubectl create secret generic $RUNTIME_SECRET \
|
||||
--namespace $NAMESPACE \
|
||||
kubectl create secret generic "$RUNTIME_SECRET" \
|
||||
-n "$NAMESPACE" \
|
||||
--from-literal=DATABASE_URL="$DATABASE_URL" \
|
||||
--from-literal=POSTGRES_USER="$USER" \
|
||||
--from-literal=POSTGRES_PASSWORD="$PASS" \
|
||||
--from-literal=POSTGRES_DB="$POSTGRES_DB" \
|
||||
--from-literal=DATABASE_URL="$DATABASE_URL" \
|
||||
--dry-run=client -o yaml | kubectl apply -f -
|
||||
|
||||
|
||||
- name: Apply app secrets
|
||||
run: |
|
||||
set -e
|
||||
set -a
|
||||
source stripe_to_invoice/deployment/secrets/.env
|
||||
set +a
|
||||
|
||||
if [[ "$ENV" == "prod" ]]; then
|
||||
NAMESPACE=default
|
||||
STRIPE_SECRET_KEY="$PROD_STRIPE_SECRET_KEY"
|
||||
STRIPE_CLIENT_ID="$PROD_STRIPE_CLIENT_ID"
|
||||
STRIPE_REDIRECT_URI="$PROD_STRIPE_REDIRECT_URI"
|
||||
APP_URL="$PROD_APP_URL"
|
||||
XERO_CLIENT_ID="$PROD_XERO_CLIENT_ID"
|
||||
XERO_CLIENT_SECRET="$PROD_XERO_SECRET_KEY"
|
||||
XERO_REDIRECT_URI="$PROD_XERO_REDIRECT_URI"
|
||||
AWS_REGION="$PROD_AWS_REGION"
|
||||
STRIPE_WEBHOOK_SECRET="$PROD_STRIPE_WEBHOOK_SECRET"
|
||||
SES_FROM_EMAIL="$PROD_SES_FROM_EMAIL"
|
||||
export STRIPE_SECRET_KEY="$PROD_STRIPE_SECRET_KEY"
|
||||
export STRIPE_CLIENT_ID="$PROD_STRIPE_CLIENT_ID"
|
||||
export STRIPE_REDIRECT_URI="$PROD_STRIPE_REDIRECT_URI"
|
||||
export APP_URL="$PROD_APP_URL"
|
||||
export XERO_CLIENT_ID="$PROD_XERO_CLIENT_ID"
|
||||
export XERO_CLIENT_SECRET="$PROD_XERO_SECRET_KEY"
|
||||
export XERO_REDIRECT_URI="$PROD_XERO_REDIRECT_URI"
|
||||
export AWS_REGION="$PROD_AWS_REGION"
|
||||
export STRIPE_WEBHOOK_SECRET="$PROD_STRIPE_WEBHOOK_SECRET"
|
||||
export SES_FROM_EMAIL="$PROD_SES_FROM_EMAIL"
|
||||
else
|
||||
STRIPE_SECRET_KEY="$DEV_STRIPE_SECRET_KEY"
|
||||
STRIPE_CLIENT_ID="$DEV_STRIPE_CLIENT_ID"
|
||||
STRIPE_REDIRECT_URI="$DEV_STRIPE_REDIRECT_URI"
|
||||
APP_URL="$DEV_APP_URL"
|
||||
XERO_CLIENT_ID="$DEV_XERO_CLIENT_ID"
|
||||
XERO_CLIENT_SECRET="$DEV_XERO_SECRET_KEY"
|
||||
XERO_REDIRECT_URI="$DEV_XERO_REDIRECT_URI"
|
||||
AWS_REGION="$DEV_AWS_REGION"
|
||||
STRIPE_WEBHOOK_SECRET="$DEV_STRIPE_WEBHOOK_SECRET"
|
||||
SES_FROM_EMAIL="$DEV_SES_FROM_EMAIL"
|
||||
export STRIPE_SECRET_KEY="$DEV_STRIPE_SECRET_KEY"
|
||||
export STRIPE_CLIENT_ID="$DEV_STRIPE_CLIENT_ID"
|
||||
export STRIPE_REDIRECT_URI="$DEV_STRIPE_REDIRECT_URI"
|
||||
export APP_URL="$DEV_APP_URL"
|
||||
export XERO_CLIENT_ID="$DEV_XERO_CLIENT_ID"
|
||||
export XERO_CLIENT_SECRET="$DEV_XERO_SECRET_KEY"
|
||||
export XERO_REDIRECT_URI="$DEV_XERO_REDIRECT_URI"
|
||||
export AWS_REGION="$DEV_AWS_REGION"
|
||||
export STRIPE_WEBHOOK_SECRET="$DEV_STRIPE_WEBHOOK_SECRET"
|
||||
export SES_FROM_EMAIL="$DEV_SES_FROM_EMAIL"
|
||||
fi
|
||||
|
||||
: "${STRIPE_SECRET_KEY:?missing STRIPE_SECRET_KEY}"
|
||||
: "${STRIPE_CLIENT_ID:?missing STRIPE_CLIENT_ID}"
|
||||
: "${APP_URL:?missing APP_URL}"
|
||||
: "${STRIPE_REDIRECT_URI:?missing STRIPE_REDIRECT_URI}"
|
||||
: "${XERO_CLIENT_ID:?missing XERO_CLIENT_ID}"
|
||||
: "${XERO_CLIENT_SECRET:?missing XERO_CLIENT_SECRET}"
|
||||
: "${XERO_REDIRECT_URI:?missing XERO_REDIRECT_URI}"
|
||||
: "${AWS_REGION:?missing AWS_REGION}"
|
||||
: "${SES_FROM_EMAIL:?missing SES_FROM_EMAIL}"
|
||||
|
||||
export \
|
||||
STRIPE_SECRET_KEY \
|
||||
STRIPE_CLIENT_ID \
|
||||
STRIPE_REDIRECT_URI \
|
||||
APP_URL \
|
||||
XERO_CLIENT_ID \
|
||||
XERO_CLIENT_SECRET \
|
||||
XERO_REDIRECT_URI \
|
||||
AWS_REGION \
|
||||
STRIPE_WEBHOOK_SECRET \
|
||||
SES_FROM_EMAIL \
|
||||
NAMESPACE
|
||||
|
||||
envsubst < stripe_to_invoice/deployment/secrets/stripe-secrets.yaml \
|
||||
| kubectl apply -f -
|
||||
envsubst < stripe_to_invoice/deployment/secrets/stripe-secrets.yaml | kubectl apply -f -
|
||||
|
||||
# --------------------------------------------------
|
||||
# RUN ATLAS MIGRATIONS
|
||||
# --------------------------------------------------
|
||||
migrate:
|
||||
name: Run DB migrations (Atlas)
|
||||
runs-on: mealcraft-runners
|
||||
needs: secrets
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Install Atlas
|
||||
uses: ariga/setup-atlas@v0
|
||||
|
||||
- name: Install kubectl
|
||||
run: |
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y curl ca-certificates gettext
|
||||
curl -LO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
|
||||
sudo install -m 0755 kubectl /usr/local/bin/kubectl
|
||||
|
||||
- name: Configure kubeconfig (in-cluster)
|
||||
run: |
|
||||
KUBE_HOST="https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT"
|
||||
SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
|
||||
CA_CERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||
|
||||
kubectl config set-cluster microk8s \
|
||||
--server="$KUBE_HOST" \
|
||||
--certificate-authority="$CA_CERT"
|
||||
|
||||
kubectl config set-credentials runner --token="$SA_TOKEN"
|
||||
|
||||
kubectl config set-context runner-context \
|
||||
--cluster=microk8s \
|
||||
--user=runner
|
||||
|
||||
kubectl config use-context runner-context
|
||||
|
||||
|
||||
- name: Install netcat
|
||||
run: |
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y netcat-openbsd
|
||||
- uses: ariga/setup-atlas@v0
|
||||
- uses: ./.github/actions/kubectl-setup
|
||||
|
||||
- name: Decide environment
|
||||
run: |
|
||||
if [[ "$GITHUB_REF" == refs/heads/main || "$GITHUB_REF" == refs/tags/* || "$GITHUB_REF" == refs/heads/release/* ]]; then
|
||||
echo "ENV=prod" >> $GITHUB_ENV
|
||||
echo "POSTGRES_HOST=postgres-prod.default.svc.cluster.local" >> $GITHUB_ENV
|
||||
echo "POSTGRES_DB=stripe_invoice" >> $GITHUB_ENV
|
||||
else
|
||||
echo "ENV=dev" >> $GITHUB_ENV
|
||||
echo "POSTGRES_HOST=postgres-dev.dev.svc.cluster.local" >> $GITHUB_ENV
|
||||
echo "POSTGRES_DB=stripe_invoice" >> $GITHUB_ENV
|
||||
fi
|
||||
|
||||
- name: Wait for Postgres TCP
|
||||
run: |
|
||||
set -e
|
||||
for i in {1..30}; do
|
||||
if nc -z "$POSTGRES_HOST" 5432; then
|
||||
echo "Postgres is accepting connections"
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for Postgres ($i/30)..."
|
||||
sleep 5
|
||||
done
|
||||
echo "Postgres never became ready"
|
||||
exit 1
|
||||
|
||||
- name: Run migrations (using K8s secret)
|
||||
run: |
|
||||
set -e
|
||||
|
||||
if [[ "$ENV" == "prod" ]]; then
|
||||
SECRET=postgres-prod
|
||||
NAMESPACE=default
|
||||
|
|
@ -315,12 +167,15 @@ jobs:
|
|||
SECRET=postgres-dev
|
||||
NAMESPACE=dev
|
||||
fi
|
||||
echo "SECRET=$SECRET" >> $GITHUB_ENV
|
||||
echo "NAMESPACE=$NAMESPACE" >> $GITHUB_ENV
|
||||
|
||||
DATABASE_URL=$(kubectl get secret "$SECRET" \
|
||||
-n "$NAMESPACE" \
|
||||
- name: Run migrations
|
||||
run: |
|
||||
DATABASE_URL=$(kubectl get secret "$SECRET" -n "$NAMESPACE" \
|
||||
-o jsonpath='{.data.DATABASE_URL}' | base64 -d)
|
||||
|
||||
echo "Running Atlas migrations against $POSTGRES_HOST"
|
||||
echo "$DATABASE_URL" | sed -E 's#(postgres://[^:]+:)[^@]+#\1****#'
|
||||
|
||||
atlas migrate apply \
|
||||
--dir file://db/atlas/stripe_invoice/migrations \
|
||||
|
|
@ -331,39 +186,15 @@ jobs:
|
|||
# --------------------------------------------------
|
||||
deploy:
|
||||
runs-on: mealcraft-runners
|
||||
needs:
|
||||
- build
|
||||
- secrets
|
||||
- migrate
|
||||
|
||||
needs: [build, secrets, migrate]
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Install kubectl
|
||||
run: |
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y curl ca-certificates gettext
|
||||
curl -LO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
|
||||
sudo install -m 0755 kubectl /usr/local/bin/kubectl
|
||||
|
||||
- name: Configure kubeconfig (in-cluster)
|
||||
run: |
|
||||
KUBE_HOST="https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT"
|
||||
SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
|
||||
CA_CERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||
NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
|
||||
|
||||
kubectl config set-cluster microk8s --server="$KUBE_HOST" --certificate-authority="$CA_CERT"
|
||||
kubectl config set-credentials runner --token="$SA_TOKEN"
|
||||
kubectl config set-context runner-context --cluster=microk8s --user=runner --namespace="$NAMESPACE"
|
||||
kubectl config use-context runner-context
|
||||
|
||||
- name: Inject slug variables
|
||||
uses: rlespinasse/github-slug-action@v4
|
||||
- uses: ./.github/actions/kubectl-setup
|
||||
- uses: rlespinasse/github-slug-action@v4
|
||||
|
||||
- name: Decide environment
|
||||
run: |
|
||||
if [[ "$GITHUB_REF" == refs/heads/release/* || "$GITHUB_REF" == refs/tags/* ]]; then
|
||||
if [[ "$ENV" == "prod" ]]; then
|
||||
echo "NAMESPACE=default" >> $GITHUB_ENV
|
||||
echo "DB_ENV=prod" >> $GITHUB_ENV
|
||||
echo "HOSTNAME=stripe-to-invoice.juntekim.com" >> $GITHUB_ENV
|
||||
|
|
@ -376,5 +207,4 @@ jobs:
|
|||
- name: Deploy application
|
||||
run: |
|
||||
export IMAGE="docker.io/kimjunte/stripe_to_invoice:$GITHUB_REF_SLUG"
|
||||
export NAMESPACE DB_ENV HOSTNAME
|
||||
envsubst < stripe_to_invoice/deployment/deployment.yaml | kubectl apply -f -
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue