Skip to content

Commit d001211

Browse files
metju-acmetju-ac
authored
Merge pull request #2060 from gooddata/INFRA-4009
refactor: create new lcm pipeline
2 parents a4ed258 + a8c2900 commit d001211

21 files changed

+1860
-195
lines changed

‎.github/actions/container-build-push/action.yaml‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
# yamllint disable rule:line-length
2+
---
3+
name: "ecr-container-build-push"
4+
description: "Build a container image and upload it to ECR"
5+
inputs:
6+
aws-creds-vault-path:
7+
default: secret/data/v2/data-special/infra1-user-ecr-rw
8+
description: "Vault path to AWS credentials used for helm push"
9+
aws-creds-vault-role:
10+
default: ecr-push
11+
description: "Vault auth role for reading AWS credentials"
12+
aws-region:
13+
default: "us-east-1"
14+
description: "AWS region to use for ECR"
15+
ecr-repos:
16+
description: "Repository (as defined in gooddata/terraform-ecr/repositories)"
17+
required: true
18+
ecr-url:
19+
description: "ECR registry default URL (without prefix/suffix)"
20+
required: true
21+
vault-url:
22+
description: "Vault API URL (default okay in almost all cases)"
23+
required: true
24+
build-args:
25+
description: "Arguments for container build file (ARG in Dockerfile)."
26+
required: false
27+
default: ""
28+
build-context:
29+
description: "Context (working directory) where the build should be executed"
30+
default: "."
31+
build-tags:
32+
description: "Tags (newline delimited)"
33+
required: true
34+
container-file:
35+
description: "File (with a path) to use for build"
36+
default: "Dockerfile"
37+
push-image:
38+
description: "Whether to really push to registry"
39+
default: "true"
40+
debug:
41+
description: "Turn on debug messages"
42+
default: "false"
43+
platforms:
44+
description: "List of target platforms for build"
45+
default: "linux/amd64"
46+
labels:
47+
description: "List of labels for image"
48+
default: ""
49+
secrets:
50+
description: "List of secrets to expose to the build (e.g., key=string, GIT_AUTH_TOKEN=mytoken)"
51+
default: ""
52+
secret-envs:
53+
description: "List of secret env vars to expose to the build (e.g., key=envname, MY_SECRET=MY_ENV_VAR)"
54+
default: ""
55+
provenance:
56+
description: "Generate provenance attestation for the build"
57+
default: "true"
58+
outputs:
59+
digest:
60+
description: "Image digest"
61+
value: ${{ steps.build_push.outputs.digest }}
62+
imageid:
63+
description: "Image ID"
64+
value: ${{ steps.build_push.outputs.imageid }}
65+
metadata:
66+
description: "Image metadata"
67+
value: ${{ steps.build_push.outputs.metadata }}
68+
runs:
69+
using: "composite"
70+
steps:
71+
- name: Check container file
72+
env:
73+
CONTAINERFILE: ${{ inputs.container-file }}
74+
shell: bash
75+
run: |
76+
test -f $CONTAINERFILE
77+
- name: Get required Vault secrets
78+
id: secrets
79+
uses: hashicorp/vault-action@v3
80+
with:
81+
url: ${{ inputs.vault-url }}
82+
method: jwt
83+
path: jwt/github
84+
role: ${{ inputs.aws-creds-vault-role }}
85+
secrets: |
86+
${{ inputs.aws-creds-vault-path }} aws_ecr_access_key | AWS_ACCESS_KEY ;
87+
${{ inputs.aws-creds-vault-path }} aws_ecr_secret_key | AWS_SECRET_KEY ;
88+
- name: Configure AWS credentials
89+
uses: aws-actions/configure-aws-credentials@v4
90+
with:
91+
aws-access-key-id: ${{ env.AWS_ACCESS_KEY }}
92+
aws-secret-access-key: ${{ env.AWS_SECRET_KEY }}
93+
aws-region: ${{ inputs.aws-region }}
94+
- name: Expand tags with ECR url and ECR repo
95+
id: expand_tags
96+
env:
97+
ECR_URL: ${{ inputs.ecr-url }}
98+
ECR_REPOS: ${{ inputs.ecr-repos }}
99+
BUILD_TAGS: ${{ inputs.build-tags }}
100+
shell: bash
101+
run: |
102+
eval REPO=$ECR_REPOS
103+
{
104+
echo "EXPANDED_TAGS<<EOF"
105+
for BTAG in $BUILD_TAGS; do
106+
echo $ECR_URL/$REPO:$BTAG
107+
done
108+
echo EOF
109+
} >> "$GITHUB_ENV"
110+
echo "REPO=$REPO" >> "$GITHUB_ENV"
111+
112+
- name: Build and push Docker images (legacy)
113+
shell: bash
114+
env:
115+
CONTAINERFILE: ${{ inputs.container-file }}
116+
BUILD_CONTEXT: ${{ inputs.build-context }}
117+
BUILD_ARGS: ${{ inputs.build-args }}
118+
ECR_URL: ${{ inputs.ecr-url }}
119+
AWS_REGION: ${{ inputs.aws-region }}
120+
run: |
121+
# Login to ECR
122+
aws ecr get-login-password --region $AWS_REGION | \
123+
docker login --username AWS --password-stdin $ECR_URL
124+
125+
# Parse build args
126+
DOCKER_BUILD_ARGS=""
127+
if [ -n "$BUILD_ARGS" ]; then
128+
while IFS= read -r arg; do
129+
[ -n "$arg" ] && DOCKER_BUILD_ARGS="$DOCKER_BUILD_ARGS --build-arg $arg"
130+
done <<< "$BUILD_ARGS"
131+
fi
132+
133+
# Build and push each tag
134+
for TAG in $EXPANDED_TAGS; do
135+
docker build -f $CONTAINERFILE \
136+
$DOCKER_BUILD_ARGS \
137+
-t $TAG \
138+
$BUILD_CONTEXT
139+
docker push $TAG
140+
done

‎.github/actions/helm-push/action.yaml‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
---
2+
# yamllint disable rule:line-length
3+
name: "ecr-helm-push"
4+
description: "Package a Helm chart and upload to ECR"
5+
inputs:
6+
aws-creds-vault-path:
7+
default: secret/data/v2/data-special/infra1-user-ecr-rw
8+
description: "Vault path to AWS credentials used for helm push"
9+
type: string
10+
aws-creds-vault-role:
11+
description: "Vault auth role for reading AWS credentials"
12+
type: string
13+
required: true
14+
aws-region:
15+
default: "us-east-1"
16+
description: "AWS region to use for ECR"
17+
type: string
18+
ecr-repo-prefix:
19+
description: "Repository prefix (without Chart name)"
20+
type: string
21+
required: true
22+
ecr-url:
23+
description: "ECR registry default URL (without prefix/suffix)"
24+
type: string
25+
required: true
26+
path:
27+
description: "Path to directory containing Chart.yaml"
28+
required: true
29+
type: string
30+
package-destination:
31+
default: "."
32+
description: "Where to put helm-built package"
33+
type: string
34+
package-app-version:
35+
default: ""
36+
description: "Application version"
37+
type: string
38+
package-version:
39+
default: ""
40+
description: "Helm chart version - used by `helm package`"
41+
type: string
42+
vault-url:
43+
description: "Vault API URL (default okay in almost all cases)"
44+
required: true
45+
checkout-code:
46+
default: "true"
47+
description: "Checkout fresh code from repository"
48+
type: string
49+
dependency-update:
50+
default: "true"
51+
description: "Run helm dependency update before packaging"
52+
type: string
53+
dry-run:
54+
default: "false"
55+
type: string
56+
description: "Dry-run (do not upload to ECR)"
57+
runs:
58+
using: "composite"
59+
steps:
60+
- name: Checkout code
61+
if: ${{ inputs.checkout-code == 'true' }}
62+
uses: actions/checkout@v5
63+
- name: Install helm binary
64+
uses: azure/setup-helm@v4
65+
with:
66+
version: 'v3.12.1'
67+
- name: Get required Vault secrets
68+
if: ${{ inputs.dry-run == 'false' }}
69+
id: secrets
70+
uses: hashicorp/vault-action@v3
71+
with:
72+
url: ${{ inputs.vault-url }}
73+
method: jwt
74+
path: jwt/github
75+
role: ${{ inputs.aws-creds-vault-role }}
76+
secrets: |
77+
${{ inputs.aws-creds-vault-path }} aws_ecr_access_key | AWS_ACCESS_KEY ;
78+
${{ inputs.aws-creds-vault-path }} aws_ecr_secret_key | AWS_SECRET_KEY ;
79+
- name: Configure AWS credentials
80+
if: ${{ inputs.dry-run == 'false' }}
81+
uses: aws-actions/configure-aws-credentials@v4
82+
with:
83+
aws-access-key-id: ${{ env.AWS_ACCESS_KEY }}
84+
aws-secret-access-key: ${{ env.AWS_SECRET_KEY }}
85+
aws-region: ${{ inputs.aws-region }}
86+
- name: Login to Amazon ECR
87+
if: ${{ inputs.dry-run == 'false' }}
88+
id: login-ecr
89+
uses: aws-actions/amazon-ecr-login@v2
90+
- name: Package chart
91+
id: package-chart
92+
env:
93+
DESTINATION: ${{ inputs.package-destination }}
94+
APP_VERSION: ${{ inputs.package-app-version }}
95+
VERSION: ${{ inputs.package-version }}
96+
run: |
97+
# helm package doesn't allow custom target name, so we have to parse it this way
98+
pkgfile=$(helm package ${DESTINATION:+--destination $DESTINATION} ${APP_VERSION:+--app-version $APP_VERSION} ${VERSION:+--version $VERSION} ${{ inputs.dependency-update == 'true' && '--dependency-update' || '' }} ${{ inputs.path }} | tee | awk '{print $NF}')
99+
echo "pkgfile=$pkgfile" >> $GITHUB_OUTPUT
100+
shell: bash
101+
- name: Push chart to ECR
102+
if: ${{ inputs.dry-run == 'false' }}
103+
run: |
104+
helm push ${{ steps.package-chart.outputs.pkgfile }} oci://${{ inputs.ecr-url }}/${{ inputs.ecr-repo-prefix }}
105+
echo "Pushed ${{ steps.package-chart.outputs.pkgfile }} to oci://${{ inputs.ecr-url }}/${{ inputs.ecr-repo-prefix }}" >> $GITHUB_STEP_SUMMARY
106+
shell: bash

‎.github/actions/rundeck/action.yaml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
name: "Trigger Rundeck job"
2+
description: "Trigger Rundeck job through Rundeck API with given parameters"
3+
inputs:
4+
server:
5+
description: "Which server should the job be run on (rundeck server hostname)"
6+
required: true
7+
project:
8+
description: "Rundeck project name containing the job to run"
9+
required: true
10+
job-group:
11+
description: "Job group name"
12+
required: true
13+
job-name:
14+
description: "Job name"
15+
required: true
16+
vault-url:
17+
description: "Vault URL for certificate retrieval"
18+
required: true
19+
outputs:
20+
job-execution-status:
21+
description: "Job execution status"
22+
value: ${{ steps.python.outputs.execution_status }}
23+
job-execution-url:
24+
description: "Job execution URL"
25+
value: ${{ steps.python.outputs.url }}
26+
plan-summary:
27+
description: "Overall plan summary extracted from job output"
28+
value: ${{ steps.python.outputs.plan_summary }}
29+
runs:
30+
using: "composite"
31+
steps:
32+
- name: Get certificate from Vault
33+
id: cert-from-vault
34+
uses: gooddata/github-actions-public/vault/cert@master
35+
with:
36+
vault-url: ${{ inputs.vault-url }}
37+
cn: gh.action
38+
role: github-common-action
39+
vault-auth-role: common-action
40+
- name: Join certificates
41+
id: join-certs
42+
run: |
43+
echo "${{ steps.cert-from-vault.outputs.certificate }}" > cert.pem
44+
echo "${{ steps.cert-from-vault.outputs.ca_chain }}" >> cert.pem
45+
echo "${{ steps.cert-from-vault.outputs.private_key }}" >> cert.pem
46+
shell: bash
47+
- name: Run python script
48+
id: python
49+
run: |
50+
python "${{ github.action_path }}/rundeck_job_trigger.py" \
51+
--cert-path cert.pem \
52+
--server "${{ inputs.server }}" \
53+
--project "${{ inputs.project }}" \
54+
--job-group "${{ inputs.job-group }}" \
55+
--job-name "${{ inputs.job-name }}"
56+
shell: bash

0 commit comments

Comments
 (0)