mirror of
https://gitlab.sarex.io/infra/terraform-contour-mirror.git
synced 2026-08-05 18:31:00 +03:00
++ aaahhh
This commit is contained in:
gitlab-pusher
parent
ae63a51323
commit
50c8430733
@ -13,6 +13,7 @@ name: Terraform Terragrunt (contour)
|
|||||||
|
|
||||||
on:
|
on:
|
||||||
pull_request:
|
pull_request:
|
||||||
|
workflow_dispatch:
|
||||||
branches: [contour]
|
branches: [contour]
|
||||||
paths:
|
paths:
|
||||||
- "live/**"
|
- "live/**"
|
||||||
|
|||||||
200
.gitlab-ci.yml
200
.gitlab-ci.yml
@ -1,133 +1,81 @@
|
|||||||
name: Terraform Terragrunt (contour)
|
stages:
|
||||||
|
- generate
|
||||||
|
- trigger
|
||||||
|
- deploy
|
||||||
|
|
||||||
# One workflow for ALL closed contours. Per-contour differentiation is done via
|
|
||||||
# repository variables/secrets in each contour's Gitea — this is the downstream
|
|
||||||
# runner contract:
|
|
||||||
# vars: INFRA_ENV, RUNNER_LABEL, RUNNER_IMAGE
|
|
||||||
# secrets: TF_STATE_S3_ENDPOINT, TF_STATE_S3_BUCKET, S3_ACCESS_KEY, S3_SECRET_KEY,
|
|
||||||
# VAULT_ADDR, VAULT_TOKEN, SOPS_AGE_KEY, KUBECONFIG_B64 (external runner
|
|
||||||
# only), KUBE_CONTEXT (external runner only)
|
|
||||||
# Infra-service admin creds are NOT passed as secrets — they are read from Vault
|
|
||||||
# at run time (see the "Run ... stacks" step) so the single source of truth stays
|
|
||||||
# in the contour Vault.
|
|
||||||
|
|
||||||
on:
|
|
||||||
workflow_dispatch:
|
generate-pipeline:
|
||||||
pull_request:
|
stage: generate
|
||||||
branches: [contour]
|
image: alpine:latest
|
||||||
|
before_script:
|
||||||
|
- apk add --no-cache bash findutils
|
||||||
|
script:
|
||||||
|
- echo "=== DEBUG INFO ==="
|
||||||
|
- echo "CI_PIPELINE_SOURCE=$CI_PIPELINE_SOURCE"
|
||||||
|
- echo "CI_COMMIT_BRANCH=$CI_COMMIT_BRANCH"
|
||||||
|
- echo "CI_MERGE_REQUEST_SOURCE_BRANCH_NAME=$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME"
|
||||||
|
- pwd && ls -la
|
||||||
|
- echo "=== Finding terragrunt files ==="
|
||||||
|
- find live -name "terragrunt.hcl" -not -path "*/.terragrunt-cache/*" | head -20 || echo "No files found"
|
||||||
|
- echo "=== Generating pipeline ==="
|
||||||
|
- chmod +x ./scripts/generate-pipeline.sh
|
||||||
|
- ./scripts/generate-pipeline.sh
|
||||||
|
- echo "=== Generated pipeline content ==="
|
||||||
|
- cat .gitlab-ci.generated.yml
|
||||||
|
artifacts:
|
||||||
paths:
|
paths:
|
||||||
- "live/**"
|
- .gitlab-ci.generated.yml
|
||||||
- "modules/**"
|
expire_in: 1 hour
|
||||||
- "infrastructure.yaml"
|
rules:
|
||||||
- "infrastructure-secrets.yaml"
|
- if: '$CI_PIPELINE_SOURCE == "pipeline"'
|
||||||
- "scripts/**"
|
- if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
|
||||||
- ".gitea/workflows/**"
|
- if: '$CI_COMMIT_BRANCH == "stage"'
|
||||||
push:
|
- if: '$CI_COMMIT_BRANCH == "master"'
|
||||||
branches: [contour]
|
- if: '$CI_COMMIT_BRANCH =~ /^feature\/.*/'
|
||||||
paths:
|
|
||||||
- "live/**"
|
|
||||||
- "modules/**"
|
|
||||||
- "infrastructure.yaml"
|
|
||||||
- "infrastructure-secrets.yaml"
|
|
||||||
- "scripts/**"
|
|
||||||
- ".gitea/workflows/**"
|
|
||||||
|
|
||||||
env:
|
|
||||||
TF_STATE_S3_REGION: ru-central1
|
|
||||||
INFRA_ENV: ${{ vars.INFRA_ENV }}
|
|
||||||
|
|
||||||
jobs:
|
# Prod environment
|
||||||
validate:
|
trigger-downstream-prod:
|
||||||
runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
|
stage: trigger
|
||||||
container:
|
needs:
|
||||||
image: ${{ vars.RUNNER_IMAGE || 'cr.yandex/crp3ccidau046kdj8g9q/terraform/terragrunt:v9.11' }}
|
- generate-pipeline
|
||||||
env:
|
trigger:
|
||||||
TF_STATE_S3_ENDPOINT: ${{ secrets.TF_STATE_S3_ENDPOINT }}
|
include:
|
||||||
TF_STATE_S3_BUCKET: ${{ secrets.TF_STATE_S3_BUCKET }}
|
- artifact: .gitlab-ci.generated.yml
|
||||||
S3_ACCESS_KEY: ${{ secrets.S3_ACCESS_KEY }}
|
job: generate-pipeline
|
||||||
S3_SECRET_KEY: ${{ secrets.S3_SECRET_KEY }}
|
strategy: depend
|
||||||
VAULT_ADDR: ${{ secrets.VAULT_ADDR }}
|
forward:
|
||||||
VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
|
pipeline_variables: true
|
||||||
SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
|
yaml_variables: true
|
||||||
KUBE_CONTEXT: ${{ secrets.KUBE_CONTEXT }}
|
variables:
|
||||||
KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
|
TERRAFORM_IMAGE_NAME: cr.yandex/crp3ccidau046kdj8g9q/terraform/terragrunt:v9.11
|
||||||
KUBECONFIG: /workspace/.kube/config
|
YC_SERVICE_ACCOUNT_KEY_FILE: ${YC_PROD_SERVICE_ACCOUNT_KEY_FILE}
|
||||||
GIT_AUTH_TOKEN: ${{ github.token }}
|
YC_CLOUD_ID: ${YC_CLOUD_ID}
|
||||||
steps:
|
YC_STAGE_FOLDER_ID: ${YC_STAGE_FOLDER_ID}
|
||||||
- uses: actions/checkout@v4
|
YC_PROD_FOLDER_ID: ${YC_PROD_FOLDER_ID}
|
||||||
- name: Prepare kubeconfig
|
YC_PREPROD_FOLDER_ID: ${YC_PREPROD_FOLDER_ID}
|
||||||
run: |
|
S3_ACCESS_KEY: ${S3_PROD_ACCESS_KEY}
|
||||||
if [ -n "${KUBECONFIG_B64:-}" ]; then
|
S3_SECRET_KEY: ${S3_PROD_SECRET_KEY}
|
||||||
mkdir -p /workspace/.kube
|
S3_STATE_BUCKET: ${S3_PROD_STATE_BUCKET}
|
||||||
echo "$KUBECONFIG_B64" | base64 -d > /workspace/.kube/config
|
AWS_ACCESS_KEY_ID: ${S3_PROD_ACCESS_KEY}
|
||||||
chmod 600 /workspace/.kube/config
|
AWS_SECRET_ACCESS_KEY: ${S3_PROD_SECRET_KEY}
|
||||||
else
|
TARGET_ENV: "prod"
|
||||||
echo "No KUBECONFIG_B64 — in-cluster runner: kubernetes/vault providers use the pod ServiceAccount kubeconfig or in-cluster config."
|
rules:
|
||||||
fi
|
- if: '$CI_PIPELINE_SOURCE == "pipeline"'
|
||||||
- name: Run validate for all stacks
|
- if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
|
||||||
run: |
|
- if: '$CI_COMMIT_BRANCH == "master"'
|
||||||
. ./scripts/load_admin_creds.sh
|
- if: '$CI_COMMIT_BRANCH =~ /^feature\/.*/'
|
||||||
./scripts/run_all_stacks.sh validate
|
|
||||||
|
|
||||||
plan:
|
|
||||||
needs: [validate]
|
|
||||||
runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
|
|
||||||
container:
|
|
||||||
image: ${{ vars.RUNNER_IMAGE || 'cr.yandex/crp3ccidau046kdj8g9q/terraform/terragrunt:v9.11' }}
|
|
||||||
env:
|
|
||||||
TF_STATE_S3_ENDPOINT: ${{ secrets.TF_STATE_S3_ENDPOINT }}
|
|
||||||
TF_STATE_S3_BUCKET: ${{ secrets.TF_STATE_S3_BUCKET }}
|
|
||||||
S3_ACCESS_KEY: ${{ secrets.S3_ACCESS_KEY }}
|
|
||||||
S3_SECRET_KEY: ${{ secrets.S3_SECRET_KEY }}
|
|
||||||
VAULT_ADDR: ${{ secrets.VAULT_ADDR }}
|
|
||||||
VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
|
|
||||||
SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
|
|
||||||
KUBE_CONTEXT: ${{ secrets.KUBE_CONTEXT }}
|
|
||||||
KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
|
|
||||||
KUBECONFIG: /workspace/.kube/config
|
|
||||||
GIT_AUTH_TOKEN: ${{ github.token }}
|
|
||||||
steps:
|
|
||||||
- uses: actions/checkout@v4
|
|
||||||
- name: Prepare kubeconfig
|
|
||||||
run: |
|
|
||||||
if [ -n "${KUBECONFIG_B64:-}" ]; then
|
|
||||||
mkdir -p /workspace/.kube
|
|
||||||
echo "$KUBECONFIG_B64" | base64 -d > /workspace/.kube/config
|
|
||||||
chmod 600 /workspace/.kube/config
|
|
||||||
fi
|
|
||||||
- name: Run plan for all stacks
|
|
||||||
run: |
|
|
||||||
. ./scripts/load_admin_creds.sh
|
|
||||||
./scripts/run_all_stacks.sh plan
|
|
||||||
|
|
||||||
apply:
|
mirror-contour:
|
||||||
needs: [plan]
|
stage: deploy
|
||||||
if: github.event_name == 'push'
|
image: alpine:3.21
|
||||||
runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
|
variables:
|
||||||
container:
|
GIT_DEPTH: "0"
|
||||||
image: ${{ vars.RUNNER_IMAGE || 'cr.yandex/crp3ccidau046kdj8g9q/terraform/terragrunt:v9.11' }}
|
before_script:
|
||||||
env:
|
- apk add --no-cache git ca-certificates
|
||||||
TF_STATE_S3_ENDPOINT: ${{ secrets.TF_STATE_S3_ENDPOINT }}
|
script:
|
||||||
TF_STATE_S3_BUCKET: ${{ secrets.TF_STATE_S3_BUCKET }}
|
- git push --force "$CONTOUR_MIRROR_PUSH_URL" "$CI_COMMIT_SHA:refs/heads/contour"
|
||||||
S3_ACCESS_KEY: ${{ secrets.S3_ACCESS_KEY }}
|
rules:
|
||||||
S3_SECRET_KEY: ${{ secrets.S3_SECRET_KEY }}
|
- if: '$CI_COMMIT_BRANCH == "contour" && $CI_PIPELINE_SOURCE == "push"'
|
||||||
VAULT_ADDR: ${{ secrets.VAULT_ADDR }}
|
|
||||||
VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
|
|
||||||
SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
|
|
||||||
KUBE_CONTEXT: ${{ secrets.KUBE_CONTEXT }}
|
|
||||||
KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
|
|
||||||
KUBECONFIG: /workspace/.kube/config
|
|
||||||
GIT_AUTH_TOKEN: ${{ github.token }}
|
|
||||||
steps:
|
|
||||||
- uses: actions/checkout@v4
|
|
||||||
- name: Prepare kubeconfig
|
|
||||||
run: |
|
|
||||||
if [ -n "${KUBECONFIG_B64:-}" ]; then
|
|
||||||
mkdir -p /workspace/.kube
|
|
||||||
echo "$KUBECONFIG_B64" | base64 -d > /workspace/.kube/config
|
|
||||||
chmod 600 /workspace/.kube/config
|
|
||||||
fi
|
|
||||||
- name: Run apply for all stacks
|
|
||||||
run: |
|
|
||||||
. ./scripts/load_admin_creds.sh
|
|
||||||
./scripts/run_all_stacks.sh apply
|
|
||||||
Loading…
Reference in New Issue
Block a user