mirror of
https://gitlab.sarex.io/infra/terraform-contour-mirror.git
synced 2026-08-05 18:31:00 +03:00
++ add wf dispatch trigger
This commit is contained in:
gitlab-pusher
parent
7142806524
commit
ae63a51323
200
.gitlab-ci.yml
200
.gitlab-ci.yml
@ -1,81 +1,133 @@
|
|||||||
stages:
|
name: Terraform Terragrunt (contour)
|
||||||
- generate
|
|
||||||
- trigger
|
|
||||||
- deploy
|
|
||||||
|
|
||||||
|
# One workflow for ALL closed contours. Per-contour differentiation is done via
|
||||||
|
# repository variables/secrets in each contour's Gitea — this is the downstream
|
||||||
|
# runner contract:
|
||||||
|
# vars: INFRA_ENV, RUNNER_LABEL, RUNNER_IMAGE
|
||||||
|
# secrets: TF_STATE_S3_ENDPOINT, TF_STATE_S3_BUCKET, S3_ACCESS_KEY, S3_SECRET_KEY,
|
||||||
|
# VAULT_ADDR, VAULT_TOKEN, SOPS_AGE_KEY, KUBECONFIG_B64 (external runner
|
||||||
|
# only), KUBE_CONTEXT (external runner only)
|
||||||
|
# Infra-service admin creds are NOT passed as secrets — they are read from Vault
|
||||||
|
# at run time (see the "Run ... stacks" step) so the single source of truth stays
|
||||||
|
# in the contour Vault.
|
||||||
|
|
||||||
|
on:
|
||||||
generate-pipeline:
|
workflow_dispatch:
|
||||||
stage: generate
|
pull_request:
|
||||||
image: alpine:latest
|
branches: [contour]
|
||||||
before_script:
|
|
||||||
- apk add --no-cache bash findutils
|
|
||||||
script:
|
|
||||||
- echo "=== DEBUG INFO ==="
|
|
||||||
- echo "CI_PIPELINE_SOURCE=$CI_PIPELINE_SOURCE"
|
|
||||||
- echo "CI_COMMIT_BRANCH=$CI_COMMIT_BRANCH"
|
|
||||||
- echo "CI_MERGE_REQUEST_SOURCE_BRANCH_NAME=$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME"
|
|
||||||
- pwd && ls -la
|
|
||||||
- echo "=== Finding terragrunt files ==="
|
|
||||||
- find live -name "terragrunt.hcl" -not -path "*/.terragrunt-cache/*" | head -20 || echo "No files found"
|
|
||||||
- echo "=== Generating pipeline ==="
|
|
||||||
- chmod +x ./scripts/generate-pipeline.sh
|
|
||||||
- ./scripts/generate-pipeline.sh
|
|
||||||
- echo "=== Generated pipeline content ==="
|
|
||||||
- cat .gitlab-ci.generated.yml
|
|
||||||
artifacts:
|
|
||||||
paths:
|
paths:
|
||||||
- .gitlab-ci.generated.yml
|
- "live/**"
|
||||||
expire_in: 1 hour
|
- "modules/**"
|
||||||
rules:
|
- "infrastructure.yaml"
|
||||||
- if: '$CI_PIPELINE_SOURCE == "pipeline"'
|
- "infrastructure-secrets.yaml"
|
||||||
- if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
|
- "scripts/**"
|
||||||
- if: '$CI_COMMIT_BRANCH == "stage"'
|
- ".gitea/workflows/**"
|
||||||
- if: '$CI_COMMIT_BRANCH == "master"'
|
push:
|
||||||
- if: '$CI_COMMIT_BRANCH =~ /^feature\/.*/'
|
branches: [contour]
|
||||||
|
paths:
|
||||||
|
- "live/**"
|
||||||
|
- "modules/**"
|
||||||
|
- "infrastructure.yaml"
|
||||||
|
- "infrastructure-secrets.yaml"
|
||||||
|
- "scripts/**"
|
||||||
|
- ".gitea/workflows/**"
|
||||||
|
|
||||||
|
env:
|
||||||
|
TF_STATE_S3_REGION: ru-central1
|
||||||
|
INFRA_ENV: ${{ vars.INFRA_ENV }}
|
||||||
|
|
||||||
# Prod environment
|
jobs:
|
||||||
trigger-downstream-prod:
|
validate:
|
||||||
stage: trigger
|
runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
|
||||||
needs:
|
container:
|
||||||
- generate-pipeline
|
image: ${{ vars.RUNNER_IMAGE || 'cr.yandex/crp3ccidau046kdj8g9q/terraform/terragrunt:v9.11' }}
|
||||||
trigger:
|
env:
|
||||||
include:
|
TF_STATE_S3_ENDPOINT: ${{ secrets.TF_STATE_S3_ENDPOINT }}
|
||||||
- artifact: .gitlab-ci.generated.yml
|
TF_STATE_S3_BUCKET: ${{ secrets.TF_STATE_S3_BUCKET }}
|
||||||
job: generate-pipeline
|
S3_ACCESS_KEY: ${{ secrets.S3_ACCESS_KEY }}
|
||||||
strategy: depend
|
S3_SECRET_KEY: ${{ secrets.S3_SECRET_KEY }}
|
||||||
forward:
|
VAULT_ADDR: ${{ secrets.VAULT_ADDR }}
|
||||||
pipeline_variables: true
|
VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
|
||||||
yaml_variables: true
|
SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
|
||||||
variables:
|
KUBE_CONTEXT: ${{ secrets.KUBE_CONTEXT }}
|
||||||
TERRAFORM_IMAGE_NAME: cr.yandex/crp3ccidau046kdj8g9q/terraform/terragrunt:v9.11
|
KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
|
||||||
YC_SERVICE_ACCOUNT_KEY_FILE: ${YC_PROD_SERVICE_ACCOUNT_KEY_FILE}
|
KUBECONFIG: /workspace/.kube/config
|
||||||
YC_CLOUD_ID: ${YC_CLOUD_ID}
|
GIT_AUTH_TOKEN: ${{ github.token }}
|
||||||
YC_STAGE_FOLDER_ID: ${YC_STAGE_FOLDER_ID}
|
steps:
|
||||||
YC_PROD_FOLDER_ID: ${YC_PROD_FOLDER_ID}
|
- uses: actions/checkout@v4
|
||||||
YC_PREPROD_FOLDER_ID: ${YC_PREPROD_FOLDER_ID}
|
- name: Prepare kubeconfig
|
||||||
S3_ACCESS_KEY: ${S3_PROD_ACCESS_KEY}
|
run: |
|
||||||
S3_SECRET_KEY: ${S3_PROD_SECRET_KEY}
|
if [ -n "${KUBECONFIG_B64:-}" ]; then
|
||||||
S3_STATE_BUCKET: ${S3_PROD_STATE_BUCKET}
|
mkdir -p /workspace/.kube
|
||||||
AWS_ACCESS_KEY_ID: ${S3_PROD_ACCESS_KEY}
|
echo "$KUBECONFIG_B64" | base64 -d > /workspace/.kube/config
|
||||||
AWS_SECRET_ACCESS_KEY: ${S3_PROD_SECRET_KEY}
|
chmod 600 /workspace/.kube/config
|
||||||
TARGET_ENV: "prod"
|
else
|
||||||
rules:
|
echo "No KUBECONFIG_B64 — in-cluster runner: kubernetes/vault providers use the pod ServiceAccount kubeconfig or in-cluster config."
|
||||||
- if: '$CI_PIPELINE_SOURCE == "pipeline"'
|
fi
|
||||||
- if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
|
- name: Run validate for all stacks
|
||||||
- if: '$CI_COMMIT_BRANCH == "master"'
|
run: |
|
||||||
- if: '$CI_COMMIT_BRANCH =~ /^feature\/.*/'
|
. ./scripts/load_admin_creds.sh
|
||||||
|
./scripts/run_all_stacks.sh validate
|
||||||
|
|
||||||
|
plan:
|
||||||
|
needs: [validate]
|
||||||
|
runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
|
||||||
|
container:
|
||||||
|
image: ${{ vars.RUNNER_IMAGE || 'cr.yandex/crp3ccidau046kdj8g9q/terraform/terragrunt:v9.11' }}
|
||||||
|
env:
|
||||||
|
TF_STATE_S3_ENDPOINT: ${{ secrets.TF_STATE_S3_ENDPOINT }}
|
||||||
|
TF_STATE_S3_BUCKET: ${{ secrets.TF_STATE_S3_BUCKET }}
|
||||||
|
S3_ACCESS_KEY: ${{ secrets.S3_ACCESS_KEY }}
|
||||||
|
S3_SECRET_KEY: ${{ secrets.S3_SECRET_KEY }}
|
||||||
|
VAULT_ADDR: ${{ secrets.VAULT_ADDR }}
|
||||||
|
VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
|
||||||
|
SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
|
||||||
|
KUBE_CONTEXT: ${{ secrets.KUBE_CONTEXT }}
|
||||||
|
KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
|
||||||
|
KUBECONFIG: /workspace/.kube/config
|
||||||
|
GIT_AUTH_TOKEN: ${{ github.token }}
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v4
|
||||||
|
- name: Prepare kubeconfig
|
||||||
|
run: |
|
||||||
|
if [ -n "${KUBECONFIG_B64:-}" ]; then
|
||||||
|
mkdir -p /workspace/.kube
|
||||||
|
echo "$KUBECONFIG_B64" | base64 -d > /workspace/.kube/config
|
||||||
|
chmod 600 /workspace/.kube/config
|
||||||
|
fi
|
||||||
|
- name: Run plan for all stacks
|
||||||
|
run: |
|
||||||
|
. ./scripts/load_admin_creds.sh
|
||||||
|
./scripts/run_all_stacks.sh plan
|
||||||
|
|
||||||
mirror-contour:
|
apply:
|
||||||
stage: deploy
|
needs: [plan]
|
||||||
image: alpine:3.21
|
if: github.event_name == 'push'
|
||||||
variables:
|
runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
|
||||||
GIT_DEPTH: "0"
|
container:
|
||||||
before_script:
|
image: ${{ vars.RUNNER_IMAGE || 'cr.yandex/crp3ccidau046kdj8g9q/terraform/terragrunt:v9.11' }}
|
||||||
- apk add --no-cache git ca-certificates
|
env:
|
||||||
script:
|
TF_STATE_S3_ENDPOINT: ${{ secrets.TF_STATE_S3_ENDPOINT }}
|
||||||
- git push --force "$CONTOUR_MIRROR_PUSH_URL" "$CI_COMMIT_SHA:refs/heads/contour"
|
TF_STATE_S3_BUCKET: ${{ secrets.TF_STATE_S3_BUCKET }}
|
||||||
rules:
|
S3_ACCESS_KEY: ${{ secrets.S3_ACCESS_KEY }}
|
||||||
- if: '$CI_COMMIT_BRANCH == "contour" && $CI_PIPELINE_SOURCE == "push"'
|
S3_SECRET_KEY: ${{ secrets.S3_SECRET_KEY }}
|
||||||
|
VAULT_ADDR: ${{ secrets.VAULT_ADDR }}
|
||||||
|
VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
|
||||||
|
SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
|
||||||
|
KUBE_CONTEXT: ${{ secrets.KUBE_CONTEXT }}
|
||||||
|
KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
|
||||||
|
KUBECONFIG: /workspace/.kube/config
|
||||||
|
GIT_AUTH_TOKEN: ${{ github.token }}
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v4
|
||||||
|
- name: Prepare kubeconfig
|
||||||
|
run: |
|
||||||
|
if [ -n "${KUBECONFIG_B64:-}" ]; then
|
||||||
|
mkdir -p /workspace/.kube
|
||||||
|
echo "$KUBECONFIG_B64" | base64 -d > /workspace/.kube/config
|
||||||
|
chmod 600 /workspace/.kube/config
|
||||||
|
fi
|
||||||
|
- name: Run apply for all stacks
|
||||||
|
run: |
|
||||||
|
. ./scripts/load_admin_creds.sh
|
||||||
|
./scripts/run_all_stacks.sh apply
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user