54 lines
2.5 KiB
YAML
54 lines
2.5 KiB
YAML
name: Validate and deploy cert-manager configuration
|
|
on: [push, pull_request]
|
|
env:
|
|
KUBECTL_VERSION: v1.36.3
|
|
KUBERNETES_API: https://host.containers.internal:6443
|
|
KUBERNETES_TLS_SERVER_NAME: 192.168.0.2
|
|
jobs:
|
|
validate:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- run: bash test.sh
|
|
deploy:
|
|
if: gitea.ref == 'refs/heads/main'
|
|
needs: validate
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install kubectl
|
|
run: |
|
|
curl -fsSL -o "${RUNNER_TEMP}/kubectl" "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
|
|
curl -fsSL -o "${RUNNER_TEMP}/kubectl.sha256" "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256"
|
|
printf '%s %s\n' "$(cat "${RUNNER_TEMP}/kubectl.sha256")" "${RUNNER_TEMP}/kubectl" | sha256sum -c
|
|
chmod 0700 "${RUNNER_TEMP}/kubectl"
|
|
- name: Configure Kubernetes access
|
|
env:
|
|
KUBE_CONFIG_BASE64: ${{ secrets.KUBE_CONFIG_BASE64 }}
|
|
run: |
|
|
test -n "${KUBE_CONFIG_BASE64}"
|
|
printf '%s' "${KUBE_CONFIG_BASE64}" | base64 -d > "${RUNNER_TEMP}/kubeconfig"
|
|
chmod 0600 "${RUNNER_TEMP}/kubeconfig"
|
|
export KUBECONFIG="${RUNNER_TEMP}/kubeconfig"
|
|
"${RUNNER_TEMP}/kubectl" config set-cluster cluster --server="${KUBERNETES_API}" --tls-server-name="${KUBERNETES_TLS_SERVER_NAME}"
|
|
- name: Apply and verify
|
|
run: |
|
|
export KUBECONFIG="${RUNNER_TEMP}/kubeconfig"
|
|
for file in cloudflare.yaml http-issuer.yaml certificates.yaml; do
|
|
"${RUNNER_TEMP}/kubectl" apply --server-side --force-conflicts --dry-run=server -f "$file"
|
|
done
|
|
for file in cloudflare.yaml http-issuer.yaml certificates.yaml; do
|
|
"${RUNNER_TEMP}/kubectl" apply --server-side --force-conflicts -f "$file"
|
|
done
|
|
for issuer in letsencrypt-dns letsencrypt-http; do
|
|
for attempt in {1..60}; do
|
|
ready=$("${RUNNER_TEMP}/kubectl" get clusterissuer "$issuer" -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}')
|
|
[[ "$ready" == True ]] && break
|
|
[[ "$attempt" != 60 ]] || exit 1
|
|
sleep 5
|
|
done
|
|
done
|
|
for certificate in brunner-ninja watschn-studio brgkepler-com gschissenes-equipment; do
|
|
test "$("${RUNNER_TEMP}/kubectl" -n default get certificate "$certificate" -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}')" = True
|
|
done
|