cilium-kubernetes/.gitea/workflows/deploy.yml

name: Validate and deploy Cilium

on:
  push:
    paths:
      - values.yaml
      - hubble-pki.yaml
      - cilium-alerts.yaml
      - install.sh
      - render.sh
      - test.sh
      - ci-deployer.yaml
      - create-ci-kubeconfig.sh
      - .gitea/workflows/deploy.yml
  pull_request:
    paths:
      - values.yaml
      - hubble-pki.yaml
      - cilium-alerts.yaml
      - install.sh
      - render.sh
      - test.sh
      - ci-deployer.yaml
      - create-ci-kubeconfig.sh
      - .gitea/workflows/deploy.yml

env:
  CILIUM_VERSION: 1.20.0
  CILIUM_CHART_SHA256: c5f013912360d1a334f44ef25f36da59ba3414cdb48f466ee12d0c4fdff27883
  HELM_VERSION: v4.2.2
  HELM_SHA256: 9adafecab4d406853bba163a70e9f104f47dbbf65ce24b7653bae7e36150bcb6
  KUBECTL_VERSION: v1.36.3
  KUBERNETES_API: https://host.containers.internal:6443
  KUBERNETES_TLS_SERVER_NAME: 192.168.0.2
  NAMESPACE: kube-system

jobs:
  validate:
    name: Render and validate
    runs-on: ubuntu-latest
    steps:
      - name: Check out source
        uses: actions/checkout@v4
      - name: Install pinned Helm
        run: |
          curl --fail --silent --show-error --location --output "${RUNNER_TEMP}/helm.tar.gz" \
            "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz"
          printf '%s  %s\n' "${HELM_SHA256}" "${RUNNER_TEMP}/helm.tar.gz" | sha256sum --check
          tar --extract --gzip --file "${RUNNER_TEMP}/helm.tar.gz" \
            --directory "${RUNNER_TEMP}" --strip-components=1 linux-amd64/helm
          chmod 0700 "${RUNNER_TEMP}/helm"
          echo "${RUNNER_TEMP}" >> "${GITHUB_PATH}"
      - name: Validate scripts and Kubernetes resources
        run: bash test.sh

  deploy:
    name: Deploy to Kubernetes
    if: gitea.ref == 'refs/heads/main'
    needs: validate
    runs-on: ubuntu-latest
    steps:
      - name: Check out source
        uses: actions/checkout@v4
      - name: Install pinned clients
        run: |
          curl --fail --silent --show-error --location --output "${RUNNER_TEMP}/helm.tar.gz" \
            "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz"
          printf '%s  %s\n' "${HELM_SHA256}" "${RUNNER_TEMP}/helm.tar.gz" | sha256sum --check
          tar --extract --gzip --file "${RUNNER_TEMP}/helm.tar.gz" \
            --directory "${RUNNER_TEMP}" --strip-components=1 linux-amd64/helm
          chmod 0700 "${RUNNER_TEMP}/helm"
          curl --fail --silent --show-error --location --output "${RUNNER_TEMP}/kubectl" \
            "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
          curl --fail --silent --show-error --location --output "${RUNNER_TEMP}/kubectl.sha256" \
            "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256"
          printf '%s  %s\n' "$(cat "${RUNNER_TEMP}/kubectl.sha256")" "${RUNNER_TEMP}/kubectl" | sha256sum --check
          chmod 0700 "${RUNNER_TEMP}/kubectl"
          echo "${RUNNER_TEMP}" >> "${GITHUB_PATH}"
      - name: Configure Kubernetes access
        env:
          KUBE_CONFIG_BASE64: ${{ secrets.KUBE_CONFIG_BASE64 }}
        run: |
          test -n "${KUBE_CONFIG_BASE64}"
          printf '%s' "${KUBE_CONFIG_BASE64}" | base64 --decode > "${RUNNER_TEMP}/kubeconfig"
          chmod 0600 "${RUNNER_TEMP}/kubeconfig"
          export KUBECONFIG="${RUNNER_TEMP}/kubeconfig"
          "${RUNNER_TEMP}/kubectl" config set-cluster cluster \
            --server="${KUBERNETES_API}" --tls-server-name="${KUBERNETES_TLS_SERVER_NAME}"
      - name: Render desired state
        run: ./render.sh "${RUNNER_TEMP}/cilium.yaml"
      - name: Validate desired state on the server
        run: |
          export KUBECONFIG="${RUNNER_TEMP}/kubeconfig"
          "${RUNNER_TEMP}/kubectl" apply --dry-run=server --validate=false \
            --filename hubble-pki.yaml --filename "${RUNNER_TEMP}/cilium.yaml" \
            --filename cilium-alerts.yaml
      - name: Apply and verify
        run: |
          export KUBECONFIG="${RUNNER_TEMP}/kubeconfig"
          "${RUNNER_TEMP}/kubectl" apply --validate=false --filename hubble-pki.yaml
          "${RUNNER_TEMP}/kubectl" apply --validate=false --filename "${RUNNER_TEMP}/cilium.yaml"
          "${RUNNER_TEMP}/kubectl" apply --validate=false --filename cilium-alerts.yaml

          for certificate in hubble-ca hubble-server-certs hubble-relay-client-certs; do
            for attempt in {1..60}; do
              ready=$("${RUNNER_TEMP}/kubectl" --namespace "${NAMESPACE}" get "certificate/${certificate}" \
                --output=jsonpath='{.status.conditions[?(@.type=="Ready")].status}')
              echo "Certificate ${certificate} ${attempt}/60: Ready=${ready:-unknown}"
              if [[ "${ready}" == "True" ]]; then break; fi
              if [[ "${attempt}" == 60 ]]; then
                echo "Certificate ${certificate} did not become ready" >&2
                exit 1
              fi
              sleep 5
            done
          done

          "${RUNNER_TEMP}/kubectl" --namespace "${NAMESPACE}" rollout restart daemonset/cilium
          "${RUNNER_TEMP}/kubectl" --namespace "${NAMESPACE}" rollout restart deployment/hubble-relay

          wait_for_daemonset() {
            local name=$1
            for attempt in {1..120}; do
              IFS='|' read -r generation observed desired updated ready available unavailable <<< "$(
                "${RUNNER_TEMP}/kubectl" --namespace "${NAMESPACE}" get "daemonset/${name}" \
                  --output=jsonpath='{.metadata.generation}|{.status.observedGeneration}|{.status.desiredNumberScheduled}|{.status.updatedNumberScheduled}|{.status.numberReady}|{.status.numberAvailable}|{.status.numberUnavailable}'
              )"
              echo "DaemonSet ${name} ${attempt}/120: ${updated}/${desired} updated, ${ready}/${desired} ready"
              if [[ "${observed}" == "${generation}" && "${updated}" == "${desired}" \
                    && "${ready}" == "${desired}" && "${available}" == "${desired}" \
                    && ( -z "${unavailable}" || "${unavailable}" == "0" ) ]]; then return; fi
              sleep 5
            done
            echo "DaemonSet ${name} did not roll out within ten minutes" >&2
            exit 1
          }

          wait_for_deployment() {
            local name=$1
            for attempt in {1..120}; do
              IFS='|' read -r generation observed desired updated ready available unavailable <<< "$(
                "${RUNNER_TEMP}/kubectl" --namespace "${NAMESPACE}" get "deployment/${name}" \
                  --output=jsonpath='{.metadata.generation}|{.status.observedGeneration}|{.spec.replicas}|{.status.updatedReplicas}|{.status.readyReplicas}|{.status.availableReplicas}|{.status.unavailableReplicas}'
              )"
              echo "Deployment ${name} ${attempt}/120: ${updated}/${desired} updated, ${ready}/${desired} ready"
              if [[ "${observed}" == "${generation}" && "${updated}" == "${desired}" \
                    && "${ready}" == "${desired}" && "${available}" == "${desired}" \
                    && ( -z "${unavailable}" || "${unavailable}" == "0" ) ]]; then return; fi
              sleep 5
            done
            echo "Deployment ${name} did not roll out within ten minutes" >&2
            exit 1
          }

          wait_for_daemonset cilium
          wait_for_daemonset cilium-envoy
          wait_for_deployment cilium-operator
          wait_for_deployment hubble-relay
          wait_for_deployment hubble-ui
          echo "Cilium and Hubble successfully rolled out"