121 lines
6.3 KiB
YAML
121 lines
6.3 KiB
YAML
name: Validate and deploy Elastic Stack
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
env:
|
|
KUBECONFORM_VERSION: v0.7.0
|
|
KUBECTL_VERSION: v1.36.3
|
|
KUBERNETES_API: https://host.containers.internal:6443
|
|
KUBERNETES_TLS_SERVER_NAME: 192.168.0.2
|
|
NAMESPACE: elastic
|
|
|
|
jobs:
|
|
validate:
|
|
name: Validate manifests
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check out source
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Validate scripts and Kubernetes resources
|
|
run: |
|
|
bash -n install.sh install-traefik-assets.sh check.sh configure-router.sh uninstall.sh create-ci-kubeconfig.sh
|
|
jq --exit-status . traefik-access-ilm.json traefik-access-pipeline.json traefik-access-component-template.json traefik-traffic-dashboard.json >/dev/null
|
|
docker run --rm --interactive \
|
|
"ghcr.io/yannh/kubeconform:${KUBECONFORM_VERSION}@sha256:85dbef6b4b312b99133decc9c6fc9495e9fc5f92293d4ff3b7e1b30f5611823c" \
|
|
-strict -summary -ignore-missing-schemas < stack.yaml
|
|
docker run --rm --interactive \
|
|
"ghcr.io/yannh/kubeconform:${KUBECONFORM_VERSION}@sha256:85dbef6b4b312b99133decc9c6fc9495e9fc5f92293d4ff3b7e1b30f5611823c" \
|
|
-strict -summary -ignore-missing-schemas < netflow.yaml
|
|
docker run --rm --interactive \
|
|
"ghcr.io/yannh/kubeconform:${KUBECONFORM_VERSION}@sha256:85dbef6b4b312b99133decc9c6fc9495e9fc5f92293d4ff3b7e1b30f5611823c" \
|
|
-strict -summary -ignore-missing-schemas < ingress.yaml
|
|
docker run --rm --interactive \
|
|
"ghcr.io/yannh/kubeconform:${KUBECONFORM_VERSION}@sha256:85dbef6b4b312b99133decc9c6fc9495e9fc5f92293d4ff3b7e1b30f5611823c" \
|
|
-strict -summary -ignore-missing-schemas < traefik-access.yaml
|
|
docker run --rm --interactive \
|
|
"ghcr.io/yannh/kubeconform:${KUBECONFORM_VERSION}@sha256:85dbef6b4b312b99133decc9c6fc9495e9fc5f92293d4ff3b7e1b30f5611823c" \
|
|
-strict -summary < ci-deployer.yaml
|
|
|
|
deploy:
|
|
name: Deploy to Kubernetes
|
|
if: gitea.ref == 'refs/heads/main'
|
|
needs: validate
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check out source
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install kubectl
|
|
run: |
|
|
curl --fail --silent --show-error --location \
|
|
--output "${RUNNER_TEMP}/kubectl" \
|
|
"https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
|
|
curl --fail --silent --show-error --location \
|
|
--output "${RUNNER_TEMP}/kubectl.sha256" \
|
|
"https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256"
|
|
printf '%s %s\n' "$(cat "${RUNNER_TEMP}/kubectl.sha256")" "${RUNNER_TEMP}/kubectl" | sha256sum --check
|
|
chmod 0700 "${RUNNER_TEMP}/kubectl"
|
|
|
|
- name: Configure Kubernetes access
|
|
env:
|
|
KUBE_CONFIG_BASE64: ${{ secrets.KUBE_CONFIG_BASE64 }}
|
|
run: |
|
|
test -n "${KUBE_CONFIG_BASE64}"
|
|
printf '%s' "${KUBE_CONFIG_BASE64}" | base64 --decode > "${RUNNER_TEMP}/kubeconfig"
|
|
chmod 0600 "${RUNNER_TEMP}/kubeconfig"
|
|
export KUBECONFIG="${RUNNER_TEMP}/kubeconfig"
|
|
"${RUNNER_TEMP}/kubectl" config set-cluster cluster \
|
|
--server="${KUBERNETES_API}" \
|
|
--tls-server-name="${KUBERNETES_TLS_SERVER_NAME}"
|
|
|
|
- name: Apply and verify
|
|
run: |
|
|
export KUBECONFIG="${RUNNER_TEMP}/kubeconfig"
|
|
"${RUNNER_TEMP}/kubectl" apply --dry-run=server --validate=false \
|
|
--filename stack.yaml \
|
|
--filename netflow.yaml \
|
|
--filename ingress.yaml \
|
|
--filename traefik-access.yaml
|
|
"${RUNNER_TEMP}/kubectl" apply --validate=false \
|
|
--filename stack.yaml \
|
|
--filename netflow.yaml \
|
|
--filename ingress.yaml \
|
|
--filename traefik-access.yaml
|
|
|
|
for attempt in {1..240}; do
|
|
es_health=$("${RUNNER_TEMP}/kubectl" --namespace "${NAMESPACE}" get elasticsearch/elasticsearch --output=jsonpath='{.status.health}')
|
|
es_nodes=$("${RUNNER_TEMP}/kubectl" --namespace "${NAMESPACE}" get elasticsearch/elasticsearch --output=jsonpath='{.status.availableNodes}')
|
|
kb_health=$("${RUNNER_TEMP}/kubectl" --namespace "${NAMESPACE}" get kibana/kibana --output=jsonpath='{.status.health}')
|
|
kb_nodes=$("${RUNNER_TEMP}/kubectl" --namespace "${NAMESPACE}" get kibana/kibana --output=jsonpath='{.status.availableNodes}')
|
|
beat_health=$("${RUNNER_TEMP}/kubectl" --namespace "${NAMESPACE}" get beat/netflow --output=jsonpath='{.status.health}')
|
|
beat_nodes=$("${RUNNER_TEMP}/kubectl" --namespace "${NAMESPACE}" get beat/netflow --output=jsonpath='{.status.availableNodes}')
|
|
agent_health=$("${RUNNER_TEMP}/kubectl" --namespace "${NAMESPACE}" get agent/traefik-access --output=jsonpath='{.status.health}')
|
|
agent_nodes=$("${RUNNER_TEMP}/kubectl" --namespace "${NAMESPACE}" get agent/traefik-access --output=jsonpath='{.status.availableNodes}')
|
|
agent_expected=$("${RUNNER_TEMP}/kubectl" --namespace "${NAMESPACE}" get agent/traefik-access --output=jsonpath='{.status.expectedNodes}')
|
|
load_balancer_ip=$("${RUNNER_TEMP}/kubectl" --namespace "${NAMESPACE}" get service/netflow --output=jsonpath='{.status.loadBalancer.ingress[0].ip}')
|
|
|
|
echo "Check ${attempt}/240: Elasticsearch ${es_health:-unknown} (${es_nodes:-0}/3), Kibana ${kb_health:-unknown} (${kb_nodes:-0}/2), Filebeat ${beat_health:-unknown} (${beat_nodes:-0}/1), Agent ${agent_health:-unknown} (${agent_nodes:-0}/${agent_expected:-0}), LB=${load_balancer_ip:-pending}"
|
|
if [[ "${es_health}" == "green" \
|
|
&& "${es_nodes}" == "3" \
|
|
&& "${kb_health}" == "green" \
|
|
&& "${kb_nodes}" == "2" \
|
|
&& "${beat_health}" == "green" \
|
|
&& "${beat_nodes}" == "1" \
|
|
&& "${agent_health}" == "green" \
|
|
&& -n "${agent_expected}" \
|
|
&& "${agent_expected}" != "0" \
|
|
&& "${agent_nodes}" == "${agent_expected}" \
|
|
&& "${load_balancer_ip}" == "192.168.0.20" ]]; then
|
|
echo "Elastic Stack successfully rolled out"
|
|
exit 0
|
|
fi
|
|
|
|
sleep 5
|
|
done
|
|
|
|
echo "Elastic Stack did not become ready within twenty minutes" >&2
|
|
exit 1
|