110 lines
4.8 KiB
YAML
110 lines
4.8 KiB
YAML
name: Validate and deploy MetalLB configuration
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
env:
|
|
KUBECONFORM_VERSION: v0.7.0
|
|
KUBECTL_VERSION: v1.36.3
|
|
METALLB_VERSION: v0.16.0
|
|
METALLB_MANIFEST_SHA256: b0b9be2802f10aa32d45308b4457d06cde0c70544712c8d0cf5511657ffd2b69
|
|
KUBERNETES_API: https://host.containers.internal:6443
|
|
KUBERNETES_TLS_SERVER_NAME: 192.168.0.2
|
|
NAMESPACE: metallb-system
|
|
|
|
jobs:
|
|
validate:
|
|
name: Validate manifests
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check out source
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Validate scripts and local resources
|
|
run: bash test.sh
|
|
|
|
- name: Verify the pinned upstream manifest
|
|
run: |
|
|
curl --fail --silent --show-error --location \
|
|
--output "${RUNNER_TEMP}/metallb-native.yaml" \
|
|
"https://raw.githubusercontent.com/metallb/metallb/${METALLB_VERSION}/config/manifests/metallb-native.yaml"
|
|
printf '%s %s\n' "${METALLB_MANIFEST_SHA256}" "${RUNNER_TEMP}/metallb-native.yaml" | sha256sum --check
|
|
docker run --rm --interactive \
|
|
"ghcr.io/yannh/kubeconform:${KUBECONFORM_VERSION}@sha256:85dbef6b4b312b99133decc9c6fc9495e9fc5f92293d4ff3b7e1b30f5611823c" \
|
|
-strict -ignore-missing-schemas -summary < "${RUNNER_TEMP}/metallb-native.yaml"
|
|
|
|
deploy:
|
|
name: Deploy site configuration
|
|
if: gitea.ref == 'refs/heads/main'
|
|
needs: validate
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check out source
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install kubectl
|
|
run: |
|
|
curl --fail --silent --show-error --location \
|
|
--output "${RUNNER_TEMP}/kubectl" \
|
|
"https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
|
|
curl --fail --silent --show-error --location \
|
|
--output "${RUNNER_TEMP}/kubectl.sha256" \
|
|
"https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256"
|
|
printf '%s %s\n' "$(cat "${RUNNER_TEMP}/kubectl.sha256")" "${RUNNER_TEMP}/kubectl" | sha256sum --check
|
|
chmod 0700 "${RUNNER_TEMP}/kubectl"
|
|
|
|
- name: Configure Kubernetes access
|
|
env:
|
|
KUBE_CONFIG_BASE64: ${{ secrets.KUBE_CONFIG_BASE64 }}
|
|
run: |
|
|
test -n "${KUBE_CONFIG_BASE64}"
|
|
printf '%s' "${KUBE_CONFIG_BASE64}" | base64 --decode > "${RUNNER_TEMP}/kubeconfig"
|
|
chmod 0600 "${RUNNER_TEMP}/kubeconfig"
|
|
export KUBECONFIG="${RUNNER_TEMP}/kubeconfig"
|
|
"${RUNNER_TEMP}/kubectl" config set-cluster cluster \
|
|
--server="${KUBERNETES_API}" \
|
|
--tls-server-name="${KUBERNETES_TLS_SERVER_NAME}"
|
|
|
|
- name: Apply and verify
|
|
run: |
|
|
export KUBECONFIG="${RUNNER_TEMP}/kubeconfig"
|
|
"${RUNNER_TEMP}/kubectl" apply \
|
|
--dry-run=server \
|
|
--validate=false \
|
|
--filename metallb.yaml
|
|
"${RUNNER_TEMP}/kubectl" apply \
|
|
--validate=false \
|
|
--filename metallb.yaml
|
|
|
|
for attempt in {1..60}; do
|
|
IFS='|' read -r c_generation c_observed c_desired c_updated c_ready c_available c_unavailable <<< "$(
|
|
"${RUNNER_TEMP}/kubectl" --namespace "${NAMESPACE}" get deployment/controller \
|
|
--output=jsonpath='{.metadata.generation}|{.status.observedGeneration}|{.spec.replicas}|{.status.updatedReplicas}|{.status.readyReplicas}|{.status.availableReplicas}|{.status.unavailableReplicas}'
|
|
)"
|
|
IFS='|' read -r s_generation s_observed s_desired s_updated s_ready s_available s_unavailable <<< "$(
|
|
"${RUNNER_TEMP}/kubectl" --namespace "${NAMESPACE}" get daemonset/speaker \
|
|
--output=jsonpath='{.metadata.generation}|{.status.observedGeneration}|{.status.desiredNumberScheduled}|{.status.updatedNumberScheduled}|{.status.numberReady}|{.status.numberAvailable}|{.status.numberUnavailable}'
|
|
)"
|
|
|
|
echo "Check ${attempt}/60: controller ${c_ready}/${c_desired} ready; speaker ${s_ready}/${s_desired} ready"
|
|
if [[ "${c_observed}" == "${c_generation}" \
|
|
&& "${c_updated}" == "${c_desired}" \
|
|
&& "${c_ready}" == "${c_desired}" \
|
|
&& "${c_available}" == "${c_desired}" \
|
|
&& ( -z "${c_unavailable}" || "${c_unavailable}" == "0" ) \
|
|
&& "${s_observed}" == "${s_generation}" \
|
|
&& "${s_updated}" == "${s_desired}" \
|
|
&& "${s_ready}" == "${s_desired}" \
|
|
&& "${s_available}" == "${s_desired}" \
|
|
&& ( -z "${s_unavailable}" || "${s_unavailable}" == "0" ) ]]; then
|
|
echo "MetalLB configuration is active and all components are ready"
|
|
exit 0
|
|
fi
|
|
|
|
sleep 5
|
|
done
|
|
|
|
echo "MetalLB did not become ready within five minutes" >&2
|
|
exit 1
|