Deploy Postgres database to K8s via IaC #12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Terraform Plan | |
| on: | |
| pull_request: | |
| branches: | |
| - 'main' | |
| permissions: | |
| id-token: write | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| plan: | |
| name: Plan | |
| runs-on: ubuntu-latest | |
| environment: prod | |
| defaults: | |
| run: | |
| shell: bash | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # Setup Terraform | |
| - uses: hashicorp/setup-terraform@v3 | |
| with: | |
| terraform_version: "v1.12.2" | |
| # Configure aws creds | |
| - uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| aws-region: us-west-1 | |
| role-to-assume: arn:aws:iam::691595548805:role/github_actions_full_admin | |
| - name: Terraform init | |
| id: init | |
| run: | | |
| terraform -chdir=environments/prod/infra init # Kubeconfig is fetched out of infra state; needs initializing | |
| terraform -chdir=environments/prod/k8s init | |
| - name: Terraform Format Check | |
| run: | | |
| terraform -chdir=environments/prod/infra fmt -check | |
| terraform -chdir=environments/prod/k8s fmt -check | |
| - name: Terraform Validate | |
| run: | | |
| terraform -chdir=environments/prod/infra validate | |
| terraform -chdir=environments/prod/k8s validate | |
| - name: Terraform Plan (infra) | |
| id: infra_plan | |
| run: terraform -chdir=environments/prod/infra plan -no-color | |
| env: | |
| DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }} | |
| - name: Terraform Plan (k8s) | |
| continue-on-error: true | |
| id: k8s_plan | |
| env: | |
| DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }} | |
| TF_VAR_cloudflare_api_token: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| TF_VAR_email: ${{ secrets.EMAIL }} | |
| TF_VAR_domain: ${{ secrets.DOMAIN }} | |
| TF_VAR_github_email: ${{ secrets.EMAIL }} | |
| TF_VAR_github_pat: ${{ secrets.GH_PAT }} | |
| TF_VAR_postgres_admin_password: ${{ secrets.POSTGRES_ADMIN_PASSWORD }} | |
| TF_VAR_postgres_replication_password: ${{ secrets.POSTGRES_REPLICATION_PASSWORD }} | |
| TF_VAR_hydra_database_password: ${{ secrets.HYDRA_DATABASE_PASSWORD }} | |
| run: | | |
| kubeconfig_path="/tmp/kubeconfig" | |
| # Terraform kubernetes modules support KUBECONFIG env var - read | |
| # kubeconfig from tf state & specify its location | |
| terraform -chdir=environments/prod/infra output -raw kubeconfig > "$kubeconfig_path" | |
| if terraform -chdir=environments/prod/infra output -raw kubeconfig > "$kubeconfig_path" 2>&1; then | |
| echo "Infra state contains kubeconfig" | |
| export KUBECONFIG="$kubeconfig_path" | |
| terraform -chdir=environments/prod/infra plan -no-color | |
| else | |
| terraform -chdir=environments/prod/infra plan -no-color | |
| fi | |
| - name: Comment Plan on PR | |
| uses: marocchino/sticky-pull-request-comment@v2 | |
| with: | |
| message: | | |
| ### Terraform Plan Result | |
| ``` | |
| ## Infra | |
| ${{ steps.infra_plan.outputs.stdout }} | |
| ## K8s | |
| ${{ steps.k8s_plan.outputs.stdout }} | |
| ``` |