infra/.github/workflows/apply.yml at 14cb3fa7d7b532072dec9c7941a055fcb822e487 · m8rmclaren/infra · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
name: Terraform Apply
on:
  push:
    branches:
      - main

permissions:
  id-token: write
  contents: write

jobs:
  apply_infra:
    name: Apply Infra
    runs-on: ubuntu-latest
    environment: prod
    defaults:
     run:
       shell: bash
    steps:
      - uses: actions/checkout@v4

      # Setup Terraform
      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: "v1.12.2"

      # Configure aws creds
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: us-west-1
          role-to-assume: arn:aws:iam::691595548805:role/github_actions_full_admin

      - name: Terraform init
        id: init
        run: |
          terraform -chdir=environments/prod/infra init

      - name: Terraform Format Check
        run: |
          terraform -chdir=environments/prod/infra fmt -check

      - name: Terraform Validate
        run: |
          terraform -chdir=environments/prod/infra validate

      - name: Terraform Apply
        run: terraform -chdir=environments/prod/infra apply -auto-approve
        env:
          DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}

  apply_k8s:
    name: Apply K8s
    runs-on: ubuntu-latest
    needs:
      - apply_infra
    environment: prod
    defaults:
     run:
       shell: bash
    steps:
      - uses: actions/checkout@v4

      # Setup Terraform
      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: "v1.12.2"

      # Configure aws creds
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: us-west-1
          role-to-assume: arn:aws:iam::691595548805:role/github_actions_full_admin

      - name: Terraform init
        id: init
        run: |
          terraform -chdir=environments/prod/infra init # Kubeconfig is fetched out of infra state; needs initializing
          terraform -chdir=environments/prod/k8s init

      - name: Terraform Format Check
        run: |
          terraform -chdir=environments/prod/infra fmt -check
          terraform -chdir=environments/prod/k8s fmt -check

      - name: Terraform Validate
        run: |
          terraform -chdir=environments/prod/infra validate
          terraform -chdir=environments/prod/k8s validate

      - name: Terraform Apply
        env:
          DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
          TF_VAR_cloudflare_api_token: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          TF_VAR_email: ${{ secrets.EMAIL }}
          TF_VAR_domain: ${{ secrets.DOMAIN }}
          TF_VAR_github_email: ${{ secrets.EMAIL }}
          TF_VAR_github_pat: ${{ secrets.GH_PAT }}
          TF_VAR_postgres_admin_password: ${{ secrets.POSTGRES_ADMIN_PASSWORD }}
          TF_VAR_postgres_replication_password: ${{ secrets.POSTGRES_REPLICATION_PASSWORD }}
          TF_VAR_hydra_database_password: ${{ secrets.HYDRA_DATABASE_PASSWORD }}
          TF_VAR_hydra_system_secret: ${{ secrets.HYDRA_SYSTEM_SECRET }}
          TF_VAR_hydra_cookie_secret: ${{ secrets.HYDRA_COOKIE_SECRET }}
          TF_VAR_kratos_database_password: ${{ secrets.KRATOS_DATABASE_PASSWORD }}
          TF_VAR_apple_developer_team_id: ${{ APPLE_DEVELOPER_TEAM_ID }}
          TF_VAR_chat_siwa_primary_app_id: ${{ CHAT_PRIMARY_APP_ID }}
        run: |
          kubeconfig_path="/tmp/kubeconfig"

          BOLD="\033[1m"
          RESET="\033[0m"
          CYAN="\033[36m"
          ORANGE="\033[0;33m"
          RED="\033[31m"

          info_message () {
              local message="$1"
              local mtype="INFO"
              timestamp=$(date +"%Y-%m-%d %H:%M:%S")
              echo -e "${CYAN}${timestamp} [$mtype] ${RESET}$message"
          }

          info_message "Exporting kubeconfig to $kubeconfig_path"
          terraform -chdir=environments/prod/infra output -raw kubeconfig > "$kubeconfig_path"
          export KUBECONFIG="$kubeconfig_path"

          if terraform -chdir=environments/prod/k8s state list >/dev/null 2>&1; then
              info_message "Terraform state exists - determining if this is a fresh cluster"
              if [ "$(kubectl get ns -o json | jq '.items | length')" -eq 5 ]; then
                  info_message "Determined that this is a fresh cluster."
                  kubectl cluster-info

                  info_message "Tainting k8s Terraform module"
                  terraform -chdir=environments/prod/k8s state list | xargs -I{} sh -c 'terraform -chdir=environments/prod/k8s taint "{}" || echo "Skipping {}"'
              else
                  info_message "This is not a fresh cluster - there are already resources in it. Skipping resource taint"
              fi
          else
              info_message "Terraform state for K8s Terraform project is empty. Skipping to apply"
          fi

          info_message "Running Terraform Apply (k8s)"
          terraform -chdir=environments/prod/k8s apply -var="kubeconfig=$kubeconfig_path" -auto-approve