feat: convert amalthea cleanup script to go

cleanup-renku-ci-deployments/Dockerfile

@@ -1,4 +1,12 @@
-FROM alpine/k8s:1.21.2
-RUN apk add --no-cache jq
-COPY entrypoint.sh /
-ENTRYPOINT sh /entrypoint.sh
+FROM golang:1.24 AS build
+
+WORKDIR /go/src/app
+COPY go.mod go.sum ./
+RUN go mod download
+COPY *.go ./
+RUN go vet -v
+RUN CGO_ENABLED=0 go build -o /go/bin/app
+
+FROM gcr.io/distroless/static-debian12
+COPY --from=build /go/bin/app /
+ENTRYPOINT ["/app"]

cleanup-renku-ci-deployments/README.md

@@ -2,17 +2,4 @@
 
 This action cleans up old CI renku deployments.
 
-The action has the following regex hardcoded for finding the namespaces and helm releases in which it operates:
-`.+-ci-.+|^ci-.+`. This is to ensure that it does not affect other deployments that should be more permanent, such
-as the main dev deployment or developers' deployments.
-
-It uses the following parameters, passed in as environment variables:
-- `RENKUBOT_KUBECONFIG` (required) - the kubeconfig used to run the `helm` and `kubectl` commands
-- `GITLAB_TOKEN` (required) - the Gitlab token used to cleanup the client applications for the CI deployment
-- `KUBECONFIG` (optional, defaults to `/.kubeconfig`) - the location where kubeconfig file will be saved
-- `HELM_RELEASE_REGEX` (optional, defaults to `.*`) - additional regex to apply on top of the regex used to find CI deployments
-- `MAX_AGE_SECONDS` (optional, defaults to 604800 i.e. 1 week) - the age at or after which deployments are deleted, if set to zero (or negative) the deployment is immedidately deleted
-- `DELETE_NAMESPACE` (optional, defaults to true) - whether to delete the K8S namespace or not
-
-The intended use of this action is to be setup as a scheduled workflow in github
-that runs periodically and cleans up old CI renku deploments.
+To get help run `go run . --help`. Or you can build the image and run the image with `docker run -ti --rm <image> --help`.

cleanup-renku-ci-deployments/action.yml

@@ -1,8 +1,43 @@
-name: 'cleanup-renku-ci-deployments'
-description: 'Cleanup old Renku CI deployments'
+name: "cleanup-renku-ci-deployments"
+description: "Cleanup old Renku CI deployments. Things will be deleted if the regex matches namespace OR releases regex."
 runs:
-  using: 'docker'
-  image: 'Dockerfile'
+  using: "docker"
+  image: "Dockerfile"
+  args:
+    - rm
+    - "--kubeconfig=${{ inputs.kubeconfig }}"
+    - "--min-age=${{ inputs.minAge }}"
+    - "--release-regex=${{ inputs.releaseRegex }}"
+    - "--namespace-regex=${{ inputs.namespaceRegex }}"
+    - "--gitlab-token=${{ inputs.gitlabToken }}"
+    - "--gitlab-url=${{ inputs.gitlabUrl }}"
 branding:
-  icon: 'activity'
-  color: 'blue'
+  icon: "activity"
+  color: "blue"
+inputs:
+  kubeconfig:
+    description: "The path to the kubeconfig file to use."
+    required: false
+    default: "/kubeconfig"
+  minAge:
+    description: |
+      The minimum age of a helm release or namespace used to determine if it should be deleted. 
+      Parsed by golang time.ParseDuration(). Allowed units are h, m, s, ns, us, ms. Setting this
+      to zero will result in essentially no filtering by age being done.
+    required: false
+    default: "168h"
+  releaseRegex:
+    description: "The regex used to filter Helm releases, must parse to egrep (POSIX ERE) regex."
+    required: false
+    default: "^.+-ci-.+|^ci-.+"
+  namespaceRegex:
+    description: "The regex used to filter namespaces, must parse to egrep (POSIX ERE) regex."
+    required: false
+    default: "^.+-ci-.+|^ci-.+"
+  gitlabToken:
+    description: "The token to autheticate with Gitlab so that the OIDC applications can be deleted."
+    required: true
+  gitlabURL:
+    description: "The url for Gitlab."
+    required: false
+    default: "https://gitlab.dev.renku.ch"

cleanup-renku-ci-deployments/gitlab.go

@@ -0,0 +1,145 @@
+package main
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/json"
+	"fmt"
+	"log"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"regexp"
+	"strings"
+)
+
+type GitlabApplication struct {
+	ID              int    `json:"id,omitempty"`
+	ApplicationID   string `json:"application_id,omitempty"`
+	ApplicationName string `json:"application_name,omitempty"`
+	CallbackURL     string `json:"callback_url,omitempty"`
+	Confidential    bool   `json:"confidential,omitempty"`
+}
+
+var GitlabApplicationDoesNotExist error = fmt.Errorf("The Gitlab application does not exist")
+
+func listGitlabApplications(gitlabURL *url.URL, apiToken SensitiveString) ([]GitlabApplication, error) {
+	reqURL := gitlabURL.JoinPath("/api/v4/applications").String()
+	req, err := http.NewRequest("GET", reqURL, nil)
+	if err != nil {
+		return []GitlabApplication{}, err
+	}
+	req.Header.Add("private-token", string(apiToken))
+	res, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return []GitlabApplication{}, err
+	}
+	var gitlabApps []GitlabApplication
+	err = json.NewDecoder(res.Body).Decode(&gitlabApps)
+	if err != nil {
+		val, _ := httputil.DumpResponse(res, true)
+		return []GitlabApplication{}, fmt.Errorf("could not decode response because of err %s, response is %s\n", err.Error(), string(val))
+	}
+	defer res.Body.Close()
+	return gitlabApps, nil
+}
+
+func findGitlabApplication(gitlabURL *url.URL, apiToken SensitiveString, name string) (GitlabApplication, error) {
+	gitlabApps, err := listGitlabApplications(gitlabURL, apiToken)
+	if err != nil {
+		return GitlabApplication{}, err
+	}
+	for _, app := range gitlabApps {
+		if app.ApplicationName == name {
+			return app, nil
+		}
+	}
+	return GitlabApplication{}, GitlabApplicationDoesNotExist
+}
+
+func removeGitlabApplication(gitlabURL *url.URL, apiToken SensitiveString, id int) error {
+	reqURL := gitlabURL.JoinPath(fmt.Sprintf("/api/v4/applications/%d", id)).String()
+	req, err := http.NewRequest("DELETE", reqURL, nil)
+	req.Header.Add("private-token", string(apiToken))
+	if err != nil {
+		return err
+	}
+	res, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return err
+	}
+	if res.StatusCode != 204 {
+		resContent, err := httputil.DumpResponse(res, true)
+		if err != nil {
+			return err
+		}
+		return fmt.Errorf("Gitlab responded with unexpected status code %d and content %s", res.StatusCode, resContent)
+	}
+	return nil
+}
+
+func findAndRemoveGitlabApplication(gitlabURL *url.URL, apiToken SensitiveString, name string, dryRun bool) error {
+	app, err := findGitlabApplication(gitlabURL, apiToken, name)
+	if err != nil {
+		log.Printf("Cannot find gitlab application for release %s because of error %s, skipping", name, err.Error())
+		return err
+	}
+	if !dryRun {
+		err = removeGitlabApplication(gitlabURL, apiToken, app.ID)
+		if err != nil {
+			log.Printf("Cannot delete gitlab application for release %s because of error %s, skipping", name, err.Error())
+			return err
+		}
+	}
+	return nil
+}
+
+func cleanupGitlabApps(gitlabURL *url.URL, apiToken SensitiveString, dryRun bool) error {
+	gitlabApps, err := listGitlabApplications(gitlabURL, apiToken)
+	if err != nil {
+		return err
+	}
+	for _, app := range gitlabApps {
+		log.Printf("Checking for app %s", app.ApplicationName)
+		if !(strings.Contains(app.ApplicationName, "renku-ci") || strings.Contains(app.ApplicationName, "ci-renku")) {
+			log.Printf("\tapplication %s is not part of a CI deployment, skipping", app.ApplicationName)
+			continue
+		}
+		r := regexp.MustCompile("\\s+")
+		urls := r.Split(app.CallbackURL, -1)
+		if len(urls) == 0 {
+			log.Println("\tdid not find any callback urls, skipping")
+			continue
+		}
+		callbackURLStr := urls[0]
+		callbackURL, err := url.Parse(callbackURLStr)
+		if err != nil {
+			log.Printf("\terror in parsing callback url %s, %s, skipping", app.CallbackURL, err.Error())
+			continue
+		}
+		renkuURL := *callbackURL
+		renkuURL.RawFragment = ""
+		renkuURL.RawPath = ""
+		renkuURL.Path = ""
+		renkuURL.RawQuery = ""
+		tlsError := tls.CertificateVerificationError{Err: fmt.Errorf(""), UnverifiedCertificates: []*x509.Certificate{}}
+		res, err := http.Get(renkuURL.String())
+		if err != nil && !strings.Contains(err.Error(), tlsError.Error()) {
+			log.Printf("\terror in sending request to the application base url %s, %s, skipping", renkuURL.String(), err.Error())
+			continue
+		}
+		if res != nil && res.StatusCode < 400 {
+			log.Printf("\tstatus code from calling %s is <400, will not remove gitlab client", renkuURL.String())
+			continue
+		}
+		log.Printf("\tremoving gitlab application %s", app.ApplicationName)
+		if !dryRun {
+			err = removeGitlabApplication(gitlabURL, apiToken, app.ID)
+			if err != nil {
+				log.Printf("\tcannot remove gitlab application %s because of %s", app.ApplicationID, err.Error())
+				continue
+			}
+		}
+	}
+	return nil
+}

cleanup-renku-ci-deployments/go.mod

@@ -0,0 +1,51 @@
+module github.com/SwissDataScienceCenter/renku-actions/cleanup-renku-ci-deployments
+
+go 1.24.1
+
+require (
+	github.com/alecthomas/kong v1.10.0
+	k8s.io/api v0.32.3
+	k8s.io/apimachinery v0.32.3
+	k8s.io/client-go v0.32.3
+	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738
+)
+
+require (
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonreference v0.20.2 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/google/gnostic-models v0.6.8 // indirect
+	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	golang.org/x/net v0.30.0 // indirect
+	golang.org/x/oauth2 v0.23.0 // indirect
+	golang.org/x/sys v0.26.0 // indirect
+	golang.org/x/term v0.25.0 // indirect
+	golang.org/x/text v0.19.0 // indirect
+	golang.org/x/time v0.7.0 // indirect
+	google.golang.org/protobuf v1.35.1 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f // indirect
+	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.4.2 // indirect
+	sigs.k8s.io/yaml v1.4.0 // indirect
+)