Skip to content

Commit e81f18b

Browse files
verbotenjverbotenj
committed
ci: add GHA
Signed-off-by: Ales Verbic <[email protected]>
1 parent 3234fd0 commit e81f18b

File tree

6 files changed

+158
-11
lines changed

6 files changed

+158
-11
lines changed

‎.github/workflows/common-helmfile.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
on:
2+
workflow_call:
3+
inputs:
4+
cluster:
5+
required: true
6+
type: string
7+
arguments:
8+
required: true
9+
type: string
10+
11+
jobs:
12+
run-helmfile:
13+
name: run-helmfile
14+
runs-on: ["self-hosted"]
15+
steps:
16+
- name: Checkout repo
17+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 https://github.com/actions/checkout/releases/tag/v4.2.2
18+
19+
- name: Install kubectl
20+
uses: azure/setup-kubectl@0c5e050edfed71b2b50731ab044d42489d51c129 # vv4.0.0 https://github.com/Azure/setup-kubectl/releases/tag/vv4.0.0
21+
with:
22+
version: "v1.32.3"
23+
24+
- name: Configure AWS Credentials
25+
if: inputs.cluster == 'aws-vpn'
26+
uses: aws-actions/configure-aws-credentials@f24d7193d98baebaeacc7e2227925dd47cc267f5 # v4.2.0 https://github.com/aws-actions/configure-aws-credentials/releases/tag/v4.2.0
27+
with:
28+
aws-region: us-east-1
29+
aws-access-key-id: ${{ secrets.VPN_OPS_AWS_ACCESS_KEY_ID }}
30+
aws-secret-access-key: ${{ secrets.VPN_OPS_AWS_SECRET_ACCESS_KEY }}
31+
32+
- name: Install AWS CLI
33+
if: inputs.cluster == 'aws-vpn'
34+
run: |
35+
set -e
36+
# Bail if AWS CLI is already in PATH
37+
export PATH=$HOME/bin:$PATH
38+
if which aws >/dev/null; then
39+
if test -f $HOME/bin/aws; then
40+
echo $HOME/bin >> $GITHUB_PATH
41+
fi
42+
exit 0
43+
fi
44+
curl "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o "awscliv2.zip"
45+
unzip awscliv2.zip
46+
cd aws && ./install -i $HOME/aws-cli -b $HOME/bin --update
47+
rm -rf aws awscliv2.zip
48+
echo $HOME/bin >> $GITHUB_PATH
49+
50+
- name: Configure EKS access
51+
if: inputs.cluster == 'aws-vpn'
52+
run: aws --region us-east-1 eks update-kubeconfig --name vpn-us-east-1
53+
54+
- name: Run Helmfile
55+
uses: helmfile/helmfile-action@712000e3d4e28c72778ecc53857746082f555ef3 # v2.0.4 https://github.com/helmfile/helmfile-action/releases/tag/v2.0.4
56+
with:
57+
helmfile-version: "v1.1.5"
58+
helm-version: "v3.17.0"
59+
helm-plugins: >
60+
https://github.com/databus23/helm-diff,
61+
https://github.com/jkroepke/helm-secrets
62+
helmfile-workdirectory: helmfile-app
63+
helmfile-args: "-e ${{ inputs.cluster }} ${{ inputs.arguments }}"
64+
helmfile-auto-init: "false"

‎.github/workflows/pr-helmfile.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: pr-helmfile
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- "helmfile-app/**"
7+
- ".github/workflows/test-helmfile.yml"
8+
9+
jobs:
10+
pr-helmfile:
11+
strategy:
12+
matrix:
13+
cluster:
14+
- aws-vpn
15+
secrets: inherit
16+
uses: ./.github/workflows/common-helmfile.yml
17+
with:
18+
cluster: ${{ matrix.cluster }}
19+
arguments: "diff"

‎.github/workflows/run-helmfile.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: run-helmfile
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
cluster:
7+
description: "Which cluster to run against"
8+
required: true
9+
type: choice
10+
default: aws-vpn
11+
options:
12+
- aws-vpn
13+
arguments:
14+
description: "Helmfile CLI arguments"
15+
required: true
16+
default: "sync"
17+
18+
jobs:
19+
helmfile:
20+
secrets: inherit
21+
uses: ./.github/workflows/common-helmfile.yml
22+
with:
23+
cluster: ${{ inputs.cluster }}
24+
arguments: ${{ inputs.arguments }}

‎.github/workflows/test-helmfile.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
name: test-helmfile
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
cluster:
7+
description: "Which cluster to run against"
8+
required: true
9+
type: choice
10+
default: aws-vpn
11+
options:
12+
- aws-vpn
13+
14+
jobs:
15+
helmfile:
16+
secrets: inherit
17+
uses: ./.github/workflows/common-helmfile.yml
18+
with:
19+
cluster: ${{ inputs.cluster }}
20+
arguments: "diff"

‎helmfile-app/grafana-alloy/values.yaml.gotmpl‎

Lines changed: 28 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@ alloy:
2626
prometheus.scrape "alloy_check" {
2727
targets = discovery.relabel.alloy_check.output
2828
forward_to = [prometheus.relabel.alloy_check.receiver]
29-
3029
scrape_interval = "60s"
3130
}
3231

@@ -45,8 +44,8 @@ alloy:
4544
url = "https://prometheus-prod-13-prod-us-east-0.grafana.net/api/prom/push"
4645

4746
basic_auth {
48-
username = "1834751"
49-
password = "{{ .Values.grafana.password }}"
47+
username = env("GRAFANA_USERNAME")
48+
password = env("GRAFANA_PASSWORD")
5049
}
5150
}
5251
}
@@ -118,26 +117,26 @@ alloy:
118117
"instance" = constants.hostname,
119118
},
120119
]
121-
120+
122121
rule {
123122
target_label = "job"
124123
replacement = "integrations/kubernetes/kube-state-metrics"
125124
}
126-
125+
127126
rule {
128127
target_label = "cluster"
129128
replacement = "{{ .Values.eks_lb.clusterName }}"
130129
}
131130
}
132-
131+
133132
prometheus.scrape "kube_state_metrics" {
134133
targets = discovery.relabel.kube_state_metrics.output
135134
forward_to = [prometheus.relabel.kube_state_metrics.receiver]
136-
135+
137136
scrape_interval = "60s"
138137
metrics_path = "/metrics"
139138
}
140-
139+
141140
prometheus.relabel "kube_state_metrics" {
142141
forward_to = [prometheus.remote_write.metrics_service.receiver]
143142

@@ -153,3 +152,24 @@ alloy:
153152
level = "info"
154153
format = "logfmt"
155154
}
155+
extraEnv:
156+
- name: GRAFANA_USERNAME
157+
valueFrom:
158+
secretKeyRef:
159+
name: grafana-cloud
160+
key: GRAFANA_USERNAME
161+
- name: GRAFANA_PASSWORD
162+
valueFrom:
163+
secretKeyRef:
164+
name: grafana-cloud
165+
key: GRAFANA_PASSWORD
166+
167+
extraObjects:
168+
- apiVersion: v1
169+
kind: Secret
170+
metadata:
171+
name: grafana-cloud
172+
type: Opaque
173+
stringData:
174+
GRAFANA_USERNAME: "1834751"
175+
GRAFANA_PASSWORD: "{{ .Values.grafana.password }}"

‎helmfile-app/vars/secrets.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
grafana:
2-
password: ENC[AES256_GCM,data:Kk3Bx4fWn++VvZwOSnkcHoOoa/FHgGmqj5oREV8SH+CTIUJSWRaYCY3P8hlLXYxT5FCi1E1NipuOQaflxqEy4Z7alkn8af6cjsfVYfEjjE2xfYmcUFbgu3Gn7nk7lSAAJaFco9J69DI/hB3KOVtmXTWYnuGMRNhcwAGevJnMDZbdl+RguyLqk9YUJEqaV+cOnaKxsRtEBRQ=,iv:Q4clsT09TibmFCnQh6XBWrVJXixzMOFIomVunZ7E1cA=,tag:6yd99xvAIY4UTThyoBeMkg==,type:str]
2+
password: ENC[AES256_GCM,data:W/2QfU3k9biS0FPim4WVpWk6djKlvp/0eWQMIW/BnKvItEzj0oQvde1CLZX8o1R4jHitD/MK2wzlRZVode21Y5DYrRRs1sEKM5RbX+IoD7sj/E3wzZmvu2IlEiFhhAL4JeWRecqEZJNnFidK9fV4bvFcVPzF2LkuqdWXt1zO6TP4YIIYGEoP8U1d6EsRceZZEsP9GU4HHds=,iv:2CZVwyW5NdYjP61hOvacpjrGVz3bUGEfVFFTEh13S3c=,tag:1veUnMy0JzZU1KZrB36tSg==,type:str]
33
s3:
44
#ENC[AES256_GCM,data:VLdb9ERUFm0ksOE0YrIwtJkVlwfXe3CXbDQ53B0RiUK54vAIz02ljVV4kCynm2+yE+jJcg1vswNi,iv:frIrzF6UHZcFxtlVx2gM63tJPNx0YuM4Ygu8BRvtlBg=,tag:+9NkWxA/gRepGcW50YDu0g==,type:comment]
55
accessKey: ENC[AES256_GCM,data:NrieoVbuA11VpmpAjsdVuMECcG0=,iv:ejghNiUU8Rs7+FR8Os824R4vGszFeb1rOrphqOc1kro=,tag:JYjN23qtsO88ICvanSlPBQ==,type:str]
@@ -54,7 +54,7 @@ sops:
5454
created_at: "2025-08-26T20:43:58Z"
5555
enc: AQICAHhD+6INpe9bWwzJ1I134hpS1h/xe4qIdkxHDi/fxkkAiQFMqgXfRTZHIhfP8NDybMeCAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMvfxQ0SaEdSH0SJfxAgEQgDt73qBsIBmGpipj+I6aEtJDA0WJSSFX1lH8Xh4AIPY/X1F4sRN+77JiMsCu5nGFH/75DaGee8itJ2yjvA==
5656
aws_profile: vpn_aws
57-
lastmodified: "2025-10-22T13:16:38Z"
58-
mac: ENC[AES256_GCM,data:rwAuk/w74OYVzIE+H1usFLhApa83AIp3FABw7h8U8fcK/KMLKyv1yM9BpkZq52OL1bwCACcDny12gJH1bBhtgGgLK5QVP7zodYqH3ta0Kc3F3n4Ft5lKFc5K/9vmtR70UB0ktcf7PKZEPzYWABXbHumBGoJtFlPFPWSV+MW0VWw=,iv:yEn/njCowb76WPGNJPPA8b5frFtB6OfvgbE+mX3txic=,tag:qqLbL7YOpgnpgRFhVhl83A==,type:str]
57+
lastmodified: "2025-11-04T15:35:08Z"
58+
mac: ENC[AES256_GCM,data:kaMMeotSqWlh7rBE2B8RDzC4pnApZf2fQV38VNAL4H2bMLOOjbNg8yrAf9VTUPy1ujs3xaATd7s+NZElsHiHDdSjx3Ama/Z1TfCfTpO16cPgx37V6jpf9ouJmBUryxD8VQsq6X86p1Bp152MxzI8jML7AV29VREQ5EaX2gTlfQA=,iv:I6nuaYY3Z0epnNlff6d6TrZZ2N8dqWXxCDnADz7o7J0=,tag:KyLGlvNe5UYbQnbvh6Xnew==,type:str]
5959
unencrypted_suffix: _unencrypted
6060
version: 3.10.2

0 commit comments

Comments
 (0)