Skip to content

Commit ec786b4

Browse files
verbotenjverbotenj
authored
ci: add GHA (#55)
Signed-off-by: Ales Verbic <[email protected]>
1 parent 990d51b commit ec786b4

File tree

7 files changed

+183
-13
lines changed

7 files changed

+183
-13
lines changed

‎.github/workflows/common-helmfile.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
on:
2+
workflow_call:
3+
inputs:
4+
cluster:
5+
required: true
6+
type: string
7+
arguments:
8+
required: true
9+
type: string
10+
11+
permissions:
12+
contents: read
13+
14+
jobs:
15+
run-helmfile:
16+
name: run-helmfile
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: Checkout repo
20+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 https://github.com/actions/checkout/releases/tag/v4.2.2
21+
22+
- name: Install kubectl
23+
uses: azure/setup-kubectl@0c5e050edfed71b2b50731ab044d42489d51c129 # vv4.0.0 https://github.com/Azure/setup-kubectl/releases/tag/vv4.0.0
24+
with:
25+
version: "v1.32.3"
26+
27+
- name: Sops Binary Installer
28+
uses: mdgreenwald/mozilla-sops-action@d9714e521cbaecdae64a89d2fdd576dd2aa97056 # v1.6.0 https://github.com/mdgreenwald/mozilla-sops-action/releases/tag/v1.6.0
29+
30+
- name: Setup AWS Profile
31+
if: inputs.cluster == 'aws-vpn'
32+
run: |
33+
mkdir -p ~/.aws
34+
cat > ~/.aws/credentials << EOF
35+
[vpn_aws]
36+
aws_access_key_id = ${{ secrets.VPN_OPS_AWS_ACCESS_KEY_ID }}
37+
aws_secret_access_key = ${{ secrets.VPN_OPS_AWS_SECRET_ACCESS_KEY }}
38+
EOF
39+
40+
cat > ~/.aws/config << EOF
41+
[profile vpn_aws]
42+
region = us-east-1
43+
EOF
44+
45+
echo "AWS_PROFILE=vpn_aws" >> $GITHUB_ENV
46+
47+
- name: Install AWS CLI
48+
if: inputs.cluster == 'aws-vpn'
49+
run: |
50+
set -e
51+
# Bail if AWS CLI is already in PATH
52+
export PATH=$HOME/bin:$PATH
53+
if which aws >/dev/null; then
54+
if test -f $HOME/bin/aws; then
55+
echo $HOME/bin >> $GITHUB_PATH
56+
fi
57+
exit 0
58+
fi
59+
curl "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o "awscliv2.zip"
60+
unzip awscliv2.zip
61+
cd aws && ./install -i $HOME/aws-cli -b $HOME/bin --update
62+
rm -rf aws awscliv2.zip
63+
echo $HOME/bin >> $GITHUB_PATH
64+
65+
- name: Configure EKS access
66+
if: inputs.cluster == 'aws-vpn'
67+
run: aws --region us-east-1 eks update-kubeconfig --name vpn-us-east-1
68+
69+
- name: Run Helmfile
70+
uses: helmfile/helmfile-action@712000e3d4e28c72778ecc53857746082f555ef3 # v2.0.4 https://github.com/helmfile/helmfile-action/releases/tag/v2.0.4
71+
with:
72+
helmfile-version: "v1.1.5"
73+
helm-version: "v3.19.0"
74+
helm-plugins: >
75+
https://github.com/databus23/helm-diff,
76+
https://github.com/jkroepke/helm-secrets
77+
helmfile-workdirectory: helmfile-app
78+
helmfile-args: "-e ${{ inputs.cluster }} ${{ inputs.arguments }}"
79+
helmfile-auto-init: "false"

‎.github/workflows/pr-helmfile.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: pr-helmfile
2+
on:
3+
pull_request:
4+
paths:
5+
- "helmfile-app/**"
6+
- ".github/workflows/pr-helmfile.yml"
7+
8+
permissions:
9+
contents: read
10+
11+
jobs:
12+
pr-helmfile:
13+
strategy:
14+
matrix:
15+
cluster:
16+
- aws-vpn
17+
secrets: inherit
18+
uses: ./.github/workflows/common-helmfile.yml
19+
with:
20+
cluster: ${{ matrix.cluster }}
21+
arguments: "diff"

‎.github/workflows/run-helmfile.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: run-helmfile
2+
on:
3+
workflow_dispatch:
4+
inputs:
5+
cluster:
6+
description: "Which cluster to run against"
7+
required: true
8+
type: choice
9+
default: aws-vpn
10+
options:
11+
- aws-vpn
12+
arguments:
13+
description: "Helmfile CLI arguments"
14+
required: true
15+
default: "sync"
16+
17+
permissions:
18+
contents: read
19+
20+
jobs:
21+
helmfile:
22+
secrets: inherit
23+
uses: ./.github/workflows/common-helmfile.yml
24+
with:
25+
cluster: ${{ inputs.cluster }}
26+
arguments: ${{ inputs.arguments }}

‎.github/workflows/test-helmfile.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: test-helmfile
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
cluster:
7+
description: "Which cluster to run against"
8+
required: true
9+
type: choice
10+
default: aws-vpn
11+
options:
12+
- aws-vpn
13+
14+
permissions:
15+
contents: read
16+
17+
jobs:
18+
helmfile:
19+
secrets: inherit
20+
uses: ./.github/workflows/common-helmfile.yml
21+
with:
22+
cluster: ${{ inputs.cluster }}
23+
arguments: "diff"

‎.github/workflows/test-terraform.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,9 @@ name: test-terraform
33
on:
44
workflow_dispatch:
55
pull_request:
6-
branches: ['main']
7-
paths: ['config.yaml','terraform/**','.github/workflows/test-terraform.yml']
6+
branches: ["main"]
7+
paths:
8+
["config.yaml", "terraform/**", ".github/workflows/test-terraform.yml"]
89

910
defaults:
1011
run:

‎helmfile-app/grafana-alloy/values.yaml.gotmpl‎

Lines changed: 28 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@ alloy:
2626
prometheus.scrape "alloy_check" {
2727
targets = discovery.relabel.alloy_check.output
2828
forward_to = [prometheus.relabel.alloy_check.receiver]
29-
3029
scrape_interval = "60s"
3130
}
3231

@@ -45,8 +44,8 @@ alloy:
4544
url = "https://prometheus-prod-13-prod-us-east-0.grafana.net/api/prom/push"
4645

4746
basic_auth {
48-
username = "1834751"
49-
password = "{{ .Values.grafana.password }}"
47+
username = env("GRAFANA_USERNAME")
48+
password = env("GRAFANA_PASSWORD")
5049
}
5150
}
5251
}
@@ -118,26 +117,26 @@ alloy:
118117
"instance" = constants.hostname,
119118
},
120119
]
121-
120+
122121
rule {
123122
target_label = "job"
124123
replacement = "integrations/kubernetes/kube-state-metrics"
125124
}
126-
125+
127126
rule {
128127
target_label = "cluster"
129128
replacement = "{{ .Values.eks_lb.clusterName }}"
130129
}
131130
}
132-
131+
133132
prometheus.scrape "kube_state_metrics" {
134133
targets = discovery.relabel.kube_state_metrics.output
135134
forward_to = [prometheus.relabel.kube_state_metrics.receiver]
136-
135+
137136
scrape_interval = "60s"
138137
metrics_path = "/metrics"
139138
}
140-
139+
141140
prometheus.relabel "kube_state_metrics" {
142141
forward_to = [prometheus.remote_write.metrics_service.receiver]
143142

@@ -153,3 +152,24 @@ alloy:
153152
level = "info"
154153
format = "logfmt"
155154
}
155+
extraEnv:
156+
- name: GRAFANA_USERNAME
157+
valueFrom:
158+
secretKeyRef:
159+
name: grafana-cloud
160+
key: GRAFANA_USERNAME
161+
- name: GRAFANA_PASSWORD
162+
valueFrom:
163+
secretKeyRef:
164+
name: grafana-cloud
165+
key: GRAFANA_PASSWORD
166+
167+
extraObjects:
168+
- apiVersion: v1
169+
kind: Secret
170+
metadata:
171+
name: grafana-cloud
172+
type: Opaque
173+
stringData:
174+
GRAFANA_USERNAME: "1834751"
175+
GRAFANA_PASSWORD: "{{ .Values.grafana.password }}"

‎helmfile-app/vars/secrets.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
grafana:
2-
password: ENC[AES256_GCM,data:Kk3Bx4fWn++VvZwOSnkcHoOoa/FHgGmqj5oREV8SH+CTIUJSWRaYCY3P8hlLXYxT5FCi1E1NipuOQaflxqEy4Z7alkn8af6cjsfVYfEjjE2xfYmcUFbgu3Gn7nk7lSAAJaFco9J69DI/hB3KOVtmXTWYnuGMRNhcwAGevJnMDZbdl+RguyLqk9YUJEqaV+cOnaKxsRtEBRQ=,iv:Q4clsT09TibmFCnQh6XBWrVJXixzMOFIomVunZ7E1cA=,tag:6yd99xvAIY4UTThyoBeMkg==,type:str]
2+
password: ENC[AES256_GCM,data:W/2QfU3k9biS0FPim4WVpWk6djKlvp/0eWQMIW/BnKvItEzj0oQvde1CLZX8o1R4jHitD/MK2wzlRZVode21Y5DYrRRs1sEKM5RbX+IoD7sj/E3wzZmvu2IlEiFhhAL4JeWRecqEZJNnFidK9fV4bvFcVPzF2LkuqdWXt1zO6TP4YIIYGEoP8U1d6EsRceZZEsP9GU4HHds=,iv:2CZVwyW5NdYjP61hOvacpjrGVz3bUGEfVFFTEh13S3c=,tag:1veUnMy0JzZU1KZrB36tSg==,type:str]
33
s3:
44
#ENC[AES256_GCM,data:VLdb9ERUFm0ksOE0YrIwtJkVlwfXe3CXbDQ53B0RiUK54vAIz02ljVV4kCynm2+yE+jJcg1vswNi,iv:frIrzF6UHZcFxtlVx2gM63tJPNx0YuM4Ygu8BRvtlBg=,tag:+9NkWxA/gRepGcW50YDu0g==,type:comment]
55
accessKey: ENC[AES256_GCM,data:NrieoVbuA11VpmpAjsdVuMECcG0=,iv:ejghNiUU8Rs7+FR8Os824R4vGszFeb1rOrphqOc1kro=,tag:JYjN23qtsO88ICvanSlPBQ==,type:str]
@@ -54,7 +54,7 @@ sops:
5454
created_at: "2025-08-26T20:43:58Z"
5555
enc: AQICAHhD+6INpe9bWwzJ1I134hpS1h/xe4qIdkxHDi/fxkkAiQFMqgXfRTZHIhfP8NDybMeCAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMvfxQ0SaEdSH0SJfxAgEQgDt73qBsIBmGpipj+I6aEtJDA0WJSSFX1lH8Xh4AIPY/X1F4sRN+77JiMsCu5nGFH/75DaGee8itJ2yjvA==
5656
aws_profile: vpn_aws
57-
lastmodified: "2025-10-22T13:16:38Z"
58-
mac: ENC[AES256_GCM,data:rwAuk/w74OYVzIE+H1usFLhApa83AIp3FABw7h8U8fcK/KMLKyv1yM9BpkZq52OL1bwCACcDny12gJH1bBhtgGgLK5QVP7zodYqH3ta0Kc3F3n4Ft5lKFc5K/9vmtR70UB0ktcf7PKZEPzYWABXbHumBGoJtFlPFPWSV+MW0VWw=,iv:yEn/njCowb76WPGNJPPA8b5frFtB6OfvgbE+mX3txic=,tag:qqLbL7YOpgnpgRFhVhl83A==,type:str]
57+
lastmodified: "2025-11-04T15:35:08Z"
58+
mac: ENC[AES256_GCM,data:kaMMeotSqWlh7rBE2B8RDzC4pnApZf2fQV38VNAL4H2bMLOOjbNg8yrAf9VTUPy1ujs3xaATd7s+NZElsHiHDdSjx3Ama/Z1TfCfTpO16cPgx37V6jpf9ouJmBUryxD8VQsq6X86p1Bp152MxzI8jML7AV29VREQ5EaX2gTlfQA=,iv:I6nuaYY3Z0epnNlff6d6TrZZ2N8dqWXxCDnADz7o7J0=,tag:KyLGlvNe5UYbQnbvh6Xnew==,type:str]
5959
unencrypted_suffix: _unencrypted
6060
version: 3.10.2

0 commit comments

Comments
 (0)