bootstrap-aks-platform.yml

name: Bootstrap AKS Platform

# Run once per new cluster, or after disaster recovery. Not part of normal deploys.
on:
  workflow_dispatch:

env:
  AZURE_RESOURCE_GROUP: rg-vcr-protocol-prod-in
  AKS_NAME: vcr-aks-prod
  KEY_VAULT_NAME: vcr-kv-prod-in

permissions:
  id-token: write
  contents: read

jobs:
  bootstrap:
    name: Install ingress, cert-manager, external-secrets
    runs-on: ubuntu-latest
    environment: production
    timeout-minutes: 45

    steps:
      - uses: actions/checkout@v4

      - name: Azure login (OIDC)
        if: ${{ secrets.AZURE_CLIENT_ID != '' && secrets.AZURE_CLIENT_SECRET == '' }}
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Azure login (client secret)
        if: ${{ secrets.AZURE_CLIENT_SECRET != '' }}
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}

      - name: Azure login (JSON)
        if: ${{ secrets.AZURE_CREDENTIALS != '' && secrets.AZURE_CLIENT_ID == '' }}
        uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - uses: azure/setup-kubectl@v4
      - uses: azure/setup-helm@v4

      - name: Configure kubectl
        run: |
          az aks get-credentials \
            --resource-group "${{ env.AZURE_RESOURCE_GROUP }}" \
            --name "${{ env.AKS_NAME }}" \
            --overwrite-existing

      - name: Install ingress-nginx
        run: |
          helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
          helm repo update ingress-nginx
          helm upgrade --install ingress-nginx ingress-nginx/ingress-nginx \
            --namespace ingress-nginx \
            --create-namespace \
            -f infra/platform/ingress-nginx-values-prod.yaml \
            --wait --timeout 15m

      - name: Install cert-manager
        run: |
          if kubectl get deployment cert-manager -n cert-manager &>/dev/null; then
            echo "cert-manager already installed"
          else
            helm repo add jetstack https://charts.jetstack.io
            helm repo update jetstack
            helm upgrade --install cert-manager jetstack/cert-manager \
              --namespace cert-manager \
              --create-namespace \
              --set crds.enabled=true \
              --wait --timeout 15m
          fi
          kubectl apply -f infra/platform/cluster-issuer.yaml
          kubectl wait --for=condition=Ready clusterissuer/letsencrypt-prod --timeout=120s || true

      - name: Install external-secrets
        env:
          ESO_CLIENT_ID: ${{ secrets.ESO_CLIENT_ID }}
        run: |
          helm repo add external-secrets https://charts.external-secrets.io
          helm repo update external-secrets
          EXTRA=()
          if [[ -n "${ESO_CLIENT_ID}" ]]; then
            EXTRA+=(--set "serviceAccount.annotations.azure\.workload\.identity/client-id=${ESO_CLIENT_ID}")
          else
            ESO_ID="$(az identity show -g "${{ env.AZURE_RESOURCE_GROUP }}" -n vcr-eso-prod --query clientId -o tsv 2>/dev/null || true)"
            [[ -n "${ESO_ID}" ]] && EXTRA+=(--set "serviceAccount.annotations.azure\.workload\.identity/client-id=${ESO_ID}")
          fi
          helm upgrade --install external-secrets external-secrets/external-secrets \
            --namespace external-secrets \
            --create-namespace \
            -f infra/platform/external-secrets-values-prod.yaml \
            "${EXTRA[@]}" \
            --wait --timeout 10m

      - name: Apply ClusterSecretStore
        run: |
          KV_URI="$(az keyvault show -g "${{ env.AZURE_RESOURCE_GROUP }}" -n "${{ env.KEY_VAULT_NAME }}" --query properties.vaultUri -o tsv)"
          sed "s|\${KEY_VAULT_URI}|${KV_URI}|g" infra/platform/cluster-secret-store.yaml.tpl | kubectl apply -f -

      - name: Label application namespace
        run: |
          kubectl create namespace vcr-protocol --dry-run=client -o yaml | kubectl apply -f -
          kubectl label namespace vcr-protocol \
            pod-security.kubernetes.io/enforce=restricted \
            pod-security.kubernetes.io/enforce-version=latest \
            pod-security.kubernetes.io/warn=restricted \
            pod-security.kubernetes.io/warn-version=latest \
            --overwrite

      - name: Ingress IP
        run: |
          kubectl get svc -n ingress-nginx ingress-nginx-controller -o wide
          echo "Point api.vcrprotocol.xyz A record to the EXTERNAL-IP above."