Skip to content

Commit 1c8c00a

Browse files
jfaltermeierjfaltermeier
committed
Deploy App Definition
1 parent 985247a commit 1c8c00a

File tree

4 files changed

+161
-3
lines changed

4 files changed

+161
-3
lines changed

‎.github/workflows/publish-theia-ide-preview-comment.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: Comment on new PR
2+
3+
permissions:
4+
pull-requests: write
5+
6+
on:
7+
pull_request:
8+
branches: [master]
9+
types:
10+
- opened
11+
12+
jobs:
13+
comment:
14+
runs-on: ubuntu-latest
15+
steps:
16+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea #7.0.1
17+
with:
18+
script: |
19+
github.rest.issues.createComment({
20+
issue_number: context.issue.number,
21+
owner: context.repo.owner,
22+
repo: context.repo.repo,
23+
body: 'Thank you for opening the PR!\n\nThis comment will be replaced with a link to a Preview deployment as soon as it is ready.'
24+
})

‎.github/workflows/publish-theia-ide-preview-deployment.yml‎

Lines changed: 73 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,4 +87,76 @@ jobs:
8787
file: browser.Dockerfile
8888
push: true
8989
tags: |
90-
europe-west3-docker.pkg.dev/kubernetes-238012/theia-ide-preview/theia-ide-preview:${{ env.IMAGE_TAG }}
90+
europe-west3-docker.pkg.dev/kubernetes-238012/theia-ide-preview/theia-ide-preview:${{ env.IMAGE_TAG }}
91+
92+
- name: Get GKE Credentials
93+
uses: google-github-actions/get-gke-credentials@d0cee45012069b163a631894b98904a9e6723729 # v2.3.3
94+
with:
95+
cluster_name: github-theia-ide-preview
96+
location: europe-west3-c
97+
98+
- name: List sessions in theia-cloud namespace
99+
run: kubectl get sessions -n theia-cloud
100+
101+
- name: List apps in theia-cloud namespace
102+
run: kubectl get appdefinitions -n theia-cloud
103+
104+
- name: Delete app definition if existent
105+
run: kubectl delete appdefinitions theia-ide-${{ env.IMAGE_TAG }} -n theia-cloud || true
106+
107+
- name: Delete existing sessions
108+
run: kubectl get sessions -n theia-cloud -o json | jq -r '.items[] | select(.spec.appDefinition == "theia-ide-${{ env.IMAGE_TAG }}") | .metadata.name' | xargs -r kubectl delete sessions -n theia-cloud
109+
110+
- name: Create app definition
111+
run: |
112+
cat <<EOF | kubectl apply -f -
113+
apiVersion: theia.cloud/v1beta10
114+
kind: AppDefinition
115+
metadata:
116+
name: theia-ide-${{ env.IMAGE_TAG }}
117+
namespace: theia-cloud
118+
spec:
119+
downlinkLimit: 30000
120+
image: europe-west3-docker.pkg.dev/kubernetes-238012/theia-ide-preview/theia-ide-preview:${{ env.IMAGE_TAG }}
121+
imagePullPolicy: Always
122+
ingressname: theia-cloud-demo-ws-ingress
123+
limitsCpu: "2"
124+
limitsMemory: 500M
125+
maxInstances: 3
126+
minInstances: 0
127+
mountPath: /home/project/persisted
128+
name: theia-ide-${{ env.IMAGE_TAG }}
129+
port: 3000
130+
requestsCpu: "100m"
131+
requestsMemory: 300M
132+
timeout: 15
133+
uid: 101
134+
uplinkLimit: 30000
135+
EOF
136+
137+
- name: Update bot comment with URL
138+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea #7.0.1
139+
with:
140+
script: |
141+
const {data: comments} = await github.rest.issues.listComments({
142+
owner: context.repo.owner,
143+
repo: context.repo.repo,
144+
issue_number: context.payload.number,
145+
})
146+
const botComment = comments.find(comment => comment.user.id === 41898282)
147+
const commentBody = "Preview deployment created at https://launch.theia-ide-preview.eclipsesource-munich.com/?appDef=theia-ide-${{ env.IMAGE_TAG }}\n\nWhen the deployment is cleaned up, this link will be removed again."
148+
if (botComment) {
149+
await github.rest.issues.updateComment({
150+
owner: context.repo.owner,
151+
repo: context.repo.repo,
152+
comment_id: botComment.id,
153+
body: commentBody
154+
})
155+
} else {
156+
await github.rest.issues.createComment({
157+
owner: context.repo.owner,
158+
repo: context.repo.repo,
159+
issue_number: context.payload.number,
160+
body: commentBody
161+
})
162+
}

‎.terraform/main.tf‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,9 @@ resource "google_container_cluster" "primary" {
6767
remove_default_node_pool = true
6868
initial_node_count = 1
6969
project = "kubernetes-238012"
70+
workload_identity_config {
71+
workload_pool = "kubernetes-238012.svc.id.goog"
72+
}
7073
}
7174

7275
# Node Pool
@@ -119,13 +122,21 @@ provider "helm" {
119122
host = "https://${google_container_cluster.primary.endpoint}"
120123
token = data.google_client_config.default.access_token
121124
cluster_ca_certificate = base64decode(google_container_cluster.primary.master_auth[0].cluster_ca_certificate)
125+
exec {
126+
api_version = "client.authentication.k8s.io/v1beta1"
127+
command = "gke-gcloud-auth-plugin"
128+
}
122129
}
123130
}
124131
provider "kubectl" {
125132
load_config_file = false
126133
host = "https://${google_container_cluster.primary.endpoint}"
127134
token = data.google_client_config.default.access_token
128135
cluster_ca_certificate = base64decode(google_container_cluster.primary.master_auth[0].cluster_ca_certificate)
136+
exec {
137+
api_version = "client.authentication.k8s.io/v1beta1"
138+
command = "gke-gcloud-auth-plugin"
139+
}
129140
}
130141

131142
# Install cert-manager
@@ -400,3 +411,54 @@ resource "helm_release" "theia-cloud" {
400411
value = var.cookiesecret
401412
}
402413
}
414+
415+
# Configure service account
416+
#
417+
resource "kubectl_manifest" "cluster-role" {
418+
depends_on = [helm_release.theia-cloud-crds]
419+
yaml_body = <<-EOF
420+
apiVersion: rbac.authorization.k8s.io/v1
421+
kind: ClusterRole
422+
metadata:
423+
name: custom-resource-manager
424+
rules:
425+
- apiGroups: ["theia.cloud"]
426+
resources: ["appdefinitions", "sessions"]
427+
verbs: ["get", "list", "create", "delete"]
428+
EOF
429+
}
430+
resource "kubectl_manifest" "cluster-role-binding" {
431+
depends_on = [kubectl_manifest.cluster-role]
432+
yaml_body = <<-EOF
433+
apiVersion: rbac.authorization.k8s.io/v1
434+
kind: ClusterRoleBinding
435+
metadata:
436+
name: custom-resource-binding
437+
subjects:
438+
- kind: User
439+
name: "github-theia-preview-deployer@kubernetes-238012.iam.gserviceaccount.com"
440+
apiGroup: rbac.authorization.k8s.io
441+
roleRef:
442+
kind: ClusterRole
443+
name: custom-resource-manager
444+
apiGroup: rbac.authorization.k8s.io
445+
EOF
446+
}
447+
resource "kubectl_manifest" "github-deployer-sa" {
448+
yaml_body = <<-EOF
449+
apiVersion: v1
450+
kind: ServiceAccount
451+
metadata:
452+
name: github-deployer
453+
namespace: theia-cloud
454+
annotations:
455+
iam.gke.io/gcp-service-account: github-theia-preview-deployer@kubernetes-238012.iam.gserviceaccount.com
456+
EOF
457+
}
458+
resource "google_service_account_iam_binding" "workload-identity-binding" {
459+
service_account_id = "projects/kubernetes-238012/serviceAccounts/github-theia-preview-deployer@kubernetes-238012.iam.gserviceaccount.com"
460+
role = "roles/iam.workloadIdentityUser"
461+
members = [
462+
"serviceAccount:kubernetes-238012.svc.id.goog[theia-cloud/github-deployer]"
463+
]
464+
}

‎.terraform/theia-cloud.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ app:
33
name: Theia IDE Preview
44

55
demoApplication:
6-
install: false
6+
install: true # at the moment we will lose the ingress if we delete the last app def
77

88
hosts:
99
usePaths: false
@@ -20,7 +20,7 @@ keycloak:
2020
enable: true
2121
realm: "TheiaCloud"
2222
clientId: "theia-cloud"
23-
authUrl: "https://theia-ide-preview.eclipsesource-munich.com/keycloak"
23+
authUrl: "https://theia-ide-preview.eclipsesource-munich.com/keycloak/"
2424

2525
operator:
2626
eagerStart: false

0 commit comments

Comments
 (0)