feat: update host cleanup script to use /proc/1/root for chroot execu… #8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Deploy Node Disk Janitor | |
| on: | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - "apps/node-disk-janitor/**" | |
| - "charts/node-disk-janitor/**" | |
| - ".github/actions/setup-private-k3s-access/**" | |
| - ".github/scripts/ensure-k8s-prereqs.sh" | |
| - ".github/workflows/deploy-node-disk-janitor.yml" | |
| workflow_dispatch: | |
| concurrency: | |
| group: build-and-deploy-node-disk-janitor-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| packages: write | |
| env: | |
| NAMESPACE: control-plane-agents | |
| RELEASE: node-disk-janitor | |
| CHART_PATH: charts/node-disk-janitor | |
| IMAGE_REPOSITORY: ghcr.io/${{ github.repository_owner }}/node-disk-janitor | |
| IMAGE_TAG: ${{ github.sha }} | |
| TS_CI_TAGS: ${{ vars.TS_CI_TAGS }} | |
| TS_OAUTH_CLIENT_ID: ${{ secrets.TS_OAUTH_CLIENT_ID }} | |
| TS_OAUTH_SECRET: ${{ secrets.TS_OAUTH_SECRET }} | |
| jobs: | |
| build: | |
| name: Test and publish node-disk-janitor image | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout homelab-cloud | |
| uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: apps/node-disk-janitor/go.mod | |
| cache-dependency-path: apps/node-disk-janitor/go.sum | |
| - name: Run unit tests | |
| working-directory: apps/node-disk-janitor | |
| run: | | |
| go test ./... | |
| - name: Log in to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ secrets.GHCR_PULL_USERNAME }} | |
| password: ${{ secrets.GHCR_PULL_TOKEN }} | |
| - name: Build and push image | |
| run: | | |
| docker build \ | |
| -t "$IMAGE_REPOSITORY:latest" \ | |
| -t "$IMAGE_REPOSITORY:$IMAGE_TAG" \ | |
| apps/node-disk-janitor | |
| docker push "$IMAGE_REPOSITORY:latest" | |
| docker push "$IMAGE_REPOSITORY:$IMAGE_TAG" | |
| deploy: | |
| name: Deploy node-disk-janitor to k3s | |
| needs: | |
| - build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout homelab-cloud | |
| uses: actions/checkout@v4 | |
| - name: Install kubectl | |
| uses: azure/setup-kubectl@v4 | |
| - name: Install Helm | |
| uses: azure/setup-helm@v4 | |
| - name: Configure private k3s access | |
| uses: ./.github/actions/setup-private-k3s-access | |
| with: | |
| kube_config_data: ${{ secrets.KUBE_CONFIG_DATA }} | |
| k3s_server_url_tailscale: ${{ vars.K3S_SERVER_URL_TAILSCALE }} | |
| ts_oauth_client_id: ${{ env.TS_OAUTH_CLIENT_ID }} | |
| ts_oauth_secret: ${{ env.TS_OAUTH_SECRET }} | |
| ts_ci_tags: ${{ env.TS_CI_TAGS }} | |
| - name: Prepare Kubernetes prerequisites | |
| env: | |
| NAMESPACE: ${{ env.NAMESPACE }} | |
| GHCR_PULL_USERNAME: ${{ secrets.GHCR_PULL_USERNAME }} | |
| GHCR_PULL_TOKEN: ${{ secrets.GHCR_PULL_TOKEN }} | |
| AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| run: bash .github/scripts/ensure-k8s-prereqs.sh | |
| - name: Deploy node-disk-janitor via Helm | |
| run: | | |
| helm upgrade --install "$RELEASE" \ | |
| "$CHART_PATH" \ | |
| -n "$NAMESPACE" \ | |
| --create-namespace \ | |
| --set namespaceOverride="$NAMESPACE" \ | |
| --set image.repository="$IMAGE_REPOSITORY" \ | |
| --set image.tag="$IMAGE_TAG" | |
| - name: Wait for daemonset rollout | |
| run: | | |
| kubectl -n "$NAMESPACE" rollout status daemonset/"$RELEASE" --timeout=300s || { | |
| kubectl -n "$NAMESPACE" get pods -o wide || true | |
| kubectl -n "$NAMESPACE" describe daemonset "$RELEASE" || true | |
| kubectl -n "$NAMESPACE" get events --sort-by=.lastTimestamp | tail -n 50 || true | |
| exit 1 | |
| } | |
| - name: Show deployment status | |
| run: | | |
| kubectl -n "$NAMESPACE" get daemonset "$RELEASE" -o wide | |
| kubectl -n "$NAMESPACE" get pods -l app.kubernetes.io/instance="$RELEASE" -o wide | |
| - name: Diagnostics on failure | |
| if: failure() | |
| run: | | |
| kubectl -n "$NAMESPACE" get pods -o wide || true | |
| kubectl -n "$NAMESPACE" get events --sort-by=.lastTimestamp | tail -n 50 || true | |
| kubectl -n "$NAMESPACE" describe daemonset "$RELEASE" || true | |
| kubectl -n "$NAMESPACE" logs -l app.kubernetes.io/instance="$RELEASE" --tail=200 || true | |
| notify-discord: | |
| name: Notify Discord | |
| needs: | |
| - build | |
| - deploy | |
| if: ${{ always() }} | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| continue-on-error: true | |
| - name: Send Discord notification | |
| continue-on-error: true | |
| uses: ./.github/actions/notify-discord | |
| env: | |
| AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| with: | |
| aws_region: ${{ vars.AWS_REGION }} | |
| discord_webhook_ssm_name: ${{ vars.DISCORD_WEBHOOK_SSM_NAME || '/codex/discord-webhook' }} | |
| workflow_name: Build and Deploy Node Disk Janitor | |
| needs_json: ${{ toJson(needs) }} |