homelab-cloud/.github/workflows/deploy-control-plane-triage-agent.yml at main · jingyi-zhao-01/homelab-cloud · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
name: Deploy Control Plane Triage Agent

on:
  push:
    branches:
      - main
    paths:
      - 'apps/control-plane-triage-agent/**'
      - 'charts/control-plane-triage-agent/**'
      - '.github/actions/setup-private-k3s-access/**'
      - '.github/workflows/deploy-control-plane-triage-agent.yml'
  workflow_dispatch:

concurrency:
  group: deploy-control-plane-triage-agent-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  packages: write

env:
  NAMESPACE: control-plane-agents
  IMAGE_REPOSITORY: ghcr.io/${{ github.repository_owner }}/control-plane-triage-agent
  IMAGE_TAG: ${{ github.sha }}
  TS_CI_TAGS: ${{ vars.TS_CI_TAGS }}
  TS_OAUTH_CLIENT_ID: ${{ secrets.TS_OAUTH_CLIENT_ID }}
  TS_OAUTH_SECRET: ${{ secrets.TS_OAUTH_SECRET }}

jobs:
  deploy:
    name: Build and deploy control-plane triage agent
    runs-on: ubuntu-latest

    steps:
      - name: Checkout homelab-cloud
        uses: actions/checkout@v4

      - name: Install kubectl
        uses: azure/setup-kubectl@v4

      - name: Install Helm
        uses: azure/setup-helm@v4

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ secrets.GHCR_PULL_USERNAME }}
          password: ${{ secrets.GHCR_PULL_TOKEN }}

      - name: Build and push agent image
        run: |
          docker build \
            -t "$IMAGE_REPOSITORY:latest" \
            -t "$IMAGE_REPOSITORY:$IMAGE_TAG" \
            apps/control-plane-triage-agent
          docker push "$IMAGE_REPOSITORY:latest"
          docker push "$IMAGE_REPOSITORY:$IMAGE_TAG"

      - name: Configure private k3s access
        uses: ./.github/actions/setup-private-k3s-access
        with:
          kube_config_data: ${{ secrets.KUBE_CONFIG_DATA }}
          k3s_server_url_tailscale: ${{ vars.K3S_SERVER_URL_TAILSCALE }}
          ts_oauth_client_id: ${{ env.TS_OAUTH_CLIENT_ID }}
          ts_oauth_secret: ${{ env.TS_OAUTH_SECRET }}
          ts_ci_tags: ${{ env.TS_CI_TAGS }}

      - name: Prepare Kubernetes prerequisites
        env:
          NAMESPACE: ${{ env.NAMESPACE }}
          GHCR_PULL_USERNAME: ${{ secrets.GHCR_PULL_USERNAME }}
          GHCR_PULL_TOKEN: ${{ secrets.GHCR_PULL_TOKEN }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        run: bash .github/scripts/ensure-k8s-prereqs.sh

      - name: Deploy triage agent via Helm
        run: |
          helm upgrade --install control-plane-triage-agent \
            --dependency-update \
            charts/control-plane-triage-agent/ \
            -n "$NAMESPACE" \
            --create-namespace \
            --set namespaceOverride="$NAMESPACE" \
            --set image.repository="$IMAGE_REPOSITORY" \
            --set image.tag="$IMAGE_TAG" \
            --set deploymentMetadata.gitSha="$GITHUB_SHA"

      - name: Wait for deployment
        run: |
          kubectl -n "$NAMESPACE" rollout status deploy/control-plane-triage-agent --timeout=300s || {
            kubectl -n "$NAMESPACE" get pods -o wide || true
            kubectl -n "$NAMESPACE" describe deploy control-plane-triage-agent || true
            kubectl -n "$NAMESPACE" get events --sort-by=.lastTimestamp | tail -n 50 || true
            exit 1
          }

      - name: Show deployment status
        run: kubectl -n "$NAMESPACE" get all

      - name: Diagnostics on failure
        if: failure()
        run: |
          kubectl -n "$NAMESPACE" get pods -o wide || true
          kubectl -n "$NAMESPACE" get events --sort-by=.lastTimestamp | tail -n 50 || true
          kubectl -n "$NAMESPACE" logs deploy/control-plane-triage-agent --tail=200 || true

  notify-discord:
    name: Notify Discord
    needs:
      - deploy
    if: ${{ always() }}
    runs-on: ubuntu-latest
    continue-on-error: true

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        continue-on-error: true

      - name: Send Discord notification
        continue-on-error: true
        uses: ./.github/actions/notify-discord
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        with:
          aws_region: ${{ vars.AWS_REGION }}
          discord_webhook_ssm_name: ${{ vars.DISCORD_WEBHOOK_SSM_NAME || '/codex/discord-webhook' }}
          workflow_name: Deploy Control Plane Triage Agent
          needs_json: ${{ toJson(needs) }}