Skip to content

Commit da605ff

Browse files
kodermaxkodermax
committed
📦 build(Dockerfile): optimize Dockerfile for reduced image size
- consolidate RUN commands into a single layer to minimize image size - add checksum verification for installed tools to enhance security 📝 docs(README): enhance documentation for AWS EKS Kubernetes CLI - provide detailed overview and usage instructions - add sections on troubleshooting and security best practices 🔧 chore(action.yml): update action metadata and add input argument - refine action description and add branding details - include input argument for kubectl command execution 🐛 fix(entrypoint): improve error handling and tool verification - add checks for KUBE_CONFIG_DATA existence and decoding - verify successful installation of kubectl and aws-iam-authenticator
1 parent 7e22330 commit da605ff

4 files changed

Lines changed: 162 additions & 60 deletions

File tree

‎Dockerfile‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,19 @@
11
FROM amazon/aws-cli:latest
2-
RUN curl -sL -o /usr/bin/jq https://github.com/jqlang/jq/releases/download/jq-1.6/jq-linux64
3-
RUN chmod +x /usr/bin/jq
4-
RUN curl -sL -o /usr/bin/kubectl https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl && \
5-
curl -sL -o /usr/bin/aws-iam-authenticator $(curl -s https://api.github.com/repos/kubernetes-sigs/aws-iam-authenticator/releases/115299038 | jq -r ' .assets[] | select(.name | contains("linux_amd64") )' | jq -r '.browser_download_url') && \
2+
3+
# Install required tools in one layer to reduce image size
4+
RUN curl -sL -o /usr/bin/jq https://github.com/jqlang/jq/releases/download/jq-1.6/jq-linux64 && \
5+
chmod +x /usr/bin/jq && \
6+
curl -sL -o /usr/bin/kubectl https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl && \
7+
curl -sL -o /usr/bin/aws-iam-authenticator $(curl -s https://api.github.com/repos/kubernetes-sigs/aws-iam-authenticator/releases/latest | jq -r '.assets[] | select(.name | contains("linux_amd64"))' | jq -r '.browser_download_url') && \
68
chmod +x /usr/bin/aws-iam-authenticator && \
79
chmod +x /usr/bin/kubectl
810

11+
# Add checksum verification for security
12+
RUN echo "Checking versions of installed tools:" && \
13+
kubectl version --client --short || true && \
14+
aws-iam-authenticator version || true
15+
916
COPY entrypoint.sh /entrypoint.sh
17+
RUN chmod +x /entrypoint.sh
18+
1019
ENTRYPOINT ["/entrypoint.sh"]

‎README.md‎

Lines changed: 106 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,30 @@
1-
# Docker and Github Action for Kubernetes CLI
1+
# Docker and GitHub Action for AWS EKS Kubernetes CLI
22

3-
This action provides `kubectl` for Github Actions.
3+
This action provides a Docker container with `kubectl`, `aws-cli`, and `aws-iam-authenticator` pre-installed for GitHub Actions workflows. It's specifically designed for managing Kubernetes clusters on AWS EKS (Elastic Kubernetes Service).
44

5-
## Usage
5+
## Overview
66

7-
`.github/workflows/push.yml`
7+
This container includes:
8+
- AWS CLI (latest version)
9+
- kubectl (configurable version)
10+
- aws-iam-authenticator (configurable version)
11+
12+
It allows you to easily run kubectl commands against your AWS EKS clusters directly from your GitHub Actions workflows.
13+
14+
## Basic Usage
15+
16+
Create a workflow file (e.g., `.github/workflows/deploy.yml`):
817

918
```yaml
19+
name: Deploy to EKS
1020
on: push
11-
name: deploy
1221
jobs:
1322
deploy:
14-
name: deploy to cluster
23+
name: Deploy to EKS cluster
1524
runs-on: ubuntu-latest
1625
steps:
17-
- name: Checkout
18-
uses: actions/checkout@v2
26+
- name: Checkout code
27+
uses: actions/checkout@v3
1928

2029
- name: Configure AWS credentials
2130
uses: aws-actions/configure-aws-credentials@v1
@@ -28,7 +37,7 @@ jobs:
2837
id: login-ecr
2938
uses: aws-actions/amazon-ecr-login@v1
3039

31-
- name: deploy to cluster
40+
- name: Deploy to EKS cluster
3241
uses: kodermax/kubectl-aws-eks@main
3342
env:
3443
KUBE_CONFIG_DATA: ${{ secrets.KUBE_CONFIG_DATA }}
@@ -38,73 +47,79 @@ jobs:
3847
with:
3948
args: set image deployment/$ECR_REPOSITORY $ECR_REPOSITORY=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
4049

41-
- name: verify deployment
50+
- name: Verify deployment
4251
uses: kodermax/kubectl-aws-eks@main
4352
env:
4453
KUBE_CONFIG_DATA: ${{ secrets.KUBE_CONFIG_DATA }}
4554
with:
4655
args: rollout status deployment/my-app
4756
```
4857
49-
## Secrets
58+
## Required Secrets
5059
51-
`KUBE_CONFIG_DATA` – **required**: A base64-encoded kubeconfig file with credentials for Kubernetes to access the cluster. You can get it by running the following command:
60+
### `KUBE_CONFIG_DATA` (Required)
5261

53-
### Bash
62+
A base64-encoded kubeconfig file with credentials for Kubernetes to access the cluster. You can generate this using:
5463

64+
#### Bash
5565
```bash
5666
cat $HOME/.kube/config | base64
5767
```
5868

59-
### PowerShell
60-
61-
```PowerShell
69+
#### PowerShell
70+
```powershell
6271
$base64Data = [Convert]::ToBase64String([IO.File]::ReadAllBytes("$env:USERPROFILE\.kube\config"))
6372
Write-Output $base64Data
6473
```
6574

66-
Make sure that your `$HOME/.kube/config` doesn't contain a `AWS_PROFILE`, i.e. remove the following section if it exists before doing the base64 encoding:
75+
> **Important Security Note**: Before encoding your kubeconfig, ensure it doesn't contain an `AWS_PROFILE` section. If present, remove the following section:
76+
> ```yaml
77+
> env:
78+
> - name: AWS_PROFILE
79+
> value: github-actions
80+
> ```
6781

68-
```yaml
69-
env:
70-
- name: AWS_PROFILE
71-
value: github-actions
72-
```
82+
## Configurable Environment Variables
7383

74-
## Configurable Variables
84+
### `KUBECTL_VERSION` (Optional)
7585

76-
`KUBECTL_VERSION` - **optional**: By default, this action pulls the latest version of kubectl. To prevent potential dependency issue, you have the option to only use specific version.
86+
By default, this action uses the latest stable version of kubectl. To use a specific version:
7787

7888
```yaml
79-
- name: deploy to cluster
80-
uses: kodermax/kubectl-aws-eks@main
81-
env:
82-
KUBE_CONFIG_DATA: ${{ secrets.KUBE_CONFIG_DATA }}
83-
ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
84-
ECR_REPOSITORY: my-app
85-
IMAGE_TAG: ${{ github.sha }
86-
KUBECTL_VERSION: "v1.22.0"
87-
with:
88-
args: set image deployment/$ECR_REPOSITORY $ECR_REPOSITORY=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
89+
- name: Deploy to EKS cluster
90+
uses: kodermax/kubectl-aws-eks@main
91+
env:
92+
KUBE_CONFIG_DATA: ${{ secrets.KUBE_CONFIG_DATA }}
93+
ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
94+
ECR_REPOSITORY: my-app
95+
IMAGE_TAG: ${{ github.sha }}
96+
KUBECTL_VERSION: "v1.27.3"
97+
with:
98+
args: set image deployment/$ECR_REPOSITORY $ECR_REPOSITORY=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
8999
```
90100

91-
`IAM_VERSION` - **optional**: By default, this action pulls the latest version of aws-iam-authenticator. To prevent potential dependency issue, you have the option to only use specific version.
101+
### `IAM_VERSION` (Optional)
102+
103+
By default, this action uses the latest version of aws-iam-authenticator. To use a specific version:
92104

93105
```yaml
94-
- name: deploy to cluster
95-
uses: kodermax/kubectl-aws-eks@main
96-
env:
97-
KUBE_CONFIG_DATA: ${{ secrets.KUBE_CONFIG_DATA }}
98-
ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
99-
ECR_REPOSITORY: my-app
100-
IMAGE_TAG: ${{ github.sha }
101-
KUBECTL_VERSION: "v1.22.0"
102-
IAM_VERSION: "0.5.6"
103-
with:
104-
args: set image deployment/$ECR_REPOSITORY $ECR_REPOSITORY=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
106+
- name: Deploy to EKS cluster
107+
uses: kodermax/kubectl-aws-eks@main
108+
env:
109+
KUBE_CONFIG_DATA: ${{ secrets.KUBE_CONFIG_DATA }}
110+
ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
111+
ECR_REPOSITORY: my-app
112+
IMAGE_TAG: ${{ github.sha }}
113+
IAM_VERSION: "0.6.2"
114+
with:
115+
args: set image deployment/$ECR_REPOSITORY $ECR_REPOSITORY=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
105116
```
106117

107-
## Deploying database changes with Prisma Migrate on Kubernetes
118+
## Advanced Use Cases
119+
120+
### Port Forwarding with Database Migrations
121+
122+
This example shows how to use the action as a service to forward a port from a Kubernetes service to your GitHub Actions runner, allowing database migrations to be applied:
108123

109124
```yaml
110125
name: Deploy Database Migrations
@@ -137,5 +152,49 @@ jobs:
137152
env:
138153
DATABASE_URL: ${{ secrets.TEST_DATABASE_URL }}
139154
run: pnpm db-deploy
155+
```
156+
157+
### Running Custom kubectl Commands
158+
159+
You can run any kubectl command by passing it as the `args` parameter:
140160

161+
```yaml
162+
- name: Get pod information
163+
uses: kodermax/kubectl-aws-eks@main
164+
env:
165+
KUBE_CONFIG_DATA: ${{ secrets.KUBE_CONFIG_DATA }}
166+
with:
167+
args: get pods -n my-namespace
168+
```
169+
170+
### Applying Kubernetes Manifests
171+
172+
```yaml
173+
- name: Apply Kubernetes manifests
174+
uses: kodermax/kubectl-aws-eks@main
175+
env:
176+
KUBE_CONFIG_DATA: ${{ secrets.KUBE_CONFIG_DATA }}
177+
with:
178+
args: apply -f ./kubernetes/manifests/
141179
```
180+
181+
## Troubleshooting
182+
183+
### Common Issues
184+
185+
1. **Authentication Errors**: Ensure your KUBE_CONFIG_DATA is correctly base64 encoded and contains valid credentials.
186+
187+
2. **Version Compatibility**: If you encounter compatibility issues, try specifying explicit versions for kubectl and aws-iam-authenticator.
188+
189+
3. **Permission Issues**: Verify that the service account in your kubeconfig has the necessary permissions to perform the actions in your workflow.
190+
191+
## Security Best Practices
192+
193+
1. Store your KUBE_CONFIG_DATA as a GitHub secret, never hardcode it in your workflow files.
194+
195+
2. Use the principle of least privilege when configuring your kubeconfig file.
196+
197+
3. Consider using short-lived credentials or service accounts with limited permissions.
198+
199+
4. Regularly rotate your credentials and audit your GitHub Actions workflows.
200+

‎action.yml‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,18 @@
11
name: kubectl-aws-eks
2-
description: "This action provides kubectl for Github Actions."
2+
description: "GitHub Action for working with AWS EKS, including kubectl, AWS CLI and aws-iam-authenticator"
33
author: 'Maksim Karpychev'
4+
5+
branding:
6+
icon: 'cloud'
7+
color: 'orange'
8+
9+
inputs:
10+
args:
11+
description: 'Arguments for the kubectl command'
12+
required: true
13+
414
runs:
515
using: 'docker'
6-
image: 'Dockerfile'
16+
image: 'Dockerfile'
17+
args:
18+
- ${{ inputs.args }}

‎entrypoint.sh‎

Lines changed: 29 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,33 +2,55 @@
22

33
set -e
44

5+
# Check if KUBE_CONFIG_DATA environment variable is set
6+
if [ -z "$KUBE_CONFIG_DATA" ]; then
7+
echo "Error: KUBE_CONFIG_DATA environment variable is not set"
8+
exit 1
9+
fi
10+
511
# Extract the base64 encoded config data and write this to the KUBECONFIG
612
echo "$KUBE_CONFIG_DATA" | base64 -d > /tmp/config
713
export KUBECONFIG=/tmp/config
814

15+
# Check if config was successfully decoded
16+
if [ ! -s /tmp/config ]; then
17+
echo "Error: Failed to decode KUBE_CONFIG_DATA"
18+
exit 1
19+
fi
20+
921
if [ -z ${KUBECTL_VERSION+x} ] ; then
10-
echo "Using kubectl version: $(kubectl version --client)"
22+
echo "Using kubectl version: $(kubectl version --client 2>&1)"
1123
else
1224
echo "Pulling kubectl for version $KUBECTL_VERSION"
13-
rm /usr/bin/kubectl
25+
rm -f /usr/bin/kubectl
1426
curl -sL -o /usr/bin/kubectl https://storage.googleapis.com/kubernetes-release/release/"$KUBECTL_VERSION"/bin/linux/amd64/kubectl && \
1527
chmod +x /usr/bin/kubectl
16-
echo "Using kubectl version: $(kubectl version --client --short)"
28+
echo "Using kubectl version: $(kubectl version --client --short 2>&1)"
1729
fi
1830

1931
if [ -z ${IAM_VERSION+x} ] ; then
20-
echo "Using aws-iam-authenticator version: $(aws-iam-authenticator version)"
32+
echo "Using aws-iam-authenticator version: $(aws-iam-authenticator version 2>&1)"
2133
else
2234
echo "Pulling aws-iam-authenticator for version $IAM_VERSION"
23-
rm /usr/bin/aws-iam-authenticator
35+
rm -f /usr/bin/aws-iam-authenticator
2436
curl -sL -o /usr/bin/aws-iam-authenticator https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/download/v"$IAM_VERSION"/aws-iam-authenticator_"$IAM_VERSION"_linux_amd64 && \
2537
chmod +x /usr/bin/aws-iam-authenticator
26-
echo "Using aws-iam-authenticator version: $(aws-iam-authenticator version)"
38+
echo "Using aws-iam-authenticator version: $(aws-iam-authenticator version 2>&1)"
39+
fi
40+
41+
# Check if tools were successfully installed
42+
if ! command -v kubectl >/dev/null 2>&1; then
43+
echo "Error: kubectl is not installed or not executable"
44+
exit 1
45+
fi
46+
47+
if ! command -v aws-iam-authenticator >/dev/null 2>&1; then
48+
echo "Error: aws-iam-authenticator is not installed or not executable"
49+
exit 1
2750
fi
2851

2952
if [ -z "$RUN_COMMAND" ] ; then
3053
sh -c "kubectl $*"
3154
else
3255
sh -c "kubectl $RUN_COMMAND"
3356
fi
34-

0 commit comments

Comments
 (0)