feat: prepare release 2.5.0-beta1 #88
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release-pullrequest-EKS | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| jobs: | |
| install-EKS: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| k8s_version: [ "1.32", "1.31" ] | |
| steps: | |
| - name: Extract and Store Trimmed Repository Name | |
| run: | | |
| REPO_CHART_NAME="${{ github.repository }}" | |
| REPO_APP_NAME=$(echo "$REPO_CHART_NAME" | sed 's/-chart$//') # Remove "-chart" suffix if present | |
| # Check if the trimmed repo exists | |
| HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \ | |
| -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \ | |
| "https://api.github.com/repos/$REPO_APP_NAME") | |
| if [[ "$HTTP_STATUS" -eq 200 ]]; then | |
| echo "Using trimmed repository name: $REPO_APP_NAME" | |
| echo "REPO_APP_NAME=$REPO_APP_NAME" >> $GITHUB_ENV | |
| else | |
| echo "Trimmed repository not found. Falling back to original repository name." | |
| echo "REPO_APP_NAME=$REPO_CHART_NAME" >> $GITHUB_ENV | |
| fi | |
| - name: Use the Stored Variable | |
| run: | | |
| echo "Trimmed Repository Name: ${{ env.REPO_APP_NAME }}" | |
| - name: Authenticate with GitHub App | |
| id: authenticate | |
| uses: tibdex/github-app-token@v1 | |
| with: | |
| app_id: ${{ secrets.APP_ID }} | |
| private_key: ${{ secrets.PRIVATE_KEY }} | |
| - name: Extract latest App Version | |
| uses: tdemin/find-latest-tag@v1 | |
| id: app_version | |
| with: | |
| repo: https://${{ steps.authenticate.outputs.token }}@github.com/${{ env.REPO_APP_NAME }}.git | |
| - name: Extract latest Chart Version | |
| uses: tdemin/find-latest-tag@v1 | |
| id: chart_version | |
| with: | |
| repo: https://${{ steps.authenticate.outputs.token }}@github.com/${{ github.repository }}.git | |
| - name: Checkout | |
| uses: actions/checkout@v3 | |
| - name: Print latest Chart Version | |
| run: | | |
| echo APP_VERSION:${{steps.app_version.outputs.tag}} | |
| echo CHART_VERSION:${{steps.chart_version.outputs.tag}} | |
| - name: Replace Chart Version in Chart.yaml | |
| run: sed -i 's/CHART_VERSION/${{ steps.chart_version.outputs.tag }}/g' ./chart/Chart.yaml | |
| - name: Replace App Version in Chart.yaml | |
| run: sed -i 's/APP_VERSION/${{ steps.app_version.outputs.tag }}/g' ./chart/Chart.yaml | |
| # Prepare a sanitized version string (replace '.' with '-') and store it in K8S_VERSION_NODOT | |
| - name: Prepare version variable | |
| run: echo "K8S_VERSION_NODOT=$(echo '${{ matrix.k8s_version }}' | tr '.' '-')" >> $GITHUB_ENV | |
| - name: Set up Helm | |
| uses: azure/[email protected] | |
| - name: Helm lint | |
| run: helm lint ./chart | |
| - name: Create k8s Kind Cluster | |
| uses: helm/kind-action@v1 | |
| - name: Install AWS Signing Helper | |
| run: | | |
| curl -Lo aws_signing_helper https://rolesanywhere.amazonaws.com/releases/1.4.0/X86_64/Linux/aws_signing_helper | |
| chmod +x aws_signing_helper | |
| - name: Write Certificate from Secrets | |
| run: | | |
| echo "${{ secrets.AWS_CERTIFICATE }}" | base64 --decode > certificato.txt | |
| chmod 600 certificato.txt | |
| - name: Write Private Key from Secrets | |
| run: | | |
| echo "${{ secrets.AWS_PRIVATE_KEY }}" | base64 --decode > chiave_privata_decifrata.key | |
| chmod 600 chiave_privata_decifrata.key | |
| - name: Get AWS Credentials via IAM Roles Anywhere | |
| run: | | |
| echo "Retrieving AWS credentials..." | |
| CREDS=$(./aws_signing_helper credential-process \ | |
| --certificate ./certificato.txt \ | |
| --private-key ./chiave_privata_decifrata.key \ | |
| --trust-anchor-arn arn:aws:rolesanywhere:eu-central-1:654654440307:trust-anchor/5f810e29-6061-46d6-a1ff-d36a5ac5c8cc \ | |
| --profile-arn arn:aws:rolesanywhere:eu-central-1:654654440307:profile/32097de8-0ad3-41f6-8da9-c99fa1c82bf5 \ | |
| --role-arn arn:aws:iam::654654440307:role/github-action-admin \ | |
| --session-duration 14400) | |
| ACCESS_KEY=$(echo $CREDS | jq -r '.AccessKeyId') | |
| SECRET_KEY=$(echo $CREDS | jq -r '.SecretAccessKey') | |
| SESSION_TOKEN=$(echo $CREDS | jq -r '.SessionToken') | |
| EXPIRATION=$(echo $CREDS | jq -r '.Expiration') | |
| cat > ./credentials <<EOF | |
| [dev] | |
| aws_access_key_id = $ACCESS_KEY | |
| aws_secret_access_key = $SECRET_KEY | |
| aws_session_token = $SESSION_TOKEN | |
| EOF | |
| echo "AWS credentials retrieved. Session expires at: $EXPIRATION" | |
| - name: Create AWS Credentials Secret in Kubernetes | |
| run: | | |
| kubectl create ns ack-system | |
| kubectl create secret generic aws-creds \ | |
| --from-file=credentials-file=./credentials \ | |
| --namespace=ack-system \ | |
| --type=Opaque | |
| - name: Install ACK EC2 Controller on Kind using Helm | |
| run: | | |
| helm install --create-namespace -n ack-system ack-ec2-controller \ | |
| oci://public.ecr.aws/aws-controllers-k8s/ec2-chart --version=1.3.7 --set=aws.region=eu-central-1 --wait --set=aws.credentials.secretName=aws-creds --set=aws.credentials.secretKey=credentials-file --set=aws.credentials.profile=dev | |
| - name: Annotate ACK EC2 Controller serviceaccount | |
| run: kubectl annotate serviceaccount -n ack-system ack-ec2-controller eks.amazonaws.com/role-arn=arn:aws:iam::539247454863:role/github-action | |
| - name: Check ACK EC2 Controller serviceaccount | |
| run: kubectl describe serviceaccount -n ack-system ack-ec2-controller | |
| - name: Restart ACK EC2 Controller | |
| run: kubectl rollout restart deployment -n ack-system ack-ec2-controller-ec2-chart | |
| - name: Wait for ACK EC2 Controller Deployment to be Ready | |
| run: kubectl rollout status deployment -n ack-system ack-ec2-controller-ec2-chart --timeout=300s | |
| - name: Install ACK EKS Controller on Kind using Helm | |
| run: | | |
| helm install --create-namespace -n ack-system ack-eks-controller \ | |
| oci://public.ecr.aws/aws-controllers-k8s/eks-chart --version=1.6.3 --set=aws.region=eu-central-1 --wait --set=aws.credentials.secretName=aws-creds --set=aws.credentials.secretKey=credentials-file --set=aws.credentials.profile=dev | |
| - name: Annotate ACK EKS Controller serviceaccount | |
| run: kubectl annotate serviceaccount -n ack-system ack-eks-controller eks.amazonaws.com/role-arn=arn:aws:iam::539247454863:role/github-action | |
| - name: Check ACK EKS Controller serviceaccount | |
| run: kubectl describe serviceaccount -n ack-system ack-eks-controller | |
| - name: Restart ACK EKS Controller | |
| run: kubectl rollout restart deployment -n ack-system ack-eks-controller-eks-chart | |
| - name: Wait for ACK EKS Controller Deployment to be Ready | |
| run: kubectl rollout status deployment -n ack-system ack-eks-controller-eks-chart --timeout=300s | |
| - name: Deploy VPC CR via EC2 Controller | |
| run: | | |
| echo "Deploying VPC resource with Kubernetes version ${{ matrix.k8s_version }}..." | |
| cat <<EOF | kubectl apply -f - | |
| apiVersion: ec2.services.k8s.aws/v1alpha1 | |
| kind: VPC | |
| metadata: | |
| name: cluster-$K8S_VERSION_NODOT | |
| spec: | |
| cidrBlocks: | |
| - 10.0.0.0/16 | |
| enableDNSSupport: true | |
| enableDNSHostnames: true | |
| tags: | |
| - key: Name | |
| value: cluster-$K8S_VERSION_NODOT | |
| - key: kubernetes.io/cluster/cluster-$K8S_VERSION_NODOT | |
| value: shared | |
| EOF | |
| - name: Wait for VPC Provisioning | |
| run: | | |
| echo "Waiting for VPC resource to become ACK.ResourceSynced..." | |
| kubectl wait --for=condition=ACK.ResourceSynced --timeout=600s vpc/cluster-$K8S_VERSION_NODOT | |
| - name: Check VPC status | |
| if: always() | |
| run: | | |
| kubectl get vpc/cluster-$K8S_VERSION_NODOT -o yaml | |
| - name: Create Internet Gateway | |
| run: | | |
| echo "Creating Internet Gateway..." | |
| cat <<EOF | kubectl apply -f - | |
| apiVersion: ec2.services.k8s.aws/v1alpha1 | |
| kind: InternetGateway | |
| metadata: | |
| name: cluster-$K8S_VERSION_NODOT-igw | |
| spec: | |
| tags: | |
| - key: Name | |
| value: cluster-$K8S_VERSION_NODOT-igw | |
| vpcRef: | |
| from: | |
| name: cluster-$K8S_VERSION_NODOT | |
| EOF | |
| - name: Wait for Internet Gateway Provisioning | |
| run: | | |
| echo "Waiting for Internet Gateway to become ready..." | |
| kubectl wait --for=condition=ACK.ResourceSynced --timeout=300s internetgateway/cluster-$K8S_VERSION_NODOT-igw | |
| - name: Create Public Route Table | |
| run: | | |
| echo "Creating Public Route Table..." | |
| cat <<EOF | kubectl apply -f - | |
| apiVersion: ec2.services.k8s.aws/v1alpha1 | |
| kind: RouteTable | |
| metadata: | |
| name: cluster-$K8S_VERSION_NODOT-public-rt | |
| spec: | |
| vpcRef: | |
| from: | |
| name: cluster-$K8S_VERSION_NODOT | |
| tags: | |
| - key: Name | |
| value: cluster-$K8S_VERSION_NODOT-public-rt | |
| routes: | |
| - destinationCIDRBlock: 0.0.0.0/0 | |
| gatewayRef: | |
| from: | |
| name: cluster-$K8S_VERSION_NODOT-igw | |
| EOF | |
| - name: Wait for Route Table Provisioning | |
| run: | | |
| echo "Waiting for Route Table to become ready..." | |
| kubectl wait --for=condition=ACK.ResourceSynced --timeout=300s routetable/cluster-$K8S_VERSION_NODOT-public-rt | |
| - name: Deploy Public Subnet-1 CR via EC2 Controller | |
| run: | | |
| echo "Deploying Public Subnet-1 resource with Kubernetes version ${{ matrix.k8s_version }}..." | |
| cat <<EOF | kubectl apply -f - | |
| apiVersion: ec2.services.k8s.aws/v1alpha1 | |
| kind: Subnet | |
| metadata: | |
| name: cluster-$K8S_VERSION_NODOT-public-1 | |
| spec: | |
| cidrBlock: 10.0.1.0/24 | |
| availabilityZone: eu-central-1a | |
| vpcRef: | |
| from: | |
| name: cluster-$K8S_VERSION_NODOT | |
| mapPublicIPOnLaunch: true | |
| tags: | |
| - key: Name | |
| value: cluster-$K8S_VERSION_NODOT-public-1 | |
| - key: kubernetes.io/cluster/cluster-$K8S_VERSION_NODOT | |
| value: shared | |
| - key: kubernetes.io/role/elb | |
| value: "1" | |
| routeTableRefs: | |
| - from: | |
| name: cluster-$K8S_VERSION_NODOT-public-rt | |
| EOF | |
| - name: Wait for Public Subnet-1 Provisioning | |
| run: | | |
| echo "Waiting for Public Subnet-1 resource to become Ready..." | |
| kubectl wait --for=condition=ACK.ResourceSynced --timeout=600s subnet/cluster-$K8S_VERSION_NODOT-public-1 | |
| - name: Check Public Subnet-1 status | |
| if: always() | |
| run: | | |
| kubectl get subnet/cluster-$K8S_VERSION_NODOT-public-1 -o yaml | |
| - name: Deploy Public Subnet-2 CR via EC2 Controller | |
| run: | | |
| echo "Deploying Public Subnet-2 resource with Kubernetes version ${{ matrix.k8s_version }}..." | |
| cat <<EOF | kubectl apply -f - | |
| apiVersion: ec2.services.k8s.aws/v1alpha1 | |
| kind: Subnet | |
| metadata: | |
| name: cluster-$K8S_VERSION_NODOT-public-2 | |
| spec: | |
| cidrBlock: 10.0.2.0/24 | |
| availabilityZone: eu-central-1b | |
| vpcRef: | |
| from: | |
| name: cluster-$K8S_VERSION_NODOT | |
| mapPublicIPOnLaunch: true | |
| tags: | |
| - key: Name | |
| value: cluster-$K8S_VERSION_NODOT-public-2 | |
| - key: kubernetes.io/cluster/cluster-$K8S_VERSION_NODOT | |
| value: shared | |
| - key: kubernetes.io/role/elb | |
| value: "1" | |
| routeTableRefs: | |
| - from: | |
| name: cluster-$K8S_VERSION_NODOT-public-rt | |
| EOF | |
| - name: Wait for Public Subnet-2 Provisioning | |
| run: | | |
| echo "Waiting for Public Subnet-2 resource to become Ready..." | |
| kubectl wait --for=condition=ACK.ResourceSynced --timeout=600s subnet/cluster-$K8S_VERSION_NODOT-public-2 | |
| - name: Check Public Subnet-2 status | |
| if: always() | |
| run: | | |
| kubectl get subnet/cluster-$K8S_VERSION_NODOT-public-2 -o yaml | |
| - name: Create Security Group for EKS Control Plane | |
| run: | | |
| echo "Creating Security Group for EKS Control Plane..." | |
| cat <<EOF | kubectl apply -f - | |
| apiVersion: ec2.services.k8s.aws/v1alpha1 | |
| kind: SecurityGroup | |
| metadata: | |
| name: cluster-$K8S_VERSION_NODOT-eks-sg | |
| spec: | |
| vpcRef: | |
| from: | |
| name: cluster-$K8S_VERSION_NODOT | |
| description: Security group for EKS Control Plane | |
| name: cluster-$K8S_VERSION_NODOT-eks-sg | |
| ingressRules: | |
| - ipProtocol: tcp | |
| fromPort: 443 | |
| toPort: 443 | |
| ipRanges: | |
| - cidrIP: 0.0.0.0/0 | |
| description: Allow HTTPS from anywhere | |
| egressRules: | |
| - ipProtocol: "-1" | |
| fromPort: -1 | |
| toPort: -1 | |
| ipRanges: | |
| - cidrIP: 0.0.0.0/0 | |
| description: Allow all outbound traffic | |
| tags: | |
| - key: Name | |
| value: cluster-$K8S_VERSION_NODOT-eks-sg | |
| EOF | |
| - name: Wait for EKS Security Group Provisioning | |
| run: | | |
| echo "Waiting for EKS Security Group to become ready..." | |
| kubectl wait --for=condition=ACK.ResourceSynced --timeout=300s securitygroup/cluster-$K8S_VERSION_NODOT-eks-sg | |
| - name: Create Security Group for Worker Nodes | |
| run: | | |
| echo "Creating Security Group for EKS Worker Nodes..." | |
| cat <<EOF | kubectl apply -f - | |
| apiVersion: ec2.services.k8s.aws/v1alpha1 | |
| kind: SecurityGroup | |
| metadata: | |
| name: cluster-$K8S_VERSION_NODOT-node-sg | |
| spec: | |
| vpcRef: | |
| from: | |
| name: cluster-$K8S_VERSION_NODOT | |
| description: Security group for EKS Worker Nodes | |
| name: cluster-$K8S_VERSION_NODOT-node-sg | |
| ingressRules: | |
| - ipProtocol: tcp | |
| fromPort: 1025 | |
| toPort: 65535 | |
| ipRanges: | |
| - cidrIP: 10.0.0.0/16 | |
| description: Allow all traffic from within VPC | |
| - ipProtocol: tcp | |
| fromPort: 443 | |
| toPort: 443 | |
| ipRanges: | |
| - cidrIP: 10.0.0.0/16 | |
| description: Allow HTTPS from VPC | |
| - ipProtocol: tcp | |
| fromPort: 22 | |
| toPort: 22 | |
| ipRanges: | |
| - cidrIP: 0.0.0.0/0 | |
| description: Allow SSH from anywhere | |
| egressRules: | |
| - ipProtocol: "-1" | |
| fromPort: -1 | |
| toPort: -1 | |
| ipRanges: | |
| - cidrIP: 0.0.0.0/0 | |
| description: Allow all outbound traffic | |
| tags: | |
| - key: Name | |
| value: cluster-$K8S_VERSION_NODOT-node-sg | |
| - key: kubernetes.io/cluster/cluster-$K8S_VERSION_NODOT | |
| value: owned | |
| EOF | |
| - name: Wait for Node Security Group Provisioning | |
| run: | | |
| echo "Waiting for Node Security Group to become ready..." | |
| kubectl wait --for=condition=ACK.ResourceSynced --timeout=300s securitygroup/cluster-$K8S_VERSION_NODOT-node-sg | |
| - name: Create Security Group for VPC Endpoints | |
| run: | | |
| echo "Creating Security Group for VPC Endpoints..." | |
| cat <<EOF | kubectl apply -f - | |
| apiVersion: ec2.services.k8s.aws/v1alpha1 | |
| kind: SecurityGroup | |
| metadata: | |
| name: cluster-$K8S_VERSION_NODOT-vpce-sg | |
| spec: | |
| vpcRef: | |
| from: | |
| name: cluster-$K8S_VERSION_NODOT | |
| description: Security group for VPC Endpoints | |
| name: cluster-$K8S_VERSION_NODOT-vpce-sg | |
| ingressRules: | |
| - ipProtocol: tcp | |
| fromPort: 443 | |
| toPort: 443 | |
| ipRanges: | |
| - cidrIP: 10.0.0.0/16 | |
| description: Allow HTTPS from VPC CIDR | |
| egressRules: | |
| - ipProtocol: "-1" | |
| fromPort: -1 | |
| toPort: -1 | |
| ipRanges: | |
| - cidrIP: 0.0.0.0/0 | |
| description: Allow all outbound traffic | |
| tags: | |
| - key: Name | |
| value: cluster-$K8S_VERSION_NODOT-vpce-sg | |
| EOF | |
| - name: Wait for VPC Endpoints Security Group Provisioning | |
| run: | | |
| echo "Waiting for VPC Endpoints Security Group to become ready..." | |
| kubectl wait --for=condition=ACK.ResourceSynced --timeout=300s securitygroup/cluster-$K8S_VERSION_NODOT-vpce-sg | |
| - name: Deploy VPC Endpoint for EC2 | |
| run: | | |
| echo "Deploying VPC Endpoint for EC2..." | |
| cat <<EOF | kubectl apply -f - | |
| apiVersion: ec2.services.k8s.aws/v1alpha1 | |
| kind: VPCEndpoint | |
| metadata: | |
| name: cluster-$K8S_VERSION_NODOT-ec2-endpoint | |
| spec: | |
| serviceName: com.amazonaws.eu-central-1.ec2 | |
| vpcRef: | |
| from: | |
| name: cluster-$K8S_VERSION_NODOT | |
| subnetRefs: | |
| - from: | |
| name: cluster-$K8S_VERSION_NODOT-public-1 | |
| - from: | |
| name: cluster-$K8S_VERSION_NODOT-public-2 | |
| securityGroupRefs: | |
| - from: | |
| name: cluster-$K8S_VERSION_NODOT-vpce-sg | |
| vpcEndpointType: Interface | |
| privateDNSEnabled: true | |
| policyDocument: | | |
| { | |
| "Version": "2012-10-17", | |
| "Statement": [ | |
| { | |
| "Effect": "Allow", | |
| "Principal": "*", | |
| "Action": "*", | |
| "Resource": "*" | |
| } | |
| ] | |
| } | |
| tags: | |
| - key: Name | |
| value: cluster-$K8S_VERSION_NODOT-ec2-endpoint | |
| EOF | |
| - name: Deploy VPC Endpoint for ECR API | |
| run: | | |
| echo "Deploying VPC Endpoint for ECR API..." | |
| cat <<EOF | kubectl apply -f - | |
| apiVersion: ec2.services.k8s.aws/v1alpha1 | |
| kind: VPCEndpoint | |
| metadata: | |
| name: cluster-$K8S_VERSION_NODOT-ecr-api-endpoint | |
| spec: | |
| serviceName: com.amazonaws.eu-central-1.ecr.api | |
| vpcRef: | |
| from: | |
| name: cluster-$K8S_VERSION_NODOT | |
| subnetRefs: | |
| - from: | |
| name: cluster-$K8S_VERSION_NODOT-public-1 | |
| - from: | |
| name: cluster-$K8S_VERSION_NODOT-public-2 | |
| securityGroupRefs: | |
| - from: | |
| name: cluster-$K8S_VERSION_NODOT-vpce-sg | |
| vpcEndpointType: Interface | |
| privateDNSEnabled: true | |
| policyDocument: | | |
| { | |
| "Version": "2012-10-17", | |
| "Statement": [ | |
| { | |
| "Effect": "Allow", | |
| "Principal": "*", | |
| "Action": "*", | |
| "Resource": "*" | |
| } | |
| ] | |
| } | |
| tags: | |
| - key: Name | |
| value: cluster-$K8S_VERSION_NODOT-ecr-api-endpoint | |
| EOF | |
| - name: Deploy VPC Endpoint for ECR Docker | |
| run: | | |
| echo "Deploying VPC Endpoint for ECR Docker..." | |
| cat <<EOF | kubectl apply -f - | |
| apiVersion: ec2.services.k8s.aws/v1alpha1 | |
| kind: VPCEndpoint | |
| metadata: | |
| name: cluster-$K8S_VERSION_NODOT-ecr-dkr-endpoint | |
| spec: | |
| serviceName: com.amazonaws.eu-central-1.ecr.dkr | |
| vpcRef: | |
| from: | |
| name: cluster-$K8S_VERSION_NODOT | |
| subnetRefs: | |
| - from: | |
| name: cluster-$K8S_VERSION_NODOT-public-1 | |
| - from: | |
| name: cluster-$K8S_VERSION_NODOT-public-2 | |
| securityGroupRefs: | |
| - from: | |
| name: cluster-$K8S_VERSION_NODOT-vpce-sg | |
| vpcEndpointType: Interface | |
| privateDNSEnabled: true | |
| policyDocument: | | |
| { | |
| "Version": "2012-10-17", | |
| "Statement": [ | |
| { | |
| "Effect": "Allow", | |
| "Principal": "*", | |
| "Action": "*", | |
| "Resource": "*" | |
| } | |
| ] | |
| } | |
| tags: | |
| - key: Name | |
| value: cluster-$K8S_VERSION_NODOT-ecr-dkr-endpoint | |
| EOF | |
| - name: Deploy VPC Endpoint for STS | |
| run: | | |
| echo "Deploying VPC Endpoint for STS..." | |
| cat <<EOF | kubectl apply -f - | |
| apiVersion: ec2.services.k8s.aws/v1alpha1 | |
| kind: VPCEndpoint | |
| metadata: | |
| name: cluster-$K8S_VERSION_NODOT-sts-endpoint | |
| spec: | |
| serviceName: com.amazonaws.eu-central-1.sts | |
| vpcRef: | |
| from: | |
| name: cluster-$K8S_VERSION_NODOT | |
| subnetRefs: | |
| - from: | |
| name: cluster-$K8S_VERSION_NODOT-public-1 | |
| - from: | |
| name: cluster-$K8S_VERSION_NODOT-public-2 | |
| securityGroupRefs: | |
| - from: | |
| name: cluster-$K8S_VERSION_NODOT-vpce-sg | |
| vpcEndpointType: Interface | |
| privateDNSEnabled: true | |
| policyDocument: | | |
| { | |
| "Version": "2012-10-17", | |
| "Statement": [ | |
| { | |
| "Effect": "Allow", | |
| "Principal": "*", | |
| "Action": "*", | |
| "Resource": "*" | |
| } | |
| ] | |
| } | |
| tags: | |
| - key: Name | |
| value: cluster-$K8S_VERSION_NODOT-sts-endpoint | |
| EOF | |
| # Add a wait step for VPC Endpoints | |
| - name: Wait for VPC Endpoints Provisioning | |
| run: | | |
| echo "Waiting for VPC Endpoints to become Ready..." | |
| kubectl wait --for=condition=ACK.ResourceSynced --timeout=600s vpcendpoint/cluster-$K8S_VERSION_NODOT-ec2-endpoint | |
| kubectl wait --for=condition=ACK.ResourceSynced --timeout=600s vpcendpoint/cluster-$K8S_VERSION_NODOT-ecr-api-endpoint | |
| kubectl wait --for=condition=ACK.ResourceSynced --timeout=600s vpcendpoint/cluster-$K8S_VERSION_NODOT-ecr-dkr-endpoint | |
| kubectl wait --for=condition=ACK.ResourceSynced --timeout=600s vpcendpoint/cluster-$K8S_VERSION_NODOT-sts-endpoint | |
| - name: Deploy Cluster CR via EKS Controller | |
| run: | | |
| echo "Deploying EKS Cluster resource with Kubernetes version ${{ matrix.k8s_version }}..." | |
| cat <<EOF | kubectl apply -f - | |
| apiVersion: eks.services.k8s.aws/v1alpha1 | |
| kind: Cluster | |
| metadata: | |
| name: cluster-$K8S_VERSION_NODOT | |
| spec: | |
| name: cluster-$K8S_VERSION_NODOT | |
| roleARN: arn:aws:iam::654654440307:role/EKSClusterRole | |
| version: "${{ matrix.k8s_version }}" | |
| resourcesVPCConfig: | |
| endpointPrivateAccess: true | |
| endpointPublicAccess: true | |
| publicAccessCIDRs: | |
| - 0.0.0.0/0 | |
| securityGroupRefs: | |
| - from: | |
| name: cluster-$K8S_VERSION_NODOT-eks-sg | |
| subnetRefs: | |
| - from: | |
| name: cluster-$K8S_VERSION_NODOT-public-1 | |
| - from: | |
| name: cluster-$K8S_VERSION_NODOT-public-2 | |
| EOF | |
| - name: Wait for Cluster Provisioning | |
| run: | | |
| echo "Waiting for EKS Cluster resource to become Ready..." | |
| kubectl wait --for=condition=ACK.ResourceSynced --timeout=900s cluster/cluster-$K8S_VERSION_NODOT | |
| - name: Check Cluster status | |
| if: always() | |
| run: | | |
| kubectl get cluster/cluster-$K8S_VERSION_NODOT -o yaml | |
| - name: Deploy Nodegroup CR via EKS Controller | |
| run: | | |
| echo "Deploying EKS Nodegroup resource with Kubernetes version ${{ matrix.k8s_version }}..." | |
| cat <<EOF | kubectl apply -f - | |
| apiVersion: eks.services.k8s.aws/v1alpha1 | |
| kind: Nodegroup | |
| metadata: | |
| name: cluster-$K8S_VERSION_NODOT | |
| spec: | |
| version: "${{ matrix.k8s_version }}" | |
| amiType: AL2_x86_64 | |
| name: cluster-$K8S_VERSION_NODOT | |
| clusterRef: | |
| from: | |
| name: cluster-$K8S_VERSION_NODOT | |
| nodeRole: arn:aws:iam::654654440307:role/eks-node-role | |
| subnetRefs: | |
| - from: | |
| name: cluster-$K8S_VERSION_NODOT-public-1 | |
| - from: | |
| name: cluster-$K8S_VERSION_NODOT-public-2 | |
| remoteAccess: | |
| ec2SshKey: nodegroups | |
| sourceSecurityGroupRefs: | |
| - from: | |
| name: cluster-$K8S_VERSION_NODOT-node-sg | |
| instanceTypes: | |
| - t3.medium | |
| diskSize: 50 | |
| scalingConfig: | |
| minSize: 2 | |
| maxSize: 5 | |
| desiredSize: 3 | |
| tags: | |
| cluster-${K8S_VERSION_NODOT}: owned | |
| EOF | |
| - name: Wait for Nodegroup Provisioning | |
| run: | | |
| echo "Waiting for EKS Nodegroup resource to become Ready..." | |
| kubectl wait --for=condition=ACK.ResourceSynced --timeout=3600s nodegroup/cluster-$K8S_VERSION_NODOT | |
| - name: Check Nodegroup status | |
| if: always() | |
| run: | | |
| kubectl get nodegroup/cluster-$K8S_VERSION_NODOT -o yaml | |
| - name: Get kubeconfig | |
| run: AWS_SHARED_CREDENTIALS_FILE=./credentials aws eks update-kubeconfig --region eu-central-1 --name cluster-${K8S_VERSION_NODOT} --profile dev | |
| - name: Get events | |
| if: always() | |
| run: kubectl get events -A --sort-by='.lastTimestamp' | |
| - name: Get deployments | |
| if: always() | |
| run: kubectl get deployments -n | |
| - name: Clean Up Sensitive Files | |
| run: rm -f certificato.txt chiave_privata_decifrata.key ./credentials | |
| - name: Clean Up Nodegroup Resource | |
| if: always() | |
| run: kubectl delete nodegroup/cluster-$K8S_VERSION_NODOT | |
| - name: Clean Up Cluster Resource | |
| if: always() | |
| run: kubectl delete cluster/cluster-$K8S_VERSION_NODOT | |
| - name: Clean Up VPC Endpoints Resources | |
| run: | | |
| kubectl delete vpcendpoint/cluster-$K8S_VERSION_NODOT-ec2-endpoint | |
| kubectl delete vpcendpoint/cluster-$K8S_VERSION_NODOT-ecr-api-endpoint | |
| kubectl delete vpcendpoint/cluster-$K8S_VERSION_NODOT-ecr-dkr-endpoint | |
| kubectl delete vpcendpoint/cluster-$K8S_VERSION_NODOT-sts-endpoint | |
| - name: Clean Up VPC Endpoints Security Group Resource | |
| run: kubectl delete securitygroup/cluster-$K8S_VERSION_NODOT-vpce-sg | |
| - name: Celan Up Node Security Group Resource | |
| run: kubectl delete securitygroup/cluster-$K8S_VERSION_NODOT-node-sg | |
| - name: Clean Up EKS Security Group Resource | |
| run: kubectl delete securitygroup/cluster-$K8S_VERSION_NODOT-eks-sg | |
| - name: Clean Up Public Subnet-2 Resource | |
| run: kubectl delete subnet/cluster-$K8S_VERSION_NODOT-public-2 | |
| - name: Clean Up Public Subnet-1 Resource | |
| run: kubectl delete subnet/cluster-$K8S_VERSION_NODOT-public-1 | |
| - name: Clean Up Route Table Resource | |
| run: kubectl delete routetable/cluster-$K8S_VERSION_NODOT-public-rt | |
| - name: Clean Up Internet Gateway Resource | |
| run: kubectl delete internetgateway/cluster-$K8S_VERSION_NODOT-igw | |
| - name: Clean Up VPC Resource | |
| run: kubectl delete vpc/cluster-$K8S_VERSION_NODOT |