Add LF cluster CI/CD to production workflows

zxiiro · claude · zxiiro · commit 6e3272cdcdfe · 2026-06-15T16:18:11.000-04:00
Extend _osdc-deploy.yml and _osdc-plan.yml with an optional
aws_role_arn input so LF clusters can use LF_AWS_* secrets
without affecting existing Meta cluster workflows (falls back
to META_AWS_* when not provided).

Add LF cluster jobs directly to osdc-deploy-prod.yml alongside
the existing Meta jobs. The all target deploys Meta and LF chains
in parallel; all-meta and all-lf deploy only one account's
clusters. Individual cluster targets are unchanged.

Add LF plan jobs to osdc-plan-prod.yml so PRs run tofu plan
against both LF clusters. LF jobs are gated by the
osdc-lf-production GitHub environment.

Co-Authored-By: Claude Sonnet 4.6 &lt;noreply@anthropic.com&gt;
diff --git a/.github/workflows/_osdc-deploy.yml b/.github/workflows/_osdc-deploy.yml
@@ -12,6 +12,11 @@ on:
         required: false
         type: string
         default: ""
+      aws_role_arn:
+        description: "IAM role ARN to assume for AWS operations. Defaults to META_AWS_ACC_ID + META_AWS_DEPLOY_ROLE secrets."
+        required: false
+        type: string
+        default: ""
       taint_nodes:
         description: "Taint ARC runner nodes with NoSchedule before deploy for graceful refresh"
         required: false
@@ -84,7 +89,7 @@ jobs:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
         with:
-          role-to-assume: arn:aws:iam::${{ secrets.META_AWS_ACC_ID }}:role/${{ secrets.META_AWS_DEPLOY_ROLE }}
+          role-to-assume: ${{ inputs.aws_role_arn || format('arn:aws:iam::{0}:role/{1}', secrets.META_AWS_ACC_ID, secrets.META_AWS_DEPLOY_ROLE) }}
           aws-region: us-west-1
           role-duration-seconds: 7200
 
@@ -134,7 +139,7 @@ jobs:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
         with:
-          role-to-assume: arn:aws:iam::${{ secrets.META_AWS_ACC_ID }}:role/${{ secrets.META_AWS_DEPLOY_ROLE }}
+          role-to-assume: ${{ inputs.aws_role_arn || format('arn:aws:iam::{0}:role/{1}', secrets.META_AWS_ACC_ID, secrets.META_AWS_DEPLOY_ROLE) }}
           aws-region: us-west-1
           role-duration-seconds: 7200
 
@@ -175,7 +180,7 @@ jobs:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
         with:
-          role-to-assume: arn:aws:iam::${{ secrets.META_AWS_ACC_ID }}:role/${{ secrets.META_AWS_DEPLOY_ROLE }}
+          role-to-assume: ${{ inputs.aws_role_arn || format('arn:aws:iam::{0}:role/{1}', secrets.META_AWS_ACC_ID, secrets.META_AWS_DEPLOY_ROLE) }}
           aws-region: us-west-1
           role-duration-seconds: 7200
 
diff --git a/.github/workflows/_osdc-plan.yml b/.github/workflows/_osdc-plan.yml
@@ -9,6 +9,16 @@ on:
       pr_number:
         required: true
         type: number
+      environment:
+        description: "GitHub environment for secrets/gating (default: osdc-staging)"
+        required: false
+        type: string
+        default: osdc-staging
+      aws_role_arn:
+        description: "IAM role ARN to assume for AWS operations. Defaults to META_AWS_ACC_ID + META_AWS_DEPLOY_PLAN_ROLE secrets."
+        required: false
+        type: string
+        default: ""
 
 permissions:
   id-token: write
@@ -23,7 +33,7 @@ jobs:
   plan:
     name: tofu plan (${{ inputs.cluster }})
     runs-on: ubuntu-latest
-    environment: osdc-staging
+    environment: ${{ inputs.environment }}
     timeout-minutes: 45
     # Serialize all tofu state-locking work per cluster. Shared with
     # _osdc-deploy.yml so plan and deploy against the same cluster never
@@ -50,7 +60,7 @@ jobs:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
         with:
-          role-to-assume: arn:aws:iam::${{ secrets.META_AWS_ACC_ID }}:role/${{ secrets.META_AWS_DEPLOY_PLAN_ROLE }}
+          role-to-assume: ${{ inputs.aws_role_arn || format('arn:aws:iam::{0}:role/{1}', secrets.META_AWS_ACC_ID, secrets.META_AWS_DEPLOY_PLAN_ROLE) }}
           aws-region: us-west-2
           role-duration-seconds: 3600
 
diff --git a/.github/workflows/osdc-deploy-prod.yml b/.github/workflows/osdc-deploy-prod.yml
@@ -1,14 +1,16 @@
 name: "OSDC: Deploy production"
 
-# Manual rollout for prod. Protected by the `osdc-production` GitHub
-# environment (configure required reviewers in repo Settings → Environments) —
-# the prod IAM role additionally trusts only tokens with
-# `environment:osdc-production` in the sub claim, so IAM enforces the gate too.
+# Manual rollout for prod. Protected by per-account GitHub environments:
+#   - Meta clusters: `osdc-production` environment
+#   - LF clusters:   `osdc-lf-production` environment
+# Each environment's IAM role trusts only tokens carrying that environment
+# name in the sub claim, so IAM enforces the gate independently.
 #
-# Default behavior (target = all): sequential rollout.
-#   1. Deploy arc-cbr-production-uw1 + smoke.
-#   2. Deploy arc-cbr-production (ue2) + smoke.
-#   3. Deploy meta-prod-aws-ue1 + smoke.
+# Default behavior (target = all): sequential rollout of all clusters.
+#   Meta: arc-cbr-production-uw1 → arc-cbr-production → meta-prod-aws-ue1
+#   LF:   lf-prod-aws-ue1 → lf-prod-aws-ue2 (runs in parallel with Meta)
+#
+# Use `all-meta` or `all-lf` to deploy only one account's clusters.
 #
 # Picking a specific cluster from the dropdown bypasses the sequencing and
 # deploys only that one — useful for hotfixes or to recover from a partial
@@ -27,9 +29,13 @@ on:
         default: all
         options:
           - all
-          - meta-prod-aws-ue1
+          - all-meta
+          - all-lf
           - arc-cbr-production-uw1
           - arc-cbr-production
+          - meta-prod-aws-ue1
+          - lf-prod-aws-ue1
+          - lf-prod-aws-ue2
       taint_nodes:
         description: "Taint ARC runner nodes before deploy (graceful refresh)"
         required: false
@@ -55,8 +61,10 @@ permissions:
   contents: read
 
 jobs:
+  # --- Meta clusters ---
+
   deploy_uw1:
-    if: ${{ inputs.target == 'all' || inputs.target == 'arc-cbr-production-uw1' }}
+    if: ${{ inputs.target == 'all' || inputs.target == 'all-meta' || inputs.target == 'arc-cbr-production-uw1' }}
     uses: ./.github/workflows/_osdc-deploy.yml
     with:
       cluster: arc-cbr-production-uw1
@@ -72,7 +80,7 @@ jobs:
     if: |
       !cancelled() && (
         inputs.target == 'arc-cbr-production' ||
-        (inputs.target == 'all' && needs.deploy_uw1.result == 'success')
+        ((inputs.target == 'all' || inputs.target == 'all-meta') && needs.deploy_uw1.result == 'success')
       )
     uses: ./.github/workflows/_osdc-deploy.yml
     with:
@@ -89,7 +97,7 @@ jobs:
     if: |
       !cancelled() && (
         inputs.target == 'meta-prod-aws-ue1' ||
-        (inputs.target == 'all' && needs.deploy_ue2.result == 'success')
+        ((inputs.target == 'all' || inputs.target == 'all-meta') && needs.deploy_ue2.result == 'success')
       )
     uses: ./.github/workflows/_osdc-deploy.yml
     with:
@@ -100,3 +108,36 @@ jobs:
       skip_lint_test: ${{ inputs.skip_lint_test }}
       run_smoke: true
     secrets: inherit
+
+  # --- LF clusters ---
+
+  deploy_lf_ue1:
+    if: ${{ inputs.target == 'all' || inputs.target == 'all-lf' || inputs.target == 'lf-prod-aws-ue1' }}
+    uses: ./.github/workflows/_osdc-deploy.yml
+    with:
+      cluster: lf-prod-aws-ue1
+      environment: osdc-production
+      aws_role_arn: ${{ secrets.LF_AWS_DEPLOY_ROLE_ARN }}
+      taint_nodes: ${{ inputs.taint_nodes }}
+      restart_listeners: ${{ inputs.restart_listeners }}
+      skip_lint_test: ${{ inputs.skip_lint_test }}
+      run_smoke: true
+    secrets: inherit
+
+  deploy_lf_ue2:
+    needs: deploy_lf_ue1
+    if: |
+      !cancelled() && (
+        inputs.target == 'lf-prod-aws-ue2' ||
+        ((inputs.target == 'all' || inputs.target == 'all-lf') && needs.deploy_lf_ue1.result == 'success')
+      )
+    uses: ./.github/workflows/_osdc-deploy.yml
+    with:
+      cluster: lf-prod-aws-ue2
+      environment: osdc-production
+      aws_role_arn: ${{ secrets.LF_AWS_DEPLOY_ROLE_ARN }}
+      taint_nodes: ${{ inputs.taint_nodes }}
+      restart_listeners: ${{ inputs.restart_listeners }}
+      skip_lint_test: ${{ inputs.skip_lint_test }}
+      run_smoke: true
+    secrets: inherit
diff --git a/.github/workflows/osdc-plan-prod.yml b/.github/workflows/osdc-plan-prod.yml
@@ -47,3 +47,27 @@ jobs:
       cluster: meta-prod-aws-ue1
       pr_number: ${{ github.event.pull_request.number }}
     secrets: inherit
+
+  plan_lf_ue1:
+    needs: plan_ue1
+    if: |
+      !cancelled() &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    uses: ./.github/workflows/_osdc-plan.yml
+    with:
+      cluster: lf-prod-aws-ue1
+      aws_role_arn: ${{ secrets.LF_AWS_PLAN_ROLE_ARN }}
+      pr_number: ${{ github.event.pull_request.number }}
+    secrets: inherit
+
+  plan_lf_ue2:
+    needs: plan_lf_ue1
+    if: |
+      !cancelled() &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    uses: ./.github/workflows/_osdc-plan.yml
+    with:
+      cluster: lf-prod-aws-ue2
+      aws_role_arn: ${{ secrets.LF_AWS_PLAN_ROLE_ARN }}
+      pr_number: ${{ github.event.pull_request.number }}
+    secrets: inherit
