Skip to content

New settings after INFN-CLOUD-BARI site re-installation (#290) #410

New settings after INFN-CLOUD-BARI site re-installation (#290)

New settings after INFN-CLOUD-BARI site re-installation (#290) #410

Workflow file for this run

---
name: 'Deploy'
on:
push:
branches:
- main
pull_request:
paths:
- "deploy/**"
jobs:
terraform:
name: 'Terraform'
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v3
- name: Setup python
uses: actions/setup-python@v4
with:
python-version: 3.x
- name: Install environment
run: |
curl -L https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64 > jq
chmod +x jq
pip install yq git+https://github.com/tdviet/fedcloudclient.git
curl -L https://github.com/oidc-mytoken/client/releases/download/v0.3.0/mytoken_0.3.0_Linux_x86_64.tar.gz \
| tar -xzf -
mkdir ~/.mytoken
curl https://raw.githubusercontent.com/oidc-mytoken/client/master/config/example-config.yaml > ~/.mytoken/config.yaml
- name: Configure providers access
env:
MYTOKEN: ${{ secrets.MYTOKEN }}
REFRESH_TOKEN: ${{ secrets.REFRESH_TOKEN }}
run: |
OIDC_TOKEN=$(curl -X POST "https://aai.egi.eu/auth/realms/egi/protocol/openid-connect/token" \
-d "grant_type=refresh_token&refresh_token=$REFRESH_TOKEN&client_id=token-portal&scope=openid%20email%20profile%20voperson_id%20eduperson_entitlement" \
| jq -r ".access_token")
echo "::add-mask::$OIDC_TOKEN"
cd deploy
BACKEND_SITE="$(yq -r .clouds.backend.site clouds.yaml)"
BACKEND_VO="$(yq -r .clouds.backend.vo clouds.yaml)"
EGI_SITE="$(yq -r .clouds.deploy.site clouds.yaml)"
DEPLOY_VO="$(yq -r .clouds.deploy.vo clouds.yaml)"
echo "EGI_SITE=$EGI_SITE" >> "$GITHUB_ENV"
BACKEND_OS_TOKEN="$(fedcloud openstack token issue --oidc-access-token "$OIDC_TOKEN" \
--site "$BACKEND_SITE" --vo "$BACKEND_VO" -j | jq -r '.[0].Result.id')"
echo "::add-mask::$BACKEND_OS_TOKEN"
sed -i -e "s/backend_secret/$BACKEND_OS_TOKEN/" clouds.yaml
DEPLOY_OS_TOKEN="$(fedcloud openstack token issue --oidc-access-token "$OIDC_TOKEN" \
--site "$EGI_SITE" --vo "$DEPLOY_VO" -j | jq -r '.[0].Result.id')"
echo "::add-mask::$DEPLOY_OS_TOKEN"
sed -i -e "s/deploy_secret/$DEPLOY_OS_TOKEN/" clouds.yaml
mkdir -p ~/.config/openstack
touch ~/.config/openstack/secure.yaml
- name: Setup Terraform
uses: hashicorp/setup-terraform@v2
with:
terraform_version: 1.2.9
- name: Terraform Format
id: fmt
run: |
cd deploy
terraform fmt -check
- name: Terraform init
id: init
run: |
cd deploy
terraform init
- name: Generate token for gettint git repo at VM
uses: tibdex/github-app-token@v1
id: generate-token
with:
app_id: ${{ secrets.APP_ID }}
private_key: ${{ secrets.APP_PRIVATE_KEY }}
- name: Adjust cloud-init file
env:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
ANSIBLE_SECRETS: ${{ secrets.ANSIBLE_SECRETS }}
run: |
cd deploy
sed -i -e "s/%TOKEN%/${{ steps.generate-token.outputs.token }}/" cloud-init.yaml
sed -i -e "s/%REF%/${{ github.sha }}/" cloud-init.yaml
sed -i -e "s/%SHORT_REF%/$(git rev-parse --short HEAD)/" cloud-init.yaml
sed -i -e "s#%SLACK_WEBHOOK_URL%#$SLACK_WEBHOOK_URL#" cloud-init.yaml
ANSIBLE_ENCODED_SECRETS="$(echo "$ANSIBLE_SECRETS" | base64 -w 0)"
echo "::add-mask::$ANSIBLE_ENCODED_SECRETS"
sed -i -e "s/%ANSIBLE_SECRETS%/$ANSIBLE_ENCODED_SECRETS/" cloud-init.yaml
- name: terraform plan
id: plan
if: github.event_name == 'pull_request'
run: |
cd deploy
terraform plan -no-color -var-file="$EGI_SITE.tfvars"
continue-on-error: true
- name: Update Pull Request
uses: actions/github-script@v6
if: github.event_name == 'pull_request'
env:
PLAN: "terraform\n${{ steps.plan.outputs.stdout }}"
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const output = `#### Terraform Format and Style 🖌\`${{ steps.fmt.outcome }}\`
#### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\`
#### Terraform Plan 📖\`${{ steps.plan.outcome }}\`
<details><summary>Show Plan</summary>
\`\`\`
${process.env.PLAN}
\`\`\`
</details>
*Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`*`;
github.rest.issues.createComment({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: output
})
- name: Terraform Plan Status
if: steps.plan.outcome == 'failure'
run: exit 1
- name: Terraform Apply
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
run: |
cd deploy
terraform apply -auto-approve -var-file="$EGI_SITE.tfvars"