Skip to content

Commit efa291b

Browse files
YilingCAIYilingCAI
authored
Merge pull request #20 from YilingCAI/feature/cai
Feature/cai
2 parents c1d2494 + 737d5b2 commit efa291b

12 files changed

Lines changed: 366 additions & 52 deletions

File tree

‎.github/actions/aws-auth/action.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,8 @@ runs:
4747
aws-region: ${{ inputs.aws-region }}
4848
role-session-name: ${{ inputs.session-name }}
4949
role-duration-seconds: ${{ inputs.duration-seconds }}
50+
audience: sts.amazonaws.com
51+
unset-current-credentials: true
5052

5153
- name: Get AWS Account ID
5254
id: aws-account

‎.github/actions/deploy-env/action.yml‎

Lines changed: 35 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,9 @@ inputs:
2626
gitops-repo:
2727
description: "Owner/name of the GitOps repository"
2828
required: true
29+
target-environment:
30+
description: "EKs env"
31+
required: true
2932

3033
# ── K8s / AWS ─────────────────────────────────────────────────────────────
3134
eks-cluster-name:
@@ -101,33 +104,9 @@ inputs:
101104
runs:
102105
using: "composite"
103106
steps:
104-
# ── 1. Update GitOps repo ───────────────────────────────────────────────
105-
- name: "Checkout GitOps repo"
106-
uses: actions/checkout@v4
107-
with:
108-
repository: ${{ inputs.gitops-repo }}
109-
token: ${{ inputs.gitops-deploy-token }}
110-
path: _gitops
111-
112-
- name: "Patch image tag (${{ inputs.gitops-env }} → ${{ inputs.image-tag }})"
113-
shell: bash
114-
run: |
115-
docker run --rm --user root -v "$PWD/_gitops:/gitops" mikefarah/yq:4 \
116-
e '.backend.image.tag = "${{ inputs.image-tag }}" | .frontend.image.tag = "${{ inputs.image-tag }}"' \
117-
-i /gitops/environments/${{ inputs.gitops-env }}/values.yaml
118-
119-
- name: "Commit & push GitOps change"
120-
shell: bash
121-
run: |
122-
cd _gitops
123-
git config user.name "github-actions[bot]"
124-
git config user.email "github-actions[bot]@users.noreply.github.com"
125-
git add environments/${{ inputs.gitops-env }}/values.yaml
126-
git diff --cached --quiet && echo "No changes to commit" && exit 0
127-
git commit -m "chore(deploy): ${{ inputs.gitops-env }} image tag ${{ inputs.image-tag }} [skip ci]"
128-
git push origin main
129-
130-
# ── 2. Authenticate with AWS ────────────────────────────────────────────
107+
# ── 1. Authenticate with AWS & write K8s secret FIRST ──────────────────
108+
# Must happen before the gitops commit so that pods starting in response
109+
# to the ArgoCD sync always find a secret with the correct DATABASE_HOST.
131110
- name: "Authenticate with AWS"
132111
uses: ./.github/actions/aws-auth
133112
with:
@@ -141,7 +120,7 @@ runs:
141120
--name ${{ inputs.eks-cluster-name }} \
142121
--region ${{ inputs.aws-region }}
143122
144-
# ── 3. Upsert K8s DB secret ─────────────────────────────────────────────
123+
# ── 2. Upsert K8s DB secret ─────────────────────────────────────────────
145124
- name: "Upsert DB credentials secret"
146125
shell: bash
147126
run: |
@@ -154,6 +133,34 @@ runs:
154133
--from-literal=password=${{ inputs.db-password }} \
155134
--dry-run=client -o yaml | kubectl apply -f -
156135
136+
# ── 3. Update GitOps repo (triggers ArgoCD sync) ────────────────────────
137+
# K8s secret is already correct above — pods that start from this sync
138+
# will find DATABASE_HOST populated immediately.
139+
- name: "Checkout GitOps repo"
140+
uses: actions/checkout@v4
141+
with:
142+
repository: ${{ inputs.gitops-repo }}
143+
token: ${{ inputs.gitops-deploy-token }}
144+
path: _gitops
145+
146+
- name: "Patch image tag (${{ inputs.gitops-env }} → ${{ inputs.image-tag }})"
147+
shell: bash
148+
run: |
149+
docker run --rm --user root -v "$PWD/_gitops:/gitops" mikefarah/yq:4 \
150+
e '.backend.image.tag = "${{ inputs.image-tag }}" | .frontend.image.tag = "${{ inputs.image-tag }}"' \
151+
-i /gitops/environments/${{ inputs.target-environment }}/values.yaml
152+
153+
- name: "Commit & push GitOps change"
154+
shell: bash
155+
run: |
156+
cd _gitops
157+
git config user.name "github-actions[bot]"
158+
git config user.email "github-actions[bot]@users.noreply.github.com"
159+
git add environments/${{ inputs.target-environment }}/values.yaml
160+
git diff --cached --quiet && echo "No changes to commit" && exit 0
161+
git commit -m "chore(deploy): ${{ inputs.gitops-env }} image tag ${{ inputs.image-tag }} [skip ci]"
162+
git push origin main
163+
157164
# ── 4. Wait for ArgoCD Healthy + Synced ────────────────────────────────
158165
- name: "Wait for ArgoCD sync (${{ inputs.argocd-app-name }})"
159166
shell: bash

0 commit comments

Comments
 (0)