dnoulet/go-tell
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

deploy configuration

Browse source
This commit is contained in:
Daniel Noulet 2026-10-03 04:41:31 +02:00
parent 9ba3c47d82
commit dac02c61c3
45 changed files with 1405 additions and 582 deletions
Download patch file Download diff file Expand all files Collapse all files

43
.github/workflows/deploy-rancher.yml vendored
View file

@ -26,7 +26,7 @@ permissions:
contents: read
concurrency:
group: cms-${{ github.event_name == 'workflow_dispatch' && inputs.environment || 'production' }}
group: go-tell-${{ github.event_name == 'workflow_dispatch' && inputs.environment || 'production' }}
cancel-in-progress: false
jobs:
@ -47,6 +47,9 @@ jobs:
CMS_ALLOWED_ORIGINS: ${{ vars.CMS_ALLOWED_ORIGINS }}
CMS_SSO_HEADER: ${{ vars.CMS_SSO_HEADER }}
CMS_SSO_COOKIE: ${{ vars.CMS_SSO_COOKIE }}
GO_LOOSE_CLIENT_ID: ${{ secrets.GO_LOOSE_CLIENT_ID }}
GO_LOOSE_CLIENT_SECRET: ${{ secrets.GO_LOOSE_CLIENT_SECRET }}
LOCAL_CA_CERT: ${{ secrets.LOCAL_CA_CERT }}
RANCHER_NAMESPACE: ${{ vars.RANCHER_NAMESPACE }}
steps:
@ -79,7 +82,11 @@ jobs:
echo "REGISTRY_USERNAME and REGISTRY_PASSWORD are required" >&2
exit 1
fi
namespace="${RANCHER_NAMESPACE:-cms-$TARGET_ENVIRONMENT}"
if [ -z "$GO_LOOSE_CLIENT_ID" ] || [ -z "$GO_LOOSE_CLIENT_SECRET" ]; then
echo "GO_LOOSE_CLIENT_ID and GO_LOOSE_CLIENT_SECRET are required: they come from the Go Loose console" >&2
exit 1
fi
namespace="${RANCHER_NAMESPACE:-go-tell-$TARGET_ENVIRONMENT}"
if [ -n "$PUBLISHED_SHA" ]; then
image_tag="$PUBLISHED_SHA"
else
@ -88,9 +95,9 @@ jobs:
allowed_origins="$CMS_ALLOWED_ORIGINS"
if [ -z "$allowed_origins" ]; then
if [ "$TARGET_ENVIRONMENT" = "production" ]; then
allowed_origins="https://cms.urpi.be"
allowed_origins="https://tell.dev"
else
allowed_origins="http://localhost:30081"
allowed_origins="http://localhost:30010"
fi
fi
{
@ -112,28 +119,42 @@ jobs:
set -eu
kubectl create namespace "$DEPLOY_NAMESPACE" \
--dry-run=client -o yaml | kubectl apply -f -
kubectl -n "$DEPLOY_NAMESPACE" create secret docker-registry cms-registry \
kubectl -n "$DEPLOY_NAMESPACE" create secret docker-registry go-tell-registry \
--docker-server=batty1039.startdedicated.net:5000 \
--docker-username="$REGISTRY_USERNAME" \
--docker-password="$REGISTRY_PASSWORD" \
--dry-run=client -o yaml | kubectl apply -f -
- name: Publish the internal certificate authority
if: ${{ env.LOCAL_CA_CERT != '' }}
run: |
set -eu
printf '%s' "$LOCAL_CA_CERT" | base64 --decode > "$RUNNER_TEMP/local-ca.crt"
kubectl -n "$DEPLOY_NAMESPACE" create secret generic local-ca \
--from-file=ca.crt="$RUNNER_TEMP/local-ca.crt" \
--dry-run=client -o yaml | kubectl apply -f -
- name: Deploy Helm release
run: |
set -eu
values_file="deploy/helm/cms/values-$TARGET_ENVIRONMENT.yaml"
values_file="deploy/helm/go-tell/values-$TARGET_ENVIRONMENT.yaml"
set -- \
--set-string "image.tag=$IMAGE_TAG" \
--set "imagePullSecrets[0].name=cms-registry" \
--set "imagePullSecrets[0].name=go-tell-registry" \
--set-string "app.allowedOrigins=$RESOLVED_ALLOWED_ORIGINS" \
--set-string "secrets.ssoToken=$CMS_SSO_TOKEN"
--set-string "secrets.ssoToken=$CMS_SSO_TOKEN" \
--set-string "goLoose.clientID=$GO_LOOSE_CLIENT_ID" \
--set-string "goLoose.clientSecret=$GO_LOOSE_CLIENT_SECRET"
if [ -n "$LOCAL_CA_CERT" ]; then
set -- "$@" --set-string goLoose.ca.existingSecret=local-ca
fi
if [ -n "$CMS_SSO_HEADER" ]; then
set -- "$@" --set-string "app.ssoHeader=$CMS_SSO_HEADER"
fi
if [ -n "$CMS_SSO_COOKIE" ]; then
set -- "$@" --set-string "app.ssoCookie=$CMS_SSO_COOKIE"
fi
helm upgrade --install cms deploy/helm/cms \
helm upgrade --install go-tell deploy/helm/go-tell \
--namespace "$DEPLOY_NAMESPACE" \
--values "$values_file" \
--atomic \
@ -143,6 +164,6 @@ jobs:
- name: Verify deployment
run: |
kubectl -n "$DEPLOY_NAMESPACE" rollout status deployment/cms \
kubectl -n "$DEPLOY_NAMESPACE" rollout status deployment/go-tell \
--timeout=5m
helm test cms --namespace "$DEPLOY_NAMESPACE" --logs
helm test go-tell --namespace "$DEPLOY_NAMESPACE" --logs