-
Notifications
You must be signed in to change notification settings - Fork 4
138 lines (122 loc) · 4.98 KB
/
aws-harbor.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
name: "aws-harbor"
on:
workflow_call:
inputs:
email-address:
description: "An email address to be used as the owner for the public trusted domain certificate vended by Let's Encrypt"
type: string
required: true
domain:
description: "A domain that the installation of Harbor will be addressable from"
type: string
required: true
region:
description: "The AWS region of the cluster where the Harbor instance will be available"
type: string
required: true
action:
required: true
description: "Create (new) or destroy (existing)"
type: string
secrets:
AWS_ACCESS_KEY_ID:
required: false
AWS_SECRET_ACCESS_KEY:
required: false
AWS_SESSION_TOKEN:
required: false
TF_BACKEND_S3_BUCKET_NAME:
required: true
AWS_KMS_ALIAS:
required: true
KUBECONFIG_CONTENTS:
required: true
outputs:
harbor_domain:
description: "The domain from which the Harbor instance is addressable"
value: ${{ jobs.terraform.outputs.harbor_domain }}
harbor_admin_username:
description: "The Harbor administrator account's username"
value: ${{ jobs.terraform.outputs.harbor_admin_username }}
harbor_admin_password:
description: "The Harbor administrator account's password"
value: ${{ jobs.terraform.outputs.harbor_admin_password }}
jobs:
terraform:
env:
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
AWS_REGION: ${{ inputs.region }}
AWS_SESSION_TOKEN: ${{ secrets.AWS_SESSION_TOKEN }}
TF_VAR_acme_email: ${{ inputs.email-address }}
TF_VAR_domain: ${{ inputs.domain }}
TF_VAR_kubeconfig_path: "/tmp/.kube/config"
KUBECONFIG: "/tmp/.kube/config"
runs-on: ubuntu-22.04
outputs:
harbor_domain: ${{ steps.set_outputs.outputs.harbor_domain }}
harbor_admin_username: ${{ steps.set_outputs.outputs.harbor_admin_username }}
harbor_admin_password: ${{ steps.set_outputs.outputs.harbor_admin_password }}
# Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-22.04, macos-latest, or windows-latest
defaults:
run:
shell: bash
working-directory: terraform/k8s/harbor
steps:
# Checkout the repository to the GitHub Actions runner
- name: Checkout
uses: actions/checkout@v4
# Install the latest version of Terraform CLI
- name: Setup Terraform
uses: hashicorp/setup-terraform@v2
with:
terraform_wrapper: false
terraform_version: 1.5.7
- name: Generate backend configuration
run: |
cp ../../aws/backend/backend.tf .
echo "bucket = \"${{ secrets.TF_BACKEND_S3_BUCKET_NAME }}\"" > config.aws.tfbackend
echo "key = \"harbor/terraform.tfstate\"" >> config.aws.tfbackend
echo "region = \"${{ env.AWS_REGION }}\"" >> config.aws.tfbackend
echo "encrypt = true" >> config.aws.tfbackend
echo "kms_key_id = \"${{ secrets.AWS_KMS_ALIAS }}\"" >> config.aws.tfbackend
echo "dynamodb_table = \"${{ secrets.TF_BACKEND_S3_BUCKET_NAME }}\"" >> config.aws.tfbackend
- name: Install Carvel tools
run: |
KAPP_VERSION=0.59.1
wget -O kapp https://github.com/vmware-tanzu/carvel-kapp/releases/download/v${KAPP_VERSION}/kapp-linux-amd64
chmod +x kapp
sudo mv kapp /usr/bin
- name: Generate .kube/config
env:
KUBECONFIG_CONTENTS: ${{ secrets.KUBECONFIG_CONTENTS }}
run: |
mkdir -p /tmp/.kube
echo "$KUBECONFIG_CONTENTS" | base64 -d > /tmp/.kube/config
chmod 600 /tmp/.kube/config
# Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
- name: Terraform Init
run: terraform init -upgrade -backend-config=./config.aws.tfbackend
# Checks that all Terraform configuration files adhere to a canonical format
- name: Terraform Format
run: terraform fmt -check
# Generates an execution plan for Terraform
- name: Terraform Plan
if: inputs.action == 'create'
run: terraform plan
- name: Terraform Apply
if: inputs.action == 'create'
run: terraform apply -auto-approve
- name: Terraform Destroy
if: inputs.action == 'destroy'
run: terraform destroy -auto-approve
- name: Set Outputs
id: set_outputs
if: inputs.action == 'create'
run: |
harbor_domain=$(terraform output --raw harbor_domain)
echo "harbor_domain=${harbor_domain}" >> $GITHUB_OUTPUT
harbor_admin_username=$(terraform output --raw harbor_admin_username)
echo "harbor_admin_username=${harbor_admin_username}" >> $GITHUB_OUTPUT
harbor_admin_password=$(terraform output --raw harbor_admin_password)
echo "harbor_admin_password=${harbor_admin_password}" >> $GITHUB_OUTPUT