From 14edd64a1fa40533223a8a7d60c85a321a20f188 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jean-Fran=C3=A7ois=20Bustarret?= Date: Tue, 10 Nov 2026 09:58:09 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=91=B7=20ci(kube-setup):=20fix=20preloade?= =?UTF-8?q?r=20snapshot,=20cleanup?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- kube-setup/action.yaml | 20 +++++++++++--------- kube-setup/cluster-template.yaml | 1 + kube-setup/setup.sh | 5 +++-- vault-additional/action.yml | 2 +- 4 files changed, 16 insertions(+), 12 deletions(-) diff --git a/kube-setup/action.yaml b/kube-setup/action.yaml index c7d4945..cd48015 100644 --- a/kube-setup/action.yaml +++ b/kube-setup/action.yaml @@ -1,12 +1,6 @@ name: 👷 Deploy a cluster description: This action bootstraps a Kube cluster using Cluster API. inputs: - OSC_ACCESS_KEY: - description: 'cluster access key (CSI/CCM)' - required: true - OSC_SECRET_KEY: - description: 'cluster secret key (CSI/CCM)' - required: true OSC_REGION: description: 'cluster region' required: true @@ -42,6 +36,8 @@ inputs: default: "false" KUSTOMIZE_PATH: description: 'path of kustomization config' + ALLOW_FROM: + description: 'Additional IP range to allow' vault_role: description: 'Vault role for JWT/OIDC auth method' required: true @@ -55,9 +51,14 @@ outputs: runs: using: 'composite' steps: + - name: 🩹 Safe config for 💩 DNS + shell: bash + run: | + sed 's/options /options use-vc single-request attempts:5 /' < /etc/resolv.conf > /etc/resolv.conf.new + cat /etc/resolv.conf.new > /etc/resolv.conf - name: 🔒️ Import Secrets from Vault id: import-secrets - uses: outscale/.github/vault-additional@854f0286b0ae38226218e02126e8fda7b8bd4ff7 # main + uses: outscale/.github/vault-additional@main with: vault_role: ${{ inputs.vault_role }} osc_account: birch @@ -72,11 +73,10 @@ runs: run: | ${{ github.action_path }}/setup.sh env: + ACTION_PATH: ${{ github.action_path }} OKS_ACCESS_KEY: ${{ steps.import-secrets.outputs.access_key }} OKS_SECRET_KEY: ${{ steps.import-secrets.outputs.secret_key }} OKS_REGION: ${{ steps.import-secrets.outputs.region }} - OSC_ACCESS_KEY: ${{ inputs.OSC_ACCESS_KEY }} - OSC_SECRET_KEY: ${{ inputs.OSC_SECRET_KEY }} OSC_REGION: ${{ inputs.OSC_REGION }} OSC_CLUSTER_NAME: ${{ inputs.CLUSTER_NAME }} OSC_IMAGE_NAME: ${{ inputs.IMAGE_NAME }} @@ -86,6 +86,7 @@ runs: CCM: ${{ inputs.CCM }} CERT_MANAGER: ${{ inputs.CERT_MANAGER }} KUSTOMIZE_PATH: ${{ inputs.KUSTOMIZE_PATH }} + OSC_ALLOW_FROM_DEV: ${{ inputs.ALLOW_FROM }} - name: 📸 Preloader snapshot if: ${{ inputs.PRELOADER_SNAPSHOT == 'true' }} shell: bash @@ -95,3 +96,4 @@ runs: KUBECONFIG : ${{ github.workspace }}/workload.kubeconfig ACTION_PATH: ${{ github.action_path }} PRELOADER_IMAGE: "${{ inputs.PRELOADER_IMAGE }}:${{ inputs.PRELOADER_VERSION }}" + OSC_REGION: ${{ inputs.OSC_REGION }} diff --git a/kube-setup/cluster-template.yaml b/kube-setup/cluster-template.yaml index f469ea7..49972d1 100644 --- a/kube-setup/cluster-template.yaml +++ b/kube-setup/cluster-template.yaml @@ -33,6 +33,7 @@ spec: allowFromIPRanges: - ${OSC_ALLOW_FROM} - ${OSC_ALLOW_FROM_CAPI} + - ${OSC_ALLOW_FROM_DEV} --- apiVersion: cluster.x-k8s.io/v1beta1 kind: MachineDeployment diff --git a/kube-setup/setup.sh b/kube-setup/setup.sh index 642840a..db1c447 100755 --- a/kube-setup/setup.sh +++ b/kube-setup/setup.sh @@ -20,7 +20,8 @@ clusterctl init -i outscale || clusterctl upgrade apply --contract v1beta1 export OSC_SUBREGION_NAME=${OSC_REGION}a ip=`curl -s -S --retry 5 --retry-all-errors https://api.ipify.org` export OSC_ALLOW_FROM="$ip/32" -mip=`kubectl run --image curlimages/curl:8.14.1 getip --restart=Never -ti --rm -q -- curl -s -S --retry 5 --retry-all-errors https://api.ipify.org` +mip=`kubectl get nodes -o custom-columns=IP:.metadata.labels.public-ip --no-headers=true` +# mip=`kubectl run --image curlimages/curl:8.14.1 getip --restart=Never -ti --rm -q -- curl -s -S --retry 5 --retry-all-errors https://api.ipify.org` export OSC_ALLOW_FROM_CAPI="$mip/32" export OSC_NAT_IP_POOL=caposc export KUBERNETES_VERSION=`echo $OSC_IMAGE_NAME|sed 's/.*\(v1[.0-9]*\).*/\1/'` @@ -28,7 +29,7 @@ if [ -z "$WORKER_COUNT" ]; then WORKER_COUNT=1 fi -clusterctl generate cluster $OSC_CLUSTER_NAME --kubernetes-version $KUBERNETES_VERSION --control-plane-machine-count=1 --worker-machine-count=$WORKER_COUNT -n $OSC_CLUSTER_NAME --from https://raw.githubusercontent.com/outscale/.github/refs/heads/vault_action/deploy-cluster/cluster/cluster-template.yaml > clusterapi.yaml +clusterctl generate cluster $OSC_CLUSTER_NAME --kubernetes-version $KUBERNETES_VERSION --control-plane-machine-count=1 --worker-machine-count=$WORKER_COUNT -n $OSC_CLUSTER_NAME --from $ACTION_PATH/cluster-template.yaml > clusterapi.yaml # clusterctl generate cluster $OSC_CLUSTER_NAME --kubernetes-version $KUBERNETES_VERSION --control-plane-machine-count=1 --worker-machine-count=$WORKER_COUNT -n $OSC_CLUSTER_NAME -i outscale --flavor secure-opensource > clusterapi.yaml kubectl create ns $OSC_CLUSTER_NAME || /bin/true diff --git a/vault-additional/action.yml b/vault-additional/action.yml index c7ed4ef..e9a88c4 100644 --- a/vault-additional/action.yml +++ b/vault-additional/action.yml @@ -48,7 +48,7 @@ runs: url: ${{ inputs.vault_url }} token: ${{ inputs.vault_token }} path: ${{ inputs.vault_path }} - exportEnv: true + exportEnv: false secrets: | osc-${{ inputs.osc_account }}/${{ inputs.vault_creds_type }}/${{ inputs.vault_role }} access_key | OSC_ACCESS_KEY ; osc-${{ inputs.osc_account }}/${{ inputs.vault_creds_type }}/${{ inputs.vault_role }} secret_key | OSC_SECRET_KEY ;