deploy-to-k8s.yaml

name: Deploy to K8s
permissions: read-all

on:
  workflow_call:
    inputs:
      environment:
        required: true
        type: string

jobs:
  deploy_to_k8s:
    name: Deploy to k8s
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    steps:
    - name: Check out the repo
      uses: actions/checkout@v4

    - name: Install SSH key
      uses: shimataro/ssh-key-action@d4fffb50872869abe2d9a9098a6d9c5aa7d16be4 # v2
      with:
        key: ${{ secrets.SSH_PRIVATE_KEY }}
        name: id_ed25519 # optional
        known_hosts: ${{ secrets.SSH_KNOWN_HOSTS }}
        if_key_exists: fail # replace / ignore / fail; optional (defaults to fail)

    - name: Setup WireGuard
      run:  |
        sudo apt install wireguard
        echo "${{ secrets.WIREGUARD_PRIVATE_KEY }}" > privatekey
        sudo ip link add dev wg1 type wireguard
        sudo ip address add dev wg1 ${{ secrets.WIREGUARD_OVERLAY_NETWORK_IP }} peer ${{ secrets.SSH_TARGET_IP }}
        sudo wg set wg1 listen-port 48123 private-key privatekey peer ${{ secrets.WIREGUARD_PEER_PUBLIC_KEY }} allowed-ips 0.0.0.0/0 endpoint ${{ secrets.WIREGUARD_ENDPOINT }}
        sudo ip link set up dev wg1

    - name: Deploy Helm Chart
      run: |
        # Get the kubeconfig
        scp ${{ secrets.SSH_USER }}@${{ secrets.SSH_TARGET_IP }}:~/.kube/config ./

        # Install the chart with helm
        helm upgrade --install --kubeconfig ./config --kube-apiserver https://${{ secrets.SSH_TARGET_IP }}:6443 -n ${{ vars.APP_NAMESPACE }} --create-namespace meshforms infra/helm/meshforms/ \
        --set meshforms.meshdb_url="${{ vars.MESHDB_URL }}" \
        --set meshforms_app_namespace="${{ vars.APP_NAMESPACE }}" \
        --set aws.access_key="${{ secrets.S3_ACCESS_KEY }}" \
        --set aws.secret_key="${{ secrets.S3_SECRET_KEY }}" \
        --set meshforms.s3_bucket_name="${{ secrets.S3_BUCKET_NAME }}" \
        --set meshforms.s3_base_name="${{ secrets.S3_BASE_NAME }}" \
        --set image.tag="${{ inputs.environment }}" \
        --set ingress.hosts[0].host="${{ vars.INGRESS_HOST }}",ingress.hosts[0].paths[0].path=/,ingress.hosts[0].paths[0].pathType=Prefix

        # Rolling restart
        kubectl --kubeconfig ./config --server https://${{ secrets.SSH_TARGET_IP }}:6443 -n ${{ vars.APP_NAMESPACE }} rollout restart deploy