90 lines
3.3 KiB
Plaintext
90 lines
3.3 KiB
Plaintext
name: Create Sealed Secrets (Example)
|
|
|
|
# 이 워크플로우는 예시입니다. 필요에 따라 수정하여 사용하세요.
|
|
# Secrets를 SealedSecrets로 변환하여 Git에 안전하게 저장합니다.
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
environment:
|
|
description: 'Target environment (dev/prod)'
|
|
required: true
|
|
type: choice
|
|
options:
|
|
- dev
|
|
- prod
|
|
secret_name:
|
|
description: 'Secret name to create'
|
|
required: true
|
|
type: string
|
|
|
|
jobs:
|
|
create-sealed-secret:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install kubeseal
|
|
run: |
|
|
KUBESEAL_VERSION="0.26.2"
|
|
wget "https://github.com/bitnami-labs/sealed-secrets/releases/download/v${KUBESEAL_VERSION}/kubeseal-${KUBESEAL_VERSION}-linux-amd64.tar.gz"
|
|
tar xfz "kubeseal-${KUBESEAL_VERSION}-linux-amd64.tar.gz"
|
|
sudo mv kubeseal /usr/local/bin/
|
|
kubeseal --version
|
|
|
|
- name: Download public certificate
|
|
run: |
|
|
# infrastructure 레포에서 public cert 가져오기
|
|
wget https://raw.githubusercontent.com/Mayne0213/infrastructure/main/sealed-secrets/pub-cert.pem -O /tmp/pub-cert.pem
|
|
|
|
- name: Create sealed secret for ArgoCD token
|
|
if: inputs.secret_name == 'argocd-token'
|
|
run: |
|
|
NAMESPACE="portfolio"
|
|
if [ "${{ inputs.environment }}" = "dev" ]; then
|
|
NAMESPACE="portfolio-dev"
|
|
fi
|
|
|
|
# GitHub Secret에서 값을 가져와서 SealedSecret 생성
|
|
kubectl create secret generic argocd-token \
|
|
--from-literal=token="${{ secrets.ARGOCD_TOKEN }}" \
|
|
--namespace="$NAMESPACE" \
|
|
--dry-run=client -o yaml | \
|
|
kubeseal --format=yaml \
|
|
--cert=/tmp/pub-cert.pem \
|
|
--scope=strict \
|
|
> "deploy/k8s/overlays/${{ inputs.environment }}/sealed-argocd-token.yaml"
|
|
|
|
- name: Create generic sealed secret
|
|
if: inputs.secret_name != 'argocd-token'
|
|
run: |
|
|
NAMESPACE="portfolio"
|
|
if [ "${{ inputs.environment }}" = "dev" ]; then
|
|
NAMESPACE="portfolio-dev"
|
|
fi
|
|
|
|
# 예시: API_KEY와 DATABASE_URL을 포함하는 앱 시크릿
|
|
kubectl create secret generic "${{ inputs.secret_name }}" \
|
|
--from-literal=API_KEY="${{ secrets.API_KEY }}" \
|
|
--from-literal=DATABASE_URL="${{ secrets.DATABASE_URL }}" \
|
|
--namespace="$NAMESPACE" \
|
|
--dry-run=client -o yaml | \
|
|
kubeseal --format=yaml \
|
|
--cert=/tmp/pub-cert.pem \
|
|
--scope=strict \
|
|
> "deploy/k8s/overlays/${{ inputs.environment }}/sealed-${{ inputs.secret_name }}.yaml"
|
|
|
|
- name: Commit and push sealed secret
|
|
run: |
|
|
git config --global user.name "github-actions[bot]"
|
|
git config --global user.email "github-actions[bot]@users.noreply.github.com"
|
|
|
|
git add "deploy/k8s/overlays/${{ inputs.environment }}/sealed-*.yaml"
|
|
git commit -m "Add sealed secret ${{ inputs.secret_name }} for ${{ inputs.environment }}"
|
|
git push
|
|
|
|
echo "✅ Sealed secret created and pushed to repository"
|
|
echo " ArgoCD will automatically deploy this sealed secret"
|