Skip to content

Commit 5be9a9a

Browse files
j143j143
committed
feat: add AKS lifecycle workflow with deploy/verify/destroy options .github/workflows/aks-lifecycle.yml — workflow_dispatch with four actions: deploy Create resource group + AKS cluster (idempotent) verify Run ADR-001 verification against existing cluster deploy-and-verify Deploy then verify, destroy on success destroy Delete AKS cluster and resource group (async) Inputs: action, resource_group (default: rg-basic-docker), aks_cluster (default: basic-docker-aks), location (default: eastus) Uses AZURE_CLIENT_ID / AZURE_TENANT_ID / AZURE_SUBSCRIPTION_ID secrets with OIDC login (no stored credentials).
1 parent 3965cbb commit 5be9a9a

1 file changed

Lines changed: 199 additions & 0 deletions

File tree

‎.github/workflows/aks-lifecycle.yml‎

Lines changed: 199 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,199 @@
1+
name: AKS Lifecycle — Deploy / Verify / Destroy
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
action:
7+
description: Action to perform
8+
required: true
9+
type: choice
10+
options:
11+
- deploy
12+
- verify
13+
- deploy-and-verify
14+
- destroy
15+
default: deploy-and-verify
16+
resource_group:
17+
description: Azure resource group name
18+
required: false
19+
default: rg-basic-docker
20+
type: string
21+
aks_cluster:
22+
description: AKS cluster name
23+
required: false
24+
default: basic-docker-aks
25+
type: string
26+
location:
27+
description: Azure region (used only during deploy)
28+
required: false
29+
default: eastus
30+
type: string
31+
32+
permissions:
33+
id-token: write
34+
contents: read
35+
36+
env:
37+
RESOURCE_GROUP: ${{ inputs.resource_group }}
38+
CLUSTER_NAME: ${{ inputs.aks_cluster }}
39+
LOCATION: ${{ inputs.location }}
40+
41+
jobs:
42+
# ── Deploy ────────────────────────────────────────────────────────────────
43+
deploy:
44+
name: Deploy AKS cluster
45+
runs-on: ubuntu-latest
46+
if: ${{ inputs.action == 'deploy' || inputs.action == 'deploy-and-verify' }}
47+
outputs:
48+
cluster_ready: ${{ steps.aks.outputs.cluster_ready }}
49+
50+
steps:
51+
- name: Azure login
52+
uses: azure/login@v2
53+
with:
54+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
55+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
56+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
57+
58+
- name: Ensure resource group
59+
run: |
60+
if az group show --name "$RESOURCE_GROUP" &>/dev/null; then
61+
echo "Resource group '$RESOURCE_GROUP' already exists."
62+
else
63+
az group create --name "$RESOURCE_GROUP" --location "$LOCATION" --output none
64+
echo "Resource group '$RESOURCE_GROUP' created."
65+
fi
66+
67+
- name: Ensure AKS cluster
68+
id: aks
69+
run: |
70+
if az aks show --resource-group "$RESOURCE_GROUP" --name "$CLUSTER_NAME" &>/dev/null; then
71+
echo "AKS cluster '$CLUSTER_NAME' already exists."
72+
else
73+
echo "Creating AKS cluster '$CLUSTER_NAME' (takes ~3-5 min)..."
74+
az aks create \
75+
--resource-group "$RESOURCE_GROUP" \
76+
--name "$CLUSTER_NAME" \
77+
--node-count 1 \
78+
--node-vm-size Standard_B2s \
79+
--generate-ssh-keys \
80+
--enable-oidc-issuer \
81+
--enable-workload-identity \
82+
--output none
83+
echo "AKS cluster created."
84+
fi
85+
echo "cluster_ready=true" >> "$GITHUB_OUTPUT"
86+
87+
- name: Show cluster info
88+
run: |
89+
az aks get-credentials \
90+
--resource-group "$RESOURCE_GROUP" \
91+
--name "$CLUSTER_NAME" \
92+
--overwrite-existing
93+
kubectl get nodes
94+
95+
# ── Verify ────────────────────────────────────────────────────────────────
96+
verify:
97+
name: Verify ADR-001 on AKS
98+
runs-on: ubuntu-latest
99+
needs: [deploy]
100+
if: |
101+
always() &&
102+
(inputs.action == 'verify' || inputs.action == 'deploy-and-verify') &&
103+
(needs.deploy.result == 'success' || needs.deploy.result == 'skipped')
104+
timeout-minutes: 20
105+
env:
106+
NAMESPACE: adr001-ci-${{ github.run_id }}
107+
108+
steps:
109+
- name: Checkout code
110+
uses: actions/checkout@v4
111+
112+
- name: Set up Go
113+
uses: actions/setup-go@v5
114+
with:
115+
go-version: '^1.24'
116+
cache: true
117+
118+
- name: Azure login
119+
uses: azure/login@v2
120+
with:
121+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
122+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
123+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
124+
125+
- name: Connect to AKS
126+
run: |
127+
az aks get-credentials \
128+
--resource-group "$RESOURCE_GROUP" \
129+
--name "$CLUSTER_NAME" \
130+
--overwrite-existing
131+
kubectl get nodes
132+
133+
- name: Apply ResourceCapsule CRD
134+
run: |
135+
kubectl apply -f k8s/crd-resourcecapsule.yaml
136+
kubectl wait --for=condition=established --timeout=60s \
137+
crd/resourcecapsules.capsules.docker.io
138+
139+
- name: Run ADR-001 verification script
140+
run: |
141+
chmod +x scripts/verify-adr-001.sh
142+
bash scripts/verify-adr-001.sh \
143+
--resource-group "$RESOURCE_GROUP" \
144+
--cluster "$CLUSTER_NAME"
145+
146+
- name: Run unit tests (capsule + CRD)
147+
run: |
148+
go test -v -run "TestKubernetesConfigMapCapsule|TestAttachCapsuleToDeployment|TestResourceCapsule" \
149+
-count=1 ./...
150+
151+
# ── Destroy ───────────────────────────────────────────────────────────────
152+
destroy:
153+
name: Destroy AKS resources
154+
runs-on: ubuntu-latest
155+
needs: [verify]
156+
if: |
157+
always() &&
158+
(inputs.action == 'destroy' || inputs.action == 'deploy-and-verify') &&
159+
(needs.verify.result == 'success' || needs.verify.result == 'skipped' || inputs.action == 'destroy')
160+
161+
steps:
162+
- name: Azure login
163+
uses: azure/login@v2
164+
with:
165+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
166+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
167+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
168+
169+
- name: Delete AKS cluster
170+
run: |
171+
if az aks show --resource-group "$RESOURCE_GROUP" --name "$CLUSTER_NAME" &>/dev/null; then
172+
echo "Deleting AKS cluster '$CLUSTER_NAME'..."
173+
az aks delete \
174+
--resource-group "$RESOURCE_GROUP" \
175+
--name "$CLUSTER_NAME" \
176+
--yes --no-wait
177+
echo "Deletion initiated (running in background)."
178+
else
179+
echo "Cluster '$CLUSTER_NAME' not found — nothing to delete."
180+
fi
181+
182+
- name: Delete resource group (optional — comment out to keep)
183+
run: |
184+
if az group show --name "$RESOURCE_GROUP" &>/dev/null; then
185+
echo "Deleting resource group '$RESOURCE_GROUP'..."
186+
az group delete \
187+
--name "$RESOURCE_GROUP" \
188+
--yes --no-wait
189+
echo "Resource group deletion initiated."
190+
else
191+
echo "Resource group '$RESOURCE_GROUP' not found — nothing to delete."
192+
fi
193+
194+
- name: Summary
195+
run: |
196+
echo "## Destroy Summary" >> "$GITHUB_STEP_SUMMARY"
197+
echo "- Cluster \`$CLUSTER_NAME\` deletion initiated" >> "$GITHUB_STEP_SUMMARY"
198+
echo "- Resource group \`$RESOURCE_GROUP\` deletion initiated" >> "$GITHUB_STEP_SUMMARY"
199+
echo "- Deletions run async; check Azure portal for final status" >> "$GITHUB_STEP_SUMMARY"

0 commit comments

Comments
 (0)