werf / actions Goto Github PK

Hi!

Is there support for secrets mounting in docker (RUN --mount=type=secret) like in docker/build-push-action?

https://render.com/docs/docker-secrets

is it possible to run docker build --secret from werf converge

DOCKER_BUILDKIT=1 docker build --secret id=FILENAME,src=LOCAL_FILENAME ...

Hi! I try to use werf 1.2 with github actions. I've had problem with passing secrets from Github to helm. I've tried different combination but i didn't get how to use values to helm release.
My workflow:

---
      - name: Converge
        uses: werf/actions/[email protected]
        with:
          env: staging
          kube-config-base64-data: ${{ secrets.KUBE_CONFIG_BASE64_DATA }}
        env:
          JWT_SECRET: ${{secrets.JWT_SECRET}}

My values.yaml

---
secrets:
  api-secret:
    JWT_SECRET: ""

I tried WERF_SET_JWT_SECRET: ${{secrets.JWT_SECRET}}; WERF_SET_JWT_SECRET=secrets.api-secret.jwt_secret=${{secrets.JWT_SECRET}}; JWT_SECRET=secrets.api-secret.jwt_secret=${{secrets.JWT_SECRET}}
but nothing helps

I am new to werf and its integration with GH. First, I just created simple Dockerfile, start.sh and werf.yaml as described in the werf docs. Then I created GH workflow yml according to the docs as well. It seems I get the image successfully built but then I get:

Error: unable to create lock manager: get ConfigMap werf-synchronization error: Get "https://127.0.0.1:6443/api/v1/namespaces/werf-guide-app-production/configmaps/werf-synchronization": dial tcp 127.0.0.1:6443: connect: connection refused
Error: The process '/home/runner/work/_temp/werf-tools/werf' failed with exit code 1

Since I am using everything from the official docs, I think the only place I can have a mistake is KUBE_CONFIG_BASE64_DATA GH secret. I've created it according to https://kubesandclouds.com/index.php/2020/09/01/werf-gitops/:

1. kubectl create secret docker-registry regcred --docker-server=ghcr.io --docker-username=serg046 --docker-password=generate_token_here
2. kubectl patch serviceaccount default -p '{"imagePullSecrets": [{"name": "regcred"}]}'
3. kubectl config view --raw | base64
4. Finally I put the result to the secret on GH

Could you please help to get progress?
Failing job: https://github.com/Serg046/serg046.github.io/runs/5267035872?check_suite_focus=true

Overview

I've got these steps:

      - name: Deploy to stage
        uses: werf/actions/[email protected]
        with:
          kube-config-base64-data: "${{ secrets.KUBECONFIG_FOR_STAGE }}"
        env:
          WERF_NAMESPACE: web-stage

      - name: Deploy to production
        uses: werf/actions/[email protected]
        with:
          kube-config-base64-data: "${{ secrets.KUBECONFIG_FOR_PROD }}"
        env:
          WERF_NAMESPACE: web-production

Non-relevant envs and options are omitted.

Expected behavior

'Deploy to production' step should fail if KUBECONFIG_FOR_PROD secret is not set for the repository.

Actual behavior

'Deploy to production' step uses secrets.KUBECONFIG_FOR_STAGE if KUBECONFIG_FOR_PROD is not set. web-production namespace is created in the stage cluster.

Possible ways to fix

• Additional option kube-context to use specified context from kube-config.
• Add cleanup to remove created kube-config at workflow finish.

It seems that all actions have been failing for the past few hours, this is due to the binaries download urls no longer existing, as far as i can tell there is no way to skip the binary install step or pass it an existing binary, so this is currently affecting all our workflows.

Response from https://storage.yandexcloud.net/werf/targets/releases/v1.2.26/werf-linux-amd64-v1.2.26

There needs to be a way to install the binary separately to avoid cases like this moving forward.. as it stands now all of our workflows are dead with no way to fix them.

This action currently works with the docker.pkg.github.com registry. This is problematic because it is deprecated and in fact does not work with k8s versions starting from 1.20!

Can this action be changed to work with ghcr.io? The README says the following:

Due to the fact that the new GitHub container registry (ghcr.io) does not currently support removal, all actions default to the old one (docker.pkg.github.com).

From my research it seems though that there is now support for deleting images.

Workflow

name: review-app

on:
  pull_request:
    types:
      - opened
      - reopened
      - synchronize

jobs:
  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v2
        with:
          fetch-depth: 0
      - name: Define environment url
        env:
          nip_host_ip: ${{ secrets.NIP_HOST_IP }}
        run: |
          pr_id=${{ github.event.number }}
          echo WERF_SET_ENV_URL=global.env_url=http://${pr_id}-${nip_host_ip}.nip.io >> $GITHUB_ENV
      - name: Deploy
        uses: werf/actions/[email protected]
        with:
          env: review-${{ github.event.number }}
          kube-config-base64-data: ${{ secrets.KUBE_CONFIG_BASE64_DATA }}

k8s docker secret

apiVersion: v1
kind: Secret
metadata:
  name: regsecret
type: kubernetes.io/dockerconfigjson
data:
  .dockerconfigjson: {{ .Values.dockerconfigjson }}

Result:

Error: helm upgrade have failed: unable to build kubernetes objects from release manifest: error validating "": error validating data: unknown object type "nil" in Secret.data..dockerconfigjson
Error: The process '/home/runner/work/_temp/e04a3e2b-fca8-42be-a0e3-22170e1a095c/werf' failed with exit code 1