Cloud und DevOps: Helm-Chart, Rolling Update, Terraform und CI-Pipeline

Die CI-Pipeline

name: ci
on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Unit-Tests
        working-directory: app
        run: python -m unittest -v

  build:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Image bauen
        run: docker build --build-arg VERSION=${{ github.sha }} -t probeapp:${{ github.sha }} app
      - name: Chart pruefen
        run: |
          curl -fsSL https://get.helm.sh/helm-v3.16.0-linux-amd64.tar.gz | tar xz
          ./linux-amd64/helm lint chart

  deploy:
    needs: build
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    environment: production
    concurrency: deploy-production
    steps:
      - uses: actions/checkout@v4
      - name: Ausrollen
        env:
          KUBECONFIG_DATA: ${{ secrets.KUBECONFIG_DATA }}
        run: |
          echo "$KUBECONFIG_DATA" | base64 -d > "$RUNNER_TEMP/kubeconfig"
          helm upgrade --install probeapp chart --kubeconfig "$RUNNER_TEMP/kubeconfig" --set image.tag=${{ github.sha }} --atomic --timeout 5m

Das Terraform-Modul

terraform {
  required_version = ">= 1.5"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

variable "endpoint" {
  description = "Nur fuer die lokale Probe (moto); gegen echtes AWS leer lassen"
  type        = string
  default     = ""
}

variable "bucket_name" {
  type    = string
  default = "gltools-probe-daten"
}

provider "aws" {
  region                      = "eu-central-1"
  access_key                  = var.endpoint == "" ? null : "test"
  secret_key                  = var.endpoint == "" ? null : "test"
  skip_credentials_validation = var.endpoint != ""
  skip_requesting_account_id  = var.endpoint != ""
  skip_metadata_api_check     = var.endpoint != ""
  s3_use_path_style           = var.endpoint != ""

  dynamic "endpoints" {
    for_each = var.endpoint == "" ? [] : [var.endpoint]
    content {
      s3  = endpoints.value
      iam = endpoints.value
      sts = endpoints.value
    }
  }
}

resource "aws_s3_bucket" "daten" {
  bucket = var.bucket_name
}

resource "aws_s3_bucket_versioning" "daten" {
  bucket = aws_s3_bucket.daten.id
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "daten" {
  bucket = aws_s3_bucket.daten.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

resource "aws_s3_bucket_public_access_block" "daten" {
  bucket                  = aws_s3_bucket.daten.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# Least Privilege: nur lesen/schreiben/auflisten in genau diesem Bucket
data "aws_iam_policy_document" "app" {
  statement {
    sid       = "ObjekteLesenSchreiben"
    actions   = ["s3:GetObject", "s3:PutObject"]
    resources = ["${aws_s3_bucket.daten.arn}/*"]
  }
  statement {
    sid       = "BucketAuflisten"
    actions   = ["s3:ListBucket"]
    resources = [aws_s3_bucket.daten.arn]
  }
}

resource "aws_iam_policy" "app" {
  name   = "gltools-probe-app"
  policy = data.aws_iam_policy_document.app.json
}

output "bucket" {
  value = aws_s3_bucket.daten.id
}

output "policy_arn" {
  value = aws_iam_policy.app.arn
}

So etwas für deinen Betrieb?

Beschreib kurz, was du brauchst. Du bekommst einen Festpreis, bevor ich anfange; ohne dein Ja passiert nichts.

Zur Werkstatt