test-gha-eks-manage-cluster.yml

---
name: EKS Cluster creation and destruction test

on:
  schedule:
    - cron: '0 1 * * 1' # At 01:00 on Monday.

  workflow_dispatch:
    inputs:
      cluster_name:
        description: "Cluster name."
        required: false
        type: string
      delete_cluster:
        description: "Whether to delete the cluster."
        required: false
        type: boolean
        default: true

  pull_request:
    # the paths should be synced with ../labeler.yml
    paths:
      - modules/fixtures/**/*.tf
      - modules/fixtures/**/*.tfvars
      - modules/**.tf
      - .tool-versions
      - .github/workflows/test-gha-eks-manage-cluster.yml
      - .github/actions/eks-manage-cluster/*.yml
      - justfile

# limit to a single execution per actor of this workflow
concurrency:
  group: "${{ github.workflow }}-${{ github.ref }}"
  cancel-in-progress: true

env:

  AWS_PROFILE: "infex"
  AWS_REGION: "eu-west-2" # /!\ always use one of the available test region https://github.com/camunda/infraex-common-config

  TF_STATE_BUCKET: "tests-eks-tf-state-eu-central-1"
  TF_STATE_BUCKET_REGION: "eu-central-1"

jobs:
  action-test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ github.head_ref }}
          fetch-depth: 0

      - name: Install tooling using asdf
        uses: asdf-vm/actions/install@05e0d2ed97b598bfce82fd30daf324ae0c4570e6 # v3

      - name: Get Cluster Info
        id: commit_info
        run: |
          if [[ -n "${{ github.event.inputs.cluster_name }}" ]]; then
            cluster_name="${{ github.event.inputs.cluster_name }}"
          else
            cluster_name="cl-$(git rev-parse --short HEAD)"
          fi
          echo "cluster_name=$cluster_name" >> "$GITHUB_OUTPUT"

          # Get the current commit hash for the modules revision
          tf_modules_revision=$(git rev-parse HEAD)

          echo "cluster_name=$cluster_name" >> "$GITHUB_OUTPUT"
          echo "tf_modules_revision=$tf_modules_revision" >> "$GITHUB_OUTPUT"

      - name: Import Secrets
        id: secrets
        uses: hashicorp/vault-action@v3
        with:
          url: ${{ secrets.VAULT_ADDR }}
          method: approle
          roleId: ${{ secrets.VAULT_ROLE_ID }}
          secretId: ${{ secrets.VAULT_SECRET_ID }}
          exportEnv: false
          secrets: |
            secret/data/products/infrastructure-experience/ci/common AWS_ACCESS_KEY;
            secret/data/products/infrastructure-experience/ci/common AWS_SECRET_KEY;

      - name: Add profile credentials to ~/.aws/credentials
        run: |
          aws configure set aws_access_key_id ${{ steps.secrets.outputs.AWS_ACCESS_KEY }} --profile ${{ env.AWS_PROFILE }}
          aws configure set aws_secret_access_key ${{ steps.secrets.outputs.AWS_SECRET_KEY }} --profile ${{ env.AWS_PROFILE }}
          aws configure set region ${{ env.AWS_REGION }} --profile ${{ env.AWS_PROFILE }}

      - name: Create Cluster
        timeout-minutes: 125
        uses: ./.github/actions/eks-manage-cluster
        id: create_cluster
        with:
          action: "create"
          cluster-name: ${{ steps.commit_info.outputs.cluster_name }}
          aws-region: ${{ env.AWS_REGION }}
          s3-backend-bucket: ${{ env.TF_STATE_BUCKET }}
          s3-bucket-region: ${{ env.TF_STATE_BUCKET_REGION }}
          tf-modules-revision: ${{ steps.commit_info.outputs.tf_modules_revision }}

      - name: Delete Cluster
        timeout-minutes: 125
        if: always() && !(github.event_name == 'workflow_dispatch' && github.event.inputs.delete_cluster == 'false')
        uses: ./.github/actions/eks-manage-cluster
        with:
          action: "delete"
          cluster-name: ${{ steps.commit_info.outputs.cluster_name }}
          aws-region: ${{ env.AWS_REGION }}
          s3-backend-bucket: ${{ env.TF_STATE_BUCKET }}
          s3-bucket-region: ${{ env.TF_STATE_BUCKET_REGION }}
          tf-modules-revision: ${{ steps.commit_info.outputs.tf_modules_revision }}

      - name: Notify in Slack in case of failure
        id: slack-notification
        if: failure() && github.event_name == 'schedule'
        uses: camunda/infraex-common-config/.github/actions/report-failure-on-slack@main
        with:
          vault_addr: ${{ secrets.VAULT_ADDR }}
          vault_role_id: ${{ secrets.VAULT_ROLE_ID }}
          vault_secret_id: ${{ secrets.VAULT_SECRET_ID }}