aws-jfrog-container-registry.yml

name: "aws-jfrog-container-registry"

on:
  workflow_call:
    inputs:
      domain:
        description: "A domain that the installation of Harbor will be addressable from"
        type: string
        required: true
      email-address:
        description: "An email address to be used as the owner for the public trusted domain certificate vended by Let's Encrypt"
        type: string
        required: true
      region:
        description: "The AWS region of the cluster where the JFrog Container Registry instance will be available"
        type: string
        required: true
      action:
        required: true
        description: "Create (new) or destroy (existing)"
        type: string
    secrets:
      AWS_ACCESS_KEY_ID:
        required: false
      AWS_SECRET_ACCESS_KEY:
        required: false
      AWS_SESSION_TOKEN:
        required: false
      KUBECONFIG_CONTENTS:
        required: true
      TF_BACKEND_S3_BUCKET_NAME:
        required: true
      AWS_KMS_ALIAS:
        required: true
    outputs:
      jcr_domain:
        description: "The domain from which the JFrog Container Registry instance is addressable"
        value: ${{ jobs.terraform.outputs.jcr_domain }}
      jcr_admin_username:
        description: "The JFrog Container Registry administrator account's username"
        value: ${{ jobs.terraform.outputs.jcr_admin_username }}
      jcr_admin_password:
        description: "The JFrog Container Registry administrator account's password"
        value: ${{ jobs.terraform.outputs.jcr_admin_password }}

jobs:
  terraform:
    env:
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      AWS_REGION: ${{ inputs.region }}
      AWS_SESSION_TOKEN: ${{ secrets.AWS_SESSION_TOKEN }}
      TF_VAR_acme_email: ${{ inputs.email-address }}
      TF_VAR_domain: ${{ inputs.domain }}
      TF_VAR_kubeconfig_path: "/tmp/.kube/config"
      KUBECONFIG: "/tmp/.kube/config"

    runs-on: ubuntu-22.04

    outputs:
      jcr_domain: ${{ steps.set_outputs.outputs.base_domain }}
      jcr_admin_username: ${{ steps.set_outputs.outputs.jcr_admin_username }}
      jcr_admin_password: ${{ steps.set_outputs.outputs.jcr_admin_password }}

    # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-22.04, macos-latest, or windows-latest
    defaults:
      run:
        shell: bash
        working-directory: terraform/k8s/jcr

    steps:
    # Checkout the repository to the GitHub Actions runner
    - name: Checkout
      uses: actions/checkout@v4

    # Install the latest version of Terraform CLI
    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v2

    - name: Generate backend configuration
      run: |
          cp ../../aws/backend/backend.tf .
          echo "bucket = \"${{ secrets.TF_BACKEND_S3_BUCKET_NAME }}\"" > config.aws.tfbackend
          echo "key = \"artifactory-jcr/terraform.tfstate\"" >> config.aws.tfbackend
          echo "region = \"${{ env.AWS_REGION }}\"" >> config.aws.tfbackend
          echo "encrypt = true" >> config.aws.tfbackend
          echo "kms_key_id = \"${{ secrets.AWS_KMS_ALIAS }}\"" >> config.aws.tfbackend
          echo "dynamodb_table = \"${{ secrets.TF_BACKEND_S3_BUCKET_NAME }}\"" >> config.aws.tfbackend

    - name: Install Carvel tools
      run: |
        KAPP_VERSION=0.59.1
        wget -O kapp https://github.com/vmware-tanzu/carvel-kapp/releases/download/v${KAPP_VERSION}/kapp-linux-amd64
        chmod +x kapp
        sudo mv kapp /usr/bin

    - name: Generate .kube/config
      env:
        KUBECONFIG_CONTENTS: ${{ secrets.KUBECONFIG_CONTENTS }}
      run: |
          mkdir -p /tmp/.kube
          echo "$KUBECONFIG_CONTENTS" | base64 -d > /tmp/.kube/config
          chmod 600 /tmp/.kube/config

    # Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
    - name: Terraform Init
      run: terraform init -upgrade -backend-config=./config.aws.tfbackend

    # Checks that all Terraform configuration files adhere to a canonical format
    - name: Terraform Format
      run: terraform fmt -check

    # Generates an execution plan for Terraform
    - name: Terraform Plan
      if: inputs.action == 'create'
      run: terraform plan

    - name: Terraform Apply
      if: inputs.action == 'create'
      run: terraform apply -auto-approve

    - name: Terraform Destroy
      if: inputs.action == 'destroy'
      run: terraform destroy -auto-approve

    - name: Set Outputs
      id: set_outputs
      if: inputs.action == 'create'
      run: |
        jcr_domain=$(terraform output --raw jcr_domain)
        echo "jcr_domain=${jcr_domain}" >> $GITHUB_OUTPUT
        jcr_admin_username=$(terraform output --raw jcr_admin_username)
        echo "jcr_admin_username=${jcr_admin_username}" >> $GITHUB_OUTPUT
        jcr_admin_password=$(terraform output --raw jcr_admin_password)
        echo "jcr_admin_password=${jcr_admin_password}" >> $GITHUB_OUTPUT