deploy_helm_chart.yml

name: Deploy helm chart to EKS cluster
on:
  workflow_call:
    inputs:
      annotate_grafana:
        description: 'Annotate Grafana'
        type: boolean
        required: false
        default: false
      chart_action:
        description: 'Helm action to perform'
        type: string
        required: false
        default: 'install'
      chart_name:
        description: 'The name of the helm release'
        type: string
        required: true
      chart_namespace:
        description: 'Kubernetes namespace where chart will be deployed'
        type: string
        required: false
        default: 'default'
      chart_path:
        description: 'Path to the Helm chart'
        type: string
        required: true
      chart_repository:
        description: 'Helm chart repository'
        type: string
        required: true
      chart_timeout:
        description: 'The timeout for the helm chart deployment'
        type: string
        required: false
        default: '300s'
      chart_values:
        description: 'Comma separated list of value set for helms. Example: "key1=value1,key2=value2"'
        type: string
        required: false
        default: null
      chart_values_file:
        description: 'Path to the Helm chart values file'
        type: string
        required: false
      chart_values_files_template:
        description: 'Path to the template values file used in conjunction with 1Password'
        type: string
        required: false
      chart_version:
        description: 'The version of the helm chart'
        type: string
        required: true
      cluster_region:
        description: 'AWS region of the EKS cluster'
        type: string
        required: false
        default: 'eu-west-1'
      deploy_branch:
        description: 'Branch from which helm chart will be installed'
        type: string
        required: false
        default: 'main'
      environment:
        description: 'Environment to deploy to'
        type: string
        required: true
      iam_role_name:
        description: 'Name of the IAM role to assume'
        type: string
        required: false
        default: 'K8sAdmin'
      kubectl_version:
        description: 'kubectl version'
        type: string
        required: false
        default: 'v1.23.4'
      slack_notification_enabled:
        description: 'Enable slack notification'
        type: boolean
        required: false
        default: false
      slack_channel_id:
        description: 'Slack channel ID'
        type: string
        required: false
        default: 'C05Q84211L2'
      validate_url:
        description: 'The url(s) to validate after deployment. Multiple values example: "https://example.com|http://example.net"'
        type: string
        required: false
    secrets:
      aws_account_id:
        description: 'AWS account ID'
        required: true
      cluster_name:
        description: 'EKS cluster name'
        required: true
      chart_secret_values:
        description: 'Comma separated list of value set for helms which should not be exposed in runner logs. Example: "key1=value1,key2=value2"'
        required: false
      grafana_domain:
        description: 'Grafana domain'
        required: false
      grafana_token:
        description: 'Grafana service account token'
        required: false
      op_token:
        description: '1Password service account token'
        required: false
      slack_token:
        description: 'Slack token'
        required: false

jobs:
  diff:
    runs-on: ubuntu-latest
    if: ${{ !contains(format('{0}/{1}', 'refs/heads', inputs.deploy_branch ), github.ref ) }}
    environment: ${{ inputs.environment }}
    permissions:
      contents: read
      id-token: write
      pull-requests: write
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Helm
        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1

      - name: Install Helm Diff plugin
        run: |
          helm plugin install https://github.com/databus23/helm-diff --verify=false 

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with:
          aws-region: ${{ inputs.cluster_region }}
          role-to-assume: arn:aws:iam::${{ secrets.aws_account_id }}:role/${{ inputs.iam_role_name }}
          role-session-name: GithubActionsRoleSession
          role-duration-seconds: 900
            
      - name: Setup kubectl
        uses: azure/setup-kubectl@bda439f5f36b99b262ebdcd3613869bddb064c8e # v5.2.0
        with:
          version: ${{ inputs.kubectl_version }}
      
      - name: Configure kubectl
        run: |
          aws eks update-kubeconfig --region ${{ inputs.cluster_region }} --name ${{ secrets.cluster_name }}

      - name: Install 1Password CLI
        uses: 1password/install-cli-action@1a3160d5e9de1ae0803eaa08a88746f5ae3daa50 # v4.1.0
        with:
          version: 2.34.1
        
      - name: Template value file
        if: ${{ env.OP_SERVICE_ACCOUNT_TOKEN != '' && inputs.chart_values_files_template != '' }}
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.op_token }}
        run: |
          op inject -i ${{ inputs.chart_values_files_template }} -o templated-values.yml

      - name: Set inline chart values
        id: prepare_values
        run: |
          values=""
          if [ -n "${{ inputs.chart_values }}" ]; then
            values="${{ inputs.chart_values }}"
          fi
          if [ -n "${{ secrets.chart_secret_values }}" ]; then
            values="${values:+${values},}${{ secrets.chart_secret_values }}"
          fi
          echo "values=${values}" >> $GITHUB_ENV

      - name: Create chart values files parameter
        if: ${{ inputs.chart_values_file != '' || inputs.chart_values_files_template != '' }}
        run: |
          values="${{ inputs.chart_values_file }}"
          secrets="${{ inputs.chart_values_files_template }}"
          value_files=""
          if [[ -n "$values" ]]; then
            value_files="--values $values"
          fi
          if [[ -n "$secrets" ]]; then
            if [[ -n "$value_files" ]]; then
              value_files="$value_files --values templated-values.yml"
            else
              value_files="--values templated-values.yml"
            fi
          fi
          echo "VALUE_FILES=${value_files}" >> $GITHUB_ENV

      - name: Set chart repository name
        run: |
          chart_path="${{ inputs.chart_path }}"
          chart_repo_name="${chart_path%%/*}"
          echo "chart_repo_name=${chart_repo_name}" >> $GITHUB_ENV

      - name: Add chart's repository
        run: |
          helm repo add ${{ env.chart_repo_name }} ${{ inputs.chart_repository }}
          helm repo update

      - name: Run Helm diff
        id: helm_diff
        run: |
          if [ -n "${{ steps.prepare_values.outputs.values }}" ]; then
            helm diff upgrade \
              ${{ inputs.chart_name }} \
              ${{ inputs.chart_path }} \
               --version ${{ inputs.chart_version }} \
               ${{ env.VALUE_FILES }} \
               --set ${{ steps.prepare_values.outputs.values }} \
               --namespace ${{ inputs.chart_namespace }} \
               --suppress-output-line-regex "(app.kubernetes.io/version|chart):.*" \
               --three-way-merge \
               --suppress-secrets \
               --allow-unreleased \
               --dry-run=server \
               --output dyff >> diff.result
          else
            helm diff upgrade \
              ${{ inputs.chart_name }} \
              ${{ inputs.chart_path }} \
              --version ${{ inputs.chart_version }} \
              ${{ env.VALUE_FILES }} \
              --namespace ${{ inputs.chart_namespace }} \
              --suppress-output-line-regex "(app.kubernetes.io/version|chart):.*" \
              --three-way-merge \
              --suppress-secrets \
              --allow-unreleased \
              --dry-run=server \
              --output dyff > diff.result
          fi

      - name: Create the diff summary
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          DIFF: ${{ steps.helm_diff.outputs.diff }}
        with:
          github-token: ${{secrets.GITHUB_TOKEN}}
          script: |
            let diff = '';
            const fs = require('fs');
            if (fs.existsSync('diff.result')) {
              diff = fs.readFileSync('diff.result', 'utf8');
            }
            
            const output = `## Release: \`${{ inputs.chart_name }}\`, environment: \`${{ inputs.environment }}\`
            *Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`, Workflow: \`${{ github.workflow }}\`*
            
            #### Helm Diff 📖\`${{ steps.helm_diff.outcome }}\`
            <details><summary>Show Diff</summary>

            \`\`\`\n${diff}\n\`\`\`

            </details>
            `;

            fs.writeFileSync('./summary.md', output);
      
      - name: Add diff summary to pull request
        if: github.event_name == 'pull_request'
        uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
        with:
          file-path: ./summary.md
          comment-tag: '${{ inputs.chart_name }}-helm-diff-${{ inputs.environment }}'
    
  deploy:
    runs-on: ubuntu-latest
    if: ${{ contains(format('{0}/{1}', 'refs/heads', inputs.deploy_branch ), github.ref ) }}
    environment: ${{ inputs.environment }}
    permissions:
      id-token: write
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with:
          aws-region: ${{ inputs.cluster_region }}
          role-to-assume: arn:aws:iam::${{ secrets.aws_account_id }}:role/${{ inputs.iam_role_name }}
          role-session-name: GithubActionsRoleSession
          role-duration-seconds: 900

      - name: Install 1Password CLI
        uses: 1password/install-cli-action@1a3160d5e9de1ae0803eaa08a88746f5ae3daa50 # v4.1.0
        with:
          version: 2.34.1
      
      - name: Template value file
        if: ${{ env.OP_SERVICE_ACCOUNT_TOKEN != '' && inputs.chart_values_files_template != '' }}
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.op_token }}
        run: |
          op inject -i ${{ inputs.chart_values_files_template }} -o templated-values.yml

      - name: Set chart values
        run: |
          if [ "${{ secrets.chart_secret_values }}" == "" ]
          then
            echo "VALUES=${{ inputs.chart_values }}" >> $GITHUB_ENV
          else
            echo "VALUES=${{ format('{0},{1}', secrets.chart_secret_values, inputs.chart_values) }}" >> $GITHUB_ENV
          fi

      - name: Create chart value files parameter
        if: ${{ inputs.chart_values_file != '' || inputs.chart_values_files_template != '' }}
        run: |
          values="${{ inputs.chart_values_file }}"
          secrets="${{ inputs.chart_values_files_template }}"
          value_files=""
          if [[ -n "$values" ]]; then
            value_files="$values"
          fi
          if [[ -n "$secrets" ]]; then
            if [[ -n "$value_files" ]]; then
              value_files="$value_files,templated-values.yml"
            else
              value_files="templated-values.yml"
            fi
          fi
          echo "VALUE_FILES=${value_files}" >> $GITHUB_ENV

      - name: Fetch Last Commit Message
        id: last_commit_msg
        run: |
          git fetch --depth=1 origin main
          LAST_COMMIT_MSG=$(git log --format=%B -n 1 FETCH_HEAD | sed 's/`//g' | sed 's/"//g' | tr '\n' ' ')
          echo "LAST_COMMIT_MSG=$LAST_COMMIT_MSG" >> $GITHUB_ENV

      - name: Send notification
        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d #4.0.0
        id: send_notification
        if: ${{ fromJson( inputs.slack_notification_enabled ) }} 
        with:
          method: 'chat.postMessage'
          token: ${{ secrets.slack_token }}
          payload: |
            channel: ${{ inputs.slack_channel_id }}
            text: "${{ inputs.chart_name }} ${{ inputs.environment }} deployment started (In Progress)"
            blocks:
              - type: "header"
                text:
                  type: "plain_text"
                  text: "${{ inputs.chart_name }} ${{ inputs.environment }} deployment started (In Progress)"
                  emoji: true
              - type: "section"
                fields:
                  - type: "mrkdwn"
                    text: "*Status:*\n:large_yellow_square: In Progress"
                  - type: "mrkdwn"
                    text: "*Last Commit Message:*\n${{ env.LAST_COMMIT_MSG }}"
                  - type: "mrkdwn"
                    text: "*Workflow run:*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View>"

      - name: Deploy Helm
        uses: bitovi/github-actions-deploy-eks-helm@29f556cf128eb1b42f834caf13b60a630ee2a20b # v1.2.12
        id: deploy
        with:
          action: ${{ inputs.chart_action }}
          aws-region: ${{ inputs.cluster_region }}
          cluster-name: ${{ secrets.cluster_name }}
          chart-repository: ${{ inputs.chart_repository }}
          chart-path: ${{ inputs.chart_path }}
          config-files: ${{ env.VALUE_FILES }}
          values: ${{ env.VALUES }}
          namespace: ${{ inputs.chart_namespace }}
          name: ${{ inputs.chart_name }}
          version: ${{ inputs.chart_version }}
          atomic: true
          helm-wait: true
          timeout: ${{ inputs.chart_timeout }}


      - name: Validate deployment
        if: ${{ inputs.validate_url != '' }}
        uses: jtalk/url-health-check-action@e7d5ebdc9027fbf494d2d034f3e8fc78f8b7a2b9 # v5
        with:
          url: ${{ inputs.validate_url }}
          follow-redirect: true
          max-attempts: 3
          retry-delay: 10s
          retry-all: false

      - name: Annotate Grafana
        if: ${{ fromJson( inputs.annotate_grafana ) }}
        env:
          CHART: ${{ inputs.chart_name }}
          GRAFANA_URL: ${{ secrets.grafana_domain }}
          GRAFANA_TOKEN: ${{ secrets.grafana_token }}
          ENVIRONMENT: ${{ inputs.environment }}
        run: |
          curl -X POST "${GRAFANA_URL}/api/annotations" \
          -H "Content-Type: application/json" \
          -H "Authorization: Bearer ${GRAFANA_TOKEN}" \
          -d '{
            "time": '$(date +%s%3N)',
            "tags": ["deployment", "${{ env.CHART }}", "${{ env.ENVIRONMENT }}"],
            "text": "Deploy of ${{ env.CHART }} to ${{ env.ENVIRONMENT }} from GitHub Actions: ${{ env.LAST_COMMIT_MSG }}"
          }'

      - name: Update notification
        if: ${{ always() && fromJson( inputs.slack_notification_enabled ) }}
        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d #4.0.0
        with:
          method: 'chat.update'
          token: ${{ secrets.slack_token }}
          payload: |
            channel: ${{ inputs.slack_channel_id }}
            ts: ${{ steps.send_notification.outputs.ts }}
            text: "${{ inputs.chart_name }} ${{ inputs.environment }} deployment finished (Completed)"
            blocks:
              - type: "header"
                text:
                  type: "plain_text"
                  text: "${{ inputs.chart_name }} ${{ inputs.environment }} deployment finished (Completed)"
                  emoji: true
              - type: "section"
                fields:
                  - type: "mrkdwn"
                    text: "*Status:*\n${{ steps.deploy.outcome == 'success' && ':white_check_mark: Success' || ':x: Failure '}}"
                  - type: "mrkdwn"
                    text: "*Last Commit Message:*\n${{ env.LAST_COMMIT_MSG }}"
                  - type: "mrkdwn"
                    text: "*Workflow run:*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View>"