cluster.yml

name: Clusters

on:
  workflow_dispatch:
    inputs:
      dry-run:
        type: choice
        required: false
        default: "false"
        options:
          - "true"
          - "false"
      regions:
        type: string
        required: false
        default: "all"
        description: >
          Comma-separated list of regions to deploy to (e.g., "us-east-1,eu-central-1").
          Use "all" to deploy to all regions.

jobs:
  terraform:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - region: us-east-1
            ssl_cert_arn: arn:aws:acm:us-east-1:509399595051:certificate/6ab8319d-1dec-494f-b71c-3a4132e42a5e
          - region: eu-central-1
            ssl_cert_arn: arn:aws:acm:eu-central-1:509399595051:certificate/f69f5c80-9eb9-41fc-9133-5d72ecb223d3
          - region: us-west-2
            ssl_cert_arn: arn:aws:acm:us-west-2:509399595051:certificate/2587017b-119b-41ae-8d76-c4b1a20d53e5
          - region: ap-southeast-1
            ssl_cert_arn: arn:aws:acm:ap-southeast-1:509399595051:certificate/0e596d0c-ec2d-4b94-bc49-9460798a2734
          - region: sa-east-1
            ssl_cert_arn: arn:aws:acm:sa-east-1:509399595051:certificate/d5fc1098-bf1b-4e88-916d-ce4c4dd5942b
          - region: af-south-1
            ssl_cert_arn: arn:aws:acm:af-south-1:509399595051:certificate/349c46d7-ad77-43c0-8a88-a5712ef5d653

    env:
      TF_VAR_cluster_name: ${{ matrix.region }}
      TF_VAR_ssl_cert_arn: ${{ matrix.ssl_cert_arn }}
      TF_VAR_eks_cluster_arn: arn:aws:eks:${{ matrix.region }}:509399595051:cluster/hydra-doom-dev-cluster

    steps:
      - name: Filter regions
        id: filter
        run: |
          selected_regions="${{ github.event.inputs.regions }}"
          if [[ "$selected_regions" != "all" ]]; then
            if [[ ! "${{ matrix.region }}" =~ (^|,)(${selected_regions})(,|$) ]]; then
              echo "Skipping region ${{ matrix.region }}"
              echo "should_skip=true" >> $GITHUB_OUTPUT
              exit 0
            else
              echo "should_skip=false" >> $GITHUB_OUTPUT
            fi
          else
            echo "should_skip=false" >> $GITHUB_OUTPUT
          fi

      - uses: actions/checkout@v2
        if: steps.filter.outputs.should_skip == 'false'

      - uses: aws-actions/configure-aws-credentials@v1
        if: steps.filter.outputs.should_skip == 'false'
        with:
          aws-region: ${{ matrix.region }}
          aws-access-key-id: ${{ secrets.DEPLOY_AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.DEPLOY_AWS_SECRET_ACCESS_KEY }}
          role-to-assume: arn:aws:iam::509399595051:role/ClusterAdminRole
          role-session-name: Github-Actions
          role-duration-seconds: 1200

      - name: Get short commit sh
        id: image_tag
        run: echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
        if: steps.filter.outputs.should_skip == 'false'

      - name: setup kubeconfig
        run: aws eks update-kubeconfig --name hydra-doom-dev-cluster
        if: steps.filter.outputs.should_skip == 'false'

      - name: setup terraform
        uses: hashicorp/setup-terraform@v3
        if: steps.filter.outputs.should_skip == 'false'

      - name: init terraform
        working-directory: playbook/cluster-setup
        run: terraform init -backend-config=backend.${{ matrix.region }}.conf
        if: steps.filter.outputs.should_skip == 'false'

      - name: validate terraform
        working-directory: playbook/cluster-setup
        run: terraform validate
        if: steps.filter.outputs.should_skip == 'false'

      - name: plan terraform
        working-directory: playbook/cluster-setup
        if: inputs.dry-run == 'true' && steps.filter.outputs.should_skip == 'false'
        run: terraform plan -input=false

      - name: apply terraform
        working-directory: playbook/cluster-setup
        if: inputs.dry-run == 'false' && steps.filter.outputs.should_skip == 'false'
        run: terraform apply -auto-approve -input=false