feat(ci): push-to-main deploy via self-hosted ARC runner - #1
Merged
Conversation
Replace manual `helm upgrade` / `kubectl apply` loop with GitHub Actions running on in-cluster ARC scale set `arc-itguys-ro-nextcloud`. Push to main triggers path-filtered jobs: secrets always; manifests if `manifests/*.yaml` changed; helm if `helm/**` changed. PRs run server-side dry-run via `pr-checks.yml`. Runner pod auth = its own SA bound to Role `nextcloud-deployer` (ns nextcloud, broad CRUD) and Role `cf-token-writer` (ns cert-manager, narrow update of Secret `cloudflare-api-token` only). 5 k8s Secrets rendered at apply time from 8 GitHub Actions Secrets. `manifests/60-nginx-tls-proxy.yaml` is excluded from the CI path filter: the live proxy is a shared :443 ingress that also fronts headlamp / degoog / searxng / degoog-mcp with vhosts and a /tls-warp cert mount not declared in this repo. Repo copy retained as historical baseline with a DO-NOT-APPLY header. Bootstrap manifests (namespace, ClusterIssuer, deployer RBAC) split into `manifests/bootstrap/`; cluster-admin applies once. Design: docs/superpowers/specs/2026-05-25-nextcloud-ci-deployment-design.md
kubectl apply --dry-run=server defaulted to the runner pod's namespace (arc-runners) where the deployer SA has no rights, failing with 'forbidden: cannot get resource services in namespace arc-runners'. Pass -n nextcloud explicitly.
The fallback called /api/v1/namespaces/nextcloud which needs cluster-scoped 'namespaces get' that the deployer SA lacks (intentionally — Role is ns-scoped only). Rely on auth can-i SelfSubjectAccessReview which needs no RBAC.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
mainnow triggers.github/workflows/deploy.ymlon the in-cluster ARC scale setarc-itguys-ro-nextcloud(asus-pinned).nextcloud-deployerin nsnextcloud,cf-token-writerin nscert-managernarrowed toresourceNames: [cloudflare-api-token]). RBAC atmanifests/bootstrap/11-ci-deployer-rbac.yaml.secretsalways;manifestsifmanifests/*.yamlchanged;helmifhelm/**changed.workflow_dispatchreconcile_all=trueforces full reconcile.manifests/60-nginx-tls-proxy.yamlexplicitly excluded from CI — live proxy is shared:443for headlamp/degoog/searxng/degoog-mcp with extra vhosts +/tls-warpcert mount not in repo.manifests/bootstrap/; not CI-applied.Design doc:
docs/superpowers/specs/2026-05-25-nextcloud-ci-deployment-design.md.Test plan
kubectl diff -f manifests/*clean (only nginx-tls-proxy drifted; resolved by exclusion).arc-itguys-ro-nextcloudinstalled, listener pod Running.kubectl auth can-ismoke tests pass for the runner SA.pr-checks.yml) green.deploy.ymlno-op against live (helm release moves to next revision but resources unchanged; manifests are already current).