You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
-**Kubeconfig**: wird zur**Build-Zeit**in der Pipeline dieses Repos übergeben (Secret`KUBECONFIG_B64`) und als Default ins Image eingebacken. In einem Job kann man optional per Env **`KUBECONFIG_B64`** überschreiben; wenn nicht gesetzt, gilt immer die zur Build-Zeit eingebackene Kubeconfig.
7
+
-**kubectl**and**Helm** (Alpine-based)
8
+
-**Kubeconfig**: passed at**build time**via the pipeline of this repo (secret`KUBECONFIG_B64`) and baked into the image as default. In a job, you can optionally override it via env **`KUBECONFIG_B64`**; if not set, the kubeconfig baked in at build time is always used.
9
9
10
10
## Build & Push
11
11
12
-
Bei Push auf`main` baut `.github/workflows/build-and-push.yml`pro Stage ein Image und pusht es nach **GHCR**. Die Stages sind als Matrix definiert (z. B. `staging`, `production`), jede mit einem eigenen Secret.
12
+
On push to`main`, `.github/workflows/build-and-push.yml`builds an image per stage and pushes it to **GHCR**. Stages are defined as a matrix (e.g. `staging`, `production`), each with its own secret.
13
13
14
-
**In diesem Repository** müssen pro Stage Secrets gesetzt sein (base64-kodierte Kubeconfig):
14
+
**In this repository**, secrets must be set per stage (base64-encoded kubeconfig):
Das Skript liest`/etc/rancher/k3s/k3s.yaml`vom SSH-Host, setzt die Server-URL auf`https://<host>:6443`, kodiert base64 und setzt das Secret per `gh secret set`. Optional: `SSH_HOST=myhost.example.com`, `SSH_USER=user`, `SECRET_NAME` oder`GITHUB_REPO=owner/repo` setzen.
27
+
The script reads`/etc/rancher/k3s/k3s.yaml`from the SSH host, sets the server URL to`https://<host>:6443`, base64-encodes it, and sets the secret via `gh secret set`. Optional: set `SSH_HOST=myhost.example.com`, `SSH_USER=user`, `SECRET_NAME`, or`GITHUB_REPO=owner/repo`.
28
28
29
-
- Push-Credentials: `GITHUB_TOKEN`
29
+
- Push credentials: `GITHUB_TOKEN`
30
30
31
-
## Nutzung in einer anderen GitHub Action (z. B. Deployment)
31
+
## Usage in another GitHub Action (e.g. Deployment)
32
32
33
-
Image als Container nutzen; **Default-Kubeconfig**ist die beim Build eingebackene (pro Stage). Optional: mit`KUBECONFIG_B64`im Job eine andere Kubeconfig setzen.
33
+
Use the image as a container; the **default kubeconfig**is the one baked in at build time (per stage). Optionally, set`KUBECONFIG_B64`in the job to use a different kubeconfig.
34
34
35
-
**Falls "Error response from daemon: denied" beim Pull:**Das andere Repo hat mit `GITHUB_TOKEN` standardmäßig kein Lese-Recht für dieses Package. Entweder:
35
+
**If you get "Error response from daemon: denied" on pull:**The other repo does not have read access to this package by default with `GITHUB_TOKEN`. Either:
36
36
37
-
-**Package öffentlich machen:** Repo dockerized-deployment → rechte Seite**Packages** → Package öffnen → **Package settings** → **Change visibility** → **Public**. Dann braucht der Deploy-Job keine speziellen Rechte.
38
-
-**Oder Zugriff erlauben:**Unter Package settings → Manage Actions access das Ziel-Repository mit **Read**hinzufügen.
37
+
-**Make the package public:** Repo dockerized-deployment → right sidebar**Packages** → open package → **Package settings** → **Change visibility** → **Public**. Then the deploy job does not need special permissions.
38
+
-**Or grant access:**Under [Package settings → Manage Actions access](https://github.com/orgs/project-construct-x/packages/container/dockerized-deployment/settings), add the target repository with **Read**permission.
39
39
40
40
```yaml
41
41
jobs:
@@ -46,7 +46,7 @@ jobs:
46
46
credentials:
47
47
username: ${{ github.actor }}
48
48
password: ${{ secrets.GITHUB_TOKEN }}
49
-
# Optional: eigene Kubeconfig statt der eingebackenen
49
+
# Optional: own kubeconfig instead of the baked-in one
50
50
# env:
51
51
# KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
52
52
steps:
@@ -58,9 +58,9 @@ jobs:
58
58
--set image.tag="${{ github.sha }}"
59
59
```
60
60
61
-
Für Production einfach den Tag tauschen: `dockerized-deployment:production`.
61
+
For production, simply swap the tag: `dockerized-deployment:production`.
62
62
63
-
Alternativ ohne `container:` – Image nur für einen Step:
63
+
Alternatively, without `container:` – image only for a single step:
64
64
65
65
```yaml
66
66
- name: Deploy with Helm
@@ -75,11 +75,11 @@ Alternativ ohne `container:` – Image nur für einen Step:
75
75
'
76
76
```
77
77
78
-
Empfohlen: Job mit `container:` (erstes Beispiel), dann läuft der ganze Job im Image und `run: |` ist das multiline Skript.
78
+
Recommended: job with `container:` (first example), then the entire job runs inside the image and `run: |` is the multiline script.
@@ -88,13 +88,13 @@ docker run --rm dockerized-deployment kubectl get nodes
88
88
docker run --rm dockerized-deployment helm list -A
89
89
```
90
90
91
-
Optional: zur Laufzeit andere Kubeconfig setzen:
91
+
Optional: set a different kubeconfig at runtime:
92
92
93
93
```bash
94
94
docker run --rm -e KUBECONFIG_B64="$OTHER_KUBECONFIG_B64" dockerized-deployment kubectl get nodes
95
95
```
96
96
97
-
Multiline-Skript (mit Default-Kubeconfig):
97
+
Multiline script (with default kubeconfig):
98
98
99
99
```bash
100
100
docker run --rm dockerized-deployment sh -c '
@@ -111,4 +111,4 @@ This documentation is located in the `/docs` folder.
111
111
112
112
All code files are distributed under the Apache 2.0 license. See [LICENSE](./LICENSE) for more information.
113
113
114
-
All non-code files are distributed under the Creative Commons Attribution 4.0 International license. See [LICENSE_non-code](./LICENSE_non-code) for more information.
114
+
All non-code files are distributed under the Creative Commons Attribution 4.0 International license. See [LICENSE_non_code](./LICENSE_non_code) for more information.
Copy file name to clipboardExpand all lines: docs/configuration.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,16 +10,16 @@
10
10
11
11
## GitHub Actions Secrets
12
12
13
-
Pro Stage wird ein eigenes Secret benötigt (siehe[Stage Matrix](#stage-matrix)).
13
+
Each stage needs its own secret (see[Stage Matrix](#stage-matrix)).
14
14
15
15
| Secret | Required | Description |
16
16
|---|---|---|
17
-
|`KUBECONFIG_B64_<STAGE>`|Pro Stage| Base64-encoded Kubeconfig für die jeweilige Stage, wird als Build-Arg ins Image gebacken|
17
+
|`KUBECONFIG_B64_<STAGE>`|Per stage| Base64-encoded kubeconfig for the respective stage, baked into the image as build-arg|
18
18
|`GITHUB_TOKEN`| Automatic | Provided by GitHub; used to authenticate to GHCR |
19
19
20
20
## Stage Matrix
21
21
22
-
Die Stages werden in `.github/workflows/build-and-push.yml`als Matrix definiert. Jeder Eintrag ist ein Tupel aus`name` (Stage-Identifier, wird als Image-Tag verwendet) und`secret` (Name des GitHub-Secrets mit der Kubeconfig).
22
+
Stages are defined in `.github/workflows/build-and-push.yml`as a matrix. Each entry is a tuple of`name` (stage identifier, used as image tag) and`secret` (name of the GitHub secret containing the kubeconfig).
23
23
24
24
```yaml
25
25
strategy:
@@ -32,14 +32,14 @@ strategy:
32
32
secret: KUBECONFIG_B64_PRODUCTION
33
33
```
34
34
35
-
Die Matrix sorgt dafür, dass derselbe Build-Job pro Stage einmal läuft — mit dem jeweiligen Secret und Stage-spezifischen Image-Tags:
35
+
The matrix ensures the same build job runs once per stage — with the respective secret and stage-specific image tags:
0 commit comments