name: Deploy to AWS EKS
on:
  push:
    branches:
      - 'deploy/**' # DEPLOY 브랜치에 푸시되었을 때 실행하겠습니다. 예시)deploy/221223
env:
  ECR_URI: 123456789012.dkr.ecr.ap-northeast-2.amazonaws.com # ECR URI로 고쳐주십시오
  ECR_REPOSITORY: pmi-api # ECR 레포지토리 이름
  ROLE_ARN: arn:aws:iam::123456789012:role/github-actions-eks # 위에서 생성한 역할의 ARN
  AWS_REGION: ap-northeast-2
  DEPLOYMENT_NAME: pmi-api  # k8s deployment 이름을 변수화 했습니다
jobs:
  build-and-deploy:
    runs-on: ubuntu-latest

    permissions:
      id-token: write   # This is required for requesting the JWT
      contents: read    # This is required for actions/checkout

    steps:
      # 체크아웃 액션을 해야 github action에서 코드를 가져올 수 있습니다.(필수)
      - name: Checkout
        uses: actions/checkout@v3 

      # AWS 자격 증명 (생성한 OIDC 공급자를 사용해 역할을 얻습니다.)
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${\{ env.ROLE_ARN }}
          aws-region: ${\{ env.AWS_REGION }}

      # AWS ECR 로그인 (ECR에 이미지를 푸시하기 위해 필요합니다.)
      - name: Login to Amazon ECR Private
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2


      # docker 이미지를 빌드 하고 push 하겠습니다. image tag는 github sha를 사용합시다.
      - name: Build and push docker image to Amazon ECR
        env:
          REGISTRY: ${\{ steps.login-ecr.outputs.registry }}
          REPOSITORY: ${\{ env.ECR_REPOSITORY }}
          IMAGE_TAG: ${\{ github.sha }}
        run: |
          docker build -t $REGISTRY/$REPOSITORY:$IMAGE_TAG .
          docker push $REGISTRY/$REPOSITORY:$IMAGE_TAG

      # kubectl-aws-eks 액션을 사용해 EKS 클러스터에 있는 deployment의 image를 업데이트 합니다.
      - name: deploy to cluster
        uses: kodermax/kubectl-aws-eks@main
        env:
          KUBE_CONFIG_DATA: ${\{ secrets.AWS_PMI_EKS_KUBECONFIG }} # 위에서 생성한 kubeconfig secrets
          ECR_REGISTRY: ${\{ steps.login-ecr.outputs.registry }}
          ECR_REPOSITORY: ${\{ env.ECR_REPOSITORY }}
          DEPLOYMENT_NAME: ${\{ env.DEPLOYMENT_NAME }}
          IMAGE_TAG: ${\{ github.sha }}
        with:
          args: set image deployment/$DEPLOYMENT_NAME $ECR_REPOSITORY=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG

      # 이미지가 업데이트 되었으니 rollout을 해줍니다.
      - name: verify deployment
        uses: kodermax/kubectl-aws-eks@main
        env:
          KUBE_CONFIG_DATA: ${\{ secrets.AWS_PMI_EKS_KUBECONFIG }}
          DEPLOYMENT_NAME: ${\{ env.DEPLOYMENT_NAME }}
        with:
          args: rollout status deployment/$DEPLOYMENT_NAME

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  # 클러스터 role은 namepsace가 필요 없습니다
  name: github-oidc-cluster-role
rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: github-oidc-cluster-role-binding
subjects:
  - kind: User
    name: github-oidc-auth-user
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: github-oidc-cluster-role
  apiGroup: rbac.authorization.k8s.io

apiVersion: v1
kind: ConfigMap
data:
  mapRoles: |
    - groups:
      - system:bootstrappers
      - system:nodes
      rolearn: arn:aws:iam::123456789012:role/github-actions-eks # 위에서 생성한 역할의 ARN
      username: github-oidc-auth-user # 위에서 생성한 cluster role의 이름