Skip to content

Commit 043926b

Browse files
ZIJZIJ
authored
Merge pull request #2058 from diggerhq/docs/enhance-helm-guide-with-iac-steps
docs: add IaC setup steps to Helm deployment guide
2 parents 2bfca47 + 9683a15 commit 043926b

File tree

1 file changed

+230
-0
lines changed

1 file changed

+230
-0
lines changed

‎docs/ce/self-host/deploy-helm.mdx

Lines changed: 230 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,236 @@ description: "Learn how to use Helm chart to install Digger on your Kubernetes c
186186
- Select which repositories the app can access
187187
</Step>
188188

189+
<Step title="Create Action Secrets with cloud credentials">
190+
In GitHub repository settings, go to Secrets and Variables - Actions. Create the following secrets:
191+
192+
<Tabs>
193+
<Tab title="AWS">
194+
- `AWS_ACCESS_KEY_ID`
195+
- `AWS_SECRET_ACCESS_KEY`
196+
197+
You can also [use OIDC](/ce/cloud-providers/authenticating-with-oidc-on-aws) for AWS authentication.
198+
</Tab>
199+
<Tab title="GCP">
200+
- `GCP_CREDENTIALS` - contents of your GCP Service Account Key json file
201+
202+
You can also [use OIDC](/gcp/federated-oidc-access/) for GCP authentication.
203+
</Tab>
204+
<Tab title="Azure">
205+
- `AZURE_CLIENT_ID` - Your Azure App Registration Client ID
206+
- `AZURE_TENANT_ID` - Your Azure Tenant ID
207+
- `AZURE_SUBSCRIPTION_ID` - Your Azure Subscription ID
208+
209+
You'll need to configure OIDC authentication by setting up federated credentials in your Azure App Registration. See [Azure OIDC setup](/ce/azure-specific/azure) for details.
210+
</Tab>
211+
</Tabs>
212+
</Step>
213+
214+
<Step title="Create digger.yml">
215+
This file contains Digger configuration and needs to be placed at the root level of your repository:
216+
217+
<Tabs>
218+
<Tab title="Terraform / OpenTofu">
219+
Assuming your terraform code is in the `prod` directory:
220+
221+
```
222+
projects:
223+
- name: production
224+
dir: prod
225+
```
226+
</Tab>
227+
<Tab title="Terragrunt Generated">
228+
For Terragrunt monorepos with many modules, use the blocks syntax to automatically generate projects:
229+
230+
```yaml
231+
generate_projects:
232+
blocks:
233+
- block_name: dev
234+
terragrunt: true
235+
root_dir: "dev/"
236+
workflow: default
237+
- block_name: staging
238+
terragrunt: true
239+
root_dir: "staging/"
240+
workflow: default
241+
- block_name: prod
242+
terragrunt: true
243+
root_dir: "prod/"
244+
workflow: default
245+
246+
workflows:
247+
default:
248+
plan:
249+
steps:
250+
- init
251+
- plan
252+
apply:
253+
steps:
254+
- init
255+
- apply
256+
```
257+
258+
This approach automatically discovers all Terragrunt modules under each directory and creates projects for them.
259+
</Tab>
260+
</Tabs>
261+
</Step>
262+
263+
<Step title="Create Github Actions workflow file">
264+
Place it at `.github/workflows/digger_workflow.yml` (name is important!)
265+
266+
<Tabs>
267+
<Tab title="AWS">
268+
```yaml
269+
name: Digger Workflow
270+
271+
on:
272+
workflow_dispatch:
273+
inputs:
274+
spec:
275+
required: true
276+
run_name:
277+
required: false
278+
279+
run-name: '${{inputs.run_name}}'
280+
281+
jobs:
282+
digger-job:
283+
runs-on: ubuntu-latest
284+
permissions:
285+
contents: write # required to merge PRs
286+
actions: write # required for plan persistence
287+
id-token: write # required for workload-identity-federation
288+
pull-requests: write # required to post PR comments
289+
issues: read # required to check if PR number is an issue or not
290+
statuses: write # required to validate combined PR status
291+
292+
steps:
293+
- uses: actions/checkout@v4
294+
- name: ${{ fromJSON(github.event.inputs.spec).job_id }}
295+
run: echo "job id ${{ fromJSON(github.event.inputs.spec).job_id }}"
296+
- uses: diggerhq/digger@vLatest
297+
with:
298+
digger-spec: ${{ inputs.spec }}
299+
setup-aws: true
300+
setup-terraform: true
301+
terraform-version: 1.5.5
302+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
303+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
304+
env:
305+
GITHUB_CONTEXT: ${{ toJson(github) }}
306+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
307+
```
308+
</Tab>
309+
<Tab title="GCP">
310+
```yaml
311+
name: Digger
312+
313+
on:
314+
workflow_dispatch:
315+
inputs:
316+
spec:
317+
required: true
318+
run_name:
319+
required: false
320+
321+
run-name: '${{inputs.run_name}}'
322+
323+
jobs:
324+
digger-job:
325+
name: Digger
326+
runs-on: ubuntu-latest
327+
permissions:
328+
contents: write # required to merge PRs
329+
actions: write # required for plan persistence
330+
id-token: write # required for workload-identity-federation
331+
pull-requests: write # required to post PR comments
332+
issues: read # required to check if PR number is an issue or not
333+
statuses: write # required to validate combined PR status
334+
steps:
335+
- uses: actions/checkout@v4
336+
- name: ${{ fromJSON(github.event.inputs.spec).job_id }}
337+
run: echo "job id ${{ fromJSON(github.event.inputs.spec).job_id }}"
338+
- id: 'auth'
339+
uses: 'google-github-actions/auth@v1'
340+
with:
341+
credentials_json: '${{ secrets.GCP_CREDENTIALS }}'
342+
create_credentials_file: true
343+
- name: 'Set up Cloud SDK'
344+
uses: 'google-github-actions/setup-gcloud@v1'
345+
- name: 'Use gcloud CLI'
346+
run: 'gcloud info'
347+
- name: digger run
348+
uses: diggerhq/digger@vLatest
349+
with:
350+
digger-spec: ${{ inputs.spec }}
351+
setup-aws: false
352+
setup-terraform: true
353+
terraform-version: 1.5.5
354+
env:
355+
GITHUB_CONTEXT: ${{ toJson(github) }}
356+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
357+
```
358+
</Tab>
359+
<Tab title="Azure">
360+
```yaml
361+
name: Digger Workflow
362+
363+
on:
364+
workflow_dispatch:
365+
inputs:
366+
spec:
367+
required: true
368+
run_name:
369+
required: false
370+
371+
run-name: '${{inputs.run_name}}'
372+
373+
jobs:
374+
digger-job:
375+
runs-on: ubuntu-latest
376+
permissions:
377+
contents: write # required to merge PRs
378+
actions: write # required for plan persistence
379+
id-token: write # required for workload-identity-federation
380+
pull-requests: write # required to post PR comments
381+
issues: read # required to check if PR number is an issue or not
382+
statuses: write # required to validate combined PR status
383+
384+
steps:
385+
- uses: actions/checkout@v4
386+
- name: ${{ fromJSON(github.event.inputs.spec).job_id }}
387+
run: echo "job id ${{ fromJSON(github.event.inputs.spec).job_id }}"
388+
- uses: diggerhq/digger@vLatest
389+
with:
390+
digger-spec: ${{ inputs.spec }}
391+
setup-azure: true
392+
azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
393+
azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
394+
azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
395+
setup-terraform: true
396+
terraform-version: 1.5.5
397+
env:
398+
GITHUB_CONTEXT: ${{ toJson(github) }}
399+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
400+
ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
401+
ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
402+
ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
403+
```
404+
</Tab>
405+
</Tabs>
406+
407+
<Note>
408+
The workflow above uses Terraform. For other tools:
409+
- **OpenTofu**: Replace `setup-terraform: true` with `setup-opentofu: true` and `terraform-version: 1.5.5` with `opentofu-version: 1.10.3`
410+
- **Terragrunt**: Replace `setup-terraform: true` with `setup-terragrunt: true` and `terraform-version: 1.5.5` with `terragrunt-version: 0.44.1`
411+
412+
For complete examples, see:
413+
- [Terraform quickstart](/ce/getting-started/with-terraform)
414+
- [OpenTofu quickstart](/ce/getting-started/with-opentofu)
415+
- [Terragrunt quickstart](/ce/getting-started/with-terragrunt)
416+
</Note>
417+
</Step>
418+
189419
<Step title="Verify installation">
190420
Test that your Digger installation is working correctly:
191421

0 commit comments

Comments
 (0)