Эфемерные namespace Kubernetes для preview pull request: автоматизация, изоляция и удаление

name: Ephemeral Environment Deployment
on:
  pull_request:
    types: [opened, synchronize, reopened, closed]

jobs:
  deploy-ephemeral:
    if: github.event.action != 'closed'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Authenticate to Kubernetes
        uses: azure/k8s-set-context@v4
        with:
          kubeconfig: ${{ secrets.KUBECONFIG }}

      - name: Set namespace name
        id: namespace
        run: echo "name=pr-${{ github.event.number }}" >> $GITHUB_OUTPUT

      - name: Set up Helm
        uses: azure/setup-helm@v4

      - name: Deploy to ephemeral namespace
        run: |
          kubectl create namespace ${{ steps.namespace.outputs.name }} \
            --dry-run=client -o yaml | kubectl apply -f -
          kubectl label namespace ${{ steps.namespace.outputs.name }} \
            app.kubernetes.io/managed-by=ci \
            pr-number=${{ github.event.number }} \
            --overwrite
          kubectl apply -f ./manifests/ephemeral-guardrails.yaml \
            -n ${{ steps.namespace.outputs.name }}
          helm upgrade --install app-${{ github.event.number }} ./chart \
            --namespace ${{ steps.namespace.outputs.name }} \
            --set image.tag=${{ github.sha }} \
            --set ingress.host=pr-${{ github.event.number }}.preview.example.com \
            --wait --timeout 5m

      - name: Comment PR with preview URL
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `Ephemeral environment ready: https://pr-${context.issue.number}.preview.example.com`
            })

  teardown-ephemeral:
    if: github.event.action == 'closed'
    runs-on: ubuntu-latest
    steps:
      - name: Authenticate to Kubernetes
        uses: azure/k8s-set-context@v4
        with:
          kubeconfig: ${{ secrets.KUBECONFIG }}

      - name: Delete ephemeral namespace
        run: |
          kubectl delete namespace pr-${{ github.event.number }} \
            --wait=false --ignore-not-found=true

apiVersion: v1
kind: ResourceQuota
metadata:
  name: ephemeral-quota
spec:
  hard:
    requests.cpu: "2"
    requests.memory: 4Gi
    limits.cpu: "4"
    limits.memory: 8Gi
    pods: "10"
---
apiVersion: v1
kind: LimitRange
metadata:
  name: ephemeral-limits
spec:
  limits:
    - type: Container
      default:
        cpu: 500m
        memory: 512Mi
      defaultRequest:
        cpu: 100m
        memory: 128Mi
      max:
        cpu: "2"
        memory: 2Gi