-
Notifications
You must be signed in to change notification settings - Fork 0
44 lines (40 loc) · 1.73 KB
/
sync-cloudflare-nets.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
---
name: Sync Cloudflare network ranges
on:
workflow_dispatch:
schedule:
- cron: "0 0 * * *"
jobs:
sync:
runs-on: ubuntu-latest
steps:
- name: Check out code
uses: actions/checkout@v4
- name: Process YAML
run: |
# renovate depName=mikefarah/yq
wget -O /tmp/yq https://github.com/mikefarah/yq/releases/download/v4.44.3/yq_linux_amd64
chmod +x /tmp/yq
readarray -d '' nets < <(curl -sS https://www.cloudflare.com/ips-v4/ | sort)
readarray -d '' netsv6 < <(curl -sS https://www.cloudflare.com/ips-v6/ | sort)
nets+=$(printf '\n%s' "${netsv6[@]}")
cilium_nets=$(printf '"%s", ' ${nets[@]})
/tmp/yq eval --inplace ".spec.ingress[1].fromCIDR = [ ${cilium_nets%,*} ]" infra/ingress-nginx/ciliumnetworkpolicy.yaml
ingress_nets=$(printf '%s,' ${nets[@]})
ingress_nets="${ingress_nets%,*}"
/tmp/yq eval --inplace ".spec.values.controller.config.proxy-real-ip-cidr = \"${ingress_nets}\"" infra/ingress-nginx/helmrelease.yaml
- name: Create pull request for cloudflare network range update
uses: peter-evans/create-pull-request@v6
with:
token: ${{ secrets.GITHUB_TOKEN }}
branch: "cf/update-nets"
delete-branch: true
title: "update cloudflare network ranges"
signoff: true
committer: "${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>"
author: "${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>"
assignees: "rxbn"
commit-message: "update cloudflare network ranges"
body: |
Cloudflare IP ranges: https://www.cloudflare.com/ips/
labels: cf/ip-ranges