Skip to content

Commit eca4181

Browse files
vertismvertism
authored
Merge branch 'main' into re-add-multiple-convictions
2 parents 33b680f + 55c88de commit eca4181

18 files changed

+1443
-24
lines changed

‎.env.example

-8
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,2 @@
11
DATABASE_URL=postgresql://postgres@db/disclosure-checker
22
SESSION_EXPIRES_IN_MINUTES=60
3-
4-
# Uncomment this line to enable http credentials site-wise.
5-
# HTTP_AUTH_ENABLED=1
6-
7-
# Following are the credentials, also used in the back office.
8-
# Even if the `HTTP_AUTH_ENABLED` is disabled, the back office still will use them.
9-
HTTP_AUTH_USER=test
10-
HTTP_AUTH_PASSWORD=test

‎.github/workflows/deploy.yml

+137-16
Original file line numberDiff line numberDiff line change
@@ -54,24 +54,124 @@ jobs:
5454
-t ${{ vars.ECR_URL }}:$SHA .
5555
5656
- name: Push to ECR
57+
run: docker push ${{ vars.ECR_URL }}:$SHA
58+
59+
deploy-staging:
60+
runs-on: ubuntu-latest
61+
needs: build
62+
environment: staging
63+
64+
permissions:
65+
id-token: write # This is required for requesting the JWT
66+
contents: read # This is required for actions/checkout
67+
68+
env:
69+
KUBE_NAMESPACE: ${{ secrets.KUBE_NAMESPACE }}
70+
KUBE_CERT: ${{ secrets.KUBE_CERT }}
71+
KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
72+
KUBE_CLUSTER: ${{ secrets.KUBE_CLUSTER }}
73+
74+
steps:
75+
- name: Checkout
76+
uses: actions/checkout@v4
77+
78+
- name: Assume role in Cloud Platform
79+
uses: aws-actions/configure-aws-credentials@v4
80+
with:
81+
role-to-assume: ${{ secrets.ECR_ROLE_TO_ASSUME }}
82+
aws-region: ${{ vars.ECR_REGION }}
83+
84+
- name: Login to container repository
85+
uses: aws-actions/amazon-ecr-login@v2
86+
id: login-ecr
87+
88+
- name: Store build tag
89+
id: vars
5790
run: |
91+
branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}
92+
short_sha=$(git rev-parse --short $SHA)
93+
build_tag=$PREFIX-$branch-$short_sha
94+
echo "build_tag=$build_tag" >> $GITHUB_OUTPUT
95+
96+
- name: Tag build and push to ECR
97+
run: |
98+
docker pull ${{ vars.ECR_URL }}:$SHA
5899
docker tag ${{ vars.ECR_URL }}:$SHA ${{ vars.ECR_URL }}:staging.latest
59-
docker tag ${{ vars.ECR_URL }}:$SHA ${{ vars.ECR_URL }}:production.latest
60-
docker push ${{ vars.ECR_URL }}:$SHA
61100
docker push ${{ vars.ECR_URL }}:staging.latest
62-
docker push ${{ vars.ECR_URL }}:production.latest
63101
64-
deploy-staging:
102+
- name: Authenticate to the cluster
103+
run: |
104+
echo "${KUBE_CERT}" > ca.crt
105+
kubectl config set-cluster ${KUBE_CLUSTER} --certificate-authority=./ca.crt --server=https://${KUBE_CLUSTER}
106+
kubectl config set-credentials deploy-user --token=${KUBE_TOKEN}
107+
kubectl config set-context ${KUBE_CLUSTER} --cluster=${KUBE_CLUSTER} --user=deploy-user --namespace=${KUBE_NAMESPACE}
108+
kubectl config use-context ${KUBE_CLUSTER}
109+
110+
- name: Rollout restart deployment
111+
run: |
112+
kubectl set image -n ${KUBE_NAMESPACE} \
113+
deployment/disclosure-checker-staging \
114+
webapp="${{ vars.ECR_URL }}:$SHA"
115+
116+
- name: Send deploy notification to product Slack channel
117+
uses: slackapi/slack-github-action@v1.25.0
118+
with:
119+
payload: |
120+
{
121+
"attachments": [
122+
{
123+
"color": "#1d990c",
124+
"text": "${{ github.actor }} deployed *${{ steps.vars.outputs.build_tag }}* to *Staging*",
125+
"fields": [
126+
{
127+
"title": "Project",
128+
"value": "Disclosure Checker",
129+
"short": true
130+
}
131+
],
132+
"actions": [
133+
{
134+
"text": "Visit Job",
135+
"type": "button",
136+
"url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
137+
}
138+
]
139+
}
140+
]
141+
}
142+
env:
143+
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
144+
SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
145+
146+
deploy-qa:
65147
runs-on: ubuntu-latest
66148
needs: build
149+
environment: qa
150+
151+
permissions:
152+
id-token: write # This is required for requesting the JWT
153+
contents: read # This is required for actions/checkout
67154

68155
env:
69156
KUBE_NAMESPACE: ${{ secrets.KUBE_NAMESPACE }}
157+
KUBE_CERT: ${{ secrets.KUBE_CERT }}
158+
KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
159+
KUBE_CLUSTER: ${{ secrets.KUBE_CLUSTER }}
70160

71161
steps:
72162
- name: Checkout
73163
uses: actions/checkout@v4
74164

165+
- name: Assume role in Cloud Platform
166+
uses: aws-actions/configure-aws-credentials@v4
167+
with:
168+
role-to-assume: ${{ secrets.ECR_ROLE_TO_ASSUME }}
169+
aws-region: ${{ vars.ECR_REGION }}
170+
171+
- name: Login to container repository
172+
uses: aws-actions/amazon-ecr-login@v2
173+
id: login-ecr
174+
75175
- name: Store build tag
76176
id: vars
77177
run: |
@@ -80,11 +180,13 @@ jobs:
80180
build_tag=$PREFIX-$branch-$short_sha
81181
echo "build_tag=$build_tag" >> $GITHUB_OUTPUT
82182
183+
- name: Tag build and push to ECR
184+
run: |
185+
docker pull ${{ vars.ECR_URL }}:$SHA
186+
docker tag ${{ vars.ECR_URL }}:$SHA ${{ vars.ECR_URL }}:qa.latest
187+
docker push ${{ vars.ECR_URL }}:qa.latest
188+
83189
- name: Authenticate to the cluster
84-
env:
85-
KUBE_CERT: ${{ secrets.KUBE_CERT }}
86-
KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
87-
KUBE_CLUSTER: ${{ secrets.KUBE_CLUSTER }}
88190
run: |
89191
echo "${KUBE_CERT}" > ca.crt
90192
kubectl config set-cluster ${KUBE_CLUSTER} --certificate-authority=./ca.crt --server=https://${KUBE_CLUSTER}
@@ -95,7 +197,7 @@ jobs:
95197
- name: Rollout restart deployment
96198
run: |
97199
kubectl set image -n ${KUBE_NAMESPACE} \
98-
deployment/disclosure-checker-deployment-staging \
200+
deployment/disclosure-checker-qa \
99201
webapp="${{ vars.ECR_URL }}:$SHA"
100202
101203
- name: Send deploy notification to product Slack channel
@@ -106,7 +208,7 @@ jobs:
106208
"attachments": [
107209
{
108210
"color": "#1d990c",
109-
"text": "${{ github.actor }} deployed *${{ steps.vars.outputs.build_tag }}* to *Staging*",
211+
"text": "${{ github.actor }} deployed *${{ steps.vars.outputs.build_tag }}* to *QA*",
110212
"fields": [
111213
{
112214
"title": "Project",
@@ -134,13 +236,30 @@ jobs:
134236
if: ${{ github.ref == 'refs/heads/main' }}
135237
environment: production
136238

239+
permissions:
240+
id-token: write # This is required for requesting the JWT
241+
contents: read # This is required for actions/checkout
242+
137243
env:
138-
KUBE_NAMESPACE: ${{ secrets.KUBE_PROD_NAMESPACE }}
244+
KUBE_NAMESPACE: ${{ secrets.KUBE_NAMESPACE }}
245+
KUBE_CERT: ${{ secrets.KUBE_CERT }}
246+
KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
247+
KUBE_CLUSTER: ${{ secrets.KUBE_CLUSTER }}
139248

140249
steps:
141250
- name: Checkout
142251
uses: actions/checkout@v4
143252

253+
- name: Assume role in Cloud Platform
254+
uses: aws-actions/configure-aws-credentials@v4
255+
with:
256+
role-to-assume: ${{ secrets.ECR_ROLE_TO_ASSUME }}
257+
aws-region: ${{ vars.ECR_REGION }}
258+
259+
- name: Login to container repository
260+
uses: aws-actions/amazon-ecr-login@v2
261+
id: login-ecr
262+
144263
- name: Store build tag
145264
id: vars
146265
run: |
@@ -149,11 +268,13 @@ jobs:
149268
build_tag=$PREFIX-$branch-$short_sha
150269
echo "build_tag=$build_tag" >> $GITHUB_OUTPUT
151270
271+
- name: Tag build and push to ECR
272+
run: |
273+
docker pull ${{ vars.ECR_URL }}:$SHA
274+
docker tag ${{ vars.ECR_URL }}:$SHA ${{ vars.ECR_URL }}:production.latest
275+
docker push ${{ vars.ECR_URL }}:production.latest
276+
152277
- name: Authenticate to the cluster
153-
env:
154-
KUBE_CERT: ${{ secrets.KUBE_PROD_CERT }}
155-
KUBE_TOKEN: ${{ secrets.KUBE_PROD_TOKEN }}
156-
KUBE_CLUSTER: ${{ secrets.KUBE_PROD_CLUSTER }}
157278
run: |
158279
echo "${KUBE_CERT}" > ca.crt
159280
kubectl config set-cluster ${KUBE_CLUSTER} --certificate-authority=./ca.crt --server=https://${KUBE_CLUSTER}
@@ -164,7 +285,7 @@ jobs:
164285
- name: Rollout restart deployment
165286
run: |
166287
kubectl set image -n ${KUBE_NAMESPACE} \
167-
deployment/disclosure-checker-deployment-production \
288+
deployment/disclosure-checker-production \
168289
webapp="${{ vars.ECR_URL }}:$SHA"
169290
170291
- name: Send deploy notification to product Slack channel

‎config/kubernetes/production/config_map.yml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: disclosure-checker-configmap-production
5+
namespace: disclosure-checker-production
6+
data:
7+
EXTERNAL_URL: https://check-when-to-disclose-caution-conviction.service.gov.uk
8+
RACK_ENV: production
9+
RAILS_ENV: production
10+
RAILS_MAX_THREADS: "3"
11+
RAILS_SERVE_STATIC_FILES: enabled

‎config/kubernetes/production/cronjob.yml

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
apiVersion: batch/v1
2+
kind: CronJob
3+
metadata:
4+
name: disclosure-checker-cronjob-production
5+
namespace: disclosure-checker-production
6+
spec:
7+
schedule: "0 3 * * *"
8+
concurrencyPolicy: Forbid
9+
startingDeadlineSeconds: 300
10+
jobTemplate:
11+
spec:
12+
ttlSecondsAfterFinished: 86400 # 24 hours
13+
backoffLimit: 3
14+
template:
15+
metadata:
16+
labels:
17+
tier: worker
18+
spec:
19+
restartPolicy: Never
20+
containers:
21+
- name: cronjob-daily-tasks
22+
image: 754256621582.dkr.ecr.eu-west-2.amazonaws.com/family-justice/disclosure-checker:production.latest
23+
imagePullPolicy: Always
24+
command: ['bin/rails', 'daily_tasks']
25+
# non-secret env vars defined in `config_map.yaml`
26+
envFrom:
27+
- configMapRef:
28+
name: disclosure-checker-configmap-production
29+
env:
30+
# external secrets defined in `secrets.yml`
31+
- name: SECRET_KEY_BASE
32+
valueFrom:
33+
secretKeyRef:
34+
name: disclosure-checker-secrets-production
35+
key: secret_key_base
36+
- name: SENTRY_DSN
37+
valueFrom:
38+
secretKeyRef:
39+
name: disclosure-checker-secrets-production
40+
key: sentry_dsn
41+
#
42+
# secrets created by `terraform`
43+
#
44+
- name: DATABASE_URL
45+
valueFrom:
46+
secretKeyRef:
47+
name: rds-instance-disclosure-checker-production
48+
key: url

‎config/kubernetes/production/deployment.yml

+81
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: disclosure-checker-production
5+
namespace: disclosure-checker-production
6+
spec:
7+
replicas: 3
8+
revisionHistoryLimit: 5
9+
strategy:
10+
type: RollingUpdate
11+
rollingUpdate:
12+
maxUnavailable: 0
13+
maxSurge: 100%
14+
selector:
15+
matchLabels:
16+
app: disclosure-checker-web-production
17+
template:
18+
metadata:
19+
labels:
20+
app: disclosure-checker-web-production
21+
tier: frontend
22+
spec:
23+
containers:
24+
- name: webapp
25+
image: 754256621582.dkr.ecr.eu-west-2.amazonaws.com/family-justice/disclosure-checker:production.latest
26+
imagePullPolicy: Always
27+
ports:
28+
- containerPort: 3000
29+
resources:
30+
requests:
31+
cpu: 125m
32+
memory: 500Mi
33+
limits:
34+
cpu: 250m
35+
memory: 1Gi
36+
readinessProbe:
37+
httpGet:
38+
path: /ping.json
39+
port: 3000
40+
httpHeaders:
41+
- name: X-Forwarded-Proto
42+
value: https
43+
- name: X-Forwarded-Ssl
44+
value: "on"
45+
initialDelaySeconds: 15
46+
periodSeconds: 10
47+
livenessProbe:
48+
httpGet:
49+
path: /ping.json
50+
port: 3000
51+
httpHeaders:
52+
- name: X-Forwarded-Proto
53+
value: https
54+
- name: X-Forwarded-Ssl
55+
value: "on"
56+
initialDelaySeconds: 30
57+
periodSeconds: 10
58+
# non-secret env vars defined in `config_map.yaml`
59+
envFrom:
60+
- configMapRef:
61+
name: disclosure-checker-configmap-production
62+
env:
63+
# external secrets defined in `secrets.yml`
64+
- name: SECRET_KEY_BASE
65+
valueFrom:
66+
secretKeyRef:
67+
name: disclosure-checker-secrets-production
68+
key: secret_key_base
69+
- name: SENTRY_DSN
70+
valueFrom:
71+
secretKeyRef:
72+
name: disclosure-checker-secrets-production
73+
key: sentry_dsn
74+
#
75+
# secrets created by `terraform`
76+
#
77+
- name: DATABASE_URL
78+
valueFrom:
79+
secretKeyRef:
80+
name: rds-instance-disclosure-checker-production
81+
key: url

0 commit comments

Comments
 (0)