Skip to content

Commit 225cd84

Browse files
daniel-vadaniel-va
authored
Merge pull request #1416 from swisstopo/feature/asset-1370-deployment-der-applikation
Feature 1370: Deployment der Applikation
2 parents dca237e + 4e6bf9e commit 225cd84

15 files changed

+305
-1
lines changed

‎.github/workflows/code-quality.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ on:
66
branches:
77
- "**"
88
- "!main"
9-
109
env:
1110
NODE_VERSION: "22.5.1"
1211
RUST_VERSION: "1.82"

‎.github/workflows/deploy.yml

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
name: Deploy
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
env:
7+
type: choice
8+
description: The environment to which the Kubernetes config is deployed.
9+
options:
10+
- dev
11+
- int
12+
- prod
13+
14+
env:
15+
APP_ENV: ${{ github.event.inputs.env }}
16+
17+
jobs:
18+
publish-helm:
19+
name: "publish helm"
20+
runs-on: ubuntu-latest
21+
permissions:
22+
contents: read
23+
id-token: write
24+
steps:
25+
- name: "Load secrets"
26+
id: load-secrets
27+
uses: hashicorp/vault-action@v3
28+
with:
29+
url: https://swisstopo-vault-public-vault-d680830d.382257a9.z1.hashicorp.cloud:8200
30+
caCertificate: ${{ secrets.VAULT_CA_CERT }}
31+
method: jwt
32+
role: ${{ secrets.VAULT_ROLE }}
33+
namespace: admin/igi/igi-cloud/swisstopo-ngm
34+
secrets: |
35+
kv/data/${{ env.APP_ENV }}/k8s kubeconfig | KUBECONFIG;
36+
kv/data/${{ env.APP_ENV }}/k8s helm_values | HELM_VALUES;
37+
kv/data/${{ env.APP_ENV }}/k8s helm_secrets | HELM_SECRETS;
38+
- name: "Checkout repository"
39+
uses: actions/checkout@v4
40+
- name: "Setup kubectl"
41+
uses: azure/setup-kubectl@v4
42+
- name: "Install helm"
43+
uses: azure/setup-helm@v4
44+
- name: "Configure AWS credentials from AWS account"
45+
uses: aws-actions/configure-aws-credentials@v4
46+
with:
47+
role-to-assume: ${{ secrets.AWS_ROLE }}
48+
aws-region: ${{ secrets.AWS_REGION }}
49+
role-session-name: GitHub-OIDC
50+
retry-max-attempts: 3
51+
- name: "Write kubeconfig file"
52+
run: |
53+
echo "${{ env.HELM_VALUES }}" > ./k8s/values.yaml
54+
echo "${{ env.HELM_SECRETS }}" > ./k8s/secrets.yaml
55+
echo "${{ env.KUBECONFIG }}" > kubeconfig.yaml
56+
- name: "Deploy helm charts"
57+
env:
58+
KUBECONFIG: ./kubeconfig.yaml
59+
run: |
60+
helm upgrade --install swissgeol-viewer ./k8s \
61+
--values ./k8s/values.yaml \
62+
--values ./k8s/secrets.yaml \
63+
--kubeconfig $(pwd)/kubeconfig.yaml \
64+
--namespace ngm
65+

‎k8s/.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
values-*.yaml
2+
secrets-*.yaml

‎k8s/.helmignore

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎k8s/Chart.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: v2
2+
name: swissgeol-viewer
3+
description:
4+
type: application
5+
version: 1.0.0
6+
appVersion: 1.0.0

‎k8s/secrets.template.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Template for secret values used by the Helm files.
2+
3+
# Note that every secret needs to be nested below this `secret` key
4+
# so that we can properly encode them in template/secrets.yaml.
5+
secrets:
6+
# Database
7+
database_password:
8+
9+
# S3
10+
s3_access_key:
11+
s3_secret_key:

‎k8s/templates/NOTES.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
*** {{ .Chart.Name }} is successfully installed ***

‎k8s/templates/deployment.api.yaml

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ .Release.Name }}-api
5+
namespace: {{ .Release.Namespace }}
6+
annotations:
7+
keel.sh/policy: force
8+
keel.sh/match-tag: 'true'
9+
keel.sh/trigger: poll
10+
spec:
11+
replicas: 1
12+
selector:
13+
matchLabels:
14+
app: {{ .Release.Name }}-api
15+
template:
16+
metadata:
17+
labels:
18+
app: {{ .Release.Name }}-api
19+
spec:
20+
serviceAccountName: api
21+
containers:
22+
- name: {{ .Release.Name }}-api
23+
image: {{ .Values.docker.api_image }}
24+
imagePullPolicy: Always
25+
ports:
26+
- containerPort: 3000
27+
livenessProbe:
28+
httpGet:
29+
path: /api/health_check
30+
port: 3000
31+
readinessProbe:
32+
httpGet:
33+
path: /api/health_check
34+
port: 3000
35+
env:
36+
- name: APP_PORT
37+
value: '3000'
38+
- name: ENV
39+
value: prod
40+
41+
# Database
42+
- name: PGHOST
43+
value: "{{ .Values.database.host }}"
44+
- name: PGPORT
45+
value: "{{ .Values.database.port }}"
46+
- name: PGDATABASE
47+
value: "{{ .Values.database.name }}"
48+
- name: PGUSER
49+
value: "{{ .Values.database.user }}"
50+
- name: PG_SSL_MODE
51+
value: 'require'
52+
- name: PGPASSWORD
53+
valueFrom:
54+
secretKeyRef:
55+
name: {{ .Release.Name }}-secrets
56+
key: database_password
57+
58+
# S3
59+
- name: S3_AWS_REGION
60+
value: "{{ .Values.s3.region }}"
61+
- name: S3_BUCKET
62+
value: "{{ .Values.s3.bucket }}"
63+
- name: PROJECTS_S3_BUCKET
64+
value: "{{ .Values.s3.projects_bucket }}"
65+
66+
# Cognito
67+
- name: COGNITO_AWS_REGION
68+
value: "{{ .Values.cognito.region }}"
69+
- name: COGNITO_CLIENT_ID
70+
value: "{{ .Values.cognito.client_id }}"
71+
- name: COGNITO_POOL_ID
72+
value: "{{ .Values.cognito.pool_id }}"
73+
- name: COGNITO_IDENTITY_POOL_ID
74+
value: "{{ .Values.cognito.identity_pool_id }}"
75+
76+
# ION
77+
- name: ION_DEFAULT_ACCESS_TOKEN
78+
value: "{{ .Values.ion.default_access_token }}"
79+
80+
imagePullSecrets:
81+
- name: {{ .Release.Namespace }}-registry

‎k8s/templates/deployment.ui.yaml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ .Release.Name }}-ui
5+
namespace: {{ .Release.Namespace }}
6+
annotations:
7+
keel.sh/policy: force
8+
keel.sh/match-tag: 'true'
9+
keel.sh/trigger: poll
10+
spec:
11+
replicas: 1
12+
selector:
13+
matchLabels:
14+
app: {{ .Release.Name }}-ui
15+
template:
16+
metadata:
17+
labels:
18+
app: {{ .Release.Name }}-ui
19+
spec:
20+
containers:
21+
- name: {{ .Release.Name }}-ui
22+
image: {{ .Values.docker.ui_image }}
23+
imagePullPolicy: Always
24+
ports:
25+
- containerPort: 80
26+
imagePullSecrets:
27+
- name: {{ .Release.Namespace }}-registry
28+
29+
30+

‎k8s/templates/ingress-route.yaml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
apiVersion: traefik.containo.us/v1alpha1
2+
kind: IngressRoute
3+
metadata:
4+
name: {{ .Release.Name }}-routes
5+
namespace: {{ .Release.Namespace }}
6+
spec:
7+
entryPoints:
8+
- web
9+
routes:
10+
- kind: Rule
11+
match: Host(`{{ .Values.host }}`)
12+
priority: 100
13+
services:
14+
- name: {{ .Release.Name }}-ui
15+
port: 80
16+
- kind: Rule
17+
match: Host(`api.{{ .Values.host }}`) && PathPrefix(`/api`)
18+
priority: 120
19+
services:
20+
- name: {{ .Release.Name }}-api
21+
port: 3000

‎k8s/templates/secrets.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
name: {{ .Release.Name }}-secrets
5+
namespace: {{ .Release.Namespace }}
6+
type: Opaque
7+
stringData:
8+
{{- range $key, $value := .Values.secrets }}
9+
{{ $key }}: {{ $value | quote }}
10+
{{- end }}

‎k8s/templates/service-account.api.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: api
5+
namespace: {{ .Release.Namespace }}
6+
annotations:
7+
eks.amazonaws.com/role-arn: {{ .Values.service_roles.s3 }}

‎k8s/templates/service.api.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: {{ .Release.Name }}-api
5+
namespace: {{ .Release.Namespace }}
6+
spec:
7+
selector:
8+
app: {{ .Release.Name }}-api
9+
ports:
10+
- protocol: TCP
11+
port: 3000

‎k8s/templates/service.ui.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: {{ .Release.Name }}-ui
5+
namespace: {{ .Release.Namespace }}
6+
spec:
7+
selector:
8+
app: {{ .Release.Name }}-ui
9+
ports:
10+
- protocol: TCP
11+
port: 80

‎k8s/values.template.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
host:
2+
3+
docker:
4+
api_image:
5+
ui_image:
6+
7+
database:
8+
host:
9+
port:
10+
name:
11+
user:
12+
13+
s3:
14+
endpoint:
15+
region:
16+
bucket:
17+
project_bucket:
18+
19+
cognito:
20+
region:
21+
client_id:
22+
pool_id:
23+
identity_pool_id:
24+
25+
ion:
26+
default_access_token:

0 commit comments

Comments
 (0)