Skip to content

Commit 4e6bf9e

Browse files
daniel-vadaniel-va
committed
Add deploy workflow
1 parent 66a5323 commit 4e6bf9e

File tree

9 files changed

+96
-36
lines changed

9 files changed

+96
-36
lines changed

‎.github/workflows/code-quality.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ on:
66
branches:
77
- "**"
88
- "!main"
9-
109
env:
1110
NODE_VERSION: "22.5.1"
1211
RUST_VERSION: "1.82"

‎.github/workflows/deploy.yml

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
name: Deploy
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
env:
7+
type: choice
8+
description: The environment to which the Kubernetes config is deployed.
9+
options:
10+
- dev
11+
- int
12+
- prod
13+
14+
env:
15+
APP_ENV: ${{ github.event.inputs.env }}
16+
17+
jobs:
18+
publish-helm:
19+
name: "publish helm"
20+
runs-on: ubuntu-latest
21+
permissions:
22+
contents: read
23+
id-token: write
24+
steps:
25+
- name: "Load secrets"
26+
id: load-secrets
27+
uses: hashicorp/vault-action@v3
28+
with:
29+
url: https://swisstopo-vault-public-vault-d680830d.382257a9.z1.hashicorp.cloud:8200
30+
caCertificate: ${{ secrets.VAULT_CA_CERT }}
31+
method: jwt
32+
role: ${{ secrets.VAULT_ROLE }}
33+
namespace: admin/igi/igi-cloud/swisstopo-ngm
34+
secrets: |
35+
kv/data/${{ env.APP_ENV }}/k8s kubeconfig | KUBECONFIG;
36+
kv/data/${{ env.APP_ENV }}/k8s helm_values | HELM_VALUES;
37+
kv/data/${{ env.APP_ENV }}/k8s helm_secrets | HELM_SECRETS;
38+
- name: "Checkout repository"
39+
uses: actions/checkout@v4
40+
- name: "Setup kubectl"
41+
uses: azure/setup-kubectl@v4
42+
- name: "Install helm"
43+
uses: azure/setup-helm@v4
44+
- name: "Configure AWS credentials from AWS account"
45+
uses: aws-actions/configure-aws-credentials@v4
46+
with:
47+
role-to-assume: ${{ secrets.AWS_ROLE }}
48+
aws-region: ${{ secrets.AWS_REGION }}
49+
role-session-name: GitHub-OIDC
50+
retry-max-attempts: 3
51+
- name: "Write kubeconfig file"
52+
run: |
53+
echo "${{ env.HELM_VALUES }}" > ./k8s/values.yaml
54+
echo "${{ env.HELM_SECRETS }}" > ./k8s/secrets.yaml
55+
echo "${{ env.KUBECONFIG }}" > kubeconfig.yaml
56+
- name: "Deploy helm charts"
57+
env:
58+
KUBECONFIG: ./kubeconfig.yaml
59+
run: |
60+
helm upgrade --install swissgeol-viewer ./k8s \
61+
--values ./k8s/values.yaml \
62+
--values ./k8s/secrets.yaml \
63+
--kubeconfig $(pwd)/kubeconfig.yaml \
64+
--namespace ngm
65+

‎k8s/README.md

Lines changed: 0 additions & 4 deletions
This file was deleted.

‎k8s/templates/deployment.api.yaml

Lines changed: 17 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ spec:
1717
labels:
1818
app: {{ .Release.Name }}-api
1919
spec:
20+
serviceAccountName: api
2021
containers:
2122
- name: {{ .Release.Name }}-api
2223
image: {{ .Values.docker.api_image }}
@@ -26,11 +27,11 @@ spec:
2627
livenessProbe:
2728
httpGet:
2829
path: /api/health_check
29-
port: http
30+
port: 3000
3031
readinessProbe:
3132
httpGet:
3233
path: /api/health_check
33-
port: http
34+
port: 3000
3435
env:
3536
- name: APP_PORT
3637
value: '3000'
@@ -39,52 +40,42 @@ spec:
3940

4041
# Database
4142
- name: PGHOST
42-
value: {{ .Values.database.host }}
43+
value: "{{ .Values.database.host }}"
4344
- name: PGPORT
44-
value: {{ .Values.database.port }}
45+
value: "{{ .Values.database.port }}"
4546
- name: PGDATABASE
46-
value: {{ .Values.database.name }}
47+
value: "{{ .Values.database.name }}"
4748
- name: PGUSER
48-
value: {{ .Values.database.user }}
49+
value: "{{ .Values.database.user }}"
50+
- name: PG_SSL_MODE
51+
value: 'require'
4952
- name: PGPASSWORD
5053
valueFrom:
5154
secretKeyRef:
5255
name: {{ .Release.Name }}-secrets
5356
key: database_password
5457

5558
# S3
56-
- name: S3_ENDPOINT
57-
value: {{ .Values.s3.endpoint }}
5859
- name: S3_AWS_REGION
59-
value: {{ .Values.s3.region }}
60+
value: "{{ .Values.s3.region }}"
6061
- name: S3_BUCKET
61-
value: {{ .Values.s3.bucket }}
62+
value: "{{ .Values.s3.bucket }}"
6263
- name: PROJECTS_S3_BUCKET
63-
value: {{ .Values.s3.project_bucket }}
64-
- name: AWS_ACCESS_KEY_ID
65-
valueFrom:
66-
secretKeyRef:
67-
name: {{ .Release.Name }}-secrets
68-
key: s3_access_key
69-
- name: AWS_SECRET_ACCESS_KEY
70-
valueFrom:
71-
secretKeyRef:
72-
name: {{ .Release.Name }}-secrets
73-
key: s3_secret_key
64+
value: "{{ .Values.s3.projects_bucket }}"
7465

7566
# Cognito
7667
- name: COGNITO_AWS_REGION
77-
value: {{ .Values.cognito.region }}
68+
value: "{{ .Values.cognito.region }}"
7869
- name: COGNITO_CLIENT_ID
79-
value: {{ .Values.cognito.client_id }}
70+
value: "{{ .Values.cognito.client_id }}"
8071
- name: COGNITO_POOL_ID
81-
value: {{ .Values.cognito.pool_id }}
72+
value: "{{ .Values.cognito.pool_id }}"
8273
- name: COGNITO_IDENTITY_POOL_ID
83-
value: {{ .Values.cognito.identity_pool_id }}
74+
value: "{{ .Values.cognito.identity_pool_id }}"
8475

8576
# ION
8677
- name: ION_DEFAULT_ACCESS_TOKEN
87-
value: {{ .Values.ion.default_access_token }}
78+
value: "{{ .Values.ion.default_access_token }}"
8879

8980
imagePullSecrets:
9081
- name: {{ .Release.Namespace }}-registry

‎k8s/templates/ingress-route.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: traefik.containo.us/v1alpha1
22
kind: IngressRoute
33
metadata:
44
name: {{ .Release.Name }}-routes
5-
namespace: {{ .Release.Namespace }}
5+
namespace: {{ .Release.Namespace }}
66
spec:
77
entryPoints:
88
- web
@@ -14,7 +14,7 @@ spec:
1414
- name: {{ .Release.Name }}-ui
1515
port: 80
1616
- kind: Rule
17-
match: Host(`{{ .Values.host }}`) && PathPrefix(`/api`)
17+
match: Host(`api.{{ .Values.host }}`) && PathPrefix(`/api`)
1818
priority: 120
1919
services:
2020
- name: {{ .Release.Name }}-api

‎k8s/templates/secrets.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,5 +6,5 @@ metadata:
66
type: Opaque
77
stringData:
88
{{- range $key, $value := .Values.secrets }}
9-
{{ $key }}: {{ $value | b64enc | quote }}
9+
{{ $key }}: {{ $value | quote }}
1010
{{- end }}

‎k8s/templates/service-account.api.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: api
5+
namespace: {{ .Release.Namespace }}
6+
annotations:
7+
eks.amazonaws.com/role-arn: {{ .Values.service_roles.s3 }}

‎k8s/templates/service.app.yaml renamed to ‎k8s/templates/service.ui.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
apiVersion: v1
22
kind: Service
33
metadata:
4-
name: {{ .Release.Name }}-app
4+
name: {{ .Release.Name }}-ui
55
namespace: {{ .Release.Namespace }}
66
spec:
77
selector:
8-
app: {{ .Release.Name }}-app
8+
app: {{ .Release.Name }}-ui
99
ports:
1010
- protocol: TCP
1111
port: 80

‎k8s/values.template.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
host:
2+
13
docker:
24
api_image:
35
ui_image:

0 commit comments

Comments
 (0)