Skip to content

feat(prod): promote 8 microservices to the j26-prod environment - #39

Merged
scriptcoded merged 7 commits into
mainfrom
prod/j26-more-apps
Jul 5, 2026
Merged

feat(prod): promote 8 microservices to the j26-prod environment#39
scriptcoded merged 7 commits into
mainfrom
prod/j26-more-apps

Conversation

@hakan-persson

@hakan-persson hakan-persson commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Promotes eight microservices to the j26-prod environment. Each was applied to the prod cluster and verified before this PR; once merged, the *-prod ArgoCD Applications adopt them via GitOps.

Apps promoted

notifications (api+client), map, screens, signupinfo, photo-permission, platsbank, cms, scoutin-2

Pattern

Most apps are kustomize overlays on the dev base (resources: ../../app-manifest/<app>, namespace: j26-prod, image pinned via images:, nginx Ingress → Traefik IngressRoute, *-prod ArgoCD app name to stay out of the image-updater glob).

Two apps are deliberately self-contained (no dev base) — platsbank and scoutin-2. This is an intentional exception to close the dev→prod coupling: because their ConfigMaps / config bundles carry environment-specific values, inheriting the dev base would let an untested dev config change flow to prod on the next sync. As standalone packages, a dev change cannot reach prod without an explicit prod change. Tradeoff: genuine dev fixes to those apps are carried over deliberately (tracked via the dev-PR review routine). This mirrors the already-self-contained j26-keycloak-scoutid, and the companion PR #48 does the same for scoutid-sync. Both conversions render byte-identically to the prior overlays (verified).

Image tags (published versions): notifications api + client → v0.2.0; photo-permission → v0.1.0; map / screens / signupinfo / platsbank / cms → 0.1.0; scoutin-2 → 0.1.0.

Ingress: StripPrefix where the dev rewrite stripped (map, screens, signupinfo, notifications api); prefix kept where dev kept it (notification-client, photo-permission, platsbank, cms, scoutin-2). TLS reuses j26-app-tls-secret.

Secrets & databases

  • Reuse dev KV objects where data is environment-agnostic: Scoutnet API keys (signupinfo, 16 of scoutin-2's keys), FCM (notifications), scoutin-2 Google SA.
  • No Azure Service Connector. The DB-backed apps (platsbank, cms, scoutin-2) read a single DATABASE_URL, so prod sources the DSN from Key Vault via the Secrets Store CSI driver. Backed by role-owned prod databases on psql-j26apps-shared-sdc (j26_prod_platsbank, j26_prod_cms, j26_prod_scoutin_2).
  • Fresh prod KV objects: cms payload secret; scoutin-2 token-secret + datasource hashing secret/salt.

App-specific notes

  • signupinfo: ServiceMonitor namespaceSelector patched to j26-prod.
  • cms: keeps the 10Gi uploads PVC; SERVER_URL → https://app.jamboree.se; Traefik buffering middleware mirrors the dev proxy-body-size: 50m.
  • platsbank: self-contained; ConfigMap holds the prod Keycloak discovery URL.
  • j26-app: J26_PUBLIC_APP_CONFIGS grown to include notification-client, signupinfo, map, photo-permission, platsbank.

Verification (on the live prod cluster)

  • All pods 1/1; DB migrations applied (platsbank 4 tables, cms 20, scoutin-2 10).
  • All routes on app.jamboree.se return expected codes; full coexistence with /, /auth.
  • kubectl diff -k empty / cluster-matching for every app (self-contained conversions verified as cluster no-ops).

🤖 Generated with Claude Code

Copilot AI review requested due to automatic review settings June 29, 2026 14:39
@hakan-persson
hakan-persson requested a review from a team as a code owner June 29, 2026 14:39
Copilot AI reviewed Jun 29, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Promotes eight existing microservices to the j26-prod environment by introducing prod kustomize overlays (reusing dev bases) and adding corresponding *-prod ArgoCD Applications so prod can adopt the live-verified state via GitOps.

Changes:

  • Add k8s/argocd/prod-apps/*-prod Applications for the promoted services, targeting k8s/app-manifest-prod/<app> overlays in j26-prod.
  • Introduce prod overlays that pin images, replace nginx Ingress with Traefik IngressRoute (+ StripPrefix where needed), and patch monitoring/secret wiring where prod differs.
  • Switch DB-backed apps away from Azure Service Connector secrets to Key Vault–sourced DSNs via Secrets Store CSI, and extend j26-app’s J26_PUBLIC_APP_CONFIGS accordingly.

Reviewed changes

Copilot reviewed 33 out of 33 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
k8s/argocd/prod-apps/j26-signupinfo.yaml Add prod ArgoCD Application for signupinfo overlay.
k8s/argocd/prod-apps/j26-screens.yaml Add prod ArgoCD Application for screens overlay.
k8s/argocd/prod-apps/j26-scoutin-2.yaml Add prod ArgoCD Application for scoutin-2 overlay.
k8s/argocd/prod-apps/j26-platsbank.yaml Add prod ArgoCD Application for platsbank overlay.
k8s/argocd/prod-apps/j26-photo-permission.yaml Add prod ArgoCD Application for photo-permission overlay.
k8s/argocd/prod-apps/j26-notifications.yaml Add prod ArgoCD Application for notifications overlay.
k8s/argocd/prod-apps/j26-map.yaml Add prod ArgoCD Application for map overlay.
k8s/argocd/prod-apps/j26-cms.yaml Add prod ArgoCD Application for cms overlay.
k8s/app-manifest-prod/j26-signupinfo/servicemonitor-patch.yaml Patch ServiceMonitor namespaceSelector for prod scraping.
k8s/app-manifest-prod/j26-signupinfo/kustomization.yaml Prod overlay: namespace, pinned image, ingress swap, ServiceMonitor patch.
k8s/app-manifest-prod/j26-signupinfo/ingressroute.yaml Traefik IngressRoute + StripPrefix middleware for signupinfo.
k8s/app-manifest-prod/j26-screens/kustomization.yaml Prod overlay: namespace, pinned image, ingress swap.
k8s/app-manifest-prod/j26-screens/ingressroute.yaml Traefik IngressRoute + StripPrefix middleware for screens.
k8s/app-manifest-prod/j26-scoutin-2/secret-provider-class-patch.yaml Extend/repoint scoutin-2 KV objects and add DATABASE_URL.
k8s/app-manifest-prod/j26-scoutin-2/kustomization.yaml Prod overlay: pinned image, ingress swap, SPC + deployment patches.
k8s/app-manifest-prod/j26-scoutin-2/ingressroute.yaml Traefik IngressRoute for scoutin-2 (no StripPrefix).
k8s/app-manifest-prod/j26-scoutin-2/deployment-patch.yaml Switch scoutin-2 DB env from Service Connector to KV DSN secret.
k8s/app-manifest-prod/j26-platsbank/secret-provider-class.yaml Add prod-only SPC to materialize DATABASE_URL from Key Vault.
k8s/app-manifest-prod/j26-platsbank/kustomization.yaml Prod overlay: pinned image, ingress swap, add SPC + deployment patch.
k8s/app-manifest-prod/j26-platsbank/ingressroute.yaml Traefik IngressRoute for platsbank (no StripPrefix).
k8s/app-manifest-prod/j26-platsbank/deployment-patch.yaml Wire platsbank DB env to KV DSN and add CSI volume/mounts.
k8s/app-manifest-prod/j26-photo-permission/kustomization.yaml Prod overlay: pinned image, ingress swap.
k8s/app-manifest-prod/j26-photo-permission/ingressroute.yaml Traefik IngressRoute for photo-permission (no StripPrefix).
k8s/app-manifest-prod/j26-notifications/secret-provider-class-patch.yaml Repoint notifications KV object names for prod while keeping secret name.
k8s/app-manifest-prod/j26-notifications/kustomization.yaml Prod overlay: pinned images, ingress swap, SPC patch, config merge.
k8s/app-manifest-prod/j26-notifications/ingressroute.yaml Traefik IngressRoutes for notifications API/client (+ StripPrefix for API).
k8s/app-manifest-prod/j26-map/kustomization.yaml Prod overlay: pinned image, ingress swap.
k8s/app-manifest-prod/j26-map/ingressroute.yaml Traefik IngressRoute + StripPrefix middleware for map.
k8s/app-manifest-prod/j26-cms/secret-provider-class-patch.yaml Repoint cms payload secret and add DATABASE_URL from KV.
k8s/app-manifest-prod/j26-cms/kustomization.yaml Prod overlay: pinned image, ingress swap (+ buffering), SPC + deployment patches, config merge.
k8s/app-manifest-prod/j26-cms/ingressroute.yaml Traefik IngressRoute for cms with buffering middleware.
k8s/app-manifest-prod/j26-cms/deployment-patch.yaml Switch cms DB env to KV DSN secret.
k8s/app-manifest-prod/j26-app/kustomization.yaml Extend J26_PUBLIC_APP_CONFIGS to include newly promoted services.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread k8s/app-manifest-prod/j26-platsbank/secret-provider-class.yaml Outdated
hakan-persson added a commit that referenced this pull request Jun 29, 2026
@hakan-persson @claude
docs(prod): replace internal memory refs in overlay comments
ab663be 
Address Copilot review on #39: comments referenced Claude's internal
"memory" notes (e.g. "see memory j26_prod_dbs_platsbank_cms_scoutin2" and
the [[prod_overlay_pattern]] wikilink), which are meaningless to repo
readers and age poorly. Rewrite them to reference concrete repo facts —
the actual KV object name / prod DB, and the established j26-app / j26-auth
prod overlays as the pattern reference. Comment-only changes; rendered
output is unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
hakan-persson and others added 5 commits July 4, 2026 17:54
@hakan-persson @claude
feat(prod): promote 8 microservices to the j26-prod environment
fa30e39 
Add production kustomize overlays + ArgoCD Applications for eight apps,
each an overlay on the existing dev base (namespace j26-prod, pinned image
tag, nginx Ingress -> Traefik IngressRoute, secrets repointed/added):

  notifications (api+client), map, screens, signupinfo, photo-permission,
  platsbank, cms, scoutin-2

Highlights:
- No-DB apps (map, screens, signupinfo, photo-permission) and notifications
  reuse dev KV objects where the data is env-agnostic (Scoutnet keys, FCM).
- DB-backed apps (platsbank, cms, scoutin-2) source DATABASE_URL from a KV
  DSN via the Secrets Store CSI driver (the notifications pattern) instead
  of Azure Service Connector; the overlay patches the deployment to drop the
  sc-postgresql* wiring. Backed by new role-owned prod DBs on
  psql-j26apps-shared-sdc.
- signupinfo ServiceMonitor namespaceSelector patched to j26-prod.
- cms keeps its 10Gi uploads PVC and gets a Traefik buffering middleware
  mirroring the dev 50m proxy-body-size; SERVER_URL -> app.jamboree.se.
- j26-app prod J26_PUBLIC_APP_CONFIGS grown to include notification-client,
  signupinfo, map, photo-permission, platsbank.

All ArgoCD apps are named <app>-prod to stay out of the image-updater glob;
prod image tags are pinned and bumped by explicit commits. Each overlay was
applied to the prod cluster and verified (pods healthy, migrations applied,
routes 200, kubectl diff -k empty) ahead of GitOps adoption.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@hakan-persson @claude
docs(prod): replace internal memory refs in overlay comments
cd505cd 
Address Copilot review on #39: comments referenced Claude's internal
"memory" notes (e.g. "see memory j26_prod_dbs_platsbank_cms_scoutin2" and
the [[prod_overlay_pattern]] wikilink), which are meaningless to repo
readers and age poorly. Rewrite them to reference concrete repo facts —
the actual KV object name / prod DB, and the established j26-app / j26-auth
prod overlays as the pattern reference. Comment-only changes; rendered
output is unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@hakan-persson @claude
docs(prod): slim down the prod overlay comments
bfc522a 
Trim the verbose block comments across the 8-app prod overlays down to the
non-obvious rationale only, per review (the same feedback applied to #30).
The prior comments restated the YAML and carried volatile detail — image
SHAs/tags, PR numbers, dates, dev-side values — that rots (e.g. several
ArgoCD Applications still said "pinned to 0.1.0"). Net -240 comment lines.

Comment-only change: every overlay renders byte-identically (verified with
kubectl kustomize before/after).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@hakan-persson @claude
chore(prod): bump j26-notifications (api + client) to v0.2.0
782f735 
Pin both prod images to v0.2.0 (was v0.1.0). Applied to the prod cluster and
verified: both deployments 1/1 on v0.2.0, routes + the Keycloak-backed groups
endpoint return 200.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@hakan-persson @claude
feat(prod): scrape notification-api metrics in j26-prod
dfe099f 
Patch the notifications base ServiceMonitor's namespaceSelector to j26-prod
in the prod overlay (the overlay's `namespace:` transformer rewrites the
object's metadata.namespace but not the selector value in the spec).

Verified live: Prometheus scrapes notification-api in j26-prod (up=1) and
prod http_* series appear under namespace="j26-prod".

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@hakan-persson @claude
refactor(prod): make platsbank + scoutin-2 self-contained (no dev base)
2b481e2 
Convert both prod overlays from dev-base overlays to standalone packages, so
no dev-side change can silently reach prod. Each now carries its own copy of
the structural manifests + config; the config-bearing files (platsbank
ConfigMap, scoutin-2 config/ bundle) are prod-owned, closing the coupling
that let a dev value leak to prod (cf. #47).

- platsbank ConfigMap now holds the PROD Keycloak discovery URL.
- scoutin-2 renders byte-identically to the previous overlay (verified).
- The DB-via-CSI wiring is baked into the deployments directly (no more
  deployment-patch / SPC-patch indirection); image tags still pinned.

Tradeoff: genuine dev fixes to these apps' structural manifests must now be
carried over deliberately (tracked via the dev-PR review routine).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@hakan-persson hakan-persson mentioned this pull request Jul 4, 2026
Merged
@hakan-persson
hakan-persson requested a review from Copilot July 4, 2026 21:01
Copilot AI reviewed Jul 4, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 41 out of 41 changed files in this pull request and generated 3 comments.

Comment thread k8s/app-manifest-prod/j26-notifications/kustomization.yaml
Comment thread k8s/app-manifest-prod/j26-platsbank/kustomization.yaml
Comment thread k8s/app-manifest-prod/j26-scoutin-2/kustomization.yaml
@hakan-persson hakan-persson mentioned this pull request Jul 4, 2026
Merged
@github-actions github-actions Bot added the prod-review Touches a dev base (k8s/app-manifest/) — decide if it must be carried to prod label Jul 5, 2026
@scriptcoded
scriptcoded force-pushed the prod/j26-more-apps branch from be17ed7 to 4e9a36a Compare July 5, 2026 09:01
@scriptcoded
scriptcoded merged commit a2a8ead into main Jul 5, 2026
1 check passed
scriptcoded pushed a commit that referenced this pull request Jul 5, 2026
@hakan-persson @claude @scriptcoded
docs(prod): replace internal memory refs in overlay comments
698f18f 
Address Copilot review on #39: comments referenced Claude's internal
"memory" notes (e.g. "see memory j26_prod_dbs_platsbank_cms_scoutin2" and
the [[prod_overlay_pattern]] wikilink), which are meaningless to repo
readers and age poorly. Rewrite them to reference concrete repo facts —
the actual KV object name / prod DB, and the established j26-app / j26-auth
prod overlays as the pattern reference. Comment-only changes; rendered
output is unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@scriptcoded scriptcoded scriptcoded approved these changes

Assignees

No one assigned

Labels

prod-review Touches a dev base (k8s/app-manifest/) — decide if it must be carried to prod

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@hakan-persson @scriptcoded