Merge pull request #8 from mucsi96/claude/update-deployment-secrets-vB3oZ

Externalize Docker Hub username and Azure Key Vault endpoint

Author: mucsi96

.github/workflows/pipeline.yml

@@ -64,14 +64,14 @@ jobs:
         if: steps.get_next_version.outputs.hasNextVersion == 'true'
         uses: docker/login-action@v4
         with:
-          username: ${{ github.repository_owner }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push server image
         if: steps.get_next_version.outputs.hasNextVersion == 'true'
         run: |
-          docker build -t ${{ github.repository_owner }}/skeleton-app-server:${{ steps.get_next_version.outputs.version }} server
-          docker push ${{ github.repository_owner }}/skeleton-app-server:${{ steps.get_next_version.outputs.version }}
+          docker build -t ${{ secrets.DOCKERHUB_USERNAME }}/skeleton-app-server:${{ steps.get_next_version.outputs.version }} server
+          docker push ${{ secrets.DOCKERHUB_USERNAME }}/skeleton-app-server:${{ steps.get_next_version.outputs.version }}
 
       - name: Create release
         if: steps.get_next_version.outputs.hasNextVersion == 'true'
@@ -104,14 +104,14 @@ jobs:
         if: steps.get_next_version.outputs.hasNextVersion == 'true'
         uses: docker/login-action@v4
         with:
-          username: ${{ github.repository_owner }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push client image
         if: steps.get_next_version.outputs.hasNextVersion == 'true'
         run: |
-          docker build -t ${{ github.repository_owner }}/skeleton-app-client:${{ steps.get_next_version.outputs.version }} client
-          docker push ${{ github.repository_owner }}/skeleton-app-client:${{ steps.get_next_version.outputs.version }}
+          docker build -t ${{ secrets.DOCKERHUB_USERNAME }}/skeleton-app-client:${{ steps.get_next_version.outputs.version }} client
+          docker push ${{ secrets.DOCKERHUB_USERNAME }}/skeleton-app-client:${{ steps.get_next_version.outputs.version }}
 
       - name: Create release
         if: steps.get_next_version.outputs.hasNextVersion == 'true'
@@ -137,4 +137,6 @@ jobs:
           K8S_CONFIG: ${{ secrets.K8S_CONFIG }}
           HOSTNAME: ${{ secrets.HOSTNAME }}
           API_CLIENT_ID: ${{ secrets.API_CLIENT_ID }}
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+          AZURE_KEYVAULT_ENDPOINT: ${{ secrets.AZURE_KEYVAULT_ENDPOINT }}
         run: scripts/deploy.sh

scripts/deploy.sh

@@ -5,6 +5,8 @@ set -e  # Exit immediately if a command exits with a non-zero status
 : "${K8S_CONFIG:?Environment variable K8S_CONFIG is required}"
 : "${HOSTNAME:?Environment variable HOSTNAME is required}"
 : "${API_CLIENT_ID:?Environment variable API_CLIENT_ID is required}"
+: "${DOCKERHUB_USERNAME:?Environment variable DOCKERHUB_USERNAME is required}"
+: "${AZURE_KEYVAULT_ENDPOINT:?Environment variable AZURE_KEYVAULT_ENDPOINT is required}"
 
 # Create a temporary file in /dev/shm (RAM) to avoid writing to disk
 KUBECONFIG_FILE=$(mktemp /dev/shm/kubeconfig.XXXXXX)
@@ -16,28 +18,28 @@ export KUBECONFIG="$KUBECONFIG_FILE"
 trap 'rm -f "$KUBECONFIG_FILE"' EXIT
 
 # Get latest tags for both server and client
-serverLatestTag=$(curl -s "https://registry.hub.docker.com/v2/repositories/mucsi96/skeleton-app-server/tags" | jq -r '.results | map(select(.name != "latest")) | sort_by(.last_updated) | reverse | .[0].name')
-clientLatestTag=$(curl -s "https://registry.hub.docker.com/v2/repositories/mucsi96/skeleton-app-client/tags" | jq -r '.results | map(select(.name != "latest")) | sort_by(.last_updated) | reverse | .[0].name')
+serverLatestTag=$(curl -s "https://registry.hub.docker.com/v2/repositories/$DOCKERHUB_USERNAME/skeleton-app-server/tags" | jq -r '.results | map(select(.name != "latest")) | sort_by(.last_updated) | reverse | .[0].name')
+clientLatestTag=$(curl -s "https://registry.hub.docker.com/v2/repositories/$DOCKERHUB_USERNAME/skeleton-app-client/tags" | jq -r '.results | map(select(.name != "latest")) | sort_by(.last_updated) | reverse | .[0].name')
 
 echo "Updating Helm repositories..."
 helm repo add mucsi96 https://mucsi96.github.io/k8s-helm-charts --force-update
 
 springAppChartVersion=$(helm search repo mucsi96/spring-app --output json | jq -r '.[0].version')
 clientAppChartVersion=$(helm search repo mucsi96/client-app --output json | jq -r '.[0].version')
 
-echo "Deploying server: mucsi96/skeleton-app-server:$serverLatestTag to $HOSTNAME using spring-app chart $springAppChartVersion"
+echo "Deploying server: $DOCKERHUB_USERNAME/skeleton-app-server:$serverLatestTag to $HOSTNAME using spring-app chart $springAppChartVersion"
 
 helm upgrade hello-server mucsi96/spring-app \
     --install \
     --version $springAppChartVersion \
     --namespace hello \
-    --set image=mucsi96/skeleton-app-server:$serverLatestTag \
+    --set image=$DOCKERHUB_USERNAME/skeleton-app-server:$serverLatestTag \
     --set entryPoint=web \
     --set host=$HOSTNAME \
     --set basePath=/api \
     --set clientId=$API_CLIENT_ID \
     --set serviceAccountName=hello-api-workload-identity \
-    --set env.AZURE_KEYVAULT_ENDPOINT=https://p06-hello.vault.azure.net \
+    --set env.AZURE_KEYVAULT_ENDPOINT=$AZURE_KEYVAULT_ENDPOINT \
     --set env.STORAGE_DIRECTORY=/app/storage \
     --set persistentVolumeClaims[0].name=hello-pvc \
     --set persistentVolumeClaims[0].accessMode=ReadWriteOnce \
@@ -51,13 +53,13 @@ helm upgrade hello-server mucsi96/spring-app \
     --set resources.limits.cpu=2 \
     --wait
 
-echo "Deploying client: mucsi96/skeleton-app-client:$clientLatestTag to $HOSTNAME using client-app chart $clientAppChartVersion"
+echo "Deploying client: $DOCKERHUB_USERNAME/skeleton-app-client:$clientLatestTag to $HOSTNAME using client-app chart $clientAppChartVersion"
 
 helm upgrade hello-client mucsi96/client-app \
     --install \
     --version $clientAppChartVersion \
     --namespace hello \
-    --set image=mucsi96/skeleton-app-client:$clientLatestTag \
+    --set image=$DOCKERHUB_USERNAME/skeleton-app-client:$clientLatestTag \
     --set host=$HOSTNAME \
     --set entryPoint=web \
     --wait