Skip to content

Commit 7356c38

Browse files
adskyiprogeradskyiproger
committed
TEsting
1 parent 5c8b20f commit 7356c38

File tree

9 files changed

+719
-330
lines changed

9 files changed

+719
-330
lines changed

‎.github/workflows/deploy-opencrvs-with-approval.yml‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
name: Deploy OpenCRVS (with approval)
2+
run-name: "Deploy OpenCRVS on ${{ inputs.environment }} (core: ${{ inputs.core-image-tag }}, country: ${{ inputs.countryconfig-image-tag }})"
3+
on:
4+
workflow_call:
5+
inputs:
6+
core-image-tag:
7+
type: string
8+
countryconfig-image-tag:
9+
type: string
10+
environment:
11+
type: string
12+
workflow_dispatch:
13+
inputs:
14+
core-image-tag:
15+
description: "Tag of the core image"
16+
required: true
17+
default: "v1.9.0-beta-1"
18+
countryconfig-image-tag:
19+
description: "Tag of the countryconfig image"
20+
required: true
21+
default: "v1.9.0-beta-1"
22+
environment:
23+
description: "Target environment"
24+
required: true
25+
default: "dev"
26+
type: choice
27+
options:
28+
- demo1
29+
jobs:
30+
approve:
31+
uses: trstringer/manual-approval@v1
32+
with:
33+
secret: ${{ github.TOKEN }}
34+
approvers: ${{ vars.DEPLOY_APPROVERS }} # comma separated list of GitHub usernames
35+
minimum-approvals: 1
36+
issue-title: 'Deploy (${{ github.event.inputs.environment }}): core: ${{ github.event.inputs.core-image-tag }} country config: ${{ github.event.inputs.countryconfig-image-tag }}'
37+
issue-body: 'Please approve or deny the deployment of core: ${{ github.event.inputs.core-image-tag }} country config: ${{ github.event.inputs.countryconfig-image-tag }} to ${{ github.event.inputs.environment }}'
38+
exclude-workflow-initiator-as-approver: false
39+
github-to-k8s-sync-env:
40+
uses: ./.github/workflows/github-to-k8s-sync-env.yml
41+
with:
42+
environment: ${{ inputs.environment }}
43+
secrets: inherit
44+
deploy:
45+
needs: github-to-k8s-sync-env
46+
environment: ${{ inputs.environment }}
47+
env:
48+
ENV: ${{ inputs.environment }}
49+
BRANCH: ${{ github.ref_name }}
50+
CORE_IMAGE_TAG: ${{ inputs.core-image-tag }}
51+
COUNTRYCONFIG_IMAGE_TAG: ${{ inputs.countryconfig-image-tag }}
52+
COUNTRYCONFIG_IMAGE_NAME: ${{ secrets.DOCKERHUB_ACCOUNT || 'opencrvs' }}/${{ secrets.DOCKERHUB_REPO || 'ocrvs-farajaland'}}
53+
runs-on:
54+
- self-hosted
55+
- k8s
56+
- ${{ inputs.environment }}
57+
steps:
58+
- uses: actions/checkout@v5
59+
- name: Generate summary
60+
env:
61+
PUBLIC_DOMAIN: ${{ vars.DOMAIN }}
62+
run: |
63+
SUMMARY=$(cat <<EOF
64+
### Deployment Summary
65+
66+
| Key | Value |
67+
|-----|-------|
68+
| Environment URL | https://$PUBLIC_DOMAIN |
69+
| Core image tag | \`${{ inputs.core-image-tag }}\` |
70+
| Country config image | \`${{ inputs.countryconfig-image-tag }}\` |
71+
| Branch name | \`${{ github.ref_name }}\` |
72+
EOF
73+
)
74+
echo "$SUMMARY" | sed 's/^ //' >> $GITHUB_STEP_SUMMARY
75+
- name: Create namespace
76+
run: kubectl create namespace "opencrvs-${ENV}" || true
77+
- name: Copy secrets from dependencies into application namespace
78+
# Only redis secret for now needs to be copied
79+
run: |
80+
secrets=(
81+
"redis-opencrvs-users"
82+
)
83+
for secret in "${secrets[@]}"; do
84+
kubectl get secret $secret -n opencrvs-deps-${ENV} -o yaml \
85+
| sed "s#namespace: opencrvs-deps-${ENV}#namespace: opencrvs-${ENV}#" \
86+
| grep -vE 'resourceVersion|uid|creationTimestamp' \
87+
| kubectl apply -n opencrvs-${ENV} -f - \
88+
|| echo "Secret $secret doesn't exist in opencrvs-deps-${ENV} namespace"
89+
done
90+
- name: Deploy with Helm
91+
run: |
92+
helm upgrade --install opencrvs oci://ghcr.io/opencrvs/opencrvs-services \
93+
--timeout 15m \
94+
--namespace "opencrvs-${ENV}" \
95+
-f environments/${ENV}/opencrvs-services/values.yaml \
96+
--create-namespace \
97+
--atomic \
98+
--wait \
99+
--wait-for-jobs \
100+
--set image.tag="$CORE_IMAGE_TAG" \
101+
--set countryconfig.image.tag="$COUNTRYCONFIG_IMAGE_TAG" \
102+
--set countryconfig.image.name="$COUNTRYCONFIG_IMAGE_NAME" \
103+
--set hostname=${{ vars.DOMAIN }}
104+
- name: Cleanup Helm Locks
105+
if: failure() || cancelled()
106+
run: |
107+
kubectl -n "opencrvs-${ENV}" get secrets -l owner=helm -o json | \
108+
jq -r '.items[] | select(.metadata.labels.status=="pending-install" or .metadata.labels.status=="pending-upgrade") | .metadata.name' | \
109+
xargs -r kubectl -n "opencrvs-${ENV}" delete secret || \
110+
echo "No helm locks found, all is good"

‎.github/workflows/k8s-seed-data.yml‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -49,17 +49,17 @@ jobs:
4949
-s templates/data-seed-job.yaml \
5050
oci://ghcr.io/opencrvs/opencrvs-services | kubectl apply --wait -n ${namespace} -f -
5151
52-
- name: Checking data-seed job status
53-
run: |
54-
while true; do
55-
kubectl wait --for=condition=ready pod -ljob-name=data-seed --timeout=300s -n ${namespace} && \
56-
kubectl logs job/data-seed --all-containers -f -n ${namespace} && \
57-
touch /tmp/logs_stramed-${namespace}-data-seed.txt || break;
58-
sleep 10; done &
59-
echo "---------------------- Waiting for job completion ----------------------"
60-
kubectl wait --for=condition=complete job/data-seed -n ${namespace} --timeout=600s; status=$? || true
61-
[ $status -ne 0 ] && kubectl get pods -n ${namespace} --show-labels && kubectl describe pod -ljob-name=${job_name} -n ${namespace};
62-
[ ! -f /tmp/logs_stramed-${namespace}-data-seed.txt ] && kubectl logs job/data-seed --all-containers -n ${namespace} || \
63-
rm -vf /tmp/logs_stramed-${namespace}-data-seed.txt
64-
kill %1 2>/dev/null && echo "Stopped log streaming" || true
65-
exit $status
52+
- name: Checking data-seed job status
53+
run: |
54+
while true; do
55+
kubectl wait --for=condition=ready pod -ljob-name=data-seed --timeout=300s -n ${namespace} && \
56+
kubectl logs job/data-seed --all-containers -f -n ${namespace} && \
57+
touch /tmp/logs_stramed-${namespace}-data-seed.txt || break;
58+
sleep 10; done &
59+
echo "---------------------- Waiting for job completion ----------------------"
60+
kubectl wait --for=condition=complete job/data-seed -n ${namespace} --timeout=600s; status=$? || true
61+
[ $status -ne 0 ] && kubectl get pods -n ${namespace} --show-labels && kubectl describe pod -ljob-name=${job_name} -n ${namespace};
62+
[ ! -f /tmp/logs_stramed-${namespace}-data-seed.txt ] && kubectl logs job/data-seed --all-containers -n ${namespace} || \
63+
rm -vf /tmp/logs_stramed-${namespace}-data-seed.txt
64+
kill %1 2>/dev/null && echo "Stopped log streaming" || true
65+
exit $status

‎.github/workflows/update-envs.yml‎

Lines changed: 0 additions & 74 deletions
This file was deleted.

‎infrastructure/environments/setup-environment.ts‎

Lines changed: 25 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ import {
1919
import { readFileSync, writeFileSync } from 'fs'
2020
import { error, info, log, success, warn } from './logger'
2121
import { generateInventory, copyChartsValues } from './templates'
22+
import { updateWorkflowEnvironments } from './update-workflows';
2223

2324
const notEmpty = (value: string | number) =>
2425
value.toString().trim().length > 0 ? true : 'Please enter a value'
@@ -242,6 +243,17 @@ const githubQuestions = [
242243
validate: notEmpty,
243244
initial: process.env.GITHUB_REPOSITORY,
244245
scope: 'REPOSITORY' as const
246+
},
247+
]
248+
const githubOtherQuestions = [
249+
{
250+
name: 'githubApprovers',
251+
type: 'text' as const,
252+
message: 'Please provide/update list of production approvers?',
253+
initial: process.env.GH_APPROVERS,
254+
valueType: 'VARIABLE' as const,
255+
valueLabel: 'GH_APPROVERS',
256+
scope: 'REPOSITORY' as const
245257
}
246258
]
247259
const githubTokenQuestion = [
@@ -307,7 +319,7 @@ const countryQuestions = [
307319
type: 'text' as const,
308320
message:
309321
'What is the ISO 3166-1 alpha-3 country-code? (e.g. "NZL" for New Zealand) Reference: https://en.wikipedia.org/wiki/ISO_3166-1_alpha-3',
310-
valueType: 'VARIABLE' as const,
322+
valueType: 'SECRET' as const,
311323
valueLabel: 'COUNTRY',
312324
initial: process.env.COUNTRY,
313325
scope: 'REPOSITORY' as const
@@ -534,18 +546,6 @@ const emailQuestions = [
534546
}
535547
]
536548

537-
// const vpnHostQuestions = [
538-
// {
539-
// name: 'vpnAdminPassword',
540-
// type: 'text' as const,
541-
// message: `Admin password for Wireguard UI`,
542-
// initial: generateLongPassword(),
543-
// valueType: 'SECRET' as const,
544-
// valueLabel: 'VPN_ADMIN_PASSWORD',
545-
// scope: 'ENVIRONMENT' as const
546-
// }
547-
// ]
548-
549549
const sentryQuestions = [
550550
{
551551
name: 'sentryDsn',
@@ -719,15 +719,14 @@ const metabaseAdminQuestions = [
719719

720720
ALL_QUESTIONS.push(
721721
...githubTokenQuestion,
722+
...githubOtherQuestions,
722723
...dockerhubQuestions,
723724
...infrastructureQuestions,
724725
...countryQuestions,
725726
...databaseAndMonitoringQuestions,
726727
...notificationTransportQuestions,
727728
...smsQuestions,
728729
...emailQuestions,
729-
// TODO: remove vpn questions
730-
// ...vpnHostQuestions,
731730
...sentryQuestions,
732731
...derivedVariables,
733732
...metabaseAdminQuestions
@@ -743,10 +742,10 @@ ALL_QUESTIONS.push(
743742
scope: 'ENVIRONMENT' as const,
744743
message: 'Purpose for the environment?',
745744
choices: [
746-
{ title: 'Development/Quality assurance/Testing (no PII data)', value: 'non-prod' },
745+
{ title: 'Development/Quality assurance/Testing (no PII data)', value: 'non-production' },
747746
{
748747
title: 'Staging (hosts PII data, no backups)',
749-
value: 'production'
748+
value: 'staging'
750749
},
751750
{
752751
title: 'Production (hosts PII data, requires frequent backups)',
@@ -855,11 +854,15 @@ ALL_QUESTIONS.push(
855854
} else {
856855
log(kleur.green('\nSuccessfully logged in to Github\n'))
857856
}
857+
if (environment_type === 'production') {
858+
log('\n', kleur.yellow().bold(
859+
'WARNING! You are setting up a production environment.\n Make sure you have read the deployment guide carefully before proceeding.\n'
860+
))
861+
await promptAndStoreAnswer(environment, githubOtherQuestions, existingValues)
862+
}
858863

859864
log('\n', kleur.bold().underline('Docker Hub'))
860-
861865
await promptAndStoreAnswer(environment, dockerhubQuestions, existingValues)
862-
863866

864867
log('\n', kleur.bold().underline('Kubernetes & Runtime'))
865868

@@ -873,8 +876,10 @@ ALL_QUESTIONS.push(
873876
? infrastructure.workerNodes.split(',').map((ip: string) => ip.trim())
874877
: []
875878
const backupHost = infrastructure.backupHost || ''
879+
log('\n', kleur.bold().underline('Running configuration files updates'))
876880
generateInventory(environment, {worker_nodes: workerNodes, backup_host: backupHost, kube_api_host: infrastructure.kubeAPIHost})
877-
copyChartsValues(environment, { env: environment})
881+
copyChartsValues(environment, { env: environment, environment_type: environment_type })
882+
await updateWorkflowEnvironments();
878883

879884
log('\n', kleur.bold().underline('Databases & monitoring'))
880885
await promptAndStoreAnswer(

‎infrastructure/environments/templates/charts-values/dependencies/values.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
storage_type: host_path
22

3+
environment_type: {{environment_type}}
4+
35
ingress:
46
tls_resolver: letsencrypt
57

‎infrastructure/environments/templates/charts-values/opencrvs-services/values.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@
99
ingress:
1010
tls_resolver: letsencrypt
1111

12+
environment_type: {{environment_type}}
13+
1214
hpa:
1315
enabled: false
1416

0 commit comments

Comments
 (0)