Skip to content

Commit d2f27d5

Browse files
bcobzhbcobzh
committed
premier test cloudnative-pg
1 parent 5afa6a6 commit d2f27d5

File tree

5 files changed

+129
-98
lines changed

5 files changed

+129
-98
lines changed

‎.github/workflows/cd.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,5 +55,6 @@ jobs:
5555
gke-credentials: ${{ secrets.GKE_SA_KEY }}
5656
gke-project: ${{ secrets.GKE_PROJECT }}
5757
gh-key: ${{ secrets.GH_KEY }}
58+
pgpasswd: ${{ secrets.PGPASSWORD }}
5859
# cloudflare-api-token: ${{ secrets.CF_API_TOKEN }}
5960
# cloudflare-zone-id: ${{ secrets.CF_ZONE_ID }}

‎.github/workflows/deploy.yml‎

Lines changed: 85 additions & 92 deletions
Original file line numberDiff line numberDiff line change
@@ -39,12 +39,58 @@ on:
3939
# required: true
4040

4141
jobs:
42+
meta:
43+
name: Meta
44+
runs-on: ubuntu-latest
45+
outputs:
46+
context: ${{ steps.meta.outputs.context }}
47+
cors: ${{ steps.meta.outputs.cors }}
48+
environment: ${{ steps.meta.outputs.environment }}
49+
namespace: ${{ steps.meta.outputs.namespace }}
50+
release_name: ${{ steps.meta.outputs.release_name }}
51+
replica: ${{ steps.meta.outputs.replica }}
52+
url: ${{ steps.meta.outputs.url }}
53+
54+
steps:
55+
- name: Generate metadata
56+
id: meta
57+
run: |
58+
set -o pipefail
59+
if [[ "${{ github.ref }}" == 'refs/heads/main' ]]; then
60+
# Tags are deployed in prod
61+
echo "context=prod" >> "$GITHUB_ENV"
62+
echo 'cors=["https://api-platform.com", "http://localhost", "https://localhost", "http://localhost:3000"]' >> "$GITHUB_ENV"
63+
echo "environment=prod" >> "$GITHUB_ENV"
64+
echo "namespace=prod-website" >> "$GITHUB_ENV"
65+
echo "release_name=website-prod" >> "$GITHUB_ENV"
66+
echo "replica=1" >> "$GITHUB_ENV"
67+
echo "url=api-platform.com" >> "$GITHUB_ENV"
68+
else
69+
echo "context=nonprod" >> "$GITHUB_ENV"
70+
if [ "$GITHUB_EVENT_NAME" == "pull_request" ]; then
71+
echo "environment=Preview" >> "$GITHUB_ENV"
72+
echo release_name=pr-$(jq --raw-output .pull_request.number "$GITHUB_EVENT_PATH") >> "$GITHUB_ENV"
73+
export release_name=pr-$(jq --raw-output .pull_request.number "$GITHUB_EVENT_PATH")
74+
else
75+
echo "environment=Staging" >> "$GITHUB_ENV"
76+
echo "release_name=${{ github.ref_name }}" >> "$GITHUB_ENV"
77+
export release_name=${{ github.ref_name }}
78+
fi
79+
echo 'cors=["https://${{ env.RELEASE_NAME}}.apip.preprod-tilleuls.ovh", "http://localhost", "https://localhost", "http://localhost:3000"]' >> "$GITHUB_ENV"
80+
echo "namespace=nonprod-website" >> "$GITHUB_ENV"
81+
echo "replica=1" >> "$GITHUB_ENV"
82+
echo "url=$RELEASE_NAME.apip.preprod-tilleuls.ovh" >> "$GITHUB_ENV"
83+
fi
84+
85+
4286
deploy:
4387
name: Deploy
4488
runs-on: ubuntu-latest
4589
permissions:
4690
contents: 'read'
4791
id-token: 'write'
92+
environment:
93+
name: ${{ needs.meta.outputs.environment }}
4894
steps:
4995
- name: Checkout
5096
uses: actions/checkout@v3
@@ -71,101 +117,48 @@ jobs:
71117
helm repo add bitnami https://charts.bitnami.com/bitnami/
72118
helm repo add stable https://charts.helm.sh/stable/
73119
helm dependency build ./helm/api-platform
74-
- name: Define namespace
75-
run: |
76-
set -o pipefail
77-
if [[ "${{ github.ref }}" == 'refs/heads/main' ]]; then
78-
# Tags are deployed in prod
79-
echo "CONTEXT=prod" >> "$GITHUB_ENV"
80-
echo "RELEASE_NAME=website-prod" >> "$GITHUB_ENV"
81-
echo "URL=api-platform.com" >> "$GITHUB_ENV"
82-
echo 'CORS=["https://api-platform.com", "http://localhost", "https://localhost", "http://localhost:3000"]' >> "$GITHUB_ENV"
83-
echo "NAMESPACE=prod-website" >> "$GITHUB_ENV"
84-
echo "REPLICA=1" >> "$GITHUB_ENV"
85-
else
86-
CONTEXT=nonprod
87-
if [ "$GITHUB_EVENT_NAME" == "pull_request" ]; then
88-
echo RELEASE_NAME=pr-$(jq --raw-output .pull_request.number "$GITHUB_EVENT_PATH") >> "$GITHUB_ENV"
89-
export RELEASE_NAME=pr-$(jq --raw-output .pull_request.number "$GITHUB_EVENT_PATH")
90-
else
91-
echo "RELEASE_NAME=${{ github.ref_name }}" >> "$GITHUB_ENV"
92-
export RELEASE_NAME=${{ github.ref_name }}
93-
fi
94-
echo "URL=$RELEASE_NAME.apip.preprod-tilleuls.ovh" >> "$GITHUB_ENV"
95-
echo "REPLICA=1" >> "$GITHUB_ENV"
96-
echo "NAMESPACE=nonprod-website" >> "$GITHUB_ENV"
97-
echo 'CORS=["https://${{ env.RELEASE_NAME}}.apip.preprod-tilleuls.ovh", "http://localhost", "https://localhost", "http://localhost:3000"]' >> "$GITHUB_ENV"
98-
fi
99120
- name: HELM Deploy
100121
run: |
101122
set -o pipefail
102-
if ! helm -n ${{ env.NAMESPACE }} status ${{ env.RELEASE_NAME }} &>/dev/null; then
103-
JWT_PASSPHRASE=$(openssl rand -base64 32)
104-
JWT_SECRET_KEY=$(openssl genpkey -pass file:<(echo "$JWT_PASSPHRASE") -aes256 -algorithm rsa -pkeyopt rsa_keygen_bits:4096)
105-
helm upgrade ${{ env.RELEASE_NAME }} ./helm/api-platform \
106-
--reuse-values \
107-
--install \
108-
--create-namespace \
109-
--debug \
110-
--wait \
111-
--atomic \
112-
--namespace=${{ env.NAMESPACE }} \
113-
--set=app.version=${{ github.sha }} \
114-
--set=php.image.repository=europe-west1-docker.pkg.dev/${{ secrets.gke-project }}/website/php \
115-
--set=php.image.tag=${{ inputs.docker-images-version }} \
116-
--set=php.image.pullPolicy=Always \
117-
--set=caddy.image.repository=europe-west1-docker.pkg.dev/${{ secrets.gke-project }}/website/caddy \
118-
--set=caddy.image.tag=${{ inputs.docker-images-version }} \
119-
--set=caddy.image.pullPolicy=Always \
120-
--set=pwa.image.repository=europe-west1-docker.pkg.dev/${{ secrets.gke-project }}/website/pwa \
121-
--set=pwa.image.tag=${{ inputs.docker-images-version }} \
122-
--set=pwa.image.pullPolicy=Always \
123-
--set=bucket.s3Upstream=storage.googleapis.com \
124-
--set=bucket.s3Name=api-platform-website-v3 \
125-
--set=service.type=NodePort \
126-
--set=ingress.enabled=true \
127-
--set=ingress.hosts[0].host=${{ env.URL }} \
128-
--set=ingress.hosts[0].paths[0].path=/ \
129-
--set=ingress.hosts[0].paths[0].pathType=ImplementationSpecific \
130-
--set=ingress.tls[0].hosts[0]=${{ env.URL }} \
131-
--set=ingress.annotations."cert-manager\.io/cluster-issuer"=letsencrypt-production \
132-
--set=ingress.tls[0].secretName=${{ env.RELEASE_NAME }}-website-ssl \
133-
--set=php.jwt.secretKey="$JWT_SECRET_KEY" \
134-
--set=php.jwt.publicKey="$(openssl pkey -in <(echo "$JWT_SECRET_KEY") -passin file:<(echo "$JWT_PASSPHRASE") -pubout)" \
135-
--set=php.jwt.passphrase=$JWT_PASSPHRASE \
136-
--set=php.corsAllowOrigin="^$(echo "${{ join(fromJSON(env.CORS), '|') }}" | sed 's/\./\\./g')$" \
137-
--set=php.host=${{ env.URL }} \
138-
--set=next.rootUrl=${{ env.URL }} \
139-
--set=github.key=${{ secrets.gh-key }} \
140-
--set=postgresql.global.postgresql.auth.password=$(openssl rand -base64 32 | tr -d "=+/") \
141-
--set=postgresql.global.postgresql.auth.username=website \
142-
| sed --unbuffered '/USER-SUPPLIED VALUES/,$d'
143-
else
144-
helm upgrade ${{ env.RELEASE_NAME }} ./helm/api-platform \
145-
--reuse-values \
146-
--install \
147-
--create-namespace \
148-
--debug \
149-
--wait \
150-
--atomic \
151-
--namespace=${{ env.NAMESPACE }} \
152-
--set=app.version=${{ github.sha }} \
153-
--set=php.image.repository=europe-west1-docker.pkg.dev/${{ secrets.gke-project }}/website/php \
154-
--set=php.image.tag=${{ inputs.docker-images-version }} \
155-
--set=php.image.pullPolicy=Always \
156-
--set=caddy.image.repository=europe-west1-docker.pkg.dev/${{ secrets.gke-project }}/website/caddy \
157-
--set=caddy.image.tag=${{ inputs.docker-images-version }} \
158-
--set=caddy.image.pullPolicy=Always \
159-
--set=pwa.image.repository=europe-west1-docker.pkg.dev/${{ secrets.gke-project }}/website/pwa \
160-
--set=pwa.image.tag=${{ inputs.docker-images-version }} \
161-
--set=pwa.image.pullPolicy=Always \
162-
--set=php.corsAllowOrigin="^$(echo "${{ join(fromJSON(env.CORS), '|') }}" | sed 's/\./\\./g')$" \
163-
--set=github.key=${{ secrets.gh-key }} \
164-
--set=next.rootUrl=${{ env.URL }} \
165-
--set=bucket.s3Upstream=storage.googleapis.com \
166-
--set=bucket.s3Name=api-platform-website-v3 \
167-
| sed --unbuffered '/USER-SUPPLIED VALUES/,$d'
168-
fi
123+
# JWT_PASSPHRASE=$(openssl rand -base64 32)
124+
# JWT_SECRET_KEY=$(openssl genpkey -pass file:<(echo "$JWT_PASSPHRASE") -aes256 -algorithm rsa -pkeyopt rsa_keygen_bits:4096)
125+
helm upgrade ${{ needs.meta.outputs.release_name }} ./helm/api-platform \
126+
--install \
127+
--create-namespace \
128+
--debug \
129+
--wait \
130+
--atomic \
131+
--namespace ${{ needs.meta.outputs.namespace }} \
132+
--set=app.version=${{ github.sha }} \
133+
--set=php.image.repository=europe-west1-docker.pkg.dev/${{ secrets.gke-project }}/website/php \
134+
--set=php.image.tag=${{ inputs.docker-images-version }} \
135+
--set=php.image.pullPolicy=Always \
136+
--set=caddy.image.repository=europe-west1-docker.pkg.dev/${{ secrets.gke-project }}/website/caddy \
137+
--set=caddy.image.tag=${{ inputs.docker-images-version }} \
138+
--set=caddy.image.pullPolicy=Always \
139+
--set=pwa.image.repository=europe-west1-docker.pkg.dev/${{ secrets.gke-project }}/website/pwa \
140+
--set=pwa.image.tag=${{ inputs.docker-images-version }} \
141+
--set=pwa.image.pullPolicy=Always \
142+
--set=bucket.s3Upstream=storage.googleapis.com \
143+
--set=bucket.s3Name=api-platform-website-v3 \
144+
--set=service.type=NodePort \
145+
--set=ingress.enabled=true \
146+
--set=ingress.hosts[0].host=${{ needs.meta.outputs.url }} \
147+
--set=ingress.hosts[0].paths[0].path=/ \
148+
--set=ingress.hosts[0].paths[0].pathType=ImplementationSpecific \
149+
--set=ingress.tls[0].hosts[0]=${{ env.URL }} \
150+
--set=ingress.annotations."cert-manager\.io/cluster-issuer"=letsencrypt-production \
151+
--set=ingress.tls[0].secretName=${{ needs.meta.outputs.release_name }}-website-ssl \
152+
# --set=php.jwt.secretKey="$JWT_SECRET_KEY" \
153+
# --set=php.jwt.publicKey="$(openssl pkey -in <(echo "$JWT_SECRET_KEY") -passin file:<(echo "$JWT_PASSPHRASE") -pubout)" \
154+
# --set=php.jwt.passphrase=$JWT_PASSPHRASE \
155+
--set=php.corsAllowOrigin="^$(echo "${{ join(fromJSON(env.CORS), '|') }}" | sed 's/\./\\./g')$" \
156+
--set=php.host=${{ env.URL }} \
157+
--set=next.rootUrl=${{ env.URL }} \
158+
--set=github.key=${{ secrets.gh-key }} \
159+
--set=postgresql.global.postgresql.auth.password=${{ secrets.pgpasswd }} \
160+
--set=postgresql.global.postgresql.auth.username=website \
161+
| sed --unbuffered '/USER-SUPPLIED VALUES/,$d'
169162
- name: Debug kube events
170163
if: failure()
171164
run: kubectl get events --namespace=${{ env.NAMESPACE }} --sort-by .metadata.creationTimestamp

‎helm/api-platform/Chart.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,8 @@ version: 0.1.0
2424
# follow Semantic Versioning. They should reflect the version the application is using.
2525
appVersion: 0.1.0
2626

27-
dependencies:
28-
- name: postgresql
29-
version: ~12.1.14
30-
repository: https://charts.bitnami.com/bitnami/
31-
condition: postgresql.enabled
27+
#dependencies:
28+
# - name: postgresql
29+
# version: ~12.1.14
30+
# repository: https://charts.bitnami.com/bitnami/
31+
# condition: postgresql.enabled

‎helm/api-platform/templates/postgresql.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
{{- if .Values.postgresql.enabled -}}
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
name: {{ include "api-platform.fullname" . }}-initdb
6+
labels:
7+
{{- include "api-platform.labels" . | nindent 4 }}
8+
type: kubernetes.io/basic-auth
9+
data:
10+
username: {{ .Values.postgresql.global.postgresql.auth.username | b64enc }}
11+
password: {{ .Values.postgresql.global.postgresql.auth.password | b64enc }}
12+
---
13+
apiVersion: postgresql.cnpg.io/v1
14+
kind: Cluster
15+
metadata:
16+
name: {{ .Release.Name }}-postgresql
17+
spec:
18+
instances: 1
19+
imageName: ghcr.io/cloudnative-pg/postgresql:17
20+
superuserSecret:
21+
name: {{ include "api-platform.fullname" . }}-initdb
22+
bootstrap:
23+
initdb:
24+
database: {{ .Values.postgresql.global.postgresql.auth.database }}
25+
owner: {{ .Values.postgresql.global.postgresql.auth.username }}
26+
postInitSQL:
27+
- {{ printf "ALTER USER %s CREATEDB;" .Values.postgresql.global.postgresql.auth.username | quote }}
28+
secret:
29+
name: {{ include "api-platform.fullname" . }}-initdb
30+
managed:
31+
services:
32+
disabledDefaultServices: ["ro", "r"]
33+
storage:
34+
size: {{ .Values.postgresql.primary.persistence.size }}
35+
resources:
36+
{{- toYaml .Values.postgresql.primary.resources | nindent 4 }}
37+
{{- end -}}

‎helm/api-platform/templates/secrets.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ metadata:
77
type: Opaque
88
stringData:
99
{{- if .Values.postgresql.enabled }}
10-
database-url: {{ printf "pgsql://%s:%s@%s-postgresql/%s?serverVersion=13&charset=utf8" .Values.postgresql.global.postgresql.auth.username .Values.postgresql.global.postgresql.auth.password .Release.Name .Values.postgresql.global.postgresql.auth.database | quote }}
10+
database-url: {{ printf "pgsql://%s:%s@%s-postgresql-rw/%s?serverVersion=13&charset=utf8" .Values.postgresql.global.postgresql.auth.username .Values.postgresql.global.postgresql.auth.password .Release.Name .Values.postgresql.global.postgresql.auth.database | quote }}
1111
{{- else }}
1212
database-url: {{ .Values.postgresql.url | quote }}
1313
{{- end }}

0 commit comments

Comments
 (0)