Skip to content

Commit c5f84ee

Browse files
vrtornisiellovrtornisiello
authored
Merge pull request #44 from basedosdados/staging
chore(k8s): deploy to main
2 parents 6781dfb + 1a3a060 commit c5f84ee

File tree

10 files changed

+563
-119
lines changed

10 files changed

+563
-119
lines changed

‎.github/workflows/deploy-prod.yaml‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
name: Deploy Production Docker Container
2+
3+
on:
4+
workflow_run:
5+
workflows:
6+
- "Release Production Docker Image"
7+
branches:
8+
- main
9+
types:
10+
- completed
11+
workflow_dispatch:
12+
13+
jobs:
14+
deploy-prod:
15+
if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}
16+
runs-on: ubuntu-latest
17+
environment:
18+
name: production
19+
url: https://basedosdados.org
20+
21+
steps:
22+
- name: Checkout
23+
uses: actions/checkout@v4
24+
with:
25+
ref: main
26+
27+
- name: Import Secrets
28+
id: import_secrets
29+
uses: hashicorp/vault-action@v3
30+
with:
31+
url: https://vault.basedosdados.org
32+
token: ${{ secrets.VAULT_TOKEN }}
33+
secrets: |
34+
secret/data/gcp_credentials/basedosdados-dev GCP_SA_KEY_BASE64 | GCP_SA_KEY_BASE64;
35+
secret/data/gcp_credentials/basedosdados-dev GCP_PROJECT_ID | GCP_PROJECT_ID;
36+
secret/data/gcp_credentials/basedosdados-dev GKE_CLUSTER_NAME | GKE_CLUSTER_NAME;
37+
secret/data/gcp_credentials/basedosdados-dev GKE_CLUSTER_ZONE | GKE_CLUSTER_ZONE;
38+
39+
- name: Setup Google Cloud CLI
40+
uses: google-github-actions/[email protected]
41+
with:
42+
service_account_key: ${{ steps.import_secrets.outputs.GCP_SA_KEY_BASE64 }}
43+
project_id: ${{ steps.import_secrets.outputs.GCP_PROJECT_ID }}
44+
export_default_credentials: true
45+
46+
- name: Get GKE credentials
47+
uses: google-github-actions/[email protected]
48+
with:
49+
cluster_name: ${{ steps.import_secrets.outputs.GKE_CLUSTER_NAME }}
50+
location: ${{ steps.import_secrets.outputs.GKE_CLUSTER_ZONE }}
51+
credentials: ${{ steps.import_secrets.outputs.GCP_SA_KEY_BASE64 }}
52+
53+
- name: Write values.yaml file
54+
run: |
55+
cat << 'EOF' > values.yaml
56+
chatbotFrontend:
57+
name: basedosdados-chatbot-frontend-prod
58+
image:
59+
name: ghcr.io/${{ github.repository }}
60+
tag: prod
61+
pullPolicy: Always
62+
env:
63+
API_HOST: api-prod-service
64+
API_PORT: 80
65+
LOG_LEVEL: INFO
66+
LOG_BACKTRACE: true
67+
LOG_DIAGNOSE: false
68+
LOG_ENQUEUE: true
69+
replicas: 1
70+
resources:
71+
requests:
72+
cpu: 250m
73+
memory: 500Mi
74+
limits:
75+
cpu: 500m
76+
memory: 1Gi
77+
ingress:
78+
enabled: true
79+
host: basedosdados.org
80+
annotations:
81+
nginx.ingress.kubernetes.io/use-regex: "true"
82+
nginx.ingress.kubernetes.io/rewrite-target: /$2
83+
nginx.ingress.kubernetes.io/ssl-redirect: "true"
84+
cert-manager.io/issuer: letsencrypt-production
85+
nginx.ingress.kubernetes.io/configuration-snippet: |
86+
# Redirect exact /chatbot-streamlit → /chatbot-streamlit/ with a 301
87+
rewrite ^/chatbot-streamlit$ /chatbot-streamlit/ permanent;
88+
tls:
89+
- hosts:
90+
- basedosdados.org
91+
secretName: basedosdados-org-tls
92+
EOF
93+
94+
- name: Validate values.yaml file
95+
run: |
96+
echo "Generated values.yaml content:"
97+
cat values.yaml
98+
echo "Validating YAML syntax:"
99+
python3 -c "import yaml; yaml.safe_load(open('values.yaml'))"
100+
101+
- name: Deploy using Helm
102+
run: |
103+
helm upgrade \
104+
--install basedosdados-chatbot-frontend-prod charts/basedosdados-chatbot-frontend/. \
105+
--namespace website \
106+
--values values.yaml \
107+
--debug \
108+
--wait

‎.github/workflows/deploy-staging.yaml‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
name: Deploy Staging Docker Container
2+
3+
on:
4+
workflow_run:
5+
workflows:
6+
- "Release Staging Docker Image"
7+
branches:
8+
- staging
9+
types:
10+
- completed
11+
workflow_dispatch:
12+
13+
jobs:
14+
deploy-staging:
15+
if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}
16+
runs-on: ubuntu-latest
17+
environment:
18+
name: staging
19+
url: https://staging.basedosdados.org
20+
21+
steps:
22+
- name: Checkout
23+
uses: actions/checkout@v4
24+
with:
25+
ref: staging
26+
27+
- name: Import Secrets
28+
id: import_secrets
29+
uses: hashicorp/vault-action@v3
30+
with:
31+
url: https://vault.basedosdados.org
32+
token: ${{ secrets.VAULT_TOKEN }}
33+
secrets: |
34+
secret/data/gcp_credentials/basedosdados-dev GCP_SA_KEY_BASE64 | GCP_SA_KEY_BASE64;
35+
secret/data/gcp_credentials/basedosdados-dev GCP_PROJECT_ID | GCP_PROJECT_ID;
36+
secret/data/gcp_credentials/basedosdados-dev GKE_CLUSTER_NAME | GKE_CLUSTER_NAME;
37+
secret/data/gcp_credentials/basedosdados-dev GKE_CLUSTER_ZONE | GKE_CLUSTER_ZONE;
38+
39+
- name: Setup Google Cloud CLI
40+
uses: google-github-actions/[email protected]
41+
with:
42+
service_account_key: ${{ steps.import_secrets.outputs.GCP_SA_KEY_BASE64 }}
43+
project_id: ${{ steps.import_secrets.outputs.GCP_PROJECT_ID }}
44+
export_default_credentials: true
45+
46+
- name: Get GKE credentials
47+
uses: google-github-actions/[email protected]
48+
with:
49+
cluster_name: ${{ steps.import_secrets.outputs.GKE_CLUSTER_NAME }}
50+
location: ${{ steps.import_secrets.outputs.GKE_CLUSTER_ZONE }}
51+
credentials: ${{ steps.import_secrets.outputs.GCP_SA_KEY_BASE64 }}
52+
53+
- name: Write values.yaml file
54+
run: |
55+
cat << 'EOF' > values.yaml
56+
chatbotFrontend:
57+
name: basedosdados-chatbot-frontend-staging
58+
image:
59+
name: ghcr.io/${{ github.repository }}
60+
tag: staging
61+
pullPolicy: Always
62+
env:
63+
API_HOST: api-staging-service
64+
API_PORT: 80
65+
LOG_LEVEL: INFO
66+
LOG_BACKTRACE: true
67+
LOG_DIAGNOSE: false
68+
LOG_ENQUEUE: true
69+
replicas: 1
70+
resources:
71+
requests:
72+
cpu: 250m
73+
memory: 500Mi
74+
limits:
75+
cpu: 500m
76+
memory: 1Gi
77+
ingress:
78+
enabled: true
79+
host: staging.basedosdados.org
80+
annotations:
81+
nginx.ingress.kubernetes.io/use-regex: "true"
82+
nginx.ingress.kubernetes.io/rewrite-target: /$2
83+
nginx.ingress.kubernetes.io/ssl-redirect: "true"
84+
cert-manager.io/issuer: letsencrypt-production
85+
nginx.ingress.kubernetes.io/configuration-snippet: |
86+
# Redirect exact /chatbot-streamlit → /chatbot-streamlit/ with a 301
87+
rewrite ^/chatbot-streamlit$ /chatbot-streamlit/ permanent;
88+
tls:
89+
- hosts:
90+
- staging.basedosdados.org
91+
secretName: staging-basedosdados-org-tls
92+
EOF
93+
94+
- name: Validate values.yaml file
95+
run: |
96+
echo "Generated values.yaml content:"
97+
cat values.yaml
98+
echo "Validating YAML syntax:"
99+
python3 -c "import yaml; yaml.safe_load(open('values.yaml'))"
100+
101+
- name: Deploy using Helm
102+
run: |
103+
helm upgrade \
104+
--install basedosdados-chatbot-frontend-staging charts/basedosdados-chatbot-frontend/. \
105+
--namespace website \
106+
--values values.yaml \
107+
--debug \
108+
--wait

‎.github/workflows/release-prod.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: Release Production Docker Image
2+
3+
on:
4+
push:
5+
branches: main
6+
workflow_dispatch:
7+
8+
jobs:
9+
release-prod:
10+
name: Release prod docker image
11+
runs-on: ubuntu-latest
12+
13+
steps:
14+
- name: Checkout
15+
uses: actions/checkout@v4
16+
with:
17+
ref: main
18+
19+
- name: Login to GitHub Container Registry
20+
uses: docker/login-action@v3
21+
with:
22+
registry: ghcr.io
23+
username: ${{ github.repository_owner }}
24+
password: ${{ secrets.GITHUB_TOKEN }}
25+
26+
- name: Build and push
27+
uses: docker/build-push-action@v6
28+
with:
29+
context: .
30+
file: Dockerfile
31+
push: true
32+
tags: ghcr.io/${{ github.repository }}:prod

‎.github/workflows/release-staging.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: Release Staging Docker Image
2+
3+
on:
4+
push:
5+
branches: staging
6+
workflow_dispatch:
7+
8+
jobs:
9+
release-staging:
10+
name: Release staging docker image
11+
runs-on: ubuntu-latest
12+
13+
steps:
14+
- name: Checkout
15+
uses: actions/checkout@v4
16+
with:
17+
ref: staging
18+
19+
- name: Login to GitHub Container Registry
20+
uses: docker/login-action@v3
21+
with:
22+
registry: ghcr.io
23+
username: ${{ github.repository_owner }}
24+
password: ${{ secrets.GITHUB_TOKEN }}
25+
26+
- name: Build and push
27+
uses: docker/build-push-action@v6
28+
with:
29+
context: .
30+
file: Dockerfile
31+
push: true
32+
tags: ghcr.io/${{ github.repository }}:staging

0 commit comments

Comments
 (0)