✨ Add Production Deployment

.github/workflows/cicd-deploy-to-prod.yml

@@ -0,0 +1,81 @@
+name: "♻️ Deploy to Production Namespace"
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+env:
+  KUBE_CLUSTER: ${{ secrets.KUBE_CLUSTER }}
+  KUBE_NAMESPACE: ${{ secrets.PROD_KUBE_NAMESPACE }}
+  KUBE_CERT: ${{ secrets.PROD_KUBE_CERT }}
+  KUBE_TOKEN: ${{ secrets.PROD_KUBE_TOKEN }}
+
+  IMAGE_TAG: ${{ github.sha }}
+  ECR_REGISTRY: ${{ vars.PRODUCTION_ECR_REGISTRY }}
+  ECR_REPOSITORY: ${{ vars.PRODUCTION_ECR_REPOSITORY }}
+
+  API_KEY: ${{ secrets.PROD_API_KEY }}
+
+  POSTGRES_USER: ${{secrets.PROD_POSTGRES_USER}}
+  POSTGRES_PASSWORD: ${{secrets.PROD_POSTGRES_PASSWORD}}
+  POSTGRES_DB: ${{secrets.PROD_POSTGRES_DB}}
+  POSTGRES_HOST: ${{secrets.PROD_POSTGRES_HOST}}
+  POSTGRES_PORT: ${{secrets.PROD_POSTGRES_PORT}}
+
+jobs:
+  build-push:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.PRODUCTION_ECR_ROLE_TO_ASSUME }}
+          aws-region: ${{ vars.PRODUCTION_ECR_REGION }}
+
+      - uses: aws-actions/amazon-ecr-login@v2
+        id: login-ecr
+      - run: |
+          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
+          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
+
+  deploy-to-prod:
+    needs: build-push
+    runs-on: ubuntu-latest
+    container: alpine/k8s:1.23.17
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Authenticate to the cluster
+        run: |
+          echo "${KUBE_CERT}" > ca.crt
+          kubectl config set-cluster ${KUBE_CLUSTER} --certificate-authority=./ca.crt --server=https://${KUBE_CLUSTER}
+          kubectl config set-credentials deploy-user --token=${KUBE_TOKEN}
+          kubectl config set-context ${KUBE_CLUSTER} --cluster=${KUBE_CLUSTER} --user=deploy-user --namespace=${KUBE_NAMESPACE}
+          kubectl config get-contexts
+          kubectl config use-context ${KUBE_CLUSTER}
+
+      - name: Deploy helm chart to PoC
+        run: |
+          helm upgrade kpi-dashboard \
+            helm/kpi-dashboard \
+            --install \
+            --force \
+            --wait \
+            --timeout 10m \
+            --namespace ${KUBE_NAMESPACE} \
+            --values=helm/kpi-dashboard/values-prod.yaml \
+            --set app.deployment.env.API_KEY=${API_KEY} \
+            --set app.deployment.env.POSTGRES_USER=${POSTGRES_USER} \
+            --set app.deployment.env.POSTGRES_PASSWORD=${POSTGRES_PASSWORD} \
+            --set app.deployment.env.POSTGRES_DB=${POSTGRES_DB} \
+            --set app.deployment.env.POSTGRES_HOST=${POSTGRES_HOST} \
+            --set app.deployment.env.POSTGRES_PORT=${POSTGRES_PORT} \
+            --set app.deployment.image.repository=${ECR_REGISTRY}/${ECR_REPOSITORY} \
+            --set app.deployment.image.tag=${IMAGE_TAG}

helm/kpi-dashboard/values-prod.yaml

@@ -0,0 +1,8 @@
+app:
+  ingress:
+    host: "kpi-dashboard.cloud-platform.service.justice.gov.uk"
+
+  deployment:
+    replicaCount: 1
+    env:
+      LOGGING_LEVEL: INFO