✨Add workflow to build and deploy app

.github/workflows/build-deploy-poc.yml

@@ -0,0 +1,56 @@
+name: Build and Deploy (POC)
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+env:
+  KUBE_CLUSTER: ${{ secrets.DEV_KUBE_CLUSTER }}
+  KUBE_NAMESPACE: ${{ secrets.DEV_KUBE_NAMESPACE }}
+  KUBE_CERT: ${{ secrets.DEV_KUBE_CERT }}
+  KUBE_TOKEN: ${{ secrets.DEV_KUBE_TOKEN }}
+
+  ECR_REGISTRY: ${{ vars.ECR_REGISTRY }}
+  ECR_REPOSITORY: ${{ vars.DEVELOPMENT_ECR_REPOSITORY }}
+  IMAGE_TAG: ${{ vars.ECR_REGISTRY }}/${{ vars.DEVELOPMENT_ECR_REPOSITORY }}:${{ github.sha }}
+
+jobs:
+  build-push:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.DEVELOPMENT_ECR_ROLE_TO_ASSUME }}
+          aws-region: eu-west-2
+      - uses: aws-actions/amazon-ecr-login@v2
+      - run: |
+          docker build -t ${IMAGE_TAG} .
+          docker push ${IMAGE_TAG}
+
+  deploy-to-dev:
+    needs: build-push
+    runs-on: ubuntu-latest
+    container: alpine/k8s:1.23.17
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Authenticate to the cluster
+        run: |
+          echo "${KUBE_CERT}" > ca.crt
+          kubectl config set-cluster ${KUBE_CLUSTER} --certificate-authority=./ca.crt --server=https://${KUBE_CLUSTER}
+          kubectl config set-credentials deploy-user --token=${KUBE_TOKEN}
+          kubectl config set-context ${KUBE_CLUSTER} --cluster=${KUBE_CLUSTER} --user=deploy-user --namespace=${KUBE_NAMESPACE}
+          kubectl config get-contexts
+          kubectl config use-context ${KUBE_CLUSTER}
+
+      - name: Helm install
+        run: |
+          helm upgrade --values=helm/operations-engineering-metadata/values.yaml --values=helm/operations-engineering-metadata/values-poc.yaml operations-engineering-metadata-poc helm/operations-engineering-metadata --set image.tag=${{ github.sha }} --install --force --wait --timeout 2m --namespace operations-engineering-metadata-poc

deployment.yaml

@@ -13,7 +13,7 @@ spec:
         app: operations-engineering-metadata-poc
     spec:
       containers:
-        - name: operations-engineering-metadata-poc
+        - name: operations-engineering-metadata
           image: json0/metadata-api:latest
           ports:
             - containerPort: 5000
@@ -37,22 +37,22 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: operations-engineering-metadata-poc
-  namespace: operations-engineering-metadata-poc
+  namespace: operations-engineering-metadata
   annotations:
-    external-dns.alpha.kubernetes.io/set-identifier: operations-engineering-metadata-poc-operations-engineering-metadata-poc-green
+    external-dns.alpha.kubernetes.io/set-identifier: operations-engineering-metadata-operations-engineering-metadata-green
     external-dns.alpha.kubernetes.io/aws-weight: "100"
 spec:
   ingressClassName: default
   tls:
     - hosts:
-        - operations-engineering-metadata-poc.cloud-platform.service.justice.gov.uk
+        - operations-engineering-metadata.cloud-platform.service.justice.gov.uk
   rules:
-    - host: operations-engineering-metadata-poc.cloud-platform.service.justice.gov.uk
+    - host: operations-engineering-metadata.cloud-platform.service.justice.gov.uk
       http:
         paths:
           - backend:
               service:
-                name: operations-engineering-metadata-poc
+                name: operations-engineering-metadata
                 port:
                   number: 5000
             path: /

docker-compose.yaml

@@ -3,7 +3,7 @@ services:
   app:
     build: .
     image: "operations-engineering-metadata-poc"
-    container_name: "operations-engineering-metadata-poc"
+    container_name: "operations-engineering-metadata"
     environment:
       FLASK_CONFIGURATION: "development"
       FLASK_DEBUG: "true"

helm/operations-engineering-metadata/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

helm/operations-engineering-metadata/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: operations-engineering-metadata-poc
+description: A Helm chart for Kubernetes
+type: application
+version: 0.1.0
+appVersion: "0.0.1"

helm/operations-engineering-metadata/templates/NOTES.txt

@@ -0,0 +1,17 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "operations-engineering-metadata.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "operations-engineering-metadata.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "operations-engineering-metadata.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "operations-engineering-metadata.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}

helm/operations-engineering-metadata/templates/_helpers.tpl

@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "operations-engineering-metadata.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "operations-engineering-metadata.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "operations-engineering-metadata.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "operations-engineering-metadata.labels" -}}
+helm.sh/chart: {{ include "operations-engineering-metadata.chart" . }}
+{{ include "operations-engineering-metadata.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "operations-engineering-metadata.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "operations-engineering-metadata.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "operations-engineering-metadata.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "operations-engineering-metadata.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

helm/operations-engineering-metadata/templates/deployment.yaml

@@ -0,0 +1,53 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "operations-engineering-metadata.fullname" . }}
+  labels:
+    {{- include "operations-engineering-metadata.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "operations-engineering-metadata.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "operations-engineering-metadata.selectorLabels" . | nindent 8 }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: operations-engineering-metadata
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          env:
+            - name: FLASK_DEBUG
+              value: {{ .Values.application.flaskDebug | quote }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.port }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

helm/operations-engineering-metadata/templates/ingress.yaml

@@ -0,0 +1,35 @@
+{{- if .Values.ingress.enabled -}}
+{{- $fullName := include "operations-engineering-metadata.fullname" . -}}
+{{- $svcPort := .Values.service.port -}}
+---
+{{- $ingressHosts := .Values.ingress.hosts }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ $fullName }}
+  labels:
+    {{- include "operations-engineering-metadata.labels" . | nindent 4 }}
+  annotations:
+    external-dns.alpha.kubernetes.io/set-identifier: {{ $fullName }}-{{ $fullName }}-{{ .Values.ingress.colour }}
+    external-dns.alpha.kubernetes.io/aws-weight: "100"
+spec:
+  ingressClassName: {{ .Values.ingress.className }}
+  tls:
+    - hosts:
+        {{- range $host := $ingressHosts }}
+        - {{ $host }}
+        {{- end }}
+  rules:
+    {{- range $host := $ingressHosts }}
+    - host: {{ $host }}
+      http:
+        paths:
+          - path: /
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: {{ $fullName }}
+                port:
+                  number: {{ $svcPort }}
+    {{- end }}
+{{- end }}

helm/operations-engineering-metadata/templates/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "operations-engineering-metadata.fullname" . }}
+  labels:
+    {{- include "operations-engineering-metadata.labels" . | nindent 4 }}
+spec:
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: 5000
+      name: https
+  selector:
+    {{- include "operations-engineering-metadata.selectorLabels" . | nindent 4 }}

helm/operations-engineering-metadata/templates/serviceaccount.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "operations-engineering-metadata.serviceAccountName" . }}
+  labels:
+    {{- include "operations-engineering-metadata.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}

helm/operations-engineering-metadata/values-poc.yaml

@@ -0,0 +1,6 @@
+ingress:
+  hosts:
+    - operations-engineering-metadata.cloud-platform.service.justice.gov.uk
+
+image:
+  repository: 754256621582.dkr.ecr.eu-west-2.amazonaws.com/operations-engineering/operations-engineering-metadata-poc-ecr