-
Notifications
You must be signed in to change notification settings - Fork 8
112 lines (103 loc) · 4.06 KB
/
cd-prod.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
name: Deploy (Production)
on:
workflow_run:
workflows: ["Release Docker Image (Production)"]
types:
- completed
workflow_dispatch:
env:
IMAGE_NAME: ghcr.io/basedosdados/website:production
jobs:
deploy-production:
if: ${{ github.event.workflow_run.conclusion == 'success' }} || ${{ github.event_name == 'workflow_dispatch' }}
name: Deploy (Production)
runs-on: ubuntu-latest
environment:
name: production
url: https://basedosdados.org
steps:
- name: Checkout
uses: actions/[email protected]
with:
ref: main
- name: Import Secrets
id: import_secrets
uses: hashicorp/[email protected]
with:
url: https://vault.basedosdados.org
token: ${{ secrets.VAULT_TOKEN }}
secrets: |
secret/data/gcp_credentials/basedosdados-dev GCP_SA_KEY_BASE64 | GCP_SA_KEY_BASE64 ;
secret/data/gcp_credentials/basedosdados-dev GCP_PROJECT_ID | GCP_PROJECT_ID ;
secret/data/gcp_credentials/basedosdados-dev GKE_CLUSTER_NAME | GKE_CLUSTER_NAME ;
secret/data/gcp_credentials/basedosdados-dev GKE_CLUSTER_ZONE | GKE_CLUSTER_ZONE ;
- name: Setup Google Cloud CLI
uses: google-github-actions/[email protected]
with:
service_account_key: ${{ steps.import_secrets.outputs.GCP_SA_KEY_BASE64 }}
project_id: ${{ steps.import_secrets.outputs.GCP_PROJECT_ID }}
export_default_credentials: true
- name: Get GKE credentials
uses: google-github-actions/[email protected]
with:
cluster_name: ${{ steps.import_secrets.outputs.GKE_CLUSTER_NAME }}
location: ${{ steps.import_secrets.outputs.GKE_CLUSTER_ZONE }}
credentials: ${{ steps.import_secrets.outputs.GCP_SA_KEY_BASE64 }}
- name: Write values.yaml file
run: |
cat << EOF > values.yaml
website:
name: "basedosdados-website-production"
image:
name: "ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}"
tag: "production"
pullPolicy: "Always"
replicas: 2
resources:
requests:
cpu: 100m
memory: 500Mi
limits:
cpu: 500m
memory: 1Gi
env: []
envFrom:
- secretRef:
name: basedosdados-website-production
ingress:
enabled: true
host: "basedosdados.org"
annotations:
cert-manager.io/issuer: "letsencrypt-production"
kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/rewrite-target: /
nginx.ingress.kubernetes.io/ssl-redirect: "true"
tls:
- hosts:
- "basedosdados.org"
secretName: "basedosdados-org-tls"
internationalDomains:
- language: "es"
host: "basedelosdatos.org"
annotations:
cert-manager.io/issuer: "letsencrypt-production"
kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/ssl-redirect: "true"
tls:
- hosts:
- "basedelosdatos.org"
secretName: "basedelosdatos-org-tls"
- language: "en"
host: "data-basis.org"
annotations:
cert-manager.io/issuer: "letsencrypt-production"
kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/ssl-redirect: "true"
tls:
- hosts:
- "data-basis.org"
secretName: "data-basis-org-tls"
EOF
- name: Deploy using Helm
run: |
helm upgrade --install basedosdados-website-production charts/basedosdados-website/. -n website -f values.yaml --wait