88 lines
4.0 KiB
Bash
88 lines
4.0 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
: "${DEPLOYMENT_ENVIRONMENT:?DEPLOYMENT_ENVIRONMENT is required}"
|
|
: "${KUBE_NAMESPACE:?KUBE_NAMESPACE is required}"
|
|
: "${PUBLIC_API_ORIGIN:?PUBLIC_API_ORIGIN is required}"
|
|
: "${MONGODB_CONNECTION_STRING:?MONGODB_CONNECTION_STRING is required}"
|
|
: "${AUTH_JWT_KEY:?AUTH_JWT_KEY is required}"
|
|
: "${INTERNAL_PURGE_SECRET:?INTERNAL_PURGE_SECRET is required}"
|
|
: "${STRIPE_SECRET_KEY:?STRIPE_SECRET_KEY is required}"
|
|
: "${STRIPE_WEBHOOK_SECRET:?STRIPE_WEBHOOK_SECRET is required}"
|
|
|
|
NODES="${NODES:-192.168.86.72 192.168.86.73 192.168.86.74}"
|
|
BUILD_TAG="$(git rev-parse HEAD)"
|
|
API_IMAGE="step3-questions:${BUILD_TAG}"
|
|
WEB_IMAGE="step3-web:${BUILD_TAG}"
|
|
TEST_IMAGE="step3-tests:${BUILD_TAG}"
|
|
API_TAR="/tmp/step3-questions-${DEPLOYMENT_ENVIRONMENT}.tar"
|
|
WEB_TAR="/tmp/step3-web-${DEPLOYMENT_ENVIRONMENT}.tar"
|
|
|
|
cleanup() {
|
|
rm -f "${API_TAR}" "${WEB_TAR}"
|
|
docker image rm "${API_IMAGE}" "${WEB_IMAGE}" "${TEST_IMAGE}" 2>/dev/null || true
|
|
docker image prune -f >/dev/null || true
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
rm -f "${API_TAR}" "${WEB_TAR}"
|
|
docker container prune -f
|
|
docker image prune -f
|
|
docker image prune -af --filter "until=24h"
|
|
docker builder prune -af || true
|
|
docker system df
|
|
df -h
|
|
|
|
docker build -f api/QuestionsApi.Tests/Dockerfile -t "${TEST_IMAGE}" .
|
|
docker build --build-arg BUILD_REVISION="${BUILD_TAG}" -t "${API_IMAGE}" api/QuestionsApi
|
|
docker build \
|
|
--build-arg BUILD_REVISION="${BUILD_TAG}" \
|
|
--build-arg DEPLOYMENT_ENVIRONMENT="${DEPLOYMENT_ENVIRONMENT}" \
|
|
--build-arg PUBLIC_API_ORIGIN="${PUBLIC_API_ORIGIN}" \
|
|
-f web/Dockerfile -t "${WEB_IMAGE}" .
|
|
|
|
docker save "${API_IMAGE}" -o "${API_TAR}"
|
|
docker save "${WEB_IMAGE}" -o "${WEB_TAR}"
|
|
for node in ${NODES}; do
|
|
scp -o StrictHostKeyChecking=no "${API_TAR}" hz@"${node}":/tmp/step3-questions.tar
|
|
scp -o StrictHostKeyChecking=no "${WEB_TAR}" hz@"${node}":/tmp/step3-web.tar
|
|
ssh -o StrictHostKeyChecking=no hz@"${node}" \
|
|
"sudo ctr -n k8s.io images import /tmp/step3-questions.tar && sudo ctr -n k8s.io images import /tmp/step3-web.tar && rm -f /tmp/step3-questions.tar /tmp/step3-web.tar"
|
|
done
|
|
|
|
kubectl apply -f "k8s/overlays/${DEPLOYMENT_ENVIRONMENT}/namespace.yaml"
|
|
kubectl create secret generic step3-runtime-secrets \
|
|
--from-literal=mongodb-connection-string="${MONGODB_CONNECTION_STRING}" \
|
|
--from-literal=jwt-key="${AUTH_JWT_KEY}" \
|
|
--from-literal=purge-secret="${INTERNAL_PURGE_SECRET}" \
|
|
--from-literal=stripe-secret-key="${STRIPE_SECRET_KEY}" \
|
|
--from-literal=stripe-webhook-secret="${STRIPE_WEBHOOK_SECRET}" \
|
|
--from-literal=google-client-id="${GOOGLE_CLIENT_ID:-}" \
|
|
--from-literal=google-client-secret="${GOOGLE_CLIENT_SECRET:-}" \
|
|
--dry-run=client -o yaml | kubectl apply -n "${KUBE_NAMESPACE}" -f -
|
|
|
|
kubectl kustomize "k8s/overlays/${DEPLOYMENT_ENVIRONMENT}" \
|
|
| sed "s|step3-questions:latest|${API_IMAGE}|g; s|step3-web:latest|${WEB_IMAGE}|g" \
|
|
| kubectl apply -f -
|
|
|
|
# Secret and ConfigMap values are consumed as environment variables at pod startup.
|
|
# Force a rollout so rerunning an unchanged revision still applies rotated secrets.
|
|
kubectl rollout restart deployment/step3-api -n "${KUBE_NAMESPACE}"
|
|
kubectl rollout status deployment/step3-api -n "${KUBE_NAMESPACE}" --timeout=240s
|
|
kubectl get --raw "/api/v1/namespaces/${KUBE_NAMESPACE}/services/step3-api:http/proxy/readyz" >/dev/null
|
|
kubectl rollout status deployment/step3-web -n "${KUBE_NAMESPACE}" --timeout=240s
|
|
kubectl get --raw "/api/v1/namespaces/${KUBE_NAMESPACE}/services/step3-web:http/proxy/healthz" >/dev/null
|
|
|
|
if [ "${DEPLOYMENT_ENVIRONMENT}" = "uat" ]; then
|
|
# The images are already imported on every Kubernetes node. Reclaim runner
|
|
# space before pulling the Playwright browser image.
|
|
docker image rm "${API_IMAGE}" "${WEB_IMAGE}" "${TEST_IMAGE}" 2>/dev/null || true
|
|
docker builder prune -af >/dev/null || true
|
|
UAT_API_ORIGIN="${PUBLIC_API_ORIGIN}" \
|
|
UAT_WEB_ORIGIN="${PUBLIC_WEB_ORIGIN:-https://ustep3.ranaze.com}" \
|
|
EXPECTED_REVISION="${BUILD_TAG}" \
|
|
bash .gitea/scripts/run-uat-smoke.sh
|
|
fi
|
|
|
|
echo "Deployed ${DEPLOYMENT_ENVIRONMENT} revision ${BUILD_TAG}."
|