ci: align terraform version with generated plans #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy Dev | |
| on: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| id-token: write | |
| jobs: | |
| deploy: | |
| name: Plan, apply, and deploy | |
| runs-on: ubuntu-latest | |
| environment: dev | |
| concurrency: | |
| group: vidio-dev-deploy | |
| cancel-in-progress: false | |
| env: | |
| AWS_REGION: ${{ vars.AWS_REGION || 'us-west-2' }} | |
| AWS_ACCOUNT_ID: ${{ vars.AWS_ACCOUNT_ID || '202197228322' }} | |
| EKS_CLUSTER_NAME: ${{ vars.EKS_CLUSTER_NAME || 'vidio-dev' }} | |
| APP_HOSTNAME: ${{ vars.APP_HOSTNAME || 'vidio.md-dev970.com' }} | |
| API_HOSTNAME: ${{ vars.API_HOSTNAME || 'api.vidio.md-dev970.com' }} | |
| TF_VAR_aws_region: ${{ vars.AWS_REGION || 'us-west-2' }} | |
| TF_VAR_cluster_name: ${{ vars.EKS_CLUSTER_NAME || 'vidio-dev' }} | |
| TF_VAR_video_bucket_name: ${{ vars.S3_BUCKET }} | |
| TF_VAR_route53_zone_name: ${{ vars.ROUTE53_ZONE_NAME || 'vidio.md-dev970.com' }} | |
| TF_VAR_app_hostname: ${{ vars.APP_HOSTNAME || 'vidio.md-dev970.com' }} | |
| TF_VAR_api_hostname: ${{ vars.API_HOSTNAME || 'api.vidio.md-dev970.com' }} | |
| TF_VAR_ses_email_identity: ${{ vars.SES_EMAIL_IDENTITY || 'no-reply@vidio.md-dev970.com' }} | |
| TF_VAR_ses_domain_identity: ${{ vars.SES_DOMAIN_IDENTITY || 'vidio.md-dev970.com' }} | |
| TF_VAR_alb_dns_name: ${{ vars.ALB_DNS_NAME }} | |
| TF_VAR_alb_zone_id: ${{ vars.ALB_ZONE_ID }} | |
| TF_VAR_github_deploy_role_arn: ${{ secrets.AWS_DEPLOY_ROLE_ARN }} | |
| TF_IN_AUTOMATION: "true" | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set image tag | |
| run: echo "IMAGE_TAG=${GITHUB_SHA::12}" >> "$GITHUB_ENV" | |
| - uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }} | |
| aws-region: ${{ env.AWS_REGION }} | |
| - uses: hashicorp/setup-terraform@v3 | |
| with: | |
| terraform_version: "1.14.7" | |
| - name: Terraform init | |
| working-directory: infrastructure/terraform/envs/dev | |
| run: terraform init | |
| - name: Terraform plan | |
| working-directory: infrastructure/terraform/envs/dev | |
| run: terraform plan -input=false -no-color -out=tfplan | tee terraform-plan.txt | |
| - name: Upload plan artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: terraform-dev-plan | |
| path: infrastructure/terraform/envs/dev/terraform-plan.txt | |
| - name: Terraform apply | |
| working-directory: infrastructure/terraform/envs/dev | |
| run: terraform apply -input=false -auto-approve tfplan | |
| - name: Login to ECR | |
| uses: aws-actions/amazon-ecr-login@v2 | |
| - uses: docker/setup-buildx-action@v3 | |
| - name: Build and push images | |
| env: | |
| ECR: ${{ env.AWS_ACCOUNT_ID }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com | |
| run: | | |
| docker build -t "$ECR/vidio-api-service:$IMAGE_TAG" -t "$ECR/vidio-api-service:latest" new-services/api-service | |
| docker build -t "$ECR/vidio-video-service:$IMAGE_TAG" -t "$ECR/vidio-video-service:latest" new-services/video-service | |
| docker build -t "$ECR/vidio-processing-service:$IMAGE_TAG" -t "$ECR/vidio-processing-service:latest" new-services/processing-service | |
| docker build -t "$ECR/vidio-admin-dashboard:$IMAGE_TAG" -t "$ECR/vidio-admin-dashboard:latest" admin-dashboard | |
| docker push "$ECR/vidio-api-service:$IMAGE_TAG" | |
| docker push "$ECR/vidio-api-service:latest" | |
| docker push "$ECR/vidio-video-service:$IMAGE_TAG" | |
| docker push "$ECR/vidio-video-service:latest" | |
| docker push "$ECR/vidio-processing-service:$IMAGE_TAG" | |
| docker push "$ECR/vidio-processing-service:latest" | |
| docker push "$ECR/vidio-admin-dashboard:$IMAGE_TAG" | |
| docker push "$ECR/vidio-admin-dashboard:latest" | |
| - name: Update kubeconfig | |
| run: aws eks update-kubeconfig --region "$AWS_REGION" --name "$EKS_CLUSTER_NAME" | |
| - name: Render Kubernetes runtime config | |
| env: | |
| S3_BUCKET: ${{ vars.S3_BUCKET }} | |
| S3_REGION: ${{ vars.S3_REGION || 'us-west-2' }} | |
| S3_ENDPOINT: ${{ vars.S3_ENDPOINT }} | |
| S3_PUBLIC_ENDPOINT: ${{ vars.S3_PUBLIC_ENDPOINT }} | |
| S3_PATH_STYLE_ACCESS: ${{ vars.S3_PATH_STYLE_ACCESS || 'false' }} | |
| S3_PRESIGNED_URL_EXPIRATION_MINUTES: ${{ vars.S3_PRESIGNED_URL_EXPIRATION_MINUTES || '10' }} | |
| POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }} | |
| KEYCLOAK_ADMIN: ${{ vars.KEYCLOAK_ADMIN || 'admin' }} | |
| KEYCLOAK_ADMIN_PASSWORD: ${{ secrets.KEYCLOAK_ADMIN_PASSWORD }} | |
| VIDIO_SMTP_HOST: ${{ vars.VIDIO_SMTP_HOST }} | |
| VIDIO_SMTP_PORT: ${{ vars.VIDIO_SMTP_PORT || '587' }} | |
| VIDIO_SMTP_FROM: ${{ vars.VIDIO_SMTP_FROM }} | |
| VIDIO_SMTP_USER: ${{ secrets.VIDIO_SMTP_USER }} | |
| VIDIO_SMTP_PASSWORD: ${{ secrets.VIDIO_SMTP_PASSWORD }} | |
| VIDIO_SMTP_AUTH: ${{ vars.VIDIO_SMTP_AUTH || 'true' }} | |
| VIDIO_SMTP_STARTTLS: ${{ vars.VIDIO_SMTP_STARTTLS || 'true' }} | |
| run: | | |
| cat > k8s/aws/config.yaml <<EOF | |
| apiVersion: v1 | |
| kind: ConfigMap | |
| metadata: | |
| name: vidio-config | |
| namespace: vidio | |
| data: | |
| POSTGRES_DB: video_platform_db | |
| SPRING_DATASOURCE_URL: jdbc:postgresql://postgres:5432/video_platform_db | |
| SPRING_DATASOURCE_USERNAME: postgres | |
| SPRING_KAFKA_BOOTSTRAP_SERVERS: kafka:9092 | |
| KEYCLOAK_JWK_SET_URI: http://keycloak:8080/realms/vidio/protocol/openid-connect/certs | |
| VIDEO_SERVICE_BASE_URL: http://video-service:8082 | |
| PROCESSING_SERVICE_BASE_URL: http://processing-service:8083 | |
| S3_REGION: ${S3_REGION} | |
| S3_BUCKET: ${S3_BUCKET} | |
| S3_ENDPOINT: "${S3_ENDPOINT}" | |
| S3_PUBLIC_ENDPOINT: "${S3_PUBLIC_ENDPOINT}" | |
| S3_ACCESS_KEY: "" | |
| S3_SECRET_KEY: "" | |
| S3_PATH_STYLE_ACCESS: "${S3_PATH_STYLE_ACCESS}" | |
| S3_PRESIGNED_URL_EXPIRATION_MINUTES: "${S3_PRESIGNED_URL_EXPIRATION_MINUTES}" | |
| --- | |
| apiVersion: v1 | |
| kind: Secret | |
| metadata: | |
| name: vidio-secrets | |
| namespace: vidio | |
| type: Opaque | |
| stringData: | |
| POSTGRES_PASSWORD: ${POSTGRES_PASSWORD} | |
| KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN} | |
| KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD} | |
| VIDIO_SMTP_HOST: ${VIDIO_SMTP_HOST} | |
| VIDIO_SMTP_PORT: "${VIDIO_SMTP_PORT}" | |
| VIDIO_SMTP_FROM: ${VIDIO_SMTP_FROM} | |
| VIDIO_SMTP_USER: ${VIDIO_SMTP_USER} | |
| VIDIO_SMTP_PASSWORD: ${VIDIO_SMTP_PASSWORD} | |
| VIDIO_SMTP_AUTH: "${VIDIO_SMTP_AUTH}" | |
| VIDIO_SMTP_STARTTLS: "${VIDIO_SMTP_STARTTLS}" | |
| EOF | |
| - name: Pin Kubernetes image tags | |
| env: | |
| ECR: ${{ env.AWS_ACCOUNT_ID }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com | |
| run: | | |
| sed -i "s|$ECR/vidio-api-service:latest|$ECR/vidio-api-service:$IMAGE_TAG|g" k8s/aws/services.yaml | |
| sed -i "s|$ECR/vidio-video-service:latest|$ECR/vidio-video-service:$IMAGE_TAG|g" k8s/aws/services.yaml | |
| sed -i "s|$ECR/vidio-processing-service:latest|$ECR/vidio-processing-service:$IMAGE_TAG|g" k8s/aws/services.yaml | |
| sed -i "s|$ECR/vidio-admin-dashboard:latest|$ECR/vidio-admin-dashboard:$IMAGE_TAG|g" k8s/aws/services.yaml | |
| - name: Apply Kubernetes manifests | |
| run: kubectl apply -k k8s/aws | |
| - name: Validate rollouts | |
| run: | | |
| kubectl rollout status deployment/api-service -n vidio --timeout=5m | |
| kubectl rollout status deployment/video-service -n vidio --timeout=5m | |
| kubectl rollout status deployment/processing-service -n vidio --timeout=5m | |
| kubectl rollout status deployment/admin-dashboard -n vidio --timeout=5m | |
| kubectl rollout status deployment/keycloak -n vidio --timeout=5m | |
| - name: Validate service endpoints | |
| run: | | |
| kubectl get endpoints api-service -n vidio | |
| kubectl get endpoints video-service -n vidio | |
| kubectl get endpoints processing-service -n vidio | |
| - name: Smoke test public endpoints | |
| run: | | |
| curl --fail --show-error --silent "https://${API_HOSTNAME}/health" | |
| curl --fail --show-error --silent --head "https://${APP_HOSTNAME}" | |
| - name: Smoke test CORS preflight | |
| run: | | |
| curl --fail --show-error --silent -X OPTIONS "https://${API_HOSTNAME}/api/videos" \ | |
| -H "Origin: https://${APP_HOSTNAME}" \ | |
| -H "Access-Control-Request-Method: POST" \ | |
| -H "Access-Control-Request-Headers: authorization,content-type" \ | |
| -D /tmp/cors-headers.txt \ | |
| -o /tmp/cors-body.txt | |
| grep -i "access-control-allow-origin: https://${APP_HOSTNAME}" /tmp/cors-headers.txt |