Skip to content

Commit 26d8a0f

Browse files
UritassaUritassa
committedJan 4, 2025
Template files
1 parent 0216928 commit 26d8a0f

23 files changed

+835
-0
lines changed
 

‎.dockerignore

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
iac
2+
kubernetes
3+
__init__.py
4+
__pycache__
5+
.dockerignore
6+
Dockerfile
7+
README.md
8+
.github

‎.github/workflows/cd.yaml

+84
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
name: CD Pipeline
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
environment:
7+
required: true
8+
type: string
9+
working_directory:
10+
required: true
11+
type: string
12+
image:
13+
required: true
14+
type: string
15+
jobs:
16+
cd:
17+
environment:
18+
name: ${{ inputs.environment }}
19+
name: Deploy to Kubernetes cluster
20+
runs-on: ubuntu-latest
21+
defaults:
22+
run:
23+
shell: bash
24+
working-directory: ${{ inputs.working_directory }}
25+
26+
steps:
27+
28+
- name: Checkout Repository
29+
uses: actions/checkout@v4
30+
with:
31+
persist-credentials: "false"
32+
33+
- name: Configure AWS credentials from AWS account
34+
uses: aws-actions/configure-aws-credentials@v4
35+
with:
36+
role-to-assume: ${{ secrets.AWS_ROLE }}
37+
aws-region: ${{ vars.AWS_REGION }}
38+
role-session-name: Github-OIDC
39+
40+
- name: Configure kubectl for Amazon EKS
41+
run: aws eks --region ${{ vars.AWS_REGION }} update-kubeconfig --name ${{ vars.K8S_CLUSTER_NAME }}
42+
43+
44+
- name: Update Kubernetes Manifests
45+
working-directory: ${{ inputs.working_directory }}/${{ inputs.environment }}
46+
env:
47+
IMAGE: ${{ inputs.image }}
48+
run: |
49+
echo "Updating Kubernetes manifest with new image: $IMAGE"
50+
sed -i '/image:/s|image:.*|image: '"${{ inputs.image }}"'|' deployment.yaml
51+
echo "Updated deployment.yaml:"
52+
53+
- name: Commit and Push Changes to ${{ github.ref_name }} Branch
54+
working-directory: ${{ inputs.working_directory }}/${{ inputs.environment }}
55+
env:
56+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
57+
run: |
58+
git config user.name "github-actions"
59+
git config user.email "github-actions@users.noreply.github.com"
60+
git remote set-url origin https://${GITHUB_TOKEN}@github.com/${{ github.repository }}
61+
62+
# echo "Checking out or creating the ${{ github.ref_name }} branch..."
63+
# git checkout ${{ github.ref_name }} || git checkout -b ${{ github.ref_name }}
64+
65+
echo "Staging changes..."
66+
git add deployment.yaml
67+
68+
echo "Checking for changes..."
69+
if git diff --cached --quiet; then
70+
echo "No changes to commit."
71+
else
72+
echo "Changes detected. Committing..."
73+
git commit -m "Update image to ${{ inputs.image }}"
74+
75+
echo "Pushing changes to ${{ github.ref_name }} branch..."
76+
git push origin ${{ github.ref_name }}
77+
fi
78+
79+
- name: Deploy ArgoCD Application
80+
working-directory: ${{ inputs.working_directory }}/${{ inputs.environment }}/gitops
81+
run: |
82+
echo "Deploying ArgoCD application..."
83+
kubectl apply -f application.yaml
84+
echo "ArgoCD application deployed successfully."

‎.github/workflows/ci.yaml

+83
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
name: CI Pipeline
2+
on:
3+
workflow_call:
4+
inputs:
5+
environment:
6+
required: true
7+
type: string
8+
ecr_repository:
9+
required: true
10+
type: string
11+
working_directory:
12+
required: true
13+
type: string
14+
image_version:
15+
required: true
16+
type: string
17+
outputs:
18+
image_output:
19+
value: ${{ jobs.ci.outputs.image_output }}
20+
21+
22+
jobs:
23+
ci:
24+
environment:
25+
name: ${{ inputs.environment }}
26+
name: Build, Scan, and Push Docker Image
27+
runs-on: ubuntu-latest
28+
defaults:
29+
run:
30+
shell: bash
31+
working-directory: ${{ inputs.working_directory }}
32+
outputs:
33+
image_output: ${{ steps.build.outputs.image }}
34+
35+
steps:
36+
- name: Checkout Repository
37+
uses: actions/checkout@v4
38+
39+
- name: Configure AWS
40+
uses: aws-actions/configure-aws-credentials@v4
41+
with:
42+
role-to-assume: ${{ secrets.aws_role }}
43+
aws-region: ${{ vars.aws_region }}
44+
role-session-name: Github-OIDC
45+
46+
- name: Login to Amazon ECR Private
47+
id: login-ecr
48+
uses: aws-actions/amazon-ecr-login@v2
49+
50+
- name: Generate image tag
51+
id: generate-date
52+
run: |
53+
VERSION="${{ inputs.image_version }}"
54+
TAG="$VERSION"
55+
echo "TAG=$TAG" >> $GITHUB_ENV
56+
57+
58+
- name: Build Docker Image
59+
id: build
60+
env:
61+
ECR: ${{ steps.login-ecr.outputs.registry }}/${{ inputs.ecr_repository }}
62+
TAG: ${{ env.TAG }}
63+
run: |
64+
docker build -t $ECR:$TAG .
65+
echo "image=$ECR:$TAG" >> $GITHUB_ENV
66+
echo "image=$ECR:$TAG" >> $GITHUB_OUTPUT
67+
68+
- name: Scan Image with Trivy
69+
uses: aquasecurity/trivy-action@master
70+
with:
71+
image-ref: ${{ steps.build.outputs.image }}
72+
format: 'table'
73+
exit-code: '1'
74+
ignore-unfixed: true
75+
vuln-type: 'os,library'
76+
severity: 'CRITICAL'
77+
env:
78+
TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db:2,public.ecr.aws/aquasecurity/trivy-db:2
79+
80+
- name: Push Docker Image
81+
id: push
82+
if: success()
83+
run: docker push ${{ env.image }}

‎.github/workflows/iac.yaml

+104
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
name: IaC Pipeline
2+
on:
3+
workflow_dispatch:
4+
inputs:
5+
environment:
6+
description: 'Select environment target'
7+
required: true
8+
type: choice
9+
options:
10+
- dev
11+
working_directory:
12+
description: 'Select working directory target'
13+
required: true
14+
type: choice
15+
options:
16+
- './iac/dev/'
17+
cloud_resource_name:
18+
description: 'Choose a cloud resource name'
19+
required: true
20+
type: string
21+
terraform_version:
22+
description: 'Choose Terraform version'
23+
required: true
24+
type: choice
25+
options:
26+
- 1.9.8
27+
terragrunt_version:
28+
description: 'Choose Terragrunt version'
29+
required: true
30+
type: choice
31+
options:
32+
- 0.68.10
33+
34+
workflow_call:
35+
inputs:
36+
environment:
37+
required: true
38+
type: string
39+
working_directory:
40+
required: true
41+
type: string
42+
cloud_resource_name:
43+
required: true
44+
type: string
45+
terraform_version:
46+
required: true
47+
type: string
48+
terragrunt_version:
49+
required: true
50+
type: string
51+
52+
jobs:
53+
iac:
54+
name: Creating cloud resources
55+
environment:
56+
name: ${{ inputs.environment }}
57+
env:
58+
AWS_REGION: ${{ vars.aws_region }}
59+
DYNAMODB_TABLE: ${{ vars.dynamodb_table}}
60+
BUCKET_REGION: ${{ vars.bucket_region }}
61+
BUCKET_NAME: ${{ vars.bucket_name }}
62+
ENV: ${{ inputs.environment }}
63+
NAME: ${{ inputs.cloud_resource_name || github.event.repository.name }}
64+
TEMPLATE_SECRET: ${{ secrets.TEMPLATE }}
65+
66+
runs-on: ubuntu-latest
67+
defaults:
68+
run:
69+
shell: bash
70+
working-directory: ${{ inputs.working_directory }}
71+
steps:
72+
- name: ==== Git checkout ====
73+
uses: actions/checkout@v4
74+
75+
- name: ==== Configure AWS ====
76+
uses: aws-actions/configure-aws-credentials@v4
77+
with:
78+
role-to-assume: ${{ secrets.aws_role }}
79+
aws-region: ${{ vars.aws_region }}
80+
role-session-name: Github-OIDC
81+
82+
- name: Setup Terragrunt ${{ inputs.terragrunt_version }}
83+
run: |
84+
wget https://github.com/gruntwork-io/terragrunt/releases/download/v${{ inputs.terragrunt_version }}/terragrunt_linux_amd64
85+
mv terragrunt_linux_amd64 terragrunt
86+
chmod +x terragrunt
87+
sudo mv terragrunt /usr/local/bin/
88+
terragrunt -v
89+
90+
- name: Install Helm
91+
run: |
92+
curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
93+
94+
- name: Terragrunt Init
95+
id: init
96+
run: terragrunt run-all init -terragrunt-non-interactive
97+
98+
- name: Terragrunt plan
99+
id: plan
100+
run: terragrunt run-all plan -terragrunt-non-interactive
101+
102+
- name: Terragrunt apply
103+
id: apply
104+
run: terragrunt run-all apply -terragrunt-non-interactive

‎.github/workflows/main.yaml

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
name: CI/CD Main Pipeline
2+
on:
3+
workflow_dispatch:
4+
inputs:
5+
environment:
6+
description: 'Select environment target'
7+
required: true
8+
type: choice
9+
options:
10+
- dev
11+
12+
push:
13+
branches:
14+
- main
15+
paths-ignore:
16+
- 'k8s/**'
17+
- 'iac/**'
18+
- '.github/**'
19+
workflow_run:
20+
workflows: [CI/CD Release Pipeline]
21+
types: [completed]
22+
23+
jobs:
24+
iac:
25+
uses: ./.github/workflows/iac.yaml
26+
permissions:
27+
id-token: write
28+
contents: read
29+
with:
30+
environment: ${{ github.event.inputs.environment || 'dev' }}
31+
working_directory: ./iac/dev/
32+
cloud_resource_name: ${{ github.event.repository.name }}-${{ github.event.inputs.environment || 'dev' }}
33+
terraform_version: 1.9.8
34+
terragrunt_version: 0.68.10
35+
secrets: inherit
36+
ci:
37+
needs: iac
38+
uses: ./.github/workflows/ci.yaml
39+
permissions:
40+
id-token: write
41+
contents: read
42+
with:
43+
environment: ${{ github.event.inputs.environment || 'dev' }}
44+
working_directory: ./
45+
ecr_repository: "${{ github.event.repository.name }}-${{ github.event.inputs.environment || 'dev' }}"
46+
image_version: ${{ github.run_id }}
47+
secrets: inherit
48+
cd:
49+
needs: ci
50+
uses: ./.github/workflows/cd.yaml
51+
permissions:
52+
id-token: write
53+
contents: write
54+
with:
55+
environment: ${{ github.event.inputs.environment || 'dev' }}
56+
working_directory: ./k8s
57+
image: ${{ needs.ci.outputs.image_output }}
58+
secrets: inherit

‎.github/workflows/pr_validation.yaml

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
name: Pull request validation
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
paths-ignore:
8+
- '.github/**'
9+
- 'k8s/**'
10+
- 'iac'
11+
12+
jobs:
13+
pr-validaton:
14+
runs-on: ubuntu-latest
15+
defaults:
16+
run:
17+
shell: bash
18+
working-directory: ./app
19+
strategy:
20+
matrix:
21+
python-version: ['3.9', '3.10', '3.11', '3.12']
22+
steps:
23+
24+
- name: Checkout code
25+
uses: actions/checkout@v3
26+
27+
- name: Set up Python ${{ matrix.python-version }}
28+
uses: actions/setup-python@v4
29+
with:
30+
python-version: ${{ matrix.python-version }}
31+
32+
- name: Create virtual environment
33+
run: |
34+
python -m venv .venv
35+
36+
- name: Activate virtual environment
37+
run: |
38+
source .venv/bin/activate
39+
40+
- name: Install dependencies
41+
run: |
42+
python -m pip install --upgrade pip
43+
pip install -r requirements.txt
44+
45+
- name: Lint with flake8
46+
run: |
47+
pip install flake8
48+
49+
- name: Format with black
50+
run: |
51+
pip install black
52+
black --check .
53+
54+
- name: Run tests with pytest
55+
run: |
56+
pip install pytest
57+
pytest
58+
59+
- name: Type Check with mypy (Optional but highly recommended)
60+
run: |
61+
pip install mypy
62+
mypy .

‎.github/workflows/release.yaml

+120
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
name: CI/CD Release Pipeline
2+
on:
3+
workflow_dispatch:
4+
inputs:
5+
environment:
6+
description: 'Select environment target'
7+
required: true
8+
type: choice
9+
options:
10+
- prod
11+
release_version:
12+
description: 'Specify the release version (e.g., 1.2.3) or leave blank for automatic increment'
13+
required: false
14+
type: string
15+
16+
jobs:
17+
pre-release:
18+
environment: ${{ github.event.inputs.environment }}
19+
runs-on: ubuntu-latest
20+
outputs:
21+
release_tag: ${{ steps.release_version.outputs.version }}
22+
steps:
23+
- name: Checkout code
24+
uses: actions/checkout@v3
25+
with:
26+
ref: ${{ github.ref }}
27+
28+
- name: Set up Git
29+
run: |
30+
git config --global user.name "GitHub Actions"
31+
git config --global user.email "actions@github.com"
32+
33+
- name: Determine Release Version
34+
id: release_version
35+
env:
36+
RELEASE_VERSION: ${{ github.event.inputs.release_version }}
37+
run: |
38+
echo "version=$RELEASE_VERSION" >> $GITHUB_OUTPUT
39+
40+
iac:
41+
needs: pre-release
42+
uses: ./.github/workflows/iac.yaml
43+
permissions:
44+
id-token: write
45+
contents: read
46+
with:
47+
environment: ${{ github.event.inputs.environment }}
48+
working_directory: ./iac/${{ github.event.inputs.environment }}
49+
cloud_resource_name: ${{ github.event.repository.name }}
50+
terraform_version: 1.9.8
51+
terragrunt_version: 0.68.10
52+
secrets: inherit
53+
54+
ci:
55+
needs: [iac, pre-release]
56+
uses: ./.github/workflows/ci.yaml
57+
permissions:
58+
id-token: write
59+
contents: read
60+
with:
61+
environment: ${{ github.event.inputs.environment }}
62+
working_directory: ./
63+
ecr_repository: ${{ github.event.repository.name }}
64+
image_version: ${{ needs.pre-release.outputs.release_tag }}
65+
secrets: inherit
66+
67+
cd:
68+
needs: [ci]
69+
uses: ./.github/workflows/cd.yaml
70+
permissions:
71+
id-token: write
72+
contents: write
73+
with:
74+
environment: ${{ github.event.inputs.environment }}
75+
working_directory: ./k8s
76+
image: ${{ needs.ci.outputs.image_output }}
77+
secrets: inherit
78+
79+
release:
80+
needs: [ cd, pre-release]
81+
environment: ${{ github.event.inputs.environment }}
82+
permissions:
83+
contents: write
84+
runs-on: ubuntu-latest
85+
steps:
86+
- name: Checkout code
87+
uses: actions/checkout@v3
88+
with:
89+
ref: ${{ github.ref }}
90+
fetch-depth: 0
91+
92+
- name: Set up Git
93+
run: |
94+
git config --global user.name "GitHub Actions"
95+
git config --global user.email "actions@github.com"
96+
97+
- name: Create Tag and Push
98+
env:
99+
VERSION: ${{ needs.pre-release.outputs.release_tag }}
100+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
101+
run: |
102+
CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD)
103+
echo "Current branch: $CURRENT_BRANCH"
104+
# Create the tag
105+
git tag -a "${{ env.VERSION }}" -m "Release ${{ env.VERSION }}"
106+
# Push the tag only
107+
git push origin "refs/tags/${{ env.VERSION }}"
108+
#git push origin "refs/tags/${{ env.VERSION }}" $CURRENT_BRANCH # for updating main branch
109+
110+
- name: Install GitHub CLI
111+
run: |
112+
sudo apt-get update
113+
sudo apt-get install -y gh
114+
115+
- name: Create GitHub Release
116+
env:
117+
VERSION: ${{ needs.pre-release.outputs.release_tag }}
118+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
119+
run: |
120+
gh release create "${{ env.VERSION }}" --notes "Release ${{ env.VERSION }}"

‎Dockerfile

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
FROM python:3.9-slim AS builder
2+
3+
WORKDIR /usr/src/app
4+
5+
COPY ./app .
6+
7+
RUN pip3 install --no-cache-dir -r requirements.txt
8+
9+
EXPOSE 8000
10+
11+
CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]

‎app/main.py

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
import uvicorn
2+
from fastapi import FastAPI
3+
4+
app = FastAPI()
5+
6+
@app.get("/")
7+
def root():
8+
return {"message": "This is a demo"}
9+
10+
@app.get("/healthz")
11+
def healthz():
12+
return {"status": "ok", "database": "connected"}
13+
14+
@app.get("/ready")
15+
def healthz():
16+
return {"status": "ok", "app": "ready"}
17+
18+
if __name__ == "__main__":
19+
uvicorn.run("main:app", port=8000, reload=True)
20+

‎app/requirements.txt

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
fastapi==0.115.4
2+
pyasn1==0.6.1
3+
pycparser==2.22
4+
pydantic==2.9.2
5+
pydantic-settings==2.6.1
6+
pydantic_core==2.23.4
7+
python-dotenv==1.0.1
8+
python-jose==3.3.0
9+
python-multipart==0.0.17
10+
pytz==2024.2
11+
rsa==4.9
12+
setuptools==75.3.0
13+
uvicorn==0.32.0

‎iac/dev/env.hcl

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
locals {
2+
name = get_env("NAME")
3+
environment = get_env("ENV")
4+
template_secret = get_env("TEMPLATE_SECRET")
5+
6+
}

‎iac/dev/template/ecr/terragrunt.hcl

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
terraform {
2+
source = "tfr:///terraform-aws-modules/ecr/aws?version=2.3.0"
3+
}
4+
include "root" {
5+
path = find_in_parent_folders()
6+
}
7+
8+
include "env" {
9+
path = find_in_parent_folders("env.hcl")
10+
expose = true
11+
}
12+
13+
inputs = {
14+
repository_name = include.env.locals.name
15+
repository_type = "private"
16+
repository_image_tag_mutability = "MUTABLE"
17+
repository_image_scan_on_push = true
18+
create_lifecycle_policy = false
19+
tags = {
20+
Name = include.env.locals.name
21+
Environment = include.env.locals.environment
22+
}
23+
}

‎iac/dev/template/secretsmanager/terragrunt.hcl

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
terraform {
2+
source = "tfr:///terraform-aws-modules/secrets-manager/aws?version=1.3.1"
3+
}
4+
include "root" {
5+
path = find_in_parent_folders()
6+
}
7+
8+
include "env" {
9+
path = find_in_parent_folders("env.hcl")
10+
expose = true
11+
}
12+
13+
inputs = {
14+
name = include.env.locals.name
15+
secret_string = jsonencode({
16+
"template_secret" = include.env.locals.template_secret
17+
})
18+
create_lifecycle_policy = false
19+
tags = {
20+
Name = include.env.locals.name
21+
Environment = include.env.locals.environment
22+
}
23+
}

‎iac/prod/env.hcl

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
locals {
2+
name = get_env("NAME")
3+
environment = get_env("ENV")
4+
template_secret = get_env("TEMPLATE_SECRET")
5+
6+
}

‎iac/prod/template/ecr/terragrunt.hcl

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
terraform {
2+
source = "tfr:///terraform-aws-modules/ecr/aws?version=2.3.0"
3+
}
4+
include "root" {
5+
path = find_in_parent_folders()
6+
}
7+
8+
include "env" {
9+
path = find_in_parent_folders("env.hcl")
10+
expose = true
11+
}
12+
13+
inputs = {
14+
repository_name = include.env.locals.name
15+
repository_type = "private"
16+
repository_image_tag_mutability = "MUTABLE"
17+
repository_image_scan_on_push = true
18+
create_lifecycle_policy = false
19+
tags = {
20+
Name = include.env.locals.name
21+
Environment = include.env.locals.environment
22+
}
23+
}

‎iac/prod/template/secretsmanager/terragrunt.hcl

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
terraform {
2+
source = "tfr:///terraform-aws-modules/secrets-manager/aws?version=1.3.1"
3+
}
4+
include "root" {
5+
path = find_in_parent_folders()
6+
}
7+
8+
include "env" {
9+
path = find_in_parent_folders("env.hcl")
10+
expose = true
11+
}
12+
13+
inputs = {
14+
name = include.env.locals.name
15+
secret_string = jsonencode({
16+
"template_secret" = include.env.locals.template_secret
17+
})
18+
create_lifecycle_policy = false
19+
tags = {
20+
Name = include.env.locals.name
21+
Environment = include.env.locals.environment
22+
}
23+
}

‎iac/terragrunt.hcl

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
locals {
2+
region = get_env("AWS_REGION")
3+
db_table = get_env("DYNAMODB_TABLE")
4+
bucket_region = get_env("BUCKET_REGION")
5+
bucket_name = get_env("BUCKET_NAME")
6+
}
7+
8+
remote_state {
9+
backend = "s3"
10+
generate = {
11+
path = "backend.tf"
12+
if_exists = "overwrite_terragrunt"
13+
}
14+
config = {
15+
bucket = "${local.bucket_name}"
16+
key = "${path_relative_to_include()}/terraform.tfstate"
17+
region = "${local.bucket_region}"
18+
encrypt = true
19+
dynamodb_table = "${local.db_table}"
20+
}
21+
}
22+
23+
generate "provider" {
24+
path = "provider.tf"
25+
if_exists = "overwrite_terragrunt"
26+
contents = <<EOF
27+
provider "aws" {
28+
region = "${local.region}"
29+
}
30+
EOF
31+
}

‎k8s/configmap.yaml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: gh-flow-demo-cm
5+
data:
6+
NAME: "gh-flow-demo-configMap"
7+

‎k8s/deployment.yaml

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: gh-flow-demo
5+
labels:
6+
app: gh-flow-demo
7+
app.kubernetes.io/name: gh-flow-demo
8+
spec:
9+
replicas: 1
10+
selector:
11+
matchLabels:
12+
app: gh-flow-demo
13+
template:
14+
metadata:
15+
labels:
16+
app: gh-flow-demo
17+
spec:
18+
nodeSelector:
19+
nodegroup: tools
20+
containers:
21+
- name: gh-flow-demo
22+
image: 750512685552.dkr.ecr.us-west-1.amazonaws.com/gh-flow
23+
imagePullPolicy: Always
24+
ports:
25+
- name: http
26+
containerPort: 8000
27+
protocol: TCP
28+
resources:
29+
requests:
30+
cpu: 64m
31+
memory: 64Mi
32+
limits:
33+
cpu: 128m
34+
memory: 128Mi
35+
startupProbe:
36+
httpGet:
37+
path: /healthz
38+
port: 8000
39+
failureThreshold: 30
40+
periodSeconds: 1
41+
livenessProbe:
42+
httpGet:
43+
path: /healthz
44+
port: 8000
45+
initialDelaySeconds: 3
46+
periodSeconds: 3
47+
readinessProbe:
48+
httpGet:
49+
path: /ready
50+
port: 8000
51+
initialDelaySeconds: 5
52+
periodSeconds: 5
53+
envFrom:
54+
- secretRef:
55+
name: gh-flow-demo-secrets
56+
- configMapRef:
57+
name: gh-flow-demo-cm

‎k8s/dev/app.yaml

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: gh-flow-demo
5+
namespace: argocd
6+
spec:
7+
destination:
8+
name: ''
9+
namespace: gh-flow
10+
server: https://kubernetes.default.svc
11+
source:
12+
path: kubernetes
13+
repoURL: https://github.com/e-commander/gh-flow
14+
targetRevision: dev
15+
sources: []
16+
project: default
17+
syncPolicy:
18+
automated:
19+
prune: false
20+
selfHeal: true
21+
syncOptions:
22+
- CreateNamespace=true

‎k8s/externalsecret.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: external-secrets.io/v1beta1
2+
kind: ExternalSecret
3+
metadata:
4+
name: gh-flow-demo
5+
spec:
6+
refreshInterval: "1h"
7+
secretStoreRef:
8+
name: cluster-secret-store
9+
kind: ClusterSecretStore
10+
target:
11+
name: gh-flow-demo-secrets
12+
creationPolicy: Owner
13+
data:
14+
- secretKey: gh-flow-demo
15+
remoteRef:
16+
key: gh-flow-dev # aws secret manager name
17+
property: gh-flow-demo # aws secret_key

‎k8s/prod/app.yaml

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: gh-flow-demo
5+
namespace: argocd
6+
spec:
7+
destination:
8+
name: ''
9+
namespace: gh-flow
10+
server: https://kubernetes.default.svc
11+
source:
12+
path: kubernetes
13+
repoURL: https://github.com/e-commander/gh-flow
14+
targetRevision: main
15+
sources: []
16+
project: default
17+
syncPolicy:
18+
automated:
19+
prune: false
20+
selfHeal: true
21+
syncOptions:
22+
- CreateNamespace=true

‎k8s/service.yaml

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: gh-flow-demo-service
5+
spec:
6+
selector:
7+
app: gh-flow-demo
8+
ports:
9+
- protocol: TCP
10+
port: 80
11+
targetPort: http
12+
type: ClusterIP

0 commit comments

Comments
 (0)
Please sign in to comment.