[NOTASK] Deploy metabase from the monorepo

.github/workflows/build-and-deploy.yml → .github/workflows/build-and-deploy-nada-backend.yml

@@ -143,6 +143,7 @@ jobs:
           path: nada-backend
 
   push:
+    name: Push backend image
     permissions:
       contents: write
       id-token: write
@@ -183,7 +184,7 @@ jobs:
         uses: nais/deploy/actions/deploy@v2
         env:
           CLUSTER: dev-gcp
-          RESOURCE: .nais/dev/nada-backend-config.yaml,.nais/dev/gcp.yaml
+          RESOURCE: .nais/dev/nada-backend/nada-backend-config.yaml,.nais/dev/nada-backend/gcp.yaml
           VAR: image=${{ needs.push.outputs.image }}
 
   deploy-prod:
@@ -199,5 +200,5 @@ jobs:
         uses: nais/deploy/actions/deploy@v2
         env:
           CLUSTER: prod-gcp
-          RESOURCE: .nais/prod/nada-backend-config.yaml,.nais/prod/gcp.yaml
+          RESOURCE: .nais/prod/nada-backend/nada-backend-config.yaml,.nais/prod/nada-backend/gcp.yaml
           VAR: image=${{ needs.push.outputs.image }}

.github/workflows/deploy-metabase.yaml

@@ -0,0 +1,53 @@
+name: Deploy metabase
+
+on:
+  workflow_run:
+    workflows: [ "Build and Deploy Nada Backend" ]
+    types:
+      - completed
+    branches:
+      - '*'
+    paths:
+      - '.metabase_version'
+      - '.nais/dev/metabase/**'
+      - '.nais/prod/metabase/**'
+      - '.nais/vars.yaml'
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  deploy-dev:
+    name: Deploy to NAIS dev
+    runs-on: ubuntu-latest
+    if: github.actor != 'dependabot[bot]' && github.event.workflow_run.conclusion == 'success'
+    steps:
+      - uses: actions/checkout@v4
+      - name: Read Metabase Version
+        id: read_metabase_version
+        run: echo "METABASE_VERSION=$(cat .metabase_version)" >> $GITHUB_ENV
+      - uses: nais/deploy/actions/deploy@v2
+        env:
+          CLUSTER: dev-gcp
+          RESOURCE: .nais/dev/metabase/gcp.yaml
+          VAR: version=${{ env.METABASE_VERSION }}
+          VARS: .nais/vars.yaml
+
+  deploy-prod:
+    name: Deploy to NAIS prod
+    runs-on: ubuntu-latest
+    needs: deploy-dev
+    if: github.ref == 'refs/heads/main' && github.actor != 'dependabot[bot]' && github.event.workflow_run.conclusion == 'success'
+    steps:
+      - uses: actions/checkout@v4
+      - name: Read Metabase Version
+        id: read_metabase_version
+        run: echo "METABASE_VERSION=$(cat .metabase_version)" >> $GITHUB_ENV
+      - uses: nais/deploy/actions/deploy@v2
+        env:
+          CLUSTER: prod-gcp
+          RESOURCE: .nais/prod/metabase/gcp.yaml
+          VAR: version=${{ env.METABASE_VERSION }}
+          VARS: .nais/vars.yaml
+          TIMEOUT: 15m

.metabase_version

@@ -1 +1 @@
-v1.50.21
+v1.50.24

.nais/dev/metabase/gcp.yaml

@@ -0,0 +1,94 @@
+apiVersion: nais.io/v1alpha1
+kind: Application
+metadata:
+  labels:
+    team: nada
+  name: metabase
+  namespace: nada
+  annotations:
+    {{#each annotations}}
+    {{this.key}}: "{{this.value}}"
+    {{/each}}
+spec:
+  prometheus:
+    enabled: true
+    path: /metrics
+    port: "9191"
+  env:
+  - name: JAVA_OPTS
+    value: "--XX:MaxRAMPercentage=75.0 -XX:+UseParallelGC -XX:ActiveProcessorCount=2"
+  - name: MB_PROMETHEUS_SERVER_PORT
+    value: "9191"
+  - name: MB_SITE_URL
+    value: https://metabase.ansatt.dev.nav.no
+  - name: MB_DB_USER
+    value: metabasedb
+  - name: MB_DB_HOST
+    value: "100.71.0.188"
+  {{#each envs}}
+  - name: {{this.name}}
+    value: "{{this.value}}"
+  {{/each}}
+  envFrom:
+  - secret: metabase
+  gcp:
+    sqlInstances:
+    - name: metabasedb
+      databases:
+      - name: metabase
+      type: POSTGRES_12
+      tier: db-custom-1-3840
+      flags:
+        - name: max_connections
+          value: "50"
+      diskAutoresize: true
+  image:  metabase/metabase-enterprise:{{version}}
+  ingresses:
+  - https://metabase.ansatt.dev.nav.no
+  - https://metabase-inside.intern.dev.nav.no
+  liveness:
+    path: /api/health
+  startup:
+    initialDelay: 40
+    periodSeconds: 10
+    failureThreshold: 10
+    path: /api/health
+  readiness:
+    path: /api/health
+  port: 3000
+  replicas:
+    max: 2
+    min: 1
+  resources:
+    limits:
+      memory: 1536Mi
+    requests:
+      cpu: 20m
+      memory: 1024Mi
+  accessPolicy:
+    inbound:
+      rules:
+      - application: nada-backend
+    outbound:
+      external:
+      {{#externalhosts}}
+      - host: "{{ . }}"
+      {{/externalhosts}}
+      - host: smtp.adeo.no
+        ports:
+        - port: 26
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    nginx.ingress.kubernetes.io/server-snippet: |
+      return 301 https://metabase.ansatt.dev.nav.no$request_uri;
+  labels:
+    team: nada
+  name: metabase-redirect
+  namespace: nada
+spec:
+  ingressClassName: nais-ingress
+  rules:
+  - host: metabase.intern.dev.nav.no

.nais/prod/metabase/gcp.yaml

@@ -0,0 +1,114 @@
+apiVersion: nais.io/v1alpha1
+kind: Application
+metadata:
+  labels:
+    team: nada
+  name: metabase
+  namespace: nada
+  annotations:
+    {{#each annotations}}
+    {{this.key}}: "{{this.value}}"
+    {{/each}}
+spec:
+  prometheus:
+    enabled: true
+    path: /metrics
+    port: "9191"
+  env:
+  - name: MB_PROMETHEUS_SERVER_PORT
+    value: "9191"
+  - name: MB_SITE_URL
+    value: https://metabase.ansatt.nav.no
+  - name: MB_DB_USER
+    value: metabase
+  - name: MB_DB_HOST
+    value: "127.0.0.1"
+  {{#each envs}}
+  - name: {{this.name}}
+    value: "{{this.value}}"
+  {{/each}}
+  envFrom:
+  - secret: metabase
+  gcp:
+    sqlInstances:
+    - databases:
+      - name: metabase
+      type: POSTGRES_12
+      flags:
+        - name: max_connections
+          value: "100"
+      tier: db-g1-small
+  image:  metabase/metabase-enterprise:{{version}}
+  ingresses:
+  - https://metabase.ansatt.nav.no
+  - https://metabase-inside.intern.nav.no
+  liveness:
+    path: /api/health
+  startup:
+    initialDelay: 180
+    periodSeconds: 30
+    failureThreshold: 30
+    path: /api/health
+  readiness:
+    path: /api/health
+  port: 3000
+  replicas:
+    max: 4
+    min: 2
+  resources:
+    limits:
+      memory: 5Gi
+    requests:
+      cpu: 300m
+      memory: 2048Mi
+  accessPolicy:
+    inbound:
+      rules:
+        - application: nada-backend
+    outbound:
+      external:
+      {{#externalhosts}}
+      - host: "{{ . }}"
+      {{/externalhosts}}
+      - host: smtp.adeo.no
+        ports:
+        - port: 26
+
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: metabase-alert
+  namespace: nada
+  labels:
+    team: nada
+spec:
+  groups:
+  - name: metabase-alert
+    rules:
+    - alert: InstanceDown
+      expr: kube_deployment_status_replicas_available{namespace="nada", deployment="metabase"} == 0
+      for: 2m
+      annotations:
+        consequence: Metabase is unavailable
+        action: "`kubectl describe pod <podname>` -> `kubectl logs <podname>`"
+        summary: |-
+          No metabase pods are running in prod-gcp
+      labels:
+        namespace: nada
+        severity: critical
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    nginx.ingress.kubernetes.io/server-snippet: |
+      return 301 https://metabase.ansatt.nav.no$request_uri;
+  labels:
+    team: nada
+  name: metabase-redirect
+  namespace: nada
+spec:
+  ingressClassName: nais-ingress-external
+  rules:
+  - host: metabase.intern.nav.no

.nais/vars.yaml

@@ -0,0 +1,59 @@
+annotations:
+  - key: config.linkerd.io/skip-outbound-ports
+    value: "26"
+  - key: nginx.ingress.kubernetes.io/proxy-body-size
+    value: "8m"
+  - key: nginx.ingress.kubernetes.io/proxy-read-timeout
+    value: "600"
+envs:
+  - name: MB_DB_TYPE
+    value: postgres
+  - name: MB_DB_DBNAME
+    value: metabase
+  - name: MB_DB_PORT
+    value: "5432"
+  - name: JAVA_TIMEZONE
+    value: UTC+1
+  - name: MB_COLORIZE_LOGS
+    value: "false"
+  - name: MB_PLUGINS_DIR
+    value: "/tmp"
+  - name: MB_ADMIN_EMAIL
+    value: "[email protected]"
+  - name: MB_METABOT_ENABLED
+    value: "true"
+  - name: MB_SAML_ENABLED
+    value: "true"
+  - name: MB_SAML_GROUP_SYNC
+    value: "true"
+  - name: MB_SAML_ATTRIBUTE_GROUP
+    value: http://schemas.microsoft.com/ws/2008/06/identity/claims/groups
+  - name: MB_SAML_IDENTITY_PROVIDER_ISSUER
+    value: https://sts.windows.net/62366534-1ec3-4962-8869-9b5535279d0b/
+  - name: MB_SAML_IDENTITY_PROVIDER_URI
+    value: HTTPS://login.microsoftonline.com/62366534-1ec3-4962-8869-9b5535279d0b/saml2
+  - name: MB_ENABLE_PASSWORD_LOGIN
+    value: "true"
+  - name: MAX_SESSION_AGE
+    value: "1440"
+  - name: MB_SESSION_COOKIES
+    value: "true"
+  - name: MB_EMAIL_FROM_ADDRESS
+    value: "[email protected]"
+  - name: MB_EMAIL_SMTP_HOST
+    value: "smtp.adeo.no"
+  - name: MB_EMAIL_SMTP_PORT
+    value: "26"
+  - name: MB_EMAIL_SMTP_SECURITY
+    value: "none"
+  - name: MB_EMAIL_SMTP_USERNAME
+    value: "srvNada"
+  - name: MB_SEND_NEW_SSO_USER_ADMIN_EMAIL
+    value: "false"
+  - name: MB_HEALTH_CHECK_LOGGING_ENABLED
+    value: "false"
+externalhosts:
+  - token-check.metabase.com
+  - slack.com
+  - files.slack.com
+  - metaboat.slack.com