Main updates

.gitlab-ci.yml

@@ -18,15 +18,34 @@ stages:
   - build
   - release
   - deploy
+  - upgrade-connection
 
 .gke-initialization:
-    before_script:
+  before_script:
     - echo $BASE64_GOOGLE_CREDENTIALS | base64 -d > ~/service_account.json
     - gcloud auth activate-service-account --key-file ~/service_account.json
     - gcloud config set project ${GCP_PROJECT_ID}
     - gcloud config set compute/zone ${GCP_COMPUTE_REGION}
     - gcloud container clusters get-credentials ${GCP_PROJECT_ID}-gke
 
+.gke-deployment:
+  extends: .gke-initialization
+  tags:
+  - docker
+  image: google/cloud-sdk:${GOOGLE_CLOUD_SDK_IMAGE_VERSION}
+  script:
+    - IMAGE="${CI_REGISTRY_IMAGE}:${VERSION}"
+    - cd "./k8s-manifests"
+    - kubectl apply -f gitlab-registry-credentials.yaml --namespace "${ENVIRONMENT_NAME}-${K8S_NAMESPACE}"
+    - SECRETS_MANIFEST=$(sed -e "s,{{jwtSecret}},${JWT_SECRET},g" ./secrets.yaml.tmpl)
+    - echo "${SECRETS_MANIFEST}" | kubectl apply --namespace "${ENVIRONMENT_NAME}-${K8S_NAMESPACE}" --filename -
+    - kubectl apply -f configmap.yaml --namespace "${ENVIRONMENT_NAME}-${K8S_NAMESPACE}"
+    - DEPLOYMENT_MANIFEST=$(sed -e "s,{{image}},${IMAGE},g" ./deployment.yaml.tmpl)
+    - echo "${DEPLOYMENT_MANIFEST}" | kubectl apply --namespace "${ENVIRONMENT_NAME}-${K8S_NAMESPACE}" --filename -
+    - kubectl apply -f service.yaml --namespace "${ENVIRONMENT_NAME}-${K8S_NAMESPACE}"
+    - INGRESS_MANIFEST=$(sed -e "s,{{static-ip-name}},${STATIC_IP},g" -e "s,{{allowHttpFlag}},false,g" -e "s,{{portNumber}},80,g" ./ingress.yaml.tmpl)
+    - echo "${INGRESS_MANIFEST}" | kubectl apply --namespace "${ENVIRONMENT_NAME}-${K8S_NAMESPACE}" --filename -
+
 run-tests:
   stage: test
   tags:
@@ -37,7 +56,6 @@ run-tests:
       alias: localhost
   variables:
     MONGODB_URL_TEST: mongodb://localhost:27017/todo-app
-    JWT_SECRET_TEST: my-very-secret-jwt
   script:
     - docker run -p 27017:27017
       --detach
@@ -49,7 +67,7 @@ run-tests:
       --tag "${CONTAINER_TAG}-test"
       --network=host
       --build-arg MONGODB_URL_TEST=$MONGODB_URL_TEST
-      --build-arg JWT_SECRET_TEST=$JWT_SECRET_TEST
+      --build-arg JWT_SECRET_TEST=$JWT_SECRET
       --file "./app/Dockerfile.test"
       "./app"
   after_script:
@@ -59,8 +77,6 @@ run-tests:
 
 build-image:
   stage: build
-  # needs:
-  #   - 'run-tests'
   tags:
     - docker-privileged
   image: docker:${DOCKER_VERSION}
@@ -73,17 +89,16 @@ build-image:
       --tag "${CONTAINER_TAG}"
       --target=build
       "./app"
-    # - docker image build
-    #   --tag "${CONTAINER_TAG}-google-sdk"
-    #   "./gcloud-image"
     - docker push "${CONTAINER_TAG}"
-    # - docker push "${CONTAINER_TAG}-google-sdk"
   after_script:
     - docker image rm --force "${CONTAINER_TAG}"
-    # - docker image rm --force "${CONTAINER_TAG}-google-sdk"
 
-create-release_image:
+create-release-image:
   stage: release
+  rules:
+    - if: $CI_COMMIT_REF_NAME =~ /main/
+      when: always
+    - when: never
   tags:
     - docker-privileged
   image: docker:${DOCKER_VERSION}
@@ -93,59 +108,81 @@ create-release_image:
     - docker login -u ${CI_REGISTRY_USER} -p ${CI_REGISTRY_PASSWORD} ${CI_REGISTRY}
     - docker pull "${CONTAINER_TAG}"
   script:
-    - VERSION=$(cat ./app/client/package.json | docker run --interactive stedolan/jq --raw-output '.version')
+    - VERSION=$(grep '"version"' ./app/client/package.json | cut -d '"' -f 4 | head -n 1)
     - docker tag "${CONTAINER_TAG}" "${CI_REGISTRY_IMAGE}:${VERSION}"
     - docker push "${CI_REGISTRY_IMAGE}:${VERSION}"
   after_script:
     - docker image rm --force
         $(docker images --format '{{.Repository}}{{.Tag}}' | grep '${CI_REGISTRY_IMAGE}')
 
-# create-release_tag:
-#   stage: release
-#   needs:
-#     - 'create-release_image'
-#   rules:
-#     - if: $CI_COMMIT_REF_NAME =~ /main/
-#       when: 'always'
-#   tags:
-#     - docker-privileged
-#   image: docker:${DOCKER_VERSION}-git
-#   services:
-#     - name: docker:${DOCKER_VERSION}-dind
-#   script:
-#     - VERSION=$(cat ./src/package.json | docker run --interactive stedolan/jq --raw-output '.version')
-#     - echo ${VERSION}
-#     #- git tag "v${VERSION}" && git push origin "v${VERSION}"
-
+create-release-tag:
+  stage: release
+  needs:
+    - 'create-release-image'
+  rules:
+    - if: $CI_COMMIT_REF_NAME =~ /main/
+      when: 'always'
+    - when: never
+  tags:
+    - docker-privileged
+  image: docker:${DOCKER_VERSION}-git
+  services:
+    - name: docker:${DOCKER_VERSION}-dind
+  before_script:
+    - PROJECT_URL=$(echo $CI_PROJECT_URL | sed 's/https:\/\///')
+    - git remote set-url origin https://oauth2:$MY_CI_ACCESS_TOKEN@${PROJECT_URL}
+  script:
+    - VERSION=$(grep '"version"' ./app/client/package.json | cut -d '"' -f 4 | head -n 1)
+    - echo ${VERSION}
+    - TAG=v${VERSION}
+    - git tag $TAG && git push origin $TAG
 
-deploy-image:
-  extends: .gke-initialization
+deploy-new-staging-version:
+  extends: .gke-deployment
   stage: deploy
   needs:
-    - 'create-release_image'
+    - 'build-image'
   rules:
     - if: $CI_COMMIT_REF_NAME =~ /staging/
       when: 'always'
       variables:
-        ENVIRONMENT_NAME: 'staging'
-        STATIC_IP: 'staging-todoapp-ip'
+        ENVIRONMENT_NAME: staging
+        STATIC_IP: staging-todoapp-ip
+        VERSION: ${CI_PIPELINE_IID}-${CI_COMMIT_SHORT_SHA}
+    - when: never
+
+deploy-new-release:
+  extends: .gke-deployment
+  stage: deploy
+  needs:
+    - 'create-release-image'
+  rules:
     - if: $CI_COMMIT_REF_NAME =~ /main/
       when: 'always'
       variables:
-        ENVIRONMENT_NAME: 'production'
-        STATIC_IP: 'todoapp-ip'
+        ENVIRONMENT_NAME: production
+        STATIC_IP: todoapp-ip
+        VERSION: $(grep '"version"' ./app/client/package.json | cut -d '"' -f 4 | head -n 1)
+    - when: never
+
+switch-to-https:
+  extends: .gke-initialization
+  stage: upgrade-connection
+  rules:
+    - if: $CI_COMMIT_REF_NAME =~ /staging/
+      when: manual
+      variables:
+        STATIC_IP: staging-todoapp-ip
+        ENVIRONMENT_NAME: staging
+    - if: $CI_COMMIT_REF_NAME =~ /main/
+      when: manual
+      variables:
+        STATIC_IP: todoapp-ip
+        ENVIRONMENT_NAME: production
   tags:
     - docker
   image: google/cloud-sdk:${GOOGLE_CLOUD_SDK_IMAGE_VERSION}
   script:
-    - VERSION="${CI_PIPELINE_IID}-${CI_COMMIT_SHORT_SHA}"
-    - IMAGE="${CI_REGISTRY_IMAGE}:${VERSION}"
-    - cd "./k8s-manifests"
-    - kubectl apply -f secrets.yaml --namespace "${ENVIRONMENT_NAME}-${K8S_NAMESPACE}"
-    - kubectl apply -f gitlab-registry-credentials.yaml --namespace "${ENVIRONMENT_NAME}-${K8S_NAMESPACE}"
-    - kubectl apply -f configmap.yaml --namespace "${ENVIRONMENT_NAME}-${K8S_NAMESPACE}"
-    - DEPLOYMENT_MANIFEST=$(sed -e "s,{{image}},${IMAGE},g" ./deployment.yaml.tmpl)
-    - echo "${DEPLOYMENT_MANIFEST}" | kubectl apply --namespace "${ENVIRONMENT_NAME}-${K8S_NAMESPACE}" --filename -
-    - kubectl apply -f service.yaml --namespace "${ENVIRONMENT_NAME}-${K8S_NAMESPACE}"
-    - INGRESS_MANIFEST=$(sed -e "s,{{static-ip-name}},${STATIC_IP},g" ./ingress.yaml.tmpl)
+    - INGRESS_MANIFEST=$(sed -e "s,{{static-ip-name}},${STATIC_IP},g" -e "s,{{allowHttpFlag}},true,g" -e "s,{{portNumber}},443,g" ./k8s-manifests/ingress.yaml.tmpl)
     - echo "${INGRESS_MANIFEST}" | kubectl apply --namespace "${ENVIRONMENT_NAME}-${K8S_NAMESPACE}" --filename -
+  when: manual

app/Dockerfile

@@ -5,10 +5,6 @@ ARG NODEJS_VERSION='16.17.0'
 
 FROM node:$NODEJS_VERSION-alpine AS base
 
-ARG \
-    MONGODB_URL_TEST=mongodb://host.docker.internal:27017/todo-app \
-    JWT_SECRET_TEST=<my-very-secret-jwt>
-
 ENV \
     PORT=3000 \
     MONGODB_URL=<dynamically-set-from-k8s> \

k8s-manifests/ingress.yaml.tmpl

@@ -3,9 +3,9 @@ kind: Ingress
 metadata:
   name: todo-app-ingress
   annotations:
-    kubernetes.io/ingress.class: "gce" # an external load-balancer
-    # kubernetes.io/ingress.allow-http: "false" # disabling HTTP
-    kubernetes.io/ingress.global-static-ip-name: {{static-ip-name}} # staging-todoapp-ip for staging
+    kubernetes.io/ingress.class: "gce" # Google's external load-balancer
+    kubernetes.io/ingress.allow-http: "{{allowHttpFlag}}" # disabling HTTP
+    kubernetes.io/ingress.global-static-ip-name: {{static-ip-name}}
     networking.gke.io/managed-certificates: todoapp-managed-cert # defined in the infrastructure repository
 spec:
   # rules:
@@ -20,4 +20,4 @@ spec:
     service:
       name: todo-app-service
       port:
-        number: 80
+        number: {{portNumber}} # 80 for HTTP, 443 for HTTPS

k8s-manifests/secrets.yaml → k8s-manifests/secrets.yaml.tmpl

@@ -4,4 +4,4 @@ metadata:
   name: todo-app-secrets
 type: Opaque
 data:
-  JWT_SECRET: dmVyYmlnand0c2VjcmV0d293
+  JWT_SECRET: {{jwtSecret}}