Add deployment to new k8s cluster

.github/workflows/deploy.yml

@@ -0,0 +1,55 @@
+name: deploy-staging
+
+on:
+    push:
+        tags:
+            - 'v[0-9]+.[0-9]+.[0-9]+'
+
+env:
+    IMAGE_NAME: productionbuild/analytodon
+
+jobs:
+    build-and-push:
+        name: Build and push
+        runs-on: ubuntu-latest
+        permissions:
+            contents: read
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@v4
+            - name: Log in to container registry
+              uses: docker/login-action@v3
+              with:
+                  username: ${{ secrets.DOCKERHUB_USERNAME }}
+                  password: ${{ secrets.DOCKERHUB_PASSWORD }}
+            - name: 'Build and push'
+              uses: docker/build-push-action@v5
+              with:
+                  push: true
+                  tags: |
+                      ${{ env.IMAGE_NAME }}:latest
+                      ${{ env.IMAGE_NAME }}:${{ github.sha }}
+                      ${{ env.IMAGE_NAME }}:${{ github.ref_name }}
+                  cache-from: type=gha
+                  cache-to: type=gha,mode=max
+    deploy:
+        name: Deploy
+        needs: build-and-push
+        runs-on: ubuntu-latest
+        steps:
+            - name: Install doctl
+              uses: digitalocean/action-doctl@v2
+              with:
+                  token: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}
+            - name: Save DigitalOcean kubeconfig with short-lived credentials
+              run: doctl kubernetes cluster kubeconfig save productionbuild-cluster
+            - name: Checkout source code
+              uses: actions/checkout@v4
+            - name: Deploy to the Kubernetes cluster
+              uses: azure/k8s-deploy@v4
+              with:
+                  namespace: analytodon
+                  manifests: |
+                      deploy/k8s/analytodon.yml
+                  images: |
+                      ${{ env.IMAGE_NAME }}:${{ github.sha }}

deploy/k8s/analytodon.yml

@@ -0,0 +1,146 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+    name: analytodon
+    namespace: analytodon
+spec:
+    replicas: 2
+    strategy:
+        type: RollingUpdate
+        rollingUpdate:
+            maxSurge: 0
+            maxUnavailable: 1
+    selector:
+        matchLabels:
+            app: analytodon
+    template:
+        metadata:
+            labels:
+                app: analytodon
+        spec:
+            affinity:
+                nodeAffinity:
+                    preferredDuringSchedulingIgnoredDuringExecution:
+                        - weight: 1
+                          preference:
+                              matchExpressions:
+                                  - key: project
+                                    operator: In
+                                    values:
+                                        - analytodon
+            containers:
+                - name: makler-lii
+                  image: productionbuild/analytodon:latest
+                  imagePullPolicy: Always
+                  securityContext:
+                      allowPrivilegeEscalation: false
+                      capabilities:
+                          drop:
+                              - ALL
+                  ports:
+                      - name: http
+                        containerPort: 80
+                  env:
+                      - name: NEWRELIC_LICENSE_KEY
+                        valueFrom:
+                            secretKeyRef:
+                                name: newrelic-secret
+                                key: license-key
+                      - name: JWT_SECRET
+                        valueFrom:
+                            secretKeyRef:
+                                name: jwt-secret
+                                key: secret
+                      - name: MONGODB_URI
+                        valueFrom:
+                            secretKeyRef:
+                                name: mongodb-secret
+                                key: uri
+                      - name: SES_HOST
+                        valueFrom:
+                            secretKeyRef:
+                                name: email-secret
+                                key: host
+                      - name: SES_PORT
+                        valueFrom:
+                            secretKeyRef:
+                                name: email-secret
+                                key: port
+                      - name: SES_USER
+                        valueFrom:
+                            secretKeyRef:
+                                name: email-secret
+                                key: user
+                      - name: SES_PASSWD
+                        valueFrom:
+                            secretKeyRef:
+                                name: email-secret
+                                key: password
+                      - name: EMAIL_API_KEY
+                        valueFrom:
+                            secretKeyRef:
+                                name: emailapi-secret
+                                key: key
+                  startupProbe:
+                      failureThreshold: 120
+                      httpGet:
+                          path: /
+                          port: http
+                  readinessProbe:
+                      httpGet:
+                          path: /login
+                          port: http
+---
+apiVersion: v1
+kind: Service
+metadata:
+    name: analytodon
+    namespace: analytodon
+spec:
+    selector:
+        app: analytodon
+    ports:
+        - port: 80
+          targetPort: http
+    type: ClusterIP
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+    name: analytodon-ingress
+    namespace: analytodon
+    annotations:
+        cert-manager.io/cluster-issuer: letsencrypt
+spec:
+    ingressClass: nginx
+    tls:
+        - hosts:
+              - app.analytodon.com
+          secretName: letsencrypt-analytodon-tls
+    rules:
+        - host: 'app.analytodon.com'
+          http:
+              paths:
+                  - pathType: Prefix
+                    path: '/'
+                    backend:
+                        service:
+                            name: analytodon
+                            port:
+                                number: 80
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+    name: letsencrypt
+    namespace: analytodon
+spec:
+    acme:
+        email: [email protected]
+        server: https://acme-v02.api.letsencrypt.org/directory
+        privateKeySecretRef:
+            name: letsencrypt-private-key
+        solvers:
+            - http01:
+                  ingress:
+                      class: nginx

deploy/k8s/namespace.yml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: analytodon