diff --git a/.github/workflows/deploy-to-openshift-backend-dev.yml b/.github/workflows/deploy-to-openshift-backend-dev.yml index 823315fee..2dfbecb4f 100644 --- a/.github/workflows/deploy-to-openshift-backend-dev.yml +++ b/.github/workflows/deploy-to-openshift-backend-dev.yml @@ -152,7 +152,7 @@ jobs: # Process and apply deployment template oc process \ - -f tools/openshift/backend.dc.yaml \ + -f tools/openshift/backend.deployment.yaml \ -p APP_NAME=${{ env.APP_NAME }} \ -p REPO_NAME=${{ env.REPO_NAME }} \ -p BRANCH=${{ env.BRANCH }} \ diff --git a/tools/openshift/backend.deployment.yaml b/tools/openshift/backend.deployment.yaml new file mode 100644 index 000000000..76326b336 --- /dev/null +++ b/tools/openshift/backend.deployment.yaml @@ -0,0 +1,237 @@ +--- +apiVersion: template.openshift.io/v1 +kind: Template +labels: + template: "${REPO_NAME}-template" +metadata: + name: "${REPO_NAME}-backend-dc" +objects: +- apiVersion: apps/v1 + kind: Deployment + metadata: + annotations: + openshift.io/generated-by: OpenShiftNewApp + creationTimestamp: + labels: + app: "${APP_NAME}-${BRANCH}" + branch: "${BRANCH}" + name: "${APP_NAME}-backend-${APP_ENVIRONMENT}" + spec: + replicas: ${{MIN_REPLICAS}} + selector: + matchLabels: + app: "${APP_NAME}-${BRANCH}" + strategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 25% + maxSurge: 25% + template: + metadata: + annotations: + openshift.io/generated-by: OpenShiftNewApp + creationTimestamp: + labels: + app: "${APP_NAME}-${BRANCH}" + deploymentconfig: "${APP_NAME}-backend-${APP_ENVIRONMENT}" + spec: + containers: + - image: image-registry.openshift-image-registry.svc:5000/${NAMESPACE}/${REPO_NAME}-backend-${BRANCH}:${TAG} + imagePullPolicy: Always + volumeMounts: + - name: tls-certs + mountPath: "/etc/tls-certs" + readOnly: true + - name: log-storage + mountPath: /logs + livenessProbe: + initialDelaySeconds: 20 + failureThreshold: 5 + httpGet: + path: "/api/health" + port: 8080 + scheme: HTTP + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 5 + name: "${APP_NAME}-backend-${APP_ENVIRONMENT}" + ports: + - containerPort: 8080 + protocol: TCP + - containerPort: 443 + protocol: TCP + envFrom: + - configMapRef: + name: ccof-backend-${APP_ENVIRONMENT}-config-map + readinessProbe: + initialDelaySeconds: 10 + failureThreshold: 5 + httpGet: + path: "/api/health" + port: 8080 + scheme: HTTP + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 5 + resources: + requests: + cpu: "${MIN_CPU}" + memory: "${MIN_MEM}" + limits: + cpu: "${MAX_CPU}" + memory: "${MAX_MEM}" + - image: artifacts.developer.gov.bc.ca/docker-remote/fluent/fluent-bit:1.5.7 + name: "${APP_NAME}-fluent-bit-sidecar" + imagePullPolicy: Always + imagePullSecrets: + - name: artifactory-creds + volumeMounts: + - name: log-storage + mountPath: /mnt/log + - name: flb-sc-config-volume + mountPath: /fluent-bit/etc/ + readinessProbe: + tcpSocket: + port: 2020 + initialDelaySeconds: 10 + periodSeconds: 30 + timeoutSeconds: 5 + failureThreshold: 5 + successThreshold: 1 + livenessProbe: + httpGet: + path: / + port: 2020 + initialDelaySeconds: 10 + periodSeconds: 30 + timeoutSeconds: 5 + failureThreshold: 5 + successThreshold: 1 + ports: + - containerPort: 2020 + protocol: TCP + name: metrics + resources: + requests: + cpu: "5m" + memory: "32Mi" + limits: + cpu: "15m" + memory: "64Mi" + volumes: + - name: log-storage + emptyDir: {} + - name: tls-certs + secret: + secretName: ccof-backend-cert + - name: flb-sc-config-volume + configMap: + name: "${APP_NAME}-flb-sc-config-map" + test: false +- apiVersion: v1 + kind: Service + metadata: + annotations: + service.alpha.openshift.io/serving-cert-secret-name: "ccof-backend-cert" + openshift.io/generated-by: OpenShiftNewApp + creationTimestamp: + labels: + app: "${APP_NAME}-${BRANCH}" + name: "${APP_NAME}-backend-${APP_ENVIRONMENT}" + spec: + ports: + - name: 8080-tcp + port: 8080 + protocol: TCP + targetPort: 8080 + - name: 443-https + port: 443 + protocol: TCP + targetPort: 443 + selector: + matchLabels: + app: "${APP_NAME}-${BRANCH}" +- apiVersion: v1 + kind: Route + metadata: + annotations: + haproxy.router.openshift.io/rate-limit-connections: 'true' + haproxy.router.openshift.io/rate-limit-connections.concurrent-tcp: '10' + haproxy.router.openshift.io/rate-limit-connections.rate-http: '50' + haproxy.router.openshift.io/timeout: 120s + openshift.io/host.generated: 'true' + labels: + app: "${APP_NAME}-${BRANCH}" + name: "${APP_NAME}-backend-${APP_ENVIRONMENT}" + spec: + host: "${HOST_ROUTE}" + path: /api + port: + targetPort: 8080-tcp + tls: + insecureEdgeTerminationPolicy: Redirect + termination: edge + to: + kind: Service + name: "${APP_NAME}-backend-${APP_ENVIRONMENT}" + weight: 100 + wildcardPolicy: None +- apiVersion: autoscaling/v2 + kind: HorizontalPodAutoscaler + metadata: + name: "${APP_NAME}-backend-${APP_ENVIRONMENT}-cpu-autoscaler" + spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: "${APP_NAME}-backend-${APP_ENVIRONMENT}" + subresource: scale + minReplicas: ${{MIN_REPLICAS}} + maxReplicas: ${{MAX_REPLICAS}} + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: 90 +parameters: +- name: REPO_NAME + description: Application repository name + required: true +- name: BRANCH + description: Job identifier (i.e. 'pr-5' OR 'master') + required: true +- name: NAMESPACE + description: Target namespace reference (i.e. 'k8vopl-dev') + required: true +- name: APP_NAME + description: Application name + required: true +- name: HOST_ROUTE + description: The host the route will use to expose service outside cluster + required: true +- name: TAG + description: The identifying tag for this specific deployment + required: true +- name: MIN_REPLICAS + description: The minimum amount of replicas + required: true +- name: MAX_REPLICAS + description: The maximum amount of replicas + required: true +- name: MIN_CPU + description: The minimum amount of cpu + required: true +- name: MAX_CPU + description: The maximum amount of cpu + required: true +- name: MIN_MEM + description: The minimum amount of memory + required: true +- name: MAX_MEM + description: The maximum amount of memory + required: true +- name: APP_ENVIRONMENT + description: The environment being created ('dev', 'qa', 'uat', 'prod') + required: true