Add public-samples/mint-mobile-app-ncuwqw/infrastructure/monitoring/l… #56
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Human Tasks: | ||
| # 1. Configure AWS IAM OIDC provider for GitHub Actions | ||
| # 2. Set up required GitHub repository secrets: | ||
| # - AWS_ACCOUNT_ID | ||
| # - AWS_ROLE_ARN (for production environment) | ||
| # - SLACK_WEBHOOK_URL (for notifications) | ||
| # 3. Configure branch protection rules for 'main' | ||
| # 4. Set up required environment protection rules for 'production' | ||
| # 5. Configure AWS KMS encryption keys for secrets | ||
| # 6. Set up monitoring dashboards for canary metrics | ||
| # Required GitHub Actions versions: | ||
| # actions/checkout@v3 | ||
| # aws-actions/configure-aws-credentials@v2 | ||
| # aws-actions/amazon-ecr-login@v1 | ||
| # hashicorp/setup-terraform@v2 | ||
| # azure/k8s-set-context@v2 | ||
| name: Production Deployment | ||
| # Requirement: CI/CD Pipeline - Implements production deployment with canary release strategy | ||
| on: | ||
| push: | ||
| branches: | ||
| - main | ||
| workflow_dispatch: | ||
| inputs: | ||
| deploy_version: | ||
| description: 'Version to deploy' | ||
| required: true | ||
| type: string | ||
| canary_percentage: | ||
| description: 'Percentage of traffic for canary' | ||
| required: false | ||
| type: number | ||
| default: 10 | ||
| # Requirement: Production Environment Deployment - Environment Configuration | ||
| env: | ||
| ENVIRONMENT: production | ||
| AWS_REGION: us-west-2 | ||
| ECR_REGISTRY: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com | ||
|
Check failure on line 42 in .github/workflows/deploy-production.yml
|
||
| CANARY_PERCENTAGE: ${{ github.event.inputs.canary_percentage || 10 }} | ||
| # Prevent concurrent deployments to production | ||
| concurrency: | ||
| group: production-deploy | ||
| cancel-in-progress: false | ||
| # Required permissions for deployment | ||
| permissions: | ||
| id-token: write | ||
| contents: read | ||
| packages: write | ||
| deployments: write | ||
| environments: write | ||
| jobs: | ||
| # Requirement: Production Environment Deployment - Infrastructure Management | ||
| deploy-infrastructure: | ||
| name: Deploy Production Infrastructure | ||
| runs-on: ubuntu-latest | ||
| environment: production | ||
| outputs: | ||
| eks_cluster_endpoint: ${{ steps.terraform-apply.outputs.eks_cluster_endpoint }} | ||
| rds_primary_endpoint: ${{ steps.terraform-apply.outputs.rds_primary_endpoint }} | ||
| redis_endpoint: ${{ steps.terraform-apply.outputs.redis_endpoint }} | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v3 | ||
| - name: Configure AWS credentials | ||
| uses: aws-actions/configure-aws-credentials@v2 | ||
| with: | ||
| role-to-assume: ${{ secrets.AWS_ROLE_ARN }} | ||
| aws-region: ${{ env.AWS_REGION }} | ||
| - name: Setup Terraform | ||
| uses: hashicorp/setup-terraform@v2 | ||
| with: | ||
| terraform_version: "1.4.x" | ||
| - name: Initialize Terraform | ||
| working-directory: infrastructure/terraform/environments/production | ||
| run: terraform init | ||
| - name: Plan infrastructure changes | ||
| working-directory: infrastructure/terraform/environments/production | ||
| run: terraform plan -out=tfplan | ||
| - name: Request manual approval | ||
| uses: trstringer/manual-approval@v1 | ||
| with: | ||
| secret: ${{ github.token }} | ||
| approvers: required-approvers | ||
| minimum-approvals: 2 | ||
| timeout: 3600 | ||
| - name: Apply infrastructure changes | ||
| id: terraform-apply | ||
| working-directory: infrastructure/terraform/environments/production | ||
| run: terraform apply -auto-approve tfplan | ||
| # Requirement: CI/CD Pipeline - Security Scanning | ||
| security-scan: | ||
| name: Security Scanning | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Scan container images | ||
| run: | | ||
| # Install and run Trivy scanner | ||
| curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin | ||
| trivy filesystem --security-checks vuln,config . | ||
| - name: Check infrastructure compliance | ||
| run: | | ||
| # Run tfsec for Terraform security scanning | ||
| curl -s https://raw.githubusercontent.com/tfsec/tfsec/master/scripts/install_linux.sh | bash | ||
| tfsec infrastructure/terraform | ||
| - name: Analyze dependencies | ||
| run: | | ||
| # Run OWASP Dependency Check | ||
| docker run --rm \ | ||
| -v $(pwd):/src \ | ||
| owasp/dependency-check \ | ||
| --scan /src \ | ||
| --format HTML \ | ||
| --out /src/dependency-check-report.html | ||
| - name: Generate security report | ||
| run: | | ||
| echo "Security Scan Summary" > security-report.txt | ||
| echo "===================" >> security-report.txt | ||
| echo "Completed scans:" >> security-report.txt | ||
| echo "- Container security scan" >> security-report.txt | ||
| echo "- Infrastructure compliance check" >> security-report.txt | ||
| echo "- Dependency analysis" >> security-report.txt | ||
| # Requirement: CI/CD Pipeline - Build and Push | ||
| build-and-push: | ||
| name: Build and Push Images | ||
| needs: [deploy-infrastructure, security-scan] | ||
| runs-on: ubuntu-latest | ||
| outputs: | ||
| backend_image_tag: ${{ steps.build-tags.outputs.backend_tag }} | ||
| web_image_tag: ${{ steps.build-tags.outputs.web_tag }} | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v3 | ||
| - name: Configure AWS credentials | ||
| uses: aws-actions/configure-aws-credentials@v2 | ||
| with: | ||
| role-to-assume: ${{ secrets.AWS_ROLE_ARN }} | ||
| aws-region: ${{ env.AWS_REGION }} | ||
| - name: Login to Amazon ECR | ||
| uses: aws-actions/amazon-ecr-login@v1 | ||
| - name: Generate build tags | ||
| id: build-tags | ||
| run: | | ||
| echo "backend_tag=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT | ||
| echo "web_tag=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT | ||
| - name: Build backend image | ||
| run: | | ||
| docker build -t ${{ env.ECR_REGISTRY }}/backend:${{ steps.build-tags.outputs.backend_tag }} \ | ||
| --build-arg ENV=production \ | ||
| ./backend | ||
| - name: Build web image | ||
| run: | | ||
| docker build -t ${{ env.ECR_REGISTRY }}/web:${{ steps.build-tags.outputs.web_tag }} \ | ||
| --build-arg ENV=production \ | ||
| ./web | ||
| - name: Scan images for vulnerabilities | ||
| run: | | ||
| trivy image ${{ env.ECR_REGISTRY }}/backend:${{ steps.build-tags.outputs.backend_tag }} | ||
| trivy image ${{ env.ECR_REGISTRY }}/web:${{ steps.build-tags.outputs.web_tag }} | ||
| - name: Push images to ECR | ||
| run: | | ||
| docker push ${{ env.ECR_REGISTRY }}/backend:${{ steps.build-tags.outputs.backend_tag }} | ||
| docker push ${{ env.ECR_REGISTRY }}/web:${{ steps.build-tags.outputs.web_tag }} | ||
| # Requirement: CI/CD Pipeline - Canary Deployment | ||
| deploy-canary: | ||
| name: Deploy Canary Release | ||
| needs: [build-and-push] | ||
| runs-on: ubuntu-latest | ||
| environment: production | ||
| steps: | ||
| - name: Configure kubectl | ||
| uses: azure/k8s-set-context@v2 | ||
| with: | ||
| method: kubeconfig | ||
| kubeconfig: ${{ secrets.KUBE_CONFIG }} | ||
| - name: Deploy canary backend | ||
| run: | | ||
| cat <<EOF | kubectl apply -f - | ||
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
| name: backend-api-canary | ||
| namespace: mint-replica-backend | ||
| spec: | ||
| replicas: 1 | ||
| template: | ||
| spec: | ||
| containers: | ||
| - name: backend-api | ||
| image: ${{ env.ECR_REGISTRY }}/backend:${{ needs.build-and-push.outputs.backend_image_tag }} | ||
| resources: | ||
| requests: | ||
| cpu: "500m" | ||
| memory: "512Mi" | ||
| limits: | ||
| cpu: "2000m" | ||
| memory: "2Gi" | ||
| EOF | ||
| - name: Deploy canary web frontend | ||
| run: | | ||
| cat <<EOF | kubectl apply -f - | ||
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
| name: web-frontend-canary | ||
| namespace: mint-replica-web | ||
| spec: | ||
| replicas: 1 | ||
| template: | ||
| spec: | ||
| containers: | ||
| - name: web-frontend | ||
| image: ${{ env.ECR_REGISTRY }}/web:${{ needs.build-and-push.outputs.web_image_tag }} | ||
| resources: | ||
| requests: | ||
| cpu: "100m" | ||
| memory: "256Mi" | ||
| limits: | ||
| cpu: "500m" | ||
| memory: "512Mi" | ||
| EOF | ||
| - name: Monitor canary metrics | ||
| run: | | ||
| # Wait for canary pods to be ready | ||
| kubectl wait --for=condition=ready pod -l app=mint-replica-lite,deployment=canary --timeout=300s | ||
| # Monitor error rates and latency for 10 minutes | ||
| for i in {1..10}; do | ||
| kubectl logs -l app=mint-replica-lite,deployment=canary --tail=100 | ||
| sleep 60 | ||
| done | ||
| - name: Validate canary health | ||
| run: | | ||
| # Check error rates | ||
| if [[ $(kubectl logs -l app=mint-replica-lite,deployment=canary --tail=1000 | grep ERROR | wc -l) -gt 5 ]]; then | ||
| echo "Error rate too high in canary deployment" | ||
| exit 1 | ||
| fi | ||
| # Requirement: High Availability - Production Promotion | ||
| promote-to-production: | ||
| name: Promote to Production | ||
| needs: [deploy-canary] | ||
| runs-on: ubuntu-latest | ||
| environment: production | ||
| steps: | ||
| - name: Validate canary metrics | ||
| run: | | ||
| # Check performance metrics | ||
| kubectl get --raw /apis/metrics.k8s.io/v1beta1/namespaces/mint-replica-backend/pods | jq . | ||
| kubectl get --raw /apis/metrics.k8s.io/v1beta1/namespaces/mint-replica-web/pods | jq . | ||
| - name: Request manual approval | ||
| uses: trstringer/manual-approval@v1 | ||
| with: | ||
| secret: ${{ github.token }} | ||
| approvers: required-approvers | ||
| minimum-approvals: 2 | ||
| timeout: 3600 | ||
| - name: Scale up production deployment | ||
| run: | | ||
| # Scale backend deployment | ||
| kubectl scale deployment backend-api -n mint-replica-backend --replicas=3 | ||
| # Scale web deployment | ||
| kubectl scale deployment web-frontend -n mint-replica-web --replicas=3 | ||
| # Update images | ||
| kubectl set image deployment/backend-api backend-api=${{ env.ECR_REGISTRY }}/backend:${{ needs.build-and-push.outputs.backend_image_tag }} -n mint-replica-backend | ||
| kubectl set image deployment/web-frontend web-frontend=${{ env.ECR_REGISTRY }}/web:${{ needs.build-and-push.outputs.web_image_tag }} -n mint-replica-web | ||
| - name: Scale down canary | ||
| run: | | ||
| kubectl delete deployment backend-api-canary -n mint-replica-backend | ||
| kubectl delete deployment web-frontend-canary -n mint-replica-web | ||
| - name: Verify production health | ||
| run: | | ||
| # Wait for production pods to be ready | ||
| kubectl wait --for=condition=ready pod -l app=mint-replica-lite -n mint-replica-backend --timeout=300s | ||
| kubectl wait --for=condition=ready pod -l app=mint-replica-lite -n mint-replica-web --timeout=300s | ||
| # Verify endpoints | ||
| kubectl get endpoints -n mint-replica-backend | ||
| kubectl get endpoints -n mint-replica-web | ||
