Feature/ Add helm chart for production

.github/workflows/ci.yml

@@ -126,7 +126,7 @@ jobs:
           else
             # Unique semver prerelease for main pushes
             SHORT_SHA="$(echo "${GITHUB_SHA}" | cut -c1-7)"
-            VERSION="0.1.0-${SHORT_SHA}"
+            VERSION="0.1.0-c${SHORT_SHA}"
           fi
 
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
@@ -176,5 +176,3 @@ jobs:
           echo '```yaml' >> $GITHUB_STEP_SUMMARY
           helm push "$PACKAGE_FILE" "$OCI_REPO" 2>> $GITHUB_STEP_SUMMARY
           echo '```' >> $GITHUB_STEP_SUMMARY
-          echo "> [!Important]" >> $GITHUB_STEP_SUMMARY
-          echo "> NOTE: Tagged Docker image & Helm chart version: **$IMAGE**" >> $GITHUB_STEP_SUMMARY

helm/snapshots/production.yaml

@@ -0,0 +1,222 @@
+---
+# Source: cacheppuccino-helm/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ifrcgo-cacheppuccino
+  labels:
+    helm.sh/chart: cacheppuccino-helm-0.1.0
+    app.kubernetes.io/name: cacheppuccino-helm
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    azure.workload.identity/client-id: test_id
+---
+# Source: cacheppuccino-helm/templates/configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ifrcgo-cacheppuccino
+  labels:
+    helm.sh/chart: cacheppuccino-helm-0.1.0
+    app.kubernetes.io/name: cacheppuccino-helm
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/managed-by: Helm
+data:
+  SQLITE_PATH: "/data/cacheppuccino.db"
+  HTTP_TIMEOUT: "30s"
+  INITIAL_PULL_DEADLINE: "45s"
+  LISTEN_ADDR: ":8080"
+  LOG_LEVEL: "info"
+  PULL_INTERVAL: "10m"
+  TRANSLATION_APPLICATION_ID: "18"
+  TRANSLATION_BASE_URL: "https://ifrc-test-translationapi.azurewebsites.net"
+---
+# Source: cacheppuccino-helm/templates/pvc.yaml
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: ifrcgo-cacheppuccino
+  labels:
+    helm.sh/chart: cacheppuccino-helm-0.1.0
+    app.kubernetes.io/name: cacheppuccino-helm
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: "512Mi"
+---
+# Source: cacheppuccino-helm/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: ifrcgo-cacheppuccino
+  labels:
+    helm.sh/chart: cacheppuccino-helm-0.1.0
+    app.kubernetes.io/name: cacheppuccino-helm
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+      protocol: TCP
+  selector:
+    app.kubernetes.io/name: cacheppuccino-helm
+    app.kubernetes.io/instance: release-name
+---
+# Source: cacheppuccino-helm/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ifrcgo-cacheppuccino
+  annotations:
+    reloader.stakater.com/auto: "true"
+  labels:
+    helm.sh/chart: cacheppuccino-helm-0.1.0
+    app.kubernetes.io/name: cacheppuccino-helm
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: cacheppuccino-helm
+      app.kubernetes.io/instance: release-name
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: cacheppuccino-helm
+        app.kubernetes.io/instance: release-name
+        azure.workload.identity/use: "true"
+    spec:
+      serviceAccountName: ifrcgo-cacheppuccino
+      containers:
+        - name: cacheppuccino
+          image: "ghcr.io/ifrcgo/cacheppuccino:SET-BY-CICD-TAG"
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          envFrom:
+            - configMapRef:
+                name: ifrcgo-cacheppuccino
+            - secretRef:
+                name: ifrcgo-cacheppuccino-vault-secret
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsGroup: 0
+            runAsUser: 0
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 2
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 2
+            failureThreshold: 6
+          resources:
+            limits:
+              cpu: 500m
+              memory: 512Mi
+            requests:
+              cpu: 100m
+              memory: 128Mi
+          volumeMounts:
+            - name: sqlite
+              mountPath: "/data"
+            - name: secrets-store
+              mountPath: "/mnt/secrets-store"
+              readOnly: true
+      volumes:
+        - name: sqlite
+          persistentVolumeClaim:
+            claimName: ifrcgo-cacheppuccino
+        - name: secrets-store
+          csi:
+            driver: secrets-store.csi.k8s.io
+            readOnly: true
+            volumeAttributes:
+              secretProviderClass: ifrcgo-cacheppuccino-secret-provider
+---
+# Source: cacheppuccino-helm/templates/ingress.yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ifrcgo-cacheppuccino
+  labels:
+    helm.sh/chart: cacheppuccino-helm-0.1.0
+    app.kubernetes.io/name: cacheppuccino-helm
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "cacheppuccino-test-prod.ifrc.org"
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: ifrcgo-cacheppuccino
+                port:
+                  number: 8080
+  tls:
+    - secretName: cacheppuccino-helm-secret-cert-test
+      hosts:
+        - "cacheppuccino-test-prod.ifrc.org"
+---
+# Source: cacheppuccino-helm/templates/secret-provider-class.yaml
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: ifrcgo-cacheppuccino-secret-provider
+  labels:
+    helm.sh/chart: cacheppuccino-helm-0.1.0
+    app.kubernetes.io/name: cacheppuccino-helm
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  provider: azure
+  parameters:
+    clientID: test_client_id
+    keyvaultName: test_key_vault_name
+    tenantId: test_tenant_id
+    usePodIdentity: "false"
+    useVMManagedIdentity: "false"
+    objects: |
+      array:
+        - |
+          objectName: TRANSLATION-API-KEY
+          objectType: secret
+  secretObjects:
+    - secretName: ifrcgo-cacheppuccino-vault-secret
+      type: Opaque
+      data:
+        - objectName: TRANSLATION-API-KEY
+          key: TRANSLATION_API_KEY

helm/tests.yaml

@@ -3,3 +3,6 @@ tests:
   staging.yaml:
     - values/go-deploy.yaml
     - values/staging.yaml
+  production.yaml:
+    - values/go-deploy.yaml
+    - values/production.yaml

helm/tests/production.yaml

@@ -0,0 +1,22 @@
+# NOTE: test data for production, using values production.yaml
+ingress:
+  host: cacheppuccino-test-prod.ifrc.org
+  className: nginx
+  tls:
+    enabled: true
+    secretName: cacheppuccino-helm-secret-cert-test
+env:
+  TRANSLATION_BASE_URL: "https://ifrc-test-translationapi.azurewebsites.net"
+  TRANSLATION_APPLICATION_ID: "18"
+
+serviceAccount:
+  annotations:
+    azure.workload.identity/client-id: "test_id"
+
+secretsStoreCsiDriver:
+  parameters:
+    clientID: "test_client_id"
+    keyvaultName: "test_key_vault_name"
+    tenantId: "test_tenant_id"
+  secretsKeyMap:
+    TRANSLATION_API_KEY: "TRANSLATION-API-KEY"

helm/values/production.yaml

@@ -0,0 +1,3 @@
+env:
+  TRANSLATION_BASE_URL: "https://ifrcpmicroservicesapim001.azure-api.net/translation"
+  TRANSLATION_APPLICATION_ID: "18"

helm/values/staging.yaml

@@ -1,3 +1,3 @@
 env:
-  TRANSLATION_BASE_URL: "https://ifrc-translationapi.azurewebsites.net"
-  TRANSLATION_APPLICATION_ID: "18"
+  TRANSLATION_BASE_URL: "https://ifrcumicroservicesapim001.azure-api.net/translation"
+  TRANSLATION_APPLICATION_ID: "12"