Irving López
397d5fbaed
- workflow: --namespace apps (antes tenant-${TENANT_ID_NODASHES}-apps)
- values.yaml networkPolicy.addonsNamespace: addons (antes con tenant-id)
ADR-054 establece namespaces funcionales en cluster tenant (RKE2 dedicado
por ADR-018). El cluster es la unidad de aislamiento; tenant-id en
namespace name es legacy del modelo multi-tenant en cluster compartido.
83 lines
3.0 KiB
YAML
83 lines
3.0 KiB
YAML
name: __APP_NAME__ — build & deploy
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'code/**'
|
|
- 'helm/**'
|
|
- '.gitea/workflows/__APP_NAME__-build.yaml'
|
|
|
|
jobs:
|
|
# Tests + build + push a Harbor — patrón ADR-038 reusable workflow.
|
|
build:
|
|
uses: coralware/IDP/.gitea/workflows/_python-microservice.yaml@main
|
|
with:
|
|
service_name: __APP_NAME__
|
|
service_dir: code
|
|
uses_metrics: false
|
|
coverage_threshold: 80 # menor que el IDP interno (90); el dev sube cuando madure
|
|
trivy_exit_code: 0 # informacional en MVP; subir a 1 antes de producción
|
|
enforce_rollback: false # rollout lo gestiona el job helm-deploy abajo
|
|
|
|
# Deploy al cluster del tenant — Helm upgrade --install con hook Alembic.
|
|
helm-deploy:
|
|
needs: build
|
|
runs-on: [self-hosted, linux/amd64]
|
|
container: alpine/helm:3.14.4
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install kubectl
|
|
run: apk add --no-cache kubectl
|
|
|
|
- name: Decodificar kubeconfig del tenant
|
|
env:
|
|
KUBECONFIG_B64: ${{ secrets.KUBECONFIG_TENANT_B64 }}
|
|
run: |
|
|
if [ -z "$KUBECONFIG_B64" ]; then
|
|
echo "ERROR: secret KUBECONFIG_TENANT_B64 no configurado en el proyecto Gitea."
|
|
echo "tenant-manager debe provisionarlo al crear el repo."
|
|
exit 1
|
|
fi
|
|
mkdir -p /root/.kube
|
|
echo "$KUBECONFIG_B64" | base64 -d > /root/.kube/config
|
|
chmod 600 /root/.kube/config
|
|
|
|
- name: Helm upgrade --install
|
|
env:
|
|
TENANT_ID: ${{ vars.TENANT_ID }}
|
|
TENANT_ID_NODASHES: ${{ vars.TENANT_ID_NODASHES }}
|
|
TENANT_TIER: ${{ vars.TENANT_TIER }}
|
|
IMAGE_TAG: ${{ needs.build.outputs.image_tag }}
|
|
# ADR-054: en cluster tenant los namespaces son funcionales (apps/addons),
|
|
# sin tenant-id en el nombre — el cluster ya es el sandbox del tenant.
|
|
run: |
|
|
helm upgrade --install __APP_NAME__ ./helm/__APP_NAME__ \
|
|
--namespace apps \
|
|
--create-namespace \
|
|
--set image.tag=${IMAGE_TAG} \
|
|
--set tenantId=${TENANT_ID} \
|
|
--set tenantIdNodashes=${TENANT_ID_NODASHES} \
|
|
--set tier=${TENANT_TIER} \
|
|
--wait --timeout 5m
|
|
|
|
- name: Verificar rollout
|
|
run: |
|
|
kubectl -n apps rollout status deploy/__APP_NAME__ --timeout=3m
|
|
|
|
- name: Smoke check post-deploy
|
|
env:
|
|
INGRESS_HOST: __APP_NAME__-${{ vars.TENANT_ID_NODASHES }}.apps.coralware.cloud
|
|
run: |
|
|
for i in $(seq 1 12); do
|
|
if wget -q -O - --timeout=10 "https://${INGRESS_HOST}/health" | grep -q '"status":"ok"'; then
|
|
echo "Smoke OK: /health responde 200 con db:up"
|
|
exit 0
|
|
fi
|
|
echo "Intento ${i}/12 — /health aún no responde, esperando 5s…"
|
|
sleep 5
|
|
done
|
|
echo "ERROR: /health no respondió 200 dentro del timeout"
|
|
exit 1
|