main to stage

.github/workflows/aks_deploy.yml

@@ -1,4 +1,4 @@
-name: AKS deployment - core-frontend-reader
+name: AKS prod
 
 on:
   push:
@@ -76,15 +76,15 @@ jobs:
 
       - name: Apply Service and HTTPRoute
         run: |
-          kubectl apply -f kube/service.yaml
-          kubectl apply -f kube/httproute.yaml
-          kubectl apply -f kube/pdb.yaml
-          kubectl apply -f kube/hpa.yaml
+          kubectl apply -f kube/prod/service.yaml
+          kubectl apply -f kube/prod/httproute.yaml
+          kubectl apply -f kube/prod/pdb.yaml
+          kubectl apply -f kube/prod/hpa.yaml
 
       - name: Deploy to AKS
         run: |
           export IMAGE="${{ steps.image.outputs.ref }}"
-          envsubst < kube/deployment.yaml | kubectl apply -f -
+          envsubst < kube/prod/deployment.yaml | kubectl apply -f -
 
       - name: Wait for rollout
         run: |

.github/workflows/aks_stage_deploy.yml

@@ -0,0 +1,91 @@
+name: AKS stage
+
+on:
+  push:
+    branches: [stage]
+  schedule:
+    - cron: '0 4 * * *'
+  workflow_dispatch:
+
+env:
+  ACR_NAME: corecontainers
+  IMAGE_NAME: core-frontend-reader
+  RESOURCE_GROUP: core-frontend
+  AKS_CLUSTER_NAME: core-frontend-kubernetes-cluster
+  NAMESPACE: core-frontend-stage
+  DEPLOYMENT_NAME: core-frontend-reader
+
+jobs:
+  build-and-deploy:
+    runs-on: ubuntu-24.04-arm
+    environment: azure
+    permissions:
+      id-token: write
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Azure Login
+        uses: azure/login@v2
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Set image reference
+        id: image
+        run: |
+          TAG=$(echo ${{ github.sha }} | cut -c1-7)
+          echo "ref=${{ env.ACR_NAME }}.azurecr.io/aks-${{ env.IMAGE_NAME }}:$TAG" >> $GITHUB_OUTPUT
+
+      - name: Docker ACR Login
+        run: az acr login --name ${{ env.ACR_NAME }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Docker build and push
+        run: |
+          docker buildx build \
+            --platform linux/arm64 \
+            --push \
+            --build-arg GA_TRACKING_CODE=${{ secrets.GA_TRACKING_CODE }} \
+            --build-arg NPM_TOKEN=${{ secrets.NPM_TOKEN }} \
+            -t ${{ steps.image.outputs.ref }} .
+
+      - name: Get AKS credentials
+        run: |
+          az aks get-credentials \
+            --resource-group ${{ env.RESOURCE_GROUP }} \
+            --name ${{ env.AKS_CLUSTER_NAME }} \
+            --admin \
+            --overwrite-existing
+
+      - name: Sync secrets to AKS
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GA_TRACKING_CODE: ${{ secrets.GA_TRACKING_CODE }}
+        run: |
+          kubectl create secret generic core-frontend-reader-secrets \
+            --namespace core-frontend-stage \
+            --from-literal=NPM_TOKEN="${{ env.NPM_TOKEN }}" \
+            --from-literal=GA_TRACKING_CODE="${{ secrets.GA_TRACKING_CODE }}" \
+            --dry-run=client -o yaml | kubectl apply -f -
+
+      - name: Apply Service and HTTPRoute
+        run: |
+          kubectl apply -f kube/stage/service.yaml
+          kubectl apply -f kube/stage/httproute.yaml
+
+      - name: Deploy to AKS
+        run: |
+          export IMAGE="${{ steps.image.outputs.ref }}"
+          envsubst < kube/stage/deployment.yaml | kubectl apply -f -
+
+      - name: Wait for rollout
+        run: |
+          kubectl rollout status deployment/${{ env.DEPLOYMENT_NAME }} \
+            --namespace ${{ env.NAMESPACE }} \
+            --timeout=300s

kube/stage/deployment.yaml

@@ -0,0 +1,59 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: core-frontend-reader
+  namespace: core-frontend-stage
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: core-frontend-reader
+  template:
+    metadata:
+      labels:
+        app: core-frontend-reader
+    spec:
+      nodeSelector:
+        agentpool: userpool
+      containers:
+        - name: reader
+          image: ${IMAGE}
+          env:
+            - name: NODE_ENV
+              value: production
+          imagePullPolicy: IfNotPresent
+          envFrom:
+            - secretRef:
+                name: core-frontend-reader-secrets
+          ports:
+            - name: http
+              containerPort: 8080
+          startupProbe:
+            httpGet:
+              path: /reader/healthz
+              port: http
+            failureThreshold: 30
+            periodSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /reader/healthz
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /reader/healthz
+              port: http
+            initialDelaySeconds: 15
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 1000m
+              memory: 1000Mi

kube/stage/httproute.yaml

@@ -0,0 +1,35 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: core-frontend-reader
+  namespace: core-frontend-stage
+spec:
+  hostnames:
+    - stg.core.ac.uk
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: public-gateway
+      namespace: gateway-system
+  rules:
+    - backendRefs:
+        - name: core-frontend-reader
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /reader
+
+    - backendRefs:
+        - name: core-frontend-reader
+          port: 80
+      filters:
+        - type: URLRewrite
+          urlRewrite:
+            path:
+              type: ReplacePrefixMatch
+              replacePrefixMatch: /
+      matches:
+        - path:
+            type: PathPrefix
+            value: /static/reader

kube/stage/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: core-frontend-reader
+  namespace: core-frontend-stage
+spec:
+  type: ClusterIP
+  selector:
+    app: core-frontend-reader
+  ports:
+    - name: http
+      port: 80
+      targetPort: http