From 87918a2d0756221cbe6dff51121d94300f90b1b0 Mon Sep 17 00:00:00 2001 From: thenav56 Date: Tue, 15 Sep 2026 16:11:43 +0545 Subject: [PATCH 1/4] chore: cleanup go-api azure-pipline this is replaced by argocd based deployment --- README.md | 2 - applications/go-api/azure-pipelines.yaml | 203 ------------------ .../helm/ifrcgo-helm/values-production.yaml | 108 ---------- .../helm/ifrcgo-helm/values-staging.yaml | 106 --------- applications/go-api/scripts/deploy-go-api.sh | 76 ------- .../terraform/resources/bastion.tf | 4 +- 6 files changed, 2 insertions(+), 497 deletions(-) delete mode 100644 applications/go-api/azure-pipelines.yaml delete mode 100644 applications/go-api/helm/ifrcgo-helm/values-production.yaml delete mode 100644 applications/go-api/helm/ifrcgo-helm/values-staging.yaml delete mode 100644 applications/go-api/scripts/deploy-go-api.sh diff --git a/README.md b/README.md index e03de17e..bb717445 100644 --- a/README.md +++ b/README.md @@ -10,8 +10,6 @@ This repository hosts the configuration files and scripts required for deploying The repository is structured as follows: - `base-infrastructure`: Contains the Terraform configuration files for deploying the Kubernetes clusters and other infrastructure components like managed databases, object storage etc on Azure. - -- `applications/go-api`: Contains the deployment scripts and Helm configurations for deploying Helm charts of IFRC GO ecosystem applications onto the Kubernetes clusters. - `applications/argocd`: Contains the definitions of kubernetes resoures for managing applications whose deployment is managed by [ArgoCD](https://argo-cd.readthedocs.io/en/stable/). diff --git a/applications/go-api/azure-pipelines.yaml b/applications/go-api/azure-pipelines.yaml deleted file mode 100644 index 3b193195..00000000 --- a/applications/go-api/azure-pipelines.yaml +++ /dev/null @@ -1,203 +0,0 @@ -trigger: -- develop -- master - -# no PR triggers -pr: none - -resources: - repositories: - - repository: go-deploy - type: github - endpoint: IFRCGo - name: IFRCGo/go-deploy - ref: ${{ variables['Build.SourceBranchName'] }} - -pool: - vmImage: ubuntu-latest - -jobs: -- job: 'Deploy_GO_API' - steps: - - checkout: go-deploy - displayName: "Checkout go-deploy" - path: go-deploy - - # Deploy go-api to staging - - script: chmod +x $(Pipeline.Workspace)/go-deploy/applications/go-api/scripts/deploy-go-api.sh - displayName: "Make deployment script executable" - - - bash: $(Pipeline.Workspace)/go-deploy/applications/go-api/scripts/deploy-go-api.sh - condition: eq(variables['Build.SourceBranch'], 'refs/heads/develop') - displayName: "Deploy staging instance of go-api" - env: - ENVIRONMENT: staging - VERSION: "0.0.2-develop.cb1380ac" - # For Azure CLI - AZURE_TENANT_ID: $(TERRAFORM_TENANT_ID) - AZURE_CLIENT_ID: $(TERRAFORM_SERVICE_PRINCIPAL_ID) - AZURE_CLIENT_SECRET: $(TERRAFORM_SERVICE_PRINCIPAL_KEY) - # Application settings - DJANGO_SECRET_KEY: $(STAGING_DJANGO_SECRET_KEY) - DJANGO_DB_NAME: $(STAGING_DJANGO_DB_NAME) - DJANGO_DB_USER: $(STAGING_DJANGO_DB_USER) - DJANGO_DB_PASS: $(STAGING_DJANGO_DB_PASS) - DJANGO_DB_HOST: $(STAGING_DJANGO_DB_HOST) - DJANGO_DB_PORT: $(STAGING_DJANGO_DB_PORT) - AZURE_STORAGE_KEY: $(STAGING_AZURE_STORAGE_KEY) - AZURE_STORAGE_ACCOUNT: $(STAGING_AZURE_STORAGE_ACCOUNT) - EMAIL_API_ENDPOINT: $(STAGING_EMAIL_API_ENDPOINT) - EMAIL_HOST: $(STAGING_EMAIL_HOST) - EMAIL_PORT: $(STAGING_EMAIL_PORT) - EMAIL_USER: $(STAGING_EMAIL_USER) - EMAIL_PASS: $(STAGING_EMAIL_PASS) - TEST_EMAILS: $(STAGING_TEST_EMAILS) - AWS_TRANSLATE_ACCESS_KEY: $(STAGING_AWS_TRANSLATE_ACCESS_KEY) - AWS_TRANSLATE_SECRET_KEY: $(STAGING_AWS_TRANSLATE_SECRET_KEY) - AWS_TRANSLATE_REGION: $(STAGING_AWS_TRANSLATE_REGION) - CELERY_REDIS_URL: $(STAGING_CELERY_REDIS_URL) - CACHE_MIDDLEWARE_SECONDS: $(STAGING_CACHE_MIDDLEWARE_SECONDS) - MOLNIX_API_BASE: $(STAGING_MOLNIX_API_BASE) - MOLNIX_USERNAME: $(STAGING_MOLNIX_USERNAME) - MOLNIX_PASSWORD: $(STAGING_MOLNIX_PASSWORD) - ERP_API_ENDPOINT: $(STAGING_ERP_API_ENDPOINT) - ERP_API_SUBSCRIPTION_KEY: $(STAGING_ERP_API_SUBSCRIPTION_KEY) - FDRS_APIKEY: $(STAGING_FDRS_APIKEY) - FDRS_CREDENTIAL: $(STAGING_FDRS_CREDENTIAL) - HPC_CREDENTIAL: $(STAGING_HPC_CREDENTIAL) - APPLICATION_INSIGHTS_INSTRUMENTATION_KEY: $(STAGING_APPLICATION_INSIGHTS_INSTRUMENTATION_KEY) - ELASTIC_SEARCH_HOST: $(STAGING_ELASTIC_SEARCH_HOST) - GO_FTPHOST: $(STAGING_GO_FTPHOST) - GO_FTPUSER: $(STAGING_GO_FTPUSER) - GO_FTPPASS: $(STAGING_GO_FTPPASS) - GO_DBPASS: $(STAGING_GO_DBPASS) - APPEALS_USER: $(STAGING_APPEALS_USER) - APPEALS_PASS: $(STAGING_APPEALS_PASS) - RESOURCES_DB_NAME: $(STAGING_RESOURCES_DB_NAME) - RESOURCES_DB_SERVER: $(STAGING_RESOURCES_DB_SERVER) - REGION: $(STAGING_REGION) - SENTRY_DSN: $(STAGING_SENTRY_DSN) - SENTRY_SAMPLE_RATE: $(STAGING_SENTRY_SAMPLE_RATE) - DJANGO_READ_ONLY: $(STAGING_DJANGO_READ_ONLY) - AUTO_TRANSLATION_TRANSLATOR: $(STAGING_AUTO_TRANSLATION_TRANSLATOR) - IFRC_TRANSLATION_DOMAIN: $(STAGING_IFRC_TRANSLATION_DOMAIN) - IFRC_TRANSLATION_HEADER_API_KEY: $(STAGING_IFRC_TRANSLATION_HEADER_API_KEY) - DEBUG_EMAIL: '' - DOCKER_HOST_IP: '' - DJANGO_DEBUG: '' - DJANGO_ADDITIONAL_ALLOWED_HOSTS: '' - # TLS cert and key should be base64 encoded - API_TLS_CRT: $(STAGING_API_TLS_CRT) - API_TLS_KEY: $(STAGING_API_TLS_KEY) - API_ADDITIONAL_DOMAIN_TLS_CRT: '' - API_ADDITIONAL_DOMAIN_TLS_KEY: '' - # ReliefWeb job - RELIEF_WEB_APP_NAME: $(STAGING_RELIEF_WEB_APP_NAME) - # PowerBI - POWERBI_WORKSPACE_ID: $(STAGING_POWERBI_WORKSPACE_ID) - POWERBI_DATASET_IDS: $(STAGING_POWERBI_DATASET_IDS) - # Country page - NS_CONTACT_USERNAME: $(STAGING_NS_CONTACT_USERNAME) - NS_CONTACT_PASSWORD: $(STAGING_NS_CONTACT_PASSWORD) - ACAPS_API_TOKEN: $(STAGING_ACAPS_API_TOKEN) - NS_DOCUMENT_API_KEY: $(STAGING_NS_DOCUMENT_API_KEY) - NS_INITIATIVES_API_KEY: $(STAGING_NS_INITIATIVES_API_KEY) - NS_INITIATIVES_API_TOKEN: $(STAGING_NS_INITIATIVES_API_TOKEN) - JWT_PRIVATE_KEY_BASE64_ENCODED: $(STAGING_JWT_PRIVATE_KEY_BASE64_ENCODED) - JWT_PUBLIC_KEY_BASE64_ENCODED: $(STAGING_JWT_PUBLIC_KEY_BASE64_ENCODED) - JWT_EXPIRE_TIMESTAMP_DAYS: $(STAGING_JWT_EXPIRE_TIMESTAMP_DAYS) - AZURE_OPENAI_DEPLOYMENT_NAME: $(STAGING_AZURE_OPENAI_DEPLOYMENT_NAME) - AZURE_OPENAI_ENDPOINT: $(STAGING_AZURE_OPENAI_ENDPOINT) - AZURE_OPENAI_API_KEY: $(STAGING_AZURE_OPENAI_API_KEY) - # OAUTH Toolkit - OIDC_ENABLE: $(STAGING_OIDC_ENABLE) - OIDC_RSA_PRIVATE_KEY_BASE64_ENCODED: $(STAGING_OIDC_RSA_PRIVATE_KEY_BASE64_ENCODED) - OIDC_RSA_PUBLIC_KEY_BASE64_ENCODED: $(STAGING_OIDC_RSA_PUBLIC_KEY_BASE64_ENCODED) - - # Deploy go-api to production - - bash: $(Pipeline.Workspace)/go-deploy/applications/go-api/scripts/deploy-go-api.sh - condition: eq(variables['Build.SourceBranch'], 'refs/heads/master') - displayName: "Deploy production instance of go-api" - env: - ENVIRONMENT: production - VERSION: "0.0.2-master.cead0a4a" - # For Azure CLI - AZURE_TENANT_ID: $(TERRAFORM_TENANT_ID) - AZURE_CLIENT_ID: $(TERRAFORM_SERVICE_PRINCIPAL_ID) - AZURE_CLIENT_SECRET: $(TERRAFORM_SERVICE_PRINCIPAL_KEY) - # Production application settings - DJANGO_SECRET_KEY: $(PRODUCTION_DJANGO_SECRET_KEY) - DJANGO_DB_NAME: $(PRODUCTION_DJANGO_DB_NAME) - DJANGO_DB_USER: $(PRODUCTION_DJANGO_DB_USER) - DJANGO_DB_PASS: $(PRODUCTION_DJANGO_DB_PASS) - DJANGO_DB_HOST: $(PRODUCTION_DJANGO_DB_HOST) - DJANGO_DB_PORT: $(PRODUCTION_DJANGO_DB_PORT) - AZURE_STORAGE_KEY: $(PRODUCTION_AZURE_STORAGE_KEY) - AZURE_STORAGE_ACCOUNT: $(PRODUCTION_AZURE_STORAGE_ACCOUNT) - EMAIL_API_ENDPOINT: $(PRODUCTION_EMAIL_API_ENDPOINT) - EMAIL_HOST: $(PRODUCTION_EMAIL_HOST) - EMAIL_PORT: $(PRODUCTION_EMAIL_PORT) - EMAIL_USER: $(PRODUCTION_EMAIL_USER) - EMAIL_PASS: $(PRODUCTION_EMAIL_PASS) - TEST_EMAILS: $(PRODUCTION_TEST_EMAILS) - AWS_TRANSLATE_ACCESS_KEY: $(PRODUCTION_AWS_TRANSLATE_ACCESS_KEY) - AWS_TRANSLATE_SECRET_KEY: $(PRODUCTION_AWS_TRANSLATE_SECRET_KEY) - AWS_TRANSLATE_REGION: $(PRODUCTION_AWS_TRANSLATE_REGION) - CELERY_REDIS_URL: $(PRODUCTION_CELERY_REDIS_URL) - CACHE_MIDDLEWARE_SECONDS: $(PRODUCTION_CACHE_MIDDLEWARE_SECONDS) - MOLNIX_API_BASE: $(PRODUCTION_MOLNIX_API_BASE) - MOLNIX_USERNAME: $(PRODUCTION_MOLNIX_USERNAME) - MOLNIX_PASSWORD: $(PRODUCTION_MOLNIX_PASSWORD) - ERP_API_ENDPOINT: $(PRODUCTION_ERP_API_ENDPOINT) - ERP_API_SUBSCRIPTION_KEY: $(PRODUCTION_ERP_API_SUBSCRIPTION_KEY) - FDRS_APIKEY: $(PRODUCTION_FDRS_APIKEY) - FDRS_CREDENTIAL: $(PRODUCTION_FDRS_CREDENTIAL) - HPC_CREDENTIAL: $(PRODUCTION_HPC_CREDENTIAL) - APPLICATION_INSIGHTS_INSTRUMENTATION_KEY: $(PRODUCTION_APPLICATION_INSIGHTS_INSTRUMENTATION_KEY) - ELASTIC_SEARCH_HOST: $(PRODUCTION_ELASTIC_SEARCH_HOST) - GO_FTPHOST: $(PRODUCTION_GO_FTPHOST) - GO_FTPUSER: $(PRODUCTION_GO_FTPUSER) - GO_FTPPASS: $(PRODUCTION_GO_FTPPASS) - GO_DBPASS: $(PRODUCTION_GO_DBPASS) - APPEALS_USER: $(PRODUCTION_APPEALS_USER) - APPEALS_PASS: $(PRODUCTION_APPEALS_PASS) - RESOURCES_DB_NAME: $(PRODUCTION_RESOURCES_DB_NAME) - RESOURCES_DB_SERVER: $(PRODUCTION_RESOURCES_DB_SERVER) - REGION: $(PRODUCTION_REGION) - SENTRY_DSN: $(PRODUCTION_SENTRY_DSN) - SENTRY_SAMPLE_RATE: $(PRODUCTION_SENTRY_SAMPLE_RATE) - DJANGO_READ_ONLY: $(PRODUCTION_DJANGO_READ_ONLY) - AUTO_TRANSLATION_TRANSLATOR: $(PRODUCTION_AUTO_TRANSLATION_TRANSLATOR) - IFRC_TRANSLATION_DOMAIN: $(PRODUCTION_IFRC_TRANSLATION_DOMAIN) - IFRC_TRANSLATION_HEADER_API_KEY: $(PRODUCTION_IFRC_TRANSLATION_HEADER_API_KEY) - DEBUG_EMAIL: '' - DOCKER_HOST_IP: '' - DJANGO_DEBUG: '' - DJANGO_ADDITIONAL_ALLOWED_HOSTS: $(PRODUCTION_ADDITIONAL_URL) - # TLS cert and key should be base64 encoded - API_TLS_CRT: $(PRODUCTION_API_TLS_CRT) - API_TLS_KEY: $(PRODUCTION_API_TLS_KEY) - API_ADDITIONAL_DOMAIN_TLS_CRT: $(PRODUCTION_API_ADDITIONAL_DOMAIN_TLS_CRT) - API_ADDITIONAL_DOMAIN_TLS_KEY: $(PRODUCTION_API_ADDITIONAL_DOMAIN_TLS_KEY) - # ReliefWeb job - RELIEF_WEB_APP_NAME: $(PRODUCTION_RELIEF_WEB_APP_NAME) - # PowerBI - POWERBI_WORKSPACE_ID: $(PRODUCTION_POWERBI_WORKSPACE_ID) - POWERBI_DATASET_IDS: $(PRODUCTION_POWERBI_DATASET_IDS) - # Country page - NS_CONTACT_USERNAME: $(PRODUCTION_NS_CONTACT_USERNAME) - NS_CONTACT_PASSWORD: $(PRODUCTION_NS_CONTACT_PASSWORD) - ACAPS_API_TOKEN: $(PRODUCTION_ACAPS_API_TOKEN) - NS_DOCUMENT_API_KEY: $(PRODUCTION_NS_DOCUMENT_API_KEY) - NS_INITIATIVES_API_KEY: $(PRODUCTION_NS_INITIATIVES_API_KEY) - NS_INITIATIVES_API_TOKEN: $(PRODUCTION_NS_INITIATIVES_API_TOKEN) - JWT_PRIVATE_KEY_BASE64_ENCODED: $(PRODUCTION_JWT_PRIVATE_KEY_BASE64_ENCODED) - JWT_PUBLIC_KEY_BASE64_ENCODED: $(PRODUCTION_JWT_PUBLIC_KEY_BASE64_ENCODED) - JWT_EXPIRE_TIMESTAMP_DAYS: $(PRODUCTION_JWT_EXPIRE_TIMESTAMP_DAYS) - AZURE_OPENAI_DEPLOYMENT_NAME: $(PRODUCTION_AZURE_OPENAI_DEPLOYMENT_NAME) - AZURE_OPENAI_ENDPOINT: $(PRODUCTION_AZURE_OPENAI_ENDPOINT) - AZURE_OPENAI_API_KEY: $(PRODUCTION_AZURE_OPENAI_API_KEY) - # OAUTH Toolkit - OIDC_ENABLE: $(PRODUCTION_OIDC_ENABLE) - OIDC_RSA_PRIVATE_KEY_BASE64_ENCODED: $(PRODUCTION_OIDC_RSA_PRIVATE_KEY_BASE64_ENCODED) - OIDC_RSA_PUBLIC_KEY_BASE64_ENCODED: $(PRODUCTION_OIDC_RSA_PUBLIC_KEY_BASE64_ENCODED) diff --git a/applications/go-api/helm/ifrcgo-helm/values-production.yaml b/applications/go-api/helm/ifrcgo-helm/values-production.yaml deleted file mode 100644 index 8ff7dba0..00000000 --- a/applications/go-api/helm/ifrcgo-helm/values-production.yaml +++ /dev/null @@ -1,108 +0,0 @@ -environment: production - -global: - security: - allowInsecureImages: true - -# NOTE: Disabled here, and enabled in the argo app ./applications/argocd/production/applications/go-api.yaml -cronjobs: [] - -env: - API_FQDN: https://goadmin.ifrc.org - AUTO_TRANSLATION_TRANSLATOR: lang.translation.IfrcTranslator - CACHE_MIDDLEWARE_SECONDS: "0" - CELERY_REDIS_URL: redis://ifrcgo-helm-redis:6379/1 - CACHE_REDIS_URL: redis://ifrcgo-helm-redis:6379/1 - DEBUG_EMAIL: "" - DJANGO_DB_NAME: postgres - DJANGO_DEBUG: "" - DOCKER_HOST_IP: "" - DJANGO_READ_ONLY: "false" - DJANGO_ADDITIONAL_ALLOWED_HOSTS: "" - ELASTIC_SEARCH_HOST: elasticsearch://ifrcgo-helm-elasticsearch:9200 - FRONTEND_URL: https://go.ifrc.org - GO_ENVIRONMENT: production - IFRC_TRANSLATION_DOMAIN: https://ifrc-translationapi.azurewebsites.net - SENTRY_DSN: https://342632f67ea942c9bde214c0bb7e91be@sentry.northeurope.cloudapp.azure.com/2 - SENTRY_SAMPLE_RATE: "0.2" - SESSION_COOKIE_DOMAIN: ".ifrc.org" - CSRF_COOKIE_DOMAIN: ".ifrc.org" - # Reference from montandon-etl/staging file - EOAPI_STAC_INTERNAL_URL: "http://montandon-eoapi-stac.montandon-eoapi.svc.cluster.local:8080/" - EOAPI_STAC_EXTERNAL_URL: "https://montandon-eoapi.ifrc.org/stac" - # XXX: Temporary values to fix rendering issue - PLAYWRIGHT_SERVER_URL: ws://ifrcgo-helm-playwright:3000/ - -api: - # NOTE: Disabled here, and enabled in the argo app ./applications/argocd/production/applications/go-api.yaml - enabled: false - tls: - enabled: false - domain: goadmin.ifrc.org - additionalDomain: "" - replicaCount: 2 - resources: - requests: - cpu: "0.2" - memory: 4Gi - limits: - cpu: "2" - memory: 4Gi - -redis: - # NOTE: Disabled here, and enabled in the argo app ./applications/argocd/production/applications/go-api.yaml - enabled: false - image: - repository: bitnamilegacy/redis - resources: - requests: - cpu: "0.2" - memory: 0.5Gi - limits: - cpu: "1" - memory: 2Gi - -playwright: - # NOTE: Disabled here, and enabled in the argo app ./applications/argocd/production/applications/go-api.yaml - enabled: false - -celery: - # NOTE: Disabled here, and enabled in the argo app ./applications/argocd/production/applications/go-api.yaml - enabled: false - replicaCount: 2 - resources: - requests: - cpu: "0.2" - memory: 0.4Gi - limits: - cpu: "2" - memory: 4Gi - -elasticsearch: - # NOTE: Disabled here, and enabled in the argo app ./applications/argocd/production/applications/go-api.yaml - enabled: false - disk: - uri: /subscriptions/39308fb0-9929-4b29-aafa-b3c78a8b0658/resourceGroups/ifrcpgo002rg/providers/Microsoft.Compute/disks/ifrcpgo-disk001 - resources: - requests: - cpu: "0.2" - memory: 4Gi - limits: - cpu: "2" - memory: 4Gi - -sshBastion: - resources: - requests: - cpu: "0.1" - memory: 0.05Gi - limits: - cpu: "1" - memory: 0.2Gi - -serviceAccount: - create: false - name: go-api-production-workload-sa - -podLabels: - azure.workload.identity/use: "true" diff --git a/applications/go-api/helm/ifrcgo-helm/values-staging.yaml b/applications/go-api/helm/ifrcgo-helm/values-staging.yaml deleted file mode 100644 index de226eeb..00000000 --- a/applications/go-api/helm/ifrcgo-helm/values-staging.yaml +++ /dev/null @@ -1,106 +0,0 @@ -environment: staging - -global: - security: - allowInsecureImages: true - -# NOTE: Disabled here, and enabled in the argo app ./applications/argocd/staging/applications/go-api.yaml -cronjobs: [] - -env: - API_FQDN: https://goadmin-stage.ifrc.org - AUTO_TRANSLATION_TRANSLATOR: lang.translation.IfrcTranslator - CACHE_MIDDLEWARE_SECONDS: "0" - CELERY_REDIS_URL: redis://ifrcgo-helm-redis:6379/0 - CACHE_REDIS_URL: redis://ifrcgo-helm-redis:6379/1 - DEBUG_EMAIL: "" - DJANGO_DB_NAME: postgres - DJANGO_DEBUG: "" - DOCKER_HOST_IP: "" - DJANGO_READ_ONLY: "false" - DJANGO_ADDITIONAL_ALLOWED_HOSTS: "" - ELASTIC_SEARCH_HOST: elasticsearch://ifrcgo-helm-elasticsearch:9200 - FRONTEND_URL: https://go-stage.ifrc.org - GO_ENVIRONMENT: staging - IFRC_TRANSLATION_DOMAIN: https://ifrc-translationapi-staging.azurewebsites.net - SENTRY_DSN: https://342632f67ea942c9bde214c0bb7e91be@sentry.northeurope.cloudapp.azure.com/2 - SENTRY_SAMPLE_RATE: "0.3" - SESSION_COOKIE_DOMAIN: ".ifrc.org" - CSRF_COOKIE_DOMAIN: ".ifrc.org" - # Reference from montandon-etl/staging file - EOAPI_STAC_INTERNAL_URL: "http://montandon-eoapi-stac.montandon-eoapi.svc.cluster.local:8080/" - EOAPI_STAC_EXTERNAL_URL: "https://montandon-eoapi-stage.ifrc.org/stac" - # XXX: Temporary values to fix rendering issue - PLAYWRIGHT_SERVER_URL: ws://ifrcgo-helm-playwright:3000/ - -api: - # NOTE: Disabled here, and enabled in the argo app ./applications/argocd/staging/applications/go-api.yaml - enabled: false - domain: goadmin-stage.ifrc.org - additionalDomain: "" - replicaCount: 1 - resources: - requests: - cpu: "0.2" - memory: 4Gi - limits: - cpu: "2" - memory: 4Gi - -redis: - # NOTE: Disabled here, and enabled in the argo app ./applications/argocd/staging/applications/go-api.yaml - enabled: false - image: - repository: bitnamilegacy/redis - resources: - requests: - cpu: "0.2" - memory: 0.5Gi - limits: - cpu: "1" - memory: 2Gi - -playwright: - # NOTE: Disabled here, and enabled in the argo app ./applications/argocd/staging/applications/go-api.yaml - enabled: false - -celery: - # NOTE: Disabled here, and enabled in the argo app ./applications/argocd/staging/applications/go-api.yaml - enabled: false - replicaCount: 1 - resources: - requests: - cpu: "0.2" - memory: 0.4Gi - limits: - cpu: "2" - memory: 4Gi - -elasticsearch: - # NOTE: Disabled here, and enabled in the argo app ./applications/argocd/staging/applications/go-api.yaml - enabled: false - disk: - uri: /subscriptions/39308fb0-9929-4b29-aafa-b3c78a8b0658/resourceGroups/ifrctgo002rg/providers/Microsoft.Compute/disks/ifrctgo-disk001 - resources: - requests: - cpu: "0.2" - memory: 4Gi - limits: - cpu: "2" - memory: 4Gi - -sshBastion: - resources: - requests: - cpu: "0.2" - memory: 0.05Gi - limits: - cpu: "1" - memory: 0.2Gi - -serviceAccount: - create: false - name: go-api-staging-workload-sa - -podLabels: - azure.workload.identity/use: "true" diff --git a/applications/go-api/scripts/deploy-go-api.sh b/applications/go-api/scripts/deploy-go-api.sh deleted file mode 100644 index 08203471..00000000 --- a/applications/go-api/scripts/deploy-go-api.sh +++ /dev/null @@ -1,76 +0,0 @@ -#!/bin/bash - -set -x -set -e - -# if environment is production, then we get the credentials for the production cluster. -# else we get the credentials for the staging cluster -az login --service-principal -u $AZURE_CLIENT_ID -p $AZURE_CLIENT_SECRET --tenant $AZURE_TENANT_ID -if [[ "${ENVIRONMENT}" == "production" ]]; then - echo "Getting credentials for production cluster..." - az aks get-credentials --resource-group ifrcpgo002rg --name ifrcpgo-cluster -else - echo "Getting credentials for staging cluster..." - az aks get-credentials --resource-group ifrctgo002rg --name ifrctgo-cluster -fi - -helm upgrade --install --wait \ - -f applications/go-api/helm/ifrcgo-helm/values-${ENVIRONMENT}.yaml \ - ifrcgo-helm \ - oci://ghcr.io/ifrcgo/go-api/ifrcgo-helm \ - --version "${VERSION}" \ - --set env.DJANGO_SECRET_KEY=${DJANGO_SECRET_KEY} \ - --set env.DJANGO_DB_USER=${DJANGO_DB_USER} \ - --set env.DJANGO_DB_PASS=${DJANGO_DB_PASS} \ - --set env.DJANGO_DB_HOST=${DJANGO_DB_HOST} \ - --set env.DJANGO_DB_PORT=${DJANGO_DB_PORT} \ - --set env.AZURE_STORAGE_ACCOUNT=${AZURE_STORAGE_ACCOUNT} \ - --set env.AZURE_STORAGE_KEY=${AZURE_STORAGE_KEY} \ - --set env.EMAIL_API_ENDPOINT=${EMAIL_API_ENDPOINT} \ - --set env.EMAIL_HOST=${EMAIL_HOST} \ - --set env.EMAIL_PORT=${EMAIL_PORT} \ - --set env.EMAIL_USER=${EMAIL_USER} \ - --set env.EMAIL_PASS=${EMAIL_PASS} \ - --set env.TEST_EMAILS=${TEST_EMAILS} \ - --set env.AWS_TRANSLATE_ACCESS_KEY=${AWS_TRANSLATE_ACCESS_KEY} \ - --set env.AWS_TRANSLATE_SECRET_KEY=${AWS_TRANSLATE_SECRET_KEY} \ - --set env.AWS_TRANSLATE_REGION=${AWS_TRANSLATE_REGION} \ - --set env.MOLNIX_API_BASE=${MOLNIX_API_BASE} \ - --set env.MOLNIX_USERNAME=${MOLNIX_USERNAME} \ - --set env.MOLNIX_PASSWORD=${MOLNIX_PASSWORD} \ - --set env.ERP_API_ENDPOINT=${ERP_API_ENDPOINT} \ - --set env.ERP_API_SUBSCRIPTION_KEY=${ERP_API_SUBSCRIPTION_KEY} \ - --set env.FDRS_APIKEY=${FDRS_APIKEY} \ - --set env.FDRS_CREDENTIAL=${FDRS_CREDENTIAL} \ - --set env.HPC_CREDENTIAL=${HPC_CREDENTIAL} \ - --set env.APPLICATION_INSIGHTS_INSTRUMENTATION_KEY=${APPLICATION_INSIGHTS_INSTRUMENTATION_KEY} \ - --set env.GO_FTPHOST=${GO_FTPHOST} \ - --set env.GO_FTPUSER=${GO_FTPUSER} \ - --set env.GO_FTPPASS=${GO_FTPPASS} \ - --set env.GO_DBPASS=${GO_DBPASS} \ - --set env.APPEALS_USER=${APPEALS_USER} \ - --set env.APPEALS_PASS=${APPEALS_PASS} \ - --set env.IFRC_TRANSLATION_DOMAIN=${IFRC_TRANSLATION_DOMAIN} \ - --set env.IFRC_TRANSLATION_HEADER_API_KEY=${IFRC_TRANSLATION_HEADER_API_KEY} \ - --set secrets.API_TLS_CRT=${API_TLS_CRT} \ - --set secrets.API_TLS_KEY=${API_TLS_KEY} \ - --set secrets.API_ADDITIONAL_DOMAIN_TLS_CRT=${API_ADDITIONAL_DOMAIN_TLS_CRT} \ - --set secrets.API_ADDITIONAL_DOMAIN_TLS_KEY=${API_ADDITIONAL_DOMAIN_TLS_KEY} \ - --set env.RELIEF_WEB_APP_NAME=${RELIEF_WEB_APP_NAME} \ - --set env.POWERBI_WORKSPACE_ID=${POWERBI_WORKSPACE_ID} \ - --set env.POWERBI_DATASET_IDS=${POWERBI_DATASET_IDS} \ - --set env.NS_CONTACT_USERNAME=${NS_CONTACT_USERNAME} \ - --set env.NS_CONTACT_PASSWORD=${NS_CONTACT_PASSWORD} \ - --set env.ACAPS_API_TOKEN=${ACAPS_API_TOKEN} \ - --set env.NS_DOCUMENT_API_KEY=${NS_DOCUMENT_API_KEY} \ - --set env.NS_INITIATIVES_API_KEY=${NS_INITIATIVES_API_KEY} \ - --set env.NS_INITIATIVES_API_TOKEN=${NS_INITIATIVES_API_TOKEN} \ - --set "env.JWT_PRIVATE_KEY_BASE64_ENCODED=${JWT_PRIVATE_KEY_BASE64_ENCODED}" \ - --set "env.JWT_PUBLIC_KEY_BASE64_ENCODED=${JWT_PUBLIC_KEY_BASE64_ENCODED}" \ - --set env.JWT_EXPIRE_TIMESTAMP_DAYS=${JWT_EXPIRE_TIMESTAMP_DAYS} \ - --set env.AZURE_OPENAI_DEPLOYMENT_NAME=${AZURE_OPENAI_DEPLOYMENT_NAME} \ - --set env.AZURE_OPENAI_ENDPOINT=${AZURE_OPENAI_ENDPOINT} \ - --set env.AZURE_OPENAI_API_KEY=${AZURE_OPENAI_API_KEY} \ - --set env.OIDC_ENABLE=${OIDC_ENABLE} \ - --set env.OIDC_RSA_PRIVATE_KEY_BASE64_ENCODED=${OIDC_RSA_PRIVATE_KEY_BASE64_ENCODED} \ - --set env.OIDC_RSA_PUBLIC_KEY_BASE64_ENCODED=${OIDC_RSA_PUBLIC_KEY_BASE64_ENCODED} diff --git a/base-infrastructure/terraform/resources/bastion.tf b/base-infrastructure/terraform/resources/bastion.tf index da981de4..1c384dc5 100644 --- a/base-infrastructure/terraform/resources/bastion.tf +++ b/base-infrastructure/terraform/resources/bastion.tf @@ -47,8 +47,8 @@ resource "helm_release" "bastion" { # Sushil "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJbRraaLnjdExOtObCgY5RmOALKYzlXAH9GAMxbm9wtX susilnem@sushil-machine", ] - # Idle jump host — kept small. Staging gets a slightly higher CPU request (matches the - # sizing the go-api chart overrides used previously); the rest comes from values.yaml. + # Idle jump host, kept small. Staging gets a slightly higher CPU request; the rest + # comes from values.yaml. resources = { requests = { cpu = var.environment == "staging" ? "0.2" : "0.1" From ac8a8441dbc567ea0be11956a299692d5ed02d7b Mon Sep 17 00:00:00 2001 From: thenav56 Date: Tue, 15 Sep 2026 16:44:57 +0545 Subject: [PATCH 2/4] chore(go-api): remove legacy ifrcgo-helm terraform release --- .../terraform/resources/helm-ifrcgo.tf | 221 +----------------- 1 file changed, 6 insertions(+), 215 deletions(-) diff --git a/base-infrastructure/terraform/resources/helm-ifrcgo.tf b/base-infrastructure/terraform/resources/helm-ifrcgo.tf index 7293d797..97be89a2 100644 --- a/base-infrastructure/terraform/resources/helm-ifrcgo.tf +++ b/base-infrastructure/terraform/resources/helm-ifrcgo.tf @@ -1,218 +1,9 @@ -resource "helm_release" "ifrcgo" { +# Drops the `ifrcgo-helm` release from Terraform's state without uninstalling it from the +# cluster's `default` namespace. +removed { + from = helm_release.ifrcgo + lifecycle { - ignore_changes = all + destroy = false } - - name = "ifrcgo-helm" - chart = "../helm/ifrcgo-helm" - wait = true - depends_on = [ - helm_release.ifrcgo-ingress-nginx, - helm_release.ifrcgo-cert-manager - ] - - # values = [ - # file("${path.root}/../helm/ifrcgo-helm/values.yaml"), - # file("${path.root}/../helm/ifrcgo-helm/values-${var.environment}.yaml"), - # ] - - # set { - # name = "env.DJANGO_SECRET_KEY" - # value = var.DJANGO_SECRET_KEY - # } - - # set { - # name = "env.DJANGO_DB_USER" - # value = var.DJANGO_DB_USER - # } - - # set { - # name = "env.DJANGO_DB_PASS" - # value = var.DJANGO_DB_PASS - # } - - # set { - # name = "env.DJANGO_DB_HOST" - # value = var.DJANGO_DB_HOST - # } - - # set { - # name = "env.DJANGO_DB_PORT" - # value = var.DJANGO_DB_PORT - # } - - # # set { - # # name = "env.AZURE_STORAGE_ACCOUNT" - # # value = azurerm_storage_account.ifrcgo.id - # # } - # # - # # set { - # # name = "env.AZURE_STORAGE_KEY" - # # value = azurerm_storage_account.ifrcgo.primary_access_key - # # } - - # set { - # name = "env.AZURE_STORAGE_ACCOUNT" - # value = var.AZURE_STORAGE_ACCOUNT - # } - - # set { - # name = "env.AZURE_STORAGE_KEY" - # value = var.AZURE_STORAGE_KEY - # } - - # set { - # name = "env.EMAIL_API_ENDPOINT" - # value = var.EMAIL_API_ENDPOINT - # } - - # set { - # name = "env.EMAIL_HOST" - # value = var.EMAIL_HOST - # } - - # set { - # name = "env.EMAIL_PORT" - # value = var.EMAIL_PORT - # } - - # set { - # name = "env.EMAIL_USER" - # value = var.EMAIL_USER - # } - - # set { - # name = "env.EMAIL_PASS" - # value = var.EMAIL_PASS - # } - - # set { - # name = "env.TEST_EMAILS" - # value = var.TEST_EMAILS - # } - - # set { - # name = "env.AWS_TRANSLATE_ACCESS_KEY" - # value = var.AWS_TRANSLATE_ACCESS_KEY - # } - - # set { - # name = "env.AWS_TRANSLATE_SECRET_KEY" - # value = var.AWS_TRANSLATE_SECRET_KEY - # } - - # set { - # name = "env.AWS_TRANSLATE_REGION" - # value = var.AWS_TRANSLATE_REGION - # } - - # set { - # name = "env.MOLNIX_API_BASE" - # value = var.MOLNIX_API_BASE - # } - - # set { - # name = "env.MOLNIX_USERNAME" - # value = var.MOLNIX_USERNAME - # } - - # set { - # name = "env.MOLNIX_PASSWORD" - # value = var.MOLNIX_PASSWORD - # } - - # set { - # name = "env.ERP_API_ENDPOINT" - # value = var.ERP_API_ENDPOINT - # } - - # set { - # name = "env.ERP_API_SUBSCRIPTION_KEY" - # value = var.ERP_API_SUBSCRIPTION_KEY - # } - - # set { - # name = "env.FDRS_APIKEY" - # value = var.FDRS_APIKEY - # } - - # set { - # name = "env.FDRS_CREDENTIAL" - # value = var.FDRS_CREDENTIAL - # } - - # set { - # name = "env.HPC_CREDENTIAL" - # value = var.HPC_CREDENTIAL - # } - - # set { - # name = "env.APPLICATION_INSIGHTS_INSTRUMENTATION_KEY" - # value = var.APPLICATION_INSIGHTS_INSTRUMENTATION_KEY - # } - - # set { - # name = "env.GO_FTPHOST" - # value = var.GO_FTPHOST - # } - - # set { - # name = "env.GO_FTPUSER" - # value = var.GO_FTPUSER - # } - - # set { - # name = "env.GO_FTPPASS" - # value = var.GO_FTPPASS - # } - - # set { - # name = "env.GO_DBPASS" - # value = var.GO_DBPASS - # } - - # set { - # name = "env.APPEALS_USER" - # value = var.APPEALS_USER - # } - - # set { - # name = "env.APPEALS_PASS" - # value = var.APPEALS_PASS - # } - - # set { - # name = "env.IFRC_TRANSLATION_HEADER_API_KEY" - # value = var.IFRC_TRANSLATION_HEADER_API_KEY - # } - - # set { - # name = "elasticsearch.disk.name" - # value = "${local.prefix}-disk" - # } - - # set { - # name = "elasticsearch.disk.uri" - # value = azurerm_managed_disk.ifrcgo.id - # } - - # set { - # name = "secrets.API_TLS_CRT" - # value = var.API_TLS_CRT - # } - - # set { - # name = "secrets.API_TLS_KEY" - # value = var.API_TLS_KEY - # } - - # set { - # name = "secrets.API_ADDITIONAL_DOMAIN_TLS_CRT" - # value = var.API_ADDITIONAL_DOMAIN_TLS_CRT - # } - - # set { - # name = "secrets.API_ADDITIONAL_DOMAIN_TLS_KEY" - # value = var.API_ADDITIONAL_DOMAIN_TLS_KEY - # } } From 653b2c9e614d43ad1ef43d6320cc5786d25428cf Mon Sep 17 00:00:00 2001 From: thenav56 Date: Wed, 16 Sep 2026 12:07:59 +0545 Subject: [PATCH 3/4] chore(go-api): remove legacy elasticsearch disk and configmap --- .../terraform/resources/aks.tf | 25 +++---------------- .../terraform/resources/disk.tf | 14 ----------- 2 files changed, 4 insertions(+), 35 deletions(-) delete mode 100644 base-infrastructure/terraform/resources/disk.tf diff --git a/base-infrastructure/terraform/resources/aks.tf b/base-infrastructure/terraform/resources/aks.tf index 42b2168e..db487179 100644 --- a/base-infrastructure/terraform/resources/aks.tf +++ b/base-infrastructure/terraform/resources/aks.tf @@ -59,30 +59,13 @@ resource "azurerm_role_assignment" "storage" { principal_id = azurerm_kubernetes_cluster.ifrcgo.identity[0].principal_id } -# create k8s configmaps and secrets - +# Kubernetes provider. No resource in this configuration uses it, and it cannot be deleted +# while an orphaned kubernetes_* resource is still in state. This block sits inside a child +# module, so its provider address cannot be implied; destroying such an orphan without it +# fails with "Provider configuration not present". provider "kubernetes" { host = azurerm_kubernetes_cluster.ifrcgo.kube_config[0].host client_certificate = base64decode(azurerm_kubernetes_cluster.ifrcgo.kube_config[0].client_certificate) client_key = base64decode(azurerm_kubernetes_cluster.ifrcgo.kube_config[0].client_key) cluster_ca_certificate = base64decode(azurerm_kubernetes_cluster.ifrcgo.kube_config[0].cluster_ca_certificate) } - -# This ConfigMap stores configurations for resources created by Terraform which -# are later referenced in the go-api Helm chart. Values from this ConfigMap -# are either directly utilized in Kubernetes resource definitions or provided -# as parameters to the Helm chart. -resource "kubernetes_config_map" "ifrcgo_terraform_managed_resources" { - metadata { - name = "ifrcgo-terraform-managed-resources" - } - - depends_on = [ - azurerm_managed_disk.ifrcgo - ] - - data = { - "elasticsearch_disk_name" = "${local.prefix}-disk" - "elasticsearch_disk_uri" = azurerm_managed_disk.ifrcgo.id - } -} diff --git a/base-infrastructure/terraform/resources/disk.tf b/base-infrastructure/terraform/resources/disk.tf deleted file mode 100644 index cad5ba04..00000000 --- a/base-infrastructure/terraform/resources/disk.tf +++ /dev/null @@ -1,14 +0,0 @@ -resource "azurerm_managed_disk" "ifrcgo" { - name = "${local.prefix}-disk001" - resource_group_name = data.azurerm_resource_group.ifrcgo.name - location = data.azurerm_resource_group.ifrcgo.location - storage_account_type = "StandardSSD_LRS" - create_option = "Empty" - disk_size_gb = "20" -} - -resource "azurerm_role_assignment" "disk" { - scope = azurerm_managed_disk.ifrcgo.id - role_definition_name = "Contributor" - principal_id = azurerm_kubernetes_cluster.ifrcgo.identity[0].principal_id -} From 40ab28b5dbe32116130255920a81a5a84cab7589 Mon Sep 17 00:00:00 2001 From: thenav56 Date: Wed, 16 Sep 2026 20:21:28 +0545 Subject: [PATCH 4/4] ci(base-infrastructure): plan production on PRs targeting master Production applies ran unreviewed: plan-infra.sh was wired only to PRs targeting develop. --- base-infrastructure/azure-pipelines.yml | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/base-infrastructure/azure-pipelines.yml b/base-infrastructure/azure-pipelines.yml index 7431fc66..9e8075dc 100644 --- a/base-infrastructure/azure-pipelines.yml +++ b/base-infrastructure/azure-pipelines.yml @@ -2,7 +2,6 @@ trigger: - master - develop -# no PR triggers pr: drafts: "false" @@ -42,7 +41,6 @@ jobs: - script: chmod +x $(Pipeline.Workspace)/go-deploy/base-infrastructure/scripts/apply-infra.sh displayName: "Make apply-infra executable" - # TODO: add plan-infra for main branch (when PR created from develop) - bash: $(Pipeline.Workspace)/go-deploy/base-infrastructure/scripts/plan-infra.sh condition: and(eq(variables['Build.Reason'], 'PullRequest'), eq(variables['System.PullRequest.targetBranchName'], 'develop')) displayName: "Plan Staging Infrastructure" @@ -90,6 +88,29 @@ jobs: AZURE_CLIENT_SECRET: $(TERRAFORM_SERVICE_PRINCIPAL_KEY) # Deploy Terraform managed infrastructure to production + - bash: $(Pipeline.Workspace)/go-deploy/base-infrastructure/scripts/plan-infra.sh + condition: and(eq(variables['Build.Reason'], 'PullRequest'), eq(variables['System.PullRequest.targetBranchName'], 'master')) + displayName: "Plan Production Infrastructure" + env: + TF_VAR_environment: production + TF_VAR_subscriptionId: $(TERRAFORM_SUBSCRIPTION_ID) + # DB resources + TF_VAR_RESOURCES_DB_SERVER: $(PRODUCTION_RESOURCES_DB_SERVER) + TF_VAR_RESOURCES_DB_NAME: $(PRODUCTION_RESOURCES_DB_NAME) + TF_VAR_REGION: $(PRODUCTION_REGION) + + # For azurerm backend + ARM_SUBSCRIPTION_ID: $(TERRAFORM_SUBSCRIPTION_ID) + ARM_TENANT_ID: $(TERRAFORM_TENANT_ID) + ARM_CLIENT_ID: $(TERRAFORM_SERVICE_PRINCIPAL_ID) + ARM_CLIENT_SECRET: $(TERRAFORM_SERVICE_PRINCIPAL_KEY) + ARM_ACCESS_KEY: $(TERRAFORM_STORAGE_KEY) + + # For Azure CLI + AZURE_TENANT_ID: $(TERRAFORM_TENANT_ID) + AZURE_CLIENT_ID: $(TERRAFORM_SERVICE_PRINCIPAL_ID) + AZURE_CLIENT_SECRET: $(TERRAFORM_SERVICE_PRINCIPAL_KEY) + - bash: $(Pipeline.Workspace)/go-deploy/base-infrastructure/scripts/apply-infra.sh condition: and(eq(variables['Build.Reason'], 'IndividualCI'), eq(variables['Build.SourceBranch'], 'refs/heads/master')) displayName: "Deploy Production Infrastructure"