From 046a8dd0823ec3c486aeba2dac5b98f8c6dd4513 Mon Sep 17 00:00:00 2001 From: Sushil Tiwari Date: Tue, 15 Sep 2026 15:28:24 +0545 Subject: [PATCH 01/14] go-api(staging): active dref ops issue and appeal changes --- applications/argocd/staging/applications/go-api.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/applications/argocd/staging/applications/go-api.yaml b/applications/argocd/staging/applications/go-api.yaml index 92feb550..1301f03c 100644 --- a/applications/argocd/staging/applications/go-api.yaml +++ b/applications/argocd/staging/applications/go-api.yaml @@ -10,7 +10,7 @@ spec: source: repoURL: ghcr.io/ifrcgo chart: ifrcgo-helm - targetRevision: 0.0.2-develop.c1b74d9c + targetRevision: 0.0.2-develop.c054f0b4 helm: valueFiles: - values/traefik.yaml From 67c4799e4343af493f0a2d555b62e41202bfb443 Mon Sep 17 00:00:00 2001 From: Sushil Tiwari Date: Tue, 15 Sep 2026 15:37:35 +0545 Subject: [PATCH 02/14] risk-module(staging): disable heal check disk usage max --- applications/argocd/staging/applications/risk-module.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/applications/argocd/staging/applications/risk-module.yaml b/applications/argocd/staging/applications/risk-module.yaml index 134b63dc..f3fb7712 100644 --- a/applications/argocd/staging/applications/risk-module.yaml +++ b/applications/argocd/staging/applications/risk-module.yaml @@ -34,6 +34,7 @@ spec: AZURE_STORAGE_CONTAINER: "risk-module-staging-storage-container" AZURE_STORAGE_ACCOUNT_NAME: "riskmodulestaging4254" AZURE_STORAGE_MANAGED_IDENTITY: "true" + HEALTH_CHECK_DISK_USAGE_MAX: None serviceAccount: annotations: azure.workload.identity/client-id: "1a891bd5-87e2-4489-8050-84f26c3f99ce" From 972c7ee4e670a8d4d24ceb656c2eef1303af28ff Mon Sep 17 00:00:00 2001 From: Sushil Tiwari Date: Tue, 15 Sep 2026 16:55:55 +0545 Subject: [PATCH 03/14] prod(go-api): dref ops update issue and appeal changes --- applications/argocd/production/applications/go-api.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/applications/argocd/production/applications/go-api.yaml b/applications/argocd/production/applications/go-api.yaml index ce6619d4..476fcf76 100644 --- a/applications/argocd/production/applications/go-api.yaml +++ b/applications/argocd/production/applications/go-api.yaml @@ -11,7 +11,7 @@ spec: repoURL: ghcr.io/ifrcgo chart: ifrcgo-helm # TODO: do we need to switch to a master-build chart tag - targetRevision: 0.0.2-develop.c676a57d + targetRevision: 0.0.2-develop.c054f0b4 helm: valueFiles: - values/traefik.yaml From ccd7c826e3feb03e8e07b614945b570ecf0588a3 Mon Sep 17 00:00:00 2001 From: Felix Date: Tue, 15 Sep 2026 19:45:34 +0200 Subject: [PATCH 04/14] fix(eoapi): drop array fields from queryables indexFields (#237) --- .../production/applications/montandon-eoapi/application.yaml | 2 +- .../staging/applications/montandon-eoapi/application.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/applications/argocd/production/applications/montandon-eoapi/application.yaml b/applications/argocd/production/applications/montandon-eoapi/application.yaml index 8ad4519b..a8ce42d3 100644 --- a/applications/argocd/production/applications/montandon-eoapi/application.yaml +++ b/applications/argocd/production/applications/montandon-eoapi/application.yaml @@ -118,7 +118,7 @@ spec: context: "off" queryables: - name: "stac_queryables.json" - indexFields: ["monty:hazard_codes","monty:country_codes","monty:corr_id","roles"] + indexFields: ["monty:corr_id"] deleteMissing: true configMapRef: name: montandon-eoapi-stac-queryables diff --git a/applications/argocd/staging/applications/montandon-eoapi/application.yaml b/applications/argocd/staging/applications/montandon-eoapi/application.yaml index f2183c0f..82b58b28 100644 --- a/applications/argocd/staging/applications/montandon-eoapi/application.yaml +++ b/applications/argocd/staging/applications/montandon-eoapi/application.yaml @@ -115,7 +115,7 @@ spec: context: "off" queryables: - name: "stac_queryables.json" - indexFields: ["monty:hazard_codes","monty:country_codes","monty:corr_id","roles"] + indexFields: ["monty:corr_id"] deleteMissing: true configMapRef: name: montandon-eoapi-stac-queryables From bed44e15348919a066249dc559c7669afa603530 Mon Sep 17 00:00:00 2001 From: Felix Date: Tue, 15 Sep 2026 19:51:45 +0200 Subject: [PATCH 05/14] chore(deps): upgraded production eoapi to 0.16.2. (#234) --- .../montandon-eoapi/application.yaml | 147 +++++++++--------- 1 file changed, 71 insertions(+), 76 deletions(-) diff --git a/applications/argocd/production/applications/montandon-eoapi/application.yaml b/applications/argocd/production/applications/montandon-eoapi/application.yaml index a8ce42d3..b99aca29 100644 --- a/applications/argocd/production/applications/montandon-eoapi/application.yaml +++ b/applications/argocd/production/applications/montandon-eoapi/application.yaml @@ -11,7 +11,7 @@ spec: - repoURL: https://devseed.com/eoapi-k8s/ chart: eoapi - targetRevision: 0.11.2 + targetRevision: 0.16.2 helm: valueFiles: - values/argocd.yaml @@ -51,8 +51,6 @@ spec: port: "DB_PORT" stac: - image: - tag: 6.1.2 overrideRootPath: "" # External Azure PG + HPA: keep concurrency/pools capped. # Ceiling: maxReplicas × WEB_CONCURRENCY × pools(2 w/ transactions) × DB_MAX_CONN_SIZE @@ -93,7 +91,6 @@ spec: CORS_HEADERS: "Accept, Authorization, Content-Type, Origin, X-Requested-With" CORS_METHODS: "GET,OPTIONS,POST" CORS_CREDENTIALS: "true" - STAC_FASTAPI_VERSION: "6.1.2" STAC_FASTAPI_TITLE: "Montandon STAC API" STAC_FASTAPI_DESCRIPTION: "Welcome to the [Montandon](https://ifrcgo.org/monty-stac-extension/) STAC API. This API provides the main entry to access the Global Crisis Data Bank, a database that brings in hazard and impact data for current, historical and forecasted disasters around the globe" STAC_FASTAPI_LANDING_ID: "montandon-eoapi" @@ -124,6 +121,76 @@ spec: name: montandon-eoapi-stac-queryables key: stac_queryables.json + stac-auth-proxy: + enabled: true + startupProbe: + httpGet: + path: /stac/healthz + livenessProbe: + httpGet: + path: /stac/healthz + readinessProbe: + httpGet: + path: /stac/healthz + env: + UPSTREAM_URL: "http://montandon-eoapi-stac:8080" + # UPSTREAM_URL: "https://montandon-eoapi.ifrc.org/stac" + UPSTREAM_TIMEOUT: "30" + OIDC_DISCOVERY_URL: "https://goadmin.ifrc.org/o/.well-known/openid-configuration" + OIDC_DISCOVERY_INTERNAL_URL: "https://goadmin.ifrc.org/o/.well-known/openid-configuration" + OVERRIDE_HOST: "0" + ROOT_PATH: "/stac" + DEFAULT_PUBLIC: "false" + COLLECTIONS_FILTER_CLS: stac_auth_proxy.montandon_filters:CollectionsFilter + ITEMS_FILTER_CLS: stac_auth_proxy.montandon_filters:ItemsFilter + # External-token revocation (go-api issue #2794), injected via montandon_revocation.py. + GOAPI_TOKEN_VERIFY_TTL: "300" + # Short TTL for a fail-open allow served during a go-api outage, so revocation + # resumes within seconds of recovery instead of being masked for a full TTL. + GOAPI_TOKEN_VERIFY_OUTAGE_TTL: "30" + # TTL for a definitive deny (go-api reported the jti inactive/unknown): 24h, so a + # known-revoked token is not re-checked against go-api on every request. + GOAPI_TOKEN_VERIFY_DENY_TTL: "86400" + # Upper bound on cached jti decisions (memory guard on a long-lived pod). + GOAPI_TOKEN_VERIFY_CACHE_MAX: "50000" + GOAPI_TOKEN_VERIFY_TIMEOUT: "3" + GOAPI_TOKEN_VERIFY_FAIL_OPEN: "true" + GOAPI_TOKEN_STATIC_BLACKLIST: "fec23689-bf00-401e-9f9c-a65684f44b5f" # NOTE: Token ID used in hackathon + ingress: + # The eoapi-k8s chart default is `false` (main eoapi ingress handles routing); + # montandon disables the main ingress and routes through stac-auth-proxy directly. + enabled: true + host: "montandon-eoapi.ifrc.org" + className: "traefik" + tls: + enabled: true + secretName: "montandon-eoapi-helm-secret-cert" + autoscaling: + enabled: true + minReplicas: 1 + maxReplicas: 3 + targetCPUUtilizationPercentage: 75 + resources: + limits: + cpu: 500m + memory: "2048Mi" + requests: + cpu: 200m + memory: "1024Mi" + extraVolumes: + - name: custom-modules + configMap: + name: stac-auth-proxy-modules + extraVolumeMounts: + - name: custom-modules + mountPath: /app/src/stac_auth_proxy/montandon_filters.py + subPath: montandon_filters.py + readOnly: true + - name: custom-modules + mountPath: /app/src/stac_auth_proxy/montandon_revocation.py + subPath: montandon_revocation.py + readOnly: true + - path: applications/argocd/production/applications/montandon-eoapi/internal/ targetRevision: develop repoURL: https://github.com/IFRCGo/go-deploy.git @@ -135,78 +202,6 @@ spec: enabled: true keyvaultName: montandon-eoapi-producti - - repoURL: https://github.com/developmentseed/stac-auth-proxy.git - targetRevision: v1.2.0 - path: helm/ - helm: - valuesObject: - image: - tag: "v1.2.0" - # HealthCheck endpoints - https://github.com/developmentseed/stac-auth-proxy/pull/143 - startupProbe: - httpGet: - path: /stac/healthz - livenessProbe: - httpGet: - path: /stac/healthz - readinessProbe: - httpGet: - path: /stac/healthz - env: - UPSTREAM_URL: "http://montandon-eoapi-stac:8080" - # UPSTREAM_URL: "https://montandon-eoapi.ifrc.org/stac" - OIDC_DISCOVERY_URL: "https://goadmin.ifrc.org/o/.well-known/openid-configuration" - OIDC_DISCOVERY_INTERNAL_URL: "https://goadmin.ifrc.org/o/.well-known/openid-configuration" - OVERRIDE_HOST: "0" - ROOT_PATH: "/stac" - COLLECTIONS_FILTER_CLS: stac_auth_proxy.montandon_filters:CollectionsFilter - ITEMS_FILTER_CLS: stac_auth_proxy.montandon_filters:ItemsFilter - # External-token revocation (go-api issue #2794), injected via montandon_revocation.py. - GOAPI_TOKEN_VERIFY_TTL: "300" - # Short TTL for a fail-open allow served during a go-api outage, so revocation - # resumes within seconds of recovery instead of being masked for a full TTL. - GOAPI_TOKEN_VERIFY_OUTAGE_TTL: "30" - # TTL for a definitive deny (go-api reported the jti inactive/unknown): 24h, so a - # known-revoked token is not re-checked against go-api on every request. - GOAPI_TOKEN_VERIFY_DENY_TTL: "86400" - # Upper bound on cached jti decisions (memory guard on a long-lived pod). - GOAPI_TOKEN_VERIFY_CACHE_MAX: "50000" - GOAPI_TOKEN_VERIFY_TIMEOUT: "3" - GOAPI_TOKEN_VERIFY_FAIL_OPEN: "true" - UPSTREAM_TIMEOUT: "30" - GOAPI_TOKEN_STATIC_BLACKLIST: "fec23689-bf00-401e-9f9c-a65684f44b5f" # NOTE: Token ID used in hackathon - ingress: - enabled: true - host: "montandon-eoapi.ifrc.org" - className: "traefik" - tls: - enabled: true - secretName: "montandon-eoapi-helm-secret-cert" - autoscaling: - enabled: true - minReplicas: 1 - maxReplicas: 3 - targetCPUUtilizationPercentage: 75 - resources: - limits: - cpu: 500m - memory: "2048Mi" - requests: - cpu: 200m - memory: "1024Mi" - extraVolumes: - - name: custom-modules - configMap: - name: stac-auth-proxy-modules - extraVolumeMounts: - - name: custom-modules - mountPath: /app/src/stac_auth_proxy/montandon_filters.py - subPath: montandon_filters.py - readOnly: true - - name: custom-modules - mountPath: /app/src/stac_auth_proxy/montandon_revocation.py - subPath: montandon_revocation.py - readOnly: true destination: server: https://kubernetes.default.svc namespace: montandon-eoapi From 91f05b01bf27368ab29ffcf5a8d76fef56f3db9f Mon Sep 17 00:00:00 2001 From: thenav56 Date: Wed, 16 Sep 2026 10:59:02 +0545 Subject: [PATCH 06/14] feat(montandon-eoapi/production): add processing:version to stac_queryables change from #224 --- .../montandon-eoapi/internal/files/stac_queryables.json | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/applications/argocd/production/applications/montandon-eoapi/internal/files/stac_queryables.json b/applications/argocd/production/applications/montandon-eoapi/internal/files/stac_queryables.json index 625a5d81..6de6cedc 100644 --- a/applications/argocd/production/applications/montandon-eoapi/internal/files/stac_queryables.json +++ b/applications/argocd/production/applications/montandon-eoapi/internal/files/stac_queryables.json @@ -38,6 +38,11 @@ "description": "The unique identifier assigned by the Monty system to the reference event", "type": "string" }, + "processing:version": { + "description": "The version of the pystac-monty transformer that generated the item, from the processing: extension", + "type": "string", + "pattern": "^\\d+\\.\\d+\\.\\d+$" + }, "monty:hazard_codes": { "description": "The hazard codes of the hazards affecting the event", "type": "array", From 492b35f009e99aa614959a53860c767a2c5a2b5a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Szab=C3=B3=2C=20Zolt=C3=A1n?= Date: Wed, 16 Sep 2026 09:33:08 +0200 Subject: [PATCH 07/14] Appeal ingestor fix --- applications/argocd/staging/applications/go-api.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/applications/argocd/staging/applications/go-api.yaml b/applications/argocd/staging/applications/go-api.yaml index 1301f03c..0642ff41 100644 --- a/applications/argocd/staging/applications/go-api.yaml +++ b/applications/argocd/staging/applications/go-api.yaml @@ -10,7 +10,7 @@ spec: source: repoURL: ghcr.io/ifrcgo chart: ifrcgo-helm - targetRevision: 0.0.2-develop.c054f0b4 + targetRevision: 0.0.2-develop.cbfeec05 helm: valueFiles: - values/traefik.yaml From 297bd5d5341e5e78bb2899bf846cd1389fa9e388 Mon Sep 17 00:00:00 2001 From: thenav56 Date: Wed, 16 Sep 2026 14:54:24 +0545 Subject: [PATCH 08/14] feat(alert-hub/staging,risk-module/staging): disable disk usages check --- applications/argocd/staging/applications/alert-hub-backend.yaml | 2 +- applications/argocd/staging/applications/risk-module.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/applications/argocd/staging/applications/alert-hub-backend.yaml b/applications/argocd/staging/applications/alert-hub-backend.yaml index 03f6f990..8f078465 100644 --- a/applications/argocd/staging/applications/alert-hub-backend.yaml +++ b/applications/argocd/staging/applications/alert-hub-backend.yaml @@ -10,7 +10,7 @@ spec: source: repoURL: ghcr.io/ifrcgo chart: ifrcgo-alert-hub-helm - targetRevision: 0.1.1-develop.cba3edc6 + targetRevision: 0.1.1-develop.cd68d46e helm: valueFiles: - values/traefik.yaml diff --git a/applications/argocd/staging/applications/risk-module.yaml b/applications/argocd/staging/applications/risk-module.yaml index f3fb7712..440bebb4 100644 --- a/applications/argocd/staging/applications/risk-module.yaml +++ b/applications/argocd/staging/applications/risk-module.yaml @@ -10,7 +10,7 @@ spec: source: repoURL: ghcr.io/ifrcgo chart: ifrcgo-risk-module-helm - targetRevision: 0.0.1-develop.c9cc4e94 + targetRevision: 0.0.1-develop.c9561fd1 helm: valueFiles: - values/traefik.yaml From 913ca36c6c9e7165792a2b31e66886a06a438ef8 Mon Sep 17 00:00:00 2001 From: thenav56 Date: Wed, 16 Sep 2026 15:08:30 +0545 Subject: [PATCH 09/14] feat(alert-hub/production,risk-module/production): disable disk usages check --- .../argocd/production/applications/alert-hub-backend.yaml | 2 +- applications/argocd/production/applications/risk-module.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/applications/argocd/production/applications/alert-hub-backend.yaml b/applications/argocd/production/applications/alert-hub-backend.yaml index ba537166..fdfd0f8a 100644 --- a/applications/argocd/production/applications/alert-hub-backend.yaml +++ b/applications/argocd/production/applications/alert-hub-backend.yaml @@ -10,7 +10,7 @@ spec: source: repoURL: ghcr.io/ifrcgo chart: ifrcgo-alert-hub-helm - targetRevision: 0.1.1-develop.cba3edc6 + targetRevision: 0.1.1-develop.cd68d46e helm: valueFiles: - values/traefik.yaml diff --git a/applications/argocd/production/applications/risk-module.yaml b/applications/argocd/production/applications/risk-module.yaml index ffd22691..e70f3e6e 100644 --- a/applications/argocd/production/applications/risk-module.yaml +++ b/applications/argocd/production/applications/risk-module.yaml @@ -10,7 +10,7 @@ spec: source: repoURL: ghcr.io/ifrcgo chart: ifrcgo-risk-module-helm - targetRevision: 0.0.1-develop.c9cc4e94 + targetRevision: 0.0.1-develop.c9561fd1 helm: valueFiles: - values/traefik.yaml From 093e90cb30e15857c5b721d91d3dc82bce71b860 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Szab=C3=B3=2C=20Zolt=C3=A1n?= Date: Wed, 16 Sep 2026 15:21:17 +0200 Subject: [PATCH 10/14] PER dashboard fix --- applications/argocd/staging/applications/go-api.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/applications/argocd/staging/applications/go-api.yaml b/applications/argocd/staging/applications/go-api.yaml index 0642ff41..56d2904b 100644 --- a/applications/argocd/staging/applications/go-api.yaml +++ b/applications/argocd/staging/applications/go-api.yaml @@ -10,7 +10,7 @@ spec: source: repoURL: ghcr.io/ifrcgo chart: ifrcgo-helm - targetRevision: 0.0.2-develop.cbfeec05 + targetRevision: 0.0.2-develop.c57b926b helm: valueFiles: - values/traefik.yaml From 87918a2d0756221cbe6dff51121d94300f90b1b0 Mon Sep 17 00:00:00 2001 From: thenav56 Date: Tue, 15 Sep 2026 16:11:43 +0545 Subject: [PATCH 11/14] chore: cleanup go-api azure-pipline this is replaced by argocd based deployment --- README.md | 2 - applications/go-api/azure-pipelines.yaml | 203 ------------------ .../helm/ifrcgo-helm/values-production.yaml | 108 ---------- .../helm/ifrcgo-helm/values-staging.yaml | 106 --------- applications/go-api/scripts/deploy-go-api.sh | 76 ------- .../terraform/resources/bastion.tf | 4 +- 6 files changed, 2 insertions(+), 497 deletions(-) delete mode 100644 applications/go-api/azure-pipelines.yaml delete mode 100644 applications/go-api/helm/ifrcgo-helm/values-production.yaml delete mode 100644 applications/go-api/helm/ifrcgo-helm/values-staging.yaml delete mode 100644 applications/go-api/scripts/deploy-go-api.sh diff --git a/README.md b/README.md index e03de17e..bb717445 100644 --- a/README.md +++ b/README.md @@ -10,8 +10,6 @@ This repository hosts the configuration files and scripts required for deploying The repository is structured as follows: - `base-infrastructure`: Contains the Terraform configuration files for deploying the Kubernetes clusters and other infrastructure components like managed databases, object storage etc on Azure. - -- `applications/go-api`: Contains the deployment scripts and Helm configurations for deploying Helm charts of IFRC GO ecosystem applications onto the Kubernetes clusters. - `applications/argocd`: Contains the definitions of kubernetes resoures for managing applications whose deployment is managed by [ArgoCD](https://argo-cd.readthedocs.io/en/stable/). diff --git a/applications/go-api/azure-pipelines.yaml b/applications/go-api/azure-pipelines.yaml deleted file mode 100644 index 3b193195..00000000 --- a/applications/go-api/azure-pipelines.yaml +++ /dev/null @@ -1,203 +0,0 @@ -trigger: -- develop -- master - -# no PR triggers -pr: none - -resources: - repositories: - - repository: go-deploy - type: github - endpoint: IFRCGo - name: IFRCGo/go-deploy - ref: ${{ variables['Build.SourceBranchName'] }} - -pool: - vmImage: ubuntu-latest - -jobs: -- job: 'Deploy_GO_API' - steps: - - checkout: go-deploy - displayName: "Checkout go-deploy" - path: go-deploy - - # Deploy go-api to staging - - script: chmod +x $(Pipeline.Workspace)/go-deploy/applications/go-api/scripts/deploy-go-api.sh - displayName: "Make deployment script executable" - - - bash: $(Pipeline.Workspace)/go-deploy/applications/go-api/scripts/deploy-go-api.sh - condition: eq(variables['Build.SourceBranch'], 'refs/heads/develop') - displayName: "Deploy staging instance of go-api" - env: - ENVIRONMENT: staging - VERSION: "0.0.2-develop.cb1380ac" - # For Azure CLI - AZURE_TENANT_ID: $(TERRAFORM_TENANT_ID) - AZURE_CLIENT_ID: $(TERRAFORM_SERVICE_PRINCIPAL_ID) - AZURE_CLIENT_SECRET: $(TERRAFORM_SERVICE_PRINCIPAL_KEY) - # Application settings - DJANGO_SECRET_KEY: $(STAGING_DJANGO_SECRET_KEY) - DJANGO_DB_NAME: $(STAGING_DJANGO_DB_NAME) - DJANGO_DB_USER: $(STAGING_DJANGO_DB_USER) - DJANGO_DB_PASS: $(STAGING_DJANGO_DB_PASS) - DJANGO_DB_HOST: $(STAGING_DJANGO_DB_HOST) - DJANGO_DB_PORT: $(STAGING_DJANGO_DB_PORT) - AZURE_STORAGE_KEY: $(STAGING_AZURE_STORAGE_KEY) - AZURE_STORAGE_ACCOUNT: $(STAGING_AZURE_STORAGE_ACCOUNT) - EMAIL_API_ENDPOINT: $(STAGING_EMAIL_API_ENDPOINT) - EMAIL_HOST: $(STAGING_EMAIL_HOST) - EMAIL_PORT: $(STAGING_EMAIL_PORT) - EMAIL_USER: $(STAGING_EMAIL_USER) - EMAIL_PASS: $(STAGING_EMAIL_PASS) - TEST_EMAILS: $(STAGING_TEST_EMAILS) - AWS_TRANSLATE_ACCESS_KEY: $(STAGING_AWS_TRANSLATE_ACCESS_KEY) - AWS_TRANSLATE_SECRET_KEY: $(STAGING_AWS_TRANSLATE_SECRET_KEY) - AWS_TRANSLATE_REGION: $(STAGING_AWS_TRANSLATE_REGION) - CELERY_REDIS_URL: $(STAGING_CELERY_REDIS_URL) - CACHE_MIDDLEWARE_SECONDS: $(STAGING_CACHE_MIDDLEWARE_SECONDS) - MOLNIX_API_BASE: $(STAGING_MOLNIX_API_BASE) - MOLNIX_USERNAME: $(STAGING_MOLNIX_USERNAME) - MOLNIX_PASSWORD: $(STAGING_MOLNIX_PASSWORD) - ERP_API_ENDPOINT: $(STAGING_ERP_API_ENDPOINT) - ERP_API_SUBSCRIPTION_KEY: $(STAGING_ERP_API_SUBSCRIPTION_KEY) - FDRS_APIKEY: $(STAGING_FDRS_APIKEY) - FDRS_CREDENTIAL: $(STAGING_FDRS_CREDENTIAL) - HPC_CREDENTIAL: $(STAGING_HPC_CREDENTIAL) - APPLICATION_INSIGHTS_INSTRUMENTATION_KEY: $(STAGING_APPLICATION_INSIGHTS_INSTRUMENTATION_KEY) - ELASTIC_SEARCH_HOST: $(STAGING_ELASTIC_SEARCH_HOST) - GO_FTPHOST: $(STAGING_GO_FTPHOST) - GO_FTPUSER: $(STAGING_GO_FTPUSER) - GO_FTPPASS: $(STAGING_GO_FTPPASS) - GO_DBPASS: $(STAGING_GO_DBPASS) - APPEALS_USER: $(STAGING_APPEALS_USER) - APPEALS_PASS: $(STAGING_APPEALS_PASS) - RESOURCES_DB_NAME: $(STAGING_RESOURCES_DB_NAME) - RESOURCES_DB_SERVER: $(STAGING_RESOURCES_DB_SERVER) - REGION: $(STAGING_REGION) - SENTRY_DSN: $(STAGING_SENTRY_DSN) - SENTRY_SAMPLE_RATE: $(STAGING_SENTRY_SAMPLE_RATE) - DJANGO_READ_ONLY: $(STAGING_DJANGO_READ_ONLY) - AUTO_TRANSLATION_TRANSLATOR: $(STAGING_AUTO_TRANSLATION_TRANSLATOR) - IFRC_TRANSLATION_DOMAIN: $(STAGING_IFRC_TRANSLATION_DOMAIN) - IFRC_TRANSLATION_HEADER_API_KEY: $(STAGING_IFRC_TRANSLATION_HEADER_API_KEY) - DEBUG_EMAIL: '' - DOCKER_HOST_IP: '' - DJANGO_DEBUG: '' - DJANGO_ADDITIONAL_ALLOWED_HOSTS: '' - # TLS cert and key should be base64 encoded - API_TLS_CRT: $(STAGING_API_TLS_CRT) - API_TLS_KEY: $(STAGING_API_TLS_KEY) - API_ADDITIONAL_DOMAIN_TLS_CRT: '' - API_ADDITIONAL_DOMAIN_TLS_KEY: '' - # ReliefWeb job - RELIEF_WEB_APP_NAME: $(STAGING_RELIEF_WEB_APP_NAME) - # PowerBI - POWERBI_WORKSPACE_ID: $(STAGING_POWERBI_WORKSPACE_ID) - POWERBI_DATASET_IDS: $(STAGING_POWERBI_DATASET_IDS) - # Country page - NS_CONTACT_USERNAME: $(STAGING_NS_CONTACT_USERNAME) - NS_CONTACT_PASSWORD: $(STAGING_NS_CONTACT_PASSWORD) - ACAPS_API_TOKEN: $(STAGING_ACAPS_API_TOKEN) - NS_DOCUMENT_API_KEY: $(STAGING_NS_DOCUMENT_API_KEY) - NS_INITIATIVES_API_KEY: $(STAGING_NS_INITIATIVES_API_KEY) - NS_INITIATIVES_API_TOKEN: $(STAGING_NS_INITIATIVES_API_TOKEN) - JWT_PRIVATE_KEY_BASE64_ENCODED: $(STAGING_JWT_PRIVATE_KEY_BASE64_ENCODED) - JWT_PUBLIC_KEY_BASE64_ENCODED: $(STAGING_JWT_PUBLIC_KEY_BASE64_ENCODED) - JWT_EXPIRE_TIMESTAMP_DAYS: $(STAGING_JWT_EXPIRE_TIMESTAMP_DAYS) - AZURE_OPENAI_DEPLOYMENT_NAME: $(STAGING_AZURE_OPENAI_DEPLOYMENT_NAME) - AZURE_OPENAI_ENDPOINT: $(STAGING_AZURE_OPENAI_ENDPOINT) - AZURE_OPENAI_API_KEY: $(STAGING_AZURE_OPENAI_API_KEY) - # OAUTH Toolkit - OIDC_ENABLE: $(STAGING_OIDC_ENABLE) - OIDC_RSA_PRIVATE_KEY_BASE64_ENCODED: $(STAGING_OIDC_RSA_PRIVATE_KEY_BASE64_ENCODED) - OIDC_RSA_PUBLIC_KEY_BASE64_ENCODED: $(STAGING_OIDC_RSA_PUBLIC_KEY_BASE64_ENCODED) - - # Deploy go-api to production - - bash: $(Pipeline.Workspace)/go-deploy/applications/go-api/scripts/deploy-go-api.sh - condition: eq(variables['Build.SourceBranch'], 'refs/heads/master') - displayName: "Deploy production instance of go-api" - env: - ENVIRONMENT: production - VERSION: "0.0.2-master.cead0a4a" - # For Azure CLI - AZURE_TENANT_ID: $(TERRAFORM_TENANT_ID) - AZURE_CLIENT_ID: $(TERRAFORM_SERVICE_PRINCIPAL_ID) - AZURE_CLIENT_SECRET: $(TERRAFORM_SERVICE_PRINCIPAL_KEY) - # Production application settings - DJANGO_SECRET_KEY: $(PRODUCTION_DJANGO_SECRET_KEY) - DJANGO_DB_NAME: $(PRODUCTION_DJANGO_DB_NAME) - DJANGO_DB_USER: $(PRODUCTION_DJANGO_DB_USER) - DJANGO_DB_PASS: $(PRODUCTION_DJANGO_DB_PASS) - DJANGO_DB_HOST: $(PRODUCTION_DJANGO_DB_HOST) - DJANGO_DB_PORT: $(PRODUCTION_DJANGO_DB_PORT) - AZURE_STORAGE_KEY: $(PRODUCTION_AZURE_STORAGE_KEY) - AZURE_STORAGE_ACCOUNT: $(PRODUCTION_AZURE_STORAGE_ACCOUNT) - EMAIL_API_ENDPOINT: $(PRODUCTION_EMAIL_API_ENDPOINT) - EMAIL_HOST: $(PRODUCTION_EMAIL_HOST) - EMAIL_PORT: $(PRODUCTION_EMAIL_PORT) - EMAIL_USER: $(PRODUCTION_EMAIL_USER) - EMAIL_PASS: $(PRODUCTION_EMAIL_PASS) - TEST_EMAILS: $(PRODUCTION_TEST_EMAILS) - AWS_TRANSLATE_ACCESS_KEY: $(PRODUCTION_AWS_TRANSLATE_ACCESS_KEY) - AWS_TRANSLATE_SECRET_KEY: $(PRODUCTION_AWS_TRANSLATE_SECRET_KEY) - AWS_TRANSLATE_REGION: $(PRODUCTION_AWS_TRANSLATE_REGION) - CELERY_REDIS_URL: $(PRODUCTION_CELERY_REDIS_URL) - CACHE_MIDDLEWARE_SECONDS: $(PRODUCTION_CACHE_MIDDLEWARE_SECONDS) - MOLNIX_API_BASE: $(PRODUCTION_MOLNIX_API_BASE) - MOLNIX_USERNAME: $(PRODUCTION_MOLNIX_USERNAME) - MOLNIX_PASSWORD: $(PRODUCTION_MOLNIX_PASSWORD) - ERP_API_ENDPOINT: $(PRODUCTION_ERP_API_ENDPOINT) - ERP_API_SUBSCRIPTION_KEY: $(PRODUCTION_ERP_API_SUBSCRIPTION_KEY) - FDRS_APIKEY: $(PRODUCTION_FDRS_APIKEY) - FDRS_CREDENTIAL: $(PRODUCTION_FDRS_CREDENTIAL) - HPC_CREDENTIAL: $(PRODUCTION_HPC_CREDENTIAL) - APPLICATION_INSIGHTS_INSTRUMENTATION_KEY: $(PRODUCTION_APPLICATION_INSIGHTS_INSTRUMENTATION_KEY) - ELASTIC_SEARCH_HOST: $(PRODUCTION_ELASTIC_SEARCH_HOST) - GO_FTPHOST: $(PRODUCTION_GO_FTPHOST) - GO_FTPUSER: $(PRODUCTION_GO_FTPUSER) - GO_FTPPASS: $(PRODUCTION_GO_FTPPASS) - GO_DBPASS: $(PRODUCTION_GO_DBPASS) - APPEALS_USER: $(PRODUCTION_APPEALS_USER) - APPEALS_PASS: $(PRODUCTION_APPEALS_PASS) - RESOURCES_DB_NAME: $(PRODUCTION_RESOURCES_DB_NAME) - RESOURCES_DB_SERVER: $(PRODUCTION_RESOURCES_DB_SERVER) - REGION: $(PRODUCTION_REGION) - SENTRY_DSN: $(PRODUCTION_SENTRY_DSN) - SENTRY_SAMPLE_RATE: $(PRODUCTION_SENTRY_SAMPLE_RATE) - DJANGO_READ_ONLY: $(PRODUCTION_DJANGO_READ_ONLY) - AUTO_TRANSLATION_TRANSLATOR: $(PRODUCTION_AUTO_TRANSLATION_TRANSLATOR) - IFRC_TRANSLATION_DOMAIN: $(PRODUCTION_IFRC_TRANSLATION_DOMAIN) - IFRC_TRANSLATION_HEADER_API_KEY: $(PRODUCTION_IFRC_TRANSLATION_HEADER_API_KEY) - DEBUG_EMAIL: '' - DOCKER_HOST_IP: '' - DJANGO_DEBUG: '' - DJANGO_ADDITIONAL_ALLOWED_HOSTS: $(PRODUCTION_ADDITIONAL_URL) - # TLS cert and key should be base64 encoded - API_TLS_CRT: $(PRODUCTION_API_TLS_CRT) - API_TLS_KEY: $(PRODUCTION_API_TLS_KEY) - API_ADDITIONAL_DOMAIN_TLS_CRT: $(PRODUCTION_API_ADDITIONAL_DOMAIN_TLS_CRT) - API_ADDITIONAL_DOMAIN_TLS_KEY: $(PRODUCTION_API_ADDITIONAL_DOMAIN_TLS_KEY) - # ReliefWeb job - RELIEF_WEB_APP_NAME: $(PRODUCTION_RELIEF_WEB_APP_NAME) - # PowerBI - POWERBI_WORKSPACE_ID: $(PRODUCTION_POWERBI_WORKSPACE_ID) - POWERBI_DATASET_IDS: $(PRODUCTION_POWERBI_DATASET_IDS) - # Country page - NS_CONTACT_USERNAME: $(PRODUCTION_NS_CONTACT_USERNAME) - NS_CONTACT_PASSWORD: $(PRODUCTION_NS_CONTACT_PASSWORD) - ACAPS_API_TOKEN: $(PRODUCTION_ACAPS_API_TOKEN) - NS_DOCUMENT_API_KEY: $(PRODUCTION_NS_DOCUMENT_API_KEY) - NS_INITIATIVES_API_KEY: $(PRODUCTION_NS_INITIATIVES_API_KEY) - NS_INITIATIVES_API_TOKEN: $(PRODUCTION_NS_INITIATIVES_API_TOKEN) - JWT_PRIVATE_KEY_BASE64_ENCODED: $(PRODUCTION_JWT_PRIVATE_KEY_BASE64_ENCODED) - JWT_PUBLIC_KEY_BASE64_ENCODED: $(PRODUCTION_JWT_PUBLIC_KEY_BASE64_ENCODED) - JWT_EXPIRE_TIMESTAMP_DAYS: $(PRODUCTION_JWT_EXPIRE_TIMESTAMP_DAYS) - AZURE_OPENAI_DEPLOYMENT_NAME: $(PRODUCTION_AZURE_OPENAI_DEPLOYMENT_NAME) - AZURE_OPENAI_ENDPOINT: $(PRODUCTION_AZURE_OPENAI_ENDPOINT) - AZURE_OPENAI_API_KEY: $(PRODUCTION_AZURE_OPENAI_API_KEY) - # OAUTH Toolkit - OIDC_ENABLE: $(PRODUCTION_OIDC_ENABLE) - OIDC_RSA_PRIVATE_KEY_BASE64_ENCODED: $(PRODUCTION_OIDC_RSA_PRIVATE_KEY_BASE64_ENCODED) - OIDC_RSA_PUBLIC_KEY_BASE64_ENCODED: $(PRODUCTION_OIDC_RSA_PUBLIC_KEY_BASE64_ENCODED) diff --git a/applications/go-api/helm/ifrcgo-helm/values-production.yaml b/applications/go-api/helm/ifrcgo-helm/values-production.yaml deleted file mode 100644 index 8ff7dba0..00000000 --- a/applications/go-api/helm/ifrcgo-helm/values-production.yaml +++ /dev/null @@ -1,108 +0,0 @@ -environment: production - -global: - security: - allowInsecureImages: true - -# NOTE: Disabled here, and enabled in the argo app ./applications/argocd/production/applications/go-api.yaml -cronjobs: [] - -env: - API_FQDN: https://goadmin.ifrc.org - AUTO_TRANSLATION_TRANSLATOR: lang.translation.IfrcTranslator - CACHE_MIDDLEWARE_SECONDS: "0" - CELERY_REDIS_URL: redis://ifrcgo-helm-redis:6379/1 - CACHE_REDIS_URL: redis://ifrcgo-helm-redis:6379/1 - DEBUG_EMAIL: "" - DJANGO_DB_NAME: postgres - DJANGO_DEBUG: "" - DOCKER_HOST_IP: "" - DJANGO_READ_ONLY: "false" - DJANGO_ADDITIONAL_ALLOWED_HOSTS: "" - ELASTIC_SEARCH_HOST: elasticsearch://ifrcgo-helm-elasticsearch:9200 - FRONTEND_URL: https://go.ifrc.org - GO_ENVIRONMENT: production - IFRC_TRANSLATION_DOMAIN: https://ifrc-translationapi.azurewebsites.net - SENTRY_DSN: https://342632f67ea942c9bde214c0bb7e91be@sentry.northeurope.cloudapp.azure.com/2 - SENTRY_SAMPLE_RATE: "0.2" - SESSION_COOKIE_DOMAIN: ".ifrc.org" - CSRF_COOKIE_DOMAIN: ".ifrc.org" - # Reference from montandon-etl/staging file - EOAPI_STAC_INTERNAL_URL: "http://montandon-eoapi-stac.montandon-eoapi.svc.cluster.local:8080/" - EOAPI_STAC_EXTERNAL_URL: "https://montandon-eoapi.ifrc.org/stac" - # XXX: Temporary values to fix rendering issue - PLAYWRIGHT_SERVER_URL: ws://ifrcgo-helm-playwright:3000/ - -api: - # NOTE: Disabled here, and enabled in the argo app ./applications/argocd/production/applications/go-api.yaml - enabled: false - tls: - enabled: false - domain: goadmin.ifrc.org - additionalDomain: "" - replicaCount: 2 - resources: - requests: - cpu: "0.2" - memory: 4Gi - limits: - cpu: "2" - memory: 4Gi - -redis: - # NOTE: Disabled here, and enabled in the argo app ./applications/argocd/production/applications/go-api.yaml - enabled: false - image: - repository: bitnamilegacy/redis - resources: - requests: - cpu: "0.2" - memory: 0.5Gi - limits: - cpu: "1" - memory: 2Gi - -playwright: - # NOTE: Disabled here, and enabled in the argo app ./applications/argocd/production/applications/go-api.yaml - enabled: false - -celery: - # NOTE: Disabled here, and enabled in the argo app ./applications/argocd/production/applications/go-api.yaml - enabled: false - replicaCount: 2 - resources: - requests: - cpu: "0.2" - memory: 0.4Gi - limits: - cpu: "2" - memory: 4Gi - -elasticsearch: - # NOTE: Disabled here, and enabled in the argo app ./applications/argocd/production/applications/go-api.yaml - enabled: false - disk: - uri: /subscriptions/39308fb0-9929-4b29-aafa-b3c78a8b0658/resourceGroups/ifrcpgo002rg/providers/Microsoft.Compute/disks/ifrcpgo-disk001 - resources: - requests: - cpu: "0.2" - memory: 4Gi - limits: - cpu: "2" - memory: 4Gi - -sshBastion: - resources: - requests: - cpu: "0.1" - memory: 0.05Gi - limits: - cpu: "1" - memory: 0.2Gi - -serviceAccount: - create: false - name: go-api-production-workload-sa - -podLabels: - azure.workload.identity/use: "true" diff --git a/applications/go-api/helm/ifrcgo-helm/values-staging.yaml b/applications/go-api/helm/ifrcgo-helm/values-staging.yaml deleted file mode 100644 index de226eeb..00000000 --- a/applications/go-api/helm/ifrcgo-helm/values-staging.yaml +++ /dev/null @@ -1,106 +0,0 @@ -environment: staging - -global: - security: - allowInsecureImages: true - -# NOTE: Disabled here, and enabled in the argo app ./applications/argocd/staging/applications/go-api.yaml -cronjobs: [] - -env: - API_FQDN: https://goadmin-stage.ifrc.org - AUTO_TRANSLATION_TRANSLATOR: lang.translation.IfrcTranslator - CACHE_MIDDLEWARE_SECONDS: "0" - CELERY_REDIS_URL: redis://ifrcgo-helm-redis:6379/0 - CACHE_REDIS_URL: redis://ifrcgo-helm-redis:6379/1 - DEBUG_EMAIL: "" - DJANGO_DB_NAME: postgres - DJANGO_DEBUG: "" - DOCKER_HOST_IP: "" - DJANGO_READ_ONLY: "false" - DJANGO_ADDITIONAL_ALLOWED_HOSTS: "" - ELASTIC_SEARCH_HOST: elasticsearch://ifrcgo-helm-elasticsearch:9200 - FRONTEND_URL: https://go-stage.ifrc.org - GO_ENVIRONMENT: staging - IFRC_TRANSLATION_DOMAIN: https://ifrc-translationapi-staging.azurewebsites.net - SENTRY_DSN: https://342632f67ea942c9bde214c0bb7e91be@sentry.northeurope.cloudapp.azure.com/2 - SENTRY_SAMPLE_RATE: "0.3" - SESSION_COOKIE_DOMAIN: ".ifrc.org" - CSRF_COOKIE_DOMAIN: ".ifrc.org" - # Reference from montandon-etl/staging file - EOAPI_STAC_INTERNAL_URL: "http://montandon-eoapi-stac.montandon-eoapi.svc.cluster.local:8080/" - EOAPI_STAC_EXTERNAL_URL: "https://montandon-eoapi-stage.ifrc.org/stac" - # XXX: Temporary values to fix rendering issue - PLAYWRIGHT_SERVER_URL: ws://ifrcgo-helm-playwright:3000/ - -api: - # NOTE: Disabled here, and enabled in the argo app ./applications/argocd/staging/applications/go-api.yaml - enabled: false - domain: goadmin-stage.ifrc.org - additionalDomain: "" - replicaCount: 1 - resources: - requests: - cpu: "0.2" - memory: 4Gi - limits: - cpu: "2" - memory: 4Gi - -redis: - # NOTE: Disabled here, and enabled in the argo app ./applications/argocd/staging/applications/go-api.yaml - enabled: false - image: - repository: bitnamilegacy/redis - resources: - requests: - cpu: "0.2" - memory: 0.5Gi - limits: - cpu: "1" - memory: 2Gi - -playwright: - # NOTE: Disabled here, and enabled in the argo app ./applications/argocd/staging/applications/go-api.yaml - enabled: false - -celery: - # NOTE: Disabled here, and enabled in the argo app ./applications/argocd/staging/applications/go-api.yaml - enabled: false - replicaCount: 1 - resources: - requests: - cpu: "0.2" - memory: 0.4Gi - limits: - cpu: "2" - memory: 4Gi - -elasticsearch: - # NOTE: Disabled here, and enabled in the argo app ./applications/argocd/staging/applications/go-api.yaml - enabled: false - disk: - uri: /subscriptions/39308fb0-9929-4b29-aafa-b3c78a8b0658/resourceGroups/ifrctgo002rg/providers/Microsoft.Compute/disks/ifrctgo-disk001 - resources: - requests: - cpu: "0.2" - memory: 4Gi - limits: - cpu: "2" - memory: 4Gi - -sshBastion: - resources: - requests: - cpu: "0.2" - memory: 0.05Gi - limits: - cpu: "1" - memory: 0.2Gi - -serviceAccount: - create: false - name: go-api-staging-workload-sa - -podLabels: - azure.workload.identity/use: "true" diff --git a/applications/go-api/scripts/deploy-go-api.sh b/applications/go-api/scripts/deploy-go-api.sh deleted file mode 100644 index 08203471..00000000 --- a/applications/go-api/scripts/deploy-go-api.sh +++ /dev/null @@ -1,76 +0,0 @@ -#!/bin/bash - -set -x -set -e - -# if environment is production, then we get the credentials for the production cluster. -# else we get the credentials for the staging cluster -az login --service-principal -u $AZURE_CLIENT_ID -p $AZURE_CLIENT_SECRET --tenant $AZURE_TENANT_ID -if [[ "${ENVIRONMENT}" == "production" ]]; then - echo "Getting credentials for production cluster..." - az aks get-credentials --resource-group ifrcpgo002rg --name ifrcpgo-cluster -else - echo "Getting credentials for staging cluster..." - az aks get-credentials --resource-group ifrctgo002rg --name ifrctgo-cluster -fi - -helm upgrade --install --wait \ - -f applications/go-api/helm/ifrcgo-helm/values-${ENVIRONMENT}.yaml \ - ifrcgo-helm \ - oci://ghcr.io/ifrcgo/go-api/ifrcgo-helm \ - --version "${VERSION}" \ - --set env.DJANGO_SECRET_KEY=${DJANGO_SECRET_KEY} \ - --set env.DJANGO_DB_USER=${DJANGO_DB_USER} \ - --set env.DJANGO_DB_PASS=${DJANGO_DB_PASS} \ - --set env.DJANGO_DB_HOST=${DJANGO_DB_HOST} \ - --set env.DJANGO_DB_PORT=${DJANGO_DB_PORT} \ - --set env.AZURE_STORAGE_ACCOUNT=${AZURE_STORAGE_ACCOUNT} \ - --set env.AZURE_STORAGE_KEY=${AZURE_STORAGE_KEY} \ - --set env.EMAIL_API_ENDPOINT=${EMAIL_API_ENDPOINT} \ - --set env.EMAIL_HOST=${EMAIL_HOST} \ - --set env.EMAIL_PORT=${EMAIL_PORT} \ - --set env.EMAIL_USER=${EMAIL_USER} \ - --set env.EMAIL_PASS=${EMAIL_PASS} \ - --set env.TEST_EMAILS=${TEST_EMAILS} \ - --set env.AWS_TRANSLATE_ACCESS_KEY=${AWS_TRANSLATE_ACCESS_KEY} \ - --set env.AWS_TRANSLATE_SECRET_KEY=${AWS_TRANSLATE_SECRET_KEY} \ - --set env.AWS_TRANSLATE_REGION=${AWS_TRANSLATE_REGION} \ - --set env.MOLNIX_API_BASE=${MOLNIX_API_BASE} \ - --set env.MOLNIX_USERNAME=${MOLNIX_USERNAME} \ - --set env.MOLNIX_PASSWORD=${MOLNIX_PASSWORD} \ - --set env.ERP_API_ENDPOINT=${ERP_API_ENDPOINT} \ - --set env.ERP_API_SUBSCRIPTION_KEY=${ERP_API_SUBSCRIPTION_KEY} \ - --set env.FDRS_APIKEY=${FDRS_APIKEY} \ - --set env.FDRS_CREDENTIAL=${FDRS_CREDENTIAL} \ - --set env.HPC_CREDENTIAL=${HPC_CREDENTIAL} \ - --set env.APPLICATION_INSIGHTS_INSTRUMENTATION_KEY=${APPLICATION_INSIGHTS_INSTRUMENTATION_KEY} \ - --set env.GO_FTPHOST=${GO_FTPHOST} \ - --set env.GO_FTPUSER=${GO_FTPUSER} \ - --set env.GO_FTPPASS=${GO_FTPPASS} \ - --set env.GO_DBPASS=${GO_DBPASS} \ - --set env.APPEALS_USER=${APPEALS_USER} \ - --set env.APPEALS_PASS=${APPEALS_PASS} \ - --set env.IFRC_TRANSLATION_DOMAIN=${IFRC_TRANSLATION_DOMAIN} \ - --set env.IFRC_TRANSLATION_HEADER_API_KEY=${IFRC_TRANSLATION_HEADER_API_KEY} \ - --set secrets.API_TLS_CRT=${API_TLS_CRT} \ - --set secrets.API_TLS_KEY=${API_TLS_KEY} \ - --set secrets.API_ADDITIONAL_DOMAIN_TLS_CRT=${API_ADDITIONAL_DOMAIN_TLS_CRT} \ - --set secrets.API_ADDITIONAL_DOMAIN_TLS_KEY=${API_ADDITIONAL_DOMAIN_TLS_KEY} \ - --set env.RELIEF_WEB_APP_NAME=${RELIEF_WEB_APP_NAME} \ - --set env.POWERBI_WORKSPACE_ID=${POWERBI_WORKSPACE_ID} \ - --set env.POWERBI_DATASET_IDS=${POWERBI_DATASET_IDS} \ - --set env.NS_CONTACT_USERNAME=${NS_CONTACT_USERNAME} \ - --set env.NS_CONTACT_PASSWORD=${NS_CONTACT_PASSWORD} \ - --set env.ACAPS_API_TOKEN=${ACAPS_API_TOKEN} \ - --set env.NS_DOCUMENT_API_KEY=${NS_DOCUMENT_API_KEY} \ - --set env.NS_INITIATIVES_API_KEY=${NS_INITIATIVES_API_KEY} \ - --set env.NS_INITIATIVES_API_TOKEN=${NS_INITIATIVES_API_TOKEN} \ - --set "env.JWT_PRIVATE_KEY_BASE64_ENCODED=${JWT_PRIVATE_KEY_BASE64_ENCODED}" \ - --set "env.JWT_PUBLIC_KEY_BASE64_ENCODED=${JWT_PUBLIC_KEY_BASE64_ENCODED}" \ - --set env.JWT_EXPIRE_TIMESTAMP_DAYS=${JWT_EXPIRE_TIMESTAMP_DAYS} \ - --set env.AZURE_OPENAI_DEPLOYMENT_NAME=${AZURE_OPENAI_DEPLOYMENT_NAME} \ - --set env.AZURE_OPENAI_ENDPOINT=${AZURE_OPENAI_ENDPOINT} \ - --set env.AZURE_OPENAI_API_KEY=${AZURE_OPENAI_API_KEY} \ - --set env.OIDC_ENABLE=${OIDC_ENABLE} \ - --set env.OIDC_RSA_PRIVATE_KEY_BASE64_ENCODED=${OIDC_RSA_PRIVATE_KEY_BASE64_ENCODED} \ - --set env.OIDC_RSA_PUBLIC_KEY_BASE64_ENCODED=${OIDC_RSA_PUBLIC_KEY_BASE64_ENCODED} diff --git a/base-infrastructure/terraform/resources/bastion.tf b/base-infrastructure/terraform/resources/bastion.tf index da981de4..1c384dc5 100644 --- a/base-infrastructure/terraform/resources/bastion.tf +++ b/base-infrastructure/terraform/resources/bastion.tf @@ -47,8 +47,8 @@ resource "helm_release" "bastion" { # Sushil "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJbRraaLnjdExOtObCgY5RmOALKYzlXAH9GAMxbm9wtX susilnem@sushil-machine", ] - # Idle jump host — kept small. Staging gets a slightly higher CPU request (matches the - # sizing the go-api chart overrides used previously); the rest comes from values.yaml. + # Idle jump host, kept small. Staging gets a slightly higher CPU request; the rest + # comes from values.yaml. resources = { requests = { cpu = var.environment == "staging" ? "0.2" : "0.1" From ac8a8441dbc567ea0be11956a299692d5ed02d7b Mon Sep 17 00:00:00 2001 From: thenav56 Date: Tue, 15 Sep 2026 16:44:57 +0545 Subject: [PATCH 12/14] chore(go-api): remove legacy ifrcgo-helm terraform release --- .../terraform/resources/helm-ifrcgo.tf | 221 +----------------- 1 file changed, 6 insertions(+), 215 deletions(-) diff --git a/base-infrastructure/terraform/resources/helm-ifrcgo.tf b/base-infrastructure/terraform/resources/helm-ifrcgo.tf index 7293d797..97be89a2 100644 --- a/base-infrastructure/terraform/resources/helm-ifrcgo.tf +++ b/base-infrastructure/terraform/resources/helm-ifrcgo.tf @@ -1,218 +1,9 @@ -resource "helm_release" "ifrcgo" { +# Drops the `ifrcgo-helm` release from Terraform's state without uninstalling it from the +# cluster's `default` namespace. +removed { + from = helm_release.ifrcgo + lifecycle { - ignore_changes = all + destroy = false } - - name = "ifrcgo-helm" - chart = "../helm/ifrcgo-helm" - wait = true - depends_on = [ - helm_release.ifrcgo-ingress-nginx, - helm_release.ifrcgo-cert-manager - ] - - # values = [ - # file("${path.root}/../helm/ifrcgo-helm/values.yaml"), - # file("${path.root}/../helm/ifrcgo-helm/values-${var.environment}.yaml"), - # ] - - # set { - # name = "env.DJANGO_SECRET_KEY" - # value = var.DJANGO_SECRET_KEY - # } - - # set { - # name = "env.DJANGO_DB_USER" - # value = var.DJANGO_DB_USER - # } - - # set { - # name = "env.DJANGO_DB_PASS" - # value = var.DJANGO_DB_PASS - # } - - # set { - # name = "env.DJANGO_DB_HOST" - # value = var.DJANGO_DB_HOST - # } - - # set { - # name = "env.DJANGO_DB_PORT" - # value = var.DJANGO_DB_PORT - # } - - # # set { - # # name = "env.AZURE_STORAGE_ACCOUNT" - # # value = azurerm_storage_account.ifrcgo.id - # # } - # # - # # set { - # # name = "env.AZURE_STORAGE_KEY" - # # value = azurerm_storage_account.ifrcgo.primary_access_key - # # } - - # set { - # name = "env.AZURE_STORAGE_ACCOUNT" - # value = var.AZURE_STORAGE_ACCOUNT - # } - - # set { - # name = "env.AZURE_STORAGE_KEY" - # value = var.AZURE_STORAGE_KEY - # } - - # set { - # name = "env.EMAIL_API_ENDPOINT" - # value = var.EMAIL_API_ENDPOINT - # } - - # set { - # name = "env.EMAIL_HOST" - # value = var.EMAIL_HOST - # } - - # set { - # name = "env.EMAIL_PORT" - # value = var.EMAIL_PORT - # } - - # set { - # name = "env.EMAIL_USER" - # value = var.EMAIL_USER - # } - - # set { - # name = "env.EMAIL_PASS" - # value = var.EMAIL_PASS - # } - - # set { - # name = "env.TEST_EMAILS" - # value = var.TEST_EMAILS - # } - - # set { - # name = "env.AWS_TRANSLATE_ACCESS_KEY" - # value = var.AWS_TRANSLATE_ACCESS_KEY - # } - - # set { - # name = "env.AWS_TRANSLATE_SECRET_KEY" - # value = var.AWS_TRANSLATE_SECRET_KEY - # } - - # set { - # name = "env.AWS_TRANSLATE_REGION" - # value = var.AWS_TRANSLATE_REGION - # } - - # set { - # name = "env.MOLNIX_API_BASE" - # value = var.MOLNIX_API_BASE - # } - - # set { - # name = "env.MOLNIX_USERNAME" - # value = var.MOLNIX_USERNAME - # } - - # set { - # name = "env.MOLNIX_PASSWORD" - # value = var.MOLNIX_PASSWORD - # } - - # set { - # name = "env.ERP_API_ENDPOINT" - # value = var.ERP_API_ENDPOINT - # } - - # set { - # name = "env.ERP_API_SUBSCRIPTION_KEY" - # value = var.ERP_API_SUBSCRIPTION_KEY - # } - - # set { - # name = "env.FDRS_APIKEY" - # value = var.FDRS_APIKEY - # } - - # set { - # name = "env.FDRS_CREDENTIAL" - # value = var.FDRS_CREDENTIAL - # } - - # set { - # name = "env.HPC_CREDENTIAL" - # value = var.HPC_CREDENTIAL - # } - - # set { - # name = "env.APPLICATION_INSIGHTS_INSTRUMENTATION_KEY" - # value = var.APPLICATION_INSIGHTS_INSTRUMENTATION_KEY - # } - - # set { - # name = "env.GO_FTPHOST" - # value = var.GO_FTPHOST - # } - - # set { - # name = "env.GO_FTPUSER" - # value = var.GO_FTPUSER - # } - - # set { - # name = "env.GO_FTPPASS" - # value = var.GO_FTPPASS - # } - - # set { - # name = "env.GO_DBPASS" - # value = var.GO_DBPASS - # } - - # set { - # name = "env.APPEALS_USER" - # value = var.APPEALS_USER - # } - - # set { - # name = "env.APPEALS_PASS" - # value = var.APPEALS_PASS - # } - - # set { - # name = "env.IFRC_TRANSLATION_HEADER_API_KEY" - # value = var.IFRC_TRANSLATION_HEADER_API_KEY - # } - - # set { - # name = "elasticsearch.disk.name" - # value = "${local.prefix}-disk" - # } - - # set { - # name = "elasticsearch.disk.uri" - # value = azurerm_managed_disk.ifrcgo.id - # } - - # set { - # name = "secrets.API_TLS_CRT" - # value = var.API_TLS_CRT - # } - - # set { - # name = "secrets.API_TLS_KEY" - # value = var.API_TLS_KEY - # } - - # set { - # name = "secrets.API_ADDITIONAL_DOMAIN_TLS_CRT" - # value = var.API_ADDITIONAL_DOMAIN_TLS_CRT - # } - - # set { - # name = "secrets.API_ADDITIONAL_DOMAIN_TLS_KEY" - # value = var.API_ADDITIONAL_DOMAIN_TLS_KEY - # } } From 653b2c9e614d43ad1ef43d6320cc5786d25428cf Mon Sep 17 00:00:00 2001 From: thenav56 Date: Wed, 16 Sep 2026 12:07:59 +0545 Subject: [PATCH 13/14] chore(go-api): remove legacy elasticsearch disk and configmap --- .../terraform/resources/aks.tf | 25 +++---------------- .../terraform/resources/disk.tf | 14 ----------- 2 files changed, 4 insertions(+), 35 deletions(-) delete mode 100644 base-infrastructure/terraform/resources/disk.tf diff --git a/base-infrastructure/terraform/resources/aks.tf b/base-infrastructure/terraform/resources/aks.tf index 42b2168e..db487179 100644 --- a/base-infrastructure/terraform/resources/aks.tf +++ b/base-infrastructure/terraform/resources/aks.tf @@ -59,30 +59,13 @@ resource "azurerm_role_assignment" "storage" { principal_id = azurerm_kubernetes_cluster.ifrcgo.identity[0].principal_id } -# create k8s configmaps and secrets - +# Kubernetes provider. No resource in this configuration uses it, and it cannot be deleted +# while an orphaned kubernetes_* resource is still in state. This block sits inside a child +# module, so its provider address cannot be implied; destroying such an orphan without it +# fails with "Provider configuration not present". provider "kubernetes" { host = azurerm_kubernetes_cluster.ifrcgo.kube_config[0].host client_certificate = base64decode(azurerm_kubernetes_cluster.ifrcgo.kube_config[0].client_certificate) client_key = base64decode(azurerm_kubernetes_cluster.ifrcgo.kube_config[0].client_key) cluster_ca_certificate = base64decode(azurerm_kubernetes_cluster.ifrcgo.kube_config[0].cluster_ca_certificate) } - -# This ConfigMap stores configurations for resources created by Terraform which -# are later referenced in the go-api Helm chart. Values from this ConfigMap -# are either directly utilized in Kubernetes resource definitions or provided -# as parameters to the Helm chart. -resource "kubernetes_config_map" "ifrcgo_terraform_managed_resources" { - metadata { - name = "ifrcgo-terraform-managed-resources" - } - - depends_on = [ - azurerm_managed_disk.ifrcgo - ] - - data = { - "elasticsearch_disk_name" = "${local.prefix}-disk" - "elasticsearch_disk_uri" = azurerm_managed_disk.ifrcgo.id - } -} diff --git a/base-infrastructure/terraform/resources/disk.tf b/base-infrastructure/terraform/resources/disk.tf deleted file mode 100644 index cad5ba04..00000000 --- a/base-infrastructure/terraform/resources/disk.tf +++ /dev/null @@ -1,14 +0,0 @@ -resource "azurerm_managed_disk" "ifrcgo" { - name = "${local.prefix}-disk001" - resource_group_name = data.azurerm_resource_group.ifrcgo.name - location = data.azurerm_resource_group.ifrcgo.location - storage_account_type = "StandardSSD_LRS" - create_option = "Empty" - disk_size_gb = "20" -} - -resource "azurerm_role_assignment" "disk" { - scope = azurerm_managed_disk.ifrcgo.id - role_definition_name = "Contributor" - principal_id = azurerm_kubernetes_cluster.ifrcgo.identity[0].principal_id -} From 40ab28b5dbe32116130255920a81a5a84cab7589 Mon Sep 17 00:00:00 2001 From: thenav56 Date: Wed, 16 Sep 2026 20:21:28 +0545 Subject: [PATCH 14/14] ci(base-infrastructure): plan production on PRs targeting master Production applies ran unreviewed: plan-infra.sh was wired only to PRs targeting develop. --- base-infrastructure/azure-pipelines.yml | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/base-infrastructure/azure-pipelines.yml b/base-infrastructure/azure-pipelines.yml index 7431fc66..9e8075dc 100644 --- a/base-infrastructure/azure-pipelines.yml +++ b/base-infrastructure/azure-pipelines.yml @@ -2,7 +2,6 @@ trigger: - master - develop -# no PR triggers pr: drafts: "false" @@ -42,7 +41,6 @@ jobs: - script: chmod +x $(Pipeline.Workspace)/go-deploy/base-infrastructure/scripts/apply-infra.sh displayName: "Make apply-infra executable" - # TODO: add plan-infra for main branch (when PR created from develop) - bash: $(Pipeline.Workspace)/go-deploy/base-infrastructure/scripts/plan-infra.sh condition: and(eq(variables['Build.Reason'], 'PullRequest'), eq(variables['System.PullRequest.targetBranchName'], 'develop')) displayName: "Plan Staging Infrastructure" @@ -90,6 +88,29 @@ jobs: AZURE_CLIENT_SECRET: $(TERRAFORM_SERVICE_PRINCIPAL_KEY) # Deploy Terraform managed infrastructure to production + - bash: $(Pipeline.Workspace)/go-deploy/base-infrastructure/scripts/plan-infra.sh + condition: and(eq(variables['Build.Reason'], 'PullRequest'), eq(variables['System.PullRequest.targetBranchName'], 'master')) + displayName: "Plan Production Infrastructure" + env: + TF_VAR_environment: production + TF_VAR_subscriptionId: $(TERRAFORM_SUBSCRIPTION_ID) + # DB resources + TF_VAR_RESOURCES_DB_SERVER: $(PRODUCTION_RESOURCES_DB_SERVER) + TF_VAR_RESOURCES_DB_NAME: $(PRODUCTION_RESOURCES_DB_NAME) + TF_VAR_REGION: $(PRODUCTION_REGION) + + # For azurerm backend + ARM_SUBSCRIPTION_ID: $(TERRAFORM_SUBSCRIPTION_ID) + ARM_TENANT_ID: $(TERRAFORM_TENANT_ID) + ARM_CLIENT_ID: $(TERRAFORM_SERVICE_PRINCIPAL_ID) + ARM_CLIENT_SECRET: $(TERRAFORM_SERVICE_PRINCIPAL_KEY) + ARM_ACCESS_KEY: $(TERRAFORM_STORAGE_KEY) + + # For Azure CLI + AZURE_TENANT_ID: $(TERRAFORM_TENANT_ID) + AZURE_CLIENT_ID: $(TERRAFORM_SERVICE_PRINCIPAL_ID) + AZURE_CLIENT_SECRET: $(TERRAFORM_SERVICE_PRINCIPAL_KEY) + - bash: $(Pipeline.Workspace)/go-deploy/base-infrastructure/scripts/apply-infra.sh condition: and(eq(variables['Build.Reason'], 'IndividualCI'), eq(variables['Build.SourceBranch'], 'refs/heads/master')) displayName: "Deploy Production Infrastructure"