ci(deploy): deploy rodold with helm

.gitlab-ci-extended.yml

+variables:
+  DEPLOY_PREPROD: "false"
+  DEPLOY_REVIEW: "false"
+
+
 js-install:
   script:
     - cd frontend && npm ci

.gitlab-ci.yml

@@ -20,6 +20,7 @@
       - "templates/lint/js-lint.yml"
       - "templates/js-build.yml"
       - "templates/build-docker-image.yml"
+      - "templates/deploy-with-helmfile.yml"
   - ".gitlab-ci-extended.yml"
 
 stages:
@@ -29,3 +30,4 @@
   - tests
   - release
   - publish
+  - deploy

deploy/.sops.yaml

+creation_rules:
+  - key_groups:
+    - pgp:
+      - 179882301F897D37C8ACDDBF3189C145DE1FC33B #xgarnier
+      - E59A69EFF8D4ABEC91C934DF044E907A3B03110C #alubert
+      - 78F88336EAF649C11C4B7305048B53A72F031A64 #nchauvat
+      - 9400E4A1C8E9190258EB2F26A97E612A3DA2ECA8 #elemaillet
+      - A09B26095E5E2FF8BDCE66057338DF519EB5BFFD #famarger
+    age: age1mgc86czyjledv7zgq9leay2xvwu8kwcftxtj6f2asfnygm9s9f0sr94t53

deploy/helmfile.yaml

+---
+environments:
+  production:
+    values:
+      - values_default.yaml
+      - values_prod.yaml
+    secrets:
+      - prod_secrets.yaml
+
+---
+repositories:
+  - name: logilab
+    url: https://helm.logilab.fr
+
+releases:
+  - name: {{ requiredEnv "CI_ENVIRONMENT_NAME" }}
+    chart: logilab/cubicweb
+    version: 0.14.3
+    atomic: true
+    wait: true
+    timeout: 900
+    namespace: rodolf
+    createNamespace: false
+    values:
+      - values.yaml.gotmpl
+
+  - name: {{ requiredEnv "CI_ENVIRONMENT_NAME" }}-front
+    chart: logilab/web-app
+    version: 0.2.1
+    atomic: true
+    wait: true
+    timeout: 900
+    namespace: rodolf
+    createNamespace: false
+    values:
+      - values-front.yaml.gotmpl

deploy/prod_secrets.yaml

+cwPassword: ENC[AES256_GCM,data:7dhH310IvVLap97ETpNxvA==,iv:jNVjpKOpwGcsnH0rSWCJ2UMK7PAu2zZPkCb+qvunbCg=,tag:JXhlDgKXkM/FQRMytZJDVw==,type:str]
+cwDbPassword: ENC[AES256_GCM,data:wR5PM4hCe+7+kmQnhP+nPi55tWlcHvPK+ZpHntPxes/qt/AWFNcJnOCKga0=,iv:xA5SaVJiSrlb+1+F3wTK9Fb/3X6Jg4LQxIOEt8+bDQs=,tag:Ec0JpHeISVV8+xE4+q4Qxg==,type:str]
+redisSessionsSecret: ENC[AES256_GCM,data:06HgZOWPj+IukWSw39jBIA==,iv:phE0bAAxQFF1jluls9bmdcjJFxA0yN7V3j5hRJhe+8Q=,tag:6IXJCNg/SPTjBxSim6U3eg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-02-06T15:50:27Z"
+    mac: ENC[AES256_GCM,data:bMsQk6rd4vXxqAUJUSH2akuA+qKY970tDONYG3gMQOvayXGpSL+RG4zslQSG1GXiEwGxjKFKnJ+rg8d3/5v5c46fzM3qKK3IHf6+CeHbOWGXH1bKN/ov76XwxKn53wDZvSAX/kwCwZ2MCcQw6Y8sCXypgHOHOxZWlKv36LBaWtQ=,iv:weBr5bnipSVzjU/MSOWpk8+rUrmTX7Se72uPNt1cHLY=,tag:q1QLna6PxTzJGWzTvjYlBw==,type:str]
+    pgp:
+        - created_at: "2024-02-06T15:50:27Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMA8wTcz9fExYoAQv9Er4XHQMTV9jQMHqIVRW4GeImez5cIeIw7Em6NKedHz4z
+            oaVu9yqwB+kUiFkpfqf4xI7ZgU5in6gbdFmTWPM9WyEz2DH5xmuRiFyJWQeJygng
+            p26p9Y4pofGbCPNGLlthOKsyAieBR86MTv2Py5AaqV45tWBvMTJm+FivPnAyLkfE
+            tU7TY6q/BKclnuv0Ie4pKD+bHaJwgOmXnCgz0nvIAbZuOQ0INibuQBkDa+luTkjo
+            U1faOKj10FDZiZuYvfHQO7NYlJS3CMDW9RoUeDYVncR1YOP4udUSOKyH/qAdkr2R
+            eLMtAd9unB6lDt4H06OL4hnCb6akkCnJOmOmbDlvn8dNp4XZQyXwFDzvbjrV4wca
+            gvwhPAKCprfin6o+pzNIDLqBBikAEdzuj1akwfimfb2kaR2ot8FTaXPJrP5C1baj
+            GXY0tLratNnHUrqv+FlciP68a5RgfJeNxBNnPkzmPVZkOfCaiTKEEX6grmwpBcu+
+            5T1FxGMrhOZ+jBSuyg0w0l4BSMmCXmcJA0kOCFsavKP86+G56BLtdlMlsc6CMfvx
+            I1DoeiHfTicn+kKd6SViPVgo2GuZgghNSLrCzNSJCVfL7ABjlK2Q4DEg2YOon6b2
+            8OC9D6zq9bq3FQR0lEic
+            =JQB+
+            -----END PGP MESSAGE-----
+          fp: 179882301F897D37C8ACDDBF3189C145DE1FC33B
+        - created_at: "2024-02-06T15:50:27Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA71GxnIskxQ7ARAAqbT51c0rccEe9Rd3knydz0fJ+NfaEpsnyrDvc07pYqih
+            Xy1G2C4ocQGnnxPNYm8NoKalvzAjOLSIDIUo8YUGB1GGvIvzybGGH6DcuTIujK13
+            3DHR2qi8yWV2/DXUKKeOy/Ko3zafrxziwIGiOcCJOleHVWJTK3cp9IAYYrHVViFc
+            Np9/yRMVp0leYV/oQ7ywUWCEr5X3KZoHFUPqIYQTtSOBtPQy828+9tR+1aBoz4lR
+            JVNzQHfMKtP8vSn5ylyWsDelSgTylC4iQenlrhIelzafPjnCbuz4411hweGUe8xa
+            c+8lGxpCMjR0hlXSu7SoLv53ahHrPiPpRSksS3OhhYwPTD3oa2bIMVxeVeyHjFGx
+            8489OEOteGLnoKWOqnNMEL9WLrJBq8cp46J/vmeib4ejrbsQivJGDkfeLruaC+jw
+            OTKEXOz1EFnDzHPJhUDR8DY9vdnSrnxIQv940IKz2puGU/Gwm2HPqZGRsiFhDINX
+            JyQ5s1b0zE+TKGWr3rGs/g16qY/3lv5YLa9EBzetCsOCly9QMMPmwpJSAm2c2Vr0
+            Ih6QCmbR7noTZyFkhN4d9+ka7zgAlQfsvPgtP+yQg+PRDODW9ZoF2nNjl7uinSf4
+            jNLRUHzStjxneYTJyGNaedhGcSF0JXaYc9FukmZviALAJvjhN2zVAvvcaWz26FrS
+            XgFL3Neehkc0PVmQdhxa1ql+nHCUCehdyshE0EYJLuxpM1G+QKCKHNYnF6SdNA4i
+            uee7DC8QDo290tvTjjXqc8ADkhYmadMS7i0rLjzfD2turFkUiDMCIg1M/EoSf+Y=
+            =QFvh
+            -----END PGP MESSAGE-----
+          fp: E59A69EFF8D4ABEC91C934DF044E907A3B03110C
+        - created_at: "2024-02-06T15:50:27Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA1xGY6dIP1n3ARAAuV0kd524cSAEOlzf8R5wAEneWL7GtGxPZCnWpUnGmJ9r
+            CfFNnAN4HpGrT/myPdudTkTfXXK/7GhXa+RhI8FeMWWB5Ru+SzXv8eyvoZGXKNwo
+            Eq/2WveSDSw2HvMkGGAveenP31BPBKZ0iyUYautyUU7VSL+UaPF+WhLt40JlGaZ2
+            +464n5esI8dHwWOedBDthkzqW31u12H4+FZGC0KeooM2+RayNfyWOzZ27J4qKsem
+            TYzFiYVk6ZuDhJPgeJLWDvxNbmIwJPbX6DTywhItnVKoTLJcGUPtKjw9KjbJInhu
+            81uJakAcnao250bXp+idjK6K2bjkyseZydpt8csTztYLjvy5JRlyG3v2dZxQn3lq
+            vOVtDHAcbfpOxcNcjB1EB7owwjM+n75w+uppyuwBRgV43oOzjl/y6vERGH3SuZaF
+            whk8MUDZaNhydgnnF8F82o5UnzhbRZNVMOwF5Wv/BCTsCOxcCzRvaVHGcSt6xVGS
+            Ixq8kcfATUBVfI/Ar3DAXaRL/5l9VBSfJaiygw3iA1oz+9p0x6338GQY1ejvpgwz
+            tbT8UFw5EBxY/Qj0ubVE4sDmUOE7bkzxKbDVIBHVMQrZpcPFOGwcjdn64L/4/02V
+            sLP/m/mP4WqgFqS2oOSNY7LiRNwmZQ7H/hIeuSRfLq9WNVxC7orcH3AUgR8ve5/S
+            XgEVy7ls7yjdF06MPXO7ac/PL72Y7HADapoKJDxftrADW5Eu0CYdUcMmRz6/qFGC
+            qR7LXRnYrWR3F5Zp5EtWwiii0AQLc5g6oZfVvH07lElatjJn/PBIW5KQ5bFvjdk=
+            =IYoR
+            -----END PGP MESSAGE-----
+          fp: 78F88336EAF649C11C4B7305048B53A72F031A64
+        - created_at: "2024-02-06T15:50:27Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA53dLAazhK0dARAAtgodhxEGrHyTuJ6pif0PhyPKdUm0ppgyZhFFEU46zbYP
+            VTOuRyWNw7pi8q2gyZYp2DHSl1YwJFLC5RlGvhQP2WP28WwucfZBzQILMOfkBJHl
+            Pr3YCFsXjXg/jvrja561oH/wHT7u4lJToki+Kb1kNCCXv6ks7+V+uKIUyNCCZvOV
+            ZP+mK/HqSEFnaq0f5B7ZgmIpvUYeFwp83PxFAbJAAiWs0VgrKTJcXgKZ2yH4NN79
+            Oak7rqhV6CsDd+XyQR5mYrYADj03Msw+pGZA/0IK8QrsgnaNZtwPg3cr08q4jFQL
+            9hQHkh8kuODTgEnW5fxA95T1lmqRv3mAJiclsUMCvb6XPbe80hnB0I81yJY6XmuP
+            6NYO96zFeXOHybtqPVlLbnrEreMwzYCU8qgU42Z7EDQ4152DAuHwQWsv0ncVdMe0
+            xYTvZ/mhrqk0rMy/jl9LDgS2202fSweSY7SddHOHqOrP5+aNboowBn0APp+/wAx4
+            vucsOzkJO5oxbmka3CSC58yV8tv86EPQBO796eRDaz0XhlH1MrtTEGC+M14aUBBM
+            GeSuCXAvJX7T7dy48YQ4L2AFytvDJ7v+D1i88//UV705hY2MH5eDq/yYmfZCIUm8
+            KE3FwSjnfCjywfNA9Mk8s/23rlCRhFFNVGiND7SpMi9EslppVH5tQqNyIP/Dis3S
+            XgGkf9gpHHry888Fl+HPAg3r00zCRkoz0enFVKg5krc3HxAlTtjSGQ2GobUINtQJ
+            4rnJXrJVNOlx2wLd03RX3q3NMZK7UgR7TWnmZfJrV9Zo9CzIHZrW0EosUaY5nPY=
+            =5fu4
+            -----END PGP MESSAGE-----
+          fp: 9400E4A1C8E9190258EB2F26A97E612A3DA2ECA8
+        - created_at: "2024-02-06T15:50:27Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA8Dxr3bApGrjARAAuplKj4k72RDb4x04T7XMManBoQIcS7FB+SgCyNPxqGvr
+            eqnGxp2rZg6ixsZ+8fKDDJ00RYJaQAEwv8EqHtXR3PxtBQiD/mfor9RkpB4bN50X
+            pSAeKHXchcZWWEOW0S+rHaLwAuVv4SF727C5NKyVJUR7b0iOngxFh3oIbM3HPg7/
+            GJ4xD1eoOR7wttGvClJxwu2426oty7q6L+bewlOLv0eifPhF6BfDWxOR0oZN5Run
+            cwyCo8AusmtI8dNsaP4fvPAtV3EOLCEOpEak0Od5chldfbe5DJYJB/silpxn0rCq
+            pwb8geF5qsrH1PBGiBABPg36FFdLcXyv6BCl0dqyDV0xHy0nW1c+N1Dlw/zILstL
+            duoQUUMTzOnGk9MBtuLwTk9dBW5rv9aJ1k2CcXT0YXSLrI2r74d/YFxviPU69Ft7
+            8St4qfB6ZKfuWUgIma74loP8Ej9HsSmulvnHwu4Br1gvdz5LHoY6RmPp+NYjmXkP
+            9QEPbb9Q43d+2hPVWyYQUbyRjy/7rLk4jbM0CLZO6qITIwJqcMqFOoB+o1VhXZlR
+            ShaE5aput2ae7ugQWCZTwS646p4xZ1Oj0dfS7Ey5vZmiFydakMF8V+cL2UmzZBO4
+            r7IkoFtdabHXQO4R4Rzn7h8gVEYgjofW4NuPU1VXvcf0ZzGLvE6I+F2YmBfurWTS
+            XgFGuOqI2DKWSGpyyQesou6nlDzfJsrHd1NKVUI8eCDLDpRie1KSR5F0YghXqnEh
+            RJGW4Es/ecvaRKQMCMWgOD63MQVjE49W/m/EAN95Ur4lETXOclpUaGabusXzWYo=
+            =sORA
+            -----END PGP MESSAGE-----
+          fp: A09B26095E5E2FF8BDCE66057338DF519EB5BFFD
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

deploy/values-front.yaml.gotmpl

+appName: rodolf
+host: {{ .StateValues.frontHost }}
+
+port: 3000
+
+image:
+  repo: {{ requiredEnv "CI_REGISTRY_IMAGE" }}/frontend
+  tag: {{ .StateValues.deployTag | ternary (requiredEnv "CI_COMMIT_REF_NAME") (requiredEnv "CI_COMMIT_HG_SHORT_SHA") }}
+  pullPolicy: Always
+
+env:
+  RODOLF_API_URL: https://rodolf-api.k.intra.logilab.fr/api
+
+ingress:
+  noindex: true
+  clusterIssuer: false
+  tlsSecret: false

deploy/values.yaml.gotmpl

+host: {{ .StateValues.host }}
+
+image: {{ requiredEnv "CI_REGISTRY_IMAGE" }}
+imageTag: {{ .StateValues.deployTag | ternary (requiredEnv "CI_COMMIT_REF_NAME") (requiredEnv "CI_COMMIT_HG_SHORT_SHA") }}
+
+backupPvcClaimName: backup
+
+readinessProbeUrl: /login
+livenessProbeUrl: /login
+
+sessionsInRedis: true
+scheduler: false
+
+ingress:
+  noindex: true
+  clusterIssuer: null
+  enabled: true
+  tls:
+    withSecret: false
+  annotations:
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/cors-allow-origin: '*'
+
+# backup
+backupBeforeCwUpgrade: {{ .StateValues.backupBeforeCwUpgrade }}
+restoreDbWithLatestBackupBeforeHelmRelease: {{ .StateValues.restoreDbWithLatestBackupBeforeHelmRelease }}
+backupCronJob: {{ .StateValues.backupCronJob }}
+
+# database
+runDbInitBeforeHelmRelease: true
+resetDbBeforeHelmRelease: {{ .StateValues.resetDbBeforeHelmRelease }}
+dropDbAfterDeletingHelmRelease: {{ .StateValues.dropDbAfterDeletingHelmRelease }}
+
+env:
+  CW_DB_HOST: pg.intra.logilab.fr
+  CW_DB_PORT: 5432
+  CW_DB_NAME: rodolf
+  CW_DB_USER: rodolf
+
+secretEnv:
+  CW_PASSWORD: {{ .StateValues.cwPassword }}
+  CW_DB_PASSWORD: {{ .StateValues.cwDbPassword }}
+  REDIS_SESSIONS_SECRET: {{ .StateValues.redisSessionsSecret }}

deploy/values_default.yaml

+deployTag: false
+review: false
+
+backupBeforeCwUpgrade: true
+restoreDbWithLatestBackupBeforeHelmRelease: false
+backupCronJob: false
+
+resetDbBeforeHelmRelease: false
+dropDbAfterDeletingHelmRelease: false

deploy/values_prod.yaml

+frontHost: rodolf.k.intra.logilab.fr
+host: rodolf-api.k.intra.logilab.fr
+deployTag: true
+
+backupCronJob: "0 1 * * *"
+