Merge pull request #12 from bcgov/feat/build-docker

chore: gh action

.github/workflows/build.yml

@@ -0,0 +1,56 @@
+name: Build estimation tool
+
+on:
+  push:
+    branches: [develop, main]
+  pull_request:
+    branches: [develop, main]
+
+jobs:
+  docker-build:
+    runs-on: ubuntu-latest
+    name: Build docker image
+    steps:
+      - uses: actions/checkout@v3
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v2
+        with:
+          install: true
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v3
+        with:
+          images: ghcr.io/bcgov/cas-estimation-tool
+          tags: |
+            type=sha,format=long,prefix=
+            latest
+            type=ref,event=pr
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Cache Docker layers
+        uses: actions/cache@v3
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-estimation-tool-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-estimation-tool
+      - name: Build image
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          builder: ${{ steps.buildx.outputs.name }}
+          push: true
+          file: Dockerfile
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=local,src=/tmp/.buildx-cache
+          cache-to: type=local,dest=/tmp/.buildx-cache-new
+      - name: Move cache
+        run: |
+          rm -rf /tmp/.buildx-cache
+          mv /tmp/.buildx-cache-new /tmp/.buildx-cache

estimation/Dockerfile → Dockerfile

@@ -1,5 +1,5 @@
 # Use the official Python image from the Docker Hub
-FROM python:3.10-slim
+FROM python:3.12-slim
 
 # Set environment variables
 ENV PYTHONDONTWRITEBYTECODE 1

estimation/estimation/settings.py

@@ -29,7 +29,14 @@
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = True
 
-ALLOWED_HOSTS = ["0.0.0.0", "localhost", "127.0.0.1"]
+ALLOWED_HOSTS = [
+    "0.0.0.0",
+    "localhost",
+    "127.0.0.1",
+    "cas-estimation-tool.apps.silver.devops.gov.bc.ca",
+]
+
+CSRF_TRUSTED_ORIGINS = ["https://cas-estimation-tool.apps.silver.devops.gov.bc.ca"]
 
 
 # Application definition
@@ -81,7 +88,7 @@
 DATABASES = {
     "default": {
         "ENGINE": "django.db.backends.postgresql",
-        "NAME": os.environ.get("PGDATBASE", "estimation"),  # database name
+        "NAME": os.environ.get("PGDATABASE", "estimation"),  # database name
         "USER": os.environ.get("PGUSER", "postgres"),
         "PASSWORD": os.environ.get("PGPASSWORD"),
         "HOST": os.environ.get("PGHOST", "localhost"),
@@ -123,12 +130,13 @@
 
 USE_TZ = True
 
-#github details
-
-GITHUB_CLIENT_ID = os.environ.get('GITHUB_CLIENT_ID', '')
-GITHUB_CLIENT_SECRET = os.environ.get('GITHUB_CLIENT_SECRET', '')
-GITHUB_REDIRECT_URI = os.environ.get('GITHUB_REDIRECT_URI', 'http://localhost:8000/github/callback/')
+# github details
 
+GITHUB_CLIENT_ID = os.environ.get("GITHUB_CLIENT_ID", "")
+GITHUB_CLIENT_SECRET = os.environ.get("GITHUB_CLIENT_SECRET", "")
+GITHUB_REDIRECT_URI = os.environ.get(
+    "GITHUB_REDIRECT_URI", "http://localhost:8000/github/callback/"
+)
 
 
 # Static files (CSS, JavaScript, Images)

helm/cas-estimation-tool/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

helm/cas-estimation-tool/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: cas-estimation-tool
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"

helm/cas-estimation-tool/templates/_helpers.tpl

@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "cas-estimation-tool.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "cas-estimation-tool.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "cas-estimation-tool.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "cas-estimation-tool.labels" -}}
+helm.sh/chart: {{ include "cas-estimation-tool.chart" . }}
+{{ include "cas-estimation-tool.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "cas-estimation-tool.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "cas-estimation-tool.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "cas-estimation-tool.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "cas-estimation-tool.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

helm/cas-estimation-tool/templates/deployment.yaml

@@ -0,0 +1,66 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "cas-estimation-tool.fullname" . }}
+  labels: {{ include "cas-estimation-tool.labels" . | nindent 4 }}
+spec:
+  selector:
+    matchLabels: {{ include "cas-estimation-tool.selectorLabels" . | nindent 6 }}
+  replicas: 1
+  template:
+    metadata:
+      labels: {{ include "cas-estimation-tool.labels" . | nindent 8 }}
+    spec:
+      imagePullSecrets:
+        - name: dockerhub-registry
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "ghcr.io/bcgov/cas-estimation-tool:latest"
+          imagePullPolicy: Always
+          env:
+          - name: GITHUB_CLIENT_ID
+            valueFrom:
+              secretKeyRef: 
+                name: "cas-estimation-tool-github"
+                key: client_id
+          - name: GITHUB_CLIENT_SECRET
+            valueFrom:
+              secretKeyRef: 
+                name: "cas-estimation-tool-github"
+                key: client_secret
+          - name: GITHUB_REDIRECT_URI
+            value: https://cas-estimation-tool.apps.silver.devops.gov.bc.ca/github/callback/
+          - name: TEAM_MEMBERS
+            valueFrom:
+              secretKeyRef: 
+                name: "cas-estimation-tool-github"
+                key: team_members
+          - name: PGDATABASE
+            value: estimation
+          - name: PGUSER
+            valueFrom:
+              secretKeyRef:
+                name: "{{ .Values.databaseSecretName }}"
+                key: user
+          - name: PGPASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: "{{ .Values.databaseSecretName }}"
+                key: password
+          - name: PGHOST
+            valueFrom:
+              secretKeyRef:
+                name: "{{ .Values.databaseSecretName }}"
+                key: host
+          - name: PGPORT
+            value: "5432"
+
+          ports:
+            - containerPort: 8000
+          resources:
+            limits:
+              cpu: 250m
+              memory: 1Gi
+            requests:
+              cpu: 25m
+              memory: 512Mi

helm/cas-estimation-tool/templates/network_policy.yaml

@@ -0,0 +1,37 @@
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: {{ include "cas-estimation-tool.fullname" . }}-db-access
+  labels: {{ include "cas-estimation-tool.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: cas-estimation-db
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              release: {{ include "cas-estimation-tool.name" . }}
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/instance: {{ include "cas-estimation-tool.name" . }}
+
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "cas-estimation-tool.fullname" . }}-allow-from-openshift-ingress
+spec:
+  # This policy allows any pod with a route & service combination
+  # to accept traffic from the OpenShift router pods. This is
+  # required for things outside of OpenShift (like the Internet)
+  # to reach your pods.
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              network.openshift.io/policy-group: ingress
+  podSelector: {}
+  policyTypes:
+    - Ingress
+

helm/cas-estimation-tool/templates/route.yaml

@@ -0,0 +1,20 @@
+apiVersion: route.openshift.io/v1
+kind: Route
+metadata:
+  name: {{ template "cas-estimation-tool.fullname" . }}
+  labels:
+{{ include "cas-estimation-tool.labels" . | nindent 4 }}
+  annotations:
+    haproxy.router.openshift.io/balance: roundrobin
+spec:
+  host: cas-estimation-tool.apps.silver.devops.gov.bc.ca
+  port:
+    targetPort: {{ template "cas-estimation-tool.fullname" . }}
+  tls:
+    termination: edge
+    insecureEdgeTerminationPolicy: Redirect
+  to:
+    kind: Service
+    name: {{ template "cas-estimation-tool.fullname" . }}
+    weight: 100
+  wildcardPolicy: None

helm/cas-estimation-tool/templates/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "cas-estimation-tool.fullname" . }}
+  labels: {{ include "cas-estimation-tool.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 8000
+      protocol: TCP
+      name: {{ template "cas-estimation-tool.fullname" . }}
+  selector: {{ include "cas-estimation-tool.selectorLabels" . | nindent 4 }}

helm/cas-estimation-tool/values.yaml

@@ -0,0 +1 @@
+databaseSecretName: cas-estimation-db-cas-postgres-cluster-pguser-postgres

helm/database/values.yaml

@@ -0,0 +1,22 @@
+postgresCluster:
+  storageSize: 400Mi
+  postgres:
+    replicaCount: 2
+  pgbouncer:
+    replicaCount: 2
+
+  # The "users" value(s) is passed to the crunchy postgres operator to create the database.
+  # See https://access.crunchydata.com/documentation/postgres-operator/latest/tutorials/basic-setup/user-management
+  users:
+    - name: postgres
+      options: "SUPERUSER"
+    - name: estimation
+      databases:
+        - estimation
+
+gcsBackups:
+  enable: false
+
+# To configure a KNP allowing external access, for metabase for example
+external-access:
+  enabled: false

helm/deploy_db.sh

@@ -0,0 +1,12 @@
+
+set -euo pipefail
+
+echo "Installing database chart: cas-postgres/cas-postgres-cluster..."
+
+helm repo add cas-postgres https://bcgov.github.io/cas-postgres/
+helm repo update
+
+helm upgrade --install --atomic --timeout 1800s \
+  --namespace "599f0a-dev" \
+  --values ./database/values.yaml \
+  cas-estimation-db cas-postgres/cas-postgres-cluster --version 1.1.1