Merge branch 'dev'

.github/workflows/deploy-base.yaml

@@ -23,7 +23,7 @@ env:
 jobs:
   deploy:
     timeout-minutes: 10
-    runs-on: [self-hosted, ubuntu-focal]
+    runs-on: ubuntu-20.04
     environment:
       url: ${{ inputs.env_url }}
       name: ${{ inputs.env_name }}

.github/workflows/deploy-dev.yaml

@@ -9,7 +9,7 @@ on:
       - ".vscode/**"
 
 concurrency:
-  group: deploy-${{ github.ref }}
+  group: deploy-dev
   cancel-in-progress: true
 
 jobs:
@@ -17,12 +17,10 @@ jobs:
     name: Setup
     runs-on: ubuntu-20.04
     env:
-      IMAGE_REPO: reg.dev.krd/dit-docs/dsm-client
+      IMAGE: "reg.dev.krd/dit-docs/dsm-client:${{ github.ref_name }}"
     steps:
       - name: Extract image name
-        run: |
+        run: echo "Using image name $IMAGE"
-          REF_NAME=$(echo ${GITHUB_REF##*/})
-          echo "IMAGE=$IMAGE_REPO:$REF_NAME" >> $GITHUB_ENV
     outputs:
       image: ${{ env.IMAGE }}
       image-sha: ${{ env.IMAGE }}-${{ github.sha }}
@@ -30,21 +28,35 @@ jobs:
   test:
     uses: ditkrg/dit-digital-service-manual/.github/workflows/tests-base.yaml@dev
 
-  build:
+  build-push:
-    uses: ditkrg/common-github-workflows/.github/workflows/build-push-image.yaml@main
+    name: Build and Push
     needs: [setup, test]
+    runs-on: ubuntu-20.04
+    timeout-minutes: 10
+    steps:
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+
+      - name: Login to Registry
+        uses: docker/login-action@v1
         with:
+          registry: reg.dev.krd
+          username: ${{ secrets.HARBOR_PUBLIC_USER }}
+          password: ${{ secrets.HARBOR_PUBLIC_TOKEN }}
+
+      - name: Build and push Docker images
+        uses: docker/build-push-action@v2
+        with:
+          push: true
           tags: |-
             ${{ needs.setup.outputs.image }}
             ${{ needs.setup.outputs.image-sha }}
           cache-from: type=registry,ref=${{ needs.setup.outputs.image }}
-    secrets:
+          cache-to: type=inline
-      username: ${{ secrets.HARBOR_USER }}
-      password: ${{ secrets.HARBOR_TOKEN }}
 
   deploy:
     uses: ditkrg/dit-digital-service-manual/.github/workflows/deploy-base.yaml@dev
-    needs: [setup, build]
+    needs: [setup, build-push]
     with:
       image: ${{ needs.setup.outputs.image-sha }}
       env_url: https://service-manual.docs.dev.krd

.github/workflows/deploy-production.yaml

@@ -28,21 +28,35 @@ jobs:
   test:
     uses: ditkrg/dit-digital-service-manual/.github/workflows/tests-base.yaml@main
 
-  build:
+  build-push:
-    uses: ditkrg/common-github-workflows/.github/workflows/build-push-image.yaml@main
+    name: Build and Push
     needs: [setup, test]
+    runs-on: ubuntu-20.04
+    timeout-minutes: 10
+    steps:
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+
+      - name: Login to Registry
+        uses: docker/login-action@v1
         with:
+          registry: reg.dev.krd
+          username: ${{ secrets.HARBOR_PUBLIC_USER }}
+          password: ${{ secrets.HARBOR_PUBLIC_TOKEN }}
+
+      - name: Build and push Docker images
+        uses: docker/build-push-action@v2
+        with:
+          push: true
           tags: |-
             ${{ needs.setup.outputs.image }}
             ${{ needs.setup.outputs.image-sha }}
           cache-from: type=registry,ref=${{ needs.setup.outputs.image }}
-    secrets:
+          cache-to: type=inline
-      username: ${{ secrets.HARBOR_USER }}
-      password: ${{ secrets.HARBOR_TOKEN }}
 
   deploy:
     uses: ditkrg/dit-digital-service-manual/.github/workflows/deploy-base.yaml@main
-    needs: [setup, build]
+    needs: [setup, build-push]
     with:
       image: ${{ needs.setup.outputs.image-sha }}
       env_url: https://docs.digital.gov.krd

.github/workflows/tests-base.yaml

@@ -24,7 +24,7 @@ jobs:
       - name: Build k8s manifests
         working-directory: kubernetes
         run: |
-          envs=( "development" )
+          envs=( "development" "production" )
 
           for i in "${envs[@]}"
           do 

.github/workflows/tests-run.yaml

@@ -7,9 +7,8 @@ on:
       - staging
       - main
     paths-ignore:
-      - "**.md"
+      - "README.md"
       - ".vscode/**"
-  pull_request:
 
 jobs:
   run-tests:
@@ -32,7 +31,7 @@ jobs:
       - name: Build k8s manifests
         working-directory: kubernetes
         run: |
-          envs=( "development" )
+          envs=( "development" "production" )
 
           for i in "${envs[@]}"
           do 

Dockerfile

@@ -1,4 +1,4 @@
-FROM reg.dev.krd/hub.docker/library/node:16 as build-stage
+FROM node:16 as build-stage
 
 WORKDIR /app
 
@@ -13,8 +13,7 @@ COPY *.js ./
 
 RUN npm run build
 
-FROM reg.dev.krd/hub.docker/library/nginx:1.20-alpine AS production
+FROM nginxinc/nginx-unprivileged:1.20-alpine AS production
 
 COPY --from=build-stage /app/build /usr/share/nginx/html
-COPY nginx.conf /etc/nginx/conf.d/default.conf
+EXPOSE 8080
-EXPOSE 80

kubernetes/base/deployment.yaml

@@ -17,6 +17,12 @@ spec:
         app: dsm-client
 
     spec:
+      securityContext:
+        fsGroup: 101
+        runAsUser: 101
+        runAsGroup: 101
+        runAsNonRoot: true
+
       containers:
         - name: dsm-client
           image: IMAGE
@@ -28,11 +34,22 @@ spec:
               memory: 32Mi
               cpu: 5m
           ports:
-            - containerPort: 80
+            - name: http
+              containerPort: 8080
 
           livenessProbe:
+            tcpSocket:
+              port: http
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 6
+            successThreshold: 1
+
+          readinessProbe:
+            tcpSocket:
+              port: http
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 3
+            successThreshold: 1
             initialDelaySeconds: 5
-            periodSeconds: 15
-            httpGet:
-              path: /health
-              port: 80

kubernetes/base/service.yaml

@@ -10,4 +10,5 @@ spec:
     app: dsm-client
   ports:
     - port: 80
+      targetPort: 8080
   type: ClusterIP

nginx.conf

@@ -1,15 +0,0 @@
-server {
-    listen      80;
-    server_name  _;
-
-    location / {
-        root   /usr/share/nginx/html;
-        try_files $uri $uri/ /index.html;
-    }
-
-    location /health {
-        access_log off;
-        default_type text/plain;
-        return 200 "Healthy\n";
-    }
-}