Complete interview solution
هذا الالتزام موجود في:
235
q3-cicd/README.md
Normal file
235
q3-cicd/README.md
Normal file
@@ -0,0 +1,235 @@
|
||||
# CI/CD Pipeline Documentation
|
||||
|
||||
This document describes the Continuous Integration and Continuous Deployment (CI/CD) pipeline implemented for the Ghaymah SRE exam.
|
||||
|
||||
---
|
||||
|
||||
# Pipeline Overview
|
||||
|
||||
The pipeline automates the application delivery process by:
|
||||
|
||||
1. Building a Docker image.
|
||||
2. Pushing the image to the Ghaymah Container Registry.
|
||||
3. Deploying automatically to the **Staging** environment.
|
||||
4. Waiting for **manual approval**.
|
||||
5. Deploying the same image to **Production**.
|
||||
|
||||
```
|
||||
Developer Push
|
||||
│
|
||||
▼
|
||||
GitHub Actions
|
||||
│
|
||||
▼
|
||||
Build Docker Image
|
||||
│
|
||||
▼
|
||||
Push to Ghaymah Container Registry
|
||||
│
|
||||
▼
|
||||
Deploy to Staging
|
||||
│
|
||||
▼
|
||||
Manual Approval
|
||||
│
|
||||
▼
|
||||
Deploy to Production
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
# Manual Approval for Production
|
||||
|
||||
Production deployments are protected using **GitHub Environments**.
|
||||
|
||||
## Configuration
|
||||
|
||||
1. Open the repository.
|
||||
|
||||
2. Navigate to:
|
||||
|
||||
```
|
||||
Settings
|
||||
→ Environments
|
||||
```
|
||||
|
||||
3. Create an environment named:
|
||||
|
||||
```
|
||||
production
|
||||
```
|
||||
|
||||
4. Enable:
|
||||
|
||||
- Required reviewers
|
||||
- (Optional) Wait timer
|
||||
- (Optional) Deployment branch restrictions
|
||||
|
||||
---
|
||||
|
||||
## Deployment Flow
|
||||
|
||||
After the application is successfully deployed to **Staging**, the workflow pauses before deploying to **Production**.
|
||||
|
||||
```
|
||||
Build
|
||||
│
|
||||
Deploy Staging
|
||||
│
|
||||
Waiting for Approval
|
||||
│
|
||||
Reviewer Approves
|
||||
│
|
||||
Deploy Production
|
||||
```
|
||||
|
||||
Only authorized reviewers can approve the deployment.
|
||||
|
||||
---
|
||||
|
||||
## Benefits
|
||||
|
||||
- Prevents accidental deployments.
|
||||
- Adds an approval gate before production.
|
||||
- Provides a complete audit trail.
|
||||
- Supports controlled production releases.
|
||||
|
||||
---
|
||||
|
||||
# Staging vs Production
|
||||
|
||||
| Feature | Staging | Production |
|
||||
|----------|----------|------------|
|
||||
| Purpose | Integration testing and QA | Live customer environment |
|
||||
| Users | Developers & QA | End users |
|
||||
| Data | Test or sanitized data | Real production data |
|
||||
| Replicas | Usually 1 | Usually 3 or more |
|
||||
| Resources | Lower CPU/Memory | Higher CPU/Memory |
|
||||
| Secrets | Test credentials | Production credentials |
|
||||
| Deployment | Automatic | Manual approval required |
|
||||
| Monitoring | Basic monitoring | Full monitoring and alerting |
|
||||
| Rollback | Low impact | Carefully managed |
|
||||
| Domain | staging.example.com | api.example.com |
|
||||
| Logging | Verbose | Optimized for production |
|
||||
|
||||
> **Best Practice**
|
||||
>
|
||||
> The **same Docker image** (identified by its commit SHA) should be promoted from **Staging** to **Production**. Rebuilding the image for Production should be avoided to guarantee consistency.
|
||||
|
||||
---
|
||||
|
||||
# Ghaymah CLI Integration
|
||||
|
||||
> **Note**
|
||||
>
|
||||
> The official Ghaymah CLI documentation was not provided with the exam. The following commands are **placeholders** and should be replaced with the official syntax when available.
|
||||
|
||||
---
|
||||
|
||||
## 1. Install CLI
|
||||
|
||||
```bash
|
||||
curl -sSL https://get.ghaymah.systems/cli/install.sh | sh
|
||||
|
||||
export PATH="$HOME/.ghaymah/bin:$PATH"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 2. Authenticate
|
||||
|
||||
```bash
|
||||
ghaymah login --token $GHAYMAH_TOKEN
|
||||
```
|
||||
|
||||
Authentication credentials should be stored securely using GitHub Secrets.
|
||||
|
||||
---
|
||||
|
||||
## 3. Deploy Application
|
||||
|
||||
```bash
|
||||
ghaymah deploy \
|
||||
--image registry.ghaymah.systems/ghaymah-api:latest \
|
||||
--name api-production \
|
||||
--port 5000 \
|
||||
--env FLASK_ENV=production \
|
||||
--replicas 3 \
|
||||
--health-check /health
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 4. Verify Deployment
|
||||
|
||||
```bash
|
||||
ghaymah status --name api-production
|
||||
|
||||
ghaymah logs --name api-production
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 5. Scale Application
|
||||
|
||||
```bash
|
||||
ghaymah scale \
|
||||
--name api-production \
|
||||
--replicas 5
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 6. Rollback
|
||||
|
||||
```bash
|
||||
ghaymah deploy \
|
||||
--image registry.ghaymah.systems/ghaymah-api:<previous-tag> \
|
||||
--name api-production \
|
||||
--port 5000
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
# GitHub Secrets
|
||||
|
||||
Sensitive information should **never** be stored in the repository.
|
||||
|
||||
Configure the following repository secrets:
|
||||
|
||||
| Secret | Description |
|
||||
|---------|-------------|
|
||||
| `GHAYMAH_USERNAME` | Container Registry username |
|
||||
| `GHAYMAH_TOKEN` | Access token used for authentication |
|
||||
|
||||
These secrets are referenced in the workflow as:
|
||||
|
||||
```yaml
|
||||
${{ secrets.GHAYMAH_USERNAME }}
|
||||
|
||||
${{ secrets.GHAYMAH_TOKEN }}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
# Best Practices
|
||||
|
||||
- Build the Docker image once and promote the same image between environments.
|
||||
- Tag every image with the Git commit SHA for traceability.
|
||||
- Keep secrets in **GitHub Secrets**, never in source code.
|
||||
- Protect Production using **GitHub Environment approvals**.
|
||||
- Enable Docker Buildx cache to reduce build time.
|
||||
- Use health checks before considering a deployment successful.
|
||||
- Maintain separate configurations for Staging and Production.
|
||||
- Document deployment and rollback procedures.
|
||||
- Monitor deployments and configure alerting for failures.
|
||||
|
||||
---
|
||||
|
||||
# References
|
||||
|
||||
- GitHub Actions Documentation
|
||||
- Docker Buildx Documentation
|
||||
- GitHub Environments Documentation
|
||||
|
||||
> Ghaymah CLI commands in this document are provided as implementation placeholders because the official CLI documentation was not included with the exam.
|
||||
@@ -0,0 +1,136 @@
|
||||
name: Build and Deploy to Ghaymah
|
||||
|
||||
on:
|
||||
# Run automatically when code is pushed to the main branch
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
|
||||
# Allow manual workflow execution from GitHub Actions
|
||||
workflow_dispatch:
|
||||
|
||||
env:
|
||||
# Replace with the official Ghaymah Container Registry URL
|
||||
REGISTRY: registry.ghaymah.systems
|
||||
|
||||
# Docker image name
|
||||
IMAGE_NAME: ghaymah-api
|
||||
|
||||
jobs:
|
||||
|
||||
# -------------------------------------------------------
|
||||
# Build the Docker image and push it to the registry
|
||||
# -------------------------------------------------------
|
||||
build-and-push:
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
|
||||
steps:
|
||||
# Check out the repository source code
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
# Enable Docker Buildx for advanced builds and caching
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
|
||||
# Authenticate with the container registry
|
||||
- name: Log in to Ghaymah Container Registry
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ${{ env.REGISTRY }}
|
||||
username: ${{ secrets.GHAYMAH_USERNAME }}
|
||||
password: ${{ secrets.GHAYMAH_TOKEN }}
|
||||
|
||||
# Build the Docker image and push it to the registry
|
||||
- name: Build and push Docker image
|
||||
uses: docker/build-push-action@v6
|
||||
with:
|
||||
# Path containing the Dockerfile
|
||||
context: ./q1-deploy-monitor
|
||||
|
||||
# Push the image after a successful build
|
||||
push: true
|
||||
|
||||
# Publish two image tags:
|
||||
# - latest
|
||||
# - commit SHA for traceability
|
||||
tags: |
|
||||
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
|
||||
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
|
||||
|
||||
# Enable Docker layer caching
|
||||
cache-from: type=gha
|
||||
cache-to: type=gha,mode=max
|
||||
|
||||
# -------------------------------------------------------
|
||||
# Deploy the application to the staging environment
|
||||
# -------------------------------------------------------
|
||||
deploy-staging:
|
||||
needs: build-and-push
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
# GitHub Environment
|
||||
environment: staging
|
||||
|
||||
steps:
|
||||
# Install the Ghaymah CLI
|
||||
# Replace with the official installation command if different
|
||||
- name: Install Ghaymah CLI
|
||||
run: |
|
||||
curl -sSL https://get.ghaymah.systems/cli/install.sh | sh
|
||||
echo "$HOME/.ghaymah/bin" >> $GITHUB_PATH
|
||||
|
||||
# Deploy the application to staging
|
||||
# Replace the commands below with the official CLI syntax if needed
|
||||
- name: Deploy to Staging
|
||||
env:
|
||||
GHAYMAH_TOKEN: ${{ secrets.GHAYMAH_TOKEN }}
|
||||
|
||||
run: |
|
||||
ghaymah login --token $GHAYMAH_TOKEN
|
||||
|
||||
ghaymah deploy \
|
||||
--image ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} \
|
||||
--name api-staging \
|
||||
--port 5000 \
|
||||
--env FLASK_ENV=staging \
|
||||
--replicas 1
|
||||
|
||||
# -------------------------------------------------------
|
||||
# Deploy the application to the production environment
|
||||
# -------------------------------------------------------
|
||||
deploy-production:
|
||||
needs: deploy-staging
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
# Configure this environment with required reviewers
|
||||
# to enable manual approval before deployment
|
||||
environment: production
|
||||
|
||||
steps:
|
||||
# Install the Ghaymah CLI
|
||||
- name: Install Ghaymah CLI
|
||||
run: |
|
||||
curl -sSL https://get.ghaymah.systems/cli/install.sh | sh
|
||||
echo "$HOME/.ghaymah/bin" >> $GITHUB_PATH
|
||||
|
||||
# Deploy the application to production
|
||||
# This job runs only after manual approval
|
||||
- name: Deploy to Production
|
||||
env:
|
||||
GHAYMAH_TOKEN: ${{ secrets.GHAYMAH_TOKEN }}
|
||||
|
||||
run: |
|
||||
ghaymah login --token $GHAYMAH_TOKEN
|
||||
|
||||
ghaymah deploy \
|
||||
--image ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} \
|
||||
--name api-production \
|
||||
--port 5000 \
|
||||
--env FLASK_ENV=production \
|
||||
--replicas 3 \
|
||||
--health-check /health
|
||||
المرجع في مشكلة جديدة
حظر مستخدم