CD

.github/workflows/cd.yaml

@@ -0,0 +1,94 @@
+name: cd
+
+on:
+  workflow_run:
+    workflows: ["Build and push API image"]
+    types: [completed]
+    branches: [main]
+
+permissions:
+  id-token: write
+  contents: read
+
+env:
+  AWS_REGION: us-east-1
+  EKS_CLUSTER: control-cluster
+  ECR_REPOSITORY: control-api
+  NAMESPACE: control-ns
+
+jobs:
+  mirror-to-ecr:
+    if: >
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'push'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    outputs:
+      tag: ${{ steps.image.outputs.tag }}
+    steps:
+      - name: Extract image tag
+        id: image
+        run: echo "tag=sha-${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          role-session-name: github-actions-deploy
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Login to ECR
+        uses: aws-actions/amazon-ecr-login@v2
+
+      - name: Mirror GHCR image to ECR
+        env:
+          GHCR_IMAGE: ghcr.io/${{ github.repository_owner }}/control-api:${{ steps.image.outputs.tag }}
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+        run: |
+          docker pull "$GHCR_IMAGE"
+          docker tag "$GHCR_IMAGE" "$ECR_REGISTRY/${{ env.ECR_REPOSITORY }}:${{ steps.image.outputs.tag }}"
+          docker push "$ECR_REGISTRY/${{ env.ECR_REPOSITORY }}:${{ steps.image.outputs.tag }}"
+
+  deploy:
+    needs: mirror-to-ecr
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: azure/setup-helm@v4
+        with:
+          version: v3.16.0
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          role-session-name: github-actions-deploy
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Update kubeconfig
+        run: aws eks update-kubeconfig --name ${{ env.EKS_CLUSTER }} --region ${{ env.AWS_REGION }}
+
+      - name: helm upgrade
+        run: |
+          helm upgrade control deploy/helm/control-api \
+            --install \
+            --namespace ${{ env.NAMESPACE }} \
+            --reuse-values \
+            --set api.image.repository=${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }} \
+            --set api.image.tag=${{ needs.mirror-to-ecr.outputs.tag }} \
+            --wait --timeout 3m
+
+  notify:
+    needs: [deploy]
+    if: always()
+    uses: ./.github/workflows/notify-discord.yml
+    with:
+      status: ${{ contains(needs.*.result, 'failure') && 'failure' || 'success' }}
+      pipeline: "cd"
+    secrets: inherit

README.md

@@ -5,7 +5,7 @@
 ## Description
 A Feature Flag service, self hosted or AWS cloud native.
 
-## Currently it supports 
+## Supported Features (for now)
 - RBAC authorization natively
 - TUI client so it can work on servers locally without needing a display env or compositor (and to cut cloud costs)
 - You can only sign from the register endpoint, so you can't create an account from TUI to prevent dummy projects from existing (mostly, you still can use a regular client like **curl** or **postman** to create them like the demo)
@@ -14,7 +14,10 @@ A Feature Flag service, self hosted or AWS cloud native.
 - Flag state is visible depending on time (unchanged for so long or not)
 - Only one admin per project, to prevent collisions
 - Deployable on **AWS Cloud** or locally on an **on-premise** server 
-- Supports **TLS** termination on the api layer (not end-to-end)
+- Supports **TLS** termination on the api layer (not end-to-end at the pod level, since it's on the ingress controller side mainly)
+- Dynamic **auto-scaling** depending on resource usage (local and cloud)
+- Auto image build, push api to **GHCR** and **AWS ECR** via GitHub Actions 
+- The tui is standalone but can be used be used with docker (image is auto built and pushed to **GHCR**) 
 - All data are backed up regularly (configurable)
 
 > **Note:** If you want to fork this project make sure to configure the secrets on your behalf as well
@@ -188,6 +191,7 @@ control
 │       ├── ci.yaml   # Continuous integration workflow file
 │       ├── api-image.yaml # Build and push to GHCR 
 │       ├── tui-image.yaml # Build and push to GHCR 
+│       ├── cd.yaml  # Continuous deployment workflow file 
 │       └── discord-notify.yaml 
 └── .gitignore
 ```