diff --git a/.github/workflows/cd-build.yml b/.github/workflows/cd-build.yml new file mode 100644 index 0000000..aa35ad7 --- /dev/null +++ b/.github/workflows/cd-build.yml @@ -0,0 +1,79 @@ +name: CD Build Pipeline + +on: + push: + branches: [dev,test,main] + +jobs: + build: + name: Build Applications + runs-on: + - kubernetes #Runner cloud (default) + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Build in maven + with: + skip-tests: true + uses: codeparce/ci-workflows/.github/actions/build/maven@v1 + + docker-publish: + name: Dokcer Publish + needs: [ build] + permissions: + contents: read + packages: write + runs-on: + - kubernetes #Runner on-premise + #- ubuntu-latest #Runner cloud (default) + steps: + - uses: actions/checkout@v4 + + - name: Download build artifact + uses: actions/download-artifact@v4 + with: + name: service-build + path: target + + - name: Publish to Docker Hub + uses: codeparce/ci-workflows/.github/actions/docker@v1 + with: + target-branch: ${{ github.sha }} + account-name: ${{ secrets.DOCKER_ACCOUNT_NAME}} + access-token: ${{ secrets.DOCKER_ACCESS_TOKEN }} + + + scan-image: + name: Scan Docker Image + needs: docker-publish + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - name: Login to Registry + uses: docker/login-action@v3 + with: + username: ${{ secrets.DOCKER_ACCOUNT_NAME}} + password: ${{ secrets.DOCKER_ACCESS_TOKEN }} + + - name: Trivy image scan + uses: aquasecurity/trivy-action@v0.36.0 + with: + scan-type: image + image-ref: ${{ secrets.DOCKER_ACCOUNT_NAME}}/${{ github.event.repository.name }}:${{ github.sha }} + scanners: vuln,secret + vuln-type: os,library + severity: HIGH,CRITICAL + ignore-unfixed: true + format: table + output: trivy-results.txt + exit-code: '0' # bypass + + - name: Summary of Trivy Scan Results + if: always() + uses: codeparce/ci-workflows/.github/actions/github/summary@v1 + with: + scaner-name: Image Scaner + report-file: trivy-results.txt diff --git a/.github/workflows/cd-deploy-cloud.yml b/.github/workflows/cd-deploy-cloud.yml index da8cf6d..df21263 100644 --- a/.github/workflows/cd-deploy-cloud.yml +++ b/.github/workflows/cd-deploy-cloud.yml @@ -1,8 +1,12 @@ -name: CD Actions Pipeline (deploy aws) +name: CD Deploy in AWS on: workflow_dispatch: - + branches: + - dev + - test + - main + permissions: contents: read id-token: write @@ -43,10 +47,15 @@ jobs: working-directory: IaC run: | envsubst < provider.tf.template> provider.tf - terraform init + terraform init > terraform.log 2> error.log - name: Deploy en aws working-directory: IaC run: | - terraform apply -auto-approve - echo "✅ Deploy completado" + terraform apply -input=false > terraform.log 2> error.log + echo "✅ Deploy completado" >> error.log + + - name: Check Execution + if: always() + working-directory: IaC + run: cat error.log \ No newline at end of file diff --git a/.github/workflows/cd-deploy-kb.yml b/.github/workflows/cd-deploy-kb.yml index 3a6e455..9a788b9 100644 --- a/.github/workflows/cd-deploy-kb.yml +++ b/.github/workflows/cd-deploy-kb.yml @@ -1,86 +1,16 @@ -name: CD Actions Pipeline (kuberenets on-premise) +name: CD Deploy Kuberenets on-premise on: workflow_dispatch: - + branches: + - dev + - test + - main + jobs: - build: - name: Build Applications - runs-on: - - kubernetes #Runner cloud (default) - steps: - - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - name: Build in maven - with: - skip-tests: true - uses: codeparce/ci-workflows/.github/actions/build/maven@v1 - - docker-publish: - name: Dokcer Publish - needs: [ build] - permissions: - contents: read - packages: write - runs-on: - - kubernetes #Runner on-premise - #- ubuntu-latest #Runner cloud (default) - steps: - - uses: actions/checkout@v4 - - - name: Download build artifact - uses: actions/download-artifact@v4 - with: - name: service-build - path: target - - - name: Publish to Docker Hub - uses: codeparce/ci-workflows/.github/actions/docker@v1 - with: - target-branch: ${{ github.sha }} - account-name: ${{ secrets.DOCKER_ACCOUNT_NAME}} - access-token: ${{ secrets.DOCKER_ACCESS_TOKEN }} - - - scan-image: - name: Scan Docker Image - needs: docker-publish - runs-on: ubuntu-latest - permissions: - contents: read - steps: - - name: Login to Registry - uses: docker/login-action@v3 - with: - username: ${{ secrets.DOCKER_ACCOUNT_NAME}} - password: ${{ secrets.DOCKER_ACCESS_TOKEN }} - - - name: Trivy image scan - uses: aquasecurity/trivy-action@v0.36.0 - with: - scan-type: image - image-ref: ${{ secrets.DOCKER_ACCOUNT_NAME}}/${{ github.event.repository.name }}:${{ github.sha }} - scanners: vuln,secret - vuln-type: os,library - severity: HIGH,CRITICAL - ignore-unfixed: true - format: table - output: trivy-results.txt - exit-code: '0' # bypass - - - name: Summary of Trivy Scan Results - if: always() - uses: codeparce/ci-workflows/.github/actions/github/summary@v1 - with: - scaner-name: Image Scaner - report-file: trivy-results.txt - deploy: runs-on: kubernetes #Runner on-premise name: Deploy in Kubernetes - needs: docker-publish env: GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }} GITHUB_REF_NAME: ${{ github.ref_name }} diff --git a/.github/workflows/ci-pipeline.yml b/.github/workflows/ci-pipeline.yml index 5ea31b6..e5c6759 100644 --- a/.github/workflows/ci-pipeline.yml +++ b/.github/workflows/ci-pipeline.yml @@ -2,7 +2,7 @@ name: CI Actions Pipeline on: pull_request: - branches: [dev,test] + branches: [dev,test,main] workflow_dispatch: jobs: diff --git a/.gitignore b/.gitignore index 6cd0124..36416bc 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,4 @@ HELP.md -INTI.MD -CHECKLIST_ES.md values.yaml target/ !.mvn/wrapper/maven-wrapper.jar diff --git a/DEMO.md b/DEMO.md new file mode 100644 index 0000000..e421cd2 --- /dev/null +++ b/DEMO.md @@ -0,0 +1,142 @@ +# Demo Devops Java + +This is a simple application to be used in the technical test of DevOps. + +## Getting Started + +### Prerequisites + +- Java Version 17 +- Spring Boot 3.0.5 +- Maven + +### Installation + +Clone this repo. + +```bash +git clone https://bitbucket.org/devsu/demo-devops-java.git +``` + +### Database + +The database is generated as a file in the main path when the project is first run, and its name is `test.mv.db`. + +Consider giving access permissions to the file for proper functioning. + +## Usage + +To run tests you can use this command. + +```bash +mvn clean test +``` + +To run locally the project you can use this command. + +```bash +mvn spring-boot:run +``` + +Open http://127.0.0.1:8000/api/swagger-ui.html with your browser to see the result. + +### Features + +These services can perform, + +#### Create User + +To create a user, the endpoint **/api/users** must be consumed with the following parameters: + +```bash + Method: POST +``` + +```json +{ + "dni": "dni", + "name": "name" +} +``` + +If the response is successful, the service will return an HTTP Status 200 and a message with the following structure: + +```json +{ + "id": 1, + "dni": "dni", + "name": "name" +} +``` + +If the response is unsuccessful, we will receive status 400 and the following message: + +```json +{ + "errors": [ + "error" + ] +} +``` + +#### Get Users + +To get all users, the endpoint **/api/users** must be consumed with the following parameters: + +```bash + Method: GET +``` + +If the response is successful, the service will return an HTTP Status 200 and a message with the following structure: + +```json +[ + { + "id": 1, + "dni": "dni", + "name": "name" + } +] +``` + +#### Get User + +To get an user, the endpoint **/api/users/** must be consumed with the following parameters: + +```bash + Method: GET +``` + +If the response is successful, the service will return an HTTP Status 200 and a message with the following structure: + +```json +{ + "id": 1, + "dni": "dni", + "name": "name" +} +``` + +If the user id does not exist, we will receive status 404 and the following message: + +```json +{ + "errors": [ + "User not found: " + ] +} +``` + +If the response is unsuccessful, we will receive status 400 and the following message: + +```json +{ + "errors": [ + "error" + ] +} +``` + +## License + +Copyright © 2023 Devsu. All rights reserved. diff --git a/INTI.MD b/INTI.MD new file mode 100644 index 0000000..5fcdac6 --- /dev/null +++ b/INTI.MD @@ -0,0 +1,20 @@ +# devsu-demo-devops-java + +Repositorio devsu-demo-devops-java: https://github.com/codeparceorg/devsu-demo-devops-java + +pipeline Despliegue kuberentes (CD): https://github.com/codeparceorg/devsu-demo-devops-java/actions/workflows/cd-deploy-kb.yml + +pipeline Despliegue aws (CD): https://github.com/codeparceorg/devsu-demo-devops-java/actions/workflows/cd-deploy-cloud.yml + +pipeline Build y publish (CI): https://github.com/codeparceorg/devsu-demo-devops-java/actions/workflows/cd-build.yml + +pipeline Validate y Scan (CI): https://github.com/codeparceorg/devsu-demo-devops-java/actions/workflows/ci-pipeline.yml + + +# infra-microservice-aws + +Repositorio infra-microservice-aws: https://github.com/codeparceorg/infra-microservice-aws + +pipeline Despliegue aws (CD): https://github.com/codeparceorg/infra-microservice-aws/actions/workflows/cd-deploy.yml + +pipeline terraform Inti: https://github.com/codeparceorg/infra-microservice-aws/actions/workflows/ci-init.yml diff --git a/IaC/.env b/IaC/.env deleted file mode 100644 index f780b8c..0000000 --- a/IaC/.env +++ /dev/null @@ -1,11 +0,0 @@ -TF_VAR_aws_region=us-east-1 -TF_VAR_repository_name=devsu-demo-devops-java -TF_VAR_environment=${TARGET_BRANCH} -TF_VAR_port=8000 - -TF_VAR_health_check_path=/api/users -TF_VAR_path_pattern='["/api/users", "/api/users/*"]' - -TF_VAR_image_name=codeparce/${GITHUB_REPOSITORY_NAME}:${GITHUB_SHA} - -TF_VAR_backend_infra=devsu/aws-microservice-ecs/${TARGET_BRANCH}_terraform.tfstate diff --git a/IaC/.exmaple.env b/IaC/.exmaple.env index 7e46610..e2a3039 100644 --- a/IaC/.exmaple.env +++ b/IaC/.exmaple.env @@ -1,11 +1,15 @@ +TARGET_BRANCH=test +GITHUB_REPOSITORY_NAME=devsu-demo-devops-java +GITHUB_SHA=90ea656bafb1cab94852a5bdaa356bee9840a9eb + TF_VAR_aws_region=us-east-1 -TF_VAR_repository_name=devsu-demo-devops-java -TF_VAR_environment=test +TF_VAR_repository_name=${GITHUB_REPOSITORY_NAME} +TF_VAR_environment=${TARGET_BRANCH} TF_VAR_port=8000 TF_VAR_health_check_path=/api/users TF_VAR_path_pattern='["/api/users", "/api/users/*"]' -TF_VAR_image_name=codeparce/devsu-demo-devops-java:90ea656bafb1cab94852a5bdaa356bee9840a9eb +TF_VAR_image_name=codeparce/${GITHUB_REPOSITORY_NAME}:${GITHUB_SHA} -TF_VAR_backend_infra=devsu/aws-microservice-ecs/test_terraform.tfstate +TF_VAR_backend_infra=devsu/infra-microservice-aws/${TARGET_BRANCH}_terraform.tfstate diff --git a/IaC/.gitignore b/IaC/.gitignore new file mode 100644 index 0000000..2c099a4 --- /dev/null +++ b/IaC/.gitignore @@ -0,0 +1,34 @@ +# Terraform working directory and downloaded providers +.terraform/ +**/.terraform/* + +backend.hcl +*.json + +# Terraform state and backups +*.tfstate +*.tfstate.* +*.tfstate.backup +provider.tf + +.terraform.lock.hcl +# Terraform crash logs +crash.log +crash.*.log + +# Variable files may contain secrets or environment-specific values +*.tfvars +*.tfvars.json +!*.tfvars.example +!*.tfvars.example.json + +# Local override files +override.tf +override.tf.json +*_override.tf +*_override.tf.json + +# CLI configuration and plan output +.terraformrc +terraform.rc +*.plan diff --git a/IaC/variable.tf b/IaC/variable.tf index b3098af..eb28733 100644 --- a/IaC/variable.tf +++ b/IaC/variable.tf @@ -19,11 +19,6 @@ variable "port" { type = number } -variable "vpc_id" { - description = "VPC ID where the infrastructure will be deployed." - type = string -} - variable "path_pattern" { description = "Path pattern for the listener rule" type = list(string) diff --git a/README.md b/README.md index e421cd2..3671701 100644 --- a/README.md +++ b/README.md @@ -1,142 +1,41 @@ -# Demo Devops Java +# Demo DevOps Java -This is a simple application to be used in the technical test of DevOps. +Microservicio de usuarios (Spring Boot) con infraestructura en AWS ECS, despliegue alternativo en Kubernetes on-premise y pipelines CI/CD en GitHub Actions. -## Getting Started +Uso local y API completa: ver [DEMO.md](DEMO.md). -### Prerequisites +## Infraestructura -- Java Version 17 -- Spring Boot 3.0.5 -- Maven +Todo lo declarado está en `IaC/` (Terraform, AWS `us-east-1`) y `kubernetes/` (chart Helm `ms-template`). -### Installation +- **AWS ECS (Terraform):** declara `aws_lb_target_group` (HTTP, `target_type ip`, health-check), `aws_lb_listener_rule` (por `path_pattern`), `aws_ecs_task_definition` (Fargate) y `aws_ecs_service` (`desired 2`). VPC, ALB, clúster, subredes, SG y rol de ejecución son preexistentes y se consumen por `terraform_remote_state` (S3) — no se crean aquí. Estado por rama (`_terraform.tfstate`). + - Nota : esta solucion depende del infraestrcutura [aws-microservicios-ecs](https://github.com/codeparceorg/infra-microservice-aws) +- **Kubernetes (Helm):** plantillas `Deployment` (réplicas 2, puerto 8000) + `Service` ClusterIP (`:80 → 8000`) + `IngressRoute` Traefik (`Host + PathPrefix`) + `HPA` (2–4, CPU 60%) + `ConfigMap` (desde fichero `.env`, ausente en el repo). Namespace `sis--ms`, imagen `/:`. Secret solo si `secret.enabled=true` (por defecto `false`). -Clone this repo. +Diagrama interactivo: [docs/infraestructura.html](docs/infraestructura.html) · [docs/kubernetes.html](docs/kubernetes.html) -```bash -git clone https://bitbucket.org/devsu/demo-devops-java.git -``` +## Pipeline CI/CD -### Database +Workflows independientes en `.github/workflows/` (sin dependencias entre ellos, sin aprobaciones configuradas). Todos los escaneos Trivy usan `exit-code 0` (informan, no bloquean). -The database is generated as a file in the main path when the project is first run, and its name is `test.mv.db`. +| Workflow | Evento | Etapas | +|---|---|---| +| CI Actions Pipeline | `pull_request` a `dev, test, main` + manual | Build Maven con tests ∥ Trivy repo (filesystem + IaC/configs) | +| CD Build Pipeline | `push` a `dev, test, main` | Build Maven (sin tests) → publica imagen Docker (tag = sha) → Trivy a la imagen | +| CD deploy Kubernetes | Manual (`dev, test, main`) | `helm upgrade --install` on-premise (runner `kubernetes`). Nota: el job declara `needs: docker-publish`, job que ya no existe en este archivo | +| CD deploy AWS | Manual (`dev, test, main`) | OIDC → parámetros → `terraform init/apply` en `IaC/` | +| Pipeline env & connection | Manual | Diagnóstico de variables, contexto y OIDC | -Consider giving access permissions to the file for proper functioning. +![Flujo del pipeline](docs/devsu-demo-devops-java.png) -## Usage +*Nota: el diagrama general es el existente en el repo; para mejor visualziación revisar el [Flujo del pipeline .pdf](docs/devsu-demo-devops-java.pdf)* -To run tests you can use this command. +## Despliegue -```bash -mvn clean test -``` +- **AWS ECS:** `cd-deploy-cloud.yml` (manual) aplica Terraform contra `dev`, `test` o `main`. +- **Kubernetes on-premise:** `cd-deploy-kb.yml` (manual) renderiza `values.template` con `envsubst` y despliega con Helm en `sis--ms`; expone `http://microservicio..lab/api/users`. +- La app escucha en el puerto `8000` (`/api/users`); imagen `eclipse-temurin:17-jre-alpine` con healthcheck. -To run locally the project you can use this command. +## Tecnologías -```bash -mvn spring-boot:run -``` - -Open http://127.0.0.1:8000/api/swagger-ui.html with your browser to see the result. - -### Features - -These services can perform, - -#### Create User - -To create a user, the endpoint **/api/users** must be consumed with the following parameters: - -```bash - Method: POST -``` - -```json -{ - "dni": "dni", - "name": "name" -} -``` - -If the response is successful, the service will return an HTTP Status 200 and a message with the following structure: - -```json -{ - "id": 1, - "dni": "dni", - "name": "name" -} -``` - -If the response is unsuccessful, we will receive status 400 and the following message: - -```json -{ - "errors": [ - "error" - ] -} -``` - -#### Get Users - -To get all users, the endpoint **/api/users** must be consumed with the following parameters: - -```bash - Method: GET -``` - -If the response is successful, the service will return an HTTP Status 200 and a message with the following structure: - -```json -[ - { - "id": 1, - "dni": "dni", - "name": "name" - } -] -``` - -#### Get User - -To get an user, the endpoint **/api/users/** must be consumed with the following parameters: - -```bash - Method: GET -``` - -If the response is successful, the service will return an HTTP Status 200 and a message with the following structure: - -```json -{ - "id": 1, - "dni": "dni", - "name": "name" -} -``` - -If the user id does not exist, we will receive status 404 and the following message: - -```json -{ - "errors": [ - "User not found: " - ] -} -``` - -If the response is unsuccessful, we will receive status 400 and the following message: - -```json -{ - "errors": [ - "error" - ] -} -``` - -## License - -Copyright © 2023 Devsu. All rights reserved. +Java 17 · Spring Boot 3.0.5 · Maven · Docker · Terraform (~6.0, AWS) · Helm / Traefik · Trivy · GitHub Actions (runners `ubuntu-latest` y `kubernetes`). diff --git a/docs/devsu-demo-devops-java.pdf b/docs/devsu-demo-devops-java.pdf new file mode 100644 index 0000000..8821e6a Binary files /dev/null and b/docs/devsu-demo-devops-java.pdf differ diff --git a/docs/devsu-demo-devops-java.png b/docs/devsu-demo-devops-java.png new file mode 100644 index 0000000..2ae850e Binary files /dev/null and b/docs/devsu-demo-devops-java.png differ diff --git a/docs/infraestructura.html b/docs/infraestructura.html new file mode 100644 index 0000000..36a8e01 --- /dev/null +++ b/docs/infraestructura.html @@ -0,0 +1,186 @@ + + + + + +Infraestructura IaC — devsu-demo-devops-java + + + +
+

Diagrama de infraestructura IaC

+

devsu-demo-devops-java · Terraform AWS — 4 recursos declarados en IaC/ sobre red, balanceador y clúster preexistentes consumidos por terraform_remote_state. Sin secretos, sin plan/apply.

+
provider aws ~> 6.0región us-east-1backend s3://codeparcestate devsu/devsu-demo-devops-java/test_terraform.tfstatemódulos targetgroup · taskdefinition
+
+
+ +
+

Leyenda

+

Color por tipo de recurso · línea continua = declarado en este repo · línea discontinua = externo / referenciado (no declarado)

+
+ALB / Listener +Listener Rule +Target Group +VPC / Subredes +Security Group +ECS Service / Cluster +Task Definition +IAM +S3 / Remote state +Externo +
+
+ +
+

Diagrama de arquitectura (SVG)

+

Flujo: Internet → ALB Listener (externo) → Rule (path_pattern) → Target Group (HTTP :var.port) → tareas ECS Fargate · Desplázate horizontalmente en móvil

+
+ + + + + + + +VPC (externa, outputs.vpc.vpc_id) — todo lo inferior corre dentro del VPC + + +🌐 Internet / Usuarios +entrada HTTP al ALB + + +🔀 ALB Listener — externo +outputs.alb.listeners_arn +no declarado · dashed + + +📏 aws_lb_listener_rule.rule +forward · path_pattern = var.path_pattern + + +🎯 aws_lb_target_group.tg +ip · HTTP : var.port · tg-$repo-$env +health_check HTTP traffic-port var.health_check_path +matcher 200 · 30s/5s · 2/3 + + + +path_pattern + +forward → TG + + +🧩 Subredes públicas +subred_public_all (ext.) +usadas por ECS service + +🛡️ Security Group +sg_ecs_id (externo) +ECS network_configuration + +🧠 ECS Cluster +outputs.ecs.cluster_id (ext.) + + +🚀 aws_ecs_service.app — desired 2 · FARGATE base 20 / w 50 +subnets públicas + sg_ecs + assign_public_ip = true +load_balancer: TG → container var.repository_name : var.port +awsvpc · tareas IP registradas en el TG + + +📦 aws_ecs_task_definition.td — FARGATE · cpu 1024 · mem 2048 +container var.image_name · var.port/tcp · cpu 256 / mem 512 + + +🪣 terraform_remote_state.infra_ecs +backend s3 codeparce · key = var.backend_infra +region us-east-1 · aporta vpc / alb / ecs + +👤 data.aws_iam_role.role_exec +ecsTaskExecutionRole (existente) +→ execution_role_arn del task definition + + +health-check + tráfico + +usa TD + +remote_state + + +
+
+ +
+

Agrupación por capas — detalle de recursos

+

Solo lo confirmado en .tf. Sin IGW, NAT, RDS, ni DNS: no existen en el código y no se representan.

+
+

ALB Listener externo

outputs.alb.listeners_arn
  • Balanceador preexistente; la rule se adjunta a este listener.
+

aws_lb_listener_rule.rule declarado

targetgroup/rule.tfforward → TG
  • condition path_pattern = var.path_pattern
  • depends_on TG
+

aws_lb_target_group.tg declarado

tg-${repo}-${env}ip · HTTP : var.port
  • health_check HTTP traffic-port var.health_check_path, matcher 200, 30s/5s, 2/3
  • create_before_destroy
+

VPC externo

outputs.vpc.vpc_id
  • El TG y las tareas ECS se despliegan dentro.
+

Subredes públicas externo

subred_public_all
  • network_configuration.subnets del servicio.
+

Security Group externo

sg_ecs_id
  • Asignado al servicio ECS (reglas no definidas aquí).
+

ECS: cluster + servicio mixto

aws_ecs_service.appdesired 2
  • cluster = outputs.ecs.cluster_id (externo)
  • FARGATE base 20 / weight 50 · public IP true
  • TG → container:var.port
+

aws_ecs_task_definition.td declarado

FARGATE · awsvpccpu 1024 · mem 2048
  • container var.repository_name : var.image_name
  • ports var.port/tcp · cpu 256 / mem 512
+

IAM execution role externo

ecsTaskExecutionRole
  • execution_role_arn de la task definition.
+

Estado remoto S3 externo

codeparcekey = var.backend_infra
  • Backend propio: devsu/.../test_terraform.tfstate, us-east-1.
+
+
+ +
+

Variables y outputs

+

Entradas requeridas y salidas del módulo targetgroup

+ + + + + + + + + + + +
NombreTipo / valorUso confirmado
repository_namestringNombre TG, servicio, familia TD, container
environmentstringSufijo del TG + tags env
portnumberPuerto TG + containerPort/hostPort TCP
health_check_pathstringHealth check del TG
path_patternlist(string)Condición de la listener rule
image_namestringImagen del contenedor
backend_infrastringKey del remote_state en S3
output target_group_arnaws_lb_target_group.tg.arnEntrada del módulo taskdefinition
output lb_listener_ruleaws_lb_listener_rule.rule.arnReferencia informativa
+

Un solo entorno parametrizado por var.environment: no hay diferencias entre entornos definidas en el repo. Puertos/protocolos mostrados solo donde el código los define (HTTP, TCP, traffic-port).

+
+ +
+
Fuente: IaC/*.tf · Declarado vs referenciado · Sin plan/apply ni cambios en AWS
+ + \ No newline at end of file diff --git a/docs/kubernetes.html b/docs/kubernetes.html new file mode 100644 index 0000000..5ea59ff --- /dev/null +++ b/docs/kubernetes.html @@ -0,0 +1,120 @@ + + + + + +Recursos Kubernetes — devsu-demo-devops-java + + + +
+

Recursos Kubernetes (Helm)

+

Chart ms-template 1.0.0 · 5 plantillas en kubernetes/templates/ renderizadas con values.template → values.yaml vía envsubst + helm upgrade --install. Agrupado por namespace sis-<rama>-ms y aplicación <repo>. Sin valores sensibles en el repo.

+
templates: deployment · svc · ingress · configmap · autoscalingtráfico: :80 → targetPort 8000réplicas 2 · HPA 2–4 · cpu 60%namespace por valor, no manifiesto
+
+
+ +
+

Leyenda

+

Color por tipo · tarjeta continua = render siempre · discontinua = condicional / sin consumidor confirmado

+
+Workload (Deployment/Pod) +Red (Service) +IngressRoute Traefik +ConfigMap +Secret (condicional) +HPA +→ tráfico / dependencia +
+
+ +
+

Diagrama de tráfico y dependencias (SVG)

Internet → IngressRoute (Host + PathPrefix) → Service :80 → Pods :8000 · HPA escala el Deployment

+
+ + +namespace: sis-<rama>-ms (valor templado, no manifiesto) · app: <repo> +🌐 InternetHost + PathPrefix +IngressRoute traefik<repo>-ingress · entry web→ svc puerto 80 (fijo) +Service ClusterIP<repo>-svc :80targetPort 8000 +Deployment <repo>-deployment · réplicas 2selector app=<repo> · imagen <org>/<repo>:<tag> · AlwayscontainerPort 8000 · 0.5–1 cpu · 250–500Miprobes httpGet <path>:8000 (15s/5s/2s/3) +Pod réplica 1:8000 · /api/users* +Pod réplica 2…HPA 4:8000 · /api/users* +HPA <repo>-hpamin 2 · max 4cpu 60% · stab 10s +ConfigMap <repo>-env-filedata: fichero .env (ausente)sin consumidor confirmado +Secret <repo> (condicional)solo si secret.enabled=truedefault false · sin manifiesto + +:80 +selector + +crea/administra +escala +envFrom (si enabled) +
+
+ +
+

Recursos por namespace y aplicación

+

Todos generados por plantillas Helm (ningún manifiesto directo). Nombres efectivos: <repo>-deployment / -svc / -ingress / -env-file / -hpa en sis-<rama>-ms.

+

📦 sis-<rama>-ms · app <repo>

Chart ms-template · valores vía envsubst (GITHUB_*, ORG, IMAGE_TAG, MS_PATH) · ejemplo: repo devsu-demo-devops-java, rama test, path /api/users

+
+

IngressRoute plantilla

ingress.yaml · traefik.io/v1alpha1
  • entryPoint web, match Host(host) && PathPrefix(path)
  • destino <repo>-svc:80 (puerto 80 literal en la plantilla)
+

Service ClusterIP plantilla

svc.yaml
  • selector app=<repo>, port 80 → targetPort 8000 (valores templados)
+

Deployment + Pods plantilla

deployment.yaml · if enabled (true)
  • replicas 2, imagen ${ORG}/${REPO}:${TAG} Always, puerto 8000
  • resources 0.5/250Mi → 1/500Mi; liveness+readiness httpGet <path>:8000
+

HPA plantilla

autoscaling.yaml · autoscaling/v2 · kind: HorizontalPodAutoscaler
  • objetivo Deployment <repo>-deployment, min 2 / max 4, CPU 60%, estabilización 10s
+

ConfigMap sin consumidor confirmado

configmap.yaml · <repo>-env-file
  • data generada de fichero .env (no existe en el repo → contenido no confirmable)
  • El Deployment no lo monta ni lo referencia: relación omitida
+

Secret (referencia) condicional · inactivo por defecto

secret.enabled=false
  • Solo envFrom.secretRef:<repo> si se activa; no hay manifiesto Secret ni valores
+
+
+ +
+

Plantillas ↔ valores

+ + + + + + + +
PlantillaValores que la determinanEfecto
deployment.yamldeployment.enabled · name · namespace · container.image/port/path · secret.* · metadata.*Crea los Pods; secret solo si enabled=true
svc.yamlname · namespace · service.port (80) · container.port (8000)ClusterIP :80 → 8000 con selector app
ingress.yamlingress.entry/host/path · nameRuta Traefik hacia -svc:80
configmap.yamlfichero .env (ausente) · nameContenido no determinable desde el repo
autoscaling.yamlname (límites fijos en plantilla)Escala el Deployment 2–4 por CPU
+

No definidos en el repo y por tanto no representados: recurso Namespace, ServiceAccount/RBAC, Secret, PV/PVC, StatefulSet/DaemonSet, Ingress nginx estándar (se usa CRD Traefik). Namespace solo como ámbito de agrupación. Puertos/réplicas/selectores mostrados únicamente donde la plantilla los fija.

+
+ +
+
Fuente: kubernetes/Chart.yaml, values.template, templates/*.yaml · Solo recursos y relaciones confirmadas · Sin modificar el clúster
+ + + \ No newline at end of file