Cloud: Releases and Upgrades

#!/usr/bin/env bash
# Release step of Pocket Coffee: run by the pre-upgrade Job as the migration database user.
set -euo pipefail

cd /var/www/html
console() { php -d memory_limit=-1 bin/console --env=prod "$@"; }

# 1. The code of this image and the database must be at the same PrestaShop version.
code_version="$(php -r 'require "vendor/autoload.php"; echo PrestaShop\PrestaShop\Core\Version::VERSION;')"
db_version="$(console prestashop:config get PS_VERSION_DB | sed -n 's/.*PS_VERSION_DB=\([^[:space:]]*\).*/\1/p')"
echo "PrestaShop code ${code_version}, database ${db_version}"
if [ "${code_version}" != "${db_version}" ]; then
  echo "The database is not at the version of this image: run the core upgrade first (migrate.core.enabled=true)." >&2
  exit 1
fi

# 2. Install new modules and upgrade installed ones. The command exits 0 even when an action fails,
#    so the success message is the check. "install" on an installed module performs the upgrade.
read -r -a modules <<<"${PC_MODULES:?set PC_MODULES to the module names of the release}"
for module in "${modules[@]}"; do
  output="$(console prestashop:module install "${module}" 2>&1)" || { printf '%s\n' "${output}" >&2; exit 1; }
  printf '%s\n' "${output}"
  if ! grep -Fq "action on module ${module} succeeded" <<<"${output}"; then
    echo "Module ${module} was not installed or upgraded" >&2
    exit 1
  fi
done

# 3. Every module of the release must be installed and enabled.
active="$(console prestashop:module:list --active --simple)"
for module in "${modules[@]}"; do
  grep -Fxq "${module}" <<<"${active}" || { echo "Module ${module} is not active" >&2; exit 1; }
done

# 4. Report the drift between the entities and the database; this is a report, not a gate.
console prestashop:schema:update-without-foreign --dump-sql 2>&1 | sed -n '1,40p' || true
echo "Release step finished"

{{- if .Values.migrate.enabled }}
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ .Release.Name }}-migrate
  labels:
    {{- include "pc.labels" . | nindent 4 }}
  annotations:
    "helm.sh/hook": pre-upgrade
    "helm.sh/hook-weight": "0"
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
spec:
  backoffLimit: 0
  activeDeadlineSeconds: {{ .Values.migrate.timeoutSeconds }}
  ttlSecondsAfterFinished: 3600
  template:
    metadata:
      labels:
        app.kubernetes.io/name: {{ include "pc.name" . }}
        app.kubernetes.io/instance: {{ .Release.Name }}
        app.kubernetes.io/component: migrate
    spec:
      restartPolicy: Never
      serviceAccountName: {{ .Release.Name }}-prestashop
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        fsGroup: 33
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: migrate
          image: {{ include "pc.image" . }}
          command: ["/usr/local/bin/pc-migrate"]
          securityContext:
            {{- include "pc.containerSecurity" . | nindent 12 }}
            runAsUser: 33
            runAsGroup: 33
          envFrom:
            {{- include "pc.envFrom" . | nindent 12 }}
          env:
            {{- include "pc.dbEnv" (dict "root" . "user" .Values.database.migrateUser "key" "DB_PASSWORD_MIGRATE") | nindent 12 }}
            - name: PC_MODULES
              value: {{ join " " .Values.migrate.modules | quote }}
          resources:
            requests: { cpu: 250m, memory: 512Mi, ephemeral-storage: 512Mi }
            limits: { memory: 1Gi }
          volumeMounts:
            {{- include "pc.codeMounts" . | nindent 12 }}
      volumes:
        {{- include "pc.volumes" . | nindent 8 }}
{{- end }}

#!/usr/bin/env bash
# Core upgrade step of Pocket Coffee: runs in a Job from the OLD image, in a disposable copy of the tree.
set -euo pipefail

admin_dir="${PS_ADMIN_DIR:?set PS_ADMIN_DIR to the renamed admin folder}"
zip_file="${PS_RELEASE_ZIP:?set PS_RELEASE_ZIP}"
xml_file="${PS_RELEASE_XML:?set PS_RELEASE_XML}"
work=/work/shop

# The tool writes into the tree it lives in: give it a copy and keep the image untouched.
mkdir -p "${work}"
cp -a /var/www/html/. "${work}/"
cd "${work}"

mkdir -p "${admin_dir}/autoupgrade/download"
cp "/release/${zip_file}" "/release/${xml_file}" "${admin_dir}/autoupgrade/download/"

autoupgrade="php -d memory_limit=-1 modules/autoupgrade/bin/console"

${autoupgrade} update:check-requirements --channel=local --zip="${zip_file}" --xml="${xml_file}" "${admin_dir}"
${autoupgrade} update:start --channel=local --zip="${zip_file}" --xml="${xml_file}" \
  --regenerate-email-templates=0 --disable-all-overrides=1 --uninstall-incompatible-modules=0 "${admin_dir}"

# The version in the database is the proof that the database step ran.
db_version="$(php -d memory_limit=-1 bin/console --env=prod prestashop:config get PS_VERSION_DB | sed -n 's/.*PS_VERSION_DB=\([^[:space:]]*\).*/\1/p')"
echo "PS_VERSION_DB is now ${db_version}"

{{- if and .Values.migrate.enabled .Values.migrate.core.enabled }}
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ .Release.Name }}-migrate-core
  labels:
    {{- include "pc.labels" . | nindent 4 }}
  annotations:
    "helm.sh/hook": pre-upgrade
    "helm.sh/hook-weight": "-5"
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
spec:
  backoffLimit: 0
  activeDeadlineSeconds: {{ .Values.migrate.core.timeoutSeconds }}
  ttlSecondsAfterFinished: 3600
  template:
    metadata:
      labels:
        app.kubernetes.io/name: {{ include "pc.name" . }}
        app.kubernetes.io/instance: {{ .Release.Name }}
        app.kubernetes.io/component: migrate-core
    spec:
      restartPolicy: Never
      serviceAccountName: {{ .Release.Name }}-prestashop
      automountServiceAccountToken: false
      securityContext:
        fsGroup: 33
        seccompProfile:
          type: RuntimeDefault
      initContainers:
        - name: release-archive
          image: {{ include "pc.image" . }}
          command: ["sh", "-c", "cp /opt/prestashop-release/* /release/"]
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 33
            runAsGroup: 33
            capabilities:
              drop: ["ALL"]
          volumeMounts:
            - name: release
              mountPath: /release
      containers:
        - name: update
          image: {{ .Values.image.repository }}:{{ required "set migrate.core.fromImageTag to the tag that is running now" .Values.migrate.core.fromImageTag }}
          command: ["/usr/local/bin/pc-core-upgrade"]
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 33
            runAsGroup: 33
            capabilities:
              drop: ["ALL"]
          envFrom:
            {{- include "pc.envFrom" . | nindent 12 }}
          env:
            {{- include "pc.dbEnv" (dict "root" . "user" .Values.database.migrateUser "key" "DB_PASSWORD_MIGRATE") | nindent 12 }}
            - name: PS_ADMIN_DIR
              value: {{ .Values.shop.adminDir | quote }}
            - name: PS_RELEASE_ZIP
              value: {{ .Values.migrate.core.archiveZip | quote }}
            - name: PS_RELEASE_XML
              value: {{ .Values.migrate.core.archiveXml | quote }}
          resources:
            requests: { cpu: "1", memory: 1Gi, ephemeral-storage: 4Gi }
            limits: { memory: 2Gi, ephemeral-storage: 6Gi }
          volumeMounts:
            - name: tmp
              mountPath: /tmp
            - name: work
              mountPath: /work
            - name: release
              mountPath: /release
              readOnly: true
            - name: cache
              mountPath: /var/www/html/var/cache
            - name: logs
              mountPath: /var/www/html/var/logs
      volumes:
        - name: tmp
          emptyDir: {}
        - name: work
          emptyDir: {}
        - name: release
          emptyDir: {}
        - name: cache
          emptyDir: {}
        - name: logs
          emptyDir: {}
{{- end }}

      initContainers:
        - name: warmup
          image: {{ include "pc.image" . }}
          command: ["sh", "-c"]
          args:
            - |
              set -eu
              cd /var/www/html
              for app in admin front{{ if .Values.shop.adminApi }} admin-api{{ end }}; do
                php -d memory_limit=-1 bin/console cache:warmup --env=prod --app-id="${app}"
              done
          envFrom:
            {{- include "pc.envFrom" . | nindent 12 }}
          env:
            {{- include "pc.dbEnv" (dict "root" . "user" .Values.database.appUser "key" "DB_PASSWORD_APP") | nindent 12 }}
          securityContext:
            {{- include "pc.containerSecurity" . | nindent 12 }}
            runAsUser: 33
            runAsGroup: 33
          volumeMounts:
            {{- include "pc.codeMounts" . | nindent 12 }}

#!/usr/bin/env bash
# maintenance.sh on <ip-or-cidr>[,<ip-or-cidr>...] | off: close or open the Pocket Coffee shop for visitors.
set -euo pipefail

namespace="${NAMESPACE:-pocketcoffee}"
console() {
  kubectl --namespace "${namespace}" exec deploy/pocketcoffee-web -c php-fpm -- php bin/console --env=prod "$@"
}

case "${1:-}" in
  on)
    allowed="${2:?usage: maintenance.sh on <ip-or-cidr>[,<ip-or-cidr>...]}"
    console prestashop:config set PS_MAINTENANCE_IP --value="${allowed}"
    console prestashop:config set PS_SHOP_ENABLE --value=0
    ;;
  off)
    console prestashop:config set PS_SHOP_ENABLE --value=1
    ;;
  *)
    echo "usage: maintenance.sh on <ip-or-cidr>[,...] | off" >&2
    exit 2
    ;;
esac

#!/usr/bin/env bash
set -euo pipefail

SNAPSHOT="pocketcoffee-pre-<git-sha>"

aws rds restore-db-instance-from-db-snapshot \
  --db-instance-identifier pocketcoffee-restore \
  --db-snapshot-identifier "$SNAPSHOT" \
  --db-subnet-group-name <db-subnet-group> \
  --vpc-security-group-ids <security-group-id> \
  --db-parameter-group-name <parameter-group>

aws rds wait db-instance-available --db-instance-identifier pocketcoffee-restore

helm upgrade pocketcoffee ./pocketcoffee-prestashop \
  --namespace pocketcoffee \
  --reuse-values \
  --set image.tag=<previous-git-sha> \
  --set migrate.enabled=false \
  --set database.host=<endpoint-of-pocketcoffee-restore> \
  --rollback-on-failure

name: release

on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      core_upgrade:
        description: "Core release: run maintenance mode and the core Job (needs the archive in the image)"
        type: boolean
        default: false
      maintenance_ips:
        description: "Addresses allowed during a core release, comma separated"
        type: string
        default: ""

permissions:
  contents: read

concurrency:
  group: release-production
  cancel-in-progress: false

env:
  AWS_REGION: eu-west-1
  ECR_REPOSITORY: pocketcoffee/prestashop
  CLUSTER: pocketcoffee-prod
  NAMESPACE: pocketcoffee
  DB_INSTANCE: pocketcoffee-prod
  CORE_UPGRADE: ${{ inputs.core_upgrade == true }}

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/pocketcoffee-github-ecr-push
          aws-region: ${{ env.AWS_REGION }}
      - id: ecr
        uses: aws-actions/amazon-ecr-login@v2
      # Three images of one commit, as the image page builds them: the tags are <sha>, <sha>-nginx
      # and <sha>-install, and the chart adds the suffixes to image.tag.
      - name: Build and push the php-fpm image
        uses: docker/build-push-action@v6
        with:
          context: .
          target: app
          push: true
          pull: true
          tags: ${{ steps.ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:${{ github.sha }}
      - name: Build and push the nginx image
        uses: docker/build-push-action@v6
        with:
          context: .
          target: web
          push: true
          tags: ${{ steps.ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:${{ github.sha }}-nginx
      - name: Build and push the installer image
        uses: docker/build-push-action@v6
        with:
          context: .
          target: installer
          push: true
          tags: ${{ steps.ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:${{ github.sha }}-install

  deploy:
    needs: build
    runs-on: ubuntu-latest
    environment: production
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/pocketcoffee-github-deploy
          aws-region: ${{ env.AWS_REGION }}
      - uses: azure/setup-helm@v4
        with:
          version: v4.3.1
      - name: Snapshot the database before the schema can change
        run: |
          aws rds create-db-snapshot \
            --db-instance-identifier "$DB_INSTANCE" \
            --db-snapshot-identifier "pocketcoffee-pre-${GITHUB_SHA}"
          aws rds wait db-snapshot-available \
            --db-snapshot-identifier "pocketcoffee-pre-${GITHUB_SHA}"
      - name: Connect to the cluster
        run: aws eks update-kubeconfig --name "$CLUSTER" --region "$AWS_REGION"
      - name: Close the shop for a core release
        if: ${{ inputs.core_upgrade }}
        env:
          MAINTENANCE_IPS: ${{ inputs.maintenance_ips }}
        run: ./.github/scripts/maintenance.sh on "$MAINTENANCE_IPS"
      - name: Upgrade the release
        run: |
          args=(--set "image.tag=${GITHUB_SHA}")
          if [ "$CORE_UPGRADE" = "true" ]; then
            running_tag="$(helm get values pocketcoffee --namespace "$NAMESPACE" --output json | jq -r '.image.tag')"
            args+=(--set migrate.core.enabled=true --set "migrate.core.fromImageTag=${running_tag}")
          fi
          helm upgrade --install pocketcoffee ./pocketcoffee-prestashop \
            --namespace "$NAMESPACE" \
            --values ./pocketcoffee-prestashop/values-production.yaml \
            "${args[@]}" \
            --rollback-on-failure \
            --timeout 60m \
            --history-max 10
      - name: Smoke test and warm the shop
        run: |
          for path in / /es/ /en/ /en/6-coffee /en/cart; do
            curl --fail --silent --show-error --retry 5 --retry-delay 5 \
              "https://www.pocketcoffee.example${path}" --output /dev/null
          done
      - name: Open the shop again
        if: ${{ inputs.core_upgrade }}
        run: ./.github/scripts/maintenance.sh off

#!/usr/bin/env bash
set -euo pipefail

exec_web() { kubectl -n pocketcoffee exec deploy/pocketcoffee-web -c php-fpm -- php bin/console --env=prod "$@"; }

exec_web prestashop:config get PS_VERSION_DB
exec_web prestashop:module:list --active --simple
exec_web prestashop:config get PS_SHOP_ENABLE
kubectl -n pocketcoffee rollout status deploy/pocketcoffee-web
kubectl -n pocketcoffee get pods -l app.kubernetes.io/component=web -o wide