Rolling Deployments

terraform {
  required_providers {
    pf = {
      source = "panfactum/pf"
    }
  }
}

locals {
  name = "demo-service"
  namespace = module.namespace.namespace
  port = 3000
}

module "namespace" {
  source =   "${var.pf_module_source}kube_namespace${var.pf_module_ref}"
  namespace = local.name
}

module "database" {
  source = "${var.pf_module_source}kube_pg_cluster${var.pf_module_ref}"

  pg_cluster_namespace                 = local.namespace
  aws_iam_ip_allow_list                = []

  pg_initial_storage_gb                = 5    # for the purposes of the demo
  pg_max_connections                   = 20   # for the purposes of the demo
  pg_instances                         = 2    # for the purposes of the demo
  burstable_nodes_enabled              = true # for the purposes of the demo

  pull_through_cache_enabled           = var.pull_through_cache_enabled
  monitoring_enabled                   = var.monitoring_enabled
  panfactum_scheduler_enabled          = var.panfactum_scheduler_enabled
  instance_type_anti_affinity_required = var.enhanced_ha_enabled
}

module "demo_service" {
  source = "${var.pf_module_source}kube_deployment${var.pf_module_ref}"
  namespace = module.namespace.namespace
  name      = local.name

  replicas = 2

  common_env = {
    PORT     = local.port
    DB_HOST  = module.database.pooler_rw_service_name
    DB_PORT  = module.database.pooler_rw_service_port
    DB_NAME  = var.db_name
    DB_SCHEMA = var.db_schema
    TOKEN_VALIDATION_URL = var.token_validation_url
  }

  common_env_from_secrets = {
    DB_USER = {
      secret_name = module.database.superuser_creds_secret
      key = "username"
    }

    DB_PASSWORD = {
      secret_name = module.database.superuser_creds_secret
      key = "password"
    }
  }

  tmp_directories = {
    "cache" = {
      mount_path = "/tmp"
      size_mb = 100
    }
  }

  containers = [
    {
      name    = local.name
      // Should be the account / region where the CICD builder is running
      image_registry   = "12345678912.dkr.ecr.us-east-2.amazonaws.com"
      image_repository = local.name
      image_tag = var.image_version
      command = ["gunicorn", "--bind", "0.0.0.0:${local.port}", "src.app:app"]
      liveness_probe_type  = "HTTP"
      liveness_probe_port  = local.port
      liveness_probe_route = var.healthcheck_route
      minimum_memory = 100
      ports = {
        http ={
          port = local.port
        }
      }
    }
  ]

  depends_on = [module.database]
}

module "ingress" {
  source = "${var.pf_module_source}kube_ingress${var.pf_module_ref}"

  name      = local.name
  namespace = local.namespace

  domains      = [var.domain]
  ingress_configs = [{
    path_prefix = "/"
    remove_prefix = true
    service      = local.name
    service_port = local.port
  }]

  cdn_mode_enabled = false
  cors_enabled                   = true
  cross_origin_embedder_policy   = "credentialless"
  csp_enabled                    = true
  cross_origin_isolation_enabled = true
  rate_limiting_enabled          = true
  permissions_policy_enabled     = true

  depends_on = [module.demo_service]
}

variable "domain" {
  description = "A list of domains from which the ingress will serve traffic"
  type        = string
}

variable "image_version" {
  description = "The version of the demo user service image to deploy"
  type        = string
}

variable "healthcheck_route" {
  description = "The route to use for the healthcheck"
  type        = string
}

variable "db_name" {
  description = "The name of the database"
  type        = string
}

variable "db_schema" {
  description = "The schema of the database"
  type        = string
}

variable "token_validation_url" {
  description = "The URL to use for token validation"
  type        = string
}

variable "pull_through_cache_enabled" {
  description = "Whether to use the ECR pull through cache for the deployed images"
  type        = bool
  default     = true
}

variable "burstable_nodes_enabled" {
  description = "Whether to enable burstable nodes for the postgres cluster"
  type        = bool
  default     = true
}

variable "namespace" {
  description = "Kubernetes namespace to deploy the resources into"
  type        = string
}

variable "vpa_enabled" {
  description = "Whether the VPA resources should be enabled"
  type        = bool
  default     = true
}

variable "monitoring_enabled" {
  description = "Whether to add active monitoring to the deployed systems"
  type        = bool
  default     = false
}

variable "enhanced_ha_enabled" {
  description = "Whether to add extra high-availability scheduling constraints at the trade-off of increased cost"
  type        = bool
  default     = true
}

variable "panfactum_scheduler_enabled" {
  description = "Whether to use the Panfactum pod scheduler with enhanced bin-packing"
  type        = bool
  default     = true
}

variable "pf_module_source" {
  description = "The source of the Panfactum modules"
  type        = string
}

variable "pf_module_ref" {
  description = "The reference of the Panfactum modules"
  type        = string
}