Enable auth-service/api-gateway on production, build their images in CI

2026-08-18 14:11:00 +07:00
parent e5afedfa2f
commit b68005be1c
70 changed files with 6781 additions and 263 deletions
@@ -0,0 +1,56 @@
+{{- if .Values.apiGateway.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "medical-chatbot.fullname" . }}-api-gateway
+  labels:
+    {{- include "medical-chatbot.labels" . | nindent 4 }}
+    app.kubernetes.io/component: api-gateway
+spec:
+  replicas: {{ .Values.apiGateway.replicaCount }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/component: api-gateway
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/component: api-gateway
+      annotations:
+        checksum/runtime-config: {{ dict "port" .Values.apiGateway.service.port | toJson | sha256sum | quote }}
+    spec:
+      serviceAccountName: {{ include "medical-chatbot.serviceAccountName" . }}
+      imagePullSecrets:
+        {{- toYaml .Values.global.imagePullSecrets | nindent 8 }}
+      containers:
+        - name: api-gateway
+          image: {{ include "medical-chatbot.image" (dict "image" .Values.apiGateway.image "name" "apiGateway") | quote }}
+          imagePullPolicy: {{ .Values.apiGateway.image.pullPolicy }}
+          ports:
+            - { name: http, containerPort: {{ .Values.apiGateway.service.port }} }
+          env:
+            - name: PORT
+              value: {{ .Values.apiGateway.service.port | quote }}
+            - name: AUTH_SERVICE_URL
+              value: {{ printf "http://%s-auth-service:%d" (include "medical-chatbot.fullname" .) (.Values.authService.service.port | int) | quote }}
+          resources:
+            {{- toYaml .Values.apiGateway.resources | nindent 12 }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "medical-chatbot.fullname" . }}-api-gateway
+  labels:
+    {{- include "medical-chatbot.labels" . | nindent 4 }}
+    app.kubernetes.io/component: api-gateway
+spec:
+  type: {{ .Values.apiGateway.service.type }}
+  selector:
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: api-gateway
+  ports:
+    - name: http
+      port: {{ .Values.apiGateway.service.port }}
+      targetPort: http
+{{- end }}
@@ -0,0 +1,122 @@
+{{- if .Values.authService.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "medical-chatbot.fullname" . }}-auth-service
+  labels:
+    {{- include "medical-chatbot.labels" . | nindent 4 }}
+data:
+  JWT_EXPIRES_IN: {{ .Values.authService.config.jwtExpiresIn | quote }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "medical-chatbot.fullname" . }}-auth-service
+  labels:
+    {{- include "medical-chatbot.labels" . | nindent 4 }}
+    app.kubernetes.io/component: auth-service
+spec:
+  replicas: {{ .Values.authService.replicaCount }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/component: auth-service
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/component: auth-service
+      annotations:
+        checksum/runtime-config: {{ .Values.authService.config | toJson | sha256sum | quote }}
+    spec:
+      serviceAccountName: {{ include "medical-chatbot.serviceAccountName" . }}
+      imagePullSecrets:
+        {{- toYaml .Values.global.imagePullSecrets | nindent 8 }}
+      {{- if or .Values.authService.migration.enabled .Values.authService.seed.enabled }}
+      initContainers:
+        {{- if .Values.authService.migration.enabled }}
+        - name: migrate
+          image: {{ include "medical-chatbot.image" (dict "image" .Values.authService.image "name" "authService") | quote }}
+          imagePullPolicy: {{ .Values.authService.image.pullPolicy }}
+          command: ["node", "dist/migrate.js"]
+          env:
+            - name: POSTGRES_DSN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "medical-chatbot.secretName" . }}
+                  key: postgres-dsn
+            - name: JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "medical-chatbot.secretName" . }}
+                  key: jwt-secret
+        {{- end }}
+        {{- if .Values.authService.seed.enabled }}
+        - name: seed
+          image: {{ include "medical-chatbot.image" (dict "image" .Values.authService.image "name" "authService") | quote }}
+          imagePullPolicy: {{ .Values.authService.image.pullPolicy }}
+          command: ["node", "dist/seed.js"]
+          env:
+            - name: POSTGRES_DSN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "medical-chatbot.secretName" . }}
+                  key: postgres-dsn
+            - name: JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "medical-chatbot.secretName" . }}
+                  key: jwt-secret
+            - name: ADMIN_SEED_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "medical-chatbot.secretName" . }}
+                  key: admin-seed-password
+            - name: DEMO_SEED_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "medical-chatbot.secretName" . }}
+                  key: demo-seed-password
+        {{- end }}
+      {{- end }}
+      containers:
+        - name: auth-service
+          image: {{ include "medical-chatbot.image" (dict "image" .Values.authService.image "name" "authService") | quote }}
+          imagePullPolicy: {{ .Values.authService.image.pullPolicy }}
+          ports:
+            - { name: http, containerPort: {{ .Values.authService.service.port }} }
+          envFrom:
+            - configMapRef: { name: {{ include "medical-chatbot.fullname" . }}-auth-service }
+          env:
+            - name: PORT
+              value: {{ .Values.authService.service.port | quote }}
+            - name: POSTGRES_DSN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "medical-chatbot.secretName" . }}
+                  key: postgres-dsn
+            - name: JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "medical-chatbot.secretName" . }}
+                  key: jwt-secret
+          resources:
+            {{- toYaml .Values.authService.resources | nindent 12 }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "medical-chatbot.fullname" . }}-auth-service
+  labels:
+    {{- include "medical-chatbot.labels" . | nindent 4 }}
+    app.kubernetes.io/component: auth-service
+spec:
+  type: {{ .Values.authService.service.type }}
+  selector:
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: auth-service
+  ports:
+    - name: http
+      port: {{ .Values.authService.service.port }}
+      targetPort: http
+{{- end }}
@@ -10,4 +10,20 @@ stringData:
  postgres-password: {{ .Values.secret.postgresPassword | quote }}
  postgres-dsn: {{ printf "postgresql://duoc_thu:%s@%s:5432/duoc_thu" .Values.secret.postgresPassword (default (printf "%s-postgres" (include "medical-chatbot.fullname" .)) .Values.secret.postgresHost) | quote }}
  grafana-admin-password: {{ .Values.secret.grafanaAdminPassword | quote }}
+  {{- if and .Values.aws.staticCredentials.enabled .Values.aws.staticCredentials.accessKeyId }}
+  aws-access-key-id: {{ .Values.aws.staticCredentials.accessKeyId | quote }}
+  aws-secret-access-key: {{ .Values.aws.staticCredentials.secretAccessKey | quote }}
+  {{- end }}
+  {{- if or .Values.authService.enabled .Values.apiGateway.enabled }}
+  {{/* Required (not defaulted) once either service is turned on — same
+  fail-closed posture as the image-tag guard above: a guessable or empty
+  secret here would let anyone forge an admin JWT. */}}
+  jwt-secret: {{ required "secret.jwtSecret is required when authService or apiGateway is enabled" .Values.secret.jwtSecret | quote }}
+  {{- end }}
+  {{- if .Values.authService.seed.enabled }}
+  {{/* Required (not defaulted) once the seed job runs — see the comment on
+  secret.adminSeedPassword in values.yaml for why "1" must never reach here. */}}
+  admin-seed-password: {{ required "secret.adminSeedPassword is required when authService.seed.enabled" .Values.secret.adminSeedPassword | quote }}
+  demo-seed-password: {{ required "secret.demoSeedPassword is required when authService.seed.enabled" .Values.secret.demoSeedPassword | quote }}
+  {{- end }}
 {{- end }}
@@ -27,6 +27,20 @@ spec:
          env:
            - name: AI_SERVICE_URL
              value: {{ printf "http://%s-ai-service:%v" (include "medical-chatbot.fullname" .) .Values.aiService.service.port | quote }}
+            {{- if .Values.apiGateway.enabled }}
+            - name: API_GATEWAY_URL
+              value: {{ printf "http://%s-api-gateway:%d" (include "medical-chatbot.fullname" .) (.Values.apiGateway.service.port | int) | quote }}
+            {{- end }}
+            {{- if or .Values.authService.enabled .Values.apiGateway.enabled }}
+            {{/* Only middleware.ts needs this (verifies the admin JWT locally
+            at the edge) — the BFF routes never see it, they just forward the
+            cookie's raw token to the gateway. */}}
+            - name: JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "medical-chatbot.secretName" . }}
+                  key: jwt-secret
+            {{- end }}
          ports:
            - { name: http, containerPort: 3000 }
          readinessProbe: