From ceabd109768df0e4cf554e73274796058afd86df Mon Sep 17 00:00:00 2001 From: Ashwin Kumar Sivakumar Date: Sun, 14 Jun 2026 05:52:50 +0530 Subject: [PATCH] fix(flux): pin app releases to immutable digests --- .../overlays/prod/kustomization.yaml | 7 +-- .../overlays/prod/release-patch.yaml | 12 +++++ .../overlays/prod/replicas-patch.yaml | 7 --- .../overlays/prod/kustomization.yaml | 7 ++- .../overlays/prod/release-patch.yaml | 11 ++++ .../overlays/prod/kustomization.yaml | 7 +-- .../overlays/prod/release-patch.yaml | 12 +++++ .../overlays/prod/replicas-patch.yaml | 7 --- scripts/set-app-release.sh | 53 +++++++++++++++++++ 9 files changed, 95 insertions(+), 28 deletions(-) create mode 100644 apps/nxtgauge-admin-solid/overlays/prod/release-patch.yaml delete mode 100644 apps/nxtgauge-admin-solid/overlays/prod/replicas-patch.yaml create mode 100644 apps/nxtgauge-ai-assistant/overlays/prod/release-patch.yaml create mode 100644 apps/nxtgauge-frontend-solid/overlays/prod/release-patch.yaml delete mode 100644 apps/nxtgauge-frontend-solid/overlays/prod/replicas-patch.yaml create mode 100755 scripts/set-app-release.sh diff --git a/apps/nxtgauge-admin-solid/overlays/prod/kustomization.yaml b/apps/nxtgauge-admin-solid/overlays/prod/kustomization.yaml index 3bdb26d..4cd99e3 100644 --- a/apps/nxtgauge-admin-solid/overlays/prod/kustomization.yaml +++ b/apps/nxtgauge-admin-solid/overlays/prod/kustomization.yaml @@ -3,8 +3,5 @@ namespace: nxtgauge kind: Kustomization resources: - ../../base -patchesStrategicMerge: - - replicas-patch.yaml -images: - - name: registry.nxtgauge.com/nxtgauge-admin-solid - newTag: latest +patches: + - path: release-patch.yaml diff --git a/apps/nxtgauge-admin-solid/overlays/prod/release-patch.yaml b/apps/nxtgauge-admin-solid/overlays/prod/release-patch.yaml new file mode 100644 index 0000000..e215ab2 --- /dev/null +++ b/apps/nxtgauge-admin-solid/overlays/prod/release-patch.yaml @@ -0,0 +1,12 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + namespace: nxtgauge + name: nxtgauge-admin-solid +spec: + replicas: 1 + template: + spec: + containers: + - name: admin-solid + image: registry.nxtgauge.com/nxtgauge-admin-solid@sha256:1f534ad2029f741242436dd03b8f38e504b18b0fa8acf6ba0766ce6c70c2adb9 diff --git a/apps/nxtgauge-admin-solid/overlays/prod/replicas-patch.yaml b/apps/nxtgauge-admin-solid/overlays/prod/replicas-patch.yaml deleted file mode 100644 index aab9a8e..0000000 --- a/apps/nxtgauge-admin-solid/overlays/prod/replicas-patch.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: nxtgauge-admin-solid - namespace: nxtgauge -spec: - replicas: 1 diff --git a/apps/nxtgauge-ai-assistant/overlays/prod/kustomization.yaml b/apps/nxtgauge-ai-assistant/overlays/prod/kustomization.yaml index 33c988e..274743c 100644 --- a/apps/nxtgauge-ai-assistant/overlays/prod/kustomization.yaml +++ b/apps/nxtgauge-ai-assistant/overlays/prod/kustomization.yaml @@ -1,8 +1,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization namespace: nxtgauge-ai +kind: Kustomization resources: - ../../base -images: - - name: registry.nxtgauge.com/nxtgauge-ai-assistant - newTag: latest +patches: + - path: release-patch.yaml diff --git a/apps/nxtgauge-ai-assistant/overlays/prod/release-patch.yaml b/apps/nxtgauge-ai-assistant/overlays/prod/release-patch.yaml new file mode 100644 index 0000000..de9b75b --- /dev/null +++ b/apps/nxtgauge-ai-assistant/overlays/prod/release-patch.yaml @@ -0,0 +1,11 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: nxtgauge-ai-assistant +spec: + replicas: 1 + template: + spec: + containers: + - name: ai-assistant + image: registry.nxtgauge.com/nxtgauge-ai-assistant@sha256:17956c88918830564f1c6a93083a11183a3bec655b151a382568fd7a02e15b83 diff --git a/apps/nxtgauge-frontend-solid/overlays/prod/kustomization.yaml b/apps/nxtgauge-frontend-solid/overlays/prod/kustomization.yaml index e89735b..4cd99e3 100644 --- a/apps/nxtgauge-frontend-solid/overlays/prod/kustomization.yaml +++ b/apps/nxtgauge-frontend-solid/overlays/prod/kustomization.yaml @@ -3,8 +3,5 @@ namespace: nxtgauge kind: Kustomization resources: - ../../base -patchesStrategicMerge: - - replicas-patch.yaml -images: - - name: registry.nxtgauge.com/nxtgauge-frontend-solid - newTag: latest +patches: + - path: release-patch.yaml diff --git a/apps/nxtgauge-frontend-solid/overlays/prod/release-patch.yaml b/apps/nxtgauge-frontend-solid/overlays/prod/release-patch.yaml new file mode 100644 index 0000000..f07fe68 --- /dev/null +++ b/apps/nxtgauge-frontend-solid/overlays/prod/release-patch.yaml @@ -0,0 +1,12 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + namespace: nxtgauge + name: nxtgauge-frontend-solid +spec: + replicas: 1 + template: + spec: + containers: + - name: frontend-solid + image: registry.nxtgauge.com/nxtgauge-frontend-solid@sha256:e376a501f918f21ce8c16358674e2600644dd7166913e39edc3f0d8d4d435090 diff --git a/apps/nxtgauge-frontend-solid/overlays/prod/replicas-patch.yaml b/apps/nxtgauge-frontend-solid/overlays/prod/replicas-patch.yaml deleted file mode 100644 index 533ceca..0000000 --- a/apps/nxtgauge-frontend-solid/overlays/prod/replicas-patch.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: nxtgauge-frontend-solid - namespace: nxtgauge -spec: - replicas: 1 diff --git a/scripts/set-app-release.sh b/scripts/set-app-release.sh new file mode 100755 index 0000000..4463341 --- /dev/null +++ b/scripts/set-app-release.sh @@ -0,0 +1,53 @@ +#!/usr/bin/env bash +set -euo pipefail + +if [ "$#" -lt 2 ] || [ "$#" -gt 3 ]; then + echo "usage: $0 [replicas]" >&2 + exit 1 +fi + +app="$1" +image_ref="$2" +replicas="${3:-1}" + +case "$app" in + admin-solid) + overlay="apps/nxtgauge-admin-solid/overlays/prod" + namespace="nxtgauge" + deployment="nxtgauge-admin-solid" + container="admin-solid" + ;; + frontend-solid) + overlay="apps/nxtgauge-frontend-solid/overlays/prod" + namespace="nxtgauge" + deployment="nxtgauge-frontend-solid" + container="frontend-solid" + ;; + ai-assistant) + overlay="apps/nxtgauge-ai-assistant/overlays/prod" + namespace="" + deployment="nxtgauge-ai-assistant" + container="ai-assistant" + ;; + *) + echo "unknown app: $app" >&2 + exit 1 + ;; +esac + +{ + echo 'apiVersion: apps/v1' + echo 'kind: Deployment' + echo 'metadata:' + if [ -n "$namespace" ]; then + echo " namespace: $namespace" + fi + echo " name: $deployment" + echo 'spec:' + echo " replicas: $replicas" + echo ' template:' + echo ' spec:' + echo ' containers:' + echo " - name: $container" + echo " image: $image_ref" +} > "$overlay/release-patch.yaml"