Deploy to AKS

Code Push → Lint & Test → Build Docker Image → Push to ACR → Helm Deploy → AKS Cluster
                                                                    ↓
                                                              Staging → Smoke Tests → Production (with approval)

- uses: azure/login@v2
  with:
    creds: |
      {
        "clientId": "${{ secrets.AZURE_CLIENT_ID }}",
        "clientSecret": "${{ secrets.AZURE_CLIENT_SECRET }}",
        "tenantId": "${{ secrets.AZURE_TENANT_ID }}",
        "subscriptionId": "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
      }

permissions:
  id-token: write   # Required for OIDC
  contents: read

steps:
  - uses: azure/login@v2
    with:
      client-id: ${{ secrets.AZURE_CLIENT_ID }}
      tenant-id: ${{ secrets.AZURE_TENANT_ID }}
      subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

- run: az aks get-credentials --resource-group ${{ vars.RESOURCE_GROUP }} --cluster-name ${{ vars.CLUSTER_NAME }} --overwrite-existing

- uses: azure/docker-login@v1
  with:
    login-server: ${{ vars.ACR_NAME }}.azurecr.io
    username: ${{ secrets.ACR_USERNAME }}
    password: ${{ secrets.ACR_PASSWORD }}

- uses: docker/build-push-action@v5
  with:
    push: true
    tags: |
      ${{ vars.ACR_NAME }}.azurecr.io/myapp:${{ github.sha }}
      ${{ vars.ACR_NAME }}.azurecr.io/myapp:latest
    cache-from: type=gha
    cache-to: type=gha,mode=max

- uses: azure/aks-set-context@v3
  with:
    resource-group: ${{ vars.RESOURCE_GROUP }}
    cluster-name: ${{ vars.CLUSTER_NAME }}

- run: |
    helm upgrade --install myapp ./charts/myapp \
      --namespace production \
      --create-namespace \
      --set image.repository=${{ vars.ACR_NAME }}.azurecr.io/myapp \
      --set image.tag=${{ github.sha }} \
      --set ingress.host=myapp.example.com \
      --wait --timeout 5m

# .github/workflows/deploy-aks.yml
name: Build & Deploy to AKS
on:
  push:
    branches: [main]

permissions:
  id-token: write
  contents: read

jobs:
  lint-and-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
      - run: npm ci
      - run: npm run lint
      - run: npm test

  build-and-push:
    needs: lint-and-test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - uses: azure/docker-login@v1
        with:
          login-server: ${{ vars.ACR_NAME }}.azurecr.io
          username: ${{ secrets.ACR_USERNAME }}
          password: ${{ secrets.ACR_PASSWORD }}

      - uses: docker/setup-buildx-action@v3
      - uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: |
            ${{ vars.ACR_NAME }}.azurecr.io/myapp:${{ github.sha }}
            ${{ vars.ACR_NAME }}.azurecr.io/myapp:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

  deploy-staging:
    needs: build-and-push
    runs-on: ubuntu-latest
    environment: staging
    steps:
      - uses: actions/checkout@v4

      - uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - uses: azure/aks-set-context@v3
        with:
          resource-group: ${{ vars.RESOURCE_GROUP }}
          cluster-name: ${{ vars.CLUSTER_NAME }}

      - uses: azure/setup-helm@v3
        with:
          version: v3.14.0

      - run: |
          helm upgrade --install myapp ./charts/myapp \
            --namespace staging \
            --create-namespace \
            --set image.repository=${{ vars.ACR_NAME }}.azurecr.io/myapp \
            --set image.tag=${{ github.sha }} \
            --set ingress.host=staging.myapp.example.com \
            --atomic --wait --timeout 5m

  smoke-test:
    needs: deploy-staging
    runs-on: ubuntu-latest
    steps:
      - run: |
          echo "Running smoke tests against staging..."
          for i in 1 2 3 4 5; do
            STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://staging.myapp.example.com/health)
            if [ "$STATUS" = "200" ]; then
              echo "Health check passed (attempt $i)"
              exit 0
            fi
            echo "Attempt $i: got $STATUS, retrying in 10s..."
            sleep 10
          done
          echo "Smoke test failed after 5 attempts"
          exit 1

  deploy-production:
    needs: smoke-test
    runs-on: ubuntu-latest
    environment: production   # Requires manual approval
    steps:
      - uses: actions/checkout@v4

      - uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - uses: azure/aks-set-context@v3
        with:
          resource-group: ${{ vars.RESOURCE_GROUP }}
          cluster-name: ${{ vars.CLUSTER_NAME }}

      - uses: azure/setup-helm@v3
        with:
          version: v3.14.0

      - run: |
          helm upgrade --install myapp ./charts/myapp \
            --namespace production \
            --create-namespace \
            --set image.repository=${{ vars.ACR_NAME }}.azurecr.io/myapp \
            --set image.tag=${{ github.sha }} \
            --set ingress.host=myapp.example.com \
            --atomic --wait --timeout 5m

# In your Helm chart's deployment.yaml
spec:
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0        # Never kill old pods before new ones are ready
      maxSurge: 1              # Add one extra pod during rollout
  template:
    spec:
      containers:
        - name: myapp
          readinessProbe:        # CRITICAL — traffic only routes when ready
            httpGet:
              path: /health
              port: 3000
            initialDelaySeconds: 5
            periodSeconds: 10
          lifecycle:
            preStop:             # Allow in-flight requests to finish
              exec:
                command: ["sleep", "15"]

# GitHub Actions workflow — Blue-Green via Helm
  deploy-green:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4
      - uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
      - uses: azure/aks-set-context@v3
        with:
          resource-group: ${{ vars.RESOURCE_GROUP }}
          cluster-name: ${{ vars.CLUSTER_NAME }}

      # Step 1: Deploy to GREEN slot (inactive)
      - name: Deploy to green slot
        run: |
          helm upgrade --install myapp-green ./charts/myapp \
            --namespace production \
            --set image.tag=${{ github.sha }} \
            --set slot=green \
            --set service.enabled=false \
            --atomic --wait --timeout 5m

      # Step 2: Smoke test green slot via port-forward or internal service
      - name: Smoke test green
        run: |
          kubectl port-forward svc/myapp-green 8080:80 -n production &
          sleep 5
          STATUS=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:8080/health)
          kill %1
          if [ "$STATUS" != "200" ]; then
            echo "::error::Green slot health check failed (HTTP $STATUS)"
            helm uninstall myapp-green -n production
            exit 1
          fi
          echo "Green slot is healthy ✅"

      # Step 3: Switch traffic from blue → green
      - name: Switch traffic to green
        run: |
          kubectl patch service myapp -n production \
            -p '{"spec":{"selector":{"slot":"green"}}}'
          echo "Traffic switched to green ✅"

      # Step 4: Keep blue as rollback target (scale down after 30 min)
      - name: Schedule blue cleanup
        run: |
          echo "Blue slot kept for rollback. Remove manually after validation:"
          echo "  helm uninstall myapp-blue -n production"

  canary-deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
      - uses: azure/aks-set-context@v3
        with:
          resource-group: ${{ vars.RESOURCE_GROUP }}
          cluster-name: ${{ vars.CLUSTER_NAME }}

      # Deploy canary with 1 replica (stable has 5)
      - name: Deploy canary
        run: |
          helm upgrade --install myapp-canary ./charts/myapp \
            --namespace production \
            --set image.tag=${{ github.sha }} \
            --set replicaCount=1 \
            --set canary=true \
            --atomic --wait --timeout 5m

      # Monitor error rate for 5 minutes
      - name: Monitor canary health
        run: |
          echo "Monitoring canary for 5 minutes..."
          for i in $(seq 1 30); do
            STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
              https://myapp.example.com/health)
            ERRORS=$(kubectl logs -l app=myapp,canary=true \
              -n production --tail=50 | grep -c "ERROR" || true)
            echo "Check $i/30 — HTTP: $STATUS, Errors: $ERRORS"
            if [ "$ERRORS" -gt 5 ]; then
              echo "::error::Canary error rate too high — rolling back"
              helm uninstall myapp-canary -n production
              exit 1
            fi
            sleep 10
          done
          echo "Canary healthy after 5 minutes ✅"

      # Promote: update stable release to new version
      - name: Promote to stable
        run: |
          helm upgrade --install myapp ./charts/myapp \
            --namespace production \
            --set image.tag=${{ github.sha }} \
            --set replicaCount=5 \
            --atomic --wait --timeout 5m
          # Remove canary
          helm uninstall myapp-canary -n production

┌──────────┐    ┌──────────────┐    ┌──────────────┐    ┌──────────┐
│ Git Push │───▶│ Lint & Test  │───▶│ Docker Build │───▶│ ACR Push │
└──────────┘    └──────────────┘    └──────────────┘    └────┬─────┘
                                                             │
                    ┌────────────────────────────────────────┘
                    ▼
            ┌──────────────┐    ┌──────────────┐    ┌──────────────────┐
            │ Helm Deploy  │───▶│ Smoke Tests  │───▶│  Manual Approval │
            │  (Staging)   │    │  (Staging)   │    │                  │
            └──────────────┘    └──────────────┘    └────────┬─────────┘
                                                             │
                                              ┌──────────────┼──────────────┐
                                              ▼              ▼              ▼
                                      ┌────────────┐ ┌────────────┐ ┌────────────┐
                                      │  Rolling   │ │ Blue-Green │ │  Canary    │
                                      │  Update    │ │ Switch     │ │  → Promote │
                                      └────────────┘ └────────────┘ └────────────┘

Helm deploy failed?
├── "ACR login failed"
│   ├── Credentials wrong → Check ACR_USERNAME/PASSWORD or OIDC config
│   ├── SP expired → az ad sp credential reset
│   └── Firewall blocking → Whitelist GitHub runner IPs or use self-hosted
│
├── "UPGRADE FAILED" / timeout
│   ├── kubectl get pods → ImagePullBackOff?
│   │   ├── Image tag missing → Check ACR tags
│   │   └── ACR not attached → az aks update --attach-acr
│   ├── kubectl get pods → CrashLoopBackOff?
│   │   ├── kubectl logs <pod> → App startup error
│   │   └── kubectl describe pod → Missing env vars, bad config
│   ├── kubectl get pods → Pending?
│   │   └── kubectl describe pod → Resource quota exceeded / no nodes
│   └── kubectl get pods → Running but not Ready?
│       └── Readiness probe failing → Check /health endpoint
│
├── "OIDC token request failed"
│   ├── Missing permissions: id-token: write
│   ├── Subject claim mismatch → Check federated credential
│   └── Audience mismatch → Verify api://AzureADTokenExchange
│
└── Workflow succeeded but app shows old version
    ├── Wrong namespace → Check --namespace flag
    ├── Image tag not updated → Check --set image.tag value
    └── Cached image → Check imagePullPolicy: Always