Skip to navigation
Account Payable to Fluxx HLD

Complete build and deploy web documents ai to UAT and PROD

 

As a DevOps Engineer    

I want to extend the CI/CD pipeline to deploy the Documents AI UI application to UAT and PROD environments    

So that we can promote tested releases through our complete deployment pipeline with proper environment-specific configurations and infrastructure provisioning  

 

Acceptance Criteria

1. Terraform Infrastructure Provisioning

Given UAT and PROD environments need Azure infrastructure  

When deploying to these environments  

Then the following Terraform artifacts must be created and applied:

  • Terraform module for AKS cluster provisioning (uat-eus2-adc-aks-001 and prod-eus2-adc-aks-001)

  • Terraform module for resource groups (uat-eus2-adc-app-rg-001 and prod-eus2-adc-app-rg-001)

  • Azure Managed Identity (UAMI) for workload identity in UAT and PROD

  • Azure Container Registry access permissions for UAT and PROD service principals

  • Istio gateway configuration for UAT (documentsai.uat.claitdev.com) and PROD (documentsai.claitdev.com)

  • Network policies and security groups aligned with production standards

  • Azure Key Vault for secrets management (if not using existing)

2. GitHub Environments Configuration

Given secure deployments require proper environment configurations  

When setting up UAT and PROD in GitHub  

Then the following must be configured:

  • GitHub environment uat created with required approvers

  • GitHub environment prod created with required approvers and protection rules

  • Environment-specific secrets configured:

  - NPM_TOKEN for package installation

  • Environment-specific variables configured:

  - AZURE_CLIENT_ID (UAT and PROD service principal IDs)

  - AZURE_TENANT_ID

  - AZURE_SUBSCRIPTION_ID

  - ACR_SUBSCRIPTION_ID

  - ACR_NAME

3. Helm Values Files Creation

Given UAT and PROD require environment-specific configurations  

When deploying the application  

Then the following helm values files must be created:

  • helm/values-uat.yaml with:

  - Environment set to “uat”

  - Replica count (minimum 2 for HA)

  - Autoscaling configuration (minReplicas: 2, maxReplicas: 20)

  - Resource limits appropriate for UAT load

  - Istio host: documentsai.uat.claitdev.com

  - Azure Workload Identity Client ID for UAT UAMI

  - Environment variables (REACT_APP_AZURE_AD_CLIENT_ID, REACT_APP_API_URL, etc.)

  • helm/values-prod.yaml with:

  - Environment set to “prod”

  - Replica count (minimum 3 for HA)

  - Autoscaling configuration (minReplicas: 3, maxReplicas: 50)

  - Resource limits appropriate for production load

  - Istio host: documentsai.claitdev.com

  - Azure Workload Identity Client ID for PROD UAMI

  - Production-grade environment variables

  - Pod disruption budget enabled

  - Network policy enabled

4. GitHub Actions Workflow Updates

Given the CI/CD pipeline needs UAT and PROD deployment jobs  

When code is merged to main branch  

Then the workflow must:

  • Add package-deploy-uat job that:

  - Depends on successful package-deploy-qa deployment

  - Uses GitHub environment uat

  - Sets ENV_ABBR: uat

  - Deploys to AKS cluster uat-eus2-adc-aks-001

  - Uses resource group uat-eus2-adc-app-rg-001

  - Applies helm/values-uat.yaml configuration

  - Uses proper image tag from github.sha

  • Add package-deploy-prod job that:

  - Depends on successful package-deploy-uat deployment

  - Uses GitHub environment prod

  - Sets ENV_ABBR: prod

  - Deploys to AKS cluster prod-eus2-adc-aks-001

  - Uses resource group prod-eus2-adc-app-rg-001

  - Applies helm/values-prod.yaml configuration

  - Uses proper image tag from github.sha

  - Only runs on main branch (if: github.ref == 'refs/heads/main')

5. Deployment Validation

Given deployments to UAT and PROD must be verified  

When the deployment completes successfully  

Then the following validations must pass:

  • Health check endpoints return 200 OK

  • Application is accessible via configured Istio hostnames

  • Pod readiness and liveness probes are functioning

  • Autoscaling is properly configured and responds to load

  • Workload identity authentication works correctly

  • Application logs show no critical errors

  • All pods are in Running state with correct replica count

6. Rollback Strategy

Given deployments may need to be rolled back  

When issues are detected in UAT or PROD  

Then:

  • Helm rollback commands are documented

  • Previous release artifacts are retained in ACR

  • Rollback procedure is tested in lower environments

7. Documentation

Given teams need to understand the deployment process  

When the feature is complete  

Then:

  • Update README.md with UAT and PROD deployment information

  • Document Terraform infrastructure requirements

  • Document required Azure permissions and service principals

  • Create runbook for manual deployments if needed

  • Document environment-specific URLs and access methods

Technical Notes

  • Deployment Flow: SBX → DEV → QA → UAT → PROD

  • ACR: Uses existing cladevops.azurecr.io registry

  • Namespace: All deployments use doc-ai namespace

  • Action Versions: Use template-hub actions at appropriate versions

  • Region: All environments use eus2 (East US 2) region

Definition of Done

  • All acceptance criteria are met

  • Successful deployment to UAT environment verified

  • Successful deployment to PROD environment verified

  • Code review completed and approved

  • Documentation updated

  • Terraform state stored securely in Azure Storage

  • No security vulnerabilities introduced

  • Monitoring and alerting configured for UAT and PROD