> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://cla-demo.postmansolutions.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://cla-demo.postmansolutions.com/_mcp/server. # Complete build and deploy web documents ai to UAT and PROD **As a** DevOps Engineer **I want** to extend the CI/CD pipeline to deploy the Documents AI UI application to UAT and PROD environments **So that** we can promote tested releases through our complete deployment pipeline with proper environment-specific configurations and infrastructure provisioning --- ## Acceptance Criteria ### 1. Terraform Infrastructure Provisioning **Given** UAT and PROD environments need Azure infrastructure **When** deploying to these environments **Then** the following Terraform artifacts must be created and applied: * [ ] Terraform module for AKS cluster provisioning (`uat-eus2-adc-aks-001` and `prod-eus2-adc-aks-001`) * [ ] Terraform module for resource groups (`uat-eus2-adc-app-rg-001` and `prod-eus2-adc-app-rg-001`) * [ ] Azure Managed Identity (UAMI) for workload identity in UAT and PROD * [ ] Azure Container Registry access permissions for UAT and PROD service principals * [ ] Istio gateway configuration for UAT (`documentsai.uat.claitdev.com`) and PROD (`documentsai.claitdev.com`) * [ ] Network policies and security groups aligned with production standards * [ ] Azure Key Vault for secrets management (if not using existing) ### 2. GitHub Environments Configuration **Given** secure deployments require proper environment configurations **When** setting up UAT and PROD in GitHub **Then** the following must be configured: * [ ] GitHub environment `uat` created with required approvers * [ ] GitHub environment `prod` created with required approvers and protection rules * [ ] Environment-specific secrets configured: \- `NPM_TOKEN` for package installation * [ ] Environment-specific variables configured: \- `AZURE_CLIENT_ID` (UAT and PROD service principal IDs) \- `AZURE_TENANT_ID` \- `AZURE_SUBSCRIPTION_ID` \- `ACR_SUBSCRIPTION_ID` \- `ACR_NAME` ### 3. Helm Values Files Creation **Given** UAT and PROD require environment-specific configurations **When** deploying the application **Then** the following helm values files must be created: * [ ] `helm/values-uat.yaml` with: \- Environment set to "uat" \- Replica count (minimum 2 for HA) \- Autoscaling configuration (minReplicas: 2, maxReplicas: 20) \- Resource limits appropriate for UAT load \- Istio host: `documentsai.uat.claitdev.com` \- Azure Workload Identity Client ID for UAT UAMI \- Environment variables (REACT\_APP\_AZURE\_AD\_CLIENT\_ID, REACT\_APP\_API\_URL, etc.) * [ ] `helm/values-prod.yaml` with: \- Environment set to "prod" \- Replica count (minimum 3 for HA) \- Autoscaling configuration (minReplicas: 3, maxReplicas: 50) \- Resource limits appropriate for production load \- Istio host: `documentsai.claitdev.com` \- Azure Workload Identity Client ID for PROD UAMI \- Production-grade environment variables \- Pod disruption budget enabled \- Network policy enabled ### 4. GitHub Actions Workflow Updates **Given** the CI/CD pipeline needs UAT and PROD deployment jobs **When** code is merged to main branch **Then** the workflow must: * [ ] Add `package-deploy-uat` job that: \- Depends on successful `package-deploy-qa` deployment \- Uses GitHub environment `uat` \- Sets `ENV_ABBR: uat` \- Deploys to AKS cluster `uat-eus2-adc-aks-001` \- Uses resource group `uat-eus2-adc-app-rg-001` \- Applies `helm/values-uat.yaml` configuration \- Uses proper image tag from `github.sha` * [ ] Add `package-deploy-prod` job that: \- Depends on successful `package-deploy-uat` deployment \- Uses GitHub environment `prod` \- Sets `ENV_ABBR: prod` \- Deploys to AKS cluster `prod-eus2-adc-aks-001` \- Uses resource group `prod-eus2-adc-app-rg-001` \- Applies `helm/values-prod.yaml` configuration \- Uses proper image tag from `github.sha` \- Only runs on main branch (`if: github.ref == 'refs/heads/main'`) ### 5. Deployment Validation **Given** deployments to UAT and PROD must be verified **When** the deployment completes successfully **Then** the following validations must pass: * [ ] Health check endpoints return 200 OK * [ ] Application is accessible via configured Istio hostnames * [ ] Pod readiness and liveness probes are functioning * [ ] Autoscaling is properly configured and responds to load * [ ] Workload identity authentication works correctly * [ ] Application logs show no critical errors * [ ] All pods are in Running state with correct replica count ### 6. Rollback Strategy **Given** deployments may need to be rolled back **When** issues are detected in UAT or PROD **Then**: * [ ] Helm rollback commands are documented * [ ] Previous release artifacts are retained in ACR * [ ] Rollback procedure is tested in lower environments ### 7. Documentation **Given** teams need to understand the deployment process **When** the feature is complete **Then**: * [ ] Update `README.md` with UAT and PROD deployment information * [ ] Document Terraform infrastructure requirements * [ ] Document required Azure permissions and service principals * [ ] Create runbook for manual deployments if needed * [ ] Document environment-specific URLs and access methods --- ## Technical Notes * **Deployment Flow**: SBX → DEV → QA → UAT → PROD * **ACR**: Uses existing `cladevops.azurecr.io` registry * **Namespace**: All deployments use `doc-ai` namespace * **Action Versions**: Use template-hub actions at appropriate versions * **Region**: All environments use `eus2` (East US 2) region ## Definition of Done * [ ] All acceptance criteria are met * [ ] Successful deployment to UAT environment verified * [ ] Successful deployment to PROD environment verified * [ ] Code review completed and approved * [ ] Documentation updated * [ ] Terraform state stored securely in Azure Storage * [ ] No security vulnerabilities introduced * [ ] Monitoring and alerting configured for UAT and PROD