# ACC Services Migration Checklist

**Per Service Migration Checklist** - Follow these 4 key touchpoints

---

## Service: ___________________________

**Environments**: [ ] dev [ ] qa [ ] uat [ ] prod [ ] other: _______

**Namespace**: redtag

**Technology**: [ ] Node.js [ ] Python [ ] Java | Version: _______

**Framework**: [ ] NestJS [ ] Express [ ] FastAPI [ ] Other: _______

---

## ✅ Touchpoint 1: Create DevOps Files in tbi-devops-environments

**Location**: `/Users/iakpabio/Desktop/git-code/tbi-code/tbi-devops-environments/dev/[service-name]/`

### Files to Create:

- [ ] **CircleCI Config**: `.circleci/config.yml`
  - Copy from: `dev/tbi-acc-hotel-mapping-service/.circleci/config.yml`
  - Update service name throughout
  - Configure branches (develop, qa, uat, master)
  - Set correct contexts (devops-mgt, devops-mgt-qa, etc.)

- [ ] **Dockerfile**: `docker/Dockerfile`
  - Copy from: `dev/tbi-acc-hotel-mapping-service/docker/Dockerfile`
  - Update Node.js version if needed
  - Update entry point (CMD) - check package.json `start:prod` script
  - Verify dependencies

- [ ] **Setup Script**: `scripts/setup-kubectl.sh`
  - Copy from: `dev/tbi-acc-hotel-mapping-service/scripts/setup-kubectl.sh`
  - No changes needed (generic script)

- [ ] **Deploy Script**: `scripts/deploy-services.sh`
  - Copy from: `dev/tbi-acc-hotel-mapping-service/scripts/deploy-services.sh`
  - Update `SERVICE_NAME` variable
  - Update `NAMESPACE` if different from redtag
  - Verify all service name references

- [ ] **Helm Chart**: `charts/[service-name]/`
  - [ ] `Chart.yaml` - Update name, description
  - [ ] `values.yaml` - Basic values (usually minimal)
  - [ ] `templates/deployment.yaml` - Pod configuration
  - [ ] `templates/service.yaml` - Service definition
  - [ ] `templates/secrets.yaml` - SOPS integration
  - [ ] `templates/ingress.yaml` - Ingress configuration
  - [ ] `templates/hpa.yaml` - Horizontal Pod Autoscaler
  - [ ] `templates/pdb.yaml` - Pod Disruption Budget

- [ ] **Documentation**:
  - [ ] `README.md` - Service-specific setup guide
  - [ ] `SETUP-SUMMARY.md` - Quick reference

**Commit Command**:
```bash
cd /Users/iakpabio/Desktop/git-code/tbi-code/tbi-devops-environments
git add dev/[service-name]
git commit -m "Add CI/CD pipeline for [service-name]

- CircleCI config with lint, test, build, deploy stages
- Multi-stage Dockerfile
- Deployment scripts with critical fixes
- Complete Helm chart with all templates
- Documentation

Part of ACC services pipeline migration to CircleCI.
"
git push origin master
```

---

## ✅ Touchpoint 2: Update Values, Secrets, and Requirements in tbi-environments

**Location**: `/Users/iakpabio/Desktop/git-code/tbi-code/tbi-environments/`

### For Each Environment (dev, qa, uat, prod):

#### Values File: `[env]/values/[service-name].yaml`

- [ ] **Check if exists**: `ls -la [env]/values/[service-name].yaml`
- [ ] **If exists**: Review and verify configuration
  - [ ] `name:` matches service name
  - [ ] `group: "redtag"` (namespace)
  - [ ] `ingress_enabled: true` (if needed)
  - [ ] `ingress_type: internal-nginx` or `nginx`
  - [ ] `hostName:` correct for environment
  - [ ] `port: 80` and `targetPort: 3000` (or appropriate ports)
  - [ ] `node_env:` correct for environment
  - [ ] `autoscaling:` configured
  - [ ] `pdb:` configured
- [ ] **If doesn't exist**: Create from template
  ```bash
  cp dev/values/tbi-acc-hotel-mapping-service.yaml [env]/values/[service-name].yaml
  # Edit and customize
  ```

#### Secrets File: `[env]/secrets/secrets.[service-name].yaml`

- [ ] **Check if exists**: `ls -la [env]/secrets/secrets.[service-name].yaml`
- [ ] **If exists**: Verify it's encrypted
  ```bash
  file [env]/secrets/secrets.[service-name].yaml
  # Should show: "data" (encrypted)
  ```
- [ ] **If not encrypted**: Encrypt it
  ```bash
  sops -e -i [env]/secrets/secrets.[service-name].yaml
  ```
- [ ] **If doesn't exist**: Create and encrypt
  ```bash
  # Create file with structure:
  # configs:
  #     dotenv: |-
  #         KEY1=value1
  #         KEY2=value2
  
  # Then encrypt:
  sops -e -i [env]/secrets/secrets.[service-name].yaml
  ```

#### Requirements File: `[env]/requirements.yaml`

- [ ] **Check if entry exists**:
  ```bash
  grep "name: [service-name]" [env]/requirements.yaml
  ```
- [ ] **If exists**: Verify version will be updated by deploy script
- [ ] **If doesn't exist**: Add entry
  ```yaml
  - name: [service-name]
    version: 0.0.1  # Will be updated by deploy script
    repository: https://tbi-charts.s3.amazonaws.com
  ```

**Commit Command**:
```bash
cd /Users/iakpabio/Desktop/git-code/tbi-code/tbi-environments
git add [env]/values/[service-name].yaml
git add [env]/secrets/secrets.[service-name].yaml
git add [env]/requirements.yaml
git commit -m "Update values, secrets, and requirements for [service-name]

Environment: [env]
- Verified/updated values file
- Verified/encrypted secrets file
- Updated requirements.yaml

Part of ACC services pipeline migration to CircleCI.
"
git push origin master
```

---

## ✅ Touchpoint 3: Deploy GitHub Actions Config in Service App (Master Branch)

**Location**: `/Users/iakpabio/Desktop/git-code/tbi-code/[service-name]/`

### Files to Create/Update:

- [ ] **VERSION File**: `VERSION`
  - [ ] Check if exists: `ls -la VERSION`
  - [ ] If doesn't exist, create:
    ```bash
    echo "1.0.0" > VERSION
    ```
  - [ ] If exists, verify format (e.g., `1.0.0`)

- [ ] **GitHub Actions Workflow**: `.github/workflows/manage-secrets.yml`
  - [ ] Copy from: `dev/tbi-acc-hotel-mapping-service/.github/workflows/manage-secrets.yml`
  - [ ] Update service name in workflow
  - [ ] Verify branch triggers (master/main)
  - [ ] Verify paths to secrets files

**Commit Command**:
```bash
cd /Users/iakpabio/Desktop/git-code/tbi-code/[service-name]
git checkout master  # or main
git pull origin master

# Add files
git add VERSION
git add .github/workflows/manage-secrets.yml

git commit -m "Add VERSION file and secrets management workflow

- VERSION file for CircleCI pipeline versioning
- GitHub Actions workflow for secrets management
- Syncs secrets from tbi-environments to service repo

Part of ACC services pipeline migration to CircleCI.
"
git push origin master
```

**⚠️ Important**: This must be done on the **master/main branch**, not develop!

---

## ✅ Touchpoint 4: Check and Update Helm Chart Files Per Service

**Location**: `/Users/iakpabio/Desktop/git-code/tbi-code/tbi-devops-environments/dev/[service-name]/charts/[service-name]/`

### Chart.yaml

- [ ] **name**: Matches service name
- [ ] **version**: Set to `0.0.1` (will be updated by deploy script)
- [ ] **appVersion**: Set to `0.0.1` (will be updated by deploy script)
- [ ] **description**: Accurate description of service

### values.yaml

- [ ] Usually minimal or empty
- [ ] Any default values that apply to all environments

### templates/deployment.yaml

- [ ] **metadata.name**: Uses `{{ .Values.name }}`
- [ ] **namespace**: Uses `{{ .Values.group }}`
- [ ] **image**: Uses `{{ .Values.image }}`
- [ ] **imagePullPolicy**: `Always` or `IfNotPresent`
- [ ] **ports**: Correct containerPort (usually 3000)
- [ ] **env**: Loads from secrets using `envFrom`
- [ ] **resources**: Proper limits and requests
  ```yaml
  resources:
    requests:
      memory: "256Mi"
      cpu: "100m"
    limits:
      memory: "512Mi"
      cpu: "500m"
  ```
- [ ] **livenessProbe**: Configured (if applicable)
- [ ] **readinessProbe**: Configured (if applicable)

### templates/service.yaml

- [ ] **type**: `ClusterIP` (or `LoadBalancer` if needed)
- [ ] **port**: Matches values file (usually 80)
- [ ] **targetPort**: Matches container port (usually 3000)
- [ ] **selector**: Matches deployment labels

### templates/secrets.yaml

- [ ] Uses helm-secrets plugin
- [ ] Loads from `secrets.yaml` in tbi-environments
- [ ] Format:
  ```yaml
  apiVersion: v1
  kind: Secret
  metadata:
    name: {{ .Values.name }}-secret
    namespace: {{ .Values.group }}
  type: Opaque
  stringData:
    {{- range $key, $value := .Values.configs }}
    {{ $key }}: {{ $value | quote }}
    {{- end }}
  ```

### templates/ingress.yaml

- [ ] **Conditional**: `{{- if .Values.ingress_enabled }}`
- [ ] **ingressClassName**: Uses `{{ .Values.ingress_type }}`
- [ ] **host**: Uses `{{ .Values.hostName }}`
- [ ] **annotations**: Includes cert-manager and nginx annotations
- [ ] **tls**: Configured with cert-manager
- [ ] **backend service**: Points to correct service and port

### templates/hpa.yaml

- [ ] **minReplicas**: From `{{ .Values.autoscaling.minReplicas }}`
- [ ] **maxReplicas**: From `{{ .Values.autoscaling.maxReplicas }}`
- [ ] **metrics**: CPU and/or memory based
- [ ] **targetCPUUtilizationPercentage**: Usually 70%

### templates/pdb.yaml

- [ ] **minAvailable**: From `{{ .Values.pdb.minAvailable }}`
- [ ] **selector**: Matches deployment labels

---

## 🧪 Testing and Validation

### Test in Dev Environment

- [ ] **Trigger CircleCI Pipeline**:
  ```bash
  cd /Users/iakpabio/Desktop/git-code/tbi-code/[service-name]
  git checkout develop
  # Make a small change to trigger pipeline
  echo "# CircleCI Pipeline Test" >> README.md
  git add README.md
  git commit -m "Test CircleCI pipeline"
  git push origin develop
  ```

- [ ] **Monitor CircleCI**: https://app.circleci.com/pipelines/github/redlabelvacations
  - [ ] Lint and test job passes
  - [ ] Build and push images job passes
  - [ ] Deploy to Kubernetes job passes

- [ ] **Verify Deployment**:
  ```bash
  # Check pod status
  kubectl get pods -n redtag | grep [service-name]
  
  # Check pod logs
  kubectl logs -n redtag deployment/[service-name]
  
  # Check ingress
  kubectl get ingress -n redtag | grep [service-name]
  
  # Test endpoint (if applicable)
  curl https://[service-name].dev.tbidevelopment.ca/health
  ```

- [ ] **Compare with Existing Deployment**:
  - [ ] Image tag is correct
  - [ ] Environment variables match
  - [ ] Resource limits match
  - [ ] Service responds correctly

### Rollout to Other Environments

For each environment (qa, uat, prod):

- [ ] **Update CircleCI Config**: Add branch to workflow filters
- [ ] **Verify Values and Secrets**: Exist for environment
- [ ] **Test Deployment**: Push to environment branch
- [ ] **Validate**: Check pod status and functionality

---

## 📝 Documentation

- [ ] **Update Migration Tracker**: Mark service as complete in `AIRTABLE-MIGRATION-TRACKER.md`
- [ ] **Document Issues**: Note any problems encountered and solutions
- [ ] **Update Airtable** (optional): Update CICD-Pipeline-Migration table

---

## ⚠️ Common Issues Checklist

- [ ] **Entry Point**: Dockerfile CMD matches package.json `start:prod` script
- [ ] **Ingress**: Uses `ingress_enabled` not `ingress.enabled`
- [ ] **Ports**: Both `port` and `targetPort` defined in values
- [ ] **Secrets Format**: Uses `|-` literal block scalar
- [ ] **Git Commit Check**: Deploy script checks for changes before committing
- [ ] **Requirements Update**: Deploy script updates requirements.yaml
- [ ] **Image Tag**: Uses immutable tags (no `latest`)
- [ ] **Namespace**: Correct namespace in all templates

---

## ✅ Completion Criteria

Service migration is complete when:

- [x] All DevOps files created in tbi-devops-environments
- [x] Values, secrets, and requirements updated in tbi-environments
- [x] VERSION and GitHub Actions deployed to service master branch
- [x] Helm charts verified and updated
- [x] CircleCI pipeline runs successfully
- [x] Service deploys to dev environment
- [x] Pod is running and healthy
- [x] Endpoints respond correctly
- [x] Rolled out to all required environments
- [x] Documentation updated
- [x] Migration tracker updated

---

**Time Estimate**: 2-3 hours per service

**Next Service**: ___________________________