# iTravel Affiliate Production CircleCI Pipeline

## Overview
Production CircleCI pipeline for iTravel Affiliate app deployment.

## Production URLs
- **Production**: https://secure-itravel-aff.itravel2000.com/
- **Dev**: https://secure-itravel-aff-dev.itravel2000.com/vacations/test ✅
- **UAT**: https://secure-itravel-aff-uat.itravel2000.com/vacations/test ✅

## Configuration

### Service Details
- **Service Name**: `tbi-itravel-aff-booking-path`
- **Namespace**: `itravel`
- **Environment**: `prod`
- **Cluster**: `tbi-prod`
- **Source Repository**: `https://github.com/redlabelvacations/tbi-rlv-booking-path`
- **Branch**: `master` (for production)

### CircleCI Workflow

The production pipeline has an **approval gate** before deployment:

1. **lint-and-test**: Runs tests and linting
2. **build-prod**: Builds and pushes Docker image to ECR
3. **hold-for-approval**: ⚠️ **Manual approval required**
4. **deploy-prod**: Deploys to production Kubernetes cluster

### Required CircleCI Context

Production uses the `devops-mgt-prod` context with:
- `GITHUB_TOKEN` - GitHub access token
- `AWS_ACCOUNT_ID` - Production AWS account ID (495680544243)
- `AWS_REGION` - AWS region (ca-central-1)
- `CLUSTER_NAME` - Kubernetes cluster name (tbi-prod)

## Deployment Process

### 1. Trigger Production Build

Push to `master` branch in `tbi-rlv-booking-path` repository:

```bash
cd /path/to/tbi-rlv-booking-path
git checkout master
git pull origin master
# Make your changes
git add .
git commit -m "Production release: <description>"
git push origin master
```

### 2. Monitor CircleCI Pipeline

1. Go to CircleCI dashboard
2. Find the `tbi-rlv-booking-path` project
3. Watch the pipeline progress:
   - ✅ lint-and-test
   - ✅ build-prod
   - ⏸️ hold-for-approval (WAITING)

### 3. Approve Deployment

1. In CircleCI, click on the **hold-for-approval** step
2. Click **Approve** to proceed with production deployment
3. The `deploy-prod` job will start automatically

### 4. Verify Deployment

After deployment completes:

```bash
# Check if image was pushed to ECR
aws ecr describe-images \
  --repository-name tbi-itravel-aff-booking-path \
  --profile tbi-prod \
  --region ca-central-1 \
  --query 'sort_by(imageDetails,& imagePushedAt)[-5:].imageTags[0]'

# Check pod status
kubectl get pods -n itravel --context=tbi-prod | grep aff

# Check ingress
kubectl get ingress -n itravel --context=tbi-prod | grep aff

# Test the endpoint
curl -I https://secure-itravel-aff.itravel2000.com/
```

## Files in This Directory

```
prod/tbi-itravel-aff-booking-path/
├── .circleci/
│   └── config.yml                    # CircleCI pipeline with approval gate
├── scripts/
│   ├── deploy-services.sh            # Deployment script (DEPLOY_ENV=prod)
│   └── setup-kubectl.sh              # Kubernetes setup script
├── docker/
│   └── Dockerfile                    # Production Docker build
└── charts/tbi-itravel-aff-booking-path/
    ├── Chart.yaml                    # Helm chart metadata
    ├── values.yaml                   # Default values
    └── templates/                    # Kubernetes manifests
```

## Related Files in tbi-environments

- **Values**: `/Users/sdevaraj/Git/tbi-environments-1/prod/values/tbi-itravel-aff-booking-path.yaml`
- **Secrets**: `/Users/sdevaraj/Git/tbi-environments-1/prod/secrets/secrets.tbi-itravel-aff-booking-path.yaml`
- **Requirements**: `/Users/sdevaraj/Git/tbi-environments-1/prod/requirements.yaml`

## Important Notes

### 1. Approval Gate
Production deployments require manual approval in CircleCI. This prevents accidental deployments and allows for:
- Final review of changes
- Coordination with team
- Deployment during maintenance windows

### 2. Image Tagging
Production images are tagged with: `{VERSION}-master-{BUILD_NUM}`
Example: `2.1.19-master-850`

### 3. Ingress Configuration
Production uses external `nginx` ingress (not internal-nginx like dev/UAT):
```yaml
ingress_type: nginx  # External access
```

### 4. DNS Configuration
Ensure DNS is configured in Route53:
- **Hostname**: `secure-itravel-aff.itravel2000.com`
- **Type**: CNAME
- **Value**: Points to production load balancer

### 5. Imperva Protection
Production endpoint should be protected by Imperva WAF.

## Rollback Procedure

If issues occur in production:

### Option 1: Rollback via Helm
```bash
# List releases
helm list -n itravel --kube-context tbi-prod

# Rollback to previous version
helm rollback tbi-itravel-aff-booking-path -n itravel --kube-context tbi-prod
```

### Option 2: Deploy Previous Version
1. Update `prod/requirements.yaml` with previous version
2. Run deployment pipeline manually
3. Approve the deployment

### Option 3: Emergency Rollback
```bash
cd /Users/sdevaraj/Git/tbi-environments-1
# Update requirements.yaml with previous version
python3 _helpers/deploy_pipeline/deploy-pipeline upgrade-components prod tbi-itravel-aff-booking-path
```

## Troubleshooting

### Pipeline Fails at Build
- Check Dockerfile exists in `prod/tbi-itravel-aff-booking-path/docker/`
- Verify AWS credentials in CircleCI context
- Check ECR repository permissions

### Deployment Fails
- Verify `prod/values/tbi-itravel-aff-booking-path.yaml` exists
- Check secrets file is properly encrypted
- Verify entry in `prod/requirements.yaml`
- Check Kubernetes cluster connectivity

### Image Not Found
- Verify image was pushed to ECR
- Check image tag matches requirements.yaml
- Verify AWS account ID is correct (495680544243)

## Monitoring

- **Datadog**: Configured with `DD_ENV: "production"`
- **Logs**: `kubectl logs -n itravel -l app=tbi-itravel-aff-booking-path --context=tbi-prod`
- **Metrics**: HPA configured for auto-scaling

## Security

- All secrets managed via SOPS encryption
- Production context uses separate AWS credentials
- Manual approval required for all deployments
- Immutable image tags (no 'latest' tag)

---

**Created**: 2026-03-05  
**Status**: Ready for production deployment  
**Prerequisites**: Dev and UAT successfully deployed ✅