GitHub Actions로 EKS 무중단 배포 - Blue-Green CI/CD

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-blue
  namespace: prod
  labels:
    app: myapp
    version: blue
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myapp
      version: blue
  template:
    metadata:
      labels:
        app: myapp
        version: blue
    spec:
      containers:
        - name: myapp
          image: 123456789012.dkr.ecr.ap-northeast-2.amazonaws.com/myapp:PLACEHOLDER
          ports:
            - containerPort: 8080
          readinessProbe:
            httpGet:
              path: /actuator/health/readiness
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 5
          livenessProbe:
            httpGet:
              path: /actuator/health/liveness
              port: 8080
            initialDelaySeconds: 20
            periodSeconds: 10

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-green
  namespace: prod
  labels:
    app: myapp
    version: green
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myapp
      version: green
  template:
    metadata:
      labels:
        app: myapp
        version: green
    spec:
      containers:
        - name: myapp
          image: 123456789012.dkr.ecr.ap-northeast-2.amazonaws.com/myapp:PLACEHOLDER
          ports:
            - containerPort: 8080
          readinessProbe:
            httpGet:
              path: /actuator/health/readiness
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 5
          livenessProbe:
            httpGet:
              path: /actuator/health/liveness
              port: 8080
            initialDelaySeconds: 20
            periodSeconds: 10

apiVersion: v1
kind: Service
metadata:
  name: myapp
  namespace: prod
spec:
  selector:
    app: myapp
    version: blue
  ports:
    - name: http
      port: 80
      targetPort: 8080

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myapp
  namespace: prod
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/healthcheck-path: /actuator/health/readiness
spec:
  rules:
    - host: api.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: myapp
                port:
                  number: 80

name: deploy-blue-green

on:
  push:
    branches: [ "main" ]

permissions:
  id-token: write
  contents: read

env:
  AWS_REGION: ap-northeast-2
  EKS_CLUSTER: my-eks
  NAMESPACE: prod
  APP_NAME: myapp
  ECR_REPO: 123456789012.dkr.ecr.ap-northeast-2.amazonaws.com/myapp

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-actions-deploy-role
          aws-region: ${{ env.AWS_REGION }}

      - name: Login to ECR
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build & Push
        id: build
        run: |
          set -euo pipefail
          IMAGE_TAG=${GITHUB_SHA::12}
          docker build -t $ECR_REPO:$IMAGE_TAG .
          docker push $ECR_REPO:$IMAGE_TAG
          echo "image=$ECR_REPO:$IMAGE_TAG" >> $GITHUB_OUTPUT

      - name: Setup kubectl
        run: |
          set -euo pipefail
          aws eks update-kubeconfig --name "$EKS_CLUSTER" --region "$AWS_REGION"
          kubectl version --client

      - name: Decide target color
        id: color
        run: |
          set -euo pipefail
          CURRENT=$(kubectl -n "$NAMESPACE" get svc "$APP_NAME" -o jsonpath='{.spec.selector.version}')
          if [ "$CURRENT" = "blue" ]; then
            TARGET="green"
          else
            TARGET="blue"
          fi
          echo "current=$CURRENT" >> $GITHUB_OUTPUT
          echo "target=$TARGET" >> $GITHUB_OUTPUT

      - name: Deploy to target (no traffic)
        run: |
          set -euo pipefail
          TARGET=${{ steps.color.outputs.target }}
          IMAGE=${{ steps.build.outputs.image }}

          kubectl -n "$NAMESPACE" set image deploy/${APP_NAME}-${TARGET} ${APP_NAME}=$IMAGE
          kubectl -n "$NAMESPACE" rollout status deploy/${APP_NAME}-${TARGET} --timeout=300s

      - name: Smoke test target (port-forward)
        run: |
          set -euo pipefail
          TARGET=${{ steps.color.outputs.target }}

          # target color의 Pod 하나를 골라 포트포워딩 후 readiness 확인
          POD=$(kubectl -n "$NAMESPACE" get pod -l app=$APP_NAME,version=$TARGET -o jsonpath='{.items[0].metadata.name}')
          kubectl -n "$NAMESPACE" port-forward pod/$POD 18080:8080 >/tmp/pf.log 2>&1 &
          PF_PID=$!
          sleep 2
          curl -fsS http://127.0.0.1:18080/actuator/health/readiness | cat
          kill $PF_PID

      - name: Switch traffic (Service selector)
        run: |
          set -euo pipefail
          TARGET=${{ steps.color.outputs.target }}

          kubectl -n "$NAMESPACE" patch svc "$APP_NAME" \
            -p '{"spec":{"selector":{"app":"'"$APP_NAME"'","version":"'"$TARGET"'"}}}'

      - name: Verify after switch
        run: |
          set -euo pipefail
          # 전환 직후 간단 검증(실서비스라면 synthetic check/외부 모니터링 연동 권장)
          kubectl -n "$NAMESPACE" get endpoints "$APP_NAME" -o wide

      - name: Rollback on failure
        if: failure()
        run: |
          set -euo pipefail
          CURRENT=${{ steps.color.outputs.current }}
          kubectl -n "$NAMESPACE" patch svc "$APP_NAME" \
            -p '{"spec":{"selector":{"app":"'"$APP_NAME"'","version":"'"$CURRENT"'"}}}'
          echo "Rolled back service selector to $CURRENT"