infra: blue/green deployments

.github/workflows/ci.yml

@@ -24,7 +24,7 @@ jobs:
     needs: [lint, test]
     strategy:
       matrix:
-        app: [gateway, web, websockets, workers]
+        app: [gateway, websockets, workers]
     uses: ./.github/workflows/deploy-app.yml
     with:
       app-name: ${{ matrix.app }}

apps/infra/Pulumi.app-production-web.yaml

@@ -0,0 +1 @@
+encryptionsalt: v1:H8lEi2UXZLE=:v1:JKwRl5r98f0cySKx:7XXIpIHQtXfXtN5UyhorIAyb17mjhg==

apps/infra/src/deployments/gateway.ts → apps/infra/src/app/production/gateway.ts

@@ -9,7 +9,7 @@ import {
   privateSubnets,
   resolve,
   vpcId,
-} from '../shared'
+} from '../../shared'
 import { coreStack, environment } from './shared'
 
 const DNS_ADDRESS = 'gateway.latitude.so'

apps/infra/src/deployments/web.ts → apps/infra/src/app/production/web.ts

@@ -1,77 +1,24 @@
 import * as aws from '@pulumi/aws'
 import { Cluster } from '@pulumi/aws/ecs'
-import * as docker from '@pulumi/docker'
 import * as pulumi from '@pulumi/pulumi'
 
 import {
   ecsSecurityGroup,
   ecsTaskExecutionRole,
   privateSubnets,
-  resolve,
   vpcId,
-} from '../shared'
-import {
-  coreStack,
-  environment,
-  postHogApiKey,
-  sentryDsn,
-  sentryOrg,
-  sentryProject,
-} from './shared'
+} from '../../shared'
+import { coreStack, environment } from './shared'
 
 const DNS_ADDRESS = 'app.latitude.so'
 
 // Create an ECR repository
 const repo = new aws.ecr.Repository('latitude-llm-app-repo')
 const coreRepo = new aws.ecr.Repository('latitude-llm-core-repo')
 
-// Build and push the Docker image
-const token = await aws.ecr.getAuthorizationToken()
-
-const image = pulumi
-  .all([sentryDsn, sentryOrg, sentryProject, postHogApiKey])
-  .apply(
-    ([sentryDsn, sentryOrg, sentryProject, postHogApiKey]) =>
-      new docker.Image('LatitudeLLMAppImage', {
-        build: {
-          platform: 'linux/amd64',
-          context: resolve('../../../'),
-          dockerfile: resolve('../../../apps/web/docker/Dockerfile'),
-          cacheFrom: {
-            images: [pulumi.interpolate`${repo.repositoryUrl}:latest`],
-          },
-          args: {
-            SENTRY_DSN: sentryDsn,
-            SENTRY_ORG: sentryOrg,
-            SENTRY_PROJECT: sentryProject,
-            NEXT_PUBLIC_POSTHOG_KEY: postHogApiKey,
-            NEXT_PUBLIC_POSTHOG_HOST: 'https://eu.i.posthog.com',
-          },
-        },
-        imageName: pulumi.interpolate`${repo.repositoryUrl}:latest`,
-        registry: {
-          server: repo.repositoryUrl,
-          username: token.userName,
-          password: pulumi.secret(token.password),
-        },
-      }),
-  )
-const coreImage = new docker.Image('LatitudeLLMCoreImage', {
-  build: {
-    platform: 'linux/amd64',
-    context: resolve('../../../'),
-    dockerfile: resolve('../../../packages/core/docker/Dockerfile'),
-    cacheFrom: {
-      images: [pulumi.interpolate`${coreRepo.repositoryUrl}:latest`],
-    },
-  },
-  imageName: pulumi.interpolate`${coreRepo.repositoryUrl}:latest`,
-  registry: {
-    server: coreRepo.repositoryUrl,
-    username: token.userName,
-    password: pulumi.secret(token.password),
-  },
-})
+// Use existing images (replace 'latest' with the specific tag you want to deploy)
+const imageName = pulumi.interpolate`${repo.repositoryUrl}:latest`
+const coreImageName = pulumi.interpolate`${coreRepo.repositoryUrl}:latest`
 
 // Create a Fargate task definition
 const containerName = 'LatitudeLLMAppContainer'
@@ -82,7 +29,7 @@ const logGroup = new aws.cloudwatch.LogGroup('LatitudeLLMAppLogGroup', {
 })
 
 const taskDefinition = pulumi
-  .all([logGroup.name, image.imageName, coreImage.imageName, environment])
+  .all([logGroup.name, imageName, coreImageName, environment])
   .apply(
     ([logGroupName, imageName, coreImageName, environment]) =>
       new aws.ecs.TaskDefinition('LatitudeLLMAppTaskDefinition', {
@@ -140,7 +87,7 @@ const taskDefinition = pulumi
       }),
   )
 
-const targetGroup = new aws.lb.TargetGroup('LatitudeLLMAppTg', {
+const greenTargetGroup = new aws.lb.TargetGroup('LatitudeLLMAppTg', {
   port: 8080,
   vpcId,
   protocol: 'HTTP',
@@ -156,13 +103,12 @@ const targetGroup = new aws.lb.TargetGroup('LatitudeLLMAppTg', {
 })
 
 const defaultListenerArn = coreStack.requireOutput('defaultListenerArn')
-
 new aws.lb.ListenerRule('LatitudeLLMAppListenerRule', {
   listenerArn: defaultListenerArn,
   actions: [
     {
       type: 'forward',
-      targetGroupArn: targetGroup.arn,
+      targetGroupArn: greenTargetGroup.arn,
     },
   ],
   conditions: [
@@ -175,28 +121,111 @@ new aws.lb.ListenerRule('LatitudeLLMAppListenerRule', {
 })
 
 const cluster = coreStack.requireOutput('cluster') as pulumi.Output<Cluster>
-new aws.ecs.Service('LatitudeLLMApp', {
+
+const ecsService = new aws.ecs.Service('LatitudeLLMApp', {
   cluster: cluster.arn,
   taskDefinition: taskDefinition.arn,
   desiredCount: 2,
   launchType: 'FARGATE',
   forceNewDeployment: true,
   enableExecuteCommand: true,
+  deploymentController: {
+    type: 'CODE_DEPLOY',
+  },
   networkConfiguration: {
     subnets: privateSubnets.ids,
     assignPublicIp: false,
     securityGroups: [ecsSecurityGroup],
   },
   loadBalancers: [
     {
-      targetGroupArn: targetGroup.arn,
+      targetGroupArn: greenTargetGroup.arn,
       containerName,
       containerPort: 8080,
     },
   ],
-  triggers: {
-    digest: image.repoDigest,
-    coreDigest: coreImage.repoDigest,
+})
+
+const blueTargetGroup = new aws.lb.TargetGroup('LatitudeLLMAppBlueTg', {
+  port: 8080,
+  vpcId,
+  protocol: 'HTTP',
+  targetType: 'ip',
+  healthCheck: {
+    path: '/api/health',
+    interval: 5,
+    timeout: 2,
+    healthyThreshold: 2,
+    unhealthyThreshold: 2,
+  },
+  deregistrationDelay: 5,
+})
+
+const codeDeployApp = new aws.codedeploy.Application(
+  'LatitudeLLMCodeDeployApp',
+  {
+    computePlatform: 'ECS',
+  },
+)
+
+const codeDeployServiceRole = new aws.iam.Role('codeDeployServiceRole', {
+  assumeRolePolicy: JSON.stringify({
+    Version: '2012-10-17',
+    Statement: [
+      {
+        Action: 'sts:AssumeRole',
+        Effect: 'Allow',
+        Principal: {
+          Service: 'codedeploy.amazonaws.com',
+        },
+      },
+    ],
+  }),
+})
+
+// Attach the AWSCodeDeployRoleForECS policy to the role
+new aws.iam.RolePolicyAttachment('codeDeployPolicy', {
+  policyArn: 'arn:aws:iam::aws:policy/AWSCodeDeployRoleForECS',
+  role: codeDeployServiceRole,
+})
+
+new aws.codedeploy.DeploymentGroup('LatitudeLLMDeploymentGroup', {
+  appName: codeDeployApp.name,
+  serviceRoleArn: codeDeployServiceRole.arn,
+  deploymentConfigName: 'CodeDeployDefault.ECSAllAtOnce',
+  deploymentGroupName: 'LatitudeLLMDeploymentGroup',
+  ecsService: {
+    clusterName: cluster.name,
+    serviceName: ecsService.name,
+  },
+  autoRollbackConfiguration: {
+    enabled: true,
+    events: ['DEPLOYMENT_FAILURE'],
+  },
+  blueGreenDeploymentConfig: {
+    deploymentReadyOption: {
+      actionOnTimeout: 'CONTINUE_DEPLOYMENT',
+      waitTimeInMinutes: 0,
+    },
+    terminateBlueInstancesOnDeploymentSuccess: {
+      action: 'TERMINATE',
+      terminationWaitTimeInMinutes: 5,
+    },
+  },
+  deploymentStyle: {
+    deploymentOption: 'WITH_TRAFFIC_CONTROL',
+    deploymentType: 'BLUE_GREEN',
+  },
+  loadBalancerInfo: {
+    targetGroupPairInfo: {
+      prodTrafficRoute: {
+        listenerArns: [defaultListenerArn],
+      },
+      targetGroups: [
+        { name: blueTargetGroup.name },
+        { name: greenTargetGroup.name },
+      ],
+    },
   },
 })
 

apps/infra/src/deployments/websockets.ts → apps/infra/src/app/production/websockets.ts

@@ -9,7 +9,7 @@ import {
   privateSubnets,
   resolve,
   vpcId,
-} from '../shared'
+} from '../../shared'
 import { coreStack, environment } from './shared'
 
 const DNS_ADDRESS = 'ws.latitude.so'

apps/infra/src/deployments/workers.ts → apps/infra/src/app/production/workers.ts

@@ -8,7 +8,7 @@ import {
   ecsTaskExecutionRole,
   privateSubnets,
   resolve,
-} from '../shared'
+} from '../../shared'
 import { coreStack, environment } from './shared'
 
 const repo = new aws.ecr.Repository('latitude-llm-workers-repo')

apps/infra/src/index.ts

@@ -2,20 +2,12 @@ import * as pulumi from '@pulumi/pulumi'
 
 const stack = pulumi.getStack()
 
-// NOTE: ORDER MATTERS!
 let result
-if (stack.startsWith('core')) {
+if (stack === 'core') {
   result = await import('./core')
-} else if (stack.startsWith('websockets')) {
-  result = await import('./deployments/websockets')
-} else if (stack.startsWith('web')) {
-  result = await import('./deployments/web')
-} else if (stack.startsWith('gateway')) {
-  result = await import('./deployments/gateway')
-} else if (stack.startsWith('workers')) {
-  result = await import('./deployments/workers')
 } else {
-  console.error(`Unknown stack: ${stack}`)
+  const [action, environment, app] = stack.split('-')
+  result = await import(`./${action}/${environment}/${app}`)
 }
 
 export default result