Repository navigation
Add a separate dev environment (api-dev.veri-fact.ai) - #175
Merged
Merged
Conversation
…e identical dev env on gcp.
- Grant dev node SA roles/artifactregistry.reader so pods can pull images - Mark API key/secret Terraform variables sensitive in dev and prod - Fail dev deploys early when service-account.json is missing - Document the manual Cloudflare api-dev record and service-account.json prerequisite
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a dev environment that copies prod for end-to-end testing, served at https://api-dev.veri-fact.ai. It's deployed from the
dev-envbranch withDEPLOY_ENV=dev ./infrastructure/deploy.sh.Dev runs in the same GCP project but has its own VPC, GKE cluster, Cloud SQL instance, static IP, certificate and Terraform state (
terraform/dev). Setup, day-to-day use and teardown are indocs/dev-environment.md.Changes
infrastructure/terraform-dev/(new): a copy of the prod Terraform config with-devnames, IP ranges that don't overlap prod, and its own state. The dev node service account also getsroles/artifactregistry.reader, which it needs to pull images. Prod's account has that access through roles granted by hand.infrastructure/deploy.sh: settingDEPLOY_ENV=devselects the dev cluster, Terraform config and health URL. Dev deploys:dev-envbranchservice-account.jsonis missingvertex-ai-credentialssecret if it doesn't existsensitivein both dev and prod, so plans no longer print them in plain text.app/main.py: adds the dev frontend's Vercel URL to the CORSallow_originslist.docs/dev-environment.md(new): setup and usage guide, including the manual Cloudflare DNS step.Impact on prod
./infrastructure/deploy.shwithoutDEPLOY_ENVbehaves exactly as before.sensitiveflags, which hide values in output and change no infrastructure.Testing
dev-env: both plans showed only creates, the rollout succeeded, and/v1/healthreturned 200 over HTTPS./v1/healthreturned 200 throughout.Manual steps (not in code)
Arecord forapi-devpointing to the dev static IP, set to DNS only (grey cloud). Already done.service-account.jsonmust be in the repo root before a dev deploy.