Appendix: Build and Deploy with GitLab CI

Use your browser to download either ivia-chapter-12.tar.gz or ivia-chapter-12.zip. The archive is self-contained; you do not need this tutorial repository.

cd ~/Downloads
tar -xzf ivia-chapter-12.tar.gz
cd ivia-chapter-12

Set-Location "$HOME\Downloads"
Expand-Archive -Path ivia-chapter-12.zip -DestinationPath . -Force
Set-Location ivia-chapter-12

All remaining relative paths in this chapter start from that extracted directory.

sed -n '1,260p' persistent-app/.gitlab-ci.yml

If the GitLab CLI is installed and authenticated, validate through the project API:

glab ci lint persistent-app/.gitlab-ci.yml

Otherwise copy the file contents into Build > Pipeline editor > Validate in GitLab. To run this package unchanged, push the extracted directory as the project root and set Settings > CI/CD > General pipelines > CI/CD configuration file to persistent-app/.gitlab-ci.yml. Its paths are relative to that self-contained project root.

In Settings > CI/CD > Variables, check or add:

• FRONTEND_HOST: for example <project>.<course>.ivia.isginf.ch (or simple-app.example.org).
• BACKEND_HOST: for example be.<project>.<course>.ivia.isginf.ch (or api.simple-app.example.org).
• KUBECONFIG_B64: base64-encoded least-privilege kubeconfig; masked.
• K8S_NAMESPACE: target namespace.

Course GitLab projects (ou-ivia-courses): When your project lives under an active course group in ou-ivia-courses, the course infrastructure automatically provisions your Kubernetes namespace (K8S_NAMESPACE), a namespace-scoped client certificate (KUBECONFIG_B64), a regcred pull secret inside that namespace, and group Harbor credentials (CI_REGISTRY set to harbor.ivia.ch/iviacoursereg, CI_REGISTRY_USER, and CI_REGISTRY_PWD). Do not overwrite those pre-provisioned variables and do not pass --create-namespace to Helm (student credentials are scoped to the existing namespace). You only need to set FRONTEND_HOST and BACKEND_HOST (or derive them from BASE_URL as in the course reference repo).

In a standalone GitLab project outside ou-ivia-courses, encode a namespace-scoped kubeconfig for KUBECONFIG_B64:

base64 -w 0 path/to/limited-kubeconfig

base64 < path/to/limited-kubeconfig | tr -d '\n'

[Convert]::ToBase64String(
  [IO.File]::ReadAllBytes("path\to\limited-kubeconfig")
)

Treat the output as a secret. Paste it directly into GitLab, not a shell history shared with others.

Trigger: the packaged deploy job runs when $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH (usually main). Test and build jobs define the earlier stages of the same file. Test and deploy jobs use the runner-shared tag; Buildah jobs use ivialab-student-cluster.

Stages

1. test — builds the React frontend and compiles the Python backend so broken code fails before images are pushed.
2. build — two Buildah jobs log in to the registry via --password-stdin, normalize the lowercased image prefix ${CI_REGISTRY}/${CI_PROJECT_PATH}, and push ${CI_REGISTRY_IMAGE}-frontend:${CI_COMMIT_SHORT_SHA} and ${CI_REGISTRY_IMAGE}-backend:${CI_COMMIT_SHORT_SHA}.
3. deploy — decodes KUBECONFIG_B64, logs Helm into the OCI registry, and upgrades the release with pinned chart 4.9.3.

If a test fails, open the job log in GitLab; later stages do not start. If a build fails, check registry login and Dockerfile context paths. If deploy fails, read the Helm job log and cluster events for the target namespace.

The deploy job executes:

helm upgrade --install simple-app "$CHART" \
  --version "$CHART_VERSION" \
  --namespace "$K8S_NAMESPACE" \
  --atomic --timeout 10m \
  -f persistent-app/values.yaml \
  --set components.frontend.image.repository="${CI_REGISTRY_IMAGE}-frontend" \
  --set components.frontend.image.tag="$CI_COMMIT_SHORT_SHA" \
  --set components.backend.image.repository="${CI_REGISTRY_IMAGE}-backend" \
  --set components.backend.image.tag="$CI_COMMIT_SHORT_SHA" \
  --set components.frontend.ingress.url="$FRONTEND_HOST" \
  --set components.backend.ingress.url="$BACKEND_HOST" \
  --set components.backend.pvcs[0].storageClassName=longhorn

Immutable commit tags tie a deployment to exact source. Because persistent-app/values.yaml templates config.js (API_URL) and CORS_ORIGINS from the frontend and backend ingress.url values, overriding FRONTEND_HOST and BACKEND_HOST automatically switches both URLs from http://*.simple-app.test (Minikube) to https://$FRONTEND_HOST and https://$BACKEND_HOST on the cluster, while --set components.backend.pvcs[0].storageClassName=longhorn switches the volume from Minikube's standard class to longhorn on ivia-students. --atomic rolls back failed upgrades and returns failure to GitLab. A resource_group prevents two deploy jobs from changing the same release concurrently.