Jenkins Pipeline)¶

SUPERSEDED - this is not the current staging path

This checklist describes the prerequisites for the planned future Kubernetes/Helm/Terraform staging pipeline (Jenkins → GHCR → Terraform → Helm → K3s), which remains on hold - see Deployment → Staging (legacy) for why. It is kept for historical/future-architecture reference only.

VayzoMart's current, live staging environment uses a much shorter prerequisite list on the shared-VPS Docker Compose architecture instead - see Deployment → Staging (VPS) for the canonical, actually-used runbook and its actual prerequisites (VPS .env secrets, GHCR pull auth, R2 buckets, a Let's Encrypt cert for stg.vayzomart.com - no Terraform, Helm, or kubeconfig involved).

The Vayzo staging pipeline is fully automated once a small set of environment bootstrap prerequisites exists outside git. These values and private keys must never be committed.

Exact release candidate¶

Run staging only from the current release/web-launch-readiness branch after GitHub Actions is green. Jenkins builds immutable backend/frontend images tagged with the 12-character Git SHA and deploys those exact tags.

Required Jenkins credentials¶

container-registry-creds — GHCR push credential.
k3s-kubeconfig-staging — kubeconfig allowed to reach the staging/shared K3s API.
terraform-state-r2-creds — R2 S3-compatible access/secret keys for Terraform remote state.
terraform-staging-tfvars — staging Terraform variables, including scoped Hetzner/Cloudflare credentials and staging-only DB/Redis values.
vayzo-staging-app-env — staging application secret file containing ConnectionStrings__DefaultConnection, ConnectionStrings__Redis, Jwt__SecretKey, FileStorage__R2__AccessKey, FileStorage__R2__SecretKey, and Razorpay__KeySecret.

Required non-secret Jenkins environment values¶

TERRAFORM_STATE_R2_ENDPOINT=https://<account-id>.r2.cloudflarestorage.com
STAGING_FRONTEND_HOST=<real staging hostname>
STAGING_R2_ENDPOINT_URL=<R2 S3 endpoint>
STAGING_R2_PUBLIC_BASE_URL=<public media base URL>
STAGING_RAZORPAY_KEY_ID=rzp_test_*

Origin TLS certificate — first-deployment blocker¶

Staging DNS is Cloudflare-proxied and the repository's Cloudflare security policy defaults to Full (strict). Helm staging values reference the Kubernetes TLS Secret:

akshayabazaar-staging-tls

That Secret is intentionally not generated from git because it contains a private key. Before the first staging deployment, provision either:

a Cloudflare Origin CA certificate for the staging hostname, or
a publicly trusted certificate issued by an external certificate-management process.

Store it in namespace akshayabazaar-staging as a kubernetes.io/tls Secret named akshayabazaar-staging-tls.

Do not work around this by changing Cloudflare to Flexible/off, disabling origin TLS, or committing certificate keys.

scripts/sync-k8s-secrets.sh now verifies that this Secret exists and has type kubernetes.io/tls before it changes the application Secret. A missing/malformed certificate therefore fails the automated release early instead of reaching Helm and later surfacing as a Cloudflare 526/HTTPS failure.

Production has the same fail-closed contract with akshayabazaar-production-tls, but production remains out of scope until staging/UAT is complete and an explicit release approval is given.

Automated checks after prerequisites exist¶

Jenkins then performs, without routine operator commands:

backend/frontend quality gates and dependency scans;
immutable Docker build and Trivy scan;
GHCR push using the commit SHA tag;
Terraform staging plan/apply from saved plan;
R2 upload/read/compare/delete probe;
Razorpay test-mode read-only credential preflight;
TLS prerequisite check and Kubernetes application Secret synchronization;
Helm --atomic deployment and EF migration Job;
Kubernetes/service/readiness verification;
external frontend/API, security and Playwright smoke;
disposable MySQL concurrency smoke;
k6 staging performance smoke;
automatic Helm rollback on behavioral verification failure;
archived release evidence.

A pipeline success is deployment evidence. Repository CI success alone must never be reported as a successful staging deployment.