CI/CD PIPELINE: NODE + K8S

DOCKERFILE
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
RUN npm run build

FROM node:20-alpine
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=3s \
  CMD node -e "require('http').get('http://localhost:3000/health', (r) => {if (r.statusCode !== 200) throw new Error(r.statusCode)})"
CMD exec node dist/server.js

Image size: 180MB (multi-stage optimized)
Scan: Trivy for CVEs before push

GITHUB ACTIONS WORKFLOW (.github/workflows/deploy.yml)
Trigger: Push to main branch

Stage 1: BUILD (4 min)
✓ Checkout code
✓ Run npm test (Jest, 12 test suites)
✓ Build Docker image
✓ Push to registry (ghcr.io)
✓ SBOM generation (CycloneDX)

Stage 2: SECURITY SCAN (2 min)
✓ Trivy scan for CVE-high
✓ SAST scan (CodeQL)
✓ DAST: Light smoke test against image
✓ Block deployment if critical vulns found

Stage 3: DEPLOY (3 min)
✓ Update K8s manifests with new image tag
✓ Apply via kubectl apply (GitOps)
✓ Rollout status check (await 5 min timeout)
✓ Post-deploy smoke tests (hit /health endpoint)
✓ Notify Slack on success/failure

Total pipeline time: 9 minutes end-to-end

KUBERNETES MANIFESTS (k8s/)

Deployment (node-app-deploy.yaml)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: node-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: node-app
  template:
    metadata:
      labels:
        app: node-app
    spec:
      containers:
      - name: app
        image: ghcr.io/myorg/node-app:TAG
        ports:
        - containerPort: 3000
        env:
        - name: NODE_ENV
          value: "production"
        - name: DB_URL
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: url
        livenessProbe:
          httpGet:
            path: /health
            port: 3000
          initialDelaySeconds: 10
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /ready
            port: 3000
          initialDelaySeconds: 5
          periodSeconds: 5
        resources:
          requests:
            memory: "256Mi"
            cpu: "100m"
          limits:
            memory: "512Mi"
            cpu: "500m"

Service (node-app-service.yaml)
apiVersion: v1
kind: Service
metadata:
  name: node-app-svc
spec:
  type: LoadBalancer
  selector:
    app: node-app
  ports:
  - protocol: TCP
    port: 80
    targetPort: 3000

Ingress (node-app-ingress.yaml)
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: node-app-ingress
spec:
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: node-app-svc
            port:
              number: 80

Rolling Update Strategy:
• Max surge: 1 replica
• Max unavailable: 0 (zero-downtime deployments)
• Rollback: Automatic if readiness probe fails for 2 minutes

MONITORING & OBSERVABILITY
✓ Prometheus scrape config for app metrics
✓ Logging: stdout collected by ELK/Loki
✓ Alerts: Slack notification on deployment failure or pod crash
✓ Dashboard: Grafana for deployment frequency, error rate, latency

INCIDENT RESPONSE RUNBOOK
If deployment fails:
  1. Check pod logs: kubectl logs -f pod/node-app-xxxxx
  2. Inspect last 2 commits for breaking changes
  3. Automatic rollback kicks in if probe fails
  4. Escalation: Slack alert tagged to on-call

DELIVERABLES
✓ Dockerfile (optimized, scanned)
✓ GitHub Actions workflow (ready to copy/paste)
✓ 3 K8s manifests (deployment, service, ingress)
✓ Local testing: docker-compose.yml for dev simulation
✓ Runbook: Troubleshooting guide for common issues