cat > secrets.json <<EOF
{
  "DB_USERNAME": "example_user",
  "DB_PASSWORD": "example_pass",
  "API_KEY": "example_api_key",
  "JWT_SECRET": "example_jwt_secret"
}
EOF
 
aws secretsmanager create-secret \
  --name {{SECRET_NAME}} \
  --secret-string file://secrets.json \
  --region {{AWS_REGION}}

apiVersion: v1
kind: ConfigMap
metadata:
  name: {{APP_CONFIGMAP_NAME}}
data:
  NODE_ENV: "uat"
  PORT: "443"
  LOG_LEVEL: "info"
  BASE_URL: "https://{{SERVICE_DOMAIN_UAT}}"
  FEATURE_TOGGLE_XYZ: "true"

kubectl apply -f manifest/configmap.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{APP_DEPLOYMENT_NAME}}
spec:
  replicas: 1
  selector:
    matchLabels:
      app: {{APP_DEPLOYMENT_NAME}}
  template:
    metadata:
      labels:
        app: {{APP_DEPLOYMENT_NAME}}
    spec:
      containers:
      - name: {{APP_DEPLOYMENT_NAME}}
        image: {{ECR_REPO_URL}}:latest
        ports:
        - containerPort: 443
        envFrom:
        - configMapRef:
            name: {{APP_CONFIGMAP_NAME}}
        - secretRef:
            name: {{APP_SECRET_NAME}}

pipeline {
  agent any
 
  environment {
    registry       = '{{ECR_REPO_URL}}'
    aws_region     = '{{AWS_REGION}}'
    eks_cluster    = '{{EKS_CLUSTER_NAME}}'
    secret_name    = '{{SECRET_NAME}}'
    aws_credentials = '{{JENKINS_AWS_CREDENTIALS_ID}}'
  }
 
  stages {
 
    stage('Cleanup Old Build') {
      steps {
        sh 'docker system prune -f || true'
      }
    }
 
    stage('Docker Build & Push') {
      steps {
        sh '''
          docker build -t $registry:latest .
          aws ecr get-login-password --region $aws_region \
            | docker login --username AWS --password-stdin $registry
          docker push $registry:latest
        '''
      }
    }
 
    stage('Fetch Secrets from AWS Secrets Manager') {
      steps {
        withAWS(credentials: aws_credentials, region: "${aws_region}") {
          sh '''
            aws secretsmanager get-secret-value \
              --secret-id $secret_name \
              --region $aws_region \
              --query SecretString \
              --output text > secrets.json
 
            jq -r 'to_entries|map("\\(.key)=\\(.value)")|.[]' secrets.json > .env.k8s
 
            kubectl create secret generic {{APP_SECRET_NAME}} \
              --from-env-file=.env.k8s \
              --dry-run=client -o yaml | kubectl apply -f -
          '''
        }
      }
    }
 
    stage('Deploy to EKS') {
      steps {
        withAWS(credentials: aws_credentials, region: "${aws_region}") {
          sh '''
            aws eks update-kubeconfig \
              --region $aws_region --name $eks_cluster
 
            kubectl apply -f manifest/configmap.yaml
            kubectl apply -f manifest/deployment.yaml
            kubectl apply -f manifest/service.yaml
            kubectl apply -f manifest/hpa.yaml
            kubectl apply -f manifest/ingress.yaml
 
            kubectl rollout status deployment/{{APP_DEPLOYMENT_NAME}}
          '''
        }
      }
    }
  }
 
  post {
    always {
      cleanWs()
    }
  }
}