8.5 CI/CD & Kubernetes Deployment

← Back to Chapter 8: Testing, Deployment & Production-Ready Spring Boot

Productionizing Spring Boot applications requires automated continuous integration, container vulnerability scanning, and robust deployment orchestration on Kubernetes.

---

1. GitHub Actions CI/CD Pipeline

name: Build & Deploy Spring Boot Service

on:
  push:
    branches: [ main ]

jobs:
  build-and-test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'temurin'
          cache: maven

      - name: Run Unit & Slice Tests
        run: ./mvnw clean test

      - name: Build Layered OCI Image
        run: |
          ./mvnw package -DskipTests
          docker build -t ghcr.io/sarwvidya/order-service:${{ github.sha }} .

      - name: Push Container to Registry
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
          docker push ghcr.io/sarwvidya/order-service:${{ github.sha }}

---

2. Kubernetes Deployment Manifest

apiVersion: apps/v1
kind: Deployment
metadata:
  name: order-service
  labels:
    app: order-service
spec:
  replicas: 3
  selector:
    matchLabels:
      app: order-service
  template:
    metadata:
      labels:
        app: order-service
    spec:
      containers:
        - name: order-service
          image: ghcr.io/sarwvidya/order-service:latest
          ports:
            - containerPort: 8080
          resources:
            requests:
              memory: "512Mi"
              cpu: "250m"
            limits:
              memory: "1Gi"
              cpu: "1000m"
          env:
            - name: SPRING_PROFILES_ACTIVE
              value: "prod"
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: db-credentials
                  key: password

          # Kubernetes Probes tied to Spring Boot Actuator:
          livenessProbe:
            httpGet:
              path: /actuator/health/liveness
              port: 8080
            initialDelaySeconds: 20
            periodSeconds: 10

          readinessProbe:
            httpGet:
              path: /actuator/health/readiness
              port: 8080
            initialDelaySeconds: 15
            periodSeconds: 5

---

3. Liveness vs Readiness Probes

• Liveness Probe (/actuator/health/liveness): Asks "Is the application deadlocked or in an unrecoverable state?" If this probe fails, Kubernetes kills and restarts the pod container.
• Readiness Probe (/actuator/health/readiness): Asks "Is the application ready to receive user traffic?" If the database connection is initializing or cache warmup is ongoing, the probe fails and Kubernetes temporarily excludes the pod from the Service load balancer without restarting it.