Ship Your App

​

Pick your route

• Your repository is on GitHub and you want Ankra to handle the build and the deploy: use Applications. It is the only route where Ankra writes the Dockerfile, the manifests and the CI definition for you.
• You already have CI you want to keep, or your code is on GitLab: keep your CI and have it commit the new image tag to the GitOps repository.
• You want CI inside your own cluster: Ankra Pipelines. To also deploy, connect the repository as an application; the pipeline then builds its image.

​

Applications (Closed Beta)

​

Ship from your checkout

ankra application ship .

1. Register. If your organisation has no application for this repository yet, ship registers one, with the same flags as ankra application add. The GitHub credential and the branch are detected when you do not pass --credential and --branch.
2. Wait for setup. Ankra analyses the repository and opens the setup pull request. ship prints its URL.
3. Wait for you to merge the setup pull request. This is the one step that needs a person.
4. Wait for a green build of the tracked branch.
5. Deploy to the cluster, in a namespace derived from the application name unless you pass --namespace.
6. Wait until the workload is running, then print the public URL when the application has one.

​

How a merge redeploys

• an Ankra pipeline run whose publish stage re-tagged the image as sha-<7> in your registry,
• a completed, successful run of the generated GitHub Actions workflow or of your own workflow,
• an Ankra platform build.

# On or off, the branch it watches, and the newest build seen there
ankra application auto-deploy get <application-id>

# Turn it off, or back on
ankra application auto-deploy set <application-id> --enabled=false
ankra application auto-deploy set <application-id> --enabled

​

Where the image is built

• A pull request preview of a pipeline-built application deploys the digest the pipeline built for that pull request’s head. Nothing else is needed.
• A pull request preview of any other application needs an image tagged sha-<7> of the head commit, pr-<number> or the branch name in the application’s registry. The generated workflow never pushes one for a pull request, so those previews only work when your own CI pushes such a tag.
• A branch demo deploys a tag that already exists. With the generated workflow or the generated pipeline, only the tracked branch gets one; for any other branch, build its head on platform builders or pick an existing tag.

​

Preview a change before merge

• PR preview environments deploy every pull request automatically, post a status comment with the link, redeploy on each push and tear the copy down when the pull request closes.
• Branch demos launch a copy of any branch by hand, with its own environment variables, an optional throwaway Postgres and a teardown timer.

​

Bring your own CI

• Connect a GitOps repository to the cluster under the cluster’s Settings → GitOps. It must be on GitHub or Bitbucket Cloud: Ankra does not sync cluster configuration from GitLab. Your application code and CI can live anywhere.
• Deploy the application once as a manifest in a Stack. Ankra writes it to clusters/<cluster-name>-<short-id>/stacks/<stack-name>/manifests/<manifest-name>.yaml in the GitOps repository. That is the file your CI edits.
• Give CI a token that can push to the GitOps repository, and nothing more. On GitHub, a fine-grained personal access token with Contents read and write on that one repository.
• Let the cluster pull the image. For a private registry, add an image pull secret to the Stack (encrypt it with SOPS) and reference it from the Deployment.

name: build-and-deploy
on:
  push:
    branches: [main]

permissions:
  contents: read
  packages: write

env:
  IMAGE: ghcr.io/my-org/my-app
  MANIFEST: clusters/my-cluster-<short-id>/stacks/my-app/manifests/my-app.yaml

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build and push an immutable tag
        run: |
          TAG="sha-${GITHUB_SHA::7}"
          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
          docker build -t "$IMAGE:$TAG" .
          docker push "$IMAGE:$TAG"
          echo "TAG=$TAG" >> "$GITHUB_ENV"

      - name: Check out the GitOps repository
        uses: actions/checkout@v4
        with:
          repository: my-org/my-gitops-repo
          token: ${{ secrets.GITOPS_TOKEN }}
          path: gitops

      - name: Commit the new tag
        working-directory: gitops
        run: |
          sed -i "s|image: ${IMAGE}:.*|image: ${IMAGE}:${TAG}|" "$MANIFEST"
          git config user.name "ci-bot"
          git config user.email "[email protected]"
          git commit -am "Deploy my-app ${TAG}"
          git push

stages: [build, deploy]

variables:
  IMAGE: $CI_REGISTRY_IMAGE
  MANIFEST: clusters/my-cluster-<short-id>/stacks/my-app/manifests/my-app.yaml

build:
  stage: build
  image: docker:27
  services: [docker:27-dind]
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
  script:
    - echo "$CI_REGISTRY_PASSWORD" | docker login -u "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"
    - docker build -t "$IMAGE:sha-$CI_COMMIT_SHORT_SHA" .
    - docker push "$IMAGE:sha-$CI_COMMIT_SHORT_SHA"

deploy:
  stage: deploy
  image: alpine:3.20
  needs: [build]
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
  script:
    - apk add --no-cache git
    - git clone "https://x-access-token:${GITOPS_TOKEN}@github.com/my-org/my-gitops-repo.git" gitops
    - cd gitops
    - 'sed -i "s|image: ${IMAGE}:.*|image: ${IMAGE}:sha-${CI_COMMIT_SHORT_SHA}|" "$MANIFEST"'
    - git config user.name "ci-bot"
    - git config user.email "[email protected]"
    - git commit -am "Deploy my-app sha-${CI_COMMIT_SHORT_SHA}"
    - git push

​

Next steps