[URGENT][TODO] Move away from Heroku by Nov 28, 2022

[webknjaz]

Apparently, they are sunsetting the free tier.

[webknjaz]

Deadline: November 28, 2022

• https://help.heroku.com/RSBRUH58/removal-of-heroku-free-product-plans-faq
• https://blog.heroku.com/next-chapter#focus-on-mission-critical

[ekohl]

FYI: Foreman runs an octomachinery-backed app on OpenShift. In https://github.com/theforeman/prprocessor#deployment-using-openshift I documented the steps. It may be possible to set a GH secret in another way, but those steps at least got me going. If you need more, feel free to reach out to me.

[webknjaz]

@ekohl thanks, I'll take a look! I've got access to a RH-sponsored instance years ago, but it was hard to get a newer Python there back then. Need to go through DO180 to get up to speed...

[webknjaz]

So I moved the bots on Nov 28, but wanted to go through some official s2i template examples that I researched years ago. I haven't moved back then, because there were no images in the image stream supporting Python 3.7, and I couldn't figure out how to change that.
The openshift cluster I got still doesn't have newer images, supposedly because it was created ~3 years ago, so it's still v3.
Anyway, I've figured out how to use an external image and got it working. So I'm hoping to publish that template at some point.

[webknjaz]

@ekohl one thing I haven't solved is TLS — did you figure out having HTTPS on a dedicated domain with Let's Encrypt?

[ekohl]

The instance we're on has a wildcard certificate for the domain it manages so we don't use a dedicated domain, just the one we got assigned. Since only GH connects to it I'd say a dedicated domain doesn't make sense.

Perhaps @evgeni remembers better how we set it up.

[evgeni]

Yeah, we just have our app configured with https://<funny-long-name>.openshiftapps.com/ and that has a valid cert issued by LE.
We didn't bother to try to host it on our domain.

[webknjaz]

Ah, too bad. It seems like my instance is also set up to drop the <funny-long-name> route (despite it being listed in the UI) from the setup so it doesn't even work when I have another route connected via CNAME.

[evgeni]

Is that a setup provided by osci.io or something else?

[webknjaz]

I don't think so, I don't remember exactly since I got it years ago, but my console is at https://console.rh-us-east-1.openshift.com.

[webknjaz]

I'm going to try this when I have time https://www.redhat.com/en/blog/dynamic-ssl-certificates-using-letsencrypt-openshift / https://github.com/tnozicka/openshift-acme, and maybe https://labs.consol.de/devops/2020/09/16/openshift-letsencrypt.html / https://computingforgeeks.com/use-lets-encrypt-wildcard-certificates-on-openshift-ingress-routes/.