Define/implement a secure deployment pattern

[s-matyukevich]

Here is what I plan to use:

1. European region in one of the public clouds (most likely GCP or AWS)
2. Managed kubernetes cluster (GKE or EKS)
3. Github actions for CI/CD
4. Cloud-native solution for secret store/management (Something like this)

The thing that I am most worried about is the fact that our website should contain fund payment credentials. Our deployment pattern must avoid storing those credentials on developers' laptops and passing them over the internet. Ideally, I would like to avoid storing them in the k8s secrets and inside the pod filesystem either, but this may be overkill for now.

We probably need 2 environments: prod and staging. I think we can share the k8s cluster for them at least for now. Our CI/CD should automatically deploy the latest version of the master branch to staging and provide a manual way to deploy a specific commit/tag to prod.

[s-matyukevich]

No need to store payment key anymore. I think the first deployment pipeline will be a simple bash script that deployed the website to k8s using kubectl directly. We may revisit this later if we need to auto-deploy master