Improve image update workflow

This improves the administrative workflow of deploying updated images to
the k8s cluster.  Still tag latest however, as that's important to
old-workflow.

Would be good to block this and have it fail on a db migration so it
doesn't happen accidently, and make the deployer deal with it.

.gitlab-ci.yml

@@ -3,8 +3,25 @@ build_image:
   services:
   - docker:dind
   script:
-    - docker build -f docker/Dockerfile -t asia.gcr.io/linuxconfsydney/symposion_app .
+    - docker build -f docker/Dockerfile -t asia.gcr.io/linuxconfsydney/symposion_app:$CI_COMMIT_SHA .
     - docker login -u _json_key -p "$GOOGLE_KEY" https://asia.gcr.io
+    - docker push asia.gcr.io/linuxconfsydney/symposion_app:$CI_COMMIT_SHA
+    - docker tag asia.gcr.io/linuxconfsydney/symposion_app:$CI_COMMIT_SHA asia.gcr.io/linuxconfsydney/symposion_app:latest
     - docker push asia.gcr.io/linuxconfsydney/symposion_app:latest
   only:
     - master
+
+k8s-prod-deploy:
+  image: google/cloud-sdk
+  stage: deploy
+  script:
+  - echo "$GOOGLE_KEY" > key.json
+  - gcloud auth activate-service-account --key-file key.json
+  - gcloud config set compute/zone australia-southeast1-b
+  - gcloud config set project linuxconfsydney
+  - gcloud config set container/use_client_certificate True
+  - gcloud container clusters get-credentials lca02
+  - kubectl --namespace=rego-prod set image deployment/symposion-app frontend=asia.gcr.io/linuxconfsydney/symposion_app:$CI_COMMIT_SHA
+  when: manual
+  only:
+  - master