Skip to content

Commit 16b2f39

Browse files
sandyforresternhssandyforresternhs
committed
NRL-1798 Resolve conflicts
2 parents 9114730 + 8581fcc commit 16b2f39

File tree

24 files changed

+248
-299
lines changed

24 files changed

+248
-299
lines changed

‎.github/workflows/deploy-account-wide-infra.yml‎

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
name: Deploy Account-wide infrastructure
2+
run-name: Account-wide infra deployment to ${{ inputs.environment }} of ${{ inputs.branch_name }} by ${{ github.actor }}
3+
4+
on:
5+
workflow_dispatch:
6+
inputs:
7+
environment:
8+
description: "Account to deploy to"
9+
required: true
10+
default: "account-dev"
11+
type: environment
12+
branch_name:
13+
description: Branch to deploy
14+
required: true
15+
16+
permissions:
17+
id-token: write
18+
contents: read
19+
actions: write
20+
21+
jobs:
22+
check-selected-environment:
23+
name: Check Workflow Env
24+
runs-on: codebuild-nhsd-nrlf-ci-build-project-${{ github.run_id }}-${{ github.run_attempt }}
25+
steps:
26+
- name: Validate environment
27+
env:
28+
IS_VALID_ENV: ${{ startsWith(inputs.environment, 'account-') }}
29+
run: |
30+
echo "valid workflow environment selected:" $IS_VALID_ENV
31+
if [[ $IS_VALID_ENV == true ]]; then
32+
exit 0
33+
fi
34+
echo "This workflow can only be run with 'account-*' environments as it deploys account-specific infrastructure"
35+
exit 1
36+
37+
terraform-plan:
38+
name: Terraform Plan - ${{ inputs.environment }}
39+
environment: ${{ inputs.environment }}
40+
needs: [check-selected-environment]
41+
runs-on: codebuild-nhsd-nrlf-ci-build-project-${{ github.run_id }}-${{ github.run_attempt }}
42+
43+
steps:
44+
- name: Git clone - ${{ inputs.branch_name }}
45+
uses: actions/checkout@v4
46+
with:
47+
ref: ${{ inputs.branch_name }}
48+
49+
- name: Setup environment
50+
run: |
51+
echo "${HOME}/.asdf/bin" >> $GITHUB_PATH
52+
poetry install --no-root
53+
54+
- name: Configure Management Credentials
55+
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a #v4.3.1
56+
with:
57+
aws-region: eu-west-2
58+
role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
59+
role-session-name: github-actions-ci-${{ inputs.environment }}-${{ github.run_id }}
60+
61+
- name: Retrieve Server Certificates
62+
env:
63+
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
64+
run: |
65+
make truststore-pull-all-for-account ACCOUNT=${ACCOUNT_NAME}
66+
67+
- name: Terraform Init
68+
env:
69+
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
70+
run: |
71+
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} init
72+
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} workspace new ${ACCOUNT_NAME} || \
73+
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} workspace select ${ACCOUNT_NAME}
74+
75+
- name: Terraform Plan
76+
env:
77+
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
78+
ACCOUNT_ID: ${{ secrets.AWS_ACCOUNT_ID }}
79+
run: |
80+
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} plan \
81+
-var assume_account=${ACCOUNT_ID} \
82+
-var assume_role=terraform \
83+
-out tfplan
84+
85+
- name: Save Terraform Plan
86+
env:
87+
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
88+
run: |
89+
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} show -no-color tfplan > terraform/account-wide-infrastructure/$ACCOUNT_NAME/tfplan.txt
90+
91+
aws s3 cp terraform/account-wide-infrastructure/$ACCOUNT_NAME/tfplan s3://nhsd-nrlf--mgmt--github-ci-logging/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan
92+
aws s3 cp terraform/account-wide-infrastructure/$ACCOUNT_NAME/tfplan.txt s3://nhsd-nrlf--mgmt--github-ci-logging/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan.txt
93+
94+
terraform-apply:
95+
name: Terraform Apply - ${{ inputs.environment }}
96+
needs: [terraform-plan]
97+
runs-on: codebuild-nhsd-nrlf-ci-build-project-${{ github.run_id }}-${{ github.run_attempt }}
98+
environment: ${{ inputs.environment }}
99+
100+
steps:
101+
- name: Git clone - ${{ inputs.branch_name }}
102+
uses: actions/checkout@v4
103+
with:
104+
ref: ${{ inputs.branch_name }}
105+
106+
- name: Setup environment
107+
run: |
108+
echo "${HOME}/.asdf/bin" >> $GITHUB_PATH
109+
poetry install --no-root
110+
111+
- name: Configure Management Credentials
112+
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a #v4.3.1
113+
with:
114+
aws-region: eu-west-2
115+
role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
116+
role-session-name: github-actions-ci-${{ inputs.environment }}-${{ github.run_id}}
117+
118+
- name: Download Terraform Plan artifact
119+
env:
120+
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
121+
run: aws s3 cp s3://nhsd-nrlf--mgmt--github-ci-logging/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan terraform/account-wide-infrastructure/${ACCOUNT_NAME}/tfplan
122+
123+
- name: Retrieve Server Certificates
124+
env:
125+
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
126+
run: |
127+
make truststore-pull-all-for-account ACCOUNT=${ACCOUNT_NAME}
128+
129+
- name: Terraform Init
130+
env:
131+
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
132+
run: |
133+
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} init
134+
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} workspace new ${ACCOUNT_NAME} || \
135+
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} workspace select ${ACCOUNT_NAME}
136+
137+
- name: Terraform Apply
138+
env:
139+
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
140+
ACCOUNT_ID: ${{ secrets.AWS_ACCOUNT_ID }}
141+
run: |
142+
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} apply tfplan
143+
144+
- name: Update environment config version
145+
env:
146+
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
147+
run: |
148+
deployed_version=$(terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} output --raw version)
149+
echo $deployed_version

‎Makefile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ SMOKE_TEST_ARGS ?=
1212
FEATURE_TEST_ARGS ?= ./tests/features --format progress2
1313
TF_WORKSPACE_NAME ?= $(shell terraform -chdir=terraform/infrastructure workspace show)
1414
ENV ?= dev
15+
ACCOUNT ?= dev
1516
APP_ALIAS ?= default
1617
HOST ?= $(TF_WORKSPACE_NAME).api.record-locator.$(ENV).national.nhs.uk
1718
ENV_TYPE ?= $(ENV)
@@ -201,6 +202,9 @@ truststore-build-ca: check-warn ## Build a CA (Certificate Authority)
201202
truststore-build-cert: check-warn ## Build a certificate
202203
@./scripts/truststore.sh build-cert "$(CA_NAME)" "$(CERT_NAME)" "$(CERT_SUBJECT)"
203204

205+
truststore-pull-all-for-account: check-warn ## Pull all certificates for each environment in a given account
206+
@./scripts/truststore.sh pull-all-for-account "$(ACCOUNT)"
207+
204208
truststore-pull-all: check-warn ## Pull all certificates
205209
@./scripts/truststore.sh pull-all "$(ENV)"
206210

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ As a short guideline about profiles to assume for a typical workflow:
5959
### Set up NRLF certificates
6060

6161
In order to execute make commands that need AWS access, you will need to pull the NRLF certificates.
62-
In order to do this, make sure you have AWS CLI installed and configured, then run:
62+
In order to do this, make sure you have AWS CLI installed and configured, assume the mgmt account, then run:
6363

6464
```
6565
make ENV=env truststore-pull-all

‎scripts/get-envs-for-account.sh‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#!/bin/bash
2+
# Get the names of all environments in a provided NRL AWS account
3+
set -o errexit -o nounset -o pipefail
4+
5+
if [[ $# -ne 1 ]]; then
6+
echo "Usage: get-envs-for-account.sh <account>"
7+
exit 1
8+
fi
9+
10+
account="$1"
11+
12+
case "${account}" in
13+
dev)
14+
envs_array=("dev" "dev-sandbox")
15+
echo ${envs_array[@]}
16+
;;
17+
test)
18+
envs_array=("qa" "perftest" "ref" "int" "int-sandbox") # "qa-sandbox" currently broken
19+
echo ${envs_array[@]}
20+
;;
21+
prod)
22+
envs_array=("prod")
23+
echo ${envs_array[@]}
24+
;;
25+
*)
26+
echo "Unknown account ${account}"
27+
exit 1
28+
esac

‎scripts/truststore.sh‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ function _truststore_help() {
2525
echo " pull-ca-key <ca> - Pull the certificate authority private key"
2626
echo " pull-client <env> - pull the files needed for a client connection"
2727
echo " pull-server <env> - pull the files needed for a server connection"
28+
echo " pull-all-for-account <acc> - pull all the truststore files for all environments in a given account"
2829
echo " pull-all <env> - pull all the truststore files for an environment"
2930
echo " push-all <env> - push all the truststore files for an environment"
3031
echo " rotate-ca <env> - rotate the certificate authority, archiving the previous one"
@@ -303,6 +304,7 @@ function _truststore_pull_server() {
303304

304305
function _truststore_pull_all() {
305306
env=$1
307+
306308
_truststore_pull_ca $env
307309
_truststore_pull_client $env
308310
_truststore_pull_server $env
@@ -311,6 +313,27 @@ function _truststore_pull_all() {
311313
return 0
312314
}
313315

316+
function _truststore_pull_all_for_account() {
317+
account=$1
318+
319+
# sets envs_array
320+
source ./scripts/get-envs-for-account.sh $account
321+
322+
for env in ${envs_array[@]}; do
323+
# don't need to pull sandbox certs
324+
if [[ $env != *"-sandbox" ]];
325+
then
326+
echo "⏳ Pulling ${env} truststore certs"
327+
_truststore_pull_ca $env
328+
_truststore_pull_client $env
329+
_truststore_pull_server $env
330+
fi
331+
done
332+
333+
echo -e "✅ Successfully pulled all ${account} truststore files from s3://${BUCKET}"
334+
return 0
335+
}
336+
314337
function _truststore_push_all() {
315338
env=$1
316339

@@ -364,6 +387,7 @@ function _truststore() {
364387
"build-ca") _truststore_build_ca $args ;;
365388
"build-cert") _truststore_build_cert $args ;;
366389
"pull-all") _truststore_pull_all $args ;;
390+
"pull-all-for-account") _truststore_pull_all_for_account $args ;;
367391
"pull-server") _truststore_pull_server $args ;;
368392
"pull-client") _truststore_pull_client $args ;;
369393
"pull-ca") _truststore_pull_ca $args ;;

‎terraform/account-wide-infrastructure/README.md‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ Each subdirectory corresponds to each AWS account (`mgmt`, `prod`, `test` and `d
1818
Before deploying the NRLF account-wide infrastructure, you will need:
1919

2020
- AWS accounts that have already been bootstrapped, as described in [bootstrap/README.md](../bootstrap/README.md). This is a one-time account setup step.
21-
- The required packages to build NRLF, see [the Setup section in README.md](../../README.md#setup).
21+
- The required packages to build NRLF, see [the Setup section in README.md](../../README.md#before-you-begin).
2222

2323
## Deploy mgmt resources
2424

@@ -45,7 +45,7 @@ terraform apply
4545
4646
### If you get "Error: creating CodeBuild Webhook"
4747
48-
If you see this erro:
48+
If you see this error:
4949
5050
```
5151
│ Error: creating CodeBuild Webhook (nhsd-nrlf-ci-build-project): operation error CodeBuild: CreateWebhook, https response error StatusCode: 400, RequestID: , ResourceNotFoundException: Access token not found in CodeBuild project for server type github
@@ -91,6 +91,9 @@ make publish-ci-image
9191
9292
## Deploy account wide resources
9393
94+
> Run the [Deploy Account-wide infrastructure](https://github.com/NHSDigital/NRLF/actions/workflows/deploy-account-wide-infra.yml) github workflow to deploy account wide infrastructure. Select your branch/tag and `account-dev`, `account-test`, or `account-prod` to deploy infra to the corresponding account.
95+
> Else follow the steps below to deploy manually.
96+
9497
To deploy the account wide resources, first login to the AWS mgmt account on the CLI.
9598
9699
Then, initialise your terraform workspace with:

‎terraform/account-wide-infrastructure/dev/data.tf‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,6 @@ data "aws_region" "current" {}
22

33
data "aws_caller_identity" "current" {}
44

5-
data "aws_secretsmanager_secret_version" "identities_account_id" {
6-
secret_id = aws_secretsmanager_secret.identities_account_id.name
7-
}
8-
95
data "aws_secretsmanager_secret_version" "backup_destination_parameters" {
106
secret_id = aws_secretsmanager_secret.backup_destination_parameters.name
117
}
@@ -17,3 +13,10 @@ data "aws_secretsmanager_secret" "emails" {
1713
data "aws_secretsmanager_secret_version" "emails" {
1814
secret_id = data.aws_secretsmanager_secret.emails.id
1915
}
16+
17+
data "external" "current-info" {
18+
program = [
19+
"bash",
20+
"../../../scripts/get-current-info.sh",
21+
]
22+
}

‎terraform/account-wide-infrastructure/dev/iam__developer-role.tf‎

Lines changed: 0 additions & 26 deletions
This file was deleted.

‎terraform/account-wide-infrastructure/dev/outputs.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,7 @@ output "athena_kms_key_arn" {
2222
description = "KMS key ARN for Athena encryption"
2323
value = var.enable_reporting ? module.dev-athena[0].kms_key_arn : null
2424
}
25+
26+
output "version" {
27+
value = data.external.current-info.result.version
28+
}

‎terraform/account-wide-infrastructure/dev/secrets.tf‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,3 @@
1-
resource "aws_secretsmanager_secret" "identities_account_id" {
2-
name = "${local.prefix}--nhs-identities-account-id"
3-
}
4-
51
resource "aws_secretsmanager_secret" "backup_destination_parameters" {
62
name = "${local.prefix}--backup-destination-parameters"
73
description = "Parameters used to configure the backup destination"

0 commit comments

Comments
 (0)