Skip to content

Commit c0a21c6

Browse files
axelkrastek1-nhsaxelkrastek1-nhs
authored
Merge pull request #672 from NHSDigital/feature/axkr1-NRL-760-blue-green-stacks
NRL-760 Add logic for blue/green deployments to build/deploy scripts
2 parents f19134a + 29804b3 commit c0a21c6

File tree

14 files changed

+119
-41
lines changed

14 files changed

+119
-41
lines changed

‎.github/workflows/persistent-environment.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,9 +134,11 @@ jobs:
134134
135135
- name: Terraform Plan
136136
run: |
137+
inactive_stack=$(poetry run python ./scripts/get_env_config.py inactive-stack ${{ inputs.environment }})
137138
terraform -chdir=terraform/infrastructure plan \
138139
--var-file=etc/${{ vars.ACCOUNT_NAME }}.tfvars \
139140
--var assume_role_arn=${{ secrets.DEPLOY_ROLE_ARN }} \
141+
--var use_shared_resources=$(poetry run python scripts/are_resources_shared_for_stack.py ${inactive_stack}) \
140142
-out tfplan
141143
142144
- name: Save Terraform Plan

‎.github/workflows/pr-env-deploy.yml‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -146,14 +146,27 @@ jobs:
146146
- name: Retrieve Server Certificates
147147
run: make truststore-pull-server ENV=dev
148148

149+
- name: Install zip
150+
run: sudo apt-get install zip
151+
152+
- name: Setup Python environment
153+
run: |
154+
poetry install --no-root
155+
source $(poetry env info --path)/bin/activate
156+
149157
- name: Terraform Init
150158
run: |
151159
terraform -chdir=terraform/infrastructure init
152160
terraform -chdir=terraform/infrastructure workspace new ${{ needs.set-environment-id.outputs.environment_id }} || \
153161
terraform -chdir=terraform/infrastructure workspace select ${{ needs.set-environment-id.outputs.environment_id }}
154162
155163
- name: Terraform Plan
156-
run: terraform -chdir=terraform/infrastructure plan --var-file=etc/dev.tfvars --var assume_role_arn=${{ secrets.DEPLOY_ROLE_ARN }} -out tfplan
164+
run: |
165+
terraform -chdir=terraform/infrastructure plan \
166+
--var-file=etc/dev.tfvars \
167+
--var assume_role_arn=${{ secrets.DEPLOY_ROLE_ARN }} \
168+
--var use_shared_resources=$(poetry run python scripts/are_resources_shared_for_stack.py ${{ needs.set-environment-id.outputs.environment_id }}) \
169+
-out tfplan
157170
158171
- name: Terraform Apply
159172
id: terraform-apply

‎Makefile‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ HOST ?= $(TF_WORKSPACE_NAME).api.record-locator.$(ENV).national.nhs.uk
1717
ENV_TYPE ?= $(ENV)
1818

1919
export PATH := $(PATH):$(PWD)/.venv/bin
20+
export USE_SHARED_RESOURCES := $(shell poetry run python scripts/are_resources_shared_for_stack.py $(TF_WORKSPACE_NAME))
2021

2122
default: build
2223

@@ -79,7 +80,11 @@ test: check-warn ## Run the unit tests
7980

8081
test-features-integration: check-warn ## Run the BDD feature tests in the integration environment
8182
@echo "Running feature tests in the integration environment"
82-
behave --define="integration_test=true" --define="env=$(TF_WORKSPACE_NAME)" $(FEATURE_TEST_ARGS)
83+
behave --define="integration_test=true" \
84+
--define="env=$(TF_WORKSPACE_NAME)" \
85+
--define="account_name=$(ENV)" \
86+
--define="use_shared_resources=${USE_SHARED_RESOURCES}" \
87+
$(FEATURE_TEST_ARGS)
8388

8489
test-smoke-internal: check-warn ## Run the smoke tests against the internal environment
8590
@echo "Running smoke tests against the internal environment"
@@ -129,7 +134,7 @@ get-access-token: check-warn ## Get an access token for an environment
129134
@poetry run python tests/utilities/get_access_token.py $(ENV) $(APP_ALIAS)
130135

131136
get-s3-perms: check-warn ## Get s3 permissions for an environment
132-
@poetry run python scripts/get_s3_permissions.py $(ENV) $(DIST_PATH)
137+
poetry run python scripts/get_s3_permissions.py ${USE_SHARED_RESOURCES} $(ENV) $(TF_WORKSPACE_NAME) "$(DIST_PATH)"
133138
@echo "Creating new Lambda NRLF permissions layer zip"
134139
./scripts/add-perms-to-lambda.sh $(DIST_PATH)
135140

‎scripts/are_resources_shared_for_stack.py‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#!/usr/bin/env python
2+
# Get if the stack should share resources
3+
import fire
4+
5+
persistent_environments = [
6+
"dev-1",
7+
"dev-2",
8+
"dev-sandbox-1",
9+
"dev-sandbox-2",
10+
"qa-1",
11+
"qa-2",
12+
"qa-sandbox-1",
13+
"qa-sandbox-2",
14+
"ref-1",
15+
"ref-2",
16+
"int-1",
17+
"int-2",
18+
"int-sandbox-1",
19+
"int-sandbox-2",
20+
"prod-1",
21+
"prod-2",
22+
]
23+
24+
25+
def main(stack_name: str):
26+
return "true" if stack_name in persistent_environments else "false"
27+
28+
29+
if __name__ == "__main__":
30+
fire.Fire(main)

‎scripts/check-deploy-environment.sh‎

Lines changed: 20 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ set -o errexit -o pipefail -o nounset
66
: "${SHOULD_WARN_ONLY:="false"}"
77
: "${ENV:="dev"}"
88
: "${ENV_ACCOUNT_NAME:="dev"}"
9+
: "${TF_WORKSPACE_NAME:=""}"
910

1011
function success() {
1112
[ "${SHOULD_WARN_ONLY}" == "true" ] && return
@@ -51,22 +52,37 @@ else
5152
warning "${ENV_ACCOUNT_NAME} account id not found in mgmt account. Check you are logged into the NRLF mgmt account."
5253
fi
5354

55+
5456
# Check the Terraform workspace is set
5557
set +e
5658
tf_workspace="$(cd terraform/infrastructure && terraform workspace show)"
5759
set -e
60+
61+
is_using_shared_resources="$(poetry run python ./scripts/are_resources_shared_for_stack.py ${tf_workspace})"
62+
if [ "${is_using_shared_resources}" == "true" ]
63+
then
64+
warning "Will use shared resources for stack '${tf_workspace}'"
65+
else
66+
success "Not using shared resources for stack '${tf_workspace}'"
67+
fi
68+
69+
70+
# Check the Terraform workspace value
5871
case "${tf_workspace}" in
59-
dev|qa|int|ref|prod)
72+
dev-*|qa-*|int-*|ref-*|prod-*)
6073
warning "Terraform workspace set to persistent environment '${tf_workspace}'"
61-
if [ "${tf_workspace}" != "${ENV}" ]
74+
75+
if [[ "${tf_workspace}" =~ "${ENV}-" ]]
6276
then
77+
success "Terraform workspace '${tf_workspace}' matches deployment environment '${ENV}'"
78+
else
6379
warning "Terraform workspace '${tf_workspace}' does not match deployment environment '${ENV}'"
6480
fi
6581
;;
66-
dev-sandbox|qa-sandbox|int-sandbox)
82+
*-sandbox-*)
6783
warning "Terraform workspace set to sandbox environment '${tf_workspace}'"
6884
;;
69-
account_wide|default)
85+
default)
7086
warning "Terraform workspace set to '${tf_workspace}'"
7187
;;
7288
*)

‎scripts/get_s3_permissions.py‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -75,8 +75,10 @@ def download_files(s3_client, bucket_name, local_path, file_names, folders):
7575
add_test_files("K6PerformanceTest", "Y05868.json", local_path)
7676

7777

78-
def main(env: str, path_to_store: str):
79-
bucket = f"nhsd-nrlf--{env}-authorization-store"
78+
def main(use_shared_resources: str, env: str, workspace: str, path_to_store: str):
79+
stack_name = env if use_shared_resources else workspace
80+
81+
bucket = f"nhsd-nrlf--{stack_name}-authorization-store"
8082
boto_session = get_boto_session(env)
8183

8284
s3 = boto_session.client("s3")

‎terraform/infrastructure/Makefile‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,9 @@ TF_WORKSPACE_NAME ?= $(shell (whoami || hostname) | head -c 5)-$(ENV)
44
TF_ARGS ?=
55
ENV_ACCOUNT_NAME ?= $(shell ../../scripts/get-account-name-for-env.sh $(ENV))
66
ENV_ACCOUNT_ID ?= $(shell aws secretsmanager get-secret-value --secret-id nhsd-nrlf--mgmt--$(ENV_ACCOUNT_NAME)-account-id --query SecretString --output text)
7+
USE_SHARED_RESOURCES ?= $(shell poetry run python ../../scripts/are_resources_shared_for_stack.py $(TF_WORKSPACE_NAME))
78

8-
export ENV ENV_ACCOUNT_NAME
9+
export ENV ENV_ACCOUNT_NAME TF_WORKSPACE_NAME
910

1011
help: ## Show this help message
1112
@echo "Usage: make [target]"
@@ -31,16 +32,19 @@ plan: check-warn ## Plan the Terraform changes
3132
terraform plan \
3233
-var-file=./etc/$(ENV).tfvars \
3334
-var 'assume_role_arn=arn:aws:iam::$(ENV_ACCOUNT_ID):role/terraform' \
35+
-var 'use_shared_resources=$(USE_SHARED_RESOURCES)' \
3436
$(TF_ARGS)
3537

3638
apply: check-warn ## Apply the Terraform changes
3739
terraform apply \
3840
-var-file=./etc/$(ENV).tfvars \
3941
-var 'assume_role_arn=arn:aws:iam::$(ENV_ACCOUNT_ID):role/terraform' \
42+
-var 'use_shared_resources=$(USE_SHARED_RESOURCES)' \
4043
$(TF_ARGS)
4144

4245
destroy: check-warn ## Destroy the Terraform resources
4346
terraform destroy \
4447
-var-file=./etc/$(ENV).tfvars \
4548
-var 'assume_role_arn=arn:aws:iam::$(ENV_ACCOUNT_ID):role/terraform' \
49+
-var 'use_shared_resources=$(USE_SHARED_RESOURCES)' \
4650
$(TF_ARGS)

‎terraform/infrastructure/data.tf‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,26 +6,26 @@ data "aws_s3_object" "api-truststore-certificate" {
66
}
77

88
data "aws_s3_bucket" "authorization-store" {
9-
count = local.use_shared_resources ? 1 : 0
10-
bucket = "${local.prefix}-authorization-store"
9+
count = var.use_shared_resources ? 1 : 0
10+
bucket = "${local.shared_prefix}-authorization-store"
1111
}
1212

1313
data "aws_dynamodb_table" "pointers-table" {
14-
count = local.use_shared_resources ? 1 : 0
15-
name = "${local.prefix}-pointers-table"
14+
count = var.use_shared_resources ? 1 : 0
15+
name = "${local.shared_prefix}-pointers-table"
1616
}
1717

1818
data "aws_iam_policy" "pointers-table-read" {
19-
count = local.use_shared_resources ? 1 : 0
20-
name = "${local.prefix}-pointers-table-read"
19+
count = var.use_shared_resources ? 1 : 0
20+
name = "${local.shared_prefix}-pointers-table-read"
2121
}
2222

2323
data "aws_iam_policy" "pointers-table-write" {
24-
count = local.use_shared_resources ? 1 : 0
25-
name = "${local.prefix}-pointers-table-write"
24+
count = var.use_shared_resources ? 1 : 0
25+
name = "${local.shared_prefix}-pointers-table-write"
2626
}
2727

2828
data "aws_iam_policy" "pointers-kms-read-write" {
29-
count = local.use_shared_resources ? 1 : 0
30-
name = "${local.prefix}-pointers-kms-read-write"
29+
count = var.use_shared_resources ? 1 : 0
30+
name = "${local.shared_prefix}-pointers-kms-read-write"
3131
}

‎terraform/infrastructure/ephemeral-resources.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
module "ephemeral-s3-permission-store" {
2-
count = local.use_shared_resources ? 0 : 1
2+
count = var.use_shared_resources ? 0 : 1
33
source = "./modules/permissions-store-bucket"
44
name_prefix = local.prefix
55
}
66

77
module "ephemeral-pointers-table" {
8-
count = local.use_shared_resources ? 0 : 1
8+
count = var.use_shared_resources ? 0 : 1
99
source = "./modules/pointers-table"
1010
name_prefix = local.prefix
1111
}

‎terraform/infrastructure/lambda.tf‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,6 @@ module "producer__createDocumentReference" {
121121
AUTH_STORE = local.auth_store_id
122122
SPLUNK_INDEX = module.firehose__processor.splunk.index
123123
POWERTOOLS_LOG_LEVEL = local.log_level
124-
ENDPOINT_URL = "${local.public_domain}/nrl-producer-api/FHIR/R4/DocumentReference"
125124
TABLE_NAME = local.pointers_table_name
126125
}
127126
additional_policies = [

0 commit comments

Comments
 (0)