Skip to content

Commit c99e926

Browse files
atraceanjalitrace2-nhs
atrace
authored and
anjalitrace2-nhs
committed
NRL-1595 Create workflow to deploy account-wide infrastructure
- NRL-1595 Minor readme amendments - NRL-1595 Rough deploy account wide infra workflow - NRL-1595 Create script to pull truststore certs for all environments in a given account - NRL-1595 pre-feedback pipeline. Different loop attempts - NRL-1595 made changes based on feedback and account-specific envs approach. Ready for test runs once workflow envs created - NRL-1595 pull account id from env secrets rather than variables - NRL-1595 set trigger to on push to perform first workflow run - NRL-1595 push only on this branch - NRL-1595 revert trigger now that we have initial run to manual - NRL-1595 Fix exit codes - NRL-1595 Hardcode env choice and branch name for now - NRL-1595 Attempt to resolve bad account id retrieval - NRL-1595 Fix tfplan output - NRL-1595 check deployed version written to state correctly - NRL-1595 fix bad apply - NRL-1595 tidy up + remove hardcoded references. This commit's run will fail because no manual inputs. Will need a test running manually once merged into develop but hopefully ready for PR - NRL-1595 fix bad apply - NRL-1595 tidy up + remove hardcoded references. This commit's run will fail because no manual inputs. Will need a test running manually once merged into develop but hopefully ready for PR - NRL-1595 attempt to fix bad apply command - NRL-1595 Pull target branch and environment from inputs - needs testing once merged - NRL-1595 Bot suggestions + amendments from self-review
1 parent 3ef1892 commit c99e926

File tree

10 files changed

+218
-5
lines changed

10 files changed

+218
-5
lines changed

‎.github/workflows/deploy-account-wide-infra.yml‎

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
name: Deploy Account-wide infrastructure
2+
run-name: Account-wide infra deployment to ${{ inputs.environment }} of ${{ inputs.branch_name }} by ${{ github.actor }}
3+
4+
on:
5+
workflow_dispatch:
6+
inputs:
7+
environment:
8+
description: "Environment to deploy to"
9+
required: true
10+
default: "account-dev"
11+
type: environment
12+
branch_name:
13+
description: Branch to deploy
14+
required: true
15+
16+
permissions:
17+
id-token: write
18+
contents: read
19+
actions: write
20+
21+
jobs:
22+
check-selected-environment:
23+
name: Check Workflow Env
24+
runs-on: codebuild-nhsd-nrlf-ci-build-project-${{ github.run_id }}-${{ github.run_attempt }}
25+
steps:
26+
- name: Validate environment
27+
env:
28+
IS_VALID_ENV: ${{ startsWith(inputs.environment, 'account-') }}
29+
run: |
30+
echo "valid workflow environment selected:" $IS_VALID_ENV
31+
if [[ $IS_VALID_ENV == true ]]; then
32+
exit 0
33+
fi
34+
echo "This workflow can only be run with 'account-*' environments as it deploys account-specific infrastructure"
35+
exit 1
36+
37+
terraform-plan:
38+
name: Terraform Plan - ${{ inputs.environment }}
39+
environment: ${{ inputs.environment }}
40+
needs: [check-selected-environment]
41+
runs-on: codebuild-nhsd-nrlf-ci-build-project-${{ github.run_id }}-${{ github.run_attempt }}
42+
43+
steps:
44+
- name: Git clone - ${{ inputs.branch_name }}
45+
uses: actions/checkout@v4
46+
with:
47+
ref: ${{ inputs.branch_name }}
48+
49+
- name: Setup environment
50+
run: |
51+
echo "${HOME}/.asdf/bin" >> $GITHUB_PATH
52+
poetry install --no-root
53+
54+
- name: Configure Management Credentials
55+
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a #v4.3.1
56+
with:
57+
aws-region: eu-west-2
58+
role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
59+
role-session-name: github-actions-ci-${{ inputs.environment }}-${{ github.run_id }}
60+
61+
- name: Retrieve Server Certificates
62+
env:
63+
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
64+
run: |
65+
make truststore-pull-all-for-account ACCOUNT=${ACCOUNT_NAME}
66+
67+
- name: Terraform Init
68+
env:
69+
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
70+
run: |
71+
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} init
72+
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} workspace new ${ACCOUNT_NAME} || \
73+
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} workspace select ${ACCOUNT_NAME}
74+
75+
- name: Terraform Plan
76+
env:
77+
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
78+
ACCOUNT_ID: ${{ secrets.AWS_ACCOUNT_ID }}
79+
run: |
80+
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} plan \
81+
-var assume_account=${ACCOUNT_ID} \
82+
-var assume_role=terraform \
83+
-out tfplan
84+
85+
- name: Save Terraform Plan
86+
env:
87+
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
88+
run: |
89+
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} show -no-color tfplan > terraform/account-wide-infrastructure/$ACCOUNT_NAME/tfplan.txt
90+
91+
aws s3 cp terraform/account-wide-infrastructure/$ACCOUNT_NAME/tfplan s3://nhsd-nrlf--mgmt--github-ci-logging/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan
92+
aws s3 cp terraform/account-wide-infrastructure/$ACCOUNT_NAME/tfplan.txt s3://nhsd-nrlf--mgmt--github-ci-logging/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan.txt
93+
94+
terraform-apply:
95+
name: Terraform Apply - ${{ inputs.environment }}
96+
needs: [terraform-plan]
97+
runs-on: codebuild-nhsd-nrlf-ci-build-project-${{ github.run_id }}-${{ github.run_attempt }}
98+
environment: ${{ inputs.environment }}
99+
100+
steps:
101+
- name: Git clone - ${{ inputs.branch_name }}
102+
uses: actions/checkout@v4
103+
with:
104+
ref: ${{ inputs.branch_name }}
105+
106+
- name: Setup environment
107+
run: |
108+
echo "${HOME}/.asdf/bin" >> $GITHUB_PATH
109+
poetry install --no-root
110+
111+
- name: Configure Management Credentials
112+
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a #v4.3.1
113+
with:
114+
aws-region: eu-west-2
115+
role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
116+
role-session-name: github-actions-ci-${{ inputs.environment }}-${{ github.run_id}}
117+
118+
- name: Download Terraform Plan artifact
119+
env:
120+
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
121+
run: aws s3 cp s3://nhsd-nrlf--mgmt--github-ci-logging/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan terraform/account-wide-infrastructure/${ACCOUNT_NAME}/tfplan
122+
123+
- name: Retrieve Server Certificates
124+
env:
125+
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
126+
run: |
127+
make truststore-pull-all-for-account ACCOUNT=${ACCOUNT_NAME}
128+
129+
- name: Terraform Init
130+
env:
131+
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
132+
run: |
133+
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} init
134+
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} workspace new ${ACCOUNT_NAME} || \
135+
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} workspace select ${ACCOUNT_NAME}
136+
137+
- name: Terraform Apply
138+
env:
139+
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
140+
ACCOUNT_ID: ${{ secrets.AWS_ACCOUNT_ID }}
141+
run: |
142+
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} apply tfplan
143+
144+
- name: Update environment config version
145+
env:
146+
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
147+
run: |
148+
deployed_version=$(terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} output --raw version)
149+
echo $deployed_version

‎Makefile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ SMOKE_TEST_ARGS ?=
1212
FEATURE_TEST_ARGS ?= ./tests/features --format progress2
1313
TF_WORKSPACE_NAME ?= $(shell terraform -chdir=terraform/infrastructure workspace show)
1414
ENV ?= dev
15+
ACCOUNT ?= dev
1516
APP_ALIAS ?= default
1617
HOST ?= $(TF_WORKSPACE_NAME).api.record-locator.$(ENV).national.nhs.uk
1718
ENV_TYPE ?= $(ENV)
@@ -201,6 +202,9 @@ truststore-build-ca: check-warn ## Build a CA (Certificate Authority)
201202
truststore-build-cert: check-warn ## Build a certificate
202203
@./scripts/truststore.sh build-cert "$(CA_NAME)" "$(CERT_NAME)" "$(CERT_SUBJECT)"
203204

205+
truststore-pull-all-for-account: check-warn ## Pull all certificates for each environment in a given account
206+
@./scripts/truststore.sh pull-all-for-account "$(ACCOUNT)"
207+
204208
truststore-pull-all: check-warn ## Pull all certificates
205209
@./scripts/truststore.sh pull-all "$(ENV)"
206210

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ As a short guideline about profiles to assume for a typical workflow:
5959
### Set up NRLF certificates
6060

6161
In order to execute make commands that need AWS access, you will need to pull the NRLF certificates.
62-
In order to do this, make sure you have AWS CLI installed and configured, then run:
62+
In order to do this, make sure you have AWS CLI installed and configured, assume the mgmt account, then run:
6363

6464
```
6565
make ENV=env truststore-pull-all

‎scripts/get-envs-for-account.sh‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#!/bin/bash
2+
# Get the names of all environments in a provided NRL AWS account
3+
set -o errexit -o nounset -o pipefail
4+
5+
if [[ $# -ne 1 ]]; then
6+
echo "Usage: get-envs-for-account.sh <account>"
7+
exit 1
8+
fi
9+
10+
account="$1"
11+
12+
case "${account}" in
13+
dev)
14+
envs_array=("dev" "dev-sandbox")
15+
echo ${envs_array[@]}
16+
;;
17+
test)
18+
envs_array=("qa" "perftest" "ref" "int" "int-sandbox") # "qa-sandbox" currently broken
19+
echo ${envs_array[@]}
20+
;;
21+
prod)
22+
envs_array=("prod")
23+
echo ${envs_array[@]}
24+
;;
25+
*)
26+
echo "Unknown account ${account}"
27+
exit 1
28+
esac

‎scripts/truststore.sh‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -303,6 +303,7 @@ function _truststore_pull_server() {
303303

304304
function _truststore_pull_all() {
305305
env=$1
306+
306307
_truststore_pull_ca $env
307308
_truststore_pull_client $env
308309
_truststore_pull_server $env
@@ -311,6 +312,25 @@ function _truststore_pull_all() {
311312
return 0
312313
}
313314

315+
function _truststore_pull_all_for_account() {
316+
account=$1
317+
318+
# sets envs_array
319+
source ./scripts/get-envs-for-account.sh $account
320+
321+
echo "Pulling certs for environments ${envs_array[@]} in ${account} account"
322+
323+
for env in ${envs_array[@]}; do
324+
echo "⏳ Pulling ${env} truststore certs"
325+
_truststore_pull_ca $env
326+
_truststore_pull_client $env
327+
_truststore_pull_server $env
328+
done
329+
330+
echo -e "✅ Successfully pulled all ${account} truststore files from s3://${BUCKET}"
331+
return 0
332+
}
333+
314334
function _truststore_push_all() {
315335
env=$1
316336

@@ -364,6 +384,7 @@ function _truststore() {
364384
"build-ca") _truststore_build_ca $args ;;
365385
"build-cert") _truststore_build_cert $args ;;
366386
"pull-all") _truststore_pull_all $args ;;
387+
"pull-all-for-account") _truststore_pull_all_for_account $args ;;
367388
"pull-server") _truststore_pull_server $args ;;
368389
"pull-client") _truststore_pull_client $args ;;
369390
"pull-ca") _truststore_pull_ca $args ;;

‎terraform/account-wide-infrastructure/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ Each subdirectory corresponds to each AWS account (`mgmt`, `prod`, `test` and `d
1818
Before deploying the NRLF account-wide infrastructure, you will need:
1919

2020
- AWS accounts that have already been bootstrapped, as described in [bootstrap/README.md](../bootstrap/README.md). This is a one-time account setup step.
21-
- The required packages to build NRLF, see [the Setup section in README.md](../../README.md#setup).
21+
- The required packages to build NRLF, see [the Setup section in README.md](../../README.md#before-you-begin).
2222

2323
## Deploy mgmt resources
2424

@@ -45,7 +45,7 @@ terraform apply
4545
4646
### If you get "Error: creating CodeBuild Webhook"
4747
48-
If you see this erro:
48+
If you see this error:
4949
5050
```
5151
│ Error: creating CodeBuild Webhook (nhsd-nrlf-ci-build-project): operation error CodeBuild: CreateWebhook, https response error StatusCode: 400, RequestID: , ResourceNotFoundException: Access token not found in CodeBuild project for server type github

‎terraform/account-wide-infrastructure/dev/data.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,10 @@ data "aws_secretsmanager_secret" "emails" {
1717
data "aws_secretsmanager_secret_version" "emails" {
1818
secret_id = data.aws_secretsmanager_secret.emails.id
1919
}
20+
21+
data "external" "current-info" {
22+
program = [
23+
"bash",
24+
"../../../scripts/get-current-info.sh",
25+
]
26+
}

‎terraform/account-wide-infrastructure/dev/outputs.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,7 @@ output "athena_kms_key_arn" {
2222
description = "KMS key ARN for Athena encryption"
2323
value = var.enable_reporting ? module.dev-athena[0].kms_key_arn : null
2424
}
25+
26+
output "version" {
27+
value = data.external.current-info.result.version
28+
}

‎terraform/bootstrap/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ The setup creates AWS resources to enable terraform deployments to AWS accounts.
1515
Before you begin deploying NRLF bootstrap components, you will need:
1616

1717
- Four AWS accounts created. These will be assigned as: mgmt, prod, test and dev
18-
- The required packages to build NRLF, see [the Setup section in README.md](../../README.md#setup).
18+
- The required packages to build NRLF, see [the Setup section in README.md](../../README.md#before-you-begin).
1919

2020
## Bootstrapping the environments
2121

‎terraform/infrastructure/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ CI pipeline creates infrastructure in the dev AWS account. These will have works
3535
Before you begin deploying NRLF infrastructure, you will need:
3636

3737
- An NRLF-enabled AWS account, ideally `dev`. See [bootstrap](../bootstrap/README.md) for details on setting up a new account.
38-
- The required packages to build NRLF, see [the Setup section in README.md](../../README.md#setup).
38+
- The required packages to build NRLF, see [the Setup section in README.md](../../README.md#before-you-begin).
3939
- To be logged into the AWS mgmt account on the CLI that you are deploying from.
4040

4141
If infrastructure changes require account wide AWS resources. Please deploy the corresponding [NRLF account wide infrastructure](../account-wide-infrastructure/README.md) first.

0 commit comments

Comments
 (0)