Merge pull request #373 from NHSDigital/VED-83-int-ref

Multiple Workspace / Envs

Author: nhsdevws

grafana/non-prod/docker/build_push_to_ecr.sh

@@ -6,13 +6,43 @@ dirname=$(dirname "$0")
 DOCKERFILE_DIR=$(realpath "$dirname")
 echo "DOCKERFILE_DIR: $DOCKERFILE_DIR"
 
+# if parameter not passed, prompt for the environment. 
+# Do not accept response if it is not one of the following: prod, int, ref, internal-dev
+# loop until valid response is received
+if [ -z "$1" ]; then
+  while true; do
+    read -p "Enter the environment (prod, int, ref, internal-dev): " ENVIRONMENT
+    case $ENVIRONMENT in
+      prod|int|ref|internal-dev)
+        break
+        ;;
+      *)
+        echo "Invalid environment. Please enter one of: prod, int, ref, internal-dev."
+        ;;
+    esac
+  done
+else
+  ENVIRONMENT=$1
+fi
+# Check if the environment is valid
+if [[ ! "$ENVIRONMENT" =~ ^(prod|int|ref|internal-dev)$ ]]; then
+  echo "Invalid environment. Please enter one of: prod, int, ref, internal-dev."
+  exit 1
+fi
+
+# Set the prefix and other variables
+PREFIX="imms-${ENVIRONMENT}"
 AWS_REGION="eu-west-2"
 ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
-REPOSITORY_NAME="imms-fhir-api-grafana"
+REPOSITORY_NAME="${PREFIX}-grafana-app"
 IMAGE_TAG="11.0.0-22.04_stable"
 LOCAL_IMAGE_NAME="$REPOSITORY_NAME:$IMAGE_TAG"
 IMAGE_NAME="$ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/$LOCAL_IMAGE_NAME"
-TAGS="Key=Environment,Value=non-prod Key=Project,Value=immunisation-fhir-api-grafana"
+TAGS='[
+  {"Key": "Environment", "Value": "non-prod"},
+  {"Key": "Project", "Value": "immunisation-fhir-api-grafana"},
+  {"Key": "Environment", "Value": "'"$ENVIRONMENT"'"}
+]'
 LIFECYCLE_POLICY_FILE="lifecycle-policy.json"
 
 # Change to the directory containing the Dockerfile

grafana/non-prod/docker/dashboards/CWLogs_rev1.json

@@ -597,8 +597,8 @@
       {
         "current": {
           "selected": false,
-          "text": "hotel catalog creation started",
-          "value": "hotel catalog creation started"
+          "text": "",
+          "value": ""
         },
         "hide": 0,
         "label": "Search",
@@ -610,7 +610,7 @@
             "value": "task timed out"
           }
         ],
-        "query": "hotel catalog creation started",
+        "query": "",
         "skipUrlSync": false,
         "type": "textbox"
       }

grafana/non-prod/docker/lifecycle-policy.json

@@ -6,12 +6,11 @@
       "selection": {
         "tagStatus": "any",
         "countType": "imageCountMoreThan",
-        "countNumber": 10,
-        "tagPrefixList": [""]
+        "countNumber": 10
       },
       "action": {
         "type": "expire"
       }
     }
   ]
-}
+}

grafana/non-prod/readme.md

@@ -17,15 +17,40 @@ S3 bucket name : immunisation-grafana-terraform-state
 
 The infrastructure is built using terraform. The code may be found in the terraform folder.
 
+#### initialise terraform
+The terraform  amanges multiple environmments. When running terraform init is used to specify the key dynamically using the -backend-config flag. This is done in the tf_init.sh file.
+
 to rebuild the docker image from the ECR to ECS, run
 ```
 terraform taint aws_ecs_task_definition.app
 ```
 
 to review the docker image
 ```
-docker image inspect imms-fhir-api-grafana:11.0.0-22.04_stable
+docker image inspect imms-internal-dev-fhir-api-grafana:11.0.0-22.04_stable
+docker image inspect imms-int-fhir-api-grafana:11.0.0-22.04_stable
+docker image inspect imms-ref-fhir-api-grafana:11.0.0-22.04_stable
+```
+
+### building environments
+Run the following commands to create and switch to the `int` workspace:
+```
+./tf_init.sh int
+./tf_init.sh ref
+./tf_init.sh internal-dev
+'''
+
+Create an environment
+```
+terraform workspace new int  
+Build an environment
 ```
+terraform workspace select int  
+```
+
+'''
+terraform plan -var="environment=int"
+'''
 
 ### vpce vs nat gateway
 

grafana/non-prod/terraform/all.tf

@@ -1,13 +1,13 @@
 # alb.tf
 
 resource "aws_alb" "main" {
-  name            = "${var.prefix}-alb"
+  name            = "${local.prefix}-alb"
   subnets         = aws_subnet.grafana_public[*].id
   security_groups = [aws_security_group.lb.id]
 }
 
 resource "aws_alb_target_group" "app" {
-  name        = "${var.prefix}-alb-tg"
+  name        = "${local.prefix}-tg"
   port        = 3000
   protocol    = "HTTP"
   vpc_id      = aws_vpc.grafana_main.id
@@ -34,7 +34,7 @@ resource "aws_alb_listener" "front_end" {
     type             = "forward"
   }
   tags = merge(var.tags, {
-    Name = "${var.prefix}-alb-listener"
+    Name = "${local.prefix}-alb-listener"
   })
 }
 ############################################################################################################
@@ -48,7 +48,7 @@ resource "aws_appautoscaling_target" "target" {
   min_capacity       = 1
   max_capacity       = 1
   tags = merge(var.tags, {
-    Name = "${var.prefix}-aas-tgt"
+    Name = "${local.prefix}-aas-tgt"
   })
 }
 
@@ -99,25 +99,26 @@ resource "aws_appautoscaling_policy" "down" {
 # ecs.tf
 
 resource "aws_ecs_cluster" "main" {
-    name = "grafana-cluster"
+    name = "${local.prefix}-cluster"
 }
 
 data "template_file" "grafana_app" {
     template = file("${path.module}/templates/ecs/grafana_app.json.tpl")
 
     vars = {
         app_image      = local.app_image
+        app_name       = local.app_name
         app_port       = var.app_port
         fargate_cpu    = var.fargate_cpu
         fargate_memory = var.fargate_memory
         aws_region     = var.aws_region
-        log_group      = var.log_group
+        log_group      = local.log_group
         health_check_path = var.health_check_path
     }
 }
 
 resource "aws_ecs_task_definition" "app" {
-    family                   = "grafana-app-task"
+    family                   = "${local.prefix}-app"
     execution_role_arn       = aws_iam_role.ecs_task_execution_role.arn
     task_role_arn            = aws_iam_role.ecs_task_role.arn    
     network_mode             = "awsvpc"
@@ -126,14 +127,13 @@ resource "aws_ecs_task_definition" "app" {
     memory                   = var.fargate_memory
     container_definitions    = data.template_file.grafana_app.rendered
     tags = merge(var.tags, {
-        Name = "${var.prefix}-ecs-task"
+        Name = "${local.prefix}-task"
     })
 
 }
 
-
 resource "aws_ecs_service" "main" {
-  name            = "${var.prefix}-ecs-svc"
+  name            = "${local.prefix}-ecs-svc"
   cluster         = aws_ecs_cluster.main.id
   task_definition = aws_ecs_task_definition.app.arn
   desired_count   = var.app_count
@@ -147,14 +147,14 @@ resource "aws_ecs_service" "main" {
 
   load_balancer {
     target_group_arn = aws_alb_target_group.app.id
-    container_name   = "grafana-app"
+    container_name   = local.app_name
     container_port   = var.app_port
   }
 }
 ############################################################################################################
 # iam.tf
 resource "aws_iam_policy" "route53resolver_policy" {
-  name        = "${var.prefix}-route53resolver-policy"
+  name        = "${local.prefix}-route53resolver-policy"
   description = "Policy to allow Route 53 Resolver DNS Firewall actions"
   policy = jsonencode({
     Version = "2012-10-17",
@@ -182,7 +182,7 @@ resource "aws_iam_role_policy_attachment" "route53resolver_policy_attachment" {
 ## Amazon ECR, and to store and retrieve logs in Amazon CloudWatch.
 ## It grants permissions needed for ECS to start and manage tasks
 resource "aws_iam_role" "ecs_task_execution_role" {
-  name = "${var.prefix}-ecs-task-execution-role"
+  name = "${local.prefix}-ecs-task-execution-role"
 
   assume_role_policy = <<EOF
 {
@@ -202,7 +202,7 @@ EOF
 }
 
 resource "aws_iam_policy" "ecs_task_execution_policy" {
-  name        = "${var.prefix}-ecs-task-execution-policy"
+  name        = "${local.prefix}-ecs-task-execution-policy"
   description = "Policy for ECS task execution role to access ECR and CloudWatch Logs"
   policy = jsonencode({
     Version = "2012-10-17",
@@ -241,7 +241,7 @@ resource "aws_iam_role_policy_attachment" "ecs-task-execution-role-policy-attach
 # needs to interact with other AWS services (e.g., accessing S3, 
 # DynamoDB, etc.).
 resource "aws_iam_role" "ecs_task_role" {
-  name = "${var.prefix}-ecs-task-role"
+  name = "${local.prefix}-ecs-task-role"
 
   assume_role_policy = <<EOF
 {
@@ -264,7 +264,7 @@ EOF
 
 
 resource "aws_iam_policy" "ecs_task_policy" {
-  name        = "${var.prefix}-ecs-task-policy"
+  name        = "${local.prefix}-ecs-task-policy"
   description = "Policy for ECS task role to access CloudWatch Logs"
   policy = jsonencode({
     Version = "2012-10-17",
@@ -303,7 +303,7 @@ data "aws_iam_policy_document" "ecs_auto_scale_role" {
 }
 # ECS auto scale role
 resource "aws_iam_role" "ecs_auto_scale_role" {
-  name               = "${var.prefix}-${var.ecs_auto_scale_role_name}"
+  name = "${local.prefix}-ecs_role"
   assume_role_policy = data.aws_iam_policy_document.ecs_auto_scale_role.json
 }
 # ECS auto scale role policy attachment
@@ -315,7 +315,7 @@ resource "aws_iam_role_policy_attachment" "ecs_auto_scale_role" {
 # Monitoring role
 resource "aws_iam_role" "monitoring_role" {
 
-  name = "${var.prefix}-monitoring-role"
+  name = "${local.prefix}-monitoring-role"
 
   assume_role_policy = jsonencode({
     "Version": "2012-10-17",
@@ -339,7 +339,7 @@ resource "aws_iam_role" "monitoring_role" {
 }
 
 resource "aws_iam_role_policy" "monitoring_policy" {
-  name   = "${var.prefix}-monitoring-policy"
+  name   = "${local.prefix}-monitoring-policy"
   role   = aws_iam_role.monitoring_role.id
 
   policy = jsonencode({
@@ -410,7 +410,7 @@ resource "aws_vpc" "grafana_main" {
     enable_dns_support = true
     enable_dns_hostnames = true
     tags = {
-        Name = "${var.prefix}-vpc"
+        Name = "${local.prefix}-vpc"
     }
 }
 
@@ -422,7 +422,7 @@ resource "aws_subnet" "grafana_private" {
     availability_zone = data.aws_availability_zones.available.names[count.index]
     vpc_id            = aws_vpc.grafana_main.id
     tags = merge(var.tags, {
-        Name = "${var.prefix}-private-subnet-${count.index}"
+        Name = "${local.prefix}-private-subnet-${count.index}"
     })
 }
 
@@ -435,7 +435,7 @@ resource "aws_subnet" "grafana_public" {
     vpc_id                  = aws_vpc.grafana_main.id
     map_public_ip_on_launch = true
     tags = merge(var.tags, {
-        Name = "${var.prefix}-public-subnet-${count.index}"
+        Name = "${local.prefix}-public-subnet-${count.index}"
     })
 }
 
@@ -444,7 +444,7 @@ resource "aws_subnet" "grafana_public" {
 resource "aws_internet_gateway" "gw" {
     vpc_id = aws_vpc.grafana_main.id
     tags = merge(var.tags, {
-        Name = "${var.prefix}-igw"
+        Name = "${local.prefix}-igw"
     })
 }
 
@@ -460,7 +460,7 @@ resource "aws_route_table" "private" {
     count  = var.az_count
     vpc_id = aws_vpc.grafana_main.id
     tags = merge(var.tags, {
-        Name = "${var.prefix}-private-rt-${count.index}"
+        Name = "${local.prefix}-private-rt-${count.index}"
     })
 }
 
@@ -486,7 +486,7 @@ resource "aws_route_table_association" "private" {
 
 # Security group for the ALB
 resource "aws_security_group" "lb" {
-  name        = "grafana-load-balancer-security-group" # @TODO ${var.prefix}-alb-sg"
+  name        = "grafana-load-balancer-security-group" # @TODO ${local.prefix}-alb-sg"
   description = "controls access to the ALB"
   vpc_id      = aws_vpc.grafana_main.id
 
@@ -505,7 +505,7 @@ resource "aws_security_group" "lb" {
   }
 
   tags = merge(var.tags, {
-    Name = "${var.prefix}-alb-sg"
+    Name = "${local.prefix}-alb-sg"
   })
 }
 
@@ -529,15 +529,15 @@ resource "aws_security_group" "ecs_tasks" {
     cidr_blocks = ["0.0.0.0/0"]
   }
   tags = merge(var.tags, {
-    Name = "${var.prefix}-sg-ecs-tasks"
+    Name = "${local.prefix}-sg-ecs-tasks"
   })
 }
 
 # Elastic IP & NAT Gateway for egress traffic
 resource "aws_eip" "nat" {
   domain = "vpc"
   tags = merge(var.tags, {
-    Name = "${var.prefix}-nat-eip"
+    Name = "${local.prefix}-nat-eip"
   })
 }
 
@@ -546,6 +546,6 @@ resource "aws_nat_gateway" "nat" {
   allocation_id = aws_eip.nat.id
   subnet_id     = element(aws_subnet.grafana_public[*].id, 0) 
   tags = merge(var.tags, {
-    Name = "${var.prefix}-nat-gw"
+    Name = "${local.prefix}-nat-gw"
   })
 }

grafana/non-prod/terraform/logs.tf

@@ -4,15 +4,15 @@
 
 # Set up CloudWatch group and log stream and retain logs for 30 days
 resource "aws_cloudwatch_log_group" "grafana_log_group" {
-  name              = var.log_group
+  name = local.log_group
   retention_in_days = 30
 
   tags = merge(var.tags, {
-      Name = "${var.prefix}-log-group"
+      Name = local.log_group
   })
 }
 
 resource "aws_cloudwatch_log_stream" "grafana_log_group" {
-  name           = "${var.prefix}-log-stream"
+  name = "${local.log_group}-stream"
   log_group_name = aws_cloudwatch_log_group.grafana_log_group.name
 }