Skip to content

Commit 8adc7f4

Browse files
robertnovac1robertnovac1
authored
VED-358 GitHub actions workflow to deploy to new INT (#691)
1 parent f329913 commit 8adc7f4

File tree

10 files changed

+200
-47
lines changed

10 files changed

+200
-47
lines changed

‎.github/workflows/deploy-blue-green.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: Deploy Blue Green - INT
2+
3+
on:
4+
pull_request:
5+
types: [closed]
6+
branches: [master]
7+
8+
jobs:
9+
deploy-green:
10+
uses: ./.github/workflows/deploy-template.yml
11+
with:
12+
environment: green
13+
14+
deploy-blue:
15+
needs: deploy-green
16+
uses: ./.github/workflows/deploy-template.yml
17+
with:
18+
environment: blue

‎.github/workflows/deploy-template.yml‎

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
name: Deploy to INT and run E2e test
2+
on:
3+
workflow_call:
4+
inputs:
5+
environment:
6+
required: true
7+
type: string
8+
9+
jobs:
10+
terraform-plan:
11+
runs-on: ubuntu-latest
12+
permissions:
13+
id-token: write
14+
contents: read
15+
steps:
16+
- name: Debug OIDC
17+
uses: aws-actions/configure-aws-credentials@v4
18+
with:
19+
aws-region: eu-west-2
20+
role-to-assume: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/auto-ops
21+
role-session-name: github-actions
22+
23+
- name: Whoami
24+
run: aws sts get-caller-identity
25+
26+
- name: Checkout
27+
uses: actions/checkout@v4
28+
with:
29+
fetch-depth: 1
30+
31+
- uses: hashicorp/setup-terraform@v3
32+
with:
33+
terraform_version: "1.12.2"
34+
35+
- name: Terraform Init
36+
working-directory: ${{ vars.TERRAFORM_DIR_PATH }}
37+
run: |
38+
export ENVIRONMENT=${{ inputs.environment }}
39+
make init
40+
41+
- name: Terraform Plan
42+
working-directory: ${{ vars.TERRAFORM_DIR_PATH }}
43+
run: |
44+
make plan environment=${{ inputs.environment }} aws_account_name=int
45+
46+
terraform-apply:
47+
needs: terraform-plan
48+
runs-on: ubuntu-latest
49+
permissions:
50+
id-token: write
51+
contents: read
52+
environment:
53+
name: int
54+
steps:
55+
- name: Checkout
56+
uses: actions/checkout@v4
57+
58+
- uses: aws-actions/configure-aws-credentials@v4
59+
with:
60+
aws-region: eu-west-2
61+
role-to-assume: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/auto-ops
62+
role-session-name: github-actions
63+
64+
- uses: hashicorp/setup-terraform@v3
65+
with:
66+
terraform_version: "1.12.2"
67+
68+
- name: Terraform Init
69+
working-directory: ${{ vars.TERRAFORM_DIR_PATH }}
70+
run: |
71+
export ENVIRONMENT=${{ inputs.environment }}
72+
make init
73+
74+
- name: Terraform Apply
75+
working-directory: ${{ vars.TERRAFORM_DIR_PATH }}
76+
run: |
77+
make apply environment=${{ inputs.environment }} aws_account_name=int
78+
79+
e2e-tests:
80+
needs: terraform-apply
81+
if: ${{ vars.RUN_E2E == 'true' || inputs.environment == vars.ACTIVE_ENVIRONMENT }}
82+
runs-on: ubuntu-latest
83+
permissions:
84+
id-token: write
85+
contents: read
86+
steps:
87+
- name: Checkout
88+
uses: actions/checkout@v4
89+
90+
- uses: aws-actions/configure-aws-credentials@v4
91+
with:
92+
aws-region: eu-west-2
93+
role-to-assume: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/auto-ops
94+
role-session-name: github-actions
95+
96+
- name: Set up Python
97+
uses: actions/setup-python@v5
98+
with:
99+
python-version: "3.11"
100+
101+
- name: Install Poetry
102+
run: |
103+
curl -sSL https://install.python-poetry.org | python3 -
104+
echo "$HOME/.local/bin" >> $GITHUB_PATH
105+
106+
- name: Set Poetry to use Python 3.11
107+
working-directory: ${{ vars.E2E_DIR_PATH }}
108+
run: |
109+
poetry env use $(which python3.11)
110+
111+
- name: Install dependencies with Poetry
112+
working-directory: ${{ vars.E2E_DIR_PATH }}
113+
run: |
114+
poetry install --no-root
115+
116+
- name: Run e2e tests
117+
working-directory: ${{ vars.E2E_DIR_PATH }}
118+
run: |
119+
apigee_token=$(aws ssm get-parameter \
120+
--name "/imms/apigee/non-prod/token" \
121+
--with-decryption \
122+
--query "Parameter.Value" \
123+
--output text)
124+
125+
status_api_key=$(aws ssm get-parameter \
126+
--name "/imms/apigee/non-prod/status-api-key" \
127+
--with-decryption \
128+
--query "Parameter.Value" \
129+
--output text)
130+
131+
export APIGEE_ACCESS_TOKEN=$apigee_token
132+
export [email protected]
133+
export APIGEE_ENVIRONMENT=int
134+
export STATUS_API_KEY=$status_api_key
135+
export PROXY_NAME=immunisation-fhir-api-internal-dev
136+
export SERVICE_BASE_PATH=immunisation-fhir-api/FHIR/R4
137+
export SSO_LOGIN_URL=https://login.apigee.com
138+
139+
make run-immunization

‎terraform_old/Makefile‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,16 @@
11
-include .env
22

3-
environment = $(ENVIRONMENT)
4-
aws_profile = $(AWS_PROFILE) #apim-dev # Leave this here for pipeline
5-
tf_cmd = AWS_PROFILE=$(aws_profile) terraform
3+
environment ?= $(ENVIRONMENT)
4+
aws_account_name ?= $(AWS_ACCOUNT_NAME)
5+
aws_profile ?= $(AWS_PROFILE) #apim-dev # Leave this here for pipeline
6+
tf_cmd = $(if $(AWS_PROFILE),AWS_PROFILE=$(AWS_PROFILE) ,)terraform
67

78
project_name = immunisation
89
project_short_name = imms
9-
state_bucket = $(BUCKET_NAME) #$(project_name)-$(APIGEE_ENVIRONMENT)-terraform-state-files
10+
state_bucket = immunisation-preprod-terraform-state-files
1011
tf_state= -backend-config="bucket=$(state_bucket)"
1112

12-
tf_vars= -var="project_name=$(project_name)" -var="project_short_name=$(project_short_name)" -var="profile=$(aws_profile)" -var="aws_account_name=$(AWS_ACCOUNT)"
13+
tf_vars= -var="project_name=$(project_name)" -var="project_short_name=$(project_short_name)" -var="aws_account_name=$(aws_account_name)" -var="environment=$(environment)"
1314

1415
.PHONY : lock-provider workspace init plan apply clean destroy output state-list lambda-zip catch-all-zip
1516

@@ -19,7 +20,7 @@ lock-provider:
1920
$(tf_cmd) providers lock -platform=darwin_arm64 -platform=darwin_amd64 -platform=linux_amd64 -platform=windows_amd64
2021

2122
workspace:
22-
$(tf_cmd) workspace new $(ENVIRONMENT) || $(tf_cmd) workspace select $(ENVIRONMENT) && echo "Switched to workspace/environment: $(ENVIRONMENT)"
23+
$(tf_cmd) workspace new $(environment) || $(tf_cmd) workspace select $(environment) && echo "Switched to workspace/environment: $(environment)"
2324

2425
init:
2526
$(tf_cmd) init $(tf_state) -upgrade $(tf_vars)
@@ -43,7 +44,7 @@ clean:
4344
destroy: workspace
4445
$(tf_cmd) destroy $(tf_vars) -auto-approve
4546
$(tf_cmd) workspace select default
46-
$(tf_cmd) workspace delete $(ENVIRONMENT)
47+
$(tf_cmd) workspace delete $(environment)
4748

4849
output:
4950
$(tf_cmd) output -raw $(name)

‎terraform_old/api_gateway/mtls_cert.tf‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ locals {
44
}
55

66
data "aws_s3_bucket" "cert_storage" {
7-
bucket = "imms-fhir-${var.config_env}-cert-storage"
7+
bucket = "imms-fhir-${var.aws_account_name}-cert-storage"
88
}
99

1010
data "aws_s3_object" "cert" {
@@ -15,6 +15,14 @@ data "aws_s3_object" "cert" {
1515
resource "aws_s3_bucket" "truststore_bucket" {
1616
bucket = "${var.prefix}-truststores"
1717
force_destroy = true
18+
19+
}
20+
21+
resource "aws_s3_bucket_versioning" "versioning" {
22+
bucket = aws_s3_bucket.truststore_bucket.id
23+
versioning_configuration {
24+
status = "Enabled"
25+
}
1826
}
1927

2028
resource "aws_s3_object_copy" "copy_cert_from_storage" {

‎terraform_old/api_gateway/variables.tf‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,7 @@ variable "zone_id" {}
44
variable "api_domain_name" {}
55
variable "environment" {}
66
variable "oas" {}
7-
variable "config_env" {}
8-
7+
variable "aws_account_name" {}
98
locals {
109
environment = terraform.workspace == "green" ? "prod" : terraform.workspace == "blue" ? "prod" : terraform.workspace
1110
}

‎terraform_old/endpoints.tf‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ locals {
2424
imms_table_name = data.aws_dynamodb_table.events-dynamodb-table.name
2525
imms_lambda_env_vars = {
2626
"DYNAMODB_TABLE_NAME" = local.imms_table_name,
27-
"IMMUNIZATION_ENV" = local.environment,
27+
"IMMUNIZATION_ENV" = var.aws_account_name,
2828
"IMMUNIZATION_BASE_PATH" = strcontains(local.environment, "pr-") ? "immunisation-fhir-api-${local.environment}" : "immunisation-fhir-api"
2929
# except for prod and ref, any other env uses PDS int environment
3030
"PDS_ENV" = local.environment == "prod" ? "prod" : local.environment == "ref" ? "ref" : "int",
@@ -101,14 +101,14 @@ output "oas" {
101101
}
102102

103103
module "api_gateway" {
104-
source = "./api_gateway"
105-
prefix = local.prefix
106-
short_prefix = local.short_prefix
107-
zone_id = data.aws_route53_zone.project_zone.zone_id
108-
api_domain_name = local.service_domain_name
109-
environment = local.environment
110-
oas = local.oas
111-
config_env = local.config_env
104+
source = "./api_gateway"
105+
prefix = local.prefix
106+
short_prefix = local.short_prefix
107+
zone_id = data.aws_route53_zone.project_zone.zone_id
108+
api_domain_name = local.service_domain_name
109+
environment = local.environment
110+
oas = local.oas
111+
aws_account_name = var.aws_account_name
112112
}
113113

114114

‎terraform_old/main.tf‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,11 @@ terraform {
1717
}
1818

1919
provider "aws" {
20-
region = var.region
21-
profile = var.profile
20+
region = var.region
2221
default_tags {
2322
tags = {
2423
Project = var.project_name
25-
Environment = local.environment
24+
Environment = var.aws_account_name
2625
Service = var.service
2726
}
2827
}

‎terraform_old/route53.tf‎

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,6 @@ locals {
22
zone_subdomain = var.project_short_name
33
}
44

5-
data "aws_route53_zone" "root_zone" {
6-
name = local.root_domain
7-
}
8-
9-
locals {
10-
project_zone_name = "${local.zone_subdomain}.${data.aws_route53_zone.root_zone.name}"
11-
}
12-
135
data "aws_route53_zone" "project_zone" {
14-
name = local.project_zone_name
15-
}
6+
name = "imms.${var.aws_account_name}.vds.platform.nhs.uk"
7+
}

‎terraform_old/splunk.tf‎

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,13 @@
1-
locals {
2-
splunk_env = local.environment == "prod" ? "prod" : local.environment == "int" ? "int" : "dev"
3-
}
41
data "aws_secretsmanager_secret" "splunk_token" {
5-
name = "imms/splunk/${local.splunk_env}/hec"
2+
name = "imms/splunk/${var.aws_account_name}/hec"
63
}
74
data "aws_secretsmanager_secret_version" "splunk_token_id" {
8-
secret_id = data.aws_secretsmanager_secret.splunk_token.id
5+
secret_id = data.aws_secretsmanager_secret.splunk_token.id
96
}
107

118
module "splunk" {
12-
source = "./splunk"
13-
prefix = local.prefix
14-
splunk_endpoint = "https://firehose.inputs.splunk.aws.digital.nhs.uk/services/collector/event"
15-
hec_token = data.aws_secretsmanager_secret_version.splunk_token_id.secret_string
16-
}
9+
source = "./splunk"
10+
prefix = local.prefix
11+
splunk_endpoint = "https://firehose.inputs.splunk.aws.digital.nhs.uk/services/collector/event"
12+
hec_token = data.aws_secretsmanager_secret_version.splunk_token_id.secret_string
13+
}

‎terraform_old/variables.tf‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
variable "profile" {
22
default = "apim-dev"
33
}
4+
5+
variable "environment" {}
6+
47
variable "aws_account_name" {
58
default = "int"
69
}
@@ -30,10 +33,6 @@ data "aws_subnets" "default" {
3033
}
3134
}
3235

33-
locals {
34-
root_domain = "${local.config_env}.vds.platform.nhs.uk"
35-
}
36-
3736
locals {
3837
project_domain_name = data.aws_route53_zone.project_zone.name
3938
}
@@ -50,6 +49,7 @@ locals {
5049
service_domain_name = "${local.env}.${local.project_domain_name}"
5150
immunisation_account_id = "084828561157"
5251
dspp_core_account_id = "603871901111"
52+
root_domain = "${local.config_env}.vds.platform.nhs.uk"
5353

5454
tags = {
5555
Project = var.project_name
@@ -86,7 +86,7 @@ data "aws_security_group" "existing_securitygroup" {
8686
}
8787

8888
data "aws_s3_bucket" "existing_config_bucket" {
89-
bucket = "imms-int-supplier-config"
89+
bucket = "imms-${var.aws_account_name}-supplier-config"
9090
}
9191

9292
data "aws_s3_bucket" "existing_destination_bucket" {

0 commit comments

Comments
 (0)