Skip to content

Commit fa0e96a

Browse files
mfjarvismfjarvis
committed
Use consistent naming for dev / preprod / prod accounts. Rename int blue / green environments to int-blue / int-green. Update pipelines to supply the correct parameters. TF fixes for state import.
1 parent cc6a7ef commit fa0e96a

File tree

16 files changed

+154
-163
lines changed

16 files changed

+154
-163
lines changed

‎.github/workflows/deploy-blue-green.yml‎

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,14 @@
11
name: Deploy Blue Green - INT
22

33
on:
4-
pull_request:
5-
types: [closed]
6-
branches: [master]
4+
push:
5+
branches:
6+
- release-2025-08-12
77

88
jobs:
99
deploy-green:
1010
uses: ./.github/workflows/deploy-template.yml
1111
with:
12-
environment: green
13-
14-
deploy-blue:
15-
needs: deploy-green
16-
uses: ./.github/workflows/deploy-template.yml
17-
with:
18-
environment: blue
12+
apigee_environment: int
13+
environment: preprod
14+
sub_environment: int-green

‎.github/workflows/deploy-template.yml‎

Lines changed: 57 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,17 @@
1-
name: Deploy to INT and run E2e test
1+
name: Deploy Template
2+
23
on:
34
workflow_call:
45
inputs:
6+
apigee_environment:
7+
required: true
8+
type: string
59
environment:
610
required: true
711
type: string
12+
sub_environment:
13+
required: true
14+
type: string
815

916
jobs:
1017
terraform-plan:
@@ -13,7 +20,7 @@ jobs:
1320
id-token: write
1421
contents: read
1522
steps:
16-
- name: Debug OIDC
23+
- name: Connect to AWS
1724
uses: aws-actions/configure-aws-credentials@v4
1825
with:
1926
aws-region: eu-west-2
@@ -34,16 +41,13 @@ jobs:
3441

3542
- name: Terraform Init
3643
working-directory: ${{ vars.TERRAFORM_DIR_PATH }}
37-
run: |
38-
export ENVIRONMENT=${{ inputs.environment }}
39-
make init
44+
run: make init apigee_environment=${{ inputs.apigee_environment }} environment=${{ inputs.environment }} sub_environment=${{ inputs.sub_environment }}
4045

4146
- name: Terraform Plan
4247
working-directory: ${{ vars.TERRAFORM_DIR_PATH }}
43-
run: |
44-
make plan environment=${{ inputs.environment }} aws_account_name=int
45-
48+
run: make plan apigee_environment=${{ inputs.apigee_environment }} environment=${{ inputs.environment }} sub_environment=${{ inputs.sub_environment }}
4649
terraform-apply:
50+
if: ${{ vars.SKIP_APPLY != 'true' }}
4751
needs: terraform-plan
4852
runs-on: ubuntu-latest
4953
permissions:
@@ -67,18 +71,14 @@ jobs:
6771

6872
- name: Terraform Init
6973
working-directory: ${{ vars.TERRAFORM_DIR_PATH }}
70-
run: |
71-
export ENVIRONMENT=${{ inputs.environment }}
72-
make init
74+
run: make init apigee_environment=${{ inputs.apigee_environment }} environment=${{ inputs.environment }} sub_environment=${{ inputs.sub_environment }}
7375

7476
- name: Terraform Apply
7577
working-directory: ${{ vars.TERRAFORM_DIR_PATH }}
76-
run: |
77-
make apply environment=${{ inputs.environment }} aws_account_name=int
78-
78+
run: make plan apigee_environment=${{ inputs.apigee_environment }} environment=${{ inputs.environment }} sub_environment=${{ inputs.sub_environment }}
7979
e2e-tests:
80+
if: ${{ vars.RUN_E2E == 'true' && inputs.environment == vars.ACTIVE_ENVIRONMENT }}
8081
needs: terraform-apply
81-
if: ${{ vars.RUN_E2E == 'true' || inputs.environment == vars.ACTIVE_ENVIRONMENT }}
8282
runs-on: ubuntu-latest
8383
permissions:
8484
id-token: write
@@ -93,15 +93,24 @@ jobs:
9393
role-to-assume: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/auto-ops
9494
role-session-name: github-actions
9595

96+
- uses: hashicorp/setup-terraform@v3
97+
with:
98+
terraform_version: "1.12.2"
99+
100+
- name: Terraform Init
101+
working-directory: ${{ vars.TERRAFORM_DIR_PATH }}
102+
run: make init apigee_environment=${{ inputs.apigee_environment }} environment=${{ inputs.environment }} sub_environment=${{ inputs.sub_environment }}
103+
96104
- name: Set up Python
97105
uses: actions/setup-python@v5
98106
with:
99107
python-version: "3.11"
100108

101109
- name: Install Poetry
102110
run: |
103-
curl -sSL https://install.python-poetry.org | python3 -
111+
curl -sSL https://install.python-poetry.org | python3 - --version 2.1.2
104112
echo "$HOME/.local/bin" >> $GITHUB_PATH
113+
poetry --version
105114
106115
- name: Set Poetry to use Python 3.11
107116
working-directory: ${{ vars.E2E_DIR_PATH }}
@@ -113,27 +122,39 @@ jobs:
113122
run: |
114123
poetry install --no-root
115124
125+
- name: Install oathtool
126+
run: sudo apt-get update && sudo apt-get install -y oathtool
127+
128+
- name: Get JWT token for apigee
129+
env:
130+
APIGEE_USERNAME: ${{ vars.APIGEE_USERNAME }}
131+
APIGEE_PASSWORD: ${{ secrets.APIGEE_PASSWORD }}
132+
APIGEE_OAUTH_TOKEN: ${{ secrets.APIGEE_BASIC_AUTH_TOKEN }}
133+
APIGEE_OTP_SECRET: ${{ secrets.APIGEE_OTP_KEY }}
134+
run: |
135+
CODE=$(oathtool --totp -b "$APIGEE_OTP_SECRET")
136+
echo "::add-mask::$CODE"
137+
echo "Requesting access token from Apigee..."
138+
response=$(curl -s -X POST "https://login.apigee.com/oauth/token" \
139+
-H "Content-Type: application/x-www-form-urlencoded" \
140+
-H "Accept: application/json;charset=utf-8" \
141+
-H "Authorization: Basic $APIGEE_BASIC_AUTH_TOKEN" \
142+
-d "username=$APIGEE_USERNAME&password=$APIGEE_PASSWORD&mfa_token=$CODE&grant_type=password")
143+
token=$(echo "$response" | jq -e -r '.access_token')
144+
if [[ -z "$token" ]]; then
145+
echo "Failed to retrieve access token"
146+
exit 1
147+
fi
148+
echo "::add-mask::$token"
149+
echo "APIGEE_ACCESS_TOKEN=$token" >> $GITHUB_ENV
150+
116151
- name: Run e2e tests
117152
working-directory: ${{ vars.E2E_DIR_PATH }}
153+
env:
154+
APIGEE_ACCESS_TOKEN: ${{ env.APIGEE_ACCESS_TOKEN }}
155+
APIGEE_USERNAME: [email protected]
118156
run: |
119-
apigee_token=$(aws ssm get-parameter \
120-
--name "/imms/apigee/non-prod/token" \
121-
--with-decryption \
122-
--query "Parameter.Value" \
123-
--output text)
124-
125-
status_api_key=$(aws ssm get-parameter \
126-
--name "/imms/apigee/non-prod/status-api-key" \
127-
--with-decryption \
128-
--query "Parameter.Value" \
129-
--output text)
130-
131-
export APIGEE_ACCESS_TOKEN=$apigee_token
132-
export [email protected]
133-
export APIGEE_ENVIRONMENT=int
134-
export STATUS_API_KEY=$status_api_key
135-
export PROXY_NAME=immunisation-fhir-api-internal-dev
136-
export SERVICE_BASE_PATH=immunisation-fhir-api/FHIR/R4
137-
export SSO_LOGIN_URL=https://login.apigee.com
138-
157+
export APIGEE_ENVIRONMENT=internal-dev
158+
export PROXY_NAME=immunisation-fhir-api-int-${{ inputs.environment }}
159+
export SERVICE_BASE_PATH=immunisation-fhir-api/FHIR/R4-int-${{ inputs.environment }}
139160
make run-immunization

‎azure/azure-pr-teardown-pipeline.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -47,8 +47,8 @@ jobs:
4747
export AWS_PROFILE=apim-dev
4848
4949
cd terraform
50-
make init environment="dev" sub_environment="$WORKSPACE" bucket_name="immunisation-internal-dev-terraform-state-files"
51-
make workspace sub_environment="$WORKSPACE"
50+
make init apigee_environment=internal-dev environment=dev sub_environment=$workspace
51+
make workspace apigee_environment=internal-dev environment=dev sub_environment="$WORKSPACE"
5252
5353
# Extract values from Terraform state before destroying
5454
ID_SYNC_QUEUE_ARN=$(make -s output name=id_sync_queue_arn)
@@ -76,6 +76,6 @@ jobs:
7676
export AWS_PROFILE=apim-dev
7777
7878
cd terraform
79-
make destroy environment="dev" sub_environment="$WORKSPACE" bucket_name="immunisation-internal-dev-terraform-state-files"
79+
make destroy apigee_environment=internal-dev environment=dev sub_environment=$workspace
8080
displayName: Destroy terraform PR workspace and linked resources
81-
retryCountOnTaskFailure: 2
81+
retryCountOnTaskFailure: 2

‎azure/templates/post-deploy.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ steps:
6060
echo pr_no: $pr_no
6161
6262
cd terraform
63-
make init
63+
make init environment=${{ parameters.aws_account_type }} sub_environment=$workspace
6464
make apply environment=${{ parameters.aws_account_type }} sub_environment=$workspace
6565
6666
AWS_DOMAIN_NAME=$(make -s output name=service_domain_name)

‎azure/templates/post-prod-deploy.yml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@ steps:
2626
set -e
2727
if ! [[ $APIGEE_ENVIRONMENT =~ .*-*sandbox ]]; then
2828
export AWS_PROFILE=apim-dev
29-
aws_account_no="$(aws sts get-caller-identity --query Account --output text)"
3029
3130
service_name=$(FULLY_QUALIFIED_SERVICE_NAME)
3231
@@ -35,12 +34,12 @@ steps:
3534
echo sandbox with following parameters:
3635
echo workspace: $workspace
3736
echo AWS environment: $APIGEE_ENVIRONMENT
38-
37+
3938
cd terraform
4039
41-
make init
42-
make apply aws_account_no=${aws_account_no} environment=$workspace
40+
make init environment=${{ parameters.aws_account_type }} sub_environment=$workspace
41+
make plan environment=${{ parameters.aws_account_type }} sub_environment=$workspace
4342
fi
4443
displayName: Apply Terraform
4544
workingDirectory: "$(Pipeline.Workspace)/s/$(SERVICE_NAME)"
46-
retryCountOnTaskFailure: 2
45+
retryCountOnTaskFailure: 2

‎infra/.terraform.lock.hcl‎

Lines changed: 16 additions & 56 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎infra/Makefile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
interactionId=$(ENVIRONMENT)
44

5-
tf_cmd = AWS_PROFILE=$(AWS_PROFILE) terraform
5+
tf_cmd = terraform
66
tf_state= -backend-config="bucket=$(BUCKET_NAME)"
77
tf_vars= -var-file=environments/$(ENVIRONMENT)/variables.tfvars
88

@@ -42,7 +42,7 @@ ifndef name
4242
endif
4343
$(tf_cmd) output -raw $(name)
4444

45-
import:
45+
import:
4646
$(tf_cmd) import $(tf_vars) $(to) $(id)
4747

4848
tf-%:

infra/environments/non-prod/variables.tfvars renamed to infra/environments/dev/variables.tfvars

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,7 @@ dspp_account_id = "603871901111"
33
mns_account_id = "631615744739"
44
admin_role = "root" # We shouldn't be using the root account. There should be an Admin role
55
dev_ops_role = "role/DevOps"
6-
auto_ops_role = "role/auto-ops"
76
dspp_admin_role = "root"
87
mns_admin_role = "role/nhs-mns-events-lambda-delivery"
98
environment = "dev"
10-
parent_route53_zone_name = "dev.vds.platform.nhs.uk"
11-
child_route53_zone_name = "imms.dev.vds.platform.nhs.uk"
9+
blue_green_split = false

infra/environments/int/variables.tfvars renamed to infra/environments/preprod/variables.tfvars

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,7 @@ dspp_account_id = "603871901111"
33
mns_account_id = "631615744739"
44
admin_role = "role/aws-reserved/sso.amazonaws.com/eu-west-2/AWSReservedSSO_PREPROD-IMMS-Admin_acce656dcacf6f4c"
55
dev_ops_role = "role/aws-reserved/sso.amazonaws.com/eu-west-2/AWSReservedSSO_PREPROD-IMMS-Devops_1d28e4f37b940bcd"
6-
auto_ops_role = "role/auto-ops"
76
dspp_admin_role = "root"
87
mns_admin_role = "role/nhs-mns-events-lambda-delivery"
9-
environment = "int"
10-
parent_route53_zone_name = "int.vds.platform.nhs.uk"
11-
child_route53_zone_name = "imms.int.vds.platform.nhs.uk"
8+
environment = "preprod"
9+
blue_green_split = true

‎infra/environments/prod/variables.tfvars‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,7 @@ dspp_account_id = "232116723729"
33
mns_account_id = "758334270304"
44
admin_role = "role/aws-reserved/sso.amazonaws.com/eu-west-2/AWSReservedSSO_PROD-IMMS-Admin_edd6691e4b74064e"
55
dev_ops_role = "role/aws-reserved/sso.amazonaws.com/eu-west-2/AWSReservedSSO_PROD-IMMS-Devops_8f32c62195d56b76"
6-
auto_ops_role = "role/auto-ops"
76
dspp_admin_role = "root"
87
mns_admin_role = "role/nhs-mns-events-lambda-delivery"
98
environment = "prod"
10-
parent_route53_zone_name = "prod.vds.platform.nhs.uk"
11-
child_route53_zone_name = "imms.prod.vds.platform.nhs.uk"
9+
blue_green_split = true

0 commit comments

Comments
 (0)