build: apply cdk-tags to cluster (#1081)

### Motivation

LINZ likes having all AWS resources taged with a number of common aws
tags

<!-- TODO: Say why you made your changes. -->

### Modifications

Applys the default set of LINz's common tags

The formatting of the github action was inconsistent, some having spaces
between steps and some not, so applied some white space consistency.

<!-- TODO: Say what changes you made. -->

<!-- TODO: Attach screenshots if you changed the UI. -->

### Verification

<!-- TODO: Say how you tested your changes. -->

Author: blacha

.github/workflows/main.yml

@@ -37,26 +37,32 @@ jobs:
     if: ${{ github.ref == 'refs/heads/master' }}
     environment:
       name: prod
+
     permissions:
       id-token: write
       contents: read
+
     env:
       CLUSTER_NAME: Workflows
+
     steps:
       - uses: linz/action-typescript@9bf69b0f313b3525d3ba3116f26b1aff7eb7a6c0 # v3.1.0
         with:
           node-version: 20.x
+
       # Configure access to AWS / EKS
       - name: Setup kubectl
         uses: azure/setup-kubectl@3e0aec4d80787158d308d7b364cb1b702e7feb7f # v3
         with:
           version: 'latest'
+
       - name: AWS Configure
         uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4
         with:
           aws-region: ap-southeast-2
           mask-aws-account-id: true
           role-to-assume: ${{ secrets.AWS_CI_ROLE }}
+
       - name: Find Changes in Infra
         id: get-infra-changes
         run: |
@@ -66,31 +72,39 @@ jobs:
           else
             echo "run_infra=false" >> "$GITHUB_OUTPUT"
           fi
+
       - name: (CDK) Deploy
         if: steps.get-infra-changes.outputs.run_infra == 'true'
         run: |
           npx cdk deploy ${{ env.CLUSTER_NAME }} \
             -c maintainer-arns=${{ secrets.AWS_CI_ROLE }},${{ secrets.AWS_ADMIN_ROLE }},${{ secrets.AWS_ADMIN_SSO_ROLE }},${{ secrets.AWS_WFMAINTAINER_ROLE }} \
             -c aws-account-id=${{ secrets.AWS_ACCOUNT_ID }} \
             --require-approval never
+        env:
+          NODE_ENV: production
+
       - name: Login to EKS
         run: |
           aws eks update-kubeconfig --name ${{ env.CLUSTER_NAME }} --region ap-southeast-2
+
       - name: Check EKS connection
         run: |
           kubectl get nodes
+
       # Configure the Kubernetes cluster with CDK8s
       - name: (CDK8s) Synth
         if: steps.get-infra-changes.outputs.run_infra == 'true'
         run: |
           npx cdk8s synth
           # nb: kubectl diff - is somewhat dangerous as it dumps out secrets in plain text
           # so it should not be used in this pipeline
+
       # TODO use a --prune and --applyset to remove unused objects
       - name: (CDK8s) Deploy
         if: steps.get-infra-changes.outputs.run_infra == 'true'
         run: |
           kubectl apply -f dist/
+
       - name: Deploy workflows
         if: github.ref == 'refs/heads/master'
         run: |
@@ -118,12 +132,14 @@ jobs:
           for cwf in $CRON_WORKFLOWS; do
               kubectl apply -f "$cwf" --namespace argo
           done
+
       - name: Install Argo
         if: steps.get-infra-changes.outputs.run_infra == 'true'
         run: |
           curl --location --remote-name --silent "${{ env.ARGO_URL }}"
           gunzip argo-linux-amd64.gz
           chmod +x argo-linux-amd64
+
       - name: Smoke test
         if: steps.get-infra-changes.outputs.run_infra == 'true'
         run: |

infra/cdk.ts

@@ -1,3 +1,4 @@
+import { applyTags, SecurityClassification } from '@linzjs/cdk-tags';
 import { App } from 'aws-cdk-lib';
 
 import { ClusterName, DefaultRegion } from './constants.js';
@@ -22,7 +23,7 @@ async function main(): Promise<void> {
     throw new Error("Missing AWS Account information, set with either '-c aws-account-id' or $CDK_DEFAULT_ACCOUNT");
   }
 
-  new LinzEksCluster(app, ClusterName, {
+  const cluster = new LinzEksCluster(app, ClusterName, {
     env: { region: DefaultRegion, account: accountId },
     maintainerRoleArns,
     slackChannelConfigurationName: ssmConfig.slackChannelConfigurationName,
@@ -31,6 +32,15 @@ async function main(): Promise<void> {
     s3BatchRestoreRoleArn: ssmConfig.s3BatchRestoreRoleArn,
   });
 
+  applyTags(cluster, {
+    application: 'argo',
+    environment: process.env['NODE_ENV'] === 'production' ? 'prod' : 'nonprod',
+    group: 'li',
+    impact: 'moderate',
+    classification: SecurityClassification.Unclassified,
+    responderTeam: 'LI - Geospatial Data Engineering',
+  });
+
   app.synth();
 }