-
Notifications
You must be signed in to change notification settings - Fork 4
175 lines (150 loc) · 7.43 KB
/
deploy-account-wide-infra.yml
File metadata and controls
175 lines (150 loc) · 7.43 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
name: Deploy Account-wide infrastructure
run-name: Account-wide infra deployment to ${{ inputs.environment }} of ${{ inputs.branch_name }} by ${{ github.actor }}
on:
workflow_dispatch:
inputs:
environment:
description: "Account to deploy to"
required: true
default: "account-dev"
type: environment
branch_name:
description: Branch to deploy
required: true
jobs:
check-selected-environment:
name: Check Workflow Env
runs-on: codebuild-nhsd-nrlf-ci-build-project-${{ github.run_id }}-${{ github.run_attempt }}
steps:
- name: Validate environment
env:
IS_VALID_ENV: ${{ startsWith(inputs.environment, 'account-') }}
run: |
echo "valid workflow environment selected:" $IS_VALID_ENV
if [[ $IS_VALID_ENV == true ]]; then
exit 0
fi
echo "This workflow can only be run with 'account-*' environments as it deploys account-specific infrastructure"
exit 1
terraform-plan:
name: Terraform Plan - ${{ inputs.environment }}
environment: ${{ inputs.environment }}
needs: [check-selected-environment]
runs-on: codebuild-nhsd-nrlf-ci-build-project-${{ github.run_id }}-${{ github.run_attempt }}
permissions:
contents: read
id-token: write
actions: write
steps:
- name: Git clone - ${{ inputs.branch_name }}
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
ref: ${{ inputs.branch_name }}
- name: Setup environment
run: |
echo "${HOME}/.asdf/bin" >> $GITHUB_PATH
poetry install --no-root
- name: Build Lambda Layers
run: |
make build-layers
make build-dependency-layer
- name: Build Seed Sandbox Lambda
run: make build-seed-sandbox-lambda
- name: Configure Management Credentials
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a #v4.3.1
with:
aws-region: eu-west-2
role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
role-session-name: github-actions-ci-${{ inputs.environment }}-${{ github.run_id }}
- name: Retrieve Server Certificates
env:
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
run: |
make truststore-pull-all-for-account ACCOUNT=${ACCOUNT_NAME}
- name: Terraform Init
env:
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
run: |
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} init
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} workspace new ${ACCOUNT_NAME} || \
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} workspace select ${ACCOUNT_NAME}
- name: Terraform Plan
env:
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
ACCOUNT_ID: ${{ secrets.AWS_ACCOUNT_ID }}
run: |
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} plan \
-var assume_account=${ACCOUNT_ID} \
-var assume_role=terraform \
-out tfplan
- name: Save Terraform Plan Artifacts
env:
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
run: |
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} show -no-color tfplan > terraform/account-wide-infrastructure/$ACCOUNT_NAME/tfplan.txt
aws s3 cp terraform/account-wide-infrastructure/$ACCOUNT_NAME/tfplan s3://nhsd-nrlf--mgmt--ci-data/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan
aws s3 cp terraform/account-wide-infrastructure/$ACCOUNT_NAME/tfplan.txt s3://nhsd-nrlf--mgmt--ci-data/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan.txt
aws s3 cp terraform/account-wide-infrastructure/modules/glue/files/src.zip s3://nhsd-nrlf--mgmt--ci-data/acc-$ACCOUNT_NAME/${{ github.run_id }}/glue-src.zip
aws s3 cp dist/nrlf.zip s3://nhsd-nrlf--mgmt--ci-data/acc-$ACCOUNT_NAME/${{ github.run_id }}/nrlf.zip
aws s3 cp dist/dependency_layer.zip s3://nhsd-nrlf--mgmt--ci-data/acc-$ACCOUNT_NAME/${{ github.run_id }}/dependency_layer.zip
aws s3 cp dist/seed_sandbox.zip s3://nhsd-nrlf--mgmt--ci-data/acc-$ACCOUNT_NAME/${{ github.run_id }}/seed_sandbox.zip
terraform-apply:
name: Terraform Apply - ${{ inputs.environment }}
needs: [terraform-plan]
runs-on: codebuild-nhsd-nrlf-ci-build-project-${{ github.run_id }}-${{ github.run_attempt }}
environment: ${{ inputs.environment }}
permissions:
contents: read
id-token: write
actions: write
steps:
- name: Git clone - ${{ inputs.branch_name }}
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
ref: ${{ inputs.branch_name }}
- name: Setup environment
run: |
echo "${HOME}/.asdf/bin" >> $GITHUB_PATH
poetry install --no-root
- name: Configure Management Credentials
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a #v4.3.1
with:
aws-region: eu-west-2
role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
role-session-name: github-actions-ci-${{ inputs.environment }}-${{ github.run_id}}
- name: Download Terraform Plan Artifacts
env:
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
run: |
aws s3 cp s3://nhsd-nrlf--mgmt--ci-data/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan terraform/account-wide-infrastructure/${ACCOUNT_NAME}/tfplan
aws s3 cp s3://nhsd-nrlf--mgmt--ci-data/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan.txt terraform/account-wide-infrastructure/${ACCOUNT_NAME}/tfplan.txt
mkdir -p terraform/account-wide-infrastructure/modules/glue/files
aws s3 cp s3://nhsd-nrlf--mgmt--ci-data/acc-$ACCOUNT_NAME/${{ github.run_id }}/glue-src.zip terraform/account-wide-infrastructure/modules/glue/files/src.zip
mkdir -p dist
aws s3 cp s3://nhsd-nrlf--mgmt--ci-data/acc-$ACCOUNT_NAME/${{ github.run_id }}/nrlf.zip dist/nrlf.zip
aws s3 cp s3://nhsd-nrlf--mgmt--ci-data/acc-$ACCOUNT_NAME/${{ github.run_id }}/dependency_layer.zip dist/dependency_layer.zip
aws s3 cp s3://nhsd-nrlf--mgmt--ci-data/acc-$ACCOUNT_NAME/${{ github.run_id }}/seed_sandbox.zip dist/seed_sandbox.zip
- name: Retrieve Server Certificates
env:
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
run: |
make truststore-pull-all-for-account ACCOUNT=${ACCOUNT_NAME}
- name: Terraform Init
env:
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
run: |
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} init
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} workspace new ${ACCOUNT_NAME} || \
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} workspace select ${ACCOUNT_NAME}
- name: Terraform Apply
env:
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
ACCOUNT_ID: ${{ secrets.AWS_ACCOUNT_ID }}
run: |
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} apply tfplan
- name: Update environment config version
env:
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
run: |
deployed_version=$(terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} output --raw version)
echo $deployed_version