Tags: EngineerBetter/iac-example
Tags
Promote changes to prod through staging CI is changed such that pushes to main will trigger the staging pipeline. If the staging pipeline is successful, the branch "staging" is updated to the current SHA. The prod pipeline will trigger on pushes to the staging pipeline. Environments are now configured via the environments.yml file. Most operations will fail when targeting environments not referenced in this file.
Parameterise environment names Previously only a production environment existed. It is now possible to deploy any environmenr with a given name by changing the environment variable TF_VAR_env_name. This same environment name is used when setting deploy and destroy pipelines in CI.
Record versions of dependencies So that builds can be reliably reproduced, we declare all versions of resources in git (such as image sha256). We use conftest to ensure that images remain pinned.
Add integration tests To ensure that sock-shop is deployed and functional, a system is run test that loads the front end and asserts on its content.
Add smoke tests to deploy After deploying, there is now a wait to ensure the the kubernetes manifest was applied successfully. This is achieved by adding a readinessProbe to the front-end that HTTP gets / to ensure a 200 response and a kubectl wait to ensure this check is successful at least one after deploy.
Run deploy pipeline every hour Running the pipeline hourly will ensure the deployment stays in sync with the definition in code.
Run bootstrap idempotently in CI The bootstrap script that creates a DynamoDB table and S3 bucket for use by terraform was not idempotent, meaning sequential runs would fail after the first. By making it idempotent it may now be run in CI every pipeline run.
Deploy and destroy in Jenkins CI Set up Jenkins pipelines for deploying and destroying our infrastructure and sock shop app. CI ensures that all tests and checks are successful prior to deployment. The Destroy pipeline is configured to be disabled by default. Running this pipeline manually will remove all infrastructure and deployments.
Added Snyk terraform plan scanning When deploying the cluster, a terraform plan is generated which is always scanned by Snyk. By settings the environment variable IGNORE_SNYK_TEST_PLAN_FAILURE=true, misconfigurations will not cause a deployment failure but will instead merely report on issues.
PreviousNext