Skip to content

Commit ef4109d

Browse files
TheOneFromNorwayTheOneFromNorway
committed
Improve new flow
- Replace complicated bash script with python script - Better tooling - Python chosen as the same script can be used for different services with only minor tweaks - Ruby is specific to this repository - Handle any changes in environment variables without needing to modify script - Also use a version-controlled yml file to persist variables - This removes the use of parameter groups for changing variables wihtout code changes - Changing variables in a running system requires in any case a full approval flow - Add singel approval step for all deployments
1 parent 42cce7c commit ef4109d

File tree

8 files changed

+305
-281
lines changed

8 files changed

+305
-281
lines changed

‎.github/workflows/deploy-application.yml‎

Lines changed: 20 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,6 @@ jobs:
6161
prepare-deployment:
6262
name: Prepare deployment
6363
runs-on: ubuntu-latest
64-
environment: ${{ inputs.environment }}
6564
permissions:
6665
id-token: write
6766
steps:
@@ -72,37 +71,27 @@ jobs:
7271
with:
7372
role-to-assume: ${{ env.aws-role }}
7473
aws-region: eu-west-2
75-
- name: Get image digest from ECR
76-
id: get-image-digest
74+
- name: Setup python
75+
uses: actions/setup-python@v4
76+
with:
77+
python-version-file: .tool-versions
78+
- name: Install Python dependencies
7779
run: |
78-
# Get AWS account ID and construct repository URI
79-
AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
80-
REPOSITORY_URI="${AWS_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/mavis/webapp"
81-
82-
# Get the image digest for the git SHA
83-
IMAGE_DIGEST=$(aws ecr describe-images \
84-
--repository-name mavis/webapp \
85-
--image-ids imageTag=${{ inputs.git_sha_to_deploy || github.sha }} \
86-
--query 'imageDetails[0].imageDigest' \
87-
--output text)
88-
89-
NEW_IMAGE_URI="${REPOSITORY_URI}@${IMAGE_DIGEST}"
90-
echo "new-image-uri=${NEW_IMAGE_URI}" >> $GITHUB_OUTPUT
91-
echo "New image URI: ${NEW_IMAGE_URI}"
80+
python3 install scripts/requirements.txt
9281
- name: Populate web task definition
9382
if: inputs.server_types == 'web' || inputs.server_types == 'all'
9483
id: render-web-task-definition
9584
run: |
96-
./script/populate_task_definition.sh ${{ inputs.environment }} web \
97-
-i "${{ steps.get-image-digest.outputs.new-image-uri }}" \
85+
python3 script/populate_task_definition.py ${{ inputs.environment }} web \
86+
-i "${{ inputs.git_sha_to_deploy || github.sha }}" \
9887
-o web-task-definition.json
9988
cat web-task-definition.json
10089
- name: Populate good-job task definition
10190
if: inputs.server_types == 'good-job' || inputs.server_types == 'all'
10291
id: render-good-job-task-definition
10392
run: |
104-
./script/populate_task_definition.sh ${{ inputs.environment }} good-job \
105-
-i "${{ steps.get-image-digest.outputs.new-image-uri }}" \
93+
python3 script/populate_task_definition.py ${{ inputs.environment }} good-job \
94+
-i "${{ inputs.git_sha_to_deploy || github.sha }}" \
10695
-o good-job-task-definition.json
10796
cat good-job-task-definition.json
10897
- name: Make artifact for web task definition
@@ -118,12 +107,19 @@ jobs:
118107
outputs:
119108
new-image-uri: ${{ steps.get-image-digest.outputs.new-image-uri }}
120109

110+
approve-deployments:
111+
name: Approve deployments
112+
runs-on: ubuntu-latest
113+
needs: prepare-deployment
114+
environment: ${{ inputs.environment }}
115+
steps:
116+
- run: echo "Proceeding with deployment to ${{ inputs.environment }} environment"
117+
121118
deploy-web:
122119
name: Deploy web service
123120
runs-on: ubuntu-latest
124121
if: inputs.server_types == 'web' || inputs.server_types == 'all'
125-
needs: prepare-deployment
126-
environment: ${{ inputs.environment }}
122+
needs: [ prepare-deployment, approve-deployments ]
127123
permissions:
128124
id-token: write
129125
steps:
@@ -167,8 +163,7 @@ jobs:
167163
name: Deploy good-job service
168164
runs-on: ubuntu-latest
169165
if: inputs.server_types == 'good-job' || inputs.server_types == 'all'
170-
needs: prepare-deployment
171-
environment: ${{ inputs.environment }}
166+
needs: [ prepare-deployment, approve-deployments ]
172167
permissions:
173168
id-token: write
174169
steps:

‎.tool-versions‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,4 @@ terraform 1.11.4
66
tflint 0.55.1
77
pkl 0.28.1
88
hk 1.1.2
9+
python 3.12.3

‎config/container_variables.yml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
# Container Variables Configuration
2+
# This file specifies environment-specific variables that will be added to or override
3+
# the environment variables extracted from terraform configuration
4+
5+
environments:
6+
production:
7+
RAILS_ENV: production
8+
SENTRY_ENVIRONMENT: production
9+
MAVIS__SPLUNK__ENABLED: true
10+
MAVIS__CIS2__ENABLED: true
11+
MAVIS__PDS__ENQUEUE_BULK_UPDATES: true
12+
MAVIS__PDS__WAIT_BETWEEN_JOBS: 0.5
13+
GOOD_JOB_MAX_THREADS: 5
14+
15+
qa:
16+
RAILS_ENV: staging
17+
SENTRY_ENVIRONMENT: qa
18+
MAVIS__SPLUNK__ENABLED: true
19+
MAVIS__CIS2__ENABLED: false
20+
MAVIS__PDS__ENQUEUE_BULK_UPDATES: false
21+
MAVIS__PDS__WAIT_BETWEEN_JOBS: 0.5
22+
GOOD_JOB_MAX_THREADS: 5
23+
24+
test:
25+
RAILS_ENV: staging
26+
SENTRY_ENVIRONMENT: test
27+
MAVIS__SPLUNK__ENABLED: true
28+
MAVIS__CIS2__ENABLED: true
29+
MAVIS__PDS__ENQUEUE_BULK_UPDATES: false
30+
MAVIS__PDS__WAIT_BETWEEN_JOBS: 0.5
31+
GOOD_JOB_MAX_THREADS: 5
32+
33+
preview:
34+
RAILS_ENV: staging
35+
SENTRY_ENVIRONMENT: preview
36+
MAVIS__SPLUNK__ENABLED: false
37+
MAVIS__CIS2__ENABLED: false
38+
MAVIS__PDS__ENQUEUE_BULK_UPDATES: false
39+
MAVIS__PDS__WAIT_BETWEEN_JOBS: 0.5
40+
GOOD_JOB_MAX_THREADS: 5
41+
42+
training:
43+
RAILS_ENV: staging
44+
SENTRY_ENVIRONMENT: training
45+
MAVIS__SPLUNK__ENABLED: false
46+
MAVIS__CIS2__ENABLED: false
47+
MAVIS__PDS__ENQUEUE_BULK_UPDATES: false
48+
MAVIS__PDS__WAIT_BETWEEN_JOBS: 0.5
49+
GOOD_JOB_MAX_THREADS: 5
50+
51+
sandbox-alpha:
52+
RAILS_ENV: staging
53+
SENTRY_ENVIRONMENT: sandbox-alpha
54+
MAVIS__SPLUNK__ENABLED: false
55+
MAVIS__CIS2__ENABLED: false
56+
MAVIS__PDS__ENQUEUE_BULK_UPDATES: false
57+
MAVIS__PDS__WAIT_BETWEEN_JOBS: 0.5
58+
GOOD_JOB_MAX_THREADS: 5
59+
60+
sandbox-beta:
61+
RAILS_ENV: staging
62+
SENTRY_ENVIRONMENT: sandbox-beta
63+
MAVIS__SPLUNK__ENABLED: false
64+
MAVIS__CIS2__ENABLED: false
65+
MAVIS__PDS__ENQUEUE_BULK_UPDATES: false
66+
MAVIS__PDS__WAIT_BETWEEN_JOBS: 0.5
67+
GOOD_JOB_MAX_THREADS: 5

‎config/templates/task-definition.json.tpl‎

Lines changed: 6 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
{
2-
"family": "mavis-<SERVER_TYPE>-task-definition-<ENV>",
2+
"family": "mavis-<SERVER_TYPE_NAME>-task-definition-<ENV>",
33
"containerDefinitions": [
44
{
55
"name": "application",
6-
"image": "REPOSITORY_URI",
6+
"image": "<IMAGE_URI>",
77
"portMappings": [
88
{
99
"containerPort": 4000,
@@ -16,83 +16,18 @@
1616
"options": {
1717
"awslogs-group": "mavis-<ENV>-ecs",
1818
"awslogs-region": "eu-west-2",
19-
"awslogs-stream-prefix": "<ENV>-<SERVER_TYPE>-logs"
19+
"awslogs-stream-prefix": "<SERVER_TYPE_NAME>-logs"
2020
}
2121
},
2222
"healthCheck": {
23-
"command": [
24-
"CMD-SHELL",
25-
"./bin/internal_healthcheck http://localhost:4000<HEALTH_CHECK_PATH>"
26-
],
23+
"command": ["CMD-SHELL", "<HEALTH_CHECK>"],
2724
"interval": 30,
2825
"timeout": 5,
2926
"retries": 3,
3027
"startPeriod": 10
3128
},
32-
"environment": [
33-
{
34-
"name": "MAVIS__GIVE_OR_REFUSE_CONSENT_HOST",
35-
"value": "<MAVIS__GIVE_OR_REFUSE_CONSENT_HOST>"
36-
},
37-
{
38-
"name": "RAILS_ENV",
39-
"value": "<RAILS_ENV>"
40-
},
41-
{
42-
"name": "MAVIS__SPLUNK__ENABLED",
43-
"value": "<SPLUNK__ENABLED>"
44-
},
45-
{
46-
"name": "MAVIS__HOST",
47-
"value": "<MAVIS__HOST>"
48-
},
49-
{
50-
"name": "MAVIS__CIS2__ENABLED",
51-
"value": "<CIS2__ENABLED>"
52-
},
53-
{
54-
"name": "SERVER_TYPE",
55-
"value": "<SERVER_TYPE>"
56-
},
57-
{
58-
"name": "DB_NAME",
59-
"value": "<DB_NAME>"
60-
},
61-
{
62-
"name": "DB_HOST",
63-
"value": "<DB_HOST>"
64-
},
65-
{
66-
"name": "SENTRY_ENVIRONMENT",
67-
"value": "<ENV>"
68-
},
69-
{
70-
"name": "APP_VERSION",
71-
"value": "<APP_VERSION>"
72-
}
73-
],
74-
"secrets": [
75-
{
76-
"name": "DB_CREDENTIALS",
77-
"valueFrom": "<DB_SECRET_ARN>"
78-
},
79-
{
80-
"name": "RAILS_MASTER_KEY",
81-
"valueFrom": "<RAILS_MASTER_KEY_ARN>"
82-
},
83-
{
84-
"name": "GOOD_JOB_MAX_THREADS",
85-
"valueFrom": "<GOOD_JOB_MAX_THREADS_ARN>"
86-
},
87-
{
88-
"name": "MAVIS__PDS__ENQUEUE_BULK_UPDATES",
89-
"valueFrom": "<MAVIS__PDS__ENQUEUE_BULK_UPDATES_ARN>"
90-
},
91-
{
92-
"name": "MAVIS__PDS__WAIT_BETWEEN_JOBS",
93-
"valueFrom": "<MAVIS__PDS__WAIT_BETWEEN_JOBS_ARN>"
94-
}
95-
]
29+
"environment": <ENVIRONMENT_VARIABLES>,
30+
"secrets": <SECRETS>
9631
}
9732
],
9833
"taskRoleArn": "<TASK_ROLE_ARN>",

0 commit comments

Comments
 (0)