Separate app and infra deployments #4432

TheOneFromNorway · 2025-08-28T14:59:50Z

Separate deployment of application and infrastructure changes

This enables separating out infrastructure components into a separate repository. Some cleanup is required post deployment, this is not done at this stage to ensure backwards compatibility of the infrastructure.

Replace the task definition creation with a template version
- The template version will be picked up and modified during the ECS deployment workflow
Remove redundant resources/outputs
- We no longer need outputs/s3 buckets since we will be using AWS provided github actions for deployment
Move application-specific variables into a config file (to be used in deployment)
- A new SSM resources is introduced that will allow tweaking
  parameters without redeployment
Create ECS deployment specific role in AWS
- Limits permission scope for production deployments
- Adheres to the principle of least privilege
- Separates permissions between application deployments and infrastructure changes

Ticket: MAV-1657

.github/workflows/data-replication-pipeline.yml

.github/workflows/deploy.yml

.github/workflows/refresh-data-replication.yml

.github/workflows/data-replication-pipeline.yml

terraform/account/variables.tf

.tool-versions

.github/workflows/data-replication-pipeline.yml

tvararu · 2025-09-11T10:23:05Z

@thomasleese this PR will cause some minor conflicts with your #4564 because I also removed some good_job references when bumping the infrastructure workflows.

- Replace the task definition creation with a teamplate version - The template version will be picked up and modified during the ECS deployment workflow - Remove redundant resources/outputs - We no longer need outputs/s3 buckets since we will be using AWS provided github actions for deployment - Move application-specific variables into a config file (to be used in deployment) - A new SSM resources is introduced that will allow tweaking parameters without redeployment

- These variables have been moved to a config file to be inserted into the task definition on deploy - Modify the docker-start script to turn the comma separated key-value pairs in the ENV_VARS secret into environment variables

- Limits permission scope for production deployments - Adheres to the principle of least privilege - Separates permissions between application deployments and infrastructure changes

- The application can now be deployed independently from infrastructure changes - Create SSM parameter population script in python so it can also be used between services located in different repositories (e.g. like reporting service) - Create a new task definition based on the templated version created by infrastructure deploy - Create appspec.yaml template for handling codedeploys - Remove redundant parameters from terraform deployment

- This is required due to the new template-mechanism - Adheres to split between application and infrastructure

- Remnant from database migration

- Dashes instead of underline for github pipelines - Clear separation of concerns in account tf stack - Remove unnecessary `app_version` input

- Docker entry point is top level so this is where the environment variables must be extracted - Otherwise shelling into the container and also db:seed does not execute properly

Also format some yml whitespace using prettier.

Matches the one in .tool-versions.

The workflow always replaces the db cluster, so the check isn't necessary anymore.

Update the title, pass in `git_ref_to_deploy`, only `build-and-push-image` image if an `image_tag` isn't specified, and ensure that `yq` is installed before using it.

Matches the convention that GitHub actions generally use.

We're now fully relying on sidekiq, so don't need this anymore.

Skip building if an `image-tag` is passed in, and rename the `deploy-sidekiq` subtask for consistency.

Use kebab-case for variables and remove an unused env var.

We don't deploy this worker anymore.

- Agreed to change the setup to control the set of tunable variables only on infrastructure side - Parameter store locations for the variables are created, but only populated with a CHANGE_ME parameter - This is for use with non-prod systems only - The docker entry point now unsets any variables with CHANGE_ME values - Workflow updated to reflect new secret/aws variable management setup - python scripts/dependency removed as no scripting is needed for secrets in the new setup

sonarqubecloud · 2025-09-15T12:04:15Z

Quality Gate failed

Failed conditions
13 Security Hotspots

See analysis details on SonarQube Cloud

bogsi17 · 2025-09-19T16:13:00Z

terraform/app/variables.tf

+  non_empty_parameter_groups = toset([
+    for key, value in local.parameter_store_variables : key if length(concat(local.secret_arns[key], local.parameter_store_paths[key])) > 0
+  ])


The non_empty_parameter_groups is just used to dynamically create dedicated iam roles and policies for "CORE" and "REPORTING" right? I would prefer to create the iam resources explicitly and avoid this complex construction

bogsi17 · 2025-09-19T16:16:58Z

terraform/app/variables.tf

-  default     = "Unknown"
-  nullable    = false
-}
-
 locals {
  is_production = var.environment == "production"
  parameter_store_variables = tomap({


I think the explicit casts to map are not necessary, also in the other places further down in this file

bogsi17 · 2025-09-19T16:17:23Z

terraform/app/variables.tf

-    MAVIS__ACADEMIC_YEAR_TODAY_OVERRIDE             = var.academic_year_today_override
-    MAVIS__ACADEMIC_YEAR_NUMBER_OF_PREPARATION_DAYS = var.academic_year_number_of_preparation_days
-    MAVIS__PDS__ENQUEUE_BULK_UPDATES                = var.enable_pds_enqueue_bulk_updates ? "true" : "false"
-    MAVIS__PDS__RATE_LIMIT_PER_SECOND               = var.pds_rate_limit_per_second
-    GOOD_JOB_MAX_THREADS                            = 5


How are these values now defined for production?

bogsi17 · 2025-09-19T16:19:14Z

terraform/app/variables.tf

-      valueFrom = var.rails_master_key_path
-    }
-  ], local.parameter_store_config_list)
+  task_secrets = tomap({


Why is the RAILS_MASTER_KEY not added as task secret anymore?

TheOneFromNorway requested review from a team as code owners August 28, 2025 14:59

TheOneFromNorway added the infrastructure Related to infrastructure changes label Aug 28, 2025

github-advanced-security bot found potential problems Aug 28, 2025

View reviewed changes

.github/workflows/data-replication-pipeline.yml Fixed Show fixed Hide fixed

TheOneFromNorway force-pushed the separate_app_and_infra_deployments branch from 6a60f17 to 5aec2b4 Compare August 28, 2025 15:39

bogsi17 temporarily deployed to sandbox-alpha August 29, 2025 09:05 — with GitHub Actions Inactive

bogsi17 temporarily deployed to sandbox-beta August 29, 2025 09:38 — with GitHub Actions Inactive

bogsi17 temporarily deployed to sandbox-beta August 29, 2025 10:00 — with GitHub Actions Inactive

bogsi17 reviewed Aug 29, 2025

View reviewed changes

terraform/account/variables.tf Show resolved Hide resolved

thomasleese reviewed Aug 29, 2025

View reviewed changes

.tool-versions Outdated Show resolved Hide resolved

.github/workflows/data-replication-pipeline.yml Outdated Show resolved Hide resolved

TheOneFromNorway force-pushed the separate_app_and_infra_deployments branch 4 times, most recently from 467e3e4 to 02f42b3 Compare September 2, 2025 12:33

tvararu force-pushed the separate_app_and_infra_deployments branch 2 times, most recently from 8fc8c72 to f9c0ab6 Compare September 11, 2025 09:08

tvararu marked this pull request as draft September 11, 2025 09:13

tvararu force-pushed the separate_app_and_infra_deployments branch from bebba7b to 2feac96 Compare September 11, 2025 10:21

tvararu marked this pull request as ready for review September 11, 2025 10:23

tvararu force-pushed the separate_app_and_infra_deployments branch from 2feac96 to 29bed06 Compare September 11, 2025 10:23

TheOneFromNorway added 7 commits September 12, 2025 14:06

Remove migrated variables out of tfvars

8d47508

- These variables have been moved to a config file to be inserted into the task definition on deploy - Modify the docker-start script to turn the comma separated key-value pairs in the ENV_VARS secret into environment variables

Create ECS deployment specific role in AWS

bce5f69

- Limits permission scope for production deployments - Adheres to the principle of least privilege - Separates permissions between application deployments and infrastructure changes

Also update deployment of data replication

c0e1040

- This is required due to the new template-mechanism - Adheres to split between application and infrastructure

Clean up empty files

01d32d1

- Remnant from database migration

Standardizing conventions/setup

629a650

- Dashes instead of underline for github pipelines - Clear separation of concerns in account tf stack - Remove unnecessary `app_version` input

TheOneFromNorway and others added 10 commits September 12, 2025 14:06

Move export of ENV_VARS

d24dabb

- Docker entry point is top level so this is where the environment variables must be extracted - Otherwise shelling into the container and also db:seed does not execute properly

Fix missing newlines from infrastructure files

e1f8053

Also format some yml whitespace using prettier.

Use latest python in data-replication-pipeline

6c61c57

Matches the one in .tool-versions.

Remove unnecessary -replace check

93c3d52

The workflow always replaces the db cluster, so the check isn't necessary anymore.

Tweak data-replication-pipeline

d61156e

Update the title, pass in `git_ref_to_deploy`, only `build-and-push-image` image if an `image_tag` isn't specified, and ensure that `yq` is installed before using it.

Use dashes for inputs to data-replication-pipeline

cba341d

Matches the convention that GitHub actions generally use.

Remove good-job deployment from deploy-application

8d72662

We're now fully relying on sidekiq, so don't need this anymore.

Align deploy-application to data-replication task

843755c

Skip building if an `image-tag` is passed in, and rename the `deploy-sidekiq` subtask for consistency.

Align refresh-data-replication to conventions

49a9c00

Use kebab-case for variables and remove an unused env var.

Remove good-job references from container vars

c9c17f5

We don't deploy this worker anymore.

tvararu force-pushed the separate_app_and_infra_deployments branch from 29bed06 to c9c17f5 Compare September 12, 2025 07:06

TheOneFromNorway temporarily deployed to sandbox-beta September 15, 2025 11:39 — with GitHub Actions Inactive

TheOneFromNorway temporarily deployed to sandbox-beta September 15, 2025 11:40 — with GitHub Actions Inactive

TheOneFromNorway force-pushed the separate_app_and_infra_deployments branch from ac891d0 to 4e6a0c9 Compare September 15, 2025 12:03

TheOneFromNorway temporarily deployed to sandbox-beta September 15, 2025 12:13 — with GitHub Actions Inactive

TheOneFromNorway temporarily deployed to sandbox-beta September 15, 2025 12:14 — with GitHub Actions Inactive

bogsi17 had a problem deploying to sandbox-beta September 19, 2025 13:20 — with GitHub Actions Failure

bogsi17 reviewed Sep 19, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Separate app and infra deployments #4432

Separate app and infra deployments #4432

Uh oh!

TheOneFromNorway commented Aug 28, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tvararu commented Sep 11, 2025

Uh oh!

sonarqubecloud bot commented Sep 15, 2025

Uh oh!

bogsi17 Sep 19, 2025

Uh oh!

bogsi17 Sep 19, 2025 •

edited

Loading

Uh oh!

bogsi17 Sep 19, 2025

Uh oh!

bogsi17 Sep 19, 2025

Uh oh!

Uh oh!

Separate app and infra deployments #4432

Are you sure you want to change the base?

Separate app and infra deployments #4432

Uh oh!

Conversation

TheOneFromNorway commented Aug 28, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tvararu commented Sep 11, 2025

Uh oh!

sonarqubecloud bot commented Sep 15, 2025

Quality Gate failed

Uh oh!

bogsi17 Sep 19, 2025

Choose a reason for hiding this comment

Uh oh!

bogsi17 Sep 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bogsi17 Sep 19, 2025

Choose a reason for hiding this comment

Uh oh!

bogsi17 Sep 19, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bogsi17 Sep 19, 2025 •

edited

Loading