Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Module refactor #14

Merged
merged 33 commits into from
Mar 14, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
33 commits
Select commit Hold shift + click to select a range
fae9826
Cleanup variables
hellais Mar 8, 2024
d63042b
Fix setup script
hellais Mar 8, 2024
ea37501
Fix naming of launch template
hellais Mar 8, 2024
6caa23c
Refactor network configuration into separate module
hellais Mar 9, 2024
11e3532
Refactor postgresql into module
hellais Mar 9, 2024
4af3739
Refactoring of names and tags
hellais Mar 9, 2024
e444d00
Refactor oonibackend proxy into separate module
hellais Mar 9, 2024
aa890b3
Refactor ooni_dataapi ecs task
hellais Mar 9, 2024
2e84511
Add script for formatting the tf moved lines
hellais Mar 9, 2024
255a9fc
Refactor ansible_inventory into module
hellais Mar 10, 2024
012d014
Rename prod to oldprod
hellais Mar 10, 2024
874f43f
Start fleshing out dev environment with multi-account setup
hellais Mar 10, 2024
ebc25e5
Switch to oonidevops_user
hellais Mar 10, 2024
729391c
Refactor postgresql config
hellais Mar 10, 2024
03398ad
Fix deployment of postgresql
hellais Mar 10, 2024
3a4e047
Print pg password id
hellais Mar 10, 2024
4e7ad3e
Improve adm_iam_roles and add ooni_backendproxy
hellais Mar 10, 2024
b6c0d8c
Implement frontend proxy
hellais Mar 10, 2024
6352cb5
Refactor oonidatapi into a general service module
hellais Mar 10, 2024
99d9455
Refactor cluster into separate module
hellais Mar 10, 2024
aa75cf4
Add dataapi listener
hellais Mar 11, 2024
b80f819
bugfix
hellais Mar 11, 2024
1c92020
Refactor split mapped and direct alb
hellais Mar 11, 2024
82eec4e
Fix reference to shared security group
hellais Mar 11, 2024
a4d18c3
Destory everything in oldprod
hellais Mar 12, 2024
95ba31b
Setup deployment of OONI Run v2
hellais Mar 12, 2024
cccbff6
Fix tags
hellais Mar 12, 2024
641d7e1
Enable session manager on codebuild
hellais Mar 12, 2024
e67cea5
Enable priviledged mode
hellais Mar 12, 2024
1e3eaac
Fix codebuild source type
hellais Mar 12, 2024
646c4a7
Fix codestar connection
hellais Mar 12, 2024
88f7087
Add mehul to the authorized_roles
hellais Mar 13, 2024
9064652
feat: add OONI Dev User for GH actions (#17)
DecFox Mar 14, 2024
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
95 changes: 95 additions & 0 deletions .github/workflows/check_ansible.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,95 @@
# For docs on this see:
# * https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions
# * https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request
# * https://docs.github.com/en/webhooks/webhook-events-and-payloads?actionType=synchronize#pull_request
on:
pull_request:
types:
- opened
- synchronize # when commits are pushed to the PR
- reopened
- edited # title or body of a pull request was edited, or the base branch of a pull request was changed

jobs:
ansible:
strategy:
matrix:
environment: ["dev"]
runs-on: ubuntu-latest
defaults:
run:
working-directory: ansible/
permissions:
pull-requests: write
steps:
- uses: actions/checkout@v4

- name: Install Ansible
run: |
sudo apt update
sudo apt install software-properties-common
sudo add-apt-repository --yes --update ppa:ansible/ansible-9
sudo apt install -y ansible

- name: Write devops ssh key to .ssh
run: |
mkdir -p ~/.ssh/
chmod 700 ~/.ssh/
echo "${{ secrets.AWS_SSH_KEY }}" > ~/.ssh/ooni-devops-prod.pem
chmod 600 ~/.ssh/ooni-devops-prod.pem

- name: Run Ansible Playbook
id: playbook
env:
ANSIBLE_SSH_ARGS: "-o UserKnownHostsFile=known_hosts"
INVENTORY_FILE_PATH: "../tf/modules/ansible_inventory/inventories/inventory-${{ matrix.environment }}.ini"
run: |
echo "ansible_playbook<<EOF" >> "$GITHUB_OUTPUT"
echo "\$ ansible-playbook playbook.yml --check --diff -i $INVENTORY_FILE_PATH" >> "$GITHUB_OUTPUT"
ansible-playbook playbook.yml --check --diff -i $INVENTORY_FILE_PATH \
--key-file ~/.ssh/ooni-devops-prod.pem 2>&1 | tee -a "$GITHUB_OUTPUT"
echo "EOF" >> "$GITHUB_OUTPUT"
continue-on-error: true

# This can be uncommmented to make it possible to ssh into the container to debug the run
#- name: Setup tmate session
# uses: mxschmitt/action-tmate@v3

- uses: actions/github-script@v6
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const commentTitle = "Ansible Run Output";
const ansiblePlaybookOutput = `${{ steps.playbook.outputs.ansible_playbook}}`;
const parts = ansiblePlaybookOutput.split(/PLAY RECAP \*+/);
const ansiblePlaybookRecap = parts.length > 1 ? parts[1].trim() : '';

const commentBody = `
#### Ansible Playbook Recap 🔍

\`\`\`\n
${ansiblePlaybookRecap}
\`\`\`

#### Ansible playbook output 📖\`${{ steps.playbook.outcome }}\`

<details><summary>Show Execution</summary>

\`\`\`\n
${ansiblePlaybookOutput}
\`\`\`

</details>

| | |
|-------------------|------------------------------------|
| Pusher | @${{ github.actor }} |
| Action | ${{ github.event_name }} |
| Working Directory | ${{ env.tf_actions_working_dir }} |
| Workflow | ${{ github.workflow }} |
| Last updated | ${(new Date()).toUTCString()} |
`;

// Call the script to write the comment
const script = require('./scripts/ghactions/comment-on-pr.js');
await script({github, context, core, commentTitle, commentBody});
Original file line number Diff line number Diff line change
Expand Up @@ -10,108 +10,39 @@ on:
- reopened
- edited # title or body of a pull request was edited, or the base branch of a pull request was changed

env:
tf_actions_working_dir: "./tf/environments/prod"
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

jobs:
ansible:
needs: terraform
runs-on: ubuntu-latest
defaults:
run:
working-directory: ${{ env.tf_actions_working_dir }}/ansible
permissions:
pull-requests: write
steps:
- uses: actions/checkout@v4

- name: Install Ansible
run: |
sudo apt update
sudo apt install software-properties-common
sudo add-apt-repository --yes --update ppa:ansible/ansible-9
sudo apt install -y ansible

- name: Write devops ssh key to .ssh
run: |
mkdir -p ~/.ssh/
chmod 700 ~/.ssh/
echo "${{ secrets.AWS_SSH_KEY }}" > ~/.ssh/ooni-devops-prod.pem
chmod 600 ~/.ssh/ooni-devops-prod.pem

- name: Run Ansible Playbook
id: playbook
env:
ANSIBLE_SSH_ARGS: "-o UserKnownHostsFile=known_hosts"
run: |
echo "ansible_playbook<<EOF" >> "$GITHUB_OUTPUT"
echo "\$ ansible-playbook playbook.yml --check --diff -i inventory.ini" >> "$GITHUB_OUTPUT"
ansible-playbook playbook.yml --check --diff -i inventory.ini --key-file ~/.ssh/ooni-devops-prod.pem 2>&1 | tee -a "$GITHUB_OUTPUT"
echo "EOF" >> "$GITHUB_OUTPUT"
continue-on-error: true

# This can be uncommmented to make it possible to ssh into the container to debug the run
#- name: Setup tmate session
# uses: mxschmitt/action-tmate@v3

- uses: actions/github-script@v6
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const commentTitle = "Ansible Run Output";
const ansiblePlaybookOutput = `${{ steps.playbook.outputs.ansible_playbook}}`;
const parts = ansiblePlaybookOutput.split(/PLAY RECAP \*+/);
const ansiblePlaybookRecap = parts.length > 1 ? parts[1].trim() : '';

const commentBody = `
#### Ansible Playbook Recap 🔍

\`\`\`\n
${ansiblePlaybookRecap}
\`\`\`

#### Ansible playbook output 📖\`${{ steps.playbook.outcome }}\`

<details><summary>Show Execution</summary>

\`\`\`\n
${ansiblePlaybookOutput}
\`\`\`

</details>

| | |
|-------------------|------------------------------------|
| Pusher | @${{ github.actor }} |
| Action | ${{ github.event_name }} |
| Working Directory | ${{ env.tf_actions_working_dir }} |
| Workflow | ${{ github.workflow }} |
| Last updated | ${(new Date()).toUTCString()} |
`;

// Call the script to write the comment
const script = require('./scripts/ghactions/comment-on-pr.js');
await script({github, context, core, commentTitle, commentBody});

terraform:
strategy:
matrix:
environment: ["dev"]

runs-on: ubuntu-latest
if: ${{ !startsWith(github.event.head_commit.message, 'skip-terraform:') }}
defaults:
run:
working-directory: ${{ env.tf_actions_working_dir }}
working-directory: tf/environments/${{ matrix.environment }}
permissions:
contents: write
pull-requests: write
env:
TF_VAR_aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
TF_VAR_aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
TF_VAR_ooni_pg_password: ${{ secrets.OONI_PG_PASSWORD }}

steps:
- uses: actions/checkout@v4

- name: Configure AWS credentials
run: |
mkdir ~/.aws/
cat <<EOF > ~/.aws/credentials
[default]
aws_access_key_id = ${{ secrets.OONIDEVOPS_AWS_ACCESS_KEY_ID }}
aws_secret_access_key = ${{ secrets.OONIDEVOPS_AWS_SECRET_ACCESS_KEY }}

[oonidevops_user]
aws_access_key_id = ${{ secrets.OONIDEVOPS_AWS_ACCESS_KEY_ID }}
aws_secret_access_key = ${{ secrets.OONIDEVOPS_AWS_SECRET_ACCESS_KEY }}
EOF
chmod 700 ~/.aws/
chmod 600 ~/.aws/credentials

- name: Install Terraform
run: |
wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
Expand Down Expand Up @@ -194,7 +125,7 @@ jobs:
|-------------------|------------------------------------|
| Pusher | @${{ github.actor }} |
| Action | ${{ github.event_name }} |
| Working Directory | ${{ env.tf_actions_working_dir }} |
| Environment | ${{ matrix.environment }} |
| Workflow | ${{ github.workflow }} |
| Last updated | ${ (new Date()).toUTCString() } |
`;
Expand Down
File renamed without changes.
File renamed without changes.
5 changes: 5 additions & 0 deletions tf/Readme.md
Original file line number Diff line number Diff line change
@@ -1 +1,6 @@
https://www.terraform-best-practices.com/naming

Sometimes it's useful to specify a target like this:
```
terraform apply -target=module.ooniapi_frontend.aws_lb_listener_rule.oonidataapi_rule
```
128 changes: 128 additions & 0 deletions tf/environments/dev/.terraform.lock.hcl

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

13 changes: 13 additions & 0 deletions tf/environments/dev/backend.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
terraform {
required_version = ">= 1.0.0"

backend "s3" {
region = "eu-central-1"
bucket = "oonidevops-dev-terraform-state"
key = "terraform.tfstate"
profile = ""
encrypt = "true"

dynamodb_table = "oonidevops-dev-terraform-state-lock"
}
}
Loading
Loading