-
Notifications
You must be signed in to change notification settings - Fork 0
292 lines (264 loc) · 15.5 KB
/
infra.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
name: AtomikLabs IAC CI/CD Workflow
on:
pull_request:
branches:
- dev
- stage
- main
paths:
- "infra/**"
push:
branches:
- dev
- stage
- main
paths:
- "infra/**"
env:
AWS_REGION: ${{ secrets.AWS_REGION }}
jobs:
setup-environment:
runs-on: ubuntu-latest
outputs:
env-file: ${{ steps.set-env.outputs.env-file }}
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Determine environment
id: set-env
run: |
if [ "${{ github.event_name }}" == "pull_request" ]; then
echo "Base branch of the PR: ${{ github.base_ref }}"
BRANCH_NAME="${{ github.base_ref }}"
else
echo "Push to branch: ${GITHUB_REF#refs/heads/}"
BRANCH_NAME="${GITHUB_REF#refs/heads/}"
fi
if [[ $BRANCH_NAME == 'dev' ]]; then
echo "Development environment selected"
echo "env-file=infra/aws/environments/env.dev.json" >> $GITHUB_ENV
elif [[ $BRANCH_NAME == 'stage' ]]; then
echo "Staging environment selected"
echo "env-file=infra/aws/environments/env.stage.json" >> $GITHUB_ENV
elif [[ $BRANCH_NAME == 'main' ]]; then
echo "Production environment selected"
echo "env-file=infra/aws/environments/env.prod.json" >> $GITHUB_ENV
else
echo "No matching environment for branch $BRANCH_NAME"
fi
- name: Echo environment file path
run: |
echo "Environment file path: ${{ env.env-file }}"
if [[ -z "${{ env.env-file }}" ]]; then
echo "Environment file path is empty"
else
echo "Environment file path is set"
fi
- name: Set environment variables from file
if: env.env-file != ''
run: |
jq -r 'to_entries | .[] | "\(.key)=\(.value)"' "${{ env.env-file }}" >> $GITHUB_ENV
lint-and-validate:
needs: setup-environment
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Validate CloudFormation templates
run: |
env:
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: ${{ secrets.AWS_REGION }}
test-deploy:
needs: lint-and-validate
if: github.event_name == 'pull_request'
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v3
- name: Determine environment and set variables
run: |
echo "env-file=infra/aws/environments/env.test.json" >> $GITHUB_ENV
- name: Set environment variables from file
run: |
if [ -f ${{ env.env-file }} ]; then
jq -r 'to_entries | .[] | "\(.key)=\(.value)"' "${{ env.env-file }}" >> $GITHUB_ENV
else
echo "${{ env.env-file }} does not exist"
fi
- name: Set AWS Credentials for Test Environment
run: |
echo "AWS_ACCESS_KEY_ID=${{ secrets.TEST_AWS_ACCESS_KEY_ID }}" >> $GITHUB_ENV
echo "AWS_SECRET_ACCESS_KEY=${{ secrets.TEST_AWS_SECRET_ACCESS_KEY }}" >> $GITHUB_ENV
- name: Upload Substack Template to S3
run: |
NETWORKING_SUBSTACK_TEMPLATE_FILE="infra/aws/templates/networking-substack.yaml"
echo "Uploading substack template: $NETWORKING_SUBSTACK_TEMPLATE_FILE"
DATA_LAYER_SUBSTACK_TEMPLATE_FILE="infra/aws/templates/data-layer-substack.yaml"
echo "Uploading substack template: $DATA_LAYER_SUBSTACK_TEMPLATE_FILE"
DATA_INGESTION_SUBSTACK_TEMPLATE_FILE="infra/aws/templates/data-ingestion-substack.yaml"
echo "Uploading substack template: $DATA_INGESTION_SUBSTACK_TEMPLATE_FILE"
DATA_PERSISTENCE_SUBSTACK_TEMPLATE_FILE="infra/aws/templates/data-persistence-substack.yaml"
echo "Uploading substack template: $DATA_PERSISTENCE_SUBSTACK_TEMPLATE_FILE"
aws s3 cp $NETWORKING_SUBSTACK_TEMPLATE_FILE s3://atomiklabs-iac/cloudformation/test/networking-substack.yaml
aws s3 cp $DATA_LAYER_SUBSTACK_TEMPLATE_FILE s3://atomiklabs-iac/cloudformation/test/data-layer-substack.yaml
aws s3 cp $DATA_INGESTION_SUBSTACK_TEMPLATE_FILE s3://atomiklabs-iac/cloudformation/test/data-ingestion-substack.yaml
aws s3 cp $DATA_PERSISTENCE_SUBSTACK_TEMPLATE_FILE s3://atomiklabs-iac/cloudformation/test/data-persistence-substack.yaml
- name: Deploy to Test Stack
run: |
MAIN_TEMPLATE_FILE="infra/aws/templates/template.yaml"
STACK_NAME="atomiklabs-test-stack-${{ github.run_number }}"
NETWORKING_SUBSTACK_URL="https://atomiklabs-iac.s3.${{ secrets.AWS_REGION }}.amazonaws.com/cloudformation/test/networking-substack.yaml"
DATA_LAYER_SUBSTACK_URL="https://atomiklabs-iac.s3.${{ secrets.AWS_REGION }}.amazonaws.com/cloudformation/test/data-layer-substack.yaml"
DATA_INGESTION_SUBSTACK_URL="https://atomiklabs-iac.s3.${{ secrets.AWS_REGION }}.amazonaws.com/cloudformation/test/data-ingestion-substack.yaml"
DATA_PERSISTENCE_SUBSTACK_TEMPLATE_URL="https://atomiklabs-iac.s3.${{ secrets.AWS_REGION }}.amazonaws.com/cloudformation/test/data-persistence-substack.yaml"
BASTION_ACCESS_CIDR=${{ secrets.BASTION_ACCESS_CIDR }}
echo "Deploying main template: $MAIN_TEMPLATE_FILE"
echo "Networking Substack URL: $NETWORKING_SUBSTACK_URL"
echo "Data Layer Substack URL: $DATA_LAYER_SUBSTACK_URL"
echo "Data Ingestion Substack URL: $DATA_INGESTION_SUBSTACK_URL"
echo "Data Persistence Substack URL: $DATA_PERSISTENCE_SUBSTACK_TEMPLATE_URL"
aws cloudformation deploy \
--template-file $MAIN_TEMPLATE_FILE \
--stack-name $STACK_NAME \
--region ${{ secrets.AWS_REGION }} \
--no-fail-on-empty-changeset \
--capabilities CAPABILITY_NAMED_IAM \
--parameter-overrides \
NetworkingSubstackTemplateURL=$NETWORKING_SUBSTACK_URL \
DataLayerSubstackTemplateURL=$DATA_LAYER_SUBSTACK_URL \
DataIngestionSubstackTemplateURL=$DATA_INGESTION_SUBSTACK_URL \
DataPersistenceSubstackTemplateURL=$DATA_PERSISTENCE_SUBSTACK_TEMPLATE_URL \
EnvironmentName=test \
VpcCidr=$TEST_VPC_CIDR \
PublicSubnet1Cidr=$TEST_PUBLIC_SUBNET_1_CIDR \
PublicSubnet2Cidr=$TEST_PUBLIC_SUBNET_2_CIDR \
PrivateSubnet1Cidr=$TEST_PRIVATE_SUBNET_1_CIDR \
PrivateSubnet2Cidr=$TEST_PRIVATE_SUBNET_2_CIDR \
BastionAccessCidr=$BASTION_ACCESS_CIDR
- name: Capture Events on Failure
if: failure()
run: |
STACK_NAME="atomiklabs-test-stack-${{ github.run_number }}"
echo "Fetching stack events for $STACK_NAME"
aws cloudformation describe-stack-events --stack-name $STACK_NAME
- name: Confirm Stack Creation
run: |
STACK_NAME="atomiklabs-test-stack-${{ github.run_number }}"
aws cloudformation describe-stacks --stack-name $STACK_NAME
echo "Stack $STACK_NAME has been confirmed to exist."
- name: Delete Test Stack
if: always()
run: |
STACK_NAME="atomiklabs-test-stack-${{ github.run_number }}"
echo "Deleting stack: $STACK_NAME"
aws cloudformation delete-stack --stack-name $STACK_NAME
echo "Waiting for the stack to be deleted..."
aws cloudformation wait stack-delete-complete --stack-name $STACK_NAME
if ! aws cloudformation describe-stacks --stack-name $STACK_NAME; then
echo "Stack $STACK_NAME has been deleted successfully."
else
echo "Stack $STACK_NAME deletion failed."
fi
deploy:
needs: [setup-environment, lint-and-validate]
if: github.event_name == 'push' && (contains(github.ref, 'refs/heads/dev') || contains(github.ref, 'refs/heads/stage') || contains(github.ref, 'refs/heads/main'))
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Set AWS Credentials and Parameter File
run: |
if [[ $GITHUB_REF == 'refs/heads/dev' ]]; then
echo "AWS_ACCESS_KEY_ID=${{ secrets.DEV_AWS_ACCESS_KEY_ID }}" >> $GITHUB_ENV
echo "AWS_SECRET_ACCESS_KEY=${{ secrets.DEV_AWS_SECRET_ACCESS_KEY }}" >> $GITHUB_ENV
elif [[ $GITHUB_REF == 'refs/heads/stage' ]]; then
echo "AWS_ACCESS_KEY_ID=${{ secrets.STAGE_AWS_ACCESS_KEY_ID }}" >> $GITHUB_ENV
echo "AWS_SECRET_ACCESS_KEY=${{ secrets.STAGE_AWS_SECRET_ACCESS_KEY }}" >> $GITHUB_ENV
elif [[ $GITHUB_REF == 'refs/heads/main' ]]; then
echo "AWS_ACCESS_KEY_ID=${{ secrets.PROD_AWS_ACCESS_KEY_ID }}" >> $GITHUB_ENV
echo "AWS_SECRET_ACCESS_KEY=${{ secrets.PROD_AWS_SECRET_ACCESS_KEY }}" >> $GITHUB_ENV
fi
- name: Determine environment
run: |
if [ "${{ github.event_name }}" == "pull_request" ]; then
echo "Base branch of the PR: ${{ github.base_ref }}"
BRANCH_NAME="${{ github.base_ref }}"
else
echo "Push to branch: ${GITHUB_REF#refs/heads/}"
BRANCH_NAME="${GITHUB_REF#refs/heads/}"
fi
if [[ $BRANCH_NAME == 'dev' ]]; then
echo "Development environment selected"
echo "env-file=infra/aws/environments/env.dev.json" >> $GITHUB_ENV
elif [[ $BRANCH_NAME == 'stage' ]]; then
echo "Staging environment selected"
echo "env-file=infra/aws/environments/env.stage.json" >> $GITHUB_ENV
elif [[ $BRANCH_NAME == 'main' ]]; then
echo "Production environment selected"
echo "env-file=infra/aws/environments/env.prod.json" >> $GITHUB_ENV
else
echo "No matching environment for branch $BRANCH_NAME"
fi
- name: Echo environment file path
run: |
echo "Environment file path: ${{ env.env-file }}"
if [[ -z "${{ env.env-file }}" ]]; then
echo "Environment file path is empty"
else
echo "Environment file path is set"
fi
- name: Set environment variables from file
if: env.env-file != ''
run: |
jq -r 'to_entries | .[] | "\(.key)=\(.value)"' "${{ env.env-file }}" >> $GITHUB_ENV
- name: Upload Template to S3
run: |
aws s3 cp infra/aws/templates/networking-substack.yaml s3://atomiklabs-iac/cloudformation/$ENVIRONMENT_NAME/networking-substack.yaml
aws s3 cp infra/aws/templates/data-layer-substack.yaml s3://atomiklabs-iac/cloudformation/$ENVIRONMENT_NAME/data-layer-substack.yaml
aws s3 cp infra/aws/templates/data-ingestion-substack.yaml s3://atomiklabs-iac/cloudformation/$ENVIRONMENT_NAME/data-ingestion-substack.yaml
aws s3 cp infra/aws/templates/data-persistence-substack.yaml s3://atomiklabs-iac/cloudformation/$ENVIRONMENT_NAME/data-persistence-substack.yaml
- name: Deploy CloudFormation stack
run: |
TEMPLATE_FILE="infra/aws/templates/template.yaml"
STACK_NAME="atomiklabs-${ENVIRONMENT_NAME}-stack"
NETWORKING_SUBSTACK_URL="https://atomiklabs-iac.s3.${{ secrets.AWS_REGION }}.amazonaws.com/cloudformation/${ENVIRONMENT_NAME}/networking-substack.yaml"
DATA_LAYER_SUBSTACK_URL="https://atomiklabs-iac.s3.${{ secrets.AWS_REGION }}.amazonaws.com/cloudformation/${ENVIRONMENT_NAME}/data-layer-substack.yaml"
DATA_INGESTION_SUBSTACK_URL="https://atomiklabs-iac.s3.${{ secrets.AWS_REGION }}.amazonaws.com/cloudformation/${ENVIRONMENT_NAME}/data-ingestion-substack.yaml"
DATA_PERSISTENCE_SUBSTACK_TEMPLATE_URL="https://atomiklabs-iac.s3.${{ secrets.AWS_REGION }}.amazonaws.com/cloudformation/${ENVIRONMENT_NAME}/data-persistence-substack.yaml"
BASTION_ACCESS_CIDR=${{ secrets.BASTION_ACCESS_CIDR }}
echo "Deploying template: $TEMPLATE_FILE"
echo "Networking Substack URL: $NETWORKING_SUBSTACK_URL"
echo "Data Layer Substack URL: $DATA_LAYER_SUBSTACK_URL"
echo "Data Ingestion Substack URL: $DATA_INGESTION_SUBSTACK_URL"
echo "Data Persistence Substack URL: $DATA_PERSISTENCE_SUBSTACK_TEMPLATE_URL"
aws cloudformation deploy \
--template-file $TEMPLATE_FILE \
--stack-name $STACK_NAME \
--region ${{ secrets.AWS_REGION }} \
--capabilities CAPABILITY_NAMED_IAM \
--no-fail-on-empty-changeset \
--parameter-overrides \
NetworkingSubstackTemplateURL=$NETWORKING_SUBSTACK_URL \
DataLayerSubstackTemplateURL=$DATA_LAYER_SUBSTACK_URL \
DataIngestionSubstackTemplateURL=$DATA_INGESTION_SUBSTACK_URL \
DataPersistenceSubstackTemplateURL=$DATA_PERSISTENCE_SUBSTACK_TEMPLATE_URL \
EnvironmentName=$ENVIRONMENT_NAME \
VpcCidr=$VPC_CIDR \
PublicSubnet1Cidr=$PUBLIC_SUBNET_1_CIDR \
PublicSubnet2Cidr=$PUBLIC_SUBNET_2_CIDR \
PrivateSubnet1Cidr=$PRIVATE_SUBNET_1_CIDR \
PrivateSubnet2Cidr=$PRIVATE_SUBNET_2_CIDR \
BastionAccessCidr=$BASTION_ACCESS_CIDR
- name: Capture Events on Failure
if: failure()
run: |
STACK_NAME="atomiklabs-${ENVIRONMENT_NAME}-stack"
echo "Fetching stack events for $STACK_NAME"
aws cloudformation describe-stack-events --stack-name $STACK_NAME
- name: Confirm Stack Creation
run: |
STACK_NAME="atomiklabs-${ENVIRONMENT_NAME}-stack"
aws cloudformation describe-stacks --stack-name $STACK_NAME
echo "Stack $STACK_NAME has been confirmed to exist."