Backup and restore Postgres DB from PAAS to AKS #15
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Backup and restore Postgres DB from PAAS to AKS | |
| on: | |
| workflow_call: | |
| inputs: | |
| environment: | |
| type: string | |
| workflow_dispatch: | |
| inputs: | |
| environment: | |
| type: choice | |
| options: | |
| - test | |
| - preprod | |
| - production | |
| env: | |
| BACKUP_ARTIFACT_NAME: ${{ inputs.environment }}-backup | |
| jobs: | |
| backup: | |
| name: Backup from PAAS | |
| runs-on: ubuntu-latest | |
| environment: ${{ inputs.environment }} | |
| outputs: | |
| ENVIRONMENT_AKS: ${{ steps.set_aks_env_name.outputs.ENVIRONMENT_AKS }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: Azure/login@v1 | |
| with: | |
| creds: ${{ secrets.AZURE_CREDENTIALS }} | |
| - uses: DFE-Digital/github-actions/install-postgres-client@master | |
| - name: Set environment variables | |
| shell: bash | |
| run: | | |
| tf_vars_file=terraform/paas/workspace_variables/${{ inputs.environment }}.tfvars.json | |
| echo "KEY_VAULT_NAME=$(jq -r '.key_vault_name' ${tf_vars_file})" >> $GITHUB_ENV | |
| echo "PAAS_SPACE=$(jq -r '.paas_space' ${tf_vars_file})" >> $GITHUB_ENV | |
| - name: Retrieve Cloudfoundry credentials from KV | |
| uses: azure/CLI@v1 | |
| id: fetch-cf-creds | |
| with: | |
| inlineScript: | | |
| SECRET_VALUE=$(az keyvault secret show --name "PAAS-USER" --vault-name "${{ env.KEY_VAULT_NAME}}" --query "value" -o tsv) | |
| echo "::add-mask::$SECRET_VALUE" | |
| echo "PAAS-USER=$SECRET_VALUE" >> $GITHUB_OUTPUT | |
| SECRET_VALUE=$(az keyvault secret show --name "PAAS-PASSWORD" --vault-name "${{ env.KEY_VAULT_NAME}}" --query "value" -o tsv) | |
| echo "::add-mask::$SECRET_VALUE" | |
| echo "PAAS-PASSWORD=$SECRET_VALUE" >> $GITHUB_OUTPUT | |
| - uses: DFE-Digital/github-actions/setup-cf-cli@master | |
| with: | |
| CF_USERNAME: ${{ steps.fetch-cf-creds.outputs.PAAS-USER }} | |
| CF_PASSWORD: ${{ steps.fetch-cf-creds.outputs.PAAS-PASSWORD }} | |
| CF_SPACE_NAME: ${{ env.PAAS_SPACE }} | |
| INSTALL_CONDUIT: true | |
| - name: Backup database | |
| run: | | |
| cf conduit find-a-lost-trn-${{ inputs.environment }}-pg-svc -- pg_dump -E utf8 --clean --compress=1 --if-exists --no-owner --no-privileges --verbose -f backup.sql.gz | |
| - name: Upload backup | |
| uses: actions/upload-artifact@v3 | |
| with: | |
| name: ${{ env.BACKUP_ARTIFACT_NAME }} | |
| path: backup.sql.gz | |
| retention-days: 1 | |
| - name: Set AKS environment name | |
| id: set_aks_env_name | |
| run: | | |
| case "${{ inputs.environment }}" in | |
| test) | |
| echo "ENVIRONMENT_AKS=test_aks" >> $GITHUB_OUTPUT | |
| ;; | |
| preprod) | |
| echo "ENVIRONMENT_AKS=preproduction_aks" >> $GITHUB_OUTPUT | |
| ;; | |
| production) | |
| echo "ENVIRONMENT_AKS=production_aks" >> $GITHUB_OUTPUT | |
| ;; | |
| *) | |
| echo "unknown cluster" | |
| ;; | |
| esac | |
| restore: | |
| name: Restore to AKS | |
| runs-on: ubuntu-latest | |
| needs: backup | |
| environment: ${{ needs.backup.outputs.ENVIRONMENT_AKS }} | |
| env: | |
| ENVIRONMENT_NAME: ${{ needs.backup.outputs.ENVIRONMENT_AKS }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: Azure/login@v1 | |
| with: | |
| creds: ${{ secrets.AZURE_CREDENTIALS }} | |
| - name: Set environment variables | |
| shell: bash | |
| run: | | |
| tf_vars_file=terraform/aks/workspace_variables/${{ env.ENVIRONMENT_NAME }}.tfvars.json | |
| - run: | | |
| test_cluster_rg=s189t01-tsc-ts-rg | |
| test_cluster_name=s189t01-tsc-test-aks | |
| production_cluster_rg=s189p01-tsc-pd-rg | |
| production_cluster_name=s189p01-tsc-production-aks | |
| case "${ENVIRONMENT_NAME}" in | |
| test_aks) | |
| echo "cluster_rg=$test_cluster_rg" >> $GITHUB_ENV | |
| echo "cluster_name=$test_cluster_name" >> $GITHUB_ENV | |
| echo "app_name=find-a-lost-trn-test" >> $GITHUB_ENV | |
| ;; | |
| preproduction_aks) | |
| echo "cluster_rg=$test_cluster_rg" >> $GITHUB_ENV | |
| echo "cluster_name=$test_cluster_name" >> $GITHUB_ENV | |
| echo "app_name=find-a-lost-trn-preproduction" >> $GITHUB_ENV | |
| ;; | |
| production_aks) | |
| echo "cluster_rg=$production_cluster_rg" >> $GITHUB_ENV | |
| echo "cluster_name=$production_cluster_name" >> $GITHUB_ENV | |
| echo "app_name=find-a-lost-trn-production" >> $GITHUB_ENV | |
| ;; | |
| *) | |
| echo "unknown cluster" | |
| ;; | |
| esac | |
| - uses: azure/setup-kubectl@v3 | |
| - run: | | |
| az aks get-credentials -g ${{ env.cluster_rg }} -n ${{ env.cluster_name }} | |
| make bin/konduit.sh | |
| - name: Download backup | |
| uses: actions/download-artifact@v3 | |
| with: | |
| name: ${{ env.BACKUP_ARTIFACT_NAME }} | |
| - name: Restore database | |
| run: bin/konduit.sh -i backup.sql.gz -c ${{ env.app_name }} -- psql | |
| - name: Remove PaaS event triggers | |
| shell: bash | |
| run: | | |
| bin/konduit.sh ${{ env.app_name }} -- psql -c 'drop event trigger forbid_ddl_reader; drop event trigger make_readable; drop event trigger reassign_owned;' | |
| - uses: geekyeggo/delete-artifact@v2 | |
| with: | |
| name: ${{ env.BACKUP_ARTIFACT_NAME }} |