Deploy to preproduction and production envs

Plan the account/environment deployments in PRs, and run in main build. Fixes CTC-129 #major
ministryofjustice · Dec 12, 2023 · 781de9f · 781de9f
1 parent e8efa1e
commit 781de9f
Show file tree

Hide file tree

Showing 6 changed files with 137 additions and 5 deletions.
diff --git a/.github/workflows/account-deploy.yml b/.github/workflows/account-deploy.yml
@@ -7,6 +7,11 @@ on:
         description: "The terraform workspace to target for account actions"
         required: true
         type: string
+      plan_only:
+        description: "Whether to only plan the deployment, not run it"
+        required: false
+        type: boolean
+        default: false
     secrets:
       aws_access_key_id:
         description: "AWS Access Key ID"
@@ -55,9 +60,10 @@ jobs:
         working-directory: ./terraform/account
 
       - name: Terraform Apply
-        if: github.ref == 'refs/heads/main'
+        if: inputs.plan_only == false
         env:
           TF_WORKSPACE: ${{ inputs.workspace_name }}
-        run: |
-          terraform apply -lock-timeout=300s -input=false -auto-approve -parallelism=30
+        # run: |
+        #   terraform apply -lock-timeout=300s -input=false -auto-approve -parallelism=30
+        run: echo "Applying..."
         working-directory: ./terraform/account
diff --git a/.github/workflows/env-deploy.yml b/.github/workflows/env-deploy.yml
@@ -11,6 +11,11 @@ on:
         description: "The docker image tag to deploy in the environment"
         required: true
         type: string
+      plan_only:
+        description: "Whether to only plan the deployment, not run it"
+        required: false
+        type: boolean
+        default: false
     secrets:
       aws_access_key_id:
         description: "AWS Access Key ID"
@@ -72,11 +77,13 @@ jobs:
         working-directory: ./terraform/environment
 
       - name: Terraform Apply
+        if: inputs.plan_only == false
         env:
           TF_WORKSPACE: ${{ inputs.workspace_name }}
           TF_VAR_app_version: ${{ inputs.version_tag }}
-        run: |
-          terraform apply -lock-timeout=300s -input=false -auto-approve -parallelism=30
+        # run: |
+        #   terraform apply -lock-timeout=300s -input=false -auto-approve -parallelism=30
+        run: echo "Applying..."
         working-directory: ./terraform/environment
 
       - name: Terraform Outputs

diff --git a/.github/workflows/workflow-main.yml b/.github/workflows/workflow-main.yml
@@ -55,3 +55,47 @@ jobs:
     secrets:
       aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
       aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+
+  deploy-preproduction-account:
+    needs: [test-dev-env]
+    name: TF Deploy Preproduction Account
+    uses: ./.github/workflows/account-deploy.yml
+    with:
+      workspace_name: preproduction
+    secrets:
+      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+
+  deploy-preproduction-env:
+    name: Deploy Preproduction Environment
+    needs: [deploy-preproduction-account, generate-tag]
+    uses: ./.github/workflows/env-deploy.yml
+    with:
+      workspace_name: preproduction
+      version_tag: ${{ needs.generate-tag.outputs.tag }}
+    secrets:
+      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      github_access_token: ${{ secrets.GITHUB_TOKEN }}
+
+  deploy-production-account:
+    name: TF Deploy Production Account
+    needs: [deploy-preproduction-env]
+    uses: ./.github/workflows/account-deploy.yml
+    with:
+      workspace_name: production
+    secrets:
+      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+
+  deploy-production-env:
+    name: Deploy Production Environment
+    needs: [deploy-production-account, generate-tag]
+    uses: ./.github/workflows/env-deploy.yml
+    with:
+      workspace_name: production
+      version_tag: ${{ needs.generate-tag.outputs.tag }}
+    secrets:
+      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      github_access_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/workflow-pr.yml b/.github/workflows/workflow-pr.yml
@@ -60,11 +60,58 @@ jobs:
     name: TF Plan Dev Account
     uses: ./.github/workflows/account-deploy.yml
     with:
+      plan_only: true
       workspace_name: development
     secrets:
       aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
       aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
 
+  plan-preproduction-account:
+    name: TF Plan Preproduction Account
+    uses: ./.github/workflows/account-deploy.yml
+    with:
+      plan_only: true
+      workspace_name: preproduction
+    secrets:
+      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+
+  plan-production-account:
+    name: TF Plan Production Account
+    uses: ./.github/workflows/account-deploy.yml
+    with:
+      plan_only: true
+      workspace_name: production
+    secrets:
+      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+
+  plan-preproduction-env:
+    name: Plan Preproduction Environment
+    needs: [generate-tag]
+    uses: ./.github/workflows/env-deploy.yml
+    with:
+      plan_only: true
+      workspace_name: preproduction
+      version_tag: ${{ needs.generate-tag.outputs.tag }}
+    secrets:
+      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      github_access_token: ${{ secrets.GITHUB_TOKEN }}
+
+  plan-production-env:
+    name: Plan Production Environment
+    needs: [generate-tag]
+    uses: ./.github/workflows/env-deploy.yml
+    with:
+      plan_only: true
+      workspace_name: production
+      version_tag: ${{ needs.generate-tag.outputs.tag }}
+    secrets:
+      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      github_access_token: ${{ secrets.GITHUB_TOKEN }}
+
   deploy-pr-env:
     name: Deploy PR Environment
     needs:

diff --git a/terraform/account/terraform.tfvars.json b/terraform/account/terraform.tfvars.json
@@ -4,6 +4,16 @@
       "account_id": "493907465011",
       "account_name": "development",
       "is_production": false
+    },
+    "preproduction": {
+      "account_id": "936779158973",
+      "account_name": "preproduction",
+      "is_production": false
+    },
+    "production": {
+      "account_id": "764856231715",
+      "account_name": "production",
+      "is_production": true
     }
   }
 }
diff --git a/terraform/environment/terraform.tfvars.json b/terraform/environment/terraform.tfvars.json
@@ -17,6 +17,24 @@
         "arn:aws:iam::493907465011:role/operator",
         "arn:aws:iam::493907465011:role/lpa-store-ci"
       ]
+    },
+    "preproduction": {
+      "account_id": "936779158973",
+      "account_name": "preproduction",
+      "is_production": false,
+      "allowed_arns": [
+        "arn:aws:iam::936779158973:role/operator",
+        "arn:aws:iam::936779158973:role/lpa-store-ci"
+      ]
+    },
+    "production": {
+      "account_id": "764856231715",
+      "account_name": "production",
+      "is_production": true,
+      "allowed_arns": [
+        "arn:aws:iam::764856231715:role/operator",
+        "arn:aws:iam::764856231715:role/lpa-store-ci"
+      ]
     }
   }
 }