Add CI/CD workflows for terraform automation #183

DaMandal0rian · 2023-10-03T16:31:10Z

The PR adds terraform automation with github actions CI for devnet, gemini-3(x) and ephemeral devnets.

Closes #184

- add transcrypt script - workflow changes to terraform

- fix permissions - write to /tmp path and not directly in repo for transcrypt - fix backend config path

DaMandal0rian · 2023-10-03T18:29:20Z

The checks will fail since other PRs need to be merged beforehand.

.github/workflows/devnet_main_deploy.yml

.github/workflows/terraform_gh_runner.yml

nazar-pc · 2023-10-06T08:13:14Z

.github/workflows/terraform_gh_runner.yml

+ env:
+ GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


It doesn't seem to be used, why setting?

The env variable needs to be set when calling github api, otherwise an error is thrown.

What and where calls those APIs? I don't see any usage of it.

The GITHUB_TOKEN is needed in CI or bash cli for API calls. The API is called with curl via https://github.com/subspace/infra/pull/183/files/99a5ac25712fdda531fd88026a12f96aafeacb83#diff-b46b68b6df852ad5f8fc96162f55c2fe198f6d53eb2fe7d7ce12fcd4b2650ba6R39-R43

If you want to use the API in a GitHub Actions workflow, GitHub recommends that you authenticate with the built-in GITHUB_TOKEN

What you linked doesn't use GITHUB_TOKEN environment variable, it uses $token that is obtained in a different way.

@nazar-pc removed it, here you go:
https://github.com/subspace/infra/actions/runs/6484473796/job/17608384650#step:5:24

Okay, so it is not for curl, it was for gh CLI command, now it makes sense.

With that knowledge we understand why it is necessary. I think what we should do now in a secure way without using heavy tools like setting repo (I'm fairly certain simply setting environment variable wasn't) without using heavy tools like setting repo's secrets from workflow is to use outputs and mask them such that they are not visible in logs: https://github.com/orgs/community/discussions/25225#discussioncomment-3246942

That is the goal here: to pass the token from one step into another. What we had in earlier versions of this PR are various suboptimal/incorrect ways of achieving that ultimate goal.

correct, github cli, I should have been more clear about that "The GITHUB_TOKEN is needed in CI or bash cli for API calls" but couldn't remember exactly since it was a while ago. That being said the solution of masking the secret and just passing it is nice if using the ephemeral runners maybe but this solution and workflow is for the dedicated runners, where i need to retain the secret so I can unregister and delete runner if need be and remove it from github. See https://docs.github.com/en/free-pro-team@latest/rest/actions/self-hosted-runners?apiVersion=2022-11-28#delete-a-self-hosted-runner-from-an-organization

But you mentioned that tokens only live for 1 hour, so you'll have to retrieve fresh token anyway. Why retaining it then at all?

The token is not needed to deregister, a force delete can be done. So i've used the masking technique.

nazar-pc · 2023-10-06T08:15:30Z

.github/workflows/terraform_gh_runner.yml

+ env:
+ GH_TOKEN: ${{ github.token }}


You're using secrets.GITHUB_TOKEN above and github.token here, which are both the same thing. Would be nice to make it consistent.

But this environment doesn't seem to be used either.

It is used with github api, will make consistent. It is needed for api calls to get the PAT token for github runner registration.

GitHub API again? Which API, I don't see any usage of it.

https://github.com/subspace/infra/pull/183/files/99a5ac25712fdda531fd88026a12f96aafeacb83#diff-b46b68b6df852ad5f8fc96162f55c2fe198f6d53eb2fe7d7ce12fcd4b2650ba6R39-R43

How is linked code related to GH_TOKEN?

Ok, for $token in the auth header of the curl request that is the pat token to authenticate to the repo and get the runner token. If i remove GH_TOKEN you will see an error in ci that you need to have GH_TOKEN to call github apis from workflow :). I wasn't using it before, but added it to fix the problem. Here is an old version:
https://github.com/subspace/infra/blob/bd296590f29cdd730ab29869c7ade1258cb395ae/.github/workflows/terraform_gh_runner.yml

.github/workflows/terraform_gh_runner.yml

- make tokens consistent and adjust some paths. - add comments - remove extra env variable set

nazar-pc

CI failed with Error: Invalid command-line option, which I think means something needs to be fixed.

nazar-pc · 2023-10-11T12:48:08Z

.github/workflows/terraform_gh_runner.yml

+ env:
+ GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


What you linked doesn't use GITHUB_TOKEN environment variable, it uses $token that is obtained in a different way.

nazar-pc · 2023-10-11T12:49:19Z

.github/workflows/terraform_gh_runner.yml

+ env:
+ GH_TOKEN: ${{ github.token }}


How is linked code related to GH_TOKEN?

.github/workflows/terraform_gh_runner.yml

- this is not needed with terraform cloud - test (remove GH_TOKEN)

vedhavyas · 2023-12-04T17:31:43Z

@DaMandal0rian is this ready to be reviewed? Looks like GH actions are still failing

- remove tfvars secret and storing in github, use the encrypted terraform.tfvars file with transcrypt. - add branch as input - change API token name and remove vars secret file - change path for dedicated runners

DaMandal0rian · 2023-12-05T12:08:55Z

@DaMandal0rian is this ready to be reviewed? Looks like GH actions are still failing

@vedhavyas yes the PR is ready. The reason is the tfvars file does not exist in the path, but i will upload the encrypted version in another PR for the resources. I've also made some changes.

- add genesis hash input - add terraform apply and destroy inputs

DaMandal0rian · 2024-01-02T11:11:53Z

tfvars file is added in PR https://github.com/subspace/infra/pull/226/files

vedhavyas

I maybe be missing something here but looks like we can only run one ephemeral devnet at a time since TF uses the same working directory. This would also be a problem if multiple people want to deploy at the same time.

If its aws, can we deploy new instances instead ?
As for the hetzner, we should not allow new deployments unless the workspace is already destroyed so that machine can be re-used.

Though I'm not sure if this is out of scope for this PR.

DaMandal0rian · 2024-01-02T14:52:55Z

@vedhavyas For hetzner can run the destroy input with workflow dispatch event. Also, please check the readme file which addresses this. This is outside the scope of this PR which deals with CI/CD. In another PR i can add a random generator to the backend (AWS) for terraform changes, but would rather dev's modify the backend and open a PR as instructions state in readme.

jfrank-summit · 2024-05-21T13:19:59Z

@DaMandal0rian it has been awhile since this PR has progressed? Are there any updates?

Add CI/CD workflows for terraform automation

55c06e4

- add transcrypt script - workflow changes to terraform

DaMandal0rian force-pushed the terraform-ci-workflows branch 2 times, most recently from 67239db to 24b2e7a Compare October 3, 2023 18:17

DaMandal0rian marked this pull request as ready for review October 3, 2023 18:24

Permission fixes and paths

99a5ac2

- fix permissions - write to /tmp path and not directly in repo for transcrypt - fix backend config path

DaMandal0rian force-pushed the terraform-ci-workflows branch from 24b2e7a to 99a5ac2 Compare October 3, 2023 18:25

DaMandal0rian requested review from nazar-pc and jfrank-summit October 3, 2023 18:29

DaMandal0rian mentioned this pull request Oct 3, 2023

Github CI pipelines for automation of networks with terraform #184

Closed

nazar-pc requested a review from vedhavyas October 3, 2023 18:39

nazar-pc reviewed Oct 6, 2023

View reviewed changes

DaMandal0rian requested a review from nazar-pc October 6, 2023 13:51

minor fixes

4a6c180

- make tokens consistent and adjust some paths. - add comments - remove extra env variable set

DaMandal0rian force-pushed the terraform-ci-workflows branch from 460596b to 4a6c180 Compare October 6, 2023 14:22

just use secret for token and not env

546685a

nazar-pc reviewed Oct 11, 2023

View reviewed changes

DaMandal0rian requested a review from nazar-pc October 11, 2023 14:04

Remove terrform init backend config

2d35eef

- this is not needed with terraform cloud - test (remove GH_TOKEN)

DaMandal0rian force-pushed the terraform-ci-workflows branch from e7c5456 to 2d35eef Compare October 11, 2023 15:06

add token masking

2fe0c94

remove tfvars secret and add branch input

d865c7c

- remove tfvars secret and storing in github, use the encrypted terraform.tfvars file with transcrypt. - add branch as input - change API token name and remove vars secret file - change path for dedicated runners

DaMandal0rian force-pushed the terraform-ci-workflows branch from 935a2a2 to d865c7c Compare December 5, 2023 12:06

DaMandal0rian added 2 commits December 5, 2023 16:06

update to gemini-3g

174064d

add more inputs

6ea4586

- add genesis hash input - add terraform apply and destroy inputs

vedhavyas reviewed Jan 2, 2024

View reviewed changes

DaMandal0rian requested a review from vedhavyas January 2, 2024 15:09

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add CI/CD workflows for terraform automation #183

Add CI/CD workflows for terraform automation #183

DaMandal0rian commented Oct 3, 2023 •

edited

Loading

DaMandal0rian commented Oct 3, 2023

nazar-pc Oct 6, 2023

DaMandal0rian Oct 6, 2023

nazar-pc Oct 10, 2023

DaMandal0rian Oct 11, 2023 •

edited

Loading

nazar-pc Oct 11, 2023

DaMandal0rian Oct 11, 2023 •

edited

Loading

nazar-pc Oct 11, 2023 •

edited

Loading

DaMandal0rian Oct 12, 2023

nazar-pc Oct 12, 2023

DaMandal0rian Nov 28, 2023

nazar-pc Oct 6, 2023

DaMandal0rian Oct 6, 2023 •

edited

Loading

nazar-pc Oct 10, 2023

DaMandal0rian Oct 11, 2023

nazar-pc Oct 11, 2023

DaMandal0rian Oct 11, 2023

nazar-pc left a comment

nazar-pc Oct 11, 2023

nazar-pc Oct 11, 2023

vedhavyas commented Dec 4, 2023

DaMandal0rian commented Dec 5, 2023 •

edited

Loading

DaMandal0rian commented Jan 2, 2024

vedhavyas left a comment

DaMandal0rian commented Jan 2, 2024 •

edited

Loading

jfrank-summit commented May 21, 2024

Add CI/CD workflows for terraform automation #183

Are you sure you want to change the base?

Add CI/CD workflows for terraform automation #183

Conversation

DaMandal0rian commented Oct 3, 2023 • edited Loading

DaMandal0rian commented Oct 3, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

DaMandal0rian Oct 11, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

DaMandal0rian Oct 11, 2023 • edited Loading

Choose a reason for hiding this comment

nazar-pc Oct 11, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

DaMandal0rian Oct 6, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nazar-pc left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

vedhavyas commented Dec 4, 2023

DaMandal0rian commented Dec 5, 2023 • edited Loading

DaMandal0rian commented Jan 2, 2024

vedhavyas left a comment

Choose a reason for hiding this comment

DaMandal0rian commented Jan 2, 2024 • edited Loading

jfrank-summit commented May 21, 2024

DaMandal0rian commented Oct 3, 2023 •

edited

Loading

DaMandal0rian Oct 11, 2023 •

edited

Loading

DaMandal0rian Oct 11, 2023 •

edited

Loading

nazar-pc Oct 11, 2023 •

edited

Loading

DaMandal0rian Oct 6, 2023 •

edited

Loading

DaMandal0rian commented Dec 5, 2023 •

edited

Loading

DaMandal0rian commented Jan 2, 2024 •

edited

Loading