feat: examples for terraform doc #203
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: EKS Cluster with an AuroraDB and OpenSearch creation and destruction test | |
| on: | |
| schedule: | |
| - cron: 0 1 * * 2 # At 01:00 on Tuesday. | |
| workflow_dispatch: | |
| inputs: | |
| cluster_name: | |
| description: Cluster name. | |
| required: false | |
| type: string | |
| create_db: | |
| description: Should the aurora db be created | |
| default: 'true' | |
| create_opensearch: | |
| description: Should the opensearch domain be created | |
| default: 'true' | |
| delete_cluster: | |
| description: Whether to delete the cluster. | |
| default: 'true' | |
| db_username: | |
| description: Database username. | |
| required: false | |
| type: string | |
| db_password: | |
| description: Database password. | |
| required: false | |
| type: string | |
| opensearch_username: | |
| description: OpenSearch username. | |
| required: false | |
| type: string | |
| opensearch_password: | |
| description: OpenSearch password. | |
| required: false | |
| type: string | |
| pull_request: | |
| # the paths should be synced with ../labeler.yml | |
| paths: | |
| - modules/fixtures/backend.tf | |
| - modules/fixtures/fixtures.default.eks.tfvars | |
| - modules/fixtures/fixtures.default.aurora.tfvars | |
| - modules/eks-cluster/**.tf | |
| - modules/aurora/**.tf | |
| - .tool-versions | |
| - .github/workflows/test-gha-eks.yml | |
| - .github/actions/*/*.yml | |
| # limit to a single execution per actor of this workflow | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| AWS_PROFILE: infex | |
| AWS_REGION: eu-west-2 | |
| # /!\ always use one of the available test region https://github.com/camunda/infraex-common-config | |
| # please keep those synced with tests.yml | |
| TF_STATE_BUCKET: tests-eks-tf-state-eu-central-1 | |
| TF_STATE_BUCKET_REGION: eu-central-1 | |
| CREATE_DB: ${{ github.event.inputs.create_db || 'true' }} | |
| CREATE_OPENSEARCH: ${{ github.event.inputs.create_opensearch || 'true' }} | |
| jobs: | |
| action-test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4 | |
| with: | |
| ref: ${{ github.head_ref }} | |
| fetch-depth: 0 | |
| - name: Install tooling using asdf | |
| uses: asdf-vm/actions/install@05e0d2ed97b598bfce82fd30daf324ae0c4570e6 # v3 | |
| - name: Get Cluster Info | |
| id: commit_info | |
| run: | | |
| if [[ -n "${{ inputs.cluster_name }}" ]]; then | |
| cluster_name="${{ inputs.cluster_name }}" | |
| else | |
| cluster_name="cl-$(git rev-parse --short HEAD)-t" | |
| fi | |
| echo "cluster_name=$cluster_name" | tee -a "$GITHUB_OUTPUT" | |
| if [[ -n "${{ inputs.db_username }}" ]]; then | |
| db_username="${{ inputs.db_username }}" | |
| else | |
| db_username="user$(openssl rand -hex 4 | tr -d '/@" ')" | |
| fi | |
| echo "db_username=$db_username" | tee -a "$GITHUB_OUTPUT" | |
| if [[ -n "${{ inputs.db_password }}" ]]; then | |
| db_password="${{ inputs.db_password }}" | |
| else | |
| db_password="$(openssl rand -base64 12 | tr -d '/@" ')" | |
| fi | |
| echo "db_password=$db_password" | tee -a "$GITHUB_OUTPUT" | |
| if [[ -n "${{ inputs.opensearch_username }}" ]]; then | |
| opensearch_username="${{ inputs.opensearch_username }}" | |
| else | |
| opensearch_username="user$(openssl rand -hex 4 | tr -d '/@" ')" | |
| fi | |
| echo "opensearch_username=$opensearch_username" | tee -a "$GITHUB_OUTPUT" | |
| if [[ -n "${{ inputs.opensearch_password }}" ]]; then | |
| opensearch_password="${{ inputs.opensearch_password }}" | |
| else | |
| opensearch_password="$(openssl rand -base64 12 | tr -d '/@" ')" | |
| fi | |
| echo "opensearch_password=$opensearch_password" | tee -a "$GITHUB_OUTPUT" | |
| # Get the current commit hash for the modules revision | |
| tf_modules_revision=$(git rev-parse HEAD) | |
| echo "tf_modules_revision=$tf_modules_revision" | tee -a "$GITHUB_OUTPUT" | |
| - name: Import Secrets | |
| id: secrets | |
| uses: hashicorp/vault-action@d1720f055e0635fd932a1d2a48f87a666a57906c # v3 | |
| with: | |
| url: ${{ secrets.VAULT_ADDR }} | |
| method: approle | |
| roleId: ${{ secrets.VAULT_ROLE_ID }} | |
| secretId: ${{ secrets.VAULT_SECRET_ID }} | |
| exportEnv: false | |
| secrets: | | |
| secret/data/products/infrastructure-experience/ci/common AWS_ACCESS_KEY; | |
| secret/data/products/infrastructure-experience/ci/common AWS_SECRET_KEY; | |
| - name: Add profile credentials to ~/.aws/credentials | |
| run: | | |
| aws configure set aws_access_key_id ${{ steps.secrets.outputs.AWS_ACCESS_KEY }} --profile ${{ env.AWS_PROFILE }} | |
| aws configure set aws_secret_access_key ${{ steps.secrets.outputs.AWS_SECRET_KEY }} --profile ${{ env.AWS_PROFILE }} | |
| aws configure set region ${{ env.AWS_REGION }} --profile ${{ env.AWS_PROFILE }} | |
| - name: Create EKS Cluster | |
| timeout-minutes: 45 | |
| uses: ./.github/actions/eks-manage-cluster | |
| id: create_eks_cluster | |
| with: | |
| cluster-name: ${{ steps.commit_info.outputs.cluster_name }} | |
| aws-region: ${{ env.AWS_REGION }} | |
| additional-terraform-vars: '{"np_capacity_type": "SPOT", "np_instance_types": ["t2.medium"]}' | |
| s3-backend-bucket: ${{ env.TF_STATE_BUCKET }} | |
| s3-bucket-region: ${{ env.TF_STATE_BUCKET_REGION }} | |
| tf-modules-revision: ${{ steps.commit_info.outputs.tf_modules_revision }} | |
| - name: After EKS creation infos | |
| id: after_cluster_creation_infos | |
| run: | | |
| vpc_id=$(echo '${{ steps.create_eks_cluster.outputs.all-terraform-outputs }}' | jq -c -r '.vpc_id.value') | |
| echo "vpc_id=$vpc_id" | tee -a "$GITHUB_OUTPUT" | |
| private_subnet_ids=$(echo '${{ steps.create_eks_cluster.outputs.all-terraform-outputs }}' | jq -c -r '.private_subnet_ids.value') | |
| echo "private_subnet_ids=$private_subnet_ids" | tee -a "$GITHUB_OUTPUT" | |
| private_vpc_cidr_blocks=$(echo '${{ steps.create_eks_cluster.outputs.all-terraform-outputs }}' | jq -c -r '.private_vpc_cidr_blocks.value') | |
| echo "private_vpc_cidr_blocks=$private_vpc_cidr_blocks" | tee -a "$GITHUB_OUTPUT" | |
| availability_zones=$(aws ec2 describe-subnets --filters "Name=vpc-id,Values=${vpc_id}" --query 'Subnets[].AvailabilityZone' --output json | jq 'unique' -c) | |
| echo "availability_zones=$availability_zones" | tee -a "$GITHUB_OUTPUT" | |
| - name: Create Aurora Cluster | |
| timeout-minutes: 20 | |
| uses: ./.github/actions/aurora-manage-cluster | |
| id: create_aurora_cluster | |
| if: env.CREATE_DB == 'true' | |
| with: | |
| cluster-name: ${{ steps.commit_info.outputs.cluster_name }} | |
| username: ${{ steps.commit_info.outputs.db_username }} | |
| password: ${{ steps.commit_info.outputs.db_password }} | |
| aws-region: ${{ env.AWS_REGION }} | |
| s3-backend-bucket: ${{ env.TF_STATE_BUCKET }} | |
| s3-bucket-region: ${{ env.TF_STATE_BUCKET_REGION }} | |
| tf-modules-revision: ${{ steps.commit_info.outputs.tf_modules_revision }} | |
| vpc-id: ${{ steps.after_cluster_creation_infos.outputs.vpc_id }} | |
| subnet-ids: ${{ steps.after_cluster_creation_infos.outputs.private_subnet_ids }} | |
| cidr-blocks: ${{ steps.after_cluster_creation_infos.outputs.private_vpc_cidr_blocks }} | |
| availability-zones: ${{ steps.after_cluster_creation_infos.outputs.availability_zones }} | |
| - name: Deploy OpenSearch Domain | |
| uses: ./.github/actions/opensearch-manage-cluster | |
| id: deploy_opensearch_domain | |
| if: env.CREATE_OPENSEARCH == 'true' | |
| with: | |
| domain-name: ${{ steps.commit_info.outputs.cluster_name }}-opensearch | |
| aws-region: ${{ env.AWS_REGION }} | |
| vpc-id: ${{ steps.after_cluster_creation_infos.outputs.vpc_id }} | |
| subnet-ids: ${{ steps.after_cluster_creation_infos.outputs.private_subnet_ids }} | |
| cidr-blocks: ${{ steps.after_cluster_creation_infos.outputs.private_vpc_cidr_blocks }} | |
| additional-terraform-vars: | | |
| { | |
| "advanced_security_master_user_name": "${{ steps.commit_info.outputs.opensearch_username }}", | |
| "advanced_security_master_user_password": "${{ steps.commit_info.outputs.opensearch_password }}", | |
| "advanced_security_internal_user_database_enabled": true | |
| } | |
| s3-backend-bucket: ${{ env.TF_STATE_BUCKET }} | |
| s3-bucket-region: ${{ env.TF_STATE_BUCKET_REGION }} | |
| tf-modules-revision: ${{ steps.commit_info.outputs.tf_modules_revision }} | |
| - name: Delete Resources | |
| timeout-minutes: 120 | |
| if: always() && !(github.event_name == 'workflow_dispatch' && inputs.delete_cluster == 'false') | |
| uses: ./.github/actions/eks-cleanup-resources | |
| with: | |
| tf-bucket: ${{ env.TF_STATE_BUCKET }} | |
| tf-bucket-region: ${{ env.TF_STATE_BUCKET_REGION }} | |
| max-age-hours: 0 | |
| target: ${{ steps.commit_info.outputs.cluster_name }} | |
| - name: Notify in Slack in case of failure | |
| id: slack-notification | |
| if: failure() && github.event_name == 'schedule' | |
| uses: camunda/infraex-common-config/.github/actions/report-failure-on-slack@1b6af8e7117e4e9bdf777911b7a724879b59fcfe # 1.2.4 | |
| with: | |
| vault_addr: ${{ secrets.VAULT_ADDR }} | |
| vault_role_id: ${{ secrets.VAULT_ROLE_ID }} | |
| vault_secret_id: ${{ secrets.VAULT_SECRET_ID }} |