Terraform Plan and Apply #52
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Terraform Plan and Apply | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| environment: | |
| description: 'The target environment for deployment' | |
| required: true | |
| default: 'Sandbox' | |
| type: choice | |
| options: | |
| - Sandbox | |
| - Production | |
| apply: | |
| description: 'Apply the Terraform plan after creation' | |
| required: false | |
| default: false | |
| type: boolean | |
| jobs: | |
| terraform: | |
| # dev is used for Sandbox deployments, main is used for Production deployments | |
| if: github.ref_name == 'dev' && github.event.inputs.environment == 'Sandbox' || github.ref_name == 'main' && github.event.inputs.environment == 'Production' | |
| permissions: | |
| contents: read | |
| id-token: write | |
| environment: ${{ inputs.environment }} | |
| runs-on: ubuntu-latest | |
| # workaround for "context access might be invalid warning" | |
| env: | |
| IMAGE_REPO: ghcr.io/bcgov/otp-provider | |
| IMAGE_TAG: dev | |
| TF_STATE_BUCKET_NAME: | |
| TF_STATE_BUCKET_KEY: | |
| TF_STATE_BUCKET_REGION: | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - uses: hashicorp/setup-terraform@v4 | |
| with: | |
| terraform_version: 1.11.0 | |
| - name: Get latest tag | |
| id: tag | |
| run: | | |
| if [ "${{ github.event.inputs.environment }}" == "Production" ]; then | |
| echo "IMAGE_TAG=$(git describe --tags --abbrev=0)" >> $GITHUB_ENV | |
| else | |
| echo "IMAGE_TAG=dev" >> $GITHUB_ENV | |
| fi | |
| - name: Set global environment variables | |
| run: | | |
| cat >> $GITHUB_ENV <<EOF | |
| TF_VAR_otp_cwlogs_group=/aws/ecs/fargate/otp-provider | |
| TF_STATE_BUCKET_KEY=otp-provider.tfstate | |
| TF_STATE_BUCKET_REGION=ca-central-1 | |
| TF_VAR_otp_image_repo=${{ env.IMAGE_REPO }} | |
| TF_VAR_ches_api_url=https://ches.api.gov.bc.ca/api/v1/email | |
| TF_VAR_ches_token_url=https://loginproxy.gov.bc.ca/auth/realms/comsvcauth/protocol/openid-connect/token | |
| TF_VAR_email_provider=ches | |
| EOF | |
| - name: Set sandbox environment variables | |
| if: github.event.inputs.environment == 'Sandbox' | |
| run: | | |
| cat >> $GITHUB_ENV <<EOF | |
| TF_STATE_BUCKET_NAME=otp-provider-tf-sandbox | |
| TF_VAR_otp_image_tag=${{ env.IMAGE_TAG }} | |
| TF_VAR_subnet_a=Dev-App-A | |
| TF_VAR_subnet_b=Dev-App-B | |
| TF_VAR_dev_app_url=https://dev.sandbox.otp.loginproxy.gov.bc.ca | |
| TF_VAR_mail_from=bcgov.sso@gov.bc.ca | |
| TF_VAR_dev_custom_domain_name=dev.sandbox.otp.loginproxy.gov.bc.ca | |
| TF_VAR_dev_cors_origins=https://dev.sandbox.loginproxy.gov.bc.ca | |
| TF_VAR_dev_task_cpu=256 | |
| TF_VAR_dev_task_memory=512 | |
| TF_VAR_dev_task_container_cpu=256 | |
| TF_VAR_dev_task_container_memory=512 | |
| TF_VAR_dev_task_container_port=3000 | |
| TF_VAR_dev_rds_min_capacity=0 | |
| TF_VAR_dev_rds_max_capacity=2 | |
| TF_VAR_dev_rds_scale_down_time=3600 | |
| TF_VAR_test_app_url=https://test.sandbox.otp.loginproxy.gov.bc.ca | |
| TF_VAR_test_custom_domain_name=test.sandbox.otp.loginproxy.gov.bc.ca | |
| TF_VAR_test_cors_origins=https://test.sandbox.loginproxy.gov.bc.ca | |
| TF_VAR_test_task_cpu=256 | |
| TF_VAR_test_task_memory=512 | |
| TF_VAR_test_task_container_cpu=256 | |
| TF_VAR_test_task_container_memory=512 | |
| TF_VAR_test_task_container_port=3000 | |
| TF_VAR_test_rds_min_capacity=0 | |
| TF_VAR_test_rds_max_capacity=2 | |
| TF_VAR_test_rds_scale_down_time=3600 | |
| TF_VAR_prod_app_url=https://sandbox.otp.loginproxy.gov.bc.ca | |
| TF_VAR_prod_custom_domain_name=sandbox.otp.loginproxy.gov.bc.ca | |
| TF_VAR_prod_cors_origins=https://sandbox.loginproxy.gov.bc.ca | |
| TF_VAR_prod_task_cpu=256 | |
| TF_VAR_prod_task_memory=512 | |
| TF_VAR_prod_task_container_cpu=256 | |
| TF_VAR_prod_task_container_memory=512 | |
| TF_VAR_prod_task_container_port=3000 | |
| TF_VAR_prod_rds_min_capacity=0 | |
| TF_VAR_prod_rds_max_capacity=2 | |
| TF_VAR_prod_rds_scale_down_time=3600 | |
| TF_VAR_enable_grafana=true | |
| TF_VAR_grafana_kc_url=${{ vars.GRAFANA_OAUTH_BASE_URL }} | |
| TF_VAR_grafana_kc_client_id=${{ secrets.GRAFANA_OAUTH_CLIENT_ID }} | |
| TF_VAR_grafana_kc_client_secret=${{ secrets.GRAFANA_OAUTH_CLIENT_SECRET }} | |
| TF_VAR_dev_desired_tasks=1 | |
| TF_VAR_dev_enable_autoscale=true | |
| TF_VAR_test_desired_tasks=1 | |
| TF_VAR_test_enable_autoscale=false | |
| TF_VAR_prod_desired_tasks=1 | |
| TF_VAR_prod_enable_autoscale=false | |
| TF_VAR_cpu_target_use=15 | |
| TF_VAR_autoscale_max_capacity=2 | |
| TF_VAR_autoscale_min_capacity=1 | |
| EOF | |
| - name: Set production environment variables | |
| if: github.event.inputs.environment == 'Production' | |
| run: | | |
| cat >> $GITHUB_ENV <<EOF | |
| TF_STATE_BUCKET_NAME=otp-provider-tf-production | |
| TF_VAR_otp_image_tag=${{ env.IMAGE_TAG }} | |
| TF_VAR_subnet_a=Prod-App-A | |
| TF_VAR_subnet_b=Prod-App-B | |
| TF_VAR_dev_app_url=https://dev.otp.loginproxy.gov.bc.ca | |
| TF_VAR_mail_from=do-not-reply@otp.gov.bc.ca | |
| TF_VAR_dev_custom_domain_name=dev.otp.loginproxy.gov.bc.ca | |
| TF_VAR_dev_cors_origins=https://dev.loginproxy.gov.bc.ca | |
| TF_VAR_dev_task_cpu=256 | |
| TF_VAR_dev_task_memory=512 | |
| TF_VAR_dev_task_container_cpu=256 | |
| TF_VAR_dev_task_container_memory=512 | |
| TF_VAR_dev_task_container_port=3000 | |
| TF_VAR_dev_rds_min_capacity=0.5 | |
| TF_VAR_dev_rds_max_capacity=2 | |
| TF_VAR_dev_rds_scale_down_time=36000 | |
| TF_VAR_test_app_url=https://test.otp.loginproxy.gov.bc.ca | |
| TF_VAR_test_custom_domain_name=test.otp.loginproxy.gov.bc.ca | |
| TF_VAR_test_cors_origins=https://test.loginproxy.gov.bc.ca | |
| TF_VAR_test_task_cpu=256 | |
| TF_VAR_test_task_memory=512 | |
| TF_VAR_test_task_container_cpu=256 | |
| TF_VAR_test_task_container_memory=512 | |
| TF_VAR_test_task_container_port=3000 | |
| TF_VAR_test_rds_min_capacity=0.5 | |
| TF_VAR_test_rds_max_capacity=2 | |
| TF_VAR_test_rds_scale_down_time=36000 | |
| TF_VAR_prod_app_url=https://otp.loginproxy.gov.bc.ca | |
| TF_VAR_prod_custom_domain_name=otp.loginproxy.gov.bc.ca | |
| TF_VAR_prod_cors_origins=https://loginproxy.gov.bc.ca | |
| TF_VAR_prod_task_cpu=512 | |
| TF_VAR_prod_task_memory=1024 | |
| TF_VAR_prod_task_container_cpu=512 | |
| TF_VAR_prod_task_container_memory=1024 | |
| TF_VAR_prod_task_container_port=3000 | |
| TF_VAR_prod_rds_min_capacity=0.5 | |
| TF_VAR_prod_rds_max_capacity=2 | |
| TF_VAR_prod_rds_scale_down_time=36000 | |
| TF_VAR_enable_grafana=true | |
| TF_VAR_grafana_kc_url=${{ vars.GRAFANA_OAUTH_BASE_URL }} | |
| TF_VAR_grafana_kc_client_id=${{ secrets.GRAFANA_OAUTH_CLIENT_ID }} | |
| TF_VAR_grafana_kc_client_secret=${{ secrets.GRAFANA_OAUTH_CLIENT_SECRET }} | |
| TF_VAR_dev_desired_tasks=1 | |
| TF_VAR_dev_enable_autoscale=false | |
| TF_VAR_test_desired_tasks=1 | |
| TF_VAR_test_enable_autoscale=false | |
| TF_VAR_prod_desired_tasks=2 | |
| TF_VAR_prod_enable_autoscale=true | |
| TF_VAR_prod_enable_alb_alarm = true | |
| TF_VAR_prod_enable_alerts = true | |
| TF_VAR_prod_alert_webhook_url = ${{ secrets.alert_webhook_url }} | |
| TF_VAR_cpu_target_use=15 | |
| TF_VAR_autoscale_max_capacity=4 | |
| TF_VAR_autoscale_min_capacity=2 | |
| EOF | |
| - name: Configure AWS credentials | |
| uses: aws-actions/configure-aws-credentials@v6 | |
| with: | |
| role-to-assume: ${{ secrets.SSO_AWS_GH_ACTIONS_DEPLOYER }} | |
| aws-region: ca-central-1 | |
| - name: Terraform Variables | |
| run: | | |
| cat >"config.tf" <<EOF | |
| terraform { | |
| backend "s3" { | |
| bucket = "${{ env.TF_STATE_BUCKET_NAME }}" | |
| key = "${{ env.TF_STATE_BUCKET_KEY }}" | |
| region = "${{ env.TF_STATE_BUCKET_REGION }}" | |
| use_lockfile = true | |
| } | |
| } | |
| EOF | |
| working-directory: ./terraform | |
| - name: Terraform Init | |
| id: init | |
| run: terraform init -upgrade | |
| working-directory: ./terraform | |
| - name: Terraform Plan | |
| id: plan | |
| run: terraform plan -no-color | |
| working-directory: ./terraform | |
| continue-on-error: true | |
| - name: Terraform Plan Status | |
| if: steps.plan.outcome == 'failure' | |
| run: exit 1 | |
| - name: Terraform Apply | |
| if: ${{ github.event.inputs.apply == 'true' }} | |
| run: terraform apply -auto-approve | |
| working-directory: ./terraform |