Skip to content

Commit 17f472a

Browse files
coreycarvalhocoreycarvalho
committed
Add task definition with GHA
1 parent 99ca34a commit 17f472a

File tree

4 files changed

+312
-0
lines changed

4 files changed

+312
-0
lines changed

‎.github/actions/ecs-task-render-deploy/action.yml

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
name: "ECS Task Render & Deploy"
2+
description: "Renders an ECS task definition from a template (with secret substitutions) and deploys it to ECS."
3+
inputs:
4+
task-definition-path:
5+
description: "Path to the ECS Task Definition template file (e.g. task-definition.template.json)"
6+
required: true
7+
default: "task-definition.json"
8+
container-name:
9+
description: "The container name to update"
10+
required: true
11+
image:
12+
description: "The container image to substitute in the task definition"
13+
required: true
14+
aws-access-key-id:
15+
description: 'AWS Access Key ID'
16+
required: true
17+
aws-secret-access-key:
18+
description: 'AWS Secret Access Key'
19+
required: true
20+
role-to-assume:
21+
description: 'AWS role to assume'
22+
required: true
23+
24+
runs:
25+
using: "composite"
26+
steps:
27+
- name: Checkout Repository
28+
uses: actions/checkout@v3
29+
30+
- name: Pre-render Task Definition
31+
id: pre_render
32+
shell: bash
33+
run: |
34+
echo "Rendering template with envsubst..."
35+
# Substitute environment variables in the task definition file
36+
envsubst < "${{ inputs.task-definition-path }}" > task-definition.json
37+
38+
- name: Configure VAEC AWS Credentials
39+
uses: aws-actions/configure-aws-credentials@v4
40+
with:
41+
aws-access-key-id: ${{ inputs.aws-access-key-id }}
42+
aws-secret-access-key: ${{ inputs.aws-secret-access-key }}
43+
aws-region: us-gov-west-1
44+
role-to-assume: ${{ inputs.role-to-assume }}
45+
role-skip-session-tagging: true
46+
role-duration-seconds: 900
47+
48+
- name: Upload Env File to S3
49+
shell: bash
50+
run: |
51+
aws s3 cp task-definition.json s3://vanotify-environment-variables-dev/va-enp-api/
52+
53+
- name: Render Task Definition
54+
id: render
55+
uses: aws-actions/amazon-ecs-render-task-definition@v1
56+
with:
57+
task-definition: ./task-definition.json
58+
container-name: ${{ inputs.container-name }}
59+
image: ${{ inputs.image }}

‎.github/workflows/deploy.yml

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: Deploy to ENV
2+
## Right now, this workflow is being used to test the rendering of task definitions. This will be extended to be
3+
## the workflow used that deploys to any arbitrary environment as part of https://github.com/department-of-veterans-affairs/va-enp-api/issues/76#issue-2669422105
4+
5+
on:
6+
push:
7+
branches:
8+
- "75-task-definitions"
9+
10+
jobs:
11+
deploy:
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- uses: actions/checkout@v4
16+
17+
- name: Renders Task Definition for DEV
18+
uses: ./.github/actions/ecs-task-render-deploy
19+
with:
20+
task-definition-path: "./cd/va-enp-api-task-definition.json"
21+
container-name: "dev-va-enp-api"
22+
image: nginx:latest
23+
aws-access-key-id: ${{ secrets.VAEC_AWS_ACCESS_KEY_ID }}
24+
aws-secret-access-key: ${{ secrets.VAEC_AWS_SECRET_ACCESS_KEY }}
25+
aws-region: ${{ secrets.AWS_REGION }}
26+
role-to-assume: ${{ secrets.VAEC_DEPLOY_ROLE }}
27+
env:
28+
AWS_ARN_REGION: ${{ secrets.AWS_ARN_REGION }}
29+
AWS_ACCOUNT_NUMBER: ${{ secrets.AWS_ACCOUNT_NUMBER }}
30+
AWS_REGION: ${{ secrets.AWS_REGION }}
31+
TASK_DEFINITION_SECRETS_JSON: ${{ secrets.DEV_TASK_DEFINITION_SECRETS_JSON }}
32+
DD_API_KEY: ${{ secrets.DD_API_KEY }}
33+
ENV: "dev"

‎cd/dev.env

+55
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
ACCEPT_RECIPIENT_IDENTIFIERS_ENABLED=True
2+
API_HOST_NAME=https://dev.api.notifications.va.gov
3+
API_MESSAGE_LIMIT_ENABLED=True
4+
API_RATE_LIMIT_ENABLED=True
5+
ATTACHMENTS_BUCKET=dev-notifications-va-gov-attachments
6+
AWS_PINPOINT_APP_ID=df55c01206b742d2946ef226410af94f
7+
AWS_SES_EMAIL_FROM_USER=dev-do-not-reply
8+
CHECK_GITHUB_SCOPE_ENABLED=True
9+
CHECK_TEMPLATE_NAME_EXISTS_ENABLED=True
10+
COMP_AND_PEN_DYNAMODB_NAME=dev-bip-payment-notification-table
11+
DD_ENV=dev
12+
DD_PROFILING_ENABLED=True
13+
DD_PROFILING_ENABLE_CODE_PROVENANCE=True
14+
DD_INSTRUMENTATION_TELEMETRY_ENABLED=False
15+
DD_SERVICE=celery-beat
16+
DD_SITE=ddog-gov.com
17+
EMAIL_ATTACHMENTS_ENABLED=True
18+
EMAIL_PASSWORD_LOGIN_ENABLED=True
19+
EMAIL_PROVIDER_SELECTION_STRATEGY_LABEL=LOAD_BALANCING
20+
FLASK_APP=run_celery_beat.py
21+
GA4_URL=https://www.google-analytics.com/mp/collect
22+
GITHUB_LOGIN_ENABLED=True
23+
GOOGLE_ANALYTICS_ENABLED=True
24+
GRANICUS_URL=https://stage-tms.govdelivery.com
25+
MPI_URL=https://int.services.eauth.va.gov:9303/int
26+
NIGHTLY_NOTIF_CSV_ENABLED=True
27+
NOTIFICATION_FAILURE_REASON_ENABLED=True
28+
NOTIFICATION_QUEUE_PREFIX=dev-notification-
29+
NOTIFY_EMAIL_FROM_USER=stage-notifications
30+
NOTIFY_ENVIRONMENT=development
31+
PINPOINT_INBOUND_SMS_ENABLED=True
32+
PINPOINT_RECEIPTS_ENABLED=True
33+
PLATFORM_STATS_ENABLED=True
34+
PROVIDER_STRATEGIES_ENABLED=True
35+
PUSH_NOTIFICATIONS_ENABLED=True
36+
REDIS_ENABLED=True
37+
SESSION_COOKIE_SECURE=True
38+
SMS_PROVIDER_SELECTION_STRATEGY_LABEL=HIGHEST_PRIORITY
39+
SMS_SENDER_RATE_LIMIT_ENABLED=True
40+
STATSD_HOST=localhost
41+
TEMPLATE_SERVICE_PROVIDERS_ENABLED=True
42+
TWILIO_ACCOUNT_SID=fake
43+
TWILIO_AUTH_TOKEN=fake
44+
UI_HOST_NAME=https://dev.notifications.va.gov
45+
VANOTIFY_SSL_CERT_PATH=/app/certs/vanotify_ssl_cert.pem
46+
VANOTIFY_SSL_KEY_PATH=/app/certs/vanotify_ssl_key.pem
47+
VA_FLAGSHIP_APP_SID=A20623E2321D4053A6C34C9307C6C221
48+
VA_ONSITE_URL=https://staging-api.va.gov
49+
VA_PROFILE_SMS_STATUS_ENABLED=True
50+
VA_PROFILE_URL=https://int.vaprofile.va.gov
51+
VA_SSO_ACCESS_TOKEN_URL=https://int.fed.eauth.va.gov/oauthi/sps/oauth/oauth20/token
52+
VA_SSO_AUTHORIZE_URL=https://int.fed.eauth.va.gov/oauthi/sps/oauth/oauth20/authorize
53+
VA_SSO_ENABLED=True
54+
VA_SSO_SERVER_METADATA_URL=https://int.fed.eauth.va.gov/oauthi/sps/oauth/oauth20/metadata/ISAMOP/.well-known/oauth-authorization-server
55+
VETEXT_SID=C9BEC63F53CE4C1D992CE73E8D1D8D94

‎cd/va-enp-api-task-definition.json

+165
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
{
2+
"family": "${ENV}-va-enp-api-task",
3+
"executionRoleArn": "arn:${AWS_ARN_REGION}:iam::${AWS_ACCOUNT_NUMBER}:role/project/project-${ENV}-notification-api-task-execution-role",
4+
"taskRoleArn": "arn:${AWS_ARN_REGION}:iam::${AWS_ACCOUNT_NUMBER}:role/project/project-${ENV}-notification-api-task-role",
5+
"networkMode": "awsvpc",
6+
"containerDefinitions": [
7+
{
8+
"name": "${ENV}-va-enp-api",
9+
"essential": true,
10+
"image": "{will-be-replaced-by-ci}",
11+
"logConfiguration": {
12+
"logDriver": "awslogs",
13+
"options": {
14+
"awslogs-group": "${ENV}-va-enp-api-log-group",
15+
"awslogs-region": "${AWS_REGION}",
16+
"awslogs-stream-prefix": "ecs"
17+
}
18+
},
19+
"portMappings": [
20+
{
21+
"containerPort": 6011,
22+
"hostPort": 6011
23+
}
24+
],
25+
"environmentFiles": [
26+
{
27+
"type": "s3",
28+
"value": "arn:${AWS_ARN_REGION}:s3:::vanotify-environment-variables-${ENV}/va-enp-api/${ENV}.env"
29+
}
30+
],
31+
"environment": [
32+
{
33+
"name": "DD_SERVICE",
34+
"value": "va-enp-api"
35+
},
36+
{
37+
"name": "FLASK_APP",
38+
"value": "application.py"
39+
}
40+
],
41+
"secrets": ${TASK_DEFINITION_SECRETS_JSON},
42+
"healthCheck": {
43+
"command": [
44+
"CMD-SHELL",
45+
"./scripts/wait_for_it.sh 127.0.0.1:6011 -t 0 || exit 1"
46+
],
47+
"interval": 30,
48+
"retries": 5,
49+
"timeout": 10
50+
}
51+
},
52+
{
53+
"name": "datadog-agent",
54+
"image": "${AWS_ACCOUNT_NUMBER}.dkr.ecr.${AWS_REGION}.amazonaws.com/datadog/agent:7.57.2",
55+
"logConfiguration": {
56+
"logDriver": "awslogs",
57+
"options": {
58+
"awslogs-group": "${ENV}-va-enp-api-datadog-log-group",
59+
"awslogs-region": "${AWS_REGION}",
60+
"awslogs-stream-prefix": "ecs"
61+
}
62+
},
63+
"portMappings": [
64+
{
65+
"containerPort": 8125,
66+
"hostPort": 8125,
67+
"protocol": "udp"
68+
},
69+
{
70+
"containerPort": 8126,
71+
"hostPort": 8126,
72+
"protocol": "tcp"
73+
}
74+
],
75+
"environment": [
76+
{
77+
"name": "DD_APM_NON_LOCAL_TRAFFIC",
78+
"value": "true"
79+
},
80+
{
81+
"name": "DD_LOGS_ENABLED",
82+
"value": "true"
83+
},
84+
{
85+
"name": "DD_APM_TELEMETRY_ENABLED",
86+
"value": "false"
87+
},
88+
{
89+
"name": "DD_PROCESS_AGENT_ENABLED",
90+
"value": "true"
91+
},
92+
{
93+
"name": "ECS_FARGATE",
94+
"value": "true"
95+
},
96+
{
97+
"name": "DD_SITE",
98+
"value": "ddog-gov.com"
99+
},
100+
{
101+
"name": "DD_APM_ENABLED",
102+
"value": "true"
103+
},
104+
{
105+
"name": "DD_ENV",
106+
"value": "${ENV}"
107+
},
108+
{
109+
"name": "DD_SERVICE",
110+
"value": "va-enp-api"
111+
},
112+
{
113+
"name": "DD_APM_FEATURES",
114+
"value": "enable_cid_stats"
115+
},
116+
{
117+
"name": "DD_PROFILING_ENABLE_CODE_PROVENANCE",
118+
"value": "true"
119+
}
120+
],
121+
"secrets": [
122+
{
123+
"name": "DD_API_KEY",
124+
"valueFrom": "${DD_API_KEY}"
125+
}
126+
]
127+
}
128+
],
129+
"requiresCompatibilities": [
130+
"FARGATE"
131+
],
132+
"cpu": "2048",
133+
"pidMode": "task",
134+
"memory": "4096",
135+
"tags": [
136+
{
137+
"key": "Stack",
138+
"value": "application-deployment"
139+
},
140+
{
141+
"key": "Environment",
142+
"value": "${ENV}"
143+
},
144+
{
145+
"key": "Team",
146+
"value": "vanotify"
147+
},
148+
{
149+
"key": "ManagedBy",
150+
"value": "CI"
151+
},
152+
{
153+
"key": "VAECID",
154+
"value": "AWG20200714002"
155+
},
156+
{
157+
"key": "ProjectName",
158+
"value": "VA Notify"
159+
},
160+
{
161+
"key": "ProjectShort",
162+
"value": "NOTIFY"
163+
}
164+
]
165+
}

0 commit comments

Comments
 (0)