feat: 5950 build logstash container image pipeline #548

Wi11Shell · 2025-01-13T14:38:53Z

Description

Related issue: https://dvsa.atlassian.net/browse/VOL-5950

Before submitting (or marking as "ready for review")

Does the pull request title follow the conventional commit specification?
Have you performed a self-review of the code
Have you have added tests that prove the fix or feature is effective and working
Did you make sure to update any documentation relating to this change?

github-actions · 2025-01-14T14:36:49Z

Terraform plan for account: `prod`

Commit: b8aa2a5

Plan summary

8 to add, 0 to change, 0 to destroy

🆕 Creates

module.account.module.ecr["liquibase"].aws_ecr_lifecycle_policy.this[0]
module.account.module.ecr["liquibase"].aws_ecr_registry_scanning_configuration.this[0]
module.account.module.ecr["liquibase"].aws_ecr_repository.this[0]
module.account.module.ecr["liquibase"].aws_ecr_repository_policy.this[0]
module.account.module.ecr["search"].aws_ecr_lifecycle_policy.this[0]
module.account.module.ecr["search"].aws_ecr_registry_scanning_configuration.this[0]
module.account.module.ecr["search"].aws_ecr_repository.this[0]
module.account.module.ecr["search"].aws_ecr_repository_policy.this[0]

Show full plan

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.account.module.ecr["liquibase"].aws_ecr_lifecycle_policy.this[0] will be created
  + resource "aws_ecr_lifecycle_policy" "this" {
      + id          = (known after apply)
      + policy      = jsonencode(
            {
              + rules = [
                  + {
                      + action       = {
                          + type = "expire"
                        }
                      + description  = "Keep last 5 release images"
                      + rulePriority = 10
                      + selection    = {
                          + countNumber    = 5
                          + countType      = "imageCountMoreThan"
                          + tagPatternList = [
                              + "*.*.*",
                            ]
                          + tagStatus      = "tagged"
                        }
                    },
                  + {
                      + action       = {
                          + type = "expire"
                        }
                      + description  = "Keep last 5 non-release images"
                      + rulePriority = 20
                      + selection    = {
                          + countNumber = 5
                          + countType   = "imageCountMoreThan"
                          + tagStatus   = "any"
                        }
                    },
                ]
            }
        )
      + registry_id = (known after apply)
      + repository  = "vol-app/liquibase"
    }

  # module.account.module.ecr["liquibase"].aws_ecr_registry_scanning_configuration.this[0] will be created
  + resource "aws_ecr_registry_scanning_configuration" "this" {
      + id          = (known after apply)
      + registry_id = (known after apply)
      + scan_type   = "ENHANCED"

      + rule {
          + scan_frequency = "SCAN_ON_PUSH"

          + repository_filter {
              + filter      = "*"
              + filter_type = "WILDCARD"
            }
        }
      + rule {
          + scan_frequency = "CONTINUOUS_SCAN"

          + repository_filter {
              + filter      = "*.*.*"
              + filter_type = "WILDCARD"
            }
        }
    }

  # module.account.module.ecr["liquibase"].aws_ecr_repository.this[0] will be created
  + resource "aws_ecr_repository" "this" {
      + arn                  = (known after apply)
      + id                   = (known after apply)
      + image_tag_mutability = "MUTABLE"
      + name                 = "vol-app/liquibase"
      + registry_id          = (known after apply)
      + repository_url       = (known after apply)
      + tags_all             = {
          + "Repository" = "https://github.com/dvsa/vol-app"
        }

      + encryption_configuration {
          + encryption_type = "AES256"
          + kms_key         = (known after apply)
        }

      + image_scanning_configuration {
          + scan_on_push = true
        }
    }

  # module.account.module.ecr["liquibase"].aws_ecr_repository_policy.this[0] will be created
  + resource "aws_ecr_repository_policy" "this" {
      + id          = (known after apply)
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = [
                          + "ecr:ListTagsForResource",
                          + "ecr:ListImages",
                          + "ecr:GetRepositoryPolicy",
                          + "ecr:GetLifecyclePolicyPreview",
                          + "ecr:GetLifecyclePolicy",
                          + "ecr:GetDownloadUrlForLayer",
                          + "ecr:GetAuthorizationToken",
                          + "ecr:DescribeRepositories",
                          + "ecr:DescribeImages",
                          + "ecr:DescribeImageScanFindings",
                          + "ecr:BatchGetImage",
                          + "ecr:BatchCheckLayerAvailability",
                        ]
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = [
                              + "arn:aws:iam::146997448015:role/vol-app-github-actions-role",
                              + "arn:aws:iam::146997448015:role/vol-app-github-actions-readonly-role",
                            ]
                        }
                      + Sid       = "PrivateReadOnly"
                    },
                  + {
                      + Action    = [
                          + "ecr:UploadLayerPart",
                          + "ecr:PutImage",
                          + "ecr:InitiateLayerUpload",
                          + "ecr:CompleteLayerUpload",
                        ]
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = "arn:aws:iam::146997448015:role/vol-app-github-actions-role"
                        }
                      + Sid       = "ReadWrite"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + registry_id = (known after apply)
      + repository  = "vol-app/liquibase"
    }

  # module.account.module.ecr["search"].aws_ecr_lifecycle_policy.this[0] will be created
  + resource "aws_ecr_lifecycle_policy" "this" {
      + id          = (known after apply)
      + policy      = jsonencode(
            {
              + rules = [
                  + {
                      + action       = {
                          + type = "expire"
                        }
                      + description  = "Keep last 5 release images"
                      + rulePriority = 10
                      + selection    = {
                          + countNumber    = 5
                          + countType      = "imageCountMoreThan"
                          + tagPatternList = [
                              + "*.*.*",
                            ]
                          + tagStatus      = "tagged"
                        }
                    },
                  + {
                      + action       = {
                          + type = "expire"
                        }
                      + description  = "Keep last 5 non-release images"
                      + rulePriority = 20
                      + selection    = {
                          + countNumber = 5
                          + countType   = "imageCountMoreThan"
                          + tagStatus   = "any"
                        }
                    },
                ]
            }
        )
      + registry_id = (known after apply)
      + repository  = "vol-app/search"
    }

  # module.account.module.ecr["search"].aws_ecr_registry_scanning_configuration.this[0] will be created
  + resource "aws_ecr_registry_scanning_configuration" "this" {
      + id          = (known after apply)
      + registry_id = (known after apply)
      + scan_type   = "ENHANCED"

      + rule {
          + scan_frequency = "SCAN_ON_PUSH"

          + repository_filter {
              + filter      = "*"
              + filter_type = "WILDCARD"
            }
        }
      + rule {
          + scan_frequency = "CONTINUOUS_SCAN"

          + repository_filter {
              + filter      = "*.*.*"
              + filter_type = "WILDCARD"
            }
        }
    }

  # module.account.module.ecr["search"].aws_ecr_repository.this[0] will be created
  + resource "aws_ecr_repository" "this" {
      + arn                  = (known after apply)
      + id                   = (known after apply)
      + image_tag_mutability = "IMMUTABLE"
      + name                 = "vol-app/search"
      + registry_id          = (known after apply)
      + repository_url       = (known after apply)
      + tags_all             = {
          + "Repository" = "https://github.com/dvsa/vol-app"
        }

      + encryption_configuration {
          + encryption_type = "AES256"
          + kms_key         = (known after apply)
        }

      + image_scanning_configuration {
          + scan_on_push = true
        }
    }

  # module.account.module.ecr["search"].aws_ecr_repository_policy.this[0] will be created
  + resource "aws_ecr_repository_policy" "this" {
      + id          = (known after apply)
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = [
                          + "ecr:ListTagsForResource",
                          + "ecr:ListImages",
                          + "ecr:GetRepositoryPolicy",
                          + "ecr:GetLifecyclePolicyPreview",
                          + "ecr:GetLifecyclePolicy",
                          + "ecr:GetDownloadUrlForLayer",
                          + "ecr:GetAuthorizationToken",
                          + "ecr:DescribeRepositories",
                          + "ecr:DescribeImages",
                          + "ecr:DescribeImageScanFindings",
                          + "ecr:BatchGetImage",
                          + "ecr:BatchCheckLayerAvailability",
                        ]
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = [
                              + "arn:aws:iam::146997448015:role/vol-app-github-actions-role",
                              + "arn:aws:iam::146997448015:role/vol-app-github-actions-readonly-role",
                            ]
                        }
                      + Sid       = "PrivateReadOnly"
                    },
                  + {
                      + Action    = [
                          + "ecr:UploadLayerPart",
                          + "ecr:PutImage",
                          + "ecr:InitiateLayerUpload",
                          + "ecr:CompleteLayerUpload",
                        ]
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = "arn:aws:iam::146997448015:role/vol-app-github-actions-role"
                        }
                      + Sid       = "ReadWrite"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + registry_id = (known after apply)
      + repository  = "vol-app/search"
    }

Plan: 8 to add, 0 to change, 0 to destroy.

github-actions · 2025-01-14T14:37:02Z

Terraform plan for account: `nonprod`

Commit: b8aa2a5

Plan summary

4 to add, 1 to change, 0 to destroy

🆕 Creates

module.account.module.ecr["search"].aws_ecr_lifecycle_policy.this[0]
module.account.module.ecr["search"].aws_ecr_registry_scanning_configuration.this[0]
module.account.module.ecr["search"].aws_ecr_repository.this[0]
module.account.module.ecr["search"].aws_ecr_repository_policy.this[0]

🔄 Updates

module.account.module.ecr["liquibase"].aws_ecr_repository.this[0]

Show full plan

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # module.account.module.ecr["liquibase"].aws_ecr_repository.this[0] will be updated in-place
  ~ resource "aws_ecr_repository" "this" {
        id                   = "vol-app/liquibase"
      ~ image_tag_mutability = "IMMUTABLE" -> "MUTABLE"
        name                 = "vol-app/liquibase"
        tags                 = {}
        # (4 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

  # module.account.module.ecr["search"].aws_ecr_lifecycle_policy.this[0] will be created
  + resource "aws_ecr_lifecycle_policy" "this" {
      + id          = (known after apply)
      + policy      = jsonencode(
            {
              + rules = [
                  + {
                      + action       = {
                          + type = "expire"
                        }
                      + description  = "Keep last 5 release images"
                      + rulePriority = 10
                      + selection    = {
                          + countNumber    = 5
                          + countType      = "imageCountMoreThan"
                          + tagPatternList = [
                              + "*.*.*",
                            ]
                          + tagStatus      = "tagged"
                        }
                    },
                  + {
                      + action       = {
                          + type = "expire"
                        }
                      + description  = "Keep last 5 non-release images"
                      + rulePriority = 20
                      + selection    = {
                          + countNumber = 5
                          + countType   = "imageCountMoreThan"
                          + tagStatus   = "any"
                        }
                    },
                ]
            }
        )
      + registry_id = (known after apply)
      + repository  = "vol-app/search"
    }

  # module.account.module.ecr["search"].aws_ecr_registry_scanning_configuration.this[0] will be created
  + resource "aws_ecr_registry_scanning_configuration" "this" {
      + id          = (known after apply)
      + registry_id = (known after apply)
      + scan_type   = "ENHANCED"

      + rule {
          + scan_frequency = "SCAN_ON_PUSH"

          + repository_filter {
              + filter      = "*"
              + filter_type = "WILDCARD"
            }
        }
      + rule {
          + scan_frequency = "CONTINUOUS_SCAN"

          + repository_filter {
              + filter      = "*.*.*"
              + filter_type = "WILDCARD"
            }
        }
    }

  # module.account.module.ecr["search"].aws_ecr_repository.this[0] will be created
  + resource "aws_ecr_repository" "this" {
      + arn                  = (known after apply)
      + id                   = (known after apply)
      + image_tag_mutability = "IMMUTABLE"
      + name                 = "vol-app/search"
      + registry_id          = (known after apply)
      + repository_url       = (known after apply)
      + tags_all             = {
          + "Repository" = "https://github.com/dvsa/vol-app"
        }

      + encryption_configuration {
          + encryption_type = "AES256"
          + kms_key         = (known after apply)
        }

      + image_scanning_configuration {
          + scan_on_push = true
        }
    }

  # module.account.module.ecr["search"].aws_ecr_repository_policy.this[0] will be created
  + resource "aws_ecr_repository_policy" "this" {
      + id          = (known after apply)
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = [
                          + "ecr:ListTagsForResource",
                          + "ecr:ListImages",
                          + "ecr:GetRepositoryPolicy",
                          + "ecr:GetLifecyclePolicyPreview",
                          + "ecr:GetLifecyclePolicy",
                          + "ecr:GetDownloadUrlForLayer",
                          + "ecr:GetAuthorizationToken",
                          + "ecr:DescribeRepositories",
                          + "ecr:DescribeImages",
                          + "ecr:DescribeImageScanFindings",
                          + "ecr:BatchGetImage",
                          + "ecr:BatchCheckLayerAvailability",
                        ]
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = [
                              + "arn:aws:iam::054614622558:role/vol-app-github-actions-role",
                              + "arn:aws:iam::054614622558:role/vol-app-github-actions-readonly-role",
                            ]
                        }
                      + Sid       = "PrivateReadOnly"
                    },
                  + {
                      + Action    = [
                          + "ecr:UploadLayerPart",
                          + "ecr:PutImage",
                          + "ecr:InitiateLayerUpload",
                          + "ecr:CompleteLayerUpload",
                        ]
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = "arn:aws:iam::054614622558:role/vol-app-github-actions-role"
                        }
                      + Sid       = "ReadWrite"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + registry_id = (known after apply)
      + repository  = "vol-app/search"
    }

Plan: 4 to add, 1 to change, 0 to destroy.

Wi11Shell requested a review from a team as a code owner January 13, 2025 14:38

Wi11Shell changed the title ~~5950 build logstash container image pipeline~~ feat: 5950 build logstash container image pipeline Jan 14, 2025

Wi11Shell added 12 commits January 16, 2025 13:41

feat: reformatting batch module

f21aaee

fix: update secrets file var

cded48a

fix: added service identifiers

8f2ca79

fix: modified run command

33107fc

fix: var ref

3cc0ef0

fix: updated pipelines

a46a63e

fix: update search tag var

835ce19

fix: updated deploy-env

2843b2e

fix: add continue on error to docker security

dce68de

fix: linting

4a620c5

fix: move continue on error

1c37910

fix: allow security-docker to fail

4ce6ea7

Wi11Shell force-pushed the 5588-containers-search branch from 8d6d6ff to 4ce6ea7 Compare January 16, 2025 13:41

Wi11Shell added 6 commits January 16, 2025 14:24

fix: only run app for app changes

dd20380

fix: removed docker-files from app conditional

0374e47

fix: add null to app conditional

8ee18a3

fix: download artefact conditional

7cc38b3

fix: if not search

5aae902

fix: add production target to search dockerfile

b8aa2a5

barkerl approved these changes Jan 17, 2025

View reviewed changes

fibble approved these changes Jan 17, 2025

View reviewed changes

Wi11Shell merged commit 6e9ab18 into main Jan 17, 2025
20 of 24 checks passed

Wi11Shell deleted the 5588-containers-search branch January 17, 2025 16:04

github-actions bot mentioned this pull request Jan 20, 2025

chore(main): release 5.14.0 #550

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: 5950 build logstash container image pipeline #548

feat: 5950 build logstash container image pipeline #548

Wi11Shell commented Jan 13, 2025

github-actions bot commented Jan 14, 2025 •

edited

Loading

github-actions bot commented Jan 14, 2025 •

edited

Loading

feat: 5950 build logstash container image pipeline #548

feat: 5950 build logstash container image pipeline #548

Conversation

Wi11Shell commented Jan 13, 2025

Description

Before submitting (or marking as "ready for review")

github-actions bot commented Jan 14, 2025 • edited Loading

Terraform plan for account: prod

Plan summary

github-actions bot commented Jan 14, 2025 • edited Loading

Terraform plan for account: nonprod

Plan summary

github-actions bot commented Jan 14, 2025 •

edited

Loading

Terraform plan for account: `prod`

github-actions bot commented Jan 14, 2025 •

edited

Loading

Terraform plan for account: `nonprod`