LDAP: RBAC Uplift #135
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "LDAP: RBAC Uplift" | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| environment: | |
| required: true | |
| type: choice | |
| options: | |
| - "dev" | |
| - "test" | |
| - "stage" | |
| - "preprod" | |
| - "prod" | |
| rbac_tag: | |
| required: true | |
| type: string | |
| jobs: | |
| deploy: | |
| name: Create ECS Task in delius-core ${{ github.event.inputs.environment }}-preapproved | |
| runs-on: ubuntu-latest | |
| environment: delius-core-${{ github.event.inputs.environment }}-preapproved | |
| permissions: | |
| id-token: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Configure AWS Credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| role-to-assume: "arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/modernisation-platform-oidc-cicd" | |
| role-session-name: "hmpps-delius-operational-automation-${{ github.run_number }}" | |
| aws-region: "eu-west-2" | |
| - name: Set cluster ARN | |
| id: set-cluster-arn | |
| run: | | |
| echo "CLUSTER_ARN=delius-core-${{ github.event.inputs.environment }}-cluster" >> $GITHUB_OUTPUT | |
| - name: Get security groups and subnet ids | |
| id: get-ids | |
| run: | | |
| echo "SEC_GROUPS=$(aws ec2 describe-security-groups --filters "Name=group-name,Values=ecs-service-ldap-${{ github.event.inputs.environment }}" --query "SecurityGroups[].GroupId" --output json | jq -s -c '.[]')" >> $GITHUB_OUTPUT | |
| echo "SUBNET_IDS=$(aws ec2 describe-subnets --filters "Name=tag:Name,Values=*-general-private-*" --query "Subnets[].SubnetId" --output json | jq -s -c '.[]')" >> $GITHUB_OUTPUT | |
| - name: Update RBAC Version SSM Parameter | |
| id: update-ssm | |
| run: | | |
| aws ssm put-parameter --name "/delius-core-${{ github.event.inputs.environment }}/LDAP_RBAC_VERSION" --value "${{ github.event.inputs.rbac_tag }}" --overwrite | |
| - name: Template task def | |
| uses: christherama/render-json-template@v1 | |
| id: render | |
| with: | |
| # Path to JSON file serving as the template for rendering an output file. Required. | |
| json-file-path: ./docker/ldap-automation/task-def.json | |
| # Multi-line string containing key/value pairs of JSON property paths and desired property values | |
| field-value-pairs: | | |
| $.containerDefinitions[0].command: ["ldap-automation", "rbac-uplift", "-t", "${{ github.event.inputs.rbac_tag }}"] | |
| $.executionRoleArn: "arn:aws:iam::${{vars.AWS_ACCOUNT_ID}}:role/${{ github.event.inputs.environment }}-ldap-ecs-task-exec" | |
| $.taskRoleArn: "arn:aws:iam::${{vars.AWS_ACCOUNT_ID}}:role/${{ github.event.inputs.environment }}-ldap-ecs-task" | |
| $.containerDefinitions[0].image: "ghcr.io/ministryofjustice/hmpps-ldap-automation:${{ vars.LDAP_AUTOMATION_IMAGE_TAG }}" | |
| $.containerDefinitions[0].containerName: "ldap-automation-task-${{ github.run_id }}" | |
| $.containerDefinitions[0].secrets: [{"name": "SECRET_LDAP_BIND_PASSWORD", "valueFrom": "arn:aws:ssm:${{secrets.AWS_REGION}}:${{vars.AWS_ACCOUNT_ID}}:parameter/delius-core-${{ github.event.inputs.environment }}/LDAP_BIND_PASSWORD"}, {"name": "SECRET_LDAP_ADMIN_PASSWORD", "valueFrom": "arn:aws:ssm:${{secrets.AWS_REGION}}:${{vars.AWS_ACCOUNT_ID}}:parameter/delius-core-${{ github.event.inputs.environment }}/LDAP_ADMIN_PASSWORD"}, {"name": "SECRET_oasys_user", "valueFrom": "arn:aws:ssm:${{secrets.AWS_REGION}}:${{vars.AWS_ACCOUNT_ID}}:parameter/delius-core-${{ github.event.inputs.environment }}/oasys_user"}, {"name": "SECRET_oasys_user_password", "valueFrom": "arn:aws:ssm:${{secrets.AWS_REGION}}:${{vars.AWS_ACCOUNT_ID}}:parameter/delius-core-${{ github.event.inputs.environment }}/oasys_password"}, {"name": "SECRET_iaps_user", "valueFrom": "arn:aws:ssm:${{secrets.AWS_REGION}}:${{vars.AWS_ACCOUNT_ID}}:parameter/delius-core-${{ github.event.inputs.environment }}/iaps_user"}, {"name": "SECRET_iaps_user_password", "valueFrom": "arn:aws:ssm:${{secrets.AWS_REGION}}:${{vars.AWS_ACCOUNT_ID}}:parameter/delius-core-${{ github.event.inputs.environment }}/iaps_user_password"}, {"name": "SECRET_dss_user", "valueFrom": "arn:aws:ssm:${{secrets.AWS_REGION}}:${{vars.AWS_ACCOUNT_ID}}:parameter/delius-core-${{ github.event.inputs.environment }}/dss_user"}, {"name": "SECRET_dss_user_password", "valueFrom": "arn:aws:ssm:${{secrets.AWS_REGION}}:${{vars.AWS_ACCOUNT_ID}}:parameter/delius-core-${{ github.event.inputs.environment }}/dss_user_password"}, {"name": "SECRET_casenotes_user", "valueFrom": "arn:aws:ssm:${{secrets.AWS_REGION}}:${{vars.AWS_ACCOUNT_ID}}:parameter/delius-core-${{ github.event.inputs.environment }}/casenotes_user"}, {"name": "SECRET_casenotes_password", "valueFrom": "arn:aws:ssm:${{secrets.AWS_REGION}}:${{vars.AWS_ACCOUNT_ID}}:parameter/delius-core-${{ github.event.inputs.environment }}/casenotes_user_password"}, {"name": "SECRET_test_user_password", "valueFrom": "arn:aws:ssm:${{secrets.AWS_REGION}}:${{vars.AWS_ACCOUNT_ID}}:parameter/delius-core-${{ github.event.inputs.environment }}/test_user_password"}, {"name": "SECRET_gdpr_api_client_secret", "valueFrom": "arn:aws:ssm:${{secrets.AWS_REGION}}:${{vars.AWS_ACCOUNT_ID}}:parameter/delius-core-${{ github.event.inputs.environment }}/gdpr_api_client_secret"}, {"name": "SECRET_pwm_config_password", "valueFrom": "arn:aws:ssm:${{secrets.AWS_REGION}}:${{vars.AWS_ACCOUNT_ID}}:parameter/delius-core-${{ github.event.inputs.environment }}/pwm_config_password"}, {"name": "SECRET_merge_api_client_secret", "valueFrom": "arn:aws:ssm:${{secrets.AWS_REGION}}:${{vars.AWS_ACCOUNT_ID}}:parameter/delius-core-${{ github.event.inputs.environment }}/merge_api_client_secret"}, {"name": "SECRET_umt_client_secret", "valueFrom": "arn:aws:ssm:${{secrets.AWS_REGION}}:${{vars.AWS_ACCOUNT_ID}}:parameter/delius-core-${{ github.event.inputs.environment }}/umt_client_secret"}, {"name": "VAR_LDAP_HOST", "valueFrom": "arn:aws:ssm:${{secrets.AWS_REGION}}:${{vars.AWS_ACCOUNT_ID}}:parameter/delius-core-${{ github.event.inputs.environment }}/LDAP_HOST"}, {"name": "VAR_LDAP_USER", "valueFrom": "arn:aws:ssm:${{secrets.AWS_REGION}}:${{vars.AWS_ACCOUNT_ID}}:parameter/delius-core-${{ github.event.inputs.environment }}/LDAP_PRINCIPAL"}, {"name": "SECRET_performance_test_user_password", "valueFrom": "arn:aws:ssm:${{secrets.AWS_REGION}}:${{vars.AWS_ACCOUNT_ID}}:parameter/delius-core-${{ github.event.inputs.environment }}/performance_test_user_password"}] | |
| $.containerDefinitions[0].environment: [{"name": "VAR_SSM_PREFIX", "value": "SSM_"}, {"name": "VAR_PROJECT_NAME", "value": "delius-core"}, {"name": "VAR_ENVIRONMENT_NAME", "value": "delius-core-${{ github.event.inputs.environment }}"}, {"name": "VAR_LDAP_ADMIN_USERNAME", "value": "root"}] | |
| $.containerDefinitions[0].logConfiguration.options."awslogs-group": "/ecs/ldap-automation-${{ github.event.inputs.environment }}" | |
| $.containerDefinitions[0].logConfiguration.options."awslogs-region": "${{secrets.AWS_REGION}}" | |
| $.containerDefinitions[0].logConfiguration.options."awslogs-stream-prefix": "${{ github.run_id }}" | |
| - name: Show rendered user service task | |
| if: github.ref != 'refs/heads/main' | |
| run: cat ${{ steps.render.outputs.rendered-json-file }} | |
| - name: Run Standalone ECS Task | |
| id: run-task | |
| run: | | |
| task_definition=$(aws ecs register-task-definition --cli-input-json file://${{ steps.render.outputs.rendered-json-file }}) | |
| task_definition_arn=$(echo $task_definition | jq -r '.taskDefinition.taskDefinitionArn') | |
| echo "TASK_DEF_ARN=$(echo $task_definition | jq -r '.taskDefinition.taskDefinitionArn') " >> $GITHUB_OUTPUT | |
| # Run task and store task id for later use | |
| echo "TASK_ID=$(aws ecs run-task --cluster ${{ steps.set-cluster-arn.outputs.CLUSTER_ARN }} --task-definition $task_definition_arn --network-configuration "awsvpcConfiguration={subnets=${{ steps.get-ids.outputs.SUBNET_IDS }},securityGroups=${{ steps.get-ids.outputs.SEC_GROUPS }},assignPublicIp=DISABLED}" --launch-type FARGATE --count 1 | jq -r '.tasks[0].taskArn' | cut -d '/' -f 3)" >> $GITHUB_OUTPUT | |
| - name: Delete Task Definition | |
| run: | | |
| aws ecs deregister-task-definition --task-definition ${{steps.run-task.outputs.TASK_DEF_ARN}} | |
| - name: Output Cloudwatch Logs | |
| run: | | |
| task_running=true | |
| while [ "$task_running" = true ]; do | |
| task_info=$(aws ecs describe-tasks --cluster ${{ steps.set-cluster-arn.outputs.CLUSTER_ARN }} --tasks ${{steps.run-task.outputs.TASK_ID}}) | |
| last_status=$(echo "$task_info" | jq -r '.tasks[0].lastStatus') | |
| if [ "$last_status" == "STOPPED" ]; then | |
| task_running=false | |
| else | |
| sleep 10 | |
| fi | |
| done | |
| task_definition_arn=$(echo "$task_info" | jq -r '.tasks[0].taskDefinitionArn') | |
| task_definition=$(aws ecs describe-task-definition --task-definition $task_definition_arn) | |
| log_group_name=$(echo "$task_definition" | jq -r '.taskDefinition.containerDefinitions[0].logConfiguration.options."awslogs-group"') | |
| log_stream_prefix=$(echo "$task_definition" | jq -r '.taskDefinition.containerDefinitions[0].logConfiguration.options."awslogs-stream-prefix"') | |
| container_name=$(echo "$task_definition" | jq -r '.taskDefinition.containerDefinitions[0].name') | |
| log_stream_name="${log_stream_prefix}/${container_name}/${{steps.run-task.outputs.TASK_ID}}" | |
| aws logs tail "$log_group_name" --log-stream-names "$log_stream_name" |