Skip to content

Commit 929edad

Browse files
CLJ2006CLJ2006
committed
retag changes
1 parent 18e60a0 commit 929edad

File tree

14 files changed

+341
-15
lines changed

14 files changed

+341
-15
lines changed

‎ansible/Makefile‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,12 @@ create-build-env-vars: guard-build_label guard-out_dir
4343
@poetry run ansible-playbook -i local create-build-env-vars.yml
4444

4545
deploy-ecs-proxies: guard-account guard-build_label guard-service_id guard-APIGEE_ENVIRONMENT guard-PROXY_VARS_FILE
46-
@poetry run ansible-playbook -i local deploy-ecs-proxies.yml
46+
@echo "MAKE DEBUG: use_ecs_tag=${use_ecs_tag}"
47+
@poetry run ansible-playbook -i local deploy-ecs-proxies.yml \
48+
-e "use_ecs_tag=${use_ecs_tag}"
49+
50+
deploy-ecs-proxies-retag: guard-build_label guard-service_id guard-PROXY_VARS_FILE
51+
@poetry run ansible-playbook -i local deploy-ecs-proxies-retag.yml
4752

4853
deploy-apigee-proxy: guard-FULLY_QUALIFIED_SERVICE_NAME guard-SERVICE_BASE_PATH guard-APIGEE_ENVIRONMENT guard-APIGEE_ORGANIZATION guard-APIGEE_ACCESS_TOKEN guard-PROXY_DIR guard-PING
4954
@poetry run ansible-playbook -i local deploy-apigee-proxy.yml

‎ansible/deploy-ecs-proxies-retag.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
- name: deploy ecs proxies retag
2+
hosts: 127.0.0.1
3+
connection: local
4+
gather_facts: no
5+
6+
vars:
7+
service_id: "{{ lookup('env','service_id') }}"
8+
APIGEE_ENVIRONMENT: "{{ lookup('env','APIGEE_ENVIRONMENT') }}"
9+
account: "{{ lookup('env','account') }}"
10+
11+
pre_tasks:
12+
- name: Show CONTAINER_VARS_FILE from environment
13+
debug:
14+
msg: "CONTAINER_VARS_FILE={{ lookup('env','CONTAINER_VARS_FILE') }}"
15+
16+
- name: include container vars
17+
include_vars:
18+
file: "{{ lookup('env', 'CONTAINER_VARS_FILE') | expandvars | expanduser | realpath }}"
19+
20+
- name: Debug docker_containers
21+
debug:
22+
var: docker_containers
23+
24+
- name: Debug containers
25+
debug:
26+
var: containers
27+
28+
roles:
29+
- setup-facts
30+
- deploy-ecs-proxies-retag

‎ansible/deploy-ecs-proxies.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,10 +39,22 @@
3939
msg: "SERVICE_BASE_PATH not set"
4040
when: not SERVICE_BASE_PATH
4141

42+
- name: load use_ecs_tag from environment
43+
set_fact:
44+
use_ecs_tag: "{{ lookup('env','use_ecs_tag') | default('false') }}"
45+
46+
- name: normalise use_ecs_tag to boolean
47+
set_fact:
48+
use_ecs_tag: "{{ use_ecs_tag | lower == 'true' }}"
49+
4250
- name: include vars
4351
include_vars:
4452
file: "{{ lookup('env', 'PROXY_VARS_FILE') | expandvars | expanduser | realpath }}"
4553

54+
- name: debug use_ecs_tag type
55+
debug:
56+
msg: "VALUEDEPLOYYAML={{ use_ecs_tag }} TYPE={{ use_ecs_tag | type_debug }}"
57+
4658
roles:
4759
- setup-facts
4860
- deploy-ecs-proxies

‎ansible/ecr-lifecycle/ecr_lifecycle.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"rules": [
3+
{
4+
"rulePriority": 1,
5+
"description": "Keep the 6 most recent ECS deployment images tagged ecs- (release images)",
6+
"selection": {
7+
"tagStatus": "tagged",
8+
"tagPrefixList": ["ecs-"],
9+
"countType": "imageCountMoreThan",
10+
"countNumber": 6
11+
},
12+
"action": { "type": "expire" }
13+
},
14+
{
15+
"rulePriority": 2,
16+
"description": "Never expire the 'latest' tag",
17+
"selection": {
18+
"tagStatus": "tagged",
19+
"tagPrefixList": ["latest"],
20+
"countType": "imageCountMoreThan",
21+
"countNumber": 9999
22+
},
23+
"action": { "type": "expire" }
24+
},
25+
{
26+
"rulePriority": 3,
27+
"description": "Keep the 6 most recent build images (all tags)",
28+
"selection": {
29+
"tagStatus": "any",
30+
"countType": "imageCountMoreThan",
31+
"countNumber": 6
32+
},
33+
"action": { "type": "expire" }
34+
}
35+
]
36+
}

‎ansible/roles/build-ecs-proxies/tasks/main.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,29 @@
3030
with_items: "{{ new_repos }}"
3131
when: new_repos
3232

33+
# TO DO- Add back in once confirmed lifecycle policy to be applied to all new repos.
34+
35+
# - name: Read lifecycle policy file
36+
# ansible.builtin.slurp:
37+
# src: "{{ playbook_dir }}/ecr-lifecycle/ecr_lifecycle.json"
38+
# register: desired_policy_raw
39+
# when: new_repos | length > 0
40+
41+
# - name: Decode lifecycle policy JSON
42+
# set_fact:
43+
# desired_policy_json: "{{ desired_policy_raw.content | b64decode | from_json }}"
44+
# when: new_repos | length > 0
45+
46+
# - name: Apply lifecycle policy to each new repo
47+
# ansible.builtin.command: >
48+
# {{ aws_cmd }} ecr put-lifecycle-policy
49+
# --repository-name {{ item }}
50+
# --lifecycle-policy-text '{{ desired_policy_json | to_json }}'
51+
# with_items: "{{ new_repos }}"
52+
# register: lifecycle_update
53+
# ignore_errors: yes
54+
# when: new_repos | length > 0
55+
3356
- name: ecr login
3457
shell: "eval $({{ aws_cmd }} ecr get-login --no-include-email)"
3558
changed_when: no

‎ansible/roles/create-api-deployment-pre-reqs/templates/terraform/iam.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,8 @@ data "aws_iam_policy_document" "ecs-execution-role" {
6969
"ecr:DescribeRepositories",
7070
"ecr:ListImages",
7171
"ecr:DescribeImages",
72+
"ecr:GetLifecyclePolicy",
73+
"ecr:PutLifecyclePolicy",
7274
"s3:GetObject"
7375
]
7476

@@ -173,6 +175,18 @@ data "aws_iam_policy_document" "deploy-user" {
173175

174176
}
175177

178+
statement {
179+
actions = [
180+
"ecr:GetLifecyclePolicy",
181+
"ecr:PutLifecyclePolicy"
182+
]
183+
184+
resources = [
185+
"arn:aws:ecr:${local.region}:${local.account_id}:repository/${var.service_id}",
186+
"arn:aws:ecr:${local.region}:${local.account_id}:repository/${var.service_id}_*"
187+
]
188+
}
189+
176190
statement {
177191
actions = [
178192
"s3:ListBucket",

‎ansible/roles/create-ecr-build-role/vars/main.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ aws_ecs_policy:
4444
- "ecr:StartImageScan"
4545
- "ecr:StartLifecyclePolicyPreview"
4646
- "ecr:UploadLayerPart"
47+
- "ecr:PutLifecyclePolicy"
4748
Resource: [
4849
"arn:aws:ecr:{{ aws_region }}:{{ aws_account_id }}:repository/{{ service_id }}_*"
4950
]

‎ansible/roles/deploy-ecs-proxies-retag/tasks/main.yml‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
- name: Ensure docker_containers is loaded
2+
include_vars:
3+
file: "{{ lookup('env', 'CONTAINER_VARS_FILE') }}"
4+
when: docker_containers is not defined
5+
6+
- name: Debug docker_containers (retag role)
7+
debug:
8+
var: docker_containers
9+
10+
- name: Debug containers (retag role)
11+
debug:
12+
var: containers
13+
14+
- name: Debug repo_names (retag role)
15+
debug:
16+
var: repo_names
17+
18+
- name: Login to ECR
19+
shell: >
20+
{{ aws_cmd }} ecr get-login-password --region {{ aws_region }}
21+
| docker login --username AWS --password-stdin {{ ecr_registry }}
22+
23+
- name: Debug pulling image
24+
debug:
25+
msg: "Pulling {{ ecr_registry }}/{{ item }}:{{ build_label }}"
26+
loop: "{{ repo_names }}"
27+
loop_control:
28+
label: "{{ item }}"
29+
30+
- name: Pull existing image
31+
ansible.builtin.command:
32+
cmd: >
33+
docker pull {{ ecr_registry }}/{{ item }}:{{ build_label }}
34+
loop: "{{ repo_names }}"
35+
loop_control:
36+
label: "{{ item }}"
37+
register: pull_results
38+
39+
- name: Debug retagging image
40+
debug:
41+
msg: "Retagging {{ item.item }}:{{ build_label }} → ecs-{{ build_label }}"
42+
loop: "{{ pull_results.results }}"
43+
loop_control:
44+
label: "{{ item.item }}"
45+
when:
46+
- item.rc == 0
47+
- item.item == "canary_canary-api"
48+
49+
- name: Retag image
50+
ansible.builtin.command:
51+
cmd: >
52+
docker tag
53+
{{ ecr_registry }}/{{ item.item }}:{{ build_label }}
54+
{{ ecr_registry }}/{{ item.item }}:ecs-{{ build_label }}
55+
loop: "{{ pull_results.results }}"
56+
loop_control:
57+
label: "{{ item.item }}"
58+
when:
59+
- item.rc == 0
60+
- item.item == "canary_canary-api"
61+
62+
- name: Debug pushing image
63+
debug:
64+
msg: "Pushing ecs-{{ build_label }} for {{ item.item }}"
65+
loop: "{{ pull_results.results }}"
66+
loop_control:
67+
label: "{{ item.item }}"
68+
when:
69+
- item.rc == 0
70+
- item.item == "canary_canary-api"
71+
72+
- name: Push new tag
73+
ansible.builtin.command:
74+
cmd: >
75+
docker push {{ ecr_registry }}/{{ item.item }}:ecs-{{ build_label }}
76+
loop: "{{ pull_results.results }}"
77+
loop_control:
78+
label: "{{ item.item }}"
79+
when:
80+
- item.rc == 0
81+
- item.item == "canary_canary-api"
82+
83+
# - name: Delete old tag from ECR
84+
# ansible.builtin.command:
85+
# cmd: >
86+
# aws ecr batch-delete-image
87+
# --repository-name {{ item.item }}
88+
# --image-ids imageTag={{ build_label }}
89+
# --region {{ aws_region }}
90+
# loop: "{{ pull_results.results }}"
91+
# loop_control:
92+
# label: "{{ item.item }}"
93+
# when:
94+
# - item.rc == 0
95+
# - item.item == "canary_canary-api"

‎ansible/roles/deploy-ecs-proxies-retag/vars/main.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
build_label: "{{ lookup('env', 'build_label') }}"
3+
containers: "{{ docker_containers | json_query('[].name') | unique | sort }}"
4+
repo_names: "{{ containers | map('regex_replace', '^(.*)$', service_id + '_\\1') | list }}"
5+
base_dir: "{{ playbook_dir }}/../.."
6+

‎ansible/roles/deploy-ecs-proxies/tasks/main.yml‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -71,14 +71,23 @@
7171
with_filetree: "{{ '../templates' }}"
7272
when: item.state == 'file'
7373

74+
- name: debug use_ecs_tag before terraform
75+
debug:
76+
msg: "ANSIBLE: use_ecs_tag={{ use_ecs_tag }} TF_VAR_use_ecs_tag={{ use_ecs_tag | ternary('true','false') }}"
77+
7478
- name: terraform plan
75-
shell: "make -C {{ out_dir }}/terraform clean plan args='-no-color -lock-timeout=30m -out tfplan.out'" # noqa 305
79+
shell: "TF_VAR_use_ecs_tag={{ use_ecs_tag | ternary('true','false') }} make -C {{ out_dir }}/terraform clean plan args='-no-color -lock-timeout=30m -out tfplan.out'" # noqa 305
7680
register: tfplan
7781
failed_when: tfplan.rc not in (0, 2)
7882
when: not do_not_terraform
7983

84+
- name: print full terraform plan output (lines)
85+
debug:
86+
var: tfplan.stdout_lines
87+
when: tfplan is defined
88+
8089
- name: terraform apply
81-
shell: "make -C {{ out_dir }}/terraform apply-plan args='-no-color -lock-timeout=30m --auto-approve tfplan.out'" # noqa 305
90+
shell: "TF_VAR_use_ecs_tag={{ use_ecs_tag | ternary('true','false') }} make -C {{ out_dir }}/terraform apply-plan args='-no-color -lock-timeout=30m --auto-approve tfplan.out'" # noqa 305
8291
register: tfapply
8392
when: not do_not_terraform
8493

0 commit comments

Comments
 (0)