Skip to content

Commit 9baf37d

Browse files
CLJ2006CLJ2006
committed
Commit summarizing all changes
1 parent 7eac65b commit 9baf37d

File tree

27 files changed

+601
-92
lines changed

27 files changed

+601
-92
lines changed

‎.github/actions/scan-secrets/action.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
name: "Scan secrets"
2+
description: "Scan secrets"
3+
runs:
4+
using: "composite"
5+
steps:
6+
- name: "Scan secrets"
7+
shell: bash
8+
run: |
9+
# Please do not change this `check=whole-history` setting, as new patterns may be added or history may be rewritten.
10+
check=whole-history ./scripts/githooks/scan-secrets.sh

‎.gitleaksignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# SEE: https://github.com/gitleaks/gitleaks/blob/master/README.md#gitleaksignore
2+
3+
cd9c0efec38c5d63053dd865e5d4e207c0760d91:docs/guides/Perform_static_analysis.md:generic-api-key:37

‎README.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@ https://nhsd-confluence.digital.nhs.uk/spaces/APM/pages/1226682275/Pipeline+Quer
1616
Note: Projects running Python version 3.13 or later do not need any pipeline modifications.
1717

1818

19-
2019
## Scripts
2120
* `template.py` - cli for basic jinja templating
2221
* `test_pull_request_deployments.py` - cli for testing utils against other repositories

‎ansible/Makefile‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,12 @@ create-build-env-vars: guard-build_label guard-out_dir
4343
@poetry run ansible-playbook -i local create-build-env-vars.yml
4444

4545
deploy-ecs-proxies: guard-account guard-build_label guard-service_id guard-APIGEE_ENVIRONMENT guard-PROXY_VARS_FILE
46-
@poetry run ansible-playbook -i local deploy-ecs-proxies.yml
46+
@echo "MAKE DEBUG: use_ecs_tag=${use_ecs_tag}"
47+
@poetry run ansible-playbook -i local deploy-ecs-proxies.yml \
48+
-e "use_ecs_tag=${use_ecs_tag}"
49+
50+
deploy-ecs-proxies-retag: guard-build_label guard-service_id guard-PROXY_VARS_FILE
51+
@poetry run ansible-playbook -i local deploy-ecs-proxies-retag.yml
4752

4853
deploy-apigee-proxy: guard-FULLY_QUALIFIED_SERVICE_NAME guard-SERVICE_BASE_PATH guard-APIGEE_ENVIRONMENT guard-APIGEE_ORGANIZATION guard-APIGEE_ACCESS_TOKEN guard-PROXY_DIR guard-PING
4954
@poetry run ansible-playbook -i local deploy-apigee-proxy.yml

‎ansible/deploy-ecs-proxies-retag.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
- name: deploy ecs proxies retag
2+
hosts: 127.0.0.1
3+
connection: local
4+
gather_facts: no
5+
6+
vars:
7+
service_id: "{{ lookup('env','service_id') }}"
8+
APIGEE_ENVIRONMENT: "{{ lookup('env','APIGEE_ENVIRONMENT') }}"
9+
account: "{{ lookup('env','account') }}"
10+
11+
pre_tasks:
12+
- name: Show CONTAINER_VARS_FILE from environment
13+
debug:
14+
msg: "CONTAINER_VARS_FILE={{ lookup('env','CONTAINER_VARS_FILE') }}"
15+
16+
- name: include container vars
17+
include_vars:
18+
file: "{{ lookup('env', 'CONTAINER_VARS_FILE') | expandvars | expanduser | realpath }}"
19+
20+
- name: Debug docker_containers
21+
debug:
22+
var: docker_containers
23+
24+
- name: Debug containers
25+
debug:
26+
var: containers
27+
28+
roles:
29+
- setup-facts
30+
- deploy-ecs-proxies-retag

‎ansible/deploy-ecs-proxies.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,19 @@
4343
include_vars:
4444
file: "{{ lookup('env', 'PROXY_VARS_FILE') | expandvars | expanduser | realpath }}"
4545

46+
- name: load use_ecs_tag from environment
47+
set_fact:
48+
use_ecs_tag: "{{ lookup('env','use_ecs_tag') | default('false') }}"
49+
50+
- name: normalise use_ecs_tag to boolean
51+
set_fact:
52+
use_ecs_tag: "{{ use_ecs_tag | lower == 'true' }}"
53+
54+
- name: debug use_ecs_tag type
55+
debug:
56+
msg: "VALUEDEPLOYYAML={{ use_ecs_tag }} TYPE={{ use_ecs_tag | type_debug }}"
57+
58+
4659
roles:
4760
- setup-facts
4861
- deploy-ecs-proxies

‎ansible/ecr-lifecycle/ecr_lifecycle.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"rules": [
3+
{
4+
"rulePriority": 1,
5+
"description": "Keep the 6 most recent ECS deployment images tagged ecs- (release images)",
6+
"selection": {
7+
"tagStatus": "tagged",
8+
"tagPrefixList": ["ecs-"],
9+
"countType": "imageCountMoreThan",
10+
"countNumber": 6
11+
},
12+
"action": { "type": "expire" }
13+
},
14+
{
15+
"rulePriority": 2,
16+
"description": "Never expire the 'latest' tag",
17+
"selection": {
18+
"tagStatus": "tagged",
19+
"tagPrefixList": ["latest"],
20+
"countType": "imageCountMoreThan",
21+
"countNumber": 9999
22+
},
23+
"action": { "type": "expire" }
24+
},
25+
{
26+
"rulePriority": 3,
27+
"description": "Keep the 6 most recent build images (all tags)",
28+
"selection": {
29+
"tagStatus": "any",
30+
"countType": "imageCountMoreThan",
31+
"countNumber": 6
32+
},
33+
"action": { "type": "expire" }
34+
}
35+
]
36+
}

‎ansible/roles/build-ecs-proxies/tasks/main.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,29 @@
3030
with_items: "{{ new_repos }}"
3131
when: new_repos
3232

33+
# TO DO- Add back in once confirmed lifecycle policy to be applied to all new repos.
34+
35+
# - name: Read lifecycle policy file
36+
# ansible.builtin.slurp:
37+
# src: "{{ playbook_dir }}/ecr-lifecycle/ecr_lifecycle.json"
38+
# register: desired_policy_raw
39+
# when: new_repos | length > 0
40+
41+
# - name: Decode lifecycle policy JSON
42+
# set_fact:
43+
# desired_policy_json: "{{ desired_policy_raw.content | b64decode | from_json }}"
44+
# when: new_repos | length > 0
45+
46+
# - name: Apply lifecycle policy to each new repo
47+
# ansible.builtin.command: >
48+
# {{ aws_cmd }} ecr put-lifecycle-policy
49+
# --repository-name {{ item }}
50+
# --lifecycle-policy-text '{{ desired_policy_json | to_json }}'
51+
# with_items: "{{ new_repos }}"
52+
# register: lifecycle_update
53+
# ignore_errors: yes
54+
# when: new_repos | length > 0
55+
3356
- name: ecr login
3457
shell: "eval $({{ aws_cmd }} ecr get-login --no-include-email)"
3558
changed_when: no

‎ansible/roles/create-api-deployment-pre-reqs/templates/terraform/iam.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,8 @@ data "aws_iam_policy_document" "ecs-execution-role" {
6969
"ecr:DescribeRepositories",
7070
"ecr:ListImages",
7171
"ecr:DescribeImages",
72+
"ecr:GetLifecyclePolicy",
73+
"ecr:PutLifecyclePolicy",
7274
"s3:GetObject"
7375
]
7476

@@ -173,6 +175,18 @@ data "aws_iam_policy_document" "deploy-user" {
173175

174176
}
175177

178+
statement {
179+
actions = [
180+
"ecr:GetLifecyclePolicy",
181+
"ecr:PutLifecyclePolicy"
182+
]
183+
184+
resources = [
185+
"arn:aws:ecr:${local.region}:${local.account_id}:repository/${var.service_id}",
186+
"arn:aws:ecr:${local.region}:${local.account_id}:repository/${var.service_id}_*"
187+
]
188+
}
189+
176190
statement {
177191
actions = [
178192
"s3:ListBucket",

‎ansible/roles/create-ecr-build-role/vars/main.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ aws_ecs_policy:
4444
- "ecr:StartImageScan"
4545
- "ecr:StartLifecyclePolicyPreview"
4646
- "ecr:UploadLayerPart"
47+
- "ecr:PutLifecyclePolicy"
4748
Resource: [
4849
"arn:aws:ecr:{{ aws_region }}:{{ aws_account_id }}:repository/{{ service_id }}_*"
4950
]

0 commit comments

Comments
 (0)