-
Notifications
You must be signed in to change notification settings - Fork 1
/
Makefile
304 lines (245 loc) · 15.1 KB
/
Makefile
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
TERRAFILE_VERSION=0.8
ARM_TEMPLATE_TAG=1.1.10
RG_TAGS={"Product" : "Refer Serious Misconduct"}
REGION=UK South
SERVICE_NAME=refer-serious-misconduct
SERVICE_SHORT=rsm
DOCKER_REPOSITORY=ghcr.io/dfe-digital/refer-serious-misconduct
.DEFAULT_GOAL :=help
SHELL :=/bin/bash
.PHONY: help
help: ## Show this help
@grep -E '^[a-zA-Z\.\-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
##@ Set environment and corresponding configuration
.PHONY: dev
dev:
$(eval DEPLOY_ENV=dev)
$(eval AZURE_SUBSCRIPTION=s165-teachingqualificationsservice-development)
$(eval RESOURCE_NAME_PREFIX=s165d01)
$(eval ENV_SHORT=dv)
$(eval ENV_TAG=dev)
$(eval NAME_ENV=${DEPLOY_ENV})
$(eval RESOURCE_ENV=${ENV_SHORT})
.PHONY: test
test:
$(eval DEPLOY_ENV=test)
$(eval AZURE_SUBSCRIPTION=s165-teachingqualificationsservice-test)
$(eval RESOURCE_NAME_PREFIX=s165t01)
$(eval ENV_SHORT=ts)
$(eval ENV_TAG=test)
$(eval NAME_ENV=${DEPLOY_ENV})
$(eval RESOURCE_ENV=${ENV_SHORT})
.PHONY: preprod
preprod:
$(eval DEPLOY_ENV=preprod)
$(eval AZURE_SUBSCRIPTION=s165-teachingqualificationsservice-test)
$(eval RESOURCE_NAME_PREFIX=s165t01)
$(eval ENV_SHORT=pp)
$(eval ENV_TAG=pre-prod)
$(eval NAME_ENV=${DEPLOY_ENV})
$(eval RESOURCE_ENV=${ENV_SHORT})
.PHONY: production
production:
$(eval DEPLOY_ENV=production)
$(eval AZURE_SUBSCRIPTION=s165-teachingqualificationsservice-production)
$(eval RESOURCE_NAME_PREFIX=s165p01)
$(eval ENV_SHORT=pd)
$(eval ENV_TAG=prod)
$(eval AZURE_BACKUP_STORAGE_ACCOUNT_NAME=s165p01rsmdbbackuppd)
$(eval AZURE_BACKUP_STORAGE_CONTAINER_NAME=rsm)
$(eval NAME_ENV=${DEPLOY_ENV})
$(eval RESOURCE_ENV=${ENV_SHORT})
$(eval CONSOLE_OPTIONS=--sandbox )
.PHONY: review-init
review-init:
$(if $(pr_id), , $(error Missing environment variable "pr_id"))
$(eval ENV_TAG=dev)
.PHONY: review
review: review-init set-azure-resource-group-tags
$(eval DEPLOY_ENV=review)
$(eval AZURE_SUBSCRIPTION=s165-teachingqualificationsservice-development)
$(eval RESOURCE_NAME_PREFIX=s165d01)
$(eval ENV_SHORT=rv)
$(eval env=-pr-$(pr_id))
$(eval backend_config=-backend-config="key=review/review$(env).tfstate")
$(eval export TF_VAR_resource_group_tags=$(RG_TAGS))
$(eval export TF_VAR_app_suffix=$(env))
$(eval export TF_VAR_resource_group_name=s165d01-rsm-review$(env)-rg)
$(eval export TF_VAR_allegations_storage_account_name=s165d01rsmallegr$(pr_id))
$(eval NAME_ENV=${DEPLOY_ENV}${env})
$(eval RESOURCE_ENV=${DEPLOY_ENV}${env})
.PHONY: domain
domain:
$(eval DEPLOY_ENV=production)
$(eval AZURE_SUBSCRIPTION=s165-teachingqualificationsservice-production)
$(eval RESOURCE_NAME_PREFIX=s165p01)
$(eval ENV_SHORT=pd)
$(eval ENV_TAG=prod)
domains:
$(eval include global_config/domains.sh)
ci: ## Run in automation environment
$(eval DISABLE_PASSCODE=true)
$(eval AUTO_APPROVE=-auto-approve)
$(eval SP_AUTH=true)
$(eval SKIP_AZURE_LOGIN=true)
set-azure-resource-group-tags: ##Tags that will be added to resource group on it's creation in ARM template
$(eval RG_TAGS=$(shell echo '{"Portfolio": "Early Years and Schools Group", "Parent Business":"Teacher Misconduct Unit", "Product" : "Refer Serious Misconduct", "Service Line": "Teaching Workforce", "Service": "Teacher Training and Qualifications", "Service Offering": "Refer Serious Misconduct", "Environment" : "$(ENV_TAG)"}' | jq . ))
set-azure-template-tag:
$(eval ARM_TEMPLATE_TAG=1.1.0)
.PHONY: read-keyvault-config
read-keyvault-config:
$(eval KEY_VAULT_NAME=$(shell jq -r '.key_vault_name' terraform/workspace_variables/$(DEPLOY_ENV).tfvars.json))
$(eval KEY_VAULT_SECRET_NAME=INFRASTRUCTURE)
read-deployment-config:
$(eval POSTGRES_DATABASE_NAME="$(RESOURCE_NAME_PREFIX)-rsm-$(DEPLOY_ENV)${var.app_suffix}-psql-db")
$(eval POSTGRES_SERVER_NAME="$(RESOURCE_NAME_PREFIX)-rsm-$(DEPLOY_ENV)${var.app_suffix}-psql.postgres.database.azure.com")
##@ Query parameter store to display environment variables. Requires Azure credentials
set-azure-account: ${environment}
echo "Logging on to ${AZURE_SUBSCRIPTION}"
az account set -s ${AZURE_SUBSCRIPTION}
.PHONY: install-fetch-config
install-fetch-config: ## Install the fetch-config script, for viewing/editing secrets in Azure Key Vault
[ ! -f bin/fetch_config.rb ] \
&& curl -s https://raw.githubusercontent.com/DFE-Digital/bat-platform-building-blocks/master/scripts/fetch_config/fetch_config.rb -o bin/fetch_config.rb \
&& chmod +x bin/fetch_config.rb \
|| true
edit-keyvault-secret: read-keyvault-config install-fetch-config set-azure-account
bin/fetch_config.rb -s azure-key-vault-secret:${KEY_VAULT_NAME}/${KEY_VAULT_SECRET_NAME} \
-e -d azure-key-vault-secret:${KEY_VAULT_NAME}/${KEY_VAULT_SECRET_NAME} -f yaml -c
create-keyvault-secret: read-keyvault-config install-fetch-config set-azure-account
bin/fetch_config.rb -s azure-key-vault-secret:${KEY_VAULT_NAME}/${KEY_VAULT_SECRET_NAME} \
-i -e -d azure-key-vault-secret:${KEY_VAULT_NAME}/${KEY_VAULT_SECRET_NAME} -f yaml -c
print-keyvault-secret: read-keyvault-config install-fetch-config set-azure-account
bin/fetch_config.rb -s azure-key-vault-secret:${KEY_VAULT_NAME}/${KEY_VAULT_SECRET_NAME} -f yaml
validate-keyvault-secret: read-keyvault-config install-fetch-config set-azure-account
bin/fetch_config.rb -s azure-key-vault-secret:${KEY_VAULT_NAME}/${KEY_VAULT_SECRET_NAME} -d quiet \
&& echo Data in ${KEY_VAULT_NAME}/${KEY_VAULT_SECRET_NAME} looks valid
terraform-init:
$(if $(IMAGE_TAG), , $(eval export IMAGE_TAG=main))
[[ "${SP_AUTH}" != "true" ]] && az account set -s $(AZURE_SUBSCRIPTION) || true
terraform -chdir=terraform init -backend-config workspace_variables/${DEPLOY_ENV}.backend.tfvars $(backend_config) -upgrade -reconfigure
terraform-plan: terraform-init
terraform -chdir=terraform plan -var-file workspace_variables/${DEPLOY_ENV}.tfvars.json
terraform-apply: terraform-init
terraform -chdir=terraform apply -var-file workspace_variables/${DEPLOY_ENV}.tfvars.json ${AUTO_APPROVE}
terraform-destroy: terraform-init
terraform -chdir=terraform destroy -var-file workspace_variables/${DEPLOY_ENV}.tfvars.json ${AUTO_APPROVE}
deploy-azure-resources: set-azure-account set-azure-template-tag set-azure-resource-group-tags# make dev deploy-azure-resources AUTO_APPROVE=1
$(if $(AUTO_APPROVE), , $(error can only run with AUTO_APPROVE))
az deployment sub create --name "resourcedeploy-rsm-$(shell date +%Y%m%d%H%M%S)" -l "West Europe" --template-uri "https://raw.githubusercontent.com/DFE-Digital/tra-shared-services/${ARM_TEMPLATE_TAG}/azure/resourcedeploy.json" \
--parameters "resourceGroupName=${RESOURCE_NAME_PREFIX}-rsm-${ENV_SHORT}-rg" 'tags=${RG_TAGS}' \
"tfStorageAccountName=${RESOURCE_NAME_PREFIX}rsmtfstate${ENV_SHORT}" "tfStorageContainerName=rsm-tfstate" \
"dbBackupStorageAccountName=${AZURE_BACKUP_STORAGE_ACCOUNT_NAME}" "dbBackupStorageContainerName=${AZURE_BACKUP_STORAGE_CONTAINER_NAME}" \
"keyVaultName=${RESOURCE_NAME_PREFIX}-rsm-${ENV_SHORT}-kv"
validate-azure-resources: set-azure-account set-azure-template-tag set-azure-resource-group-tags# make dev validate-azure-resources
az deployment sub create --name "resourcedeploy-rsm-$(shell date +%Y%m%d%H%M%S)" -l "West Europe" --template-uri "https://raw.githubusercontent.com/DFE-Digital/tra-shared-services/${ARM_TEMPLATE_TAG}/azure/resourcedeploy.json" \
--parameters "resourceGroupName=${RESOURCE_NAME_PREFIX}-rsm-${ENV_SHORT}-rg" 'tags=${RG_TAGS}' \
"tfStorageAccountName=${RESOURCE_NAME_PREFIX}rsmtfstate${ENV_SHORT}" "tfStorageContainerName=rsm-tfstate" \
"dbBackupStorageAccountName=${AZURE_BACKUP_STORAGE_ACCOUNT_NAME}" "dbBackupStorageContainerName=${AZURE_BACKUP_STORAGE_CONTAINER_NAME}" \
"keyVaultName=${RESOURCE_NAME_PREFIX}-rsm-${ENV_SHORT}-kv" \
--what-if
domain-azure-resources: set-azure-account set-azure-template-tag set-azure-resource-group-tags# make domain domain-azure-resources AUTO_APPROVE=1
$(if $(AUTO_APPROVE), , $(error can only run with AUTO_APPROVE))
az deployment sub create -l "West Europe" --template-uri "https://raw.githubusercontent.com/DFE-Digital/tra-shared-services/${ARM_TEMPLATE_TAG}/azure/resourcedeploy.json" \
--parameters "resourceGroupName=${RESOURCE_NAME_PREFIX}-rsmdomains-rg" 'tags=${RG_TAGS}' "environment=${DEPLOY_ENV}" \
"tfStorageAccountName=${RESOURCE_NAME_PREFIX}rsmdomainstf" "tfStorageContainerName=rsmdomains-tf" "keyVaultName=${RESOURCE_NAME_PREFIX}-rsmdomains-kv"
az-console: set-azure-account
az container exec \
--name=${RESOURCE_NAME_PREFIX}-rsm-${NAME_ENV}-wkr-cg \
--resource-group=${RESOURCE_NAME_PREFIX}-rsm-${RESOURCE_ENV}-rg \
--exec-command="bundle exec rails c ${CONSOLE_OPTIONS}-- --noautocomplete"
# AKS make config
.PHONY: aks-review
aks-review: test-cluster
$(if ${PR_NUMBER},,$(error Missing PR_NUMBER))
$(eval ENVIRONMENT=pr-${PR_NUMBER})
$(eval include global_config/review.sh)
.PHONY: aks-test
aks-test: test-cluster
$(eval include global_config/test.sh)
.PHONY: aks-preprod
aks-preprod: test-cluster
$(eval include global_config/preprod.sh)
.PHONY: aks-production
aks-production: production-cluster
$(eval include global_config/production.sh)
bin/terrafile: ## Install terrafile to manage terraform modules
curl -sL https://github.com/coretech/terrafile/releases/download/v${TERRAFILE_VERSION}/terrafile_${TERRAFILE_VERSION}_$$(uname)_$$(uname -m).tar.gz \
| tar xz -C ./bin terrafile
aks-set-azure-account:
[ "${SKIP_AZURE_LOGIN}" != "true" ] && az account set -s ${AZURE_SUBSCRIPTION} || true
composed-variables:
$(eval RESOURCE_GROUP_NAME=${AZURE_RESOURCE_PREFIX}-${SERVICE_SHORT}-${CONFIG_SHORT}-rg)
$(eval KEYVAULT_NAMES='("${AZURE_RESOURCE_PREFIX}-${SERVICE_SHORT}-${CONFIG_SHORT}-app-kv", "${AZURE_RESOURCE_PREFIX}-${SERVICE_SHORT}-${CONFIG_SHORT}-inf-kv")')
$(eval STORAGE_ACCOUNT_NAME=${AZURE_RESOURCE_PREFIX}${SERVICE_SHORT}${CONFIG_SHORT}tfsa)
$(eval LOG_ANALYTICS_WORKSPACE_NAME=${AZURE_RESOURCE_PREFIX}-${SERVICE_SHORT}-${CONFIG_SHORT}-log)
get-cluster-credentials: set-azure-account
az aks get-credentials --overwrite-existing -g ${CLUSTER_RESOURCE_GROUP_NAME} -n ${CLUSTER_NAME}
kubelogin convert-kubeconfig -l $(if ${GITHUB_ACTIONS},spn,azurecli)
test-cluster:
$(eval CLUSTER_RESOURCE_GROUP_NAME=s189t01-tsc-ts-rg)
$(eval CLUSTER_NAME=s189t01-tsc-test-aks)
production-cluster: ## Set up the production cluster variables for AKS
$(eval CLUSTER_RESOURCE_GROUP_NAME=s189p01-tsc-pd-rg)
$(eval CLUSTER_NAME=s189p01-tsc-production-aks)
set-what-if:
$(eval WHAT_IF=--what-if)
arm-deployment: composed-variables aks-set-azure-account
$(if ${DISABLE_KEYVAULTS},, $(eval KV_ARG=keyVaultNames=${KEYVAULT_NAMES}))
$(if ${ENABLE_KV_DIAGNOSTICS}, $(eval KV_DIAG_ARG=enableDiagnostics=${ENABLE_KV_DIAGNOSTICS} logAnalyticsWorkspaceName=${LOG_ANALYTICS_WORKSPACE_NAME}),)
az deployment sub create --name "resourcedeploy-tsc-$(shell date +%Y%m%d%H%M%S)" \
-l "${REGION}" --template-uri "https://raw.githubusercontent.com/DFE-Digital/tra-shared-services/${ARM_TEMPLATE_TAG}/azure/resourcedeploy.json" \
--parameters "resourceGroupName=${RESOURCE_GROUP_NAME}" 'tags=${RG_TAGS}' \
"tfStorageAccountName=${STORAGE_ACCOUNT_NAME}" "tfStorageContainerName=terraform-state" \
${KV_ARG} \
${KV_DIAG_ARG} \
"enableKVPurgeProtection=${KV_PURGE_PROTECTION}" \
${WHAT_IF}
deploy-arm-resources: arm-deployment ## Validate ARM resource deployment. Usage: make domains validate-arm-resources
validate-arm-resources: set-what-if arm-deployment ## Validate ARM resource deployment. Usage: make domains validate-arm-resources
aks-terraform-init: composed-variables bin/terrafile aks-set-azure-account
$(if ${DOCKER_IMAGE_TAG}, , $(eval DOCKER_IMAGE_TAG=main))
./bin/terrafile -p terraform/application/vendor/modules -f terraform/application/config/$(CONFIG)_Terrafile
terraform -chdir=terraform/application init -upgrade -reconfigure \
-backend-config=resource_group_name=${RESOURCE_GROUP_NAME} \
-backend-config=storage_account_name=${STORAGE_ACCOUNT_NAME} \
-backend-config=key=${ENVIRONMENT}_kubernetes.tfstate
$(eval export TF_VAR_environment=${ENVIRONMENT})
$(eval export TF_VAR_resource_group_name=${RESOURCE_GROUP_NAME})
$(eval export TF_VAR_azure_resource_prefix=${AZURE_RESOURCE_PREFIX})
$(eval export TF_VAR_config=${CONFIG})
$(eval export TF_VAR_config_short=${CONFIG_SHORT})
$(eval export TF_VAR_service_name=${SERVICE_NAME})
$(eval export TF_VAR_service_short=${SERVICE_SHORT})
$(eval export TF_VAR_docker_image=${DOCKER_REPOSITORY}:${DOCKER_IMAGE_TAG})
aks-terraform-plan: aks-terraform-init
terraform -chdir=terraform/application plan -var-file "config/${CONFIG}.tfvars.json"
aks-terraform-apply: aks-terraform-init
terraform -chdir=terraform/application apply -var-file "config/${CONFIG}.tfvars.json" ${AUTO_APPROVE}
aks-terraform-destroy: aks-terraform-init
terraform -chdir=terraform/application destroy -var-file "config/${CONFIG}.tfvars.json" ${AUTO_APPROVE}
aks-domain-azure-resources: set-azure-account set-azure-template-tag set-azure-resource-group-tags# make domain domain-azure-resources AUTO_APPROVE=1
$(if $(AUTO_APPROVE), , $(error can only run with AUTO_APPROVE))
az deployment sub create -l "West Europe" --template-uri "https://raw.githubusercontent.com/DFE-Digital/tra-shared-services/${ARM_TEMPLATE_TAG}/azure/resourcedeploy.json" \
--parameters "resourceGroupName=${RESOURCE_NAME_PREFIX}-rsmdomains-rg" 'tags=${RG_TAGS}' "environment=${DEPLOY_ENV}" \
"tfStorageAccountName=${RESOURCE_NAME_PREFIX}rsmdomainstf" "tfStorageContainerName=rsmdomains-tf" "keyVaultName=${RESOURCE_NAME_PREFIX}-rsmdomains-kv"
domains-infra-init: bin/terrafile domains composed-variables set-azure-account
./bin/terrafile -p terraform/domains/infrastructure/vendor/modules -f terraform/domains/infrastructure/config/zones_Terrafile
terraform -chdir=terraform/domains/infrastructure init -reconfigure -upgrade \
-backend-config=resource_group_name=${RESOURCE_GROUP_NAME} \
-backend-config=storage_account_name=${STORAGE_ACCOUNT_NAME} \
-backend-config=key=domains_infrastructure.tfstate
domains-infra-plan: domains domains-infra-init ## Terraform plan for DNS infrastructure (DNS zone and front door). Usage: make domains-infra-plan
terraform -chdir=terraform/domains/infrastructure plan -var-file config/zones.tfvars.json
domains-infra-apply: domains domains-infra-init ## Terraform apply for DNS infrastructure (DNS zone and front door). Usage: make domains-infra-apply
terraform -chdir=terraform/domains/infrastructure apply -var-file config/zones.tfvars.json ${AUTO_APPROVE}
domains-init: bin/terrafile domains composed-variables set-azure-account
./bin/terrafile -p terraform/domains/environment_domains/vendor/modules -f terraform/domains/environment_domains/config/${CONFIG}_Terrafile
terraform -chdir=terraform/domains/environment_domains init -upgrade -reconfigure \
-backend-config=resource_group_name=${RESOURCE_GROUP_NAME} \
-backend-config=storage_account_name=${STORAGE_ACCOUNT_NAME} \
-backend-config=key=${ENVIRONMENT}.tfstate
domains-plan: domains-init ## Terraform plan for DNS environment domains. Usage: make development domains-plan
terraform -chdir=terraform/domains/environment_domains plan -var-file config/${CONFIG}.tfvars.json
domains-apply: domains-init ## Terraform apply for DNS environment domains. Usage: make development domains-apply
terraform -chdir=terraform/domains/environment_domains apply -var-file config/${CONFIG}.tfvars.json ${AUTO_APPROVE}