Merge pull request #356 from DFE-Digital/ci-cd-domains

CI-CD for domains
DFE-Digital · Jan 22, 2025 · db5d635 · db5d635
2 parents 15fc1d6 + cb19a92
commit db5d635
Show file tree

Hide file tree

Showing 2 changed files with 113 additions and 2 deletions.
diff --git a/templates/new_service/.github/workflows/build-and-deploy.yml b/templates/new_service/.github/workflows/build-and-deploy.yml
@@ -124,6 +124,21 @@ jobs:
         environment: [development,production]
 
     steps:
+    - uses: azure/login@v2
+      with:
+        client-id:  ${{ secrets.AZURE_CLIENT_ID  }}
+        tenant-id:  ${{ secrets.AZURE_TENANT_ID   }}
+        subscription-id:  ${{ secrets.AZURE_SUBSCRIPTION_ID   }}
+
+    - name: Fetch secrets from key vault
+      uses: azure/CLI@v2
+      id: keyvault-secret
+      with:
+        inlineScript: |
+          SLACK_WEBHOOK=$(az keyvault secret show --name "SLACK-WEBHOOK" --vault-name "${{ secrets.INF_KEY_VAULT }}" --query "value" -o tsv)
+          echo "::add-mask::$SLACK_WEBHOOK"
+          echo "SLACK_WEBHOOK=$SLACK_WEBHOOK" >> $GITHUB_OUTPUT
+
     - name: Deploy app to ${{ matrix.environment }}
       id: deploy_app
       uses: DFE-Digital/github-actions/deploy-to-aks@master
@@ -136,7 +151,7 @@ jobs:
         sha: ${{ needs.build.outputs.docker-image-tag }}
         terraform-base: ${{ env.TERRAFORM_BASE }}
         healthcheck: ${{ env.HEALTHCHECK_CMD }}
-        slack-webhook: ${{ secrets.SLACK_WEBHOOK }}
+        slack-webhook: ${{ steps.keyvault-secret.outputs.SLACK_WEBHOOK }}
         smoke-test: true
 #        gcp-wip: ${{ vars.GCP_WIP }}
 #        gcp-project-id: ${{ vars.GCP_PROJECT_ID }}
@@ -153,6 +168,21 @@ jobs:
       pull-requests: write
 
     steps:
+    - uses: azure/login@v2
+      with:
+        client-id:  ${{ secrets.AZURE_CLIENT_ID  }}
+        tenant-id:  ${{ secrets.AZURE_TENANT_ID   }}
+        subscription-id:  ${{ secrets.AZURE_SUBSCRIPTION_ID   }}
+
+    - name: Fetch secrets from key vault
+      uses: azure/CLI@v2
+      id: keyvault-secret
+      with:
+        inlineScript: |
+          SLACK_WEBHOOK=$(az keyvault secret show --name "SLACK-WEBHOOK" --vault-name "${{ secrets.INF_KEY_VAULT }}" --query "value" -o tsv)
+          echo "::add-mask::$SLACK_WEBHOOK"
+          echo "SLACK_WEBHOOK=$SLACK_WEBHOOK" >> $GITHUB_OUTPUT
+
     - name: Deploy app to ${{ inputs.environment }}
       id: deploy_manual
       uses: DFE-Digital/github-actions/deploy-to-aks@master
@@ -165,8 +195,86 @@ jobs:
         sha: ${{ inputs.docker-image-tag }}
         terraform-base: ${{ env.TERRAFORM_BASE }}
         healthcheck: ${{ env.HEALTHCHECK_CMD }}
-        slack-webhook: ${{ secrets.SLACK_WEBHOOK }}
+        slack-webhook: ${{ steps.keyvault-secret.outputs.SLACK_WEBHOOK }}
         smoke-test: true
         db-seed: ${{ inputs.environment == 'review' && 'true' || 'false' }}
 #        gcp-wip: ${{ vars.GCP_WIP }}
 #        gcp-project-id: ${{ vars.GCP_PROJECT_ID }}
+
+  deploy_domains_infra:
+    name: Deploy Domains Infrastructure
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    concurrency: deploy_production
+    needs: [deploy]
+    environment:
+      name: production
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: azure/login@v2
+        with:
+          client-id:  ${{ secrets.AZURE_CLIENT_ID  }}
+          tenant-id:  ${{ secrets.AZURE_TENANT_ID   }}
+          subscription-id:  ${{ secrets.AZURE_SUBSCRIPTION_ID   }}
+
+      - name: Fetch secrets from key vault
+        uses: azure/CLI@v2
+        id: keyvault-secret
+        with:
+          inlineScript: |
+            SLACK_WEBHOOK=$(az keyvault secret show --name "SLACK-WEBHOOK" --vault-name "${{ secrets.INF_KEY_VAULT }}" --query "value" -o tsv)
+            echo "::add-mask::$SLACK_WEBHOOK"
+            echo "SLACK_WEBHOOK=$SLACK_WEBHOOK" >> $GITHUB_OUTPUT
+
+      - name: Deploy Domains Infrastructure
+        id: deploy_domains_infra
+        uses: DFE-Digital/github-actions/deploy-domains-infra@master
+        with:
+          azure-client-id:  ${{ secrets.AZURE_CLIENT_ID  }}
+          azure-tenant-id:  ${{ secrets.AZURE_TENANT_ID   }}
+          azure-subscription-id:  ${{ secrets.AZURE_SUBSCRIPTION_ID   }}
+          slack-webhook: ${{ steps.keyvault-secret.outputs.SLACK_WEBHOOK }}
+
+  deploy_domains_env:
+    name: Deploy Domains to ${{ matrix.domain_environment }} environment
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    concurrency: deploy_${{ matrix.domain_environment }}
+    needs: [deploy_domains_infra]
+    strategy:
+      max-parallel: 1
+      matrix:
+        domain_environment: [development, production]
+    environment:
+      name: production
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: azure/login@v2
+        with:
+          client-id:  ${{ secrets.AZURE_CLIENT_ID  }}
+          tenant-id:  ${{ secrets.AZURE_TENANT_ID   }}
+          subscription-id:  ${{ secrets.AZURE_SUBSCRIPTION_ID   }}
+
+      - name: Fetch secrets from key vault
+        uses: azure/CLI@v2
+        id: keyvault-secret
+        with:
+          inlineScript: |
+            SLACK_WEBHOOK=$(az keyvault secret show --name "SLACK-WEBHOOK" --vault-name "${{ secrets.INF_KEY_VAULT }}" --query "value" -o tsv)
+            echo "::add-mask::$SLACK_WEBHOOK"
+            echo "SLACK_WEBHOOK=$SLACK_WEBHOOK" >> $GITHUB_OUTPUT
+
+      - name: Deploy Domains Environment
+        id: deploy_domains_env
+        uses: DFE-Digital/github-actions/deploy-domains-env@master
+        with:
+          azure-client-id:  ${{ secrets.AZURE_CLIENT_ID  }}
+          azure-tenant-id:  ${{ secrets.AZURE_TENANT_ID   }}
+          azure-subscription-id:  ${{ secrets.AZURE_SUBSCRIPTION_ID   }}
+          environment: ${{ matrix.domain_environment }}
+          healthcheck: healthcheck/all
+          slack-webhook: ${{ steps.keyvault-secret.outputs.SLACK_WEBHOOK }}
diff --git a/templates/new_service/terraform/domains/environment_domains/output.tf b/templates/new_service/terraform/domains/environment_domains/output.tf
@@ -0,0 +1,3 @@
+output "hosted_zones" {
+  value = keys(var.hosted_zone)
+}