Skip to content

Commit b661b25

Browse files
bill-buchanbill-buchan
authored
Merge pull request #237 from ministryofjustice/DBA-667
Dba 667
2 parents 1d46450 + e60d876 commit b661b25

10 files changed

+939
-74
lines changed

‎.github/workflows/oracle-db-backup.yml

+213-56
Large diffs are not rendered by default.

‎.github/workflows/oracle-db-delete-dbids-not-in-use.yml

+388
Large diffs are not rendered by default.

‎.github/workflows/oracle-db-validate-chunks.yml

+121
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
name: "Oracle: Validate Chunks"
2+
run-name: "Oracle: ${{ github.event_name == 'workflow_dispatch' && format('{0}_{1}_{2}', github.event.inputs.TargetEnvironment, github.event.inputs.Period, github.event.inputs.TargetHost) }}_validate_chunks"
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
TargetEnvironment:
7+
description: "Target environment"
8+
required: true
9+
type: string
10+
TargetHost:
11+
description: "Backup target host"
12+
required: true
13+
type: string
14+
VerboseOutput:
15+
description: "Verbose Output level"
16+
required: false
17+
type: string
18+
default: ""
19+
workflow_call:
20+
inputs:
21+
TargetEnvironment:
22+
description: "Target environment"
23+
required: true
24+
type: string
25+
TargetHost:
26+
description: "Backup target host"
27+
required: true
28+
type: string
29+
VerboseOutput:
30+
description: "Verbose Output level"
31+
required: false
32+
type: string
33+
default: ""
34+
35+
# Allow permissions on repository and docker image and OIDC token
36+
permissions:
37+
contents: read
38+
packages: read
39+
id-token: write # This is required for requesting the JWT
40+
41+
jobs:
42+
# Start deployment container job based on the build delius-ansible-aws image
43+
deployment:
44+
name: oracle-backup
45+
environment: ${{ github.event.inputs.TargetEnvironment }}
46+
runs-on: ubuntu-latest
47+
container:
48+
image: ghcr.io/ministryofjustice/hmpps-delius-operational-automation:0.41.0
49+
timeout-minutes: 1440
50+
env:
51+
validate_command: ansible-playbook operations/playbooks/oracle_backup/validate.yml
52+
inventory: inventory/ansible
53+
RmanTarget: "${{ github.event.inputs.TargetHost }}"
54+
TargetEnvironment: "${{ github.event.inputs.TargetEnvironment }}"
55+
SSMParameter: "/oracle-backups/${{ github.event.inputs.TargetHost }}"
56+
ansible_config: operations/playbooks/ansible.cfg
57+
continue-on-error: false
58+
steps:
59+
60+
- name: Checkout hmpps-delius-operation-automation
61+
uses: actions/checkout@v4
62+
with:
63+
sparse-checkout-cone-mode: false
64+
sparse-checkout: |
65+
playbooks/oracle_backup
66+
playbooks/ansible.cfg
67+
path: operations
68+
ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.SourceCodeVersion || 'main' }}
69+
fetch-depth: 0
70+
71+
- name: Checkout Ansible Inventory From modernisation-platform-configuration-management
72+
uses: actions/checkout@v4
73+
with:
74+
repository: ministryofjustice/modernisation-platform-configuration-management
75+
sparse-checkout-cone-mode: false
76+
sparse-checkout: |
77+
ansible/hosts
78+
ansible/group_vars
79+
path: inventory
80+
ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.SourceConfigVersion || 'main' }}
81+
fetch-depth: 0
82+
83+
- name: Checkout Ansible Required Roles From modernisation-platform-configuration-management
84+
uses: actions/checkout@v4
85+
with:
86+
repository: ministryofjustice/modernisation-platform-configuration-management
87+
sparse-checkout-cone-mode: false
88+
sparse-checkout: |
89+
ansible/roles/secretsmanager-passwords
90+
ansible/roles/get-modernisation-platform-facts
91+
path: roles
92+
ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.SourceConfigVersion || 'main' }}
93+
fetch-depth: 0
94+
95+
- name: Configure AWS Credentials
96+
id: login-aws
97+
uses: aws-actions/configure-aws-credentials@v4
98+
with:
99+
role-to-assume: "arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/modernisation-platform-oidc-cicd"
100+
role-session-name: "hmpps-delius-operational-automation-${{ github.run_number }}"
101+
aws-region: "eu-west-2"
102+
103+
- name: Check And Set Backup Runtime
104+
id: check-and-set-backup-runtime
105+
shell: bash
106+
run: |
107+
RUNTIME=$(aws ssm get-parameter --region ${AWS_REGION} --name "$SSMParameter" --query "Parameter.Value" --output text 2>&1) || true
108+
PHASE=$(echo $RUNTIME | jq -r '.Phase')
109+
STATUS=$(echo $RUNTIME | jq -r '.Status')
110+
echo "Backup Phase and Status: $PHASE $STATUS"
111+
if [[ $PHASE != 'Backup' ]] || [[ $STATUS != 'Success' ]]; then
112+
echo "Backup must be successful before running Chunk Validation." && exit 1
113+
fi
114+
aws ssm put-parameter --region ${AWS_REGION} --name "$SSMParameter" --type String --overwrite \
115+
--value "{\"Phase\":\"Validate Chunks\",\"Status\":\"Initializing\",\"Message\":\"Running on $RmanTarget\",\"TargetEnvironment\":\"$TargetEnvironment\",\"RmanTarget\":\"$RmanTarget\"}" \
116+
117+
- name: Start Ansible Validate And Fix Absent Chunks
118+
run: |
119+
export ANSIBLE_CONFIG=$ansible_config
120+
ln -s $PWD/roles/ansible/roles $PWD/operations/playbooks/oracle_backup/roles
121+
$validate_command -i $inventory -e ansible_aws_ssm_bucket_name=${{ vars.ANSIBLE_AWS_SSM_BUCKET_NAME }} -e rman_target=$RmanTarget -e fix_absent_chunks=yes ${{ github.event.inputs.VerboseOutput }}

‎playbooks/oracle_backup/backup.yml

+21-3
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,10 @@
99
become_method: sudo
1010

1111
tasks:
12+
- name: Show Inputs
13+
debug:
14+
msg: "{{ json_inputs | string }}"
15+
1216
- name: RMAN script
1317
block:
1418
- name: Set database_global_database
@@ -62,6 +66,11 @@
6266
catalog_options: "-n Y -c {{ catalog }}"
6367
when: (catalog is defined)
6468

69+
- name: Set SSM Parameter used for Runtime details when variable is not null
70+
set_fact:
71+
ssm_parameter_path: '-s "{{ ssm_parameter }}"'
72+
when: (ssm_parameter is defined)
73+
6574
- name: Set backup duration target when variable is not null
6675
set_fact:
6776
duration_options: "-m {{ rman_level_0_backup_duration_target }}"
@@ -90,6 +99,15 @@
9099
enable_trace_flag: "-e Y"
91100
when: enable_trace | default(false) | bool
92101

102+
# The quotes in the JSON inputs can get messed up by unwanted shell interpretation.
103+
# To avoid this we send the JSON as an encoded string to be decoded by the shell script.
104+
- name: Enable Repository Dispatch Event if supplied
105+
set_fact:
106+
repository_dispatch_flag: "-r {{ repository_dispatch }} -j {{ json_inputs | b64encode }}"
107+
when:
108+
- repository_dispatch is defined
109+
- json_inputs is defined
110+
93111
- block:
94112
- name: Get Current RMAN Retention
95113
script: get_rman_retention.sh {{ database_primary_sid | default(database_standby_sid) }}
@@ -133,16 +151,16 @@
133151

134152
- name: Create RMAN Command
135153
set_fact:
136-
rman_command: "/home/oracle/admin/rman_scripts/rman_backup.sh -d {{ database_primary_sid | default(database_standby_sid) }} -g {{ database_global_database }} {{ rman_options }} {{ duration_options|default() }} {{ uncompress_options|default() }} {{ catalog_options|default() }} {{ enable_trace_flag|default() }}"
154+
rman_command: "/home/oracle/admin/rman_scripts/rman_backup.sh -d {{ database_primary_sid | default(database_standby_sid) }} -g {{ database_global_database }} {{ rman_options }} {{ ssm_parameter_path | default() }} {{ duration_options|default() }} {{ uncompress_options|default() }} {{ catalog_options|default() }} {{ enable_trace_flag|default() }} {{ repository_dispatch_flag|default() }}"
137155

138156
- name: Show RMAN Command
139157
debug:
140158
msg: "About to run: {{ rman_command }}"
141159

142-
- name: Running RMAN script
160+
- name: Running RMAN script in Background
143161
shell: "{{ rman_command }}"
144162
async: "{{ allowable_duration|default(28800) }}"
145-
poll: 60
163+
poll: 0
146164
environment:
147165
ASSUME_ROLE_NAME: "{{ secretsmanager_passwords['catalog'].assume_role_name | default() }}"
148166
SECRET_ACCOUNT_ID: "{{ account_ids[secretsmanager_passwords['catalog'].account_name] | default() }}"

‎playbooks/oracle_backup/files/get_rman_backups.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ export NUM_OF_DAYS_BACK_TO_VALIDATE="${1:-0}"
1919
if [[ "${CATALOG}" != "NOCATALOG" ]]
2020
then
2121
get_rman_password
22-
CONNECT_TO_CATALOG="connect catalog ${CATALOG_CREDENTIALS}"
22+
CONNECT_TO_CATALOG="connect catalog rcvcatowner/${RMANPASS}@${CATALOG}"
2323
fi
2424

2525
# Get list of RMAN backups from the Catalog; merge the Availability and Handle Lines

‎playbooks/oracle_backup/files/list_github_environments.py

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
import requests
2+
import os
3+
4+
token = os.getenv('GITHUB_TOKEN')
5+
repository = os.getenv('GITHUB_REPOSITORY')
6+
7+
url = f"https://api.github.com/repos/{repository}/environments"
8+
headers = {
9+
'Authorization': f'token {token}',
10+
'Accept': 'application/vnd.github+json',
11+
}
12+
13+
response = requests.get(url, headers=headers)
14+
environments = response.json()
15+
16+
for env in environments['environments']:
17+
print(env['name'])

0 commit comments

Comments
 (0)