diff --git a/.github/workflows/jenkins-deployment.yml b/.github/workflows/jenkins-deployment.yml new file mode 100644 index 00000000..355a3821 --- /dev/null +++ b/.github/workflows/jenkins-deployment.yml @@ -0,0 +1,183 @@ +name: Jenkins Deployment Test + +env: + TF_VAR_fully_qualified_domain_name: ${{ secrets.CI_FULLY_QUALIFIED_DOMAIN_NAME }} + STATE_BUCKET_NAME: ${{ secrets.TF_REMOTE_STATE_BUCKET_NAME }} + +# Triggers on any changes to modules/jenkins +on: + pull_request: # change to pull_request before publish + paths: + - 'modules/jenkins/**' + # - '.github/workflows/**' + workflow_dispatch: + +permissions: + id-token: write + contents: read + issues: write + +jobs: + # Plan: Generates a tf plan of the deployment and posts it as a comment in the triggering PR + plan: + runs-on: ubuntu-latest + environment: aws-ci + defaults: + run: + working-directory: modules/jenkins/examples/complete + steps: + # Retrieve necessary AWS permissions + - name: configure aws credentials + uses: aws-actions/configure-aws-credentials@v1.7.0 + with: + role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }} + role-session-name: GitHub_to_AWS_via_FederatedOIDC + aws-region: ${{ vars.AWS_REGION }} + # Checkout Repository + - name: Checkout Git Repository + uses: actions/checkout@v3.0.0 + with: + ref: ${{ github.ref }} + # Install Terraform + - name: Install Terraform + uses: hashicorp/setup-terraform@v1 + with: + terraform_version: 1.6.3 + # Inject remote state block + # This is required to enable remote state + - name: Inject Remote State + run: | + cat > backend.tf << EOF + terraform { + backend "s3" { + } + } + # Initialize S3 remote state + # The triggering commit hash is used as the key of the remote state + - name: Terraform init + id: init + run: | + terraform init -backend-config="bucket=${STATE_BUCKET_NAME}" -backend-config="key=${{ github.sha }}" -backend-config="region=${{ vars.AWS_REGION }}" + + # Generate tf plan + - name: Terraform plan + id: plan + run: | + terraform plan -no-color + + # Post the tf plan as a comment in the triggering PR + - name: Update Pull Request + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.BOT_PAT }} + script: | + const output = #### Terraform Plan 📖\`${{ steps.plan.outcome }}\` +
Show Plan + + \`\`\`\n + ${{ steps.plan.outputs.stdout }} + \`\`\` + +
+ + *Pushed by: @${{ github.actor }}, Action: \`${{ github.event_name }}\`*`; + + github.rest.issues.createComment({ + issue_number: context.issue.number, + owner: context.repo.owner, + repo: context.repo.repo, + body: output + }) + + # Deploy: After manual approval, deploys the solution to the designated AWS account + deploy: + needs: [ plan ] + environment: aws-ci + runs-on: ubuntu-latest + defaults: + run: + working-directory: modules/jenkins/examples/complete + steps: + # Checkout Repository + - name: Checkout Git Repository + uses: actions/checkout@v3.0.0 + with: + ref: ${{ github.ref }} + # Retrieve necessary AWS permissions + - name: configure aws credentials + uses: aws-actions/configure-aws-credentials@v1.7.0 + with: + role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }} + role-session-name: GitHub_to_AWS_via_FederatedOIDC + aws-region: ${{ vars.AWS_REGION }} + # Install Terraform + - name: Install Terraform + uses: hashicorp/setup-terraform@v1 + with: + terraform_version: 1.6.3 + # Inject remote state block + # This is required to enable remote state + - name: Inject Remote State + run: | + cat > backend.tf << EOF + terraform { + backend "s3" { + } + } + # Initialize S3 remote state + # The triggering commit hash is used as the key of the remote state + - name: Terraform init + id: init + run: | + terraform init -backend-config="bucket=${STATE_BUCKET_NAME}" -backend-config="key=${{ github.sha }}" -backend-config="region=${{ vars.AWS_REGION }}" + + # Deploys the solution + - name: Terraform apply + run: | + terraform apply -auto-approve + + # Destroy: After manual approval, destroy the solution in the designated AWS account + destroy: + needs: [ deploy ] + runs-on: ubuntu-latest + environment: aws-ci + defaults: + run: + working-directory: modules/jenkins/examples/complete + steps: + # Checkout Repository + - name: Checkout Git Repository + uses: actions/checkout@v3.0.0 + with: + ref: ${{ github.ref }} + # Retrieve necessary AWS permissions + - name: configure aws credentials + uses: aws-actions/configure-aws-credentials@v1.7.0 + with: + role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }} + role-session-name: GitHub_to_AWS_via_FederatedOIDC + aws-region: ${{ vars.AWS_REGION }} + # Install Terraform + - name: Install Terraform + uses: hashicorp/setup-terraform@v1 + with: + terraform_version: 1.6.3 + # Inject remote state block + # This is required to enable remote state + - name: Inject Remote State + run: | + cat > backend.tf << EOF + terraform { + backend "s3" { + } + } + # Initialize S3 remote state + # The triggering commit hash is used as the key of the remote state + - name: Terraform init + id: init + run: | + terraform init -backend-config="bucket=${STATE_BUCKET_NAME}" -backend-config="key=${{ github.sha }}" -backend-config="region=${{ vars.AWS_REGION }}" + # Destroys the solution + - name: Terraform Destroy + run: | + terraform destroy -auto-approve diff --git a/modules/jenkins/examples/complete/versions.tf b/modules/jenkins/examples/complete/versions.tf index a49b9edb..03a42aae 100644 --- a/modules/jenkins/examples/complete/versions.tf +++ b/modules/jenkins/examples/complete/versions.tf @@ -4,7 +4,7 @@ terraform { required_providers { aws = { source = "hashicorp/aws" - version = "5.66.0" + version = "5.70.0" } } } diff --git a/modules/jenkins/examples/complete/vpc.tf b/modules/jenkins/examples/complete/vpc.tf index 532e5edc..d5d1dbb9 100644 --- a/modules/jenkins/examples/complete/vpc.tf +++ b/modules/jenkins/examples/complete/vpc.tf @@ -109,9 +109,9 @@ resource "aws_route_table" "private_rt" { # route to the internet through NAT gateway resource "aws_route" "private_rt_nat_gateway" { - route_table_id = aws_route_table.private_rt.id - destination_cidr_block = "0.0.0.0/0" - nat_gateway_id = aws_nat_gateway.nat_gateway.id + route_table_id = aws_route_table.private_rt.id + destination_cidr_block = "0.0.0.0/0" + nat_gateway_id = aws_nat_gateway.nat_gateway.id } resource "aws_route_table_association" "private_rt_asso" {