refactor: run instance-manager workflow on PR for feature branches

.env.example

@@ -1,4 +1,6 @@
-ENVIRONMENT=feature
+ENVIRONMENT=<dev|production|etc>
+# Can be either "dev" or "prod"
+CLASSIFICATION=dev
 
 KUBE_CONFIG_FILE=/kubernetes/config
 

.github/workflows/cicd.yaml → .github/workflows/build-test-deploy.yaml

@@ -1,20 +1,25 @@
-name: Tests, build and deploy
+name: Build, test and deploy
 
 on:
  push:
  branches:
  - master
- - feature/**
  tags:
  - v*.*.*
 
  pull_request:
+ types: [opened, reopened, synchronize, labeled]
 
  workflow_dispatch:
 
+# Cancel previous runs of the same workflow and PR number or branch/tag
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+ cancel-in-progress: true
+
 jobs:
  call-workflow:
- uses: dhis2-sre/gha-workflows/.github/workflows/instance-manager.yaml@v0.8.0
+ uses: dhis2-sre/gha-workflows/.github/workflows/im-build-test-deploy.yaml@master
  with:
  RUN_PID_1_TEST: false
  PROCESS_NAME: im-inspector

.github/workflows/delete-env.yaml

@@ -0,0 +1,18 @@
+name: Delete deployed environment
+
+on:
+ pull_request:
+ types: [closed]
+
+# Cancel previous runs of the same workflow and PR number or branch/tag
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+ cancel-in-progress: true
+
+jobs:
+ call-workflow:
+ uses: dhis2-sre/gha-workflows/.github/workflows/im-delete-env.yaml@master
+ secrets:
+ AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+ AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+ KUBECONFIG: ${{ secrets.KUBECONFIG }}

.sops.yaml

@@ -0,0 +1,7 @@
+# creation rules are evaluated sequentially, the first match wins
+creation_rules:
+ - path_regex: 'helm/data/secrets/prod/.*\.yaml$'
+ kms: 'arn:aws:kms:eu-central-1:767224633206:alias/im-helm-prod-secrets'
+
+ - path_regex: 'helm/data/secrets/.*/.*\.yaml$'
+ kms: 'arn:aws:kms:eu-central-1:767224633206:alias/im-helm-nonprod-secrets'

helm/chart/values.yaml

@@ -4,7 +4,8 @@
 
 replicaCount: 1
 
-deployableNamespaces: []
+deployableNamespaces:
+ - whoami
 
 rabbitMq:
  host: rabbitmq.instance-manager.svc

helm/data/secrets/dev/rabbitmq.yaml

@@ -3,9 +3,9 @@ auth:
  password: ENC[AES256_GCM,data:2cfFKSeLGeNL2A+drPRWFw==,iv:rpinAwg6GMoBg4nPInDU02fVZuXqjiCA6sTobLlmI6Q=,tag:igIi88GhtJmi5NtnoHVuHQ==,type:str]
 sops:
  kms:
- - arn: arn:aws:kms:eu-central-1:767224633206:key/mrk-f5d88b4c53ec4100acd9c8ae3bde0a65
- created_at: "2021-10-05T05:06:49Z"
- enc: AQICAHhXq0BmrdaY1Tzk4VwL7hDRIr4Zx4dXQZOaXDZfdG+52gGh7L5ZQ7QvJP1nzDGXKM39AAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMI3BSBxiv+yfsEceWAgEQgDtZO45JHepdwU+O5EAEULrG7PeNtVf2LB0ygL49cWE9ZZQ62BwntxrfTbkimCHx8F/9uums1xVQIbWUVA==
+ - arn: arn:aws:kms:eu-central-1:767224633206:alias/im-helm-nonprod-secrets
+ created_at: "2023-07-11T11:59:13Z"
+ enc: AQICAHh6/b3MMjGJDucJ3SNZVUyEw3mmAeUTjW85E+vNYuerdAEn2dWGA1x961DiSUuLLRZlAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMr8T0SxnAeIgbwSXpAgEQgDvuoNmJ1VaWnTzOxOvWmaFKp8Qt0ZZurRahElQ1hDkDzHJMPJmsprmiP290uykAG6w7rttGlLDxrFzTtw==
  aws_profile: ""
  gcp_kms: []
  azure_kv: []

helm/data/secrets/dev/values.yaml

@@ -5,9 +5,9 @@ rabbitMq:
  password: ENC[AES256_GCM,data:+8fEyMu2oGB3cxUOcKuJlg==,iv:Jden+8Pyw6Hfsg4leZxYc2TRjL/u/c9N1NPgRfSDglk=,tag:oMn1wDldE8wW67VI0REBlg==,type:str]
 sops:
  kms:
- - arn: arn:aws:kms:eu-central-1:767224633206:key/mrk-f5d88b4c53ec4100acd9c8ae3bde0a65
- created_at: "2021-10-05T04:53:50Z"
- enc: AQICAHhXq0BmrdaY1Tzk4VwL7hDRIr4Zx4dXQZOaXDZfdG+52gEsOPTGzfmDjx1qdGVp7vCNAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQM9TC+U+hQDZwpaYUfAgEQgDt3B4bAicuMgpXNWWAzk9whB29RD1dIRlLmUtaDsQA6HgZFCPg+5xNivTmvRRnI609e8SP2fMhLqWnbXw==
+ - arn: arn:aws:kms:eu-central-1:767224633206:alias/im-helm-nonprod-secrets
+ created_at: "2023-07-12T09:16:37Z"
+ enc: AQICAHh6/b3MMjGJDucJ3SNZVUyEw3mmAeUTjW85E+vNYuerdAFdYRFzbjEvYr9+EjVY4PKkAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMpgqGgAx0+NVwiQwFAgEQgDuDXw9dcYR/9/4n5rWO7o7wWXQYGfpr/6SVcqa7+3aStm/R+w0sqKPSjcZj9byCvdbELsK7txazwsdk/Q==
  aws_profile: ""
  gcp_kms: []
  azure_kv: []

helm/data/secrets/feature

@@ -0,0 +1 @@
+dev

helm/data/secrets/prod/rabbitmq.yaml

@@ -3,9 +3,9 @@ auth:
  password: ENC[AES256_GCM,data:jP1g2JTglH98cbR7IgTT1iLaQ2+oZdkkahzMA0Jr9zE=,iv:SWE8TgFENVCwxumMs/CbDtbwJp7CfCHJ9NBLfqS9yqk=,tag:4ZBYBAn7y42vXcv4+8Ag7g==,type:str]
 sops:
  kms:
- - arn: arn:aws:kms:eu-central-1:767224633206:key/mrk-f5d88b4c53ec4100acd9c8ae3bde0a65
- created_at: "2021-10-05T05:12:25Z"
- enc: AQICAHhXq0BmrdaY1Tzk4VwL7hDRIr4Zx4dXQZOaXDZfdG+52gE1pHSI1BuNPDLutSGXqKxgAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQM88vXhoswJEdtpd5+AgEQgDuBR2MqL7aBoh3sXhHA8cMP5lBrM4ubYOwUeBfcsn0PpI8s/XUb/9iNHz4wK67l0tAgOoON+HeVAyU76g==
+ - arn: arn:aws:kms:eu-central-1:767224633206:alias/im-helm-prod-secrets
+ created_at: "2023-07-11T11:59:23Z"
+ enc: AQICAHjGjslCXX9uompjvuyTL3LRP26n7zuLUZbfgGUIQ5JhsAF/D2sGiSY59n2oB+cLFHKeAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMznEKld5C1GjKsNWbAgEQgDuxwbMjeUKiA7tFMpb+4oniIqASIxwnUt1fr1EsS0SsIEpeDJ9LNGBL1VKIU9xY9ef3q9uqnc2tWXdsRg==
  aws_profile: ""
  gcp_kms: []
  azure_kv: []

helm/data/secrets/prod/values.yaml

@@ -5,9 +5,9 @@ rabbitMq:
  password: ENC[AES256_GCM,data:RpdnVY0bl8Reh2JUGpWIdvptNK5tsA+kmUkmEXZ/R7o=,iv:DJ60OGTEe7KZ3w4i3N/5imeHXBRUsgTh7hIDwq7+vLs=,tag:TlYwKvUKUEJWP15yJU3lXA==,type:str]
 sops:
  kms:
- - arn: arn:aws:kms:eu-central-1:767224633206:key/mrk-f5d88b4c53ec4100acd9c8ae3bde0a65
- created_at: "2021-10-05T04:56:38Z"
- enc: AQICAHhXq0BmrdaY1Tzk4VwL7hDRIr4Zx4dXQZOaXDZfdG+52gGkUncyl8ZQv/LxDOAdH60YAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMz63QCtzseM2N4aOtAgEQgDvQPPfJqtQuEr/itOmKTptXF4/zvqoRMet1TPrS4QJ5SaegrzmIwsQfs8suuKWCvpSOTIAgWfBw2uO01Q==
+ - arn: arn:aws:kms:eu-central-1:767224633206:alias/im-helm-prod-secrets
+ created_at: "2023-07-11T11:59:30Z"
+ enc: AQICAHjGjslCXX9uompjvuyTL3LRP26n7zuLUZbfgGUIQ5JhsAG7mKmXMfu9XcI4Yo7xJjUvAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMesK0GY9Y6lqwdbTxAgEQgDvRIa+7ZIPkf7thpLia3eGba5k7Jz2B1jFYhRzWP2ICL/JcMfH43mk/3FFvMK5YNcJ3oD60HlG48igBHQ==
  aws_profile: ""
  gcp_kms: []
  azure_kv: []

helm/data/values/dev/values.yaml

@@ -1,8 +1 @@
 imagePullPolicy: Always
-
-deployableNamespaces:
- - whoami
-
-serviceAccount:
- annotations:
- eks.amazonaws.com/role-arn: arn:aws:iam::767224633206:role/instance-cluster-test-im-inspector-dev

helm/data/values/feature

@@ -0,0 +1 @@
+dev

helm/data/values/prod/values.yaml

@@ -1,12 +1,6 @@
-imagePullPolicy: IfNotPresent
-
 deployableNamespaces:
  - whoami
  - dev
  - play
  - qa
  - "meta-packages"
-
-serviceAccount:
- annotations:
- eks.amazonaws.com/role-arn: arn:aws:iam::767224633206:role/instance-cluster-test-im-inspector-prod