Migrate oonirun

[hellais]

This branch includes code needed to migrate OONI Run v2 over to the new host

[github-actions]

Terraform Run Output 🤖

Format and Style 🖌success

Initialization ⚙️success

Validation 🤖success

Validation Output

$ terraform validate
Success! The configuration is valid.

Plan 📖success

• Plan: 1 to add, 1 to change, 1 to destroy.

Show Plan

$ terraform plan
local_file.ansible_inventory: Refreshing state... [id=ab094adabd3ba9227beb2fc69d596fbaa80c9cfa]
null_resource.ansible_update_known_hosts: Refreshing state... [id=4418919173081010018]
data.aws_ssm_parameter.ecs_optimized_ami: Reading...
aws_cloudwatch_log_group.ecs: Refreshing state... [id=tf-ecs-group/ecs-agent]
aws_ecs_cluster.main: Refreshing state... [id=arn:aws:ecs:eu-central-1:082866812839:cluster/ooni-ecs-cluster]
aws_vpc.main: Refreshing state... [id=vpc-08b101405472a0b46]
aws_iam_role.ecs_task: Refreshing state... [id=ooni_ecs_task_role]
data.aws_availability_zones.available: Reading...
module.terraform_state_backend.data.aws_iam_policy_document.bucket_policy[0]: Reading...
module.terraform_state_backend.aws_dynamodb_table.with_server_side_encryption[0]: Refreshing state... [id=ooni-production-terraform-state-lock]
module.terraform_state_backend.aws_s3_bucket.default[0]: Refreshing state... [id=ooni-production-terraform-state]
aws_acm_certificate.dataapi: Refreshing state... [id=arn:aws:acm:eu-central-1:082866812839:certificate/27b7c5e3-ef70-41e8-a6cf-ac0d58a99613]
module.terraform_state_backend.data.aws_iam_policy_document.bucket_policy[0]: Read complete after 0s [id=2050088263]
aws_cloudwatch_log_group.app: Refreshing state... [id=tf-ecs-group/app-dataapi]
aws_iam_role.app_instance: Refreshing state... [id=tf-ecs-ooni-instance-role]
aws_iam_role.ecs_service: Refreshing state... [id=ooni_ecs_role]
data.aws_ssm_parameter.ecs_optimized_ami: Read complete after 0s [id=/aws/service/ecs/optimized-ami/amazon-linux-2/recommended]
module.terraform_state_backend.data.aws_region.current: Reading...
module.terraform_state_backend.data.aws_region.current: Read complete after 0s [id=eu-central-1]
data.aws_availability_zones.available: Read complete after 0s [id=eu-central-1]
module.terraform_state_backend.data.aws_iam_policy_document.aggregated_policy[0]: Reading...
aws_iam_role_policy.ecs_task: Refreshing state... [id=ooni_ecs_task_role:ooni_ecs_task_policy]
module.terraform_state_backend.data.aws_iam_policy_document.aggregated_policy[0]: Read complete after 0s [id=2050088263]
aws_iam_instance_profile.app: Refreshing state... [id=tf-ecs-instprofile]
aws_iam_role_policy.instance: Refreshing state... [id=tf-ecs-ooni-instance-role:TfEcsOONIInstanceRole]
aws_iam_role_policy.ecs_service: Refreshing state... [id=ooni_ecs_role:ooni_ecs_policy]
aws_ecs_task_definition.dataapi: Refreshing state... [id=ooni-dataapi-production-td]
aws_route53_record.dataapi_cert_validation["dataapi.prod.ooni.io"]: Refreshing state... [id=Z02418652BOD91LFA5S9X__74a0d0e91f58697b6838bed5a2fb4939.dataapi.prod.ooni.io._CNAME]
aws_acm_certificate_validation.dataapi: Refreshing state... [id=2024-02-05 11:11:01.598 +0000 UTC]
aws_internet_gateway.gw: Refreshing state... [id=igw-05319878d828e0a53]
aws_subnet.main[1]: Refreshing state... [id=subnet-02241f60bd951358d]
aws_subnet.main[0]: Refreshing state... [id=subnet-06d47d18b015109d4]
aws_alb_target_group.dataapi: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:082866812839:targetgroup/ooni-ecs-dataapi/c16001d24f858f20]
aws_security_group.lb_sg: Refreshing state... [id=sg-090ff83a71e7ad235]
aws_security_group.pg_sg: Refreshing state... [id=sg-06d7cf832e6855a37]
aws_route_table.r: Refreshing state... [id=rtb-06814accd93aca9ce]
aws_security_group.instance_sg: Refreshing state... [id=sg-0f39450a61732d69b]
aws_route_table_association.a[1]: Refreshing state... [id=rtbassoc-034c4831c1754e284]
aws_db_subnet_group.main: Refreshing state... [id=ooni-main]
module.terraform_state_backend.aws_s3_bucket_public_access_block.default[0]: Refreshing state... [id=ooni-production-terraform-state]
module.terraform_state_backend.aws_s3_bucket_server_side_encryption_configuration.default[0]: Refreshing state... [id=ooni-production-terraform-state]
aws_route_table_association.a[0]: Refreshing state... [id=rtbassoc-049f8c5e84cb32e55]
module.terraform_state_backend.aws_s3_bucket_versioning.default[0]: Refreshing state... [id=ooni-production-terraform-state]
aws_alb.main: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:082866812839:loadbalancer/app/ooni-alb-ecs/4cf8bd00b53f8961]
module.terraform_state_backend.aws_s3_bucket_policy.default[0]: Refreshing state... [id=ooni-production-terraform-state]
aws_launch_template.app: Refreshing state... [id=lt-01b923563af0432b5]
module.terraform_state_backend.time_sleep.wait_for_aws_s3_bucket_settings[0]: Refreshing state... [id=2024-02-02T21:32:23Z]
module.terraform_state_backend.aws_s3_bucket_ownership_controls.default[0]: Refreshing state... [id=ooni-production-terraform-state]
aws_autoscaling_group.app: Refreshing state... [id=ooni-tier1-production-backend-asg20240119184843559900000002]
aws_db_instance.ooni_pg: Refreshing state... [id=db-LT4NDHTMMWPYB4TLALUJMYTZFU]
aws_route53_record.alb_dns: Refreshing state... [id=Z02418652BOD91LFA5S9X_dataapi.prod.ooni.io_A]
aws_alb_listener.front_end: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:082866812839:listener/app/ooni-alb-ecs/4cf8bd00b53f8961/1cd9240a34a13129]
aws_alb_listener.front_end_https: Refreshing state... [id=arn:aws:elasticloadbalancing:eu-central-1:082866812839:listener/app/ooni-alb-ecs/4cf8bd00b53f8961/b7ec77ceadac94c8]
aws_route53_record.postgres_dns: Refreshing state... [id=Z035992527R8VEIX2UVO0_postgres.tier0.prod.ooni.nu_CNAME]
aws_ecs_service.dataapi: Refreshing state... [id=arn:aws:ecs:eu-central-1:082866812839:service/ooni-ecs-cluster/ooni-ecs-dataapi-production]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # aws_ecs_service.dataapi will be updated in-place
  ~ resource "aws_ecs_service" "dataapi" {
        id                                 = "arn:aws:ecs:eu-central-1:082866812839:service/ooni-ecs-cluster/ooni-ecs-dataapi-production"
        name                               = "ooni-ecs-dataapi-production"
        tags                               = {
            "Name"       = "ooni-tier1-production"
            "Repository" = "https://github.com/ooni/devops"
        }
      ~ task_definition                    = "arn:aws:ecs:eu-central-1:082866812839:task-definition/ooni-dataapi-production-td:18" -> (known after apply)
        # (15 unchanged attributes hidden)

        # (3 unchanged blocks hidden)
    }

  # aws_ecs_task_definition.dataapi must be replaced
-/+ resource "aws_ecs_task_definition" "dataapi" {
      ~ arn                      = "arn:aws:ecs:eu-central-1:082866812839:task-definition/ooni-dataapi-production-td:17" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:eu-central-1:082866812839:task-definition/ooni-dataapi-production-td" -> (known after apply)
      ~ container_definitions    = jsonencode(
          ~ [
              ~ {
                  - environment      = []
                  ~ image            = "ooni/dataapi:v0.4.3.dev1" -> "ooni/dataapi:latest"
                  - mountPoints      = []
                    name             = "ooni_dataapi"
                  ~ portMappings     = [
                      ~ {
                          - protocol      = "tcp"
                            # (2 unchanged attributes hidden)
                        },
                    ]
                  - systemControls   = []
                  - volumesFrom      = []
                    # (5 unchanged attributes hidden)
                },
            ] # forces replacement
        )
      ~ id                       = "ooni-dataapi-production-td" -> (known after apply)
      + network_mode             = (known after apply)
      - requires_compatibilities = [] -> null
      ~ revision                 = 17 -> (known after apply)
        tags                     = {
            "Name"       = "ooni-tier1-production"
            "Repository" = "https://github.com/ooni/devops"
        }
        # (4 unchanged attributes hidden)
    }

Plan: 1 to add, 1 to change, 1 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

Pusher	@hellais
Action	pull_request
Working Directory	./tf/environments/prod
Workflow	.github/workflows/check_deploy.yml
Last updated	Tue, 05 Mar 2024 13:33:40 GMT

[github-actions]

Ansible Run Output 🤖

Ansible Playbook Recap 🔍

Ansible playbook output 📖success

Show Execution

$ ansible-playbook playbook.yml --check --diff -i inventory.ini
[WARNING]: provided hosts list is empty, only localhost is available. Note that
the implicit localhost does not match 'all'

PLAY [ClickHouse servers] ******************************************************
skipping: no hosts matched

PLAY RECAP *********************************************************************

Pusher	@hellais
Action	pull_request
Working Directory	./tf/environments/prod
Workflow	.github/workflows/check_deploy.yml
Last updated	Tue, 05 Mar 2024 13:34:42 GMT