add pipeline to run terraform fmt and kitchen tests on PRs (#17)

add pipeline to run `terraform fmt` and `kitchen` tests on PRs these won't run against draft PRs run a single test scenario for now use new DWP kitchen terraform GHA Signed-off-by: Daniel Hill <[email protected]>
dwp · Mar 4, 2021 · 9557704 · 9557704
1 parent e25ee23
commit 9557704
Show file tree

Hide file tree

Showing 5 changed files with 72 additions and 15 deletions.
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
@@ -0,0 +1,52 @@
+name: PR
+
+on:
+  pull_request:
+    paths-ignore:
+      - '**/*.md'
+env:
+  TERRAFORM_VERSION: 0.14.7
+
+jobs:
+  format:
+    name: Terraform-Format
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.draft == false
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+      - uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_version: ${{ env.TERRAFORM_VERSION }}
+      - name: Terraform Format
+        id: fmt
+        run: terraform fmt -recursive
+        continue-on-error: true
+
+  test:
+    name: Kitchen-Terraform
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.draft == false
+    env:
+      GEMFILE_DIR: .
+      AWS_ACCESS_KEY_ID: ${{ secrets.ACTIONS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.ACTIONS_SECRET_ACCESS_KEY }}
+      TF_VAR_region: eu-west-1
+      TF_VAR_vpc_cidr_block: "10.0.0.0/16"
+      TF_VAR_kong_database_password: ${{ secrets.KONG_DATABASE_PASSWORD }}
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v2
+      - name: Kitchen Test hybrid-external-database
+        uses: dwp/[email protected]
+        with:
+          kitchen-command: test hybrid-external-database --destroy=always
+          aws-account-number: ${{ secrets.AWS_ACCOUNT }}
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.ACTIONS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACTIONS_SECRET_ACCESS_KEY }}
+          TF_VAR_region: eu-west-1
+          TF_VAR_environment: GHA-${{ env.GITHUB_RUN_NUMBER }}
+          TF_VAR_vpc_cidr_block: "10.0.0.0/16"
+          TF_VAR_kong_database_password: ${{ secrets.KONG_DATABASE_PASSWORD }}
diff --git a/Gemfile b/Gemfile
@@ -0,0 +1,4 @@
+ruby '2.7.2'
+source 'https://rubygems.org/' do
+  gem 'kitchen-terraform', '~> 5.6'
+end
diff --git a/examples/hybrid_external_database/iam.tf b/examples/hybrid_external_database/iam.tf
@@ -6,7 +6,7 @@ data "aws_iam_policy_document" "kong-ssm" {
 
   statement {
     actions   = ["ssm:GetParameter"]
-    resources = ["arn:aws:ssm:*:*:parameter/${var.service}/${var.environment}/*"]
+    resources = ["arn:aws:ssm:*:*:parameter/${var.service}/${local.environment}/*"]
   }
 
   statement {
@@ -16,7 +16,7 @@ data "aws_iam_policy_document" "kong-ssm" {
 }
 
 resource "aws_iam_role_policy" "kong-ssm" {
-  name = format("%s-%s-ssm", var.service, var.environment)
+  name = format("%s-%s-ssm", var.service, local.environment)
   role = aws_iam_role.kong.id
 
   policy = data.aws_iam_policy_document.kong-ssm.json
@@ -34,11 +34,11 @@ data "aws_iam_policy_document" "kong" {
 }
 
 resource "aws_iam_role" "kong" {
-  name               = format("%s-%s", var.service, var.environment)
+  name               = format("%s-%s", var.service, local.environment)
   assume_role_policy = data.aws_iam_policy_document.kong.json
 }
 
 resource "aws_iam_instance_profile" "kong" {
-  name = format("%s-%s", var.service, var.environment)
+  name = format("%s-%s", var.service, local.environment)
   role = aws_iam_role.kong.id
 }
diff --git a/examples/hybrid_external_database/main.tf b/examples/hybrid_external_database/main.tf
@@ -132,6 +132,7 @@ resource "aws_instance" "external_postgres" {
 }
 
 locals {
+  environment = "${var.environment}-${terraform.workspace}"
 
   kong_control_plane_config = {
     "KONG_ROLE"              = "control_plane"
@@ -191,7 +192,7 @@ module "create_kong_cp" {
   kong_config       = local.kong_control_plane_config
   kong_hybrid_conf  = local.kong_hybrid_conf
 
-  environment = var.environment
+  environment = local.environment
   service     = var.service
   description = var.description
   tags        = var.tags
@@ -223,7 +224,7 @@ module "create_kong_dp" {
   private_subnets    = module.create_kong_cp.private_subnet_ids
   availability_zones = module.create_kong_cp.private_subnet_azs
 
-  environment = var.environment
+  environment = local.environment
   service     = var.service
   description = var.description
   tags        = var.tags

diff --git a/examples/hybrid_external_database/ssm.tf b/examples/hybrid_external_database/ssm.tf
@@ -1,10 +1,10 @@
 resource "aws_kms_key" "kong" {
-  description = format("%s-%s", var.service, var.environment)
+  description = format("%s-%s", var.service, local.environment)
 
   tags = merge(
     {
-      "Name"        = format("%s-%s", var.service, var.environment),
-      "Environment" = var.environment,
+      "Name"        = format("%s-%s", var.service, local.environment),
+      "Environment" = local.environment,
       "Description" = var.description,
       "Service"     = var.service,
     },
@@ -13,12 +13,12 @@ resource "aws_kms_key" "kong" {
 }
 
 resource "aws_kms_alias" "kong" {
-  name          = format("alias/%s-%s", var.service, var.environment)
+  name          = format("alias/%s-%s", var.service, local.environment)
   target_key_id = aws_kms_key.kong.key_id
 }
 
 resource "aws_ssm_parameter" "ee-bintray-auth" {
-  name  = format("/%s/%s/ee/bintray-auth", var.service, var.environment)
+  name  = format("/%s/%s/ee/bintray-auth", var.service, local.environment)
   type  = "SecureString"
   value = var.ee_bintray_auth
 
@@ -30,7 +30,7 @@ resource "aws_ssm_parameter" "ee-bintray-auth" {
 }
 
 resource "aws_ssm_parameter" "ee-license" {
-  name  = format("/%s/%s/ee/license", var.service, var.environment)
+  name  = format("/%s/%s/ee/license", var.service, local.environment)
   type  = "SecureString"
   value = var.ee_license
 
@@ -47,7 +47,7 @@ resource "random_string" "admin_token" {
 }
 
 resource "aws_ssm_parameter" "ee-admin-token" {
-  name  = format("/%s/%s/ee/admin/token", var.service, var.environment)
+  name  = format("/%s/%s/ee/admin/token", var.service, local.environment)
   type  = "SecureString"
   value = random_string.admin_token.result
 
@@ -59,7 +59,7 @@ resource "aws_ssm_parameter" "ee-admin-token" {
 }
 
 resource "aws_ssm_parameter" "db-password" {
-  name  = format("/%s/%s/db/password", var.service, var.environment)
+  name  = format("/%s/%s/db/password", var.service, local.environment)
   type  = "SecureString"
   value = var.kong_database_password
 
@@ -78,7 +78,7 @@ resource "random_string" "master_password" {
 }
 
 resource "aws_ssm_parameter" "db-master-password" {
-  name  = format("/%s/%s/db/password/master", var.service, var.environment)
+  name  = format("/%s/%s/db/password/master", var.service, local.environment)
   type  = "SecureString"
   value = random_string.master_password.result