From e33c7cf726e65576867e52bb9eba8c11ff063030 Mon Sep 17 00:00:00 2001 From: Neill Turner Date: Thu, 28 Nov 2024 11:06:17 +0000 Subject: [PATCH] add workflow for aks database backup and restore --- .github/workflows/backup-db.yml | 89 ++++++++++++++++++++++++++ .github/workflows/database-restore.yml | 70 ++++++++++++++++++++ 2 files changed, 159 insertions(+) create mode 100644 .github/workflows/backup-db.yml create mode 100644 .github/workflows/database-restore.yml diff --git a/.github/workflows/backup-db.yml b/.github/workflows/backup-db.yml new file mode 100644 index 000000000..158fc4772 --- /dev/null +++ b/.github/workflows/backup-db.yml @@ -0,0 +1,89 @@ +name: Backup database + +on: + workflow_dispatch: + inputs: + environment: + description: Environment to backup + required: true + default: test + type: choice + options: + - test + - preprod + - production + backup-file: + description: | + Backup file name (without extension). Default is rsm_[env]_adhoc_YYYY-MM-DD. Set it explicitly when backing up a point-in-time (PTR) server. (Optional) + required: false + type: string + default: default + db-server: + description: | + Name of the database server. Default is the live server. When backing up a point-in-time (PTR) server, use the full name of the PTR server. (Optional) + + # uncomment to enable after production migration + #schedule: + # - cron: "0 4 * * *" # 04:00 UTC + +env: + SERVICE_NAME: refer-serious-misconduct + SERVICE_SHORT: rsm + TF_VARS_PATH: terraform/application/config + +jobs: + backup: + name: Backup database + runs-on: ubuntu-latest + environment: + name: aks-${{ inputs.environment || 'production' }} + env: + DEPLOY_ENV: ${{ inputs.environment || 'production' }} + BACKUP_FILE: ${{ inputs.backup-file || 'schedule' }} + + steps: + - uses: actions/checkout@v4 + + - uses: azure/login@v2 + with: + creds: ${{ secrets.AZURE_CREDENTIALS }} + + - name: Set environment variables + run: | + source global_config/${DEPLOY_ENV}.sh + tf_vars_file=${TF_VARS_PATH}/${DEPLOY_ENV}.tfvars.json + echo "CLUSTER=$(jq -r '.cluster' ${tf_vars_file})" >> $GITHUB_ENV + echo "RESOURCE_GROUP_NAME=${AZURE_RESOURCE_PREFIX}-${SERVICE_SHORT}-${CONFIG_SHORT}-rg" >> $GITHUB_ENV + echo "STORAGE_ACCOUNT_NAME=${AZURE_RESOURCE_PREFIX}${SERVICE_SHORT}dbbkp${CONFIG_SHORT}sa" >> $GITHUB_ENV + TODAY=$(date +"%F") + echo "DB_SERVER=${AZURE_RESOURCE_PREFIX}-${SERVICE_SHORT}-${CONFIG_SHORT}-pg" >> $GITHUB_ENV + if [ "${BACKUP_FILE}" == "schedule" ]; then + BACKUP_FILE=${SERVICE_SHORT}_${CONFIG_SHORT}_${TODAY} + elif [ "${BACKUP_FILE}" == "default" ]; then + BACKUP_FILE=${SERVICE_SHORT}_${CONFIG_SHORT}_adhoc_${TODAY} + else + BACKUP_FILE=${BACKUP_FILE} + fi + echo "BACKUP_FILE=${BACKUP_FILE}" >> $GITHUB_ENV + echo "KEYVAULT_NAME=${AZURE_RESOURCE_PREFIX}-${SERVICE_SHORT}-${CONFIG_SHORT}-inf-kv" >> $GITHUB_ENV + + - name: Fetch secrets from key vault + uses: azure/CLI@v2 + id: key-vault-secrets + with: + inlineScript: | + SLACK_WEBHOOK=$(az keyvault secret show --name "SLACK-WEBHOOK" --vault-name ${KEYVAULT_NAME} --query "value" -o tsv) + echo "::add-mask::$SLACK_WEBHOOK" + echo "SLACK_WEBHOOK=$SLACK_WEBHOOK" >> $GITHUB_OUTPUT + + - name: Backup AKS ${{ env.DEPLOY_ENV }} postgres + uses: DFE-Digital/github-actions/backup-postgres@master + with: + storage-account: ${{ env.STORAGE_ACCOUNT_NAME }} + resource-group: ${{ env.RESOURCE_GROUP_NAME }} + app-name: refer-serious-misconduct-${{ env.DEPLOY_ENV }} + cluster: ${{ env.CLUSTER }} + azure-credentials: ${{ secrets.AZURE_CREDENTIALS }} + backup-file: ${{ env.BACKUP_FILE }}.sql + db-server-name: ${{ inputs.db-server }} + slack-webhook: ${{ steps.key-vault-secrets.outputs.SLACK_WEBHOOK }} diff --git a/.github/workflows/database-restore.yml b/.github/workflows/database-restore.yml new file mode 100644 index 000000000..e3cdb273e --- /dev/null +++ b/.github/workflows/database-restore.yml @@ -0,0 +1,70 @@ +name: Restore database from Azure storage + +on: + workflow_dispatch: + inputs: + environment: + description: Environment to restore + required: true + default: test + type: choice + options: + - test + - preprod + - production + confirm-production: + description: Must be set to true if restoring production + required: true + default: "false" + type: choice + options: + - "false" + - "true" + backup-file: + description: Name of the backup file in Azure storage. e.g. rsm_prod_2024-08-09.sql.gz. The default value is today's scheduled backup. + type: string + required: false + +env: + SERVICE_NAME: refer-serious-misconduct + SERVICE_SHORT: rsm + TF_VARS_PATH: terraform/application/config + +jobs: + restore: + name: Restore AKS Database + if: ${{ inputs.environment != 'production' || (inputs.environment == 'production' && github.event.inputs.confirm-production == 'true' ) }} + runs-on: ubuntu-latest + environment: aks-${{ inputs.environment }} + concurrency: deploy_${{ inputs.environment }} + + steps: + - uses: actions/checkout@v4 + name: Checkout + + - name: Set environment variables + run: | + source global_config/${{ inputs.environment }}.sh + tf_vars_file=${{ env.TF_VARS_PATH }}/${{ inputs.environment }}.tfvars.json + echo "CLUSTER=$(jq -r '.cluster' ${tf_vars_file})" >> $GITHUB_ENV + echo "RESOURCE_GROUP_NAME=${AZURE_RESOURCE_PREFIX}-${SERVICE_SHORT}-${CONFIG_SHORT}-rg" >> $GITHUB_ENV + echo "STORAGE_ACCOUNT_NAME=${AZURE_RESOURCE_PREFIX}${SERVICE_SHORT}dbbkp${CONFIG_SHORT}sa" >> $GITHUB_ENV + echo "DB_SERVER=${AZURE_RESOURCE_PREFIX}-${SERVICE_SHORT}-${CONFIG_SHORT}-pg" >> $GITHUB_ENV + TODAY=$(date +"%F") + echo "BACKUP_FILE=${SERVICE_SHORT}_${CONFIG_SHORT}_${TODAY}.sql" >> $GITHUB_ENV + if [ "${{ inputs.backup-file }}" != "" ]; then + BACKUP_FILE=${{ inputs.backup-file }} + else + BACKUP_FILE=${SERVICE_SHORT}_${CONFIG_SHORT}_${TODAY}.sql.gz + fi + echo "BACKUP_FILE=$BACKUP_FILE" >> $GITHUB_ENV + + - name: Restore ${{ inputs.environment }} postgres + uses: DFE-Digital/github-actions/restore-postgres-backup@master + with: + storage-account: ${{ env.STORAGE_ACCOUNT_NAME }} + resource-group: ${{ env.RESOURCE_GROUP_NAME }} + app-name: ${{ env.SERVICE_NAME }}-${{ inputs.environment }} + cluster: ${{ env.CLUSTER }} + azure-credentials: ${{ secrets.AZURE_CREDENTIALS }} + backup-file: ${{ env.BACKUP_FILE }}