Merge pull request #89 from Opetushallitus/OK-613__lampi-siirto

Ok 613 lampi siirto
Opetushallitus · Jan 10, 2025 · 9b1fc17 · 9b1fc17
2 parents 4c9103d + 14ada2c
commit 9b1fc17
Show file tree

Hide file tree

Showing 19 changed files with 3,545 additions and 37 deletions.
diff --git a/.github/workflows/build-lampi-siirtaja.yml b/.github/workflows/build-lampi-siirtaja.yml
@@ -0,0 +1,40 @@
+name: Build Lampi-siirtäjä Container
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - '.github/workflows/build-lampi-siirtaja.yml'
+      - 'lampi-siirtaja-container/**'
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  build-and-deploy-container:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          role-to-assume: ${{ secrets.AWS_OVARA_UTILITY_ROLE_ARN }}
+          role-session-name: ovara-lampi-siirtaja-ecr-push
+          aws-region: eu-west-1
+
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v2
+
+      - name: Build, tag, and push docker image to Amazon ECR
+        env:
+          REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          REPOSITORY: ovara-lampi-siirtaja
+          IMAGE_TAG: ga-${{ github.run_number }}
+        run: |
+            cd lampi-siirtaja-container
+            docker build -t $REGISTRY/$REPOSITORY:$IMAGE_TAG .
+            docker push $REGISTRY/$REPOSITORY:$IMAGE_TAG
diff --git a/cdk/bin/cdk.ts b/cdk/bin/cdk.ts
@@ -19,11 +19,10 @@ import { S3Stack } from '../lib/s3-stack';
 const app = new cdk.App();
 const environmentName = app.node.tryGetContext('environment') || process.env.ENVIRONMENT;
 const ecsImageTag = app.node.tryGetContext('ecsImageTag');
-const props = getGenericStackProps(environmentName);
+const accountId = process.env.CDK_DEFAULT_ACCOUNT || '';
+const props = getGenericStackProps(environmentName, accountId);
 const config = props.config;
 
-const accountId = process.env.CDK_DEFAULT_ACCOUNT;
-
 const externalRolesStack = new ExternalRolesStack(
   app,
   `${config.environment}-ExternalRolesStack`,
@@ -71,6 +70,7 @@ const databaseStack = new DatabaseStack(app, `${config.environment}-DatabaseStac
 });
 
 const ecsStack = new EcsStack(app, `${config.environment}-EcsStack`, {
+  auroraCluster: databaseStack.auroraCluster,
   auroraSecurityGroup: databaseStack.auroraSecurityGroup,
   githubActionsDeploymentRole: externalRolesStack.githubActionsDeploymentRole,
   ecsImageTag: ecsImageTag,

diff --git a/cdk/config/testi.json b/cdk/config/testi.json
@@ -27,5 +27,11 @@
     "minute": "30",
     "hour": "5-15/1",
     "weekDay": "2-6/1"
+  },
+  "lampiSiirtajaEnabled": "true",
+  "lampiSiirtajaCron": {
+    "minute": "0",
+    "hour": "0",
+    "weekDay": "2-6/1"
   }
 }
diff --git a/cdk/config/tuotanto.json b/cdk/config/tuotanto.json
@@ -27,5 +27,11 @@
     "minute": "30",
     "hour": "5-15/2",
     "weekDay": "2-6/1"
+  },
+  "lampiSiirtajaEnabled": "false",
+  "lampiSiirtajaCron": {
+    "minute": "0",
+    "hour": "0",
+    "weekDay": "2-6/1"
   }
 }
diff --git a/cdk/files/bastion/ensure-psql-roles-up-to-date.sh b/cdk/files/bastion/ensure-psql-roles-up-to-date.sh
@@ -59,7 +59,7 @@ echo ""
 echo "Role 'oph_group' is not needed anymore, drop it."
 PGPASSWORD=$master_pw psql -h $host --user oph --dbname $db --command "drop role oph_group;"
 echo ""
-echo "Creating user insert_raw_user nad role insert_raw_role (for IAM authentication"
+echo "Creating user insert_raw_user nad role insert_raw_role (for IAM authentication)"
 PGPASSWORD=$master_pw psql -h $host --user oph --dbname $db --command "create schema raw;"
 PGPASSWORD=$master_pw psql -h $host --user oph --dbname $db --command "create role insert_raw_role;"
 PGPASSWORD=$master_pw psql -h $host --user oph --dbname $db --command "grant usage on schema raw to insert_raw_role;"
@@ -69,5 +69,9 @@ PGPASSWORD=$master_pw psql -h $host --user oph --dbname $db --command "grant ins
 PGPASSWORD=$master_pw psql -h $host --user oph --dbname $db --command "create user insert_raw_user;"
 PGPASSWORD=$master_pw psql -h $host --user oph --dbname $db --command "grant rds_iam to insert_raw_user;"
 PGPASSWORD=$master_pw psql -h $host --user oph --dbname $db --command "grant insert_raw_role to insert_raw_user;"
+echo "Creating AWS S3 extension"
+PGPASSWORD=$master_pw psql -h $host --user oph --dbname $db --command "create extension aws_s3 cascade;"
+PGPASSWORD=$master_pw psql -h $host --user oph --dbname $db --command "grant usage on schema aws_s3 to app;"
+PGPASSWORD=$master_pw psql -h $host --user oph --dbname $db --command "grant execute on all functions in schema aws_s3 to app;"
 echo ""
 echo "DONE!"
diff --git a/cdk/lib/config.ts b/cdk/lib/config.ts
@@ -4,6 +4,7 @@ import * as cdk from 'aws-cdk-lib';
 import * as appscaling from 'aws-cdk-lib/aws-applicationautoscaling';
 
 export interface GenericStackProps extends cdk.StackProps {
+  accountId: string;
   config: Config;
 }
 
@@ -23,6 +24,8 @@ export interface Config {
   lampiFileHandlerActive: string;
   dbtProcessingEnabled: string;
   dbtCron: appscaling.CronOptions;
+  lampiSiirtajaEnabled: string;
+  lampiSiirtajaCron: appscaling.CronOptions;
   profile: string;
   publicHostedZone: string;
   siirtotiedostot: {
@@ -35,11 +38,15 @@ export interface Config {
   };
 }
 
-export const getGenericStackProps = (environment: string): GenericStackProps => {
+export const getGenericStackProps = (
+  environment: string,
+  accountId: string
+): GenericStackProps => {
   const filename: string = `config/${environment}.json`;
   const fileContent: string = fs.readFileSync(filename, 'utf8');
   const config: Config = JSON.parse(fileContent);
   return {
+    accountId: accountId,
     config: config,
     env: {
       account: process.env.CDK_DEFAULT_ACCOUNT,

diff --git a/cdk/lib/database-stack.ts b/cdk/lib/database-stack.ts
@@ -30,6 +30,7 @@ export interface DatabaseStackProps extends GenericStackProps {
 export class DatabaseStack extends cdk.Stack {
   public readonly auroraSecurityGroup: ec2.ISecurityGroup;
   public readonly lampiTiedostoKasiteltyTable: dynamodb.ITableV2;
+  public readonly auroraCluster: rds.IDatabaseCluster;
 
   constructor(scope: Construct, id: string, props: DatabaseStackProps) {
     super(scope, id, props);
@@ -123,6 +124,7 @@ export class DatabaseStack extends cdk.Stack {
           : rds.DBClusterStorageType.AURORA,
       }
     );
+    this.auroraCluster = auroraCluster;
 
     new cdk.CfnOutput(this, 'AuroraClusterResourceId', {
       exportName: `${config.environment}-opiskelijavalinnanraportointi-aurora-cluster-resourceid`,