Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Task]: Pin terraform version in every Github Action #1790

Closed
2 of 3 tasks
coilysiren opened this issue Apr 19, 2024 · 0 comments · Fixed by #1898
Closed
2 of 3 tasks

[Task]: Pin terraform version in every Github Action #1790

coilysiren opened this issue Apr 19, 2024 · 0 comments · Fixed by #1898
Assignees
@aplybeah
Labels
project: grants.gov Grants.gov Modernization tickets

Comments

@coilysiren
Copy link
Collaborator

coilysiren commented Apr 19, 2024 •
edited by aplybeah
Loading

Summary

Via #1782 and navapbc/template-infra#586, it turns out that some of our Github Actions are floating their installed terraform version. This caused all of our deploys to break when the version was silently upgraded to 1.8.0. We should pin our installed terraform version, to avoid running into issues like this in the future.

Here's an example of pinning terraform in a Github Action, this is the thing we should be doing everywhere:

simpler-grants-gov/.github/workflows/infra-service.yml

Lines 23 to 26 in 4136fd6

- uses: hashicorp/setup-terraform@v2
with:
terraform_version: 1.7.1
terraform_wrapper: false

Additionally we should narrow the acceptable range of terraform versions inside of modules, to just the matching minor version. That would also have avoided this issue, as it would have flagged that we were installing terraform 1.8 instead of 1.7.

Here's an example of where the terraform version range needs to be narrowed in modules:

simpler-grants-gov/infra/api/service/main.tf

Line 57 in 4136fd6

required_version = ">= 1.2.0, < 2.0.0"

In the example above, it should be changed to ">= 1.7.0, < 1.8.0", or whatever minor version we choose.

Finally, when doing this work, we should update to the latest terraform version. At time of writing, that means updating from 1.7 => 1.8

Acceptance criteria

  • Terraform versions pinned in Github Actions
  • Terraform version range narrowed in modules
  • Terraform updated to latest version
@coilysiren coilysiren added the project: grants.gov Grants.gov Modernization tickets label Apr 19, 2024
@coilysiren coilysiren moved this from Icebox to Sprint Ready in Simpler.Grants.gov Product Backlog Apr 19, 2024
@rocketnova rocketnova mentioned this issue Apr 19, 2024
Closed
@aplybeah aplybeah self-assigned this Apr 23, 2024
@aplybeah aplybeah moved this from Sprint Ready to In Progress in Simpler.Grants.gov Product Backlog Apr 23, 2024
@aplybeah aplybeah moved this from In Progress to Sprint Ready in Simpler.Grants.gov Product Backlog Apr 23, 2024
@aplybeah aplybeah moved this from Sprint Ready to In Progress in Simpler.Grants.gov Product Backlog May 1, 2024
@aplybeah aplybeah mentioned this issue May 1, 2024
Merged
@aplybeah aplybeah moved this from In Progress to In Review in Simpler.Grants.gov Product Backlog May 2, 2024
aplybeah added a commit that referenced this issue May 2, 2024
@aplybeah
[Issue #1790] Pin Terraform version (#1898)
a3c07a4 
## Summary
Fixes #1790 

### Time to review: __x mins__

## Changes proposed
* narrow down acceptable versions of terraform in modules
* Pin the latest version of terraform in workflows (1.8.2 as of this
writing)

## Context for reviewers
> Some of our Github Actions are floating their installed terraform
version. This caused all of our deploys to break when the version was
silently upgraded to 1.8.0. We should pin our installed terraform
version, to avoid running into issues like this in the future.

## Additional information
Terraform plan for `infra/api/service` in `dev` functioning normally:
```
# aws_sfn_state_machine.copy_oracle_data will be updated in-place
  ~ resource "aws_sfn_state_machine" "copy_oracle_data" {
      ~ definition                = jsonencode(
            {
              - StartAt = "ExecuteECSTask"
              - States  = {
                  - ExecuteECSTask = {
                      - End        = true
                      - Parameters = {
                          - Cluster              = "arn:aws:ecs:us-east-1:315341936575:cluster/api-dev"
                          - LaunchType           = "FARGATE"
                          - NetworkConfiguration = {
                              - AwsvpcConfiguration = {
                                  - SecurityGroups = [
                                      - "sg-0eab49e76a34379f9",
                                    ]
                                  - Subnets        = [
                                      - "subnet-0a5ea667d3751639f",
                                      - "subnet-068ede7dcfd9469ab",
                                      - "subnet-019f469ba97dc6ec7",
                                    ]
                                }
                            }
                          - Overrides            = {
                              - ContainerOverrides = [
                                  - {
                                      - Command     = [
                                          - "poetry",
                                          - "run",
                                          - "flask",
                                          - "data-migration",
                                          - "copy-oracle-data",
                                        ]
                                      - Environment = [
                                          - {
                                              - Name  = "FLASK_APP"
                                              - Value = "src.app:create_app()"
                                            },
                                        ]
                                      - Name        = "api-dev"
                                    },
                                ]
                            }
                          - TaskDefinition       = "arn:aws:ecs:us-east-1:315341936575:task-definition/api-dev:130"
                        }
                      - Resource   = "arn:aws:states:::ecs:runTask.sync"
                      - Type       = "Task"
                    }
                }
            }
        ) -> (known after apply)
        id                        = "arn:aws:states:us-east-1:315341936575:stateMachine:api-dev-copy-oracle-data"
        name                      = "api-dev-copy-oracle-data"
        tags                      = {}
        # (11 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

  # module.service.aws_ecs_service.app will be updated in-place
  ~ resource "aws_ecs_service" "app" {
        id                                 = "arn:aws:ecs:us-east-1:315341936575:service/api-dev/api-dev"
        name                               = "api-dev"
        tags                               = {}
      ~ task_definition                    = "arn:aws:ecs:us-east-1:315341936575:task-definition/api-dev:130" -> (known after apply)
        # (15 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # module.service.aws_ecs_task_definition.app must be replaced
-/+ resource "aws_ecs_task_definition" "app" {
      ~ arn                      = "arn:aws:ecs:us-east-1:315341936575:task-definition/api-dev:131" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:us-east-1:315341936575:task-definition/api-dev" -> (known after apply)
      ~ container_definitions    = jsonencode(
          ~ [
              ~ {
                  ~ linuxParameters        = {
                      ~ capabilities       = {
                          - add  = []
                            # (1 unchanged attribute hidden)
                        }
                        # (1 unchanged attribute hidden)
                    }
                  - mountPoints            = []
                    name                   = "api-dev"
                  ~ portMappings           = [
                      ~ {
                          - hostPort      = 8000
                          - protocol      = "tcp"
                            # (1 unchanged attribute hidden)
                        },
                    ]
                  - systemControls         = []
                  - volumesFrom            = []
                    # (9 unchanged attributes hidden)
                },
            ] # forces replacement
        )
      ~ id                       = "api-dev" -> (known after apply)
      ~ revision                 = 131 -> (known after apply)
      - tags                     = {} -> null
        # (11 unchanged attributes hidden)
    }

Plan: 1 to add, 2 to change, 1 to destroy.
```
@sumiat sumiat removed the refinement label May 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@aplybeah aplybeah

Labels
project: grants.gov Grants.gov Modernization tickets
Projects
Simpler.Grants.gov Product Backlog
Status: Done
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[Issue #1790] Pin Terraform version HHS/simpler-grants-gov
3 participants
@coilysiren @aplybeah @sumiat