Giter VIP home page Giter VIP logo

infrastructure's Introduction

Infrastructure

Templates and assets used to launch and manage many aspects of PRX's applications and services.

The Infrastructure project itself contains many independent or related-but-separate projects and assets. It is the home for any work that helps PRX adhere to an infrastructure as code philosophy. The goal is to describe the various AWS resources (and their associated configurations) needed to run a multitude of applications, servers, and services using code and templates.

All aspects of Infrastructure largely rely on AWS CloudFormation.

Applications, as well as the systems designed to test and deploy those applications, are described using CloudFormation templates. Collectively the systems used to facilitate application deployment and the infrastructure necessary to support them are referred to as CI/CD. There are a number of other aspects of our AWS architecture that do not fall under that umbrella but are also maintained as part of the Infrastructure project. This includes things like DNS records for hosted zones and CDN distributions.

CI/CD

Together, the CI and CD systems support continuous integration and continuous delivery and deployment. They are independent systems, but are designed to work in close coordination. CI/CD require a pre-existing storage and notification stack to exist before either can be launched from their templates.

There is a draw.io file (System Diagram.xml) that gives a good overview of how many of the main pieces of the CI and CD systems fit together.

Destruction

If you want to remove things created by Infrastructure for CI/CD, do so in this order:

  • Delete CI stack
  • Delete production root stack
  • Delete staging root stack
  • Delete CD stack
  • Delete Storage stack
  • Delete CD pipeline artifacts store bucket (cd-artifactstore-...)
  • Delete CD pipeline CloudTrail storage bucket (cd-CdPipelineS3TriggerTrailStore-...)
  • Delete CI CodeBuild source bucket (ci-cicodebuildsourcearchivebucket-...)
  • Delete the five buckets created by the Storage stack

Other Resources

Files found in cd/, ci/, and storage/ fall under the umbrella of CI/CD. Other types of resources, such as CloudFront distributions and DNS records, can also be found in this project.

  • dns/ – DNS hosted zones and records
  • cdn/ – CDN configurations (such as through Amazon CloudFront)
  • db/ – Databases and data stores (e.g., Amazon RDS and Amazon ElastiCache)
  • etc/ – Misc. standalone stacks
  • utility/ - Scripts and Lambda functions that help with other parts of Infrastructure

GitHub Actions

The .github/workflows directory contains files that describe automated processes that are run as GitHub Action under certain conditions (e.g., a specific file is updated). These workflows are meant to operate in coordination with various processes deployed into AWS. For example, the CI system is continuously deployed using a GitHub action. Some DNS hosted zones are also continuously deployed using GitHub actions.

Highly integrated processes and pipelines (for example, where CloudFormation, CodeBuild, CodePipeline, Lambda, etc are all working together) should not be created as GitHub Actions. GitHub Actions should only be used for very simple workflows, or in cases where there's no reasonable way to accomplish something using AWS primatives (such as deploying a CloudFormation stack that deploys another deployment process). A CodePipeline that would end up being a single action may be a good candidate for GitHub actions.

GitHub Actions also have greater visibility into commit-level events than CodePipeline source actions. If there is a pipeline that only needs to run when certain files or directories are altered, it can be beneficial to create a GitHub Action to start the execution of that pipeline using a detailed on condition, rather than having the pipeline start for all commits made to this repository.

infrastructure's People

Contributors

cavis avatar debenedictis avatar farski avatar gcampo88 avatar klbaradan avatar kookster avatar pstjean avatar radical-ube avatar rpeterman-gp avatar sandikbarr avatar svevang avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

infrastructure's Issues

Set expiration on Lambda log groups

For log groups generated by Lambdas that are launched in stacks, need a good way to set the expiration. May just need another lambda that runs once a day and does it through the API.

Avoid multiple region build pipelines

Currently app-specific test/build/dockerize/etc CodePipeline stacks are deployed for every Staging root stack. That would mean if we deploy Infrastructure to more than one region, each app build pipeline would be watching GitHub repo's individually, and a commit could trigger multiple build processes, and thus, eg, multiple docker images being created for the same code at the same time. The incremental tagging for images could get really dicey at that point.

Need to figure this out. Maybe only ever deploy pipeline stacks in one region, which is selected as a parameter of the Bootstrap stack.

Approval notifactions

If we keep manual approval actions in the pipelines, there needs to be a reliable way of notifying people when something is pending

Restrict CloudFormation role permissions

The CloudFormationIAMRole in the bootstrap template currently has very permissive policies (wildcards for all the services resource stacks are currently touching). These should be much more explicit.

Missing files on sync

The CodePipeline sync lambda seems to not push all files to S3. vpc.yml is always missing. It may be because it's the last file in the list of all files extracted from the zip, and it's getting lost somehow?

Insufficient data for Upload alarm

The error alarm for upload lambda currently doesn't make use of the new CW alarm setting that can treat missing data as OK. It should do that.

Tag resources

ID resources that are worth tagging, and tag them. Also come up with a good system for tagging.

Consolidate shared env vars in template config

There are a number of env vars, in a given environment type, are shared by many apps (eg the host name for the ID service), and it would be a bit cleaner to have a single template config definition that just gets reused.

ECS ASG scaling rules

After #120, add some scaling rules to the prod ASG based on CPU/Memory reservation. Something like ... always have 1 at least half-empty instance around.

Will also require some CFN changes to prevent resetting the ASG DesiredCount every time we deploy.

Then, can tackle #134 and #135.

Production template config rollover

CodePipeline needs a step that copies over certain values from the staging template config to production before creating the production changeset

Migrate ID Staging

ID Production currently lives on contegix. But we can migrate ID-staging!

  • Setup aws-secrets
    • Modify bin/application to optionally read aws-secrets
    • Setup staging secrets in S3 bucket
  • Add .prxci
  • Add prx app label to Dockerfile
  • Add to Infrastructure CD
  • Bonus points: meta.prx.org acceptance tests

Sort out parameter limit

There's a per-template limit of 60 parameters, which makes the current giant template configuration file plan less suitable. I think I have an idea for a replacement.

Process for saving app specific env values

probably use versioned, private files on s3
need to update apps to use the same env name values for the same things (I think this is already mostly true for FEEDER_HOST and other *_HOST values)
need process for how these get updated, and used by the apps running in ecs

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.