Skip to content

Fixed various issues with the makefile #102

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bmonkman merged 1 commit into from
Sep 21, 2020
Merged

Fixed various issues with the makefile #102

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 28 additions & 22 deletions templates/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,62 +1,68 @@
SHELL := /usr/bin/env bash
SHELL = /usr/bin/env bash
Copy link
Copy Markdown
Contributor

@GrooveStomp GrooveStomp Sep 19, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This made me look up info on the various assignments: https://stackoverflow.com/a/448939
Good to know!

ENVIRONMENT ?= stage
PROJECT = <% .Name %>
export AWS_DEFAULT_REGION = <% index .Params `region` %>
export AWS_PAGER =
KUBE_CONTEXT := $(PROJECT)-$(ENVIRONMENT)-$(AWS_DEFAULT_REGION)
Copy link
Copy Markdown
Contributor

@GrooveStomp GrooveStomp Sep 19, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm. This one made me look up more info: https://stackoverflow.com/a/2839065
Also good to know. :-)

Copy link
Copy Markdown
Contributor Author

@bmonkman bmonkman Sep 19, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, make syntax is so much less familiar than shell syntax which is part of the reason I'm leaning toward moving this stuff to shell scripts now that it has gotten more complex.

Copy link
Copy Markdown
Contributor

@GrooveStomp GrooveStomp Sep 19, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's a good reason. My bash-fu is definitely stronger than my make-fu.

Copy link
Copy Markdown
Contributor Author

@bmonkman bmonkman Sep 19, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Me too!


apply: apply-remote-state apply-secrets apply-env update-k8s-conf pre-k8s apply-k8s-utils post-apply-setup

apply-remote-state:
aws s3 ls $(PROJECT)-$(ENVIRONMENT)-terraform-state || (\
aws s3 ls $(PROJECT)-$(ENVIRONMENT)-terraform-state > /dev/null 2>&1 || ( \
Copy link
Copy Markdown
Contributor

@GrooveStomp GrooveStomp Sep 19, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

cd terraform/bootstrap/remote-state && \
terraform init && \
terraform apply -var "environment=$(ENVIRONMENT)" $(AUTO_APPROVE) && \
rm ./terraform.tfstate)
rm ./terraform.tfstate )

apply-secrets:
aws iam list-access-keys --user-name $(PROJECT)-ci-user > /dev/null 2>&1 || (\
aws iam list-access-keys --user-name $(PROJECT)-ci-user > /dev/null 2>&1 || ( \
cd terraform/bootstrap/secrets && \
terraform init && \
terraform apply $(AUTO_APPROVE) && \
rm ./terraform.tfstate)
rm ./terraform.tfstate )

apply-env:
cd terraform/environments/$(ENVIRONMENT); \
terraform init && \
terraform apply $(AUTO_APPROVE)

pre-k8s:
@echo "Creating VPN private key..."
WGKEY=$(shell kubectl run -i --tty zero-k8s-utilities --image=commitdev/zero-k8s-utilities:0.0.3 --restart=Never -- wg genkey) && kubectl delete pod/zero-k8s-utilities && \
aws secretsmanager create-secret --region <% index .Params `region` %> --name $(PROJECT)-$(ENVIRONMENT)-vpn-wg-privatekey-<% index .Params `randomSeed` %> --description "Auto-generated Wireguard VPN private key" --secret-string $$WGKEY
@echo "Done VPN private key creation"
@aws secretsmanager describe-secret --region $(AWS_DEFAULT_REGION) --secret-id $(PROJECT)-$(ENVIRONMENT)-vpn-wg-privatekey-<% index .Params `randomSeed` %> > /dev/null 2>&1 || ( \
echo "Creating VPN private key..." && \
kubectl run --context $(KUBE_CONTEXT) -i --tty zero-k8s-utilities --image=commitdev/zero-k8s-utilities:0.0.3 --restart=Never -- wg genkey | \
xargs aws secretsmanager create-secret --region $(AWS_DEFAULT_REGION) --name $(PROJECT)-$(ENVIRONMENT)-vpn-wg-privatekey-<% index .Params `randomSeed` %> --description "Auto-generated Wireguard VPN private key" --secret-string && \
kubectl delete --context $(KUBE_CONTEXT) pod/zero-k8s-utilities && \
echo "Done VPN private key creation" )
Copy link
Copy Markdown
Contributor

@GrooveStomp GrooveStomp Sep 19, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not looking at this one too closely; I'll leave that for @sshi100


apply-k8s-utils:
cd kubernetes/terraform/environments/$(ENVIRONMENT) && \
terraform init && \
terraform apply $(AUTO_APPROVE)

update-k8s-conf:
aws eks --region <% index .Params `region` %> update-kubeconfig --role "arn:aws:iam::<% index .Params `accountId` %>:role/$(PROJECT)-kubernetes-admin-$(ENVIRONMENT)" --name $(PROJECT)-$(ENVIRONMENT)-<% index .Params `region` %>
aws eks --region $(AWS_DEFAULT_REGION) update-kubeconfig --role "arn:aws:iam::<% index .Params `accountId` %>:role/$(PROJECT)-kubernetes-admin-$(ENVIRONMENT)" --name $(KUBE_CONTEXT) --alias $(KUBE_CONTEXT)
Copy link
Copy Markdown
Contributor

@GrooveStomp GrooveStomp Sep 19, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍


post-apply-setup:
cd scripts && ENVIRONMENT=$(ENVIRONMENT) PROJECT=$(PROJECT) sh post-apply.sh

teardown: teardown-k8s-utils teardown-env teardown-secrets teardown-remote-state

teardown-remote-state:
@echo "Deleting remote state is not reversible, are you sure you want to delete the resources? [y/N]:" && read ans && [ $${ans:-N} == y ] && \
export AWS_PAGER='' && export AWS_DEFAULT_REGION=<% index .Params `region` %> && \
aws s3 rm s3://$(PROJECT)-$(ENVIRONMENT)-terraform-state --recursive && \
aws s3 rb s3://$(PROJECT)-$(ENVIRONMENT)-terraform-state --force && \
aws dynamodb delete-table --region <% index .Params `region` %> --table-name $(PROJECT)-$(ENVIRONMENT)-terraform-state-locks
@echo "Deleting remote state is not reversible, are you sure you want to delete the resources? [y/N]:" ; read ans ; [ $${ans:-N} == "y" ] || exit 1
Copy link
Copy Markdown
Contributor

@GrooveStomp GrooveStomp Sep 19, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What's the difference between ; and && here?
Both work the same for me locally with happy path, so I approve; but I don't understand.

Copy link
Copy Markdown
Contributor Author

@bmonkman bmonkman Sep 19, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

; will run the next command regardless of the exit code of the previous one. In this case echo and read are pretty much guaranteed to succeed so && will do the same thing, but ; makes it more clear that we don't care about the return codes, whereas we do care about the result of the comparison at the end.

Copy link
Copy Markdown
Contributor

@GrooveStomp GrooveStomp Sep 19, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! Great to know. :-)

aws dynamodb delete-table --region $(AWS_DEFAULT_REGION) --table-name $(PROJECT)-$(ENVIRONMENT)-terraform-state-locks
aws s3 rm s3://$(PROJECT)-$(ENVIRONMENT)-terraform-state --recursive
# TODO : This doesn't work because bucket versioning is enabled, we would need to loop through all versions of files and delete them manually
aws s3 rb s3://$(PROJECT)-$(ENVIRONMENT)-terraform-state --force

teardown-secrets:
@echo "Deleting secrets is not reversible, are you sure you want to delete the secrets? [y/N]:" && read ans && [ $${ans:-N} == y ] && \
export AWS_PAGER='' && export AWS_DEFAULT_REGION=<% index .Params `region` %> && \
aws secretsmanager list-secrets --region <% index .Params `region` %> --query "SecretList[?Tags[?Key=='project' && Value=='$(PROJECT)']].[Name] | [0][0]" | xargs aws secretsmanager delete-secret --region <% index .Params `region` %> --secret-id && \
aws secretsmanager list-secrets --region <% index .Params `region` %> --query "SecretList[?Tags[?Key=='rds' && Value=='$(PROJECT)-$(ENVIRONMENT)']].[Name] | [0][0]" | xargs aws secretsmanager delete-secret --region <% index .Params `region` %> --secret-id && \
aws secretsmanager list-secrets --region <% index .Params `region` %> --query "SecretList[?Tags[?Key=='sendgrid' && Value=='$(PROJECT)']].[Name] | [0][0]" | xargs aws secretsmanager delete-secret --region <% index .Params `region` %> --secret-id && \
aws iam delete-access-key --user-name $(PROJECT)-ci-user --access-key-id $(shell aws iam list-access-keys --user-name $(PROJECT)-ci-user --query "AccessKeyMetadata[0].AccessKeyId" | sed 's/"//g') && \
aws iam delete-user --user-name $(PROJECT)-ci-user && \
@echo "Deleting secrets is not reversible, are you sure you want to delete the secrets? [y/N]:" ; read ans ; [ $${ans:-N} == "y" ] || exit 1
aws secretsmanager list-secrets --region $(AWS_DEFAULT_REGION) --query "SecretList[?Tags[?Key=='project' && Value=='$(PROJECT)']].[Name] | [0][0]" | xargs aws secretsmanager delete-secret --region $(AWS_DEFAULT_REGION) --secret-id || echo "Secret already removed"
aws secretsmanager list-secrets --region $(AWS_DEFAULT_REGION) --query "SecretList[?Tags[?Key=='rds' && Value=='$(PROJECT)-$(ENVIRONMENT)']].[Name] | [0][0]" | xargs aws secretsmanager delete-secret --region $(AWS_DEFAULT_REGION) --secret-id || echo "Secret already removed"
aws secretsmanager list-secrets --region $(AWS_DEFAULT_REGION) --query "SecretList[?Tags[?Key=='sendgrid' && Value=='$(PROJECT)']].[Name] | [0][0]" | xargs aws secretsmanager delete-secret --region $(AWS_DEFAULT_REGION) --secret-id || echo "Secret already removed"
aws iam list-access-keys --user-name $(PROJECT)-ci-user --query "AccessKeyMetadata[0].AccessKeyId" --out text | xargs aws iam delete-access-key --user-name $(PROJECT)-ci-user --access-key-id
aws iam delete-user --user-name $(PROJECT)-ci-user
aws iam list-role-policies --role-name $(PROJECT)-eks-cluster-creator --query "PolicyNames" | jq -r ".[]" | xargs -n1 aws iam delete-role-policy --role-name $(PROJECT)-eks-cluster-creator --policy-name
aws iam list-attached-role-policies --role-name $(PROJECT)-eks-cluster-creator --query "AttachedPolicies[].PolicyArn" | jq -r ".[]" | xargs -n1 aws iam detach-role-policy --role-name $(PROJECT)-eks-cluster-creator --policy-arn
aws iam delete-role --role-name $(PROJECT)-eks-cluster-creator

teardown-env:
Expand Down