Skip to content

Commit e9ede1d

Browse files
LeoDiazLLeoDiazL
authored
Initial commit
1 parent e02c321 commit e9ede1d

File tree

3 files changed

+557
-1
lines changed

3 files changed

+557
-1
lines changed

‎LICENSE

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2023 Bitovi
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md

Lines changed: 225 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,225 @@
1-
# github-actions-deploy-ecs
1+
# Deploy AWS ECS Cluster
2+
3+
`bitovi/github-actions-deploy-ecs` Deploys a ECS Cluster.
4+
5+
This action uses the new GitHub Actions Commons, that is used by many Bitovi GitHub Actions, and so it's constantly evolving and improving.
6+
7+
8+
## You are here
9+
With this action, you can create your ECS (Fargate or EC2) cluster, with tasks and service definitions in a matter of minutes.
10+
11+
If you would like to deploy a backend app/service, check out our other actions:
12+
| Action | Purpose |
13+
| ------ | ------- |
14+
| [Deploy Docker to EC2](https://github.com/bitovi/github-actions-deploy-docker-to-ec2) | Deploys a repo with a Dockerized application to a virtual machine (EC2) on AWS |
15+
| [Deploy static site to AWS (S3/CDN/R53](https://github.com/marketplace/actions/deploy-static-site-to-aws-s3-cdn-r53) | Hosts a static site in AWS S3 with CloudFront |
16+
17+
# Need help or have questions?
18+
This project is supported by [Bitovi, A DevOps consultancy](https://www.bitovi.com/services/devops-consulting).
19+
20+
You can **get help or ask questions** on our:
21+
22+
- [Discord Community](https://discord.gg/J7ejFsZnJ4Z)
23+
24+
Or, you can hire us for training, consulting, or development. [Set up a free consultation](https://www.bitovi.com/services/devops-consulting).
25+
26+
# Basic Use
27+
28+
For basic usage, create `.github/workflows/deploy.yaml` with the following to build on push.
29+
```yaml
30+
name: Deploy ECS
31+
on:
32+
push:
33+
branches: [ main ]
34+
35+
jobs:
36+
deploy-ecs:
37+
runs-on: ubuntu-latest
38+
steps:
39+
- name: Create an ECS-Fargate deploy
40+
uses: bitovi/[email protected]
41+
with:
42+
aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID_SANDBOX }}
43+
aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY_SANDBOX }}
44+
aws_default_region: us-east-1
45+
46+
aws_ecs_enable: true
47+
aws_ecs_task_cpu: 1024,2048
48+
aws_ecs_task_mem: 2048,6144
49+
aws_ecs_app_image: some.dkr.ecr.us-east-1.amazonaws.com/repo:fe,some.dkr.ecr.us-east-1.amazonaws.com/repo:be
50+
aws_ecs_assign_public_ip: true
51+
aws_ecs_container_port: 3000,3001
52+
aws_ecs_lb_redirect_enable: true
53+
aws_ecs_lb_container_path: 'api'
54+
aws_ecs_cloudwatch_enable: true
55+
aws_ecs_cloudwatch_retention_days: 7
56+
aws_ecs_additional_tags: '{\"key\":\"value\",\"key2\":\"value2\"}'
57+
58+
aws_r53_enable: true
59+
aws_r53_domain_name: bitovi.com
60+
aws_r53_sub_domain_name: ecs-test
61+
```
62+
63+
# Inputs
64+
65+
The following inputs can be used as `step.with` keys
66+
67+
## Input groups
68+
1. [AWS Specific](#aws-specific)
69+
1. [GitHub Commons main inputs](#github-commons-main-inputs)
70+
1. [ECS](#ecs-inputs)
71+
1. [Secrets and Environment Variables](#secrets-and-environment-variables-inputs)
72+
1. [VPC](#vpc-inputs)
73+
1. [DNS](#dns-inputs)
74+
75+
#### **AWS Specific**
76+
| Name | Type | Description |
77+
|------------------|---------|------------------------------------|
78+
| `aws_access_key_id` | String | AWS access key ID |
79+
| `aws_secret_access_key` | String | AWS secret access key |
80+
| `aws_session_token` | String | AWS session token |
81+
| `aws_default_region` | String | AWS default region. Defaults to `us-east-1` |
82+
| `aws_resource_identifier` | String | Set to override the AWS resource identifier for the deployment. Defaults to `${GITHUB_ORG_NAME}-${GITHUB_REPO_NAME}-${GITHUB_BRANCH_NAME}`. Use with destroy to destroy specific resources. |
83+
| `aws_additional_tags` | JSON | Add additional tags to the terraform [default tags](https://www.hashicorp.com/blog/default-tags-in-the-terraform-aws-provider), any tags put here will be added to all provisioned resources.|
84+
<hr/>
85+
<br/>
86+
87+
#### **GitHub Commons main inputs**
88+
| Name | Type | Description |
89+
|------------------|---------|------------------------------------|
90+
| `checkout` | Boolean | Specifies if this action should checkout the code (i.e. whether or not to run the uses: actions/checkout@v3 action prior to deploying so that the deployment has access to the repo files). Defaults to `true`. |
91+
| `bitops_code_only` | Boolean | If `true`, will run only the generation phase of BitOps, where the Terraform and Ansible code is built. |
92+
| `bitops_code_store` | Boolean | Store BitOps generated code as a GitHub artifact. |
93+
| `tf_stack_destroy` | Boolean | Set to `true` to destroy the stack - Will delete the `elb logs bucket` after the destroy action runs. |
94+
| `tf_state_file_name` | String | Change this to be anything you want to. Carefull to be consistent here. A missing file could trigger recreation, or stepping over destruction of non-defined objects. Defaults to `tf-state-aws`, `tf-state-ecr` or `tf-state-eks.` |
95+
| `tf_state_file_name_append` | String | Appends a string to the tf-state-file. Setting this to `unique` will generate `tf-state-aws-unique`. (Can co-exist with `tf_state_file_name`) |
96+
| `tf_state_bucket` | String | AWS S3 bucket name to use for Terraform state. See [note](#s3-buckets-naming) |
97+
| `tf_state_bucket_destroy` | Boolean | Force purge and deletion of S3 bucket defined. Any file contained there will be destroyed. `tf_stack_destroy` must also be `true`. Default is `false`. |
98+
99+
100+
#### **ECS Inputs***
101+
| Name | Type | Description |
102+
|------------------|---------|------------------------------------|
103+
| `aws_ecs_enable`| Boolean | Toggle ECS Creation. Defaults to `false`. |
104+
| `aws_ecs_service_name`| String | Elastic Container Service name. |
105+
| `aws_ecs_cluster_name`| String | Elastic Container Service cluster name. |
106+
| `aws_ecs_service_launch_type`| String | Configuration type. Could be `EC2`, `FARGATE` or `EXTERNAL`. Defaults to `FARGATE`. |
107+
| `aws_ecs_task_type`| String | Configuration type. Could be `EC2`, `FARGATE` or empty. Will default to `aws_ecs_service_launch_type` if none defined. (Blank if `EXTERNAL`). |
108+
| `aws_ecs_task_name`| String | Elastic Container Service task name. If task is defined with a JSON file, should be the same as the container name. |
109+
| `aws_ecs_task_execution_role`| String | Elastic Container Service task execution role name from IAM. Defaults to `ecsTaskExecutionRole`. |
110+
| `aws_ecs_task_json_definition_file`| String | Name of the json file containing task definition. Overrides every other input. |
111+
| `aws_ecs_task_network_mode`| String | Network type to use in task definition. One of `none`, `bridge`, `awsvpc`, and `host`. |
112+
| `aws_ecs_task_cpu`| String | Task CPU Amount. |
113+
| `aws_ecs_task_mem`| String | Task Mem Amount. |
114+
| `aws_ecs_container_cpu`| String | Container CPU Amount. |
115+
| `aws_ecs_container_mem`| String | Container Mem Amount. |
116+
| `aws_ecs_node_count`| String | Node count for ECS Cluster. |
117+
| `aws_ecs_app_image`| String | Name of the container image to be used. |
118+
| `aws_ecs_security_group_name`| String | ECS Secruity group name. |
119+
| `aws_ecs_assign_public_ip`| Boolean | Assign public IP to node. |
120+
| `aws_ecs_container_port`| String | Comma separated list of container ports. One for each. |
121+
| `aws_ecs_lb_port`| String | Comma serparated list of ports exposed by the load balancer. One for each. |
122+
| `aws_ecs_lb_redirect_enable`| String | Toggle redirect from HTTP and/or HTTPS to the main port. |
123+
| `aws_ecs_lb_container_path`| String | Comma separated list of paths for subsequent deployed containers. Need `aws_ecs_lb_redirect_enable` to be true. eg. api. (For http://bitovi.com/api/). If you have multiple, set them to `api,monitor,prom,,` (This example is for 6 containers) |
124+
| `aws_ecs_autoscaling_enable`| Boolean | Toggle ecs autoscaling policy. |
125+
| `aws_ecs_autoscaling_max_nodes`| String | Max ammount of nodes to scale up to. |
126+
| `aws_ecs_autoscaling_min_nodes`| String | Min ammount of nodes to scale down to. |
127+
| `aws_ecs_autoscaling_max_mem`| String | Define autoscaling max mem. |
128+
| `aws_ecs_autoscaling_max_cpu`| String | Define autoscaling max cpu. |
129+
| `aws_ecs_cloudwatch_enable`| Boolean | Toggle cloudwatch for ECS. Default `false`. |
130+
| `aws_ecs_cloudwatch_lg_name`| String | Log group name. Will default to `aws_identifier` if none. |
131+
| `aws_ecs_cloudwatch_skip_destroy`| Boolean | Toggle deletion or not when destroying the stack. |
132+
| `aws_ecs_cloudwatch_retention_days`| String | Number of days to retain logs. 0 to never expire. Defaults to `14`. |
133+
| `aws_ecs_additional_tags`| JSON | Add additional tags to the terraform [default tags](https://www.hashicorp.com/blog/default-tags-in-the-terraform-aws-provider), any tags put here will be added to ECS provisioned resources.|
134+
<hr/>
135+
<br/>
136+
137+
138+
#### **Secrets and Environment Variables Inputs**
139+
| Name | Type | Description - Check note about [**environment variables**](#environment-variables). |
140+
|------------------|---------|------------------------------------|
141+
| `env_aws_secret` | String | Secret name to pull environment variables from AWS Secret Manager. |
142+
| `env_repo` | String | `.env` file containing environment variables to be used with the app. Name defaults to `repo_env`. |
143+
| `env_ghs` | String | `.env` file to be used with the app. This is the name of the [Github secret](https://docs.github.com/es/actions/security-guides/encrypted-secrets). |
144+
| `env_ghv` | String | `.env` file to be used with the app. This is the name of the [Github variables](https://docs.github.com/en/actions/learn-github-actions/variables). |
145+
<hr/>
146+
<br/>
147+
148+
149+
#### **VPC Inputs**
150+
| Name | Type | Description |
151+
|------------------|---------|------------------------------------|
152+
| `aws_vpc_create` | Boolean | Define if a VPC should be created |
153+
| `aws_vpc_name` | String | Define a name for the VPC. Defaults to `VPC for ${aws_resource_identifier}`. |
154+
| `aws_vpc_cidr_block` | String | Define Base CIDR block which is divided into subnet CIDR blocks. Defaults to `10.0.0.0/16`. |
155+
| `aws_vpc_public_subnets` | String | Comma separated list of public subnets. Defaults to `10.10.110.0/24`|
156+
| `aws_vpc_private_subnets` | String | Comma separated list of private subnets. If no input, no private subnet will be created. Defaults to `<none>`. |
157+
| `aws_vpc_availability_zones` | String | Comma separated list of availability zones. Defaults to `aws_default_region+<random>` value. If a list is defined, the first zone will be the one used for the EC2 instance. |
158+
| `aws_vpc_id` | String | AWS VPC ID. Accepts `vpc-###` values. |
159+
| `aws_vpc_subnet_id` | String | AWS VPC Subnet ID. If none provided, will pick one. (Ideal when there's only one) |
160+
| `aws_vpc_additional_tags` | JSON | Add additional tags to the terraform [default tags](https://www.hashicorp.com/blog/default-tags-in-the-terraform-aws-provider), any tags put here will be added to vpc provisioned resources.|
161+
<hr/>
162+
<br/>
163+
164+
165+
#### **DNS Inputs**
166+
| Name | Type | Description |
167+
|------------------|---------|------------------------------------|
168+
| `aws_r53_enable` | Boolean | Set this to true if you wish to manage certificates through AWS Certificate Manager with Terraform. **See note**. Default is `false`. |
169+
| `aws_r53_domain_name` | String | Define the root domain name for the application. e.g. bitovi.com'. |
170+
| `aws_r53_sub_domain_name` | String | Define the sub-domain part of the URL. Defaults to `${GITHUB_ORG_NAME}-${GITHUB_REPO_NAME}-${GITHUB_BRANCH_NAME}`. |
171+
| `aws_r53_root_domain_deploy` | Boolean | Deploy application to root domain. Will create root and www records. Default is `false`. |
172+
| `aws_r53_enable_cert` | Boolean | Set this to true if you wish to manage certificates through AWS Certificate Manager with Terraform. **See note**. Default is `false`. |
173+
| `aws_r53_cert_arn` | String | Define the certificate ARN to use for the application. **See note**. |
174+
| `aws_r53_create_root_cert` | Boolean | Generates and manage the root cert for the application. **See note**. Default is `false`. |
175+
| `aws_r53_create_sub_cert` | Boolean | Generates and manage the sub-domain certificate for the application. **See note**. Default is `false`. |
176+
| `aws_r53_additional_tags` | JSON | Add additional tags to the terraform [default tags](https://www.hashicorp.com/blog/default-tags-in-the-terraform-aws-provider), any tags put here will be added to R53 provisioned resources.|
177+
<hr/>
178+
<br/>
179+
180+
## Contributing
181+
We would love for you to contribute to [`bitovi/github-actions-storybook-to-github-pages`](hhttps://github.com/bitovi/github-actions-storybook-to-github-pages). [Issues](https://github.com/bitovi/github-actions-storybook-to-github-pages/issues) and [Pull Requests](https://github.com/bitovi/github-actions-storybook-to-github-pages/pulls) are welcome!
182+
183+
184+
## Note about resource identifiers
185+
186+
Most resources will contain the tag `${GITHUB_ORG_NAME}-${GITHUB_REPO_NAME}-${GITHUB_BRANCH_NAME}`, some of them, even the resource name after.
187+
We limit this to a 60 characters string because some AWS resources have a length limit and short it if needed.
188+
189+
We use the kubernetes style for this. For example, kubernetes -> k(# of characters)s -> k8s. And so you might see some compressions are made.
190+
191+
For some specific resources, we have a 32 characters limit. If the identifier length exceeds this number after compression, we remove the middle part and replace it for a hash made up from the string itself.
192+
193+
## Note about tagging
194+
195+
There's the option to add any kind of defined tag's to each grouping module. Will be added to the commons tagging.
196+
An example of how to set them: `{"key1": "value1", "key2": "value2"}`'
197+
198+
### S3 buckets naming
199+
200+
Buckets names can be made of up to 63 characters. If the length allows us to add -tf-state, we will do so. If not, a simple -tf will be added.
201+
202+
## CERTIFICATES - Only for AWS Managed domains with Route53
203+
204+
As a default, the application will be deployed and the ELB public URL will be displayed.
205+
206+
If `aws_r53_domain_name` is defined, we will look up for a certificate with the name of that domain (eg. `example.com`). We expect that certificate to contain both `example.com` and `*.example.com`.
207+
208+
Setting `aws_r53_create_root_cert` to `true` will create this certificate with both `example.com` and `*.example.com` for you, and validate them. (DNS validation).
209+
210+
Setting `aws_r53_create_sub_cert` to `true` will create a certificate **just for the subdomain**, and validate it.
211+
212+
> :warning: Be very careful here! **Created certificates are fully managed by Terraform**. Therefor **they will be destroyed upon stack destruction**.
213+
214+
To change a certificate (root_cert, sub_cert, ARN or pre-existing root cert), you must first set the `aws_r53_enable_cert` flag to false, run the action, then set the `aws_r53_enable_cert` flag to true, add the desired settings and excecute the action again. (**This will destroy the first certificate.**)
215+
216+
This is necessary due to a limitation that prevents certificates from being changed while in use by certain resources.
217+
218+
## License
219+
The scripts and documentation in this project are released under the [MIT License](https://github.com/bitovi/github-actions-storybook-to-github-pages/blob/main/LICENSE).
220+
221+
# Provided by Bitovi
222+
[Bitovi](https://www.bitovi.com/) is a proud supporter of Open Source software.
223+
224+
# We want to hear from you.
225+
Come chat with us about open source in our Bitovi community [Discord](https://discord.gg/J7ejFsZnJ4Z!

0 commit comments

Comments
 (0)