~CircleCIでTerraformリリースのサーバーレス化~ インフラの独自リリースを継続的リリースへ

tree .
.
├── Dockerfile
├── README.md
├── docker-compose.yml
├── root
│   └── dev-credentials
└── setting_dev.sh

version: '3'
services:
  app:
    container_name: menta-terraform-dev
    build:
      context: .
      dockerfile: Dockerfile
    image: menta-terraform-dev
    volumes:
      - ~/hoge:/var/www/hoge/:delegated
    tty: true

FROM hashicorp/terraform:1.0.5
ENV APP_ROOT /var/www/hoge
WORKDIR $APP_ROOT

# Setup UTC+9
RUN apk --update add tzdata && \
cp /usr/share/zoneinfo/Asia/Tokyo /etc/localtime && \
apk del tzdata && \
rm -rf /var/cache/apk/*

# install packages
RUN apk update && \
apk upgrade && \
apk add --update --no-cache \
bash \
coreutils \
vim \
python3 \
py3-pip

# install aws-cli
RUN pip3 install --upgrade pip
RUN pip3 install awscli && rm -rf /var/cache/apk/*

# copy empty credentials
RUN mkdir /root/.aws
COPY root/dev-credentials /root/.aws/credentials
COPY root/.bashrc /root/.bashrc

ENTRYPOINT ["/bin/bash"]

#!/bin/bash

aws --profile=terraform-kms s3 cp s3://hoge/dev.key /root/.aws/

aws --profile=hoge kms decrypt \
--ciphertext-blob fileb:///root/.aws/dev.key \
--output text \
--query Plaintext \
| base64 --decode > /root/.aws/newcredentials

mv /root/.aws/newcredentials /root/.aws/credentials

version: 2.1

setup: true

orbs:
  aws-ecr: circleci/aws-ecr@7.0.0
  aws-ecs: circleci/aws-ecs@2.2.0
  aws-cli: circleci/aws-cli@2.0.0
  path-filtering: circleci/path-filtering@0.0.3
  slack: circleci/slack@3.4.2

parameters:
deploy_app_stg:
type: boolean
default: false
deploy_app_private:
type: boolean
default: false

~省略~

workflows:
  version: 2
  ci:
    jobs:
      - laravel_test
      - stg_terraform_fmt_validate
      - stg_terraform_plan:
          requires:
            - stg_terraform_fmt_validate
      - prd_terraform_fmt_validate
      - prd_terraform_plan:
          requires:
      - prd_terraform_fmt_validate
      - path-filtering/filter:
          base-revision: origin/master
          config-path: .circleci/deploy.yml
          mapping: |
            terraform/stg/.* stg_terraform_apply true
            terraform/prd/.* prd_terraform_apply true

version: 2.1
orbs:
  aws-ecr: circleci/aws-ecr@7.0.0
  aws-ecs: circleci/aws-ecs@2.2.0
  aws-cli: circleci/aws-cli@2.0.0
  slack: circleci/slack@3.4.2

parameters:
stg_terraform_apply:
type: boolean
default: false
prd_terraform_apply:
type: boolean
default: false
deploy_app_stg:
type: boolean
default: false
deploy_app_private:
type: boolean
default: false

~省略~
jobs:
  check_terraform_difference:
    <<: *default_config
    steps:
      - run:
         name: install package
         command: |
           apk add bash curl jq
      - run: echo "No terraform difference ok !!"
      - slack/status:
          fail_only: true
          mentions: 'here'
          failure_message: 'Error check terraform difference 🚨 \n :innocent: ${CIRCLE_USERNAME} :branch: ${CIRCLE_BRANCH}'
          webhook: ${SLACK_WEBHOOK}
      - slack/notify:
          title: 👍
          color: '#42f486'
          message: 'No terraform difference OK !! ✨ \n :grin: ${CIRCLE_USERNAME} :branch: ${CIRCLE_BRANCH}'
          webhook: ${SLACK_WEBHOOK}
~省略~

workflows:
  version: 2.1
  check_terraform_difference:
    jobs:
     - check_terraform_difference
    when:
      and:
        - not: << pipeline.parameters.stg_terraform_apply >>
        - not: << pipeline.parameters.prd_terraform_apply >>
  stg_terraform_apply:
    when: << pipeline.parameters.stg_terraform_apply >>
    jobs:
      - stg_terraform_apply:
          filters:
            branches:
              only: master
  prd_terraform_apply:
    when: << pipeline.parameters.prd_terraform_apply >>
    jobs:
      - prd_terraform_apply:
          filters:
            branches:
              only: master
  deploy_app_stg:
    when: << pipeline.parameters.deploy_app_stg >>
    jobs:
      - deploy_app_stg
  deploy_app_private:
    when: << pipeline.parameters.deploy_app_private >>
    jobs:
      - deploy_app_private
  deploy_app_prd:
    jobs:
      - deploy_app_prd:
          filters:
            branches:
              only: master