Skip to content

Commit 25da73c

Browse files
vabvab
committed
add dsc app container
Why these changes are being introduced: This commit creates the DSpace Submission Composer (DSC) application ECR container infrastructure. The application source code is located in the https://github.com/MITLibraries/dspace-submission-composer repository. DSC is an AWS Fargate application. How this addresses that need: * Add a standard ECR for an ECS w/ Fargate launch type * Update to Terraform v11 * Update the shared workflow for pre-commit versions * Update the CODEOWNERS file for MIT Libraries GH group security re-org * Update README.md documentation * Minor code clean-up Side effects of this change: None Relevant ticket(s): https://mitlibraries.atlassian.net/browse/IN-1161 Changes to be committed: modified: .github/CODEOWNERS modified: .pre-commit-config.yaml modified: README.md new file: dsc_ecr.tf modified: modules/ecr/README.md modified: modules/ecr/main.tf modified: modules/ecr/versions.tf modified: versions.tf
1 parent 03fb383 commit 25da73c

File tree

8 files changed

+88
-14
lines changed

8 files changed

+88
-14
lines changed

‎.github/CODEOWNERS‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
# Teams can be specified as code owners as well. Teams should be identified in
1414
# the format @org/team-name. Teams must have explicit write access to the
1515
# repository.
16-
* @mitlibraries/infraeng-terraform-reviewers
16+
* @mitlibraries/infraeng
1717

1818
# We set the senior engineer in the team as the owner of the CODEOWNERS file as
1919
# a layer of protection for unauthorized changes.

‎.pre-commit-config.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
repos:
22
- repo: https://github.com/antonbabenko/pre-commit-terraform
3-
rev: "v1.97.0"
3+
rev: "v1.97.4"
44
hooks:
55
- id: terraform_fmt
66
args:
@@ -12,8 +12,8 @@ repos:
1212
- id: terraform-docs-go
1313
args: ["markdown", "table", "--config", "./.terraform-docs.yaml", "--recursive", "--output-file", "README.md", "./"]
1414
- repo: https://github.com/bridgecrewio/checkov.git
15-
rev: '3.2.353'
15+
rev: '3.2.378'
1616
hooks:
1717
- id: checkov
18-
language_version: python3.11
18+
language_version: python3.12
1919
verbose: false

‎README.md‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -98,8 +98,10 @@ This is a core infrastructure repository that defines infrastructure related to
9898
* [Alma Integrations](https://github.com/MITLibraries/mitlib-tf-workloads-patronload)
9999
* [Alma Patron Load Application Container](https://github.com/MITLibraries/alma-patronload)
100100
* [ASATI](https://github.com/MITLibraries/mitlib-tf-workloads-asati)
101-
* [ASATI Application Contaier](https://github.com/MITLibraries/asati)
101+
* [ASATI Application Container](https://github.com/MITLibraries/asati)
102102
* [Carbon](https://github.com/MITLibraries/mitlib-tf-workloads-carbon)
103+
* [DSC](https://github.com/MITLibraries/mitlib-tf-workloads-dsc)
104+
* [DSC Application Container](https://github.com/MITLibraries/dspace-submission-composer)
103105
* [DSS](https://github.com/MITLibraries/mitlib-tf-workloads-dss)
104106
* [DSpace Submission Service Application Container](https://github.com/MITLibraries/dspace-submission-service)
105107
* [ETD](https://github.com/MITLibraries/mitlib-tf-workloads-etd)
@@ -125,7 +127,7 @@ This is a core infrastructure repository that defines infrastructure related to
125127

126128
* Owner: See [CODEOWNERS](./.github/CODEOWNERS)
127129
* Team: See [CODEOWNERS](./.github/CODEOWNERS)
128-
* Last Maintenance: 2025-01
130+
* Last Maintenance: 2025-03
129131

130132
## TF markdown is automatically inserted at the bottom of this file, nothing should be written beyond this point
131133

@@ -134,7 +136,7 @@ This is a core infrastructure repository that defines infrastructure related to
134136

135137
| Name | Version |
136138
|------|---------|
137-
| terraform | ~> 1.5 |
139+
| terraform | ~> 1.11 |
138140
| aws | ~> 5.0 |
139141

140142
## Providers
@@ -152,6 +154,7 @@ This is a core infrastructure repository that defines infrastructure related to
152154
| ecr\_bursar | ./modules/ecr | n/a |
153155
| ecr\_carbon | ./modules/ecr | n/a |
154156
| ecr\_creditcardslips | ./modules/ecr | n/a |
157+
| ecr\_dsc | ./modules/ecr | n/a |
155158
| ecr\_dss | ./modules/ecr | n/a |
156159
| ecr\_hrqb\_client | ./modules/ecr | n/a |
157160
| ecr\_matomo | ./modules/ecr | n/a |
@@ -217,6 +220,10 @@ This is a core infrastructure repository that defines infrastructure related to
217220
| creditcardslips\_makefile | Full contents of the Makefile for the alma-creditcardslips repo (allows devs to push to Dev account only) |
218221
| creditcardslips\_prod\_promote\_workflow | Full contents of the prod-promote.yml for the alma-creditcardslips repo |
219222
| creditcardslips\_stage\_build\_workflow | Full contents of the stage-build.yml for the alma-creditcardslips repo |
223+
| dsc\_fargate\_dev\_build\_workflow | Full contents of the dev-build.yml for the dsc repo |
224+
| dsc\_fargate\_makefile | Full contents of the Makefile for the dsc repo (allows devs to push to Dev account only) |
225+
| dsc\_fargate\_prod\_promote\_workflow | Full contents of the prod-promote.yml for the dsc repo |
226+
| dsc\_fargate\_stage\_build\_workflow | Full contents of the stage-build.yml for the dsc repo |
220227
| dss\_fargate\_dev\_build\_workflow | Full contents of the dev-build.yml for the dss repo |
221228
| dss\_fargate\_makefile | Full contents of the Makefile for the dss repo (allows devs to push to Dev account only) |
222229
| dss\_fargate\_prod\_promote\_workflow | Full contents of the prod-promote.yml for the dss repo |

‎dsc_ecr.tf‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
# DSpace Submission Composer (dsc) containers
2+
# This is a standard ECR for an ECS with a Fargate launch type
3+
locals {
4+
ecr_dsc = "dsc-${var.environment}"
5+
}
6+
7+
module "ecr_dsc" {
8+
source = "./modules/ecr"
9+
repo_name = "dspace-submission-composer"
10+
login_policy_arn = aws_iam_policy.login.arn
11+
oidc_arn = data.aws_ssm_parameter.oidc_arn.value
12+
environment = var.environment
13+
tfoutput_ssm_path = var.tfoutput_ssm_path
14+
tags = {
15+
app-repo = "dspace-submission-composer"
16+
}
17+
}
18+
19+
## Outputs to Terraform Cloud for devs ##
20+
21+
## For dsc application repo and ECR repository
22+
# Outputs in dev
23+
output "dsc_fargate_dev_build_workflow" {
24+
value = var.environment == "prod" || var.environment == "stage" ? null : templatefile("${path.module}/files/dev-build.tpl", {
25+
region = var.aws_region
26+
role = module.ecr_dsc.gha_role
27+
ecr = module.ecr_dsc.repository_name
28+
function = ""
29+
}
30+
)
31+
description = "Full contents of the dev-build.yml for the dsc repo"
32+
}
33+
output "dsc_fargate_makefile" {
34+
value = var.environment == "prod" || var.environment == "stage" ? null : templatefile("${path.module}/files/makefile.tpl", {
35+
ecr_name = module.ecr_dsc.repository_name
36+
ecr_url = module.ecr_dsc.repository_url
37+
function = ""
38+
}
39+
)
40+
description = "Full contents of the Makefile for the dsc repo (allows devs to push to Dev account only)"
41+
}
42+
43+
# Outputs in stage
44+
output "dsc_fargate_stage_build_workflow" {
45+
value = var.environment == "prod" || var.environment == "dev" ? null : templatefile("${path.module}/files/stage-build.tpl", {
46+
region = var.aws_region
47+
role = module.ecr_dsc.gha_role
48+
ecr = module.ecr_dsc.repository_name
49+
function = ""
50+
}
51+
)
52+
description = "Full contents of the stage-build.yml for the dsc repo"
53+
}
54+
55+
# Outputs after promotion to prod
56+
output "dsc_fargate_prod_promote_workflow" {
57+
value = var.environment == "stage" || var.environment == "dev" ? null : templatefile("${path.module}/files/prod-promote.tpl", {
58+
region = var.aws_region
59+
role_stage = "${module.ecr_dsc.repo_name}-gha-stage"
60+
role_prod = "${module.ecr_dsc.repo_name}-gha-prod"
61+
ecr_stage = "${module.ecr_dsc.repo_name}-stage"
62+
ecr_prod = "${module.ecr_dsc.repo_name}-prod"
63+
function = ""
64+
}
65+
)
66+
description = "Full contents of the prod-promote.yml for the dsc repo"
67+
}

‎modules/ecr/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
| Name | Version |
55
|------|---------|
6-
| terraform | ~> 1.5 |
6+
| terraform | ~> 1.11 |
77
| aws | ~> 5.0 |
88

99
## Providers

‎modules/ecr/main.tf‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
1-
################################################################################
2-
################################################################################
1+
##############################################################################
2+
##############################################################################
33
# Create the ECR repository to store the ECS image(s) along with a lifecycle
44
# policy.
55
resource "aws_ecr_repository" "this" {
66
#checkov:skip=CKV_AWS_51:We do not currently use releases for this, but may choose to turn this on in the future
7-
#checkov:skip=CKV_AWS_136:We dont store any private information in our images, encyption is unncessary
7+
#checkov:skip=CKV_AWS_136:We do not store any private information in our images, encryption is unnecessary
88
name = "${var.repo_name}-${var.environment}"
99
image_scanning_configuration {
1010
scan_on_push = true
@@ -14,7 +14,7 @@ resource "aws_ecr_repository" "this" {
1414
}
1515

1616
resource "aws_ecr_lifecycle_policy" "this" {
17-
#checkov:skip=CKV_AWS_136:We dont store any private information in our images, encyption is unncessary
17+
#checkov:skip=CKV_AWS_136:We do not store any private information in our images, encryption is unnecessary
1818
#checkov:skip=CKV_AWS_163:We do not use image scanning by AWS right now
1919
#checkov:skip=CKV_AWS_51:We do not currently use releases for this, but may choose to turn this on in the future
2020
repository = aws_ecr_repository.this.name

‎modules/ecr/versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
# Providers themselves are set in the `providers.tf` file.
44

55
terraform {
6-
required_version = "~> 1.5"
6+
required_version = "~> 1.11"
77

88
required_providers {
99
aws = {

‎versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
# Providers themselves are set in the `providers.tf` file.
44

55
terraform {
6-
required_version = "~> 1.5"
6+
required_version = "~> 1.11"
77

88
required_providers {
99
aws = {

0 commit comments

Comments
 (0)