Incubator v2

.github/workflows/deploy-to-incubator.yml

@@ -6,55 +6,46 @@ on:
         type: choice
         description: The AWS environment to deploy (dev/test/prod)
         options: 
-        - dev
-        - test
+        - qa
         - prod
 permissions:
   id-token: write
   contents: read
 jobs:
-  TerraformPlan:
+  Deploy:
     runs-on: ubuntu-latest
     steps:
       - name: Clone repo
         uses: actions/checkout@v4
+
       - name: Configure aws credentials
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          role-to-assume: arn:aws:iam::035866691871:role/gha-incubator
-          role-session-name: ghaincubatorsession
+          role-to-assume: arn:aws:iam::035866691871:role/incubator-cicd-home-unite-us
+          role-session-name: incubator-cicd-home-unite-us
           aws-region: us-west-2
-      - name: Push Docker container to ECR
-        # env:
-        #   IMAGE_URL: ${{  }}
+
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v1
+
+      - name: Build, tag, and push the image to Amazon ECR
+        id: build-push-image
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          ECR_REPOSITORY: home-unite-us-fullstack
+          IMAGE_TAG: ${{ inputs.target-host-environment }}
         run: |
-          docker push 
-      - name: Update ECS
-        # env:
-        #   IMAGE_URL: ${{  }}
+          docker build -f ./.incubator/app.Dockerfile -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
+          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
+
+      - name: Redeploy image in ECS
+        id: redeploy-service
+        env:
+          CLUSTER_NAME: incubator-prod
+          SERVICE_NAME: home-unite-us-fullstack-${{ inputs.target-host-environment }}
         run: |
-          ## TODO: this will free us from having to maintain the template ecs task defintion
-          ##   file in sync with its terraform equivalent in the incubator IAC repo
-          # aws ecs describe-task-definition --task-definition homeuniteus --output json \
-          #   | jq --arg IMAGE_URL "${IMAGE_URL}" '.taskDefinition | .containerDefinitions[0].image = $IMAGE_URL' \
-          #   > ./ecs-task-definition.json
-
-          # populate and load the template file, by replacing the templated value(s) and storing output in a 
-          #   local env var
-          ECS_TASK_DEFINITION=$( sed "s/__IMAGE_URL__/${IMAGE_URL}/g" < ./.incubator/ecs-taskdef-template.json )
-
-          # register the task definition with the updated docker image url, write output to both stdout and 
-          #   local json file
-          aws ecs register-task-definition --cli-input-json "${ECS_TASK_DEFINITION}" \
-            | tee ./ecs-taskdef-revision.json
-
-          # force a new deployment for the new task definition we just registered
-          aws ecs update-service \
-            --cluster incubator-prod \
-            --service homeuniteus \
-            --task-definiton homeuniteus \
-            --force-new-deployment
-
+          aws ecs update-service --force-new-deployment --service $SERVICE_NAME --cluster $CLUSTER_NAME
 
 
 

.incubator/app.Dockerfile

@@ -1,6 +1,6 @@
 ARG NODE_VERSION=20.18.0-bookworm
 ARG HUU_BASE_VERSION=1.1
-ARG HUU_ECR_REPOSITORY=035866691871.dkr.ecr.us-west-2.amazonaws.com/homeuniteus
+ARG HUU_ECR_REPOSITORY=035866691871.dkr.ecr.us-west-2.amazonaws.com/home-unite-us-fullstack
 
 # use the official Node image for building the UI bundle
 FROM node:${NODE_VERSION} AS client-builder

backend/app/modules/deps.py

@@ -1,3 +1,4 @@
+import os
 import boto3
 
 import jwt
@@ -60,6 +61,10 @@ def db_session(engine: DbEngineDep):
 DbSessionDep = Annotated[Session, Depends(db_session)]
 
 def get_cognito_client(settings: SettingsDep):
+    # if this is running in ECS, we need to not set aws_access_key_id and aws_secret_access_key
+    if len(os.environ["COGNITO_ACCESS_ID"]) == 0 or len(os.environ["COGNITO_ACCESS_KEY"]) == 0:
+        return boto3.client('cognito-idp')
+
     cognito_client = boto3.client(
         "cognito-idp",
         region_name=settings.COGNITO_REGION,

flask-api/openapi_server/app.py

@@ -52,11 +52,15 @@ def boto_client(self):
         if self._boto_client:
             return self._boto_client
 
-        self._boto_client = boto3.client('cognito-idp', 
-                                         region_name=self.config["COGNITO_REGION"], 
-                                         aws_access_key_id=self.config["COGNITO_ACCESS_ID"],
-                                         aws_secret_access_key=self.config["COGNITO_ACCESS_KEY"]
-                                        )
+        # if this is running in ECS, we need to not set aws_access_key_id and aws_secret_access_key
+        if len(self.config["COGNITO_ACCESS_ID"]) == 0 or len(self.config["COGNITO_ACCESS_KEY"]) == 0:
+            self._boto_client = boto3.client('cognito-idp')
+        else:
+            self._boto_client = boto3.client('cognito-idp', 
+                                            region_name=self.config["COGNITO_REGION"], 
+                                            aws_access_key_id=self.config["COGNITO_ACCESS_ID"],
+                                            aws_secret_access_key=self.config["COGNITO_ACCESS_KEY"]
+                                            )
         return self._boto_client
 
     def calc_secret_hash(self, username: str) -> str:

scripts/build-for-incubator.bash

@@ -15,7 +15,7 @@ done;
 
 COMMIT_PREFIX="$(git log -n1 --pretty='%H' | head -c10)"
 TIMESTAMP="$(date +%Y%m%d-%H%M%S)"
-ECR_REPO='035866691871.dkr.ecr.us-west-2.amazonaws.com/homeuniteus'
+ECR_REPO='035866691871.dkr.ecr.us-west-2.amazonaws.com/home-unite-us-fullstack'
 
 IMAGE_URL="${ECR_REPO}:${COMMIT_PREFIX}.${TIMESTAMP}"
 

scripts/bump-for-incubator.bash

@@ -19,7 +19,7 @@ done;
 
 COMMIT_PREFIX="$(git log -n1 --pretty='%H' | head -c10)"
 TIMESTAMP="$(date +%Y%m%d-%H%M%S)"
-ECR_REPO='035866691871.dkr.ecr.us-west-2.amazonaws.com/homeuniteus'
+ECR_REPO='035866691871.dkr.ecr.us-west-2.amazonaws.com/home-unite-us-fullstack'
 
 IMAGE_URL="${ECR_REPO}:${COMMIT_PREFIX}.${TIMESTAMP}"