rename ci-user (#7)

* rename ci-user

* set deployer role for ci and fix db-user creation

* resume to number version 0.0.3

Author: sshi100

Makefile

@@ -8,8 +8,8 @@ GITHUB_REPO := $(shell echo ${REPOSITORY} | cut -d "/" -f 3)
 
 run: create-db-user
 	@echo "Set CIRCLECI environment variables\n"
-	export AWS_ACCESS_KEY_ID=$(shell aws secretsmanager get-secret-value --region ${region} --secret-id=ci-user-aws-keys${randomSeed} | jq -r '.SecretString'| jq -r .access_key_id)
-	export AWS_SECRET_ACCESS_KEY=$(shell aws secretsmanager get-secret-value --region ${region} --secret-id=ci-user-aws-keys${randomSeed} | jq -r '.SecretString'| jq -r .secret_key)
+	export AWS_ACCESS_KEY_ID=$(shell aws secretsmanager get-secret-value --region ${region} --secret-id=${PROJECT_NAME}-ci-user-aws-keys${randomSeed} | jq -r '.SecretString'| jq -r .access_key_id)
+	export AWS_SECRET_ACCESS_KEY=$(shell aws secretsmanager get-secret-value --region ${region} --secret-id=${PROJECT_NAME}-ci-user-aws-keys${randomSeed} | jq -r '.SecretString'| jq -r .secret_key)
 	curl -X POST --header "Content-Type: application/json" -d '{"name":"CIRCLECI_API_KEY", "value":"${CIRCLECI_API_KEY}"}' https://circleci.com/api/v1.1/project/github/${GITHUB_ORG}/${GITHUB_REPO}/envvar?circle-token=${CIRCLECI_API_KEY}
 	curl -X POST --header "Content-Type: application/json" -d '{"name":"AWS_ACCESS_KEY_ID", "value":"${AWS_ACCESS_KEY_ID}"}' https://circleci.com/api/v1.1/project/github/${GITHUB_ORG}/${GITHUB_REPO}/envvar?circle-token=${CIRCLECI_API_KEY}
 	curl -X POST --header "Content-Type: application/json" -d '{"name":"AWS_SECRET_ACCESS_KEY", "value":"${AWS_SECRET_ACCESS_KEY}"}' https://circleci.com/api/v1.1/project/github/${GITHUB_ORG}/${GITHUB_REPO}/envvar?circle-token=${CIRCLECI_API_KEY}

db-ops/create-db-user.sh

@@ -13,19 +13,20 @@ DB_APP_USERNAME=$DB_NAME
 DB_APP_PASSWORD=$(LC_ALL=C tr -dc 'A-Za-z0-9' < /dev/urandom | base64 | head -c 16)
 
 # Fill in env-vars to db user creation manifest
+JOB_ID=$(LC_ALL=C tr -dc 'a-z0-9' < /dev/urandom | head -c 8)
 eval "echo \"$(cat ./db-ops/job-create-db-$DATABASE.yml.tpl)\"" > ./k8s-job-create-db.yml
 # the manifest creates 4 things
-# 1. Namespace: db-ops
+# 1. Namespace: db-ops 
 # 2. Secret in db-ops: db-create-users (with master password, and a .sql file
 # 3. Job in db-ops: db-create-users (runs the .sql file against the RDS given master_password from env)
-# 4. Secret in Application namespace with DB_USERNAME / DB_PASSWORD
+# 4. Secret in Application namespace with DB_USERNAME / DB_PASSWORD 
 kubectl apply -f ./k8s-job-create-db.yml
 
 # Deleting the entire db-ops namespace, leaving ONLY application-namespace's secret behind
-kubectl -n db-ops wait --for=condition=complete --timeout=10s job db-create-users
+kubectl -n db-ops wait --for=condition=complete --timeout=10s job db-create-users-${JOB_ID}
 if [ $? -eq 0 ]
-then
-  kubectl get namespace db-ops
-else
-  echo "Failed to create application database user, please see 'kubectl logs -n db-ops -l job-name=db-create-users'"
+then 
+  kubectl delete namespace db-ops
+else 
+  echo "Failed to create application database user, please see 'kubectl logs -n db-ops -l job-name=db-create-users-${JOB_ID}'"
 fi

db-ops/job-create-db-mysql.yml.tpl

@@ -9,8 +9,9 @@ metadata:
   name: db-create-users
   namespace: db-ops
 type: Opaque
-stringData:
+stringData: 
   create-user.sql: |
+    DROP USER '$DB_APP_USERNAME';
     CREATE USER '$DB_APP_USERNAME' IDENTIFIED BY '$DB_APP_PASSWORD';
     GRANT ALL PRIVILEGES ON $DB_NAME.* TO '$DB_APP_USERNAME';
   RDS_MASTER_PASSWORD: $SECRET_PASSWORD
@@ -26,25 +27,25 @@ metadata:
   name: $PROJECT_NAME
   namespace: $PROJECT_NAME
 type: Opaque
-stringData:
+stringData: 
   DATABASE_USERNAME: $DB_APP_USERNAME
   DATABASE_PASSWORD: $DB_APP_PASSWORD
 ---
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: db-create-users
+  name: db-create-users-$JOB_ID
   namespace: db-ops
 spec:
   template:
     spec:
       containers:
       - name: create-rds-user
         image: $DOCKER_IMAGE_TAG
-        command:
+        command: 
         - sh
-        args:
-        - '-c'
+        args: 
+        - '-c' 
         - mysql -u$MASTER_RDS_USERNAME -h $DB_ENDPOINT $DB_NAME < /db-ops/create-user.sql
         env:
         - name: DB_ENDPOINT
@@ -87,7 +88,7 @@ spec:
       containers:
       - command:
         - sh
-        args:
+        args: 
         - "-c"
         # long running task so the pod doesn't exit with 0
         - tail -f /dev/null

db-ops/job-create-db-postgres.yml.tpl

@@ -9,8 +9,9 @@ metadata:
   name: db-create-users
   namespace: db-ops
 type: Opaque
-stringData:
+stringData: 
   create-user.sql: |
+    drop user $DB_APP_USERNAME
     create user $DB_APP_USERNAME with encrypted password '$DB_APP_PASSWORD';
     grant all privileges on database $DB_NAME to $DB_APP_USERNAME;
   RDS_MASTER_PASSWORD: $SECRET_PASSWORD
@@ -26,25 +27,25 @@ metadata:
   name: $PROJECT_NAME
   namespace: $PROJECT_NAME
 type: Opaque
-stringData:
+stringData: 
   DATABASE_USERNAME: $DB_APP_USERNAME
   DATABASE_PASSWORD: $DB_APP_PASSWORD
 ---
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: db-create-users
+  name: db-create-users-$JOB_ID
   namespace: db-ops
 spec:
   template:
     spec:
       containers:
       - name: create-rds-user
         image: $DOCKER_IMAGE_TAG
-        command:
+        command: 
         - sh
-        args:
-        - '-c'
+        args: 
+        - '-c' 
         - psql -U$MASTER_RDS_USERNAME -h $DB_ENDPOINT $DB_NAME -a -f/db-ops/create-user.sql > /dev/null
         env:
         - name: PGPASSWORD
@@ -83,7 +84,7 @@ spec:
       containers:
       - command:
         - sh
-        args:
+        args: 
         - "-c"
         # long running task so the pod doesn't exit with 0
         - tail -f /dev/null

templates/.circleci/config.yml

@@ -6,7 +6,7 @@ orbs:
   aws-eks: circleci/aws-eks@0.2.3
   aws-s3: circleci/aws-s3@1.0.11
   aws-cli: circleci/aws-cli@0.1.18
-  queue: eddiewebb/queue@1.3.0
+  queue: eddiewebb/queue@1.5.0
   slack: circleci/slack@3.4.2
   version-tag: commitdev/version-tag@0.0.3
 
@@ -295,7 +295,7 @@ workflows:
             repo: "<% .Name %>"
             cluster-name: "<% .Name %>-stage-<% index .Params `region` %>"
             config-environment: "staging"
-            cluster-authentication-role-arn: "arn:aws:iam::<% index .Params `accountId` %>:role/<% .Name %>-kubernetes-admin-stage"
+            cluster-authentication-role-arn: "arn:aws:iam::<% index .Params `accountId` %>:role/<% .Name %>-kubernetes-deployer-stage"
             region: "<% index .Params `region` %>"
             namespace: "<% .Name %>"
             tag: "${VERSION_TAG}"
@@ -318,7 +318,7 @@ workflows:
             repo: "<% .Name %>"
             cluster-name: "<% .Name %>-prod-<% index .Params `region` %>"
             config-environment: "production"
-            cluster-authentication-role-arn: "arn:aws:iam::<% index .Params `accountId` %>:role/<% .Name %>-kubernetes-admin-prod"
+            cluster-authentication-role-arn: "arn:aws:iam::<% index .Params `accountId` %>:role/<% .Name %>-kubernetes-deployer-prod"
             region: "<% index .Params `region` %>"
             namespace: "<% .Name %>"
             tag: "${VERSION_TAG}"