PILL - IaC

This repository contains the code for automating the provisioning and management of our PILL cloud infrastructure.

Structure

The repository is structured as follows:

• pulumi: contains the code for provisioning and managing the cloud infrastructure;
• kubernetes: contains the code for provisioning the Kubernetes resources; there is one Kubernetes cluster per pulumi stack or environment (test, prod); the resource manifests for a given environment are defined in the <environment>/apps folder;

Getting Started

Prerequisites

• pulumi
• sops

Usage

Provisioning

TODO by @devopsTeam

Using pulumi to manage infrastructure

Infrastructure on azure cloud is created using pulumi.

To create/manage resources in azure cloud using pulumi, you can use pulumi cli tool.

pulumi state is stored in "azblob://pulumistatepill?storage_account=stpill". To manage cloud infrastructure resources, run pulumi login "azblob://pulumistatepill?storage_account=stpill".

After making changes to code, you can create a PR and after approval, you can run pulumi up. You will be asked Enter your passphrase to unlock config/secrets, it can be find in 1password called pill-iac-pulumi.

Secrets

To add a new encrypted secret in the apps manifests, follow these steps:

1. Create a new secret manifest file (e.g. my-secret.yaml) with plain values in the kubernetes/<environment>/apps/<app>/secrets folder;
2. Move to the secrets folder and use sops to encrypt the values:

   sops -e my-secret.sec.yaml > my-secret.enc.yaml

3. Delete the original my-secret.yaml file.
4. Reference the new my-secret.enc.yaml file in the secrets/kustomization.yaml file.

Release

A new release of a certain app is triggered any time its HelmRelease resource is updated. To release a new version of an app, follow these steps:

1. Create a new branch from main (e.g. release/vX.Y.Z);
2. Bump the chart version in kubernetes/<environment>/apps/<app>/helm-release.yaml file;
3. Commit and push the changes;
4. Create a new pull request from the new branch to main;
5. Once the pull request is approved and merged, the new version of the app will be automatically deployed on the target cluster by Flux.