はじめに

TerraformでIacをしながら、GitHubActionsと連携してブルー/グリーンデプロイを実行したいと思います。

codesourceでecrを監視しない理由は、最初のデブロイでブルー/グリーンデプロイを実行させないためです。
そのため、GitHubActionsでcodecommitにクローンしブルー/グリーンデプロイを実行するように設計しています。

以下が今回の構成図になります。

以下がレポジトリーになります。

ブルー/グリーンデプロイとは

ブルーグリーンデプロイメントとは現状の本番環境（ブルー）とは別に新しい本番環境（グリーン）を構築した上で、ロードバランサーの接続先を切り替えるなどして新しい本番環境をリリースする運用方法のこと。

中略

ブルーグリーンデプロイメントの利点の1つは、システムのダウンタイムを短くできる点である。現状の本番環境を停止させて変更して戻す従来の運用方法とは違ってシステムをほとんど止める必要が無く、可用性を高められる。

以下、参照

アプリ編

terraformでデブロイした直後、画面を青くし、
ブルー/グリーンデプロイ後に画面を緑にします。

Dockerfile

FROM nginx:latest

COPY . /usr/share/nginx/html

変更前

<!DOCTYPE html>
<html lang="ja">

<head>
    <meta charset="UTF-8" />
    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <title>Document</title>
</head>

<body style="background-color: #b2d8ff;">
    <div style="  line-height: 200px;height: 200px;text-align: center;">
        <p style="  line-height: 1.5;display: inline-block;vertical-align: middle;">
            blue!!!!!!!!!!
        </p>
    </div>
</body>
</html>

変更後

<!DOCTYPE html>
<html lang="ja">

<head>
    <meta charset="UTF-8" />
    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <title>Document</title>
</head>

<body style="background-color: #b2ffb2;">
    <div style="  line-height: 200px;height: 200px;text-align: center;">
        <p style="  line-height: 1.5;display: inline-block;vertical-align: middle;">
            green!!!!!!!!!!
        </p>
    </div>
</body>
</html>

GitHubActions編

arnを取得

以下の記事を参考にarnをコピーし、GitHubActionsにAWS_IAM_ROLE_ARNを登録します。

GitHubActions

GitHubActionsでcodecommitにクローンするのが前半
後半はecrにイメージをpushします。

.github/workflows/main.yml

name: ecr push image

on:
  push:
    branches: ["main"]
    paths:
      - nginx/**

defaults:
  run:
    shell: bash

permissions:
  id-token: write
  contents: read

env:
  AWS_REGION: ap-northeast-1
  AWSWEB_IDENTITY_TOKEN_FILE: /tmp/awscreds
  CODECOMMIT_REPO_URL: "https://git-codecommit.ap-northeast-1.amazonaws.com/v1/repos/newworld-repository"

jobs:
  aws-deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout.
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: AWS Configure Credentials.
        uses: aws-actions/configure-aws-credentials@v1-node16
        with:
          aws-region: ${{ env.AWS_REGION }}
          role-to-assume: ${{ secrets.AWS_IAM_ROLE_ARN }}
          role-session-name: githubActionsAession

      - name: Configure git
        run: |
          git config --global credential.helper '!aws codecommit credential-helper $@'
          git config --global credential.UseHttpPath true

      - name: Push to AWS CodeCommit
        run: |
          git remote add codecommit ${{ env.CODECOMMIT_REPO_URL }}
          git push codecommit main:main -f

      # ecr
      - uses: aws-actions/amazon-ecr-login@v1
        id: login-ecr
      - name: build and push docker image to ecr
        env:
          REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          REPOSITORY: newworld
        run: |
          docker build ./nginx --tag ${{ env.REGISTRY }}/${{ env.REPOSITORY }}:latest
          docker push ${{ env.REGISTRY }}/${{ env.REPOSITORY }}:latest

Terraform編

elb

target_group_arnには、blueを指定します。codedeployが自動でgreenに変えてくれます。

terraform/modules/elb/aws_lb_listener.tf

resource "aws_lb_listener" "main" {
  load_balancer_arn = aws_lb.alb.arn
  port              = "80"
  protocol          = "HTTP"

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.blue.arn
  }
}

terraform/modules/elb/aws_lb_target_group.tf

resource "aws_lb_target_group" "blue" {
  name        = "${var.app_name}-blue-tg"
  port        = 80
  protocol    = "HTTP"
  target_type = "ip"
  vpc_id      = var.main-vpc-id

  health_check {
    interval            = 300
    path                = "/"
    port                = 80
    protocol            = "HTTP"
    timeout             = 120
    unhealthy_threshold = 10
    matcher             = "200-299"
  }
}

resource "aws_lb_target_group" "green" {
  name        = "${var.app_name}-green-tg"
  port        = 80
  protocol    = "HTTP"
  target_type = "ip"
  vpc_id      = var.main-vpc-id

  health_check {
    interval            = 300
    path                = "/"
    port                = 80
    protocol            = "HTTP"
    timeout             = 120
    unhealthy_threshold = 10
    matcher             = "200-299"
  }
}

ecs

taskdefinitionはcodebuild実行時、buildspec.yml取得して再利用します。

terraform/modules/ecs/ecs_service.tf

resource "aws_ecs_service" "app-service" {
  name            = "${var.app_name}-blue-service"
  cluster         = aws_ecs_cluster.app-cluster.id
  task_definition = aws_ecs_task_definition.app-definition.arn
  desired_count   = 1

  network_configuration {
    security_groups  = [var.app-sg-id]
    subnets          = var.subnet-group-id-list
    assign_public_ip = true
  }

  load_balancer {
    target_group_arn = var.elb-tg-blue-arn
    container_name   = var.image_name
    container_port   = 80
  }

  deployment_controller {
    type = "CODE_DEPLOY"
  }

  lifecycle {
    ignore_changes = [desired_count, task_definition, load_balancer]
  }
}

terraform/modules/ecs/ecs_task_definition.tf

resource "aws_ecs_task_definition" "app-definition" {
  family                   = "${var.app_name}-definition"
  requires_compatibilities = ["FARGATE"]
  cpu                      = 256
  memory                   = 512
  execution_role_arn       = var.ecs-iam-role-arn
  network_mode             = "awsvpc"
  container_definitions = jsonencode([
    {
      name      = "${var.image_name}"
      image     = "${data.aws_caller_identity.self.account_id}.dkr.ecr.ap-northeast-1.amazonaws.com/${var.image_name}:latest"
      cpu       = 256
      memory    = 512
      essential = true
      portMappings = [
        {
          containerPort = 80
          hostPort      = 80
        }
      ]
    }
  ])
  runtime_platform {
    operating_system_family = "LINUX"
    cpu_architecture        = "X86_64"
  }
}

CodePileline

CodePilelineでは次のステージにアーティファクトを引き渡す時、S3 バケットを経由させます。
Sourceステージのoutputはs3内のSourceArtiディレクトリーに格納されます。
Buildステージのoutputはs3内のBuildArtifディレクトリーに格納されます。

terraform/modules/codepipeline/aws_codepipeline.tf

resource "aws_codepipeline" "codepipeline" {
  name     = "${var.app_name}-pipeline"
  role_arn = aws_iam_role.codepipeline_role.arn

  artifact_store {
    location = aws_s3_bucket.codepipeline_bucket.bucket
    type     = "S3"
  }

  stage {
    name = "Source"

    action {
      name             = "Source"
      category         = "Source"
      owner            = "AWS"
      provider         = "CodeCommit"
      output_artifacts = ["SourceArtifact"]
      version          = "1"

      configuration = {
        RepositoryName       = aws_codecommit_repository.codecommit_repository.repository_name
        BranchName           = "main"
        OutputArtifactFormat = "CODE_ZIP"
      }
    }
  }

  stage {
    name = "Build"

    action {
      name             = "Build"
      category         = "Build"
      owner            = "AWS"
      provider         = "CodeBuild"
      input_artifacts  = ["SourceArtifact"]
      output_artifacts = ["BuildArtifact"]
      version          = "1"

      configuration = {
        ProjectName = aws_codebuild_project.main.name
      }
    }
  }

  stage {
    name = "Deploy"

    action {
      name            = "Deploy"
      category        = "Deploy"
      owner           = "AWS"
      provider        = "CodeDeployToECS"
      input_artifacts = ["BuildArtifact"]
      version         = "1"

      configuration = {
        ApplicationName                = var.app_name
        DeploymentGroupName            = aws_codedeploy_deployment_group.main.deployment_group_name
        TaskDefinitionTemplateArtifact = "BuildArtifact"
        TaskDefinitionTemplatePath     = "taskdef.json"
        AppSpecTemplateArtifact        = "BuildArtifact"
        AppSpecTemplatePath            = "appspec.yml"
        Image1ArtifactName             = "BuildArtifact"
        Image1ContainerName            = "IMAGE1_NAME"
      }
    }
  }
}

terraform/modules/codepipeline/aws_codebuild_project.tf

resource "aws_codebuild_project" "main" {
  name         = "${var.app_name}-codebuild"
  description  = "codebuild_project for ${var.app_name}"
  service_role = aws_iam_role.codebuild-role.arn

  artifacts {
    type = "CODEPIPELINE"
  }

  source {
    type      = "CODEPIPELINE"
    buildspec = "terraform/template/buildspec.yml"
  }

  environment {
    compute_type    = "BUILD_GENERAL1_SMALL"
    image           = "aws/codebuild/amazonlinux2-x86_64-standard:3.0"
    type            = "LINUX_CONTAINER"
    privileged_mode = true


    environment_variable {
      name  = "AWS_ACCOUNT_ID"
      value = data.aws_caller_identity.self.account_id
    }
    environment_variable {
      name  = "ECR_REPOSITORY"
      value = var.image_name
    }
    environment_variable {
      name  = "ECS_TASK_DEFINITION_ARN"
      value = var.ecs-task-definition-arn
    }
  }
}

terraform/modules/codepipeline/aws_codecommit_repository.tf

resource "aws_codecommit_repository" "codecommit_repository" {
  repository_name = "${var.app_name}-repository"
  description     = "This is the ${var.app_name} App Repository"
}

cloudwatchでcodecommitを監視していないと、eventが発火しません。

terraform/modules/codepipeline/aws_cloudwatch_event_rule.tf

resource "aws_cloudwatch_event_rule" "image_push" {
  name     = "codecommit_push"
  role_arn = aws_iam_role.cwe_role.arn

  event_pattern = jsonencode({
    source      = ["aws.codecommit"]
    detail-type = ["CodeCommit Repository State Change"]
    resources   = ["${aws_codecommit_repository.codecommit_repository.arn}"]

    detail = {
      event         = ["referenceCreated", "referenceUpdated"]
      referenceType = ["branch"]
      referenceName = ["main"]
    }
  })
}

terraform/modules/codepipeline/aws_cloudwatch_event_target.tf

resource "aws_cloudwatch_event_target" "codepipeline" {
  rule      = aws_cloudwatch_event_rule.image_push.name
  target_id = "${var.app_name}-Image-Push-Codepipeline"
  arn       = aws_codepipeline.codepipeline.arn
  role_arn  = aws_iam_role.cwe_role.arn
}

設定ファイル

terraform/template/buildspec.yml

version: 0.2

env:
  variables:
    AWS_REGION: ap-northeast-1
    IMAGE_TAG: latest

phases:
  pre_build:
    commands:
      - REPOSITORY_URI=$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/$ECR_REPOSITORY
  build:
    commands:
      - $(aws ecs describe-task-definition --task-definition $ECS_TASK_DEFINITION_ARN --query taskDefinition | jq '.containerDefinitions[0].image="<IMAGE1_NAME>"' > taskdef.json)
      - printf '{"Version":"1.0","ImageURI":"%s"}' $REPOSITORY_URI:$IMAGE_TAG > imageDetail.json
      - cp terraform/template/appspec.yml appspec.yml

artifacts:
  files:
    - appspec.yml
    - taskdef.json
    - imageDetail.json

terraform/template/appspec.yml

version: 0.0
Resources:
  - TargetService:
      Type: AWS::ECS::Service
      Properties:
        TaskDefinition: "<TASK_DEFINITION>"
        LoadBalancerInfo:
          ContainerName: "newworld"
          ContainerPort: 80
        PlatformVersion: "1.4.0"

結果

ブルー/グリーンデプロイを実行

無事にデプロイが出来ました。