From 7c5674c4e1847620d0abd1fb6c8bba115b88ff05 Mon Sep 17 00:00:00 2001 From: Kenneth Kehl <@kkehl@flexion.us> Date: Mon, 29 Jan 2024 13:17:50 -0800 Subject: [PATCH 1/5] notify-admin-1137 make sure one-off files get written to db --- app/main/views/send.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/app/main/views/send.py b/app/main/views/send.py index 91e9814af..4332c7ddb 100644 --- a/app/main/views/send.py +++ b/app/main/views/send.py @@ -880,14 +880,20 @@ def send_notification(service_id, template_id): service_id, job_id=upload_id, include_one_off=True ) attempts = 0 - while notifications["total"] == 0 and attempts < 5: + + # The response can come back in different forms of incompleteness + while ( + notifications["total"] == 0 + and notifications["notifications"] == [] + and attempts < 50 + ): notifications = notification_api_client.get_notifications_for_service( service_id, job_id=upload_id, include_one_off=True ) time.sleep(0.1) attempts = attempts + 1 - if notifications["total"] == 0 and attempts == 5: + if notifications["total"] == 0 and attempts == 50: # This shows the job we auto-generated for the user return redirect( url_for( From 0f167a91cc4ec5a5015965235c9736e85add270a Mon Sep 17 00:00:00 2001 From: Carlo Costino Date: Tue, 30 Jan 2024 09:26:04 -0500 Subject: [PATCH 2/5] Update Cloud Foundry Terraform module This changeset updates the Cloud Foundry Terraform to its latest release. Our file were previously referencing a very old version, which was contributing to infrastructure check and deployment failures. Signed-off-by: Carlo Costino --- terraform/bootstrap/providers.tf | 2 +- terraform/demo/providers.tf | 2 +- terraform/development/providers.tf | 2 +- terraform/production/providers.tf | 2 +- terraform/sandbox/providers.tf | 2 +- terraform/shared/container_networking/providers.tf | 2 +- terraform/staging/providers.tf | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/terraform/bootstrap/providers.tf b/terraform/bootstrap/providers.tf index 44ccda085..b6f27acf8 100644 --- a/terraform/bootstrap/providers.tf +++ b/terraform/bootstrap/providers.tf @@ -3,7 +3,7 @@ terraform { required_providers { cloudfoundry = { source = "cloudfoundry-community/cloudfoundry" - version = "0.15.5" + version = "0.53.0" } } } diff --git a/terraform/demo/providers.tf b/terraform/demo/providers.tf index eba9e9490..46ec2f376 100644 --- a/terraform/demo/providers.tf +++ b/terraform/demo/providers.tf @@ -3,7 +3,7 @@ terraform { required_providers { cloudfoundry = { source = "cloudfoundry-community/cloudfoundry" - version = "0.15.5" + version = "0.53.0" } } diff --git a/terraform/development/providers.tf b/terraform/development/providers.tf index d8ae4488e..5dcaece3e 100644 --- a/terraform/development/providers.tf +++ b/terraform/development/providers.tf @@ -3,7 +3,7 @@ terraform { required_providers { cloudfoundry = { source = "cloudfoundry-community/cloudfoundry" - version = "0.50.7" + version = "0.53.0" } } } diff --git a/terraform/production/providers.tf b/terraform/production/providers.tf index e0daee8b0..9805aaf87 100644 --- a/terraform/production/providers.tf +++ b/terraform/production/providers.tf @@ -3,7 +3,7 @@ terraform { required_providers { cloudfoundry = { source = "cloudfoundry-community/cloudfoundry" - version = "0.15.5" + version = "0.53.0" } } diff --git a/terraform/sandbox/providers.tf b/terraform/sandbox/providers.tf index 5fe15f874..d24d5a326 100644 --- a/terraform/sandbox/providers.tf +++ b/terraform/sandbox/providers.tf @@ -3,7 +3,7 @@ terraform { required_providers { cloudfoundry = { source = "cloudfoundry-community/cloudfoundry" - version = "0.15.5" + version = "0.53.0" } } diff --git a/terraform/shared/container_networking/providers.tf b/terraform/shared/container_networking/providers.tf index 8db86ca90..21ac567a2 100644 --- a/terraform/shared/container_networking/providers.tf +++ b/terraform/shared/container_networking/providers.tf @@ -3,7 +3,7 @@ terraform { required_providers { cloudfoundry = { source = "cloudfoundry-community/cloudfoundry" - version = "~> 0.15" + version = "0.53.0" } } } diff --git a/terraform/staging/providers.tf b/terraform/staging/providers.tf index 7648e192f..a6f8f2a54 100644 --- a/terraform/staging/providers.tf +++ b/terraform/staging/providers.tf @@ -3,7 +3,7 @@ terraform { required_providers { cloudfoundry = { source = "cloudfoundry-community/cloudfoundry" - version = "0.15.5" + version = "0.53.0" } } From 4da5c14751f04fdbec88c807b8defae718377af4 Mon Sep 17 00:00:00 2001 From: Carlo Costino Date: Tue, 30 Jan 2024 09:40:14 -0500 Subject: [PATCH 3/5] Updated 18F/terraform-cloudgov to v0.7.1 Signed-off-by: Carlo Costino --- terraform/demo/main.tf | 4 ++-- terraform/development/main.tf | 2 +- terraform/production/main.tf | 6 +++--- terraform/sandbox/main.tf | 4 ++-- terraform/staging/main.tf | 4 ++-- 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/terraform/demo/main.tf b/terraform/demo/main.tf index f26e495a5..7f34fb0f1 100644 --- a/terraform/demo/main.tf +++ b/terraform/demo/main.tf @@ -7,7 +7,7 @@ locals { } module "redis" { - source = "github.com/18f/terraform-cloudgov//redis?ref=v0.2.0" + source = "github.com/18f/terraform-cloudgov//redis?ref=v0.7.1" cf_org_name = local.cf_org_name cf_space_name = local.cf_space_name @@ -17,7 +17,7 @@ module "redis" { } module "logo_upload_bucket" { - source = "github.com/18f/terraform-cloudgov//s3?ref=v0.2.0" + source = "github.com/18f/terraform-cloudgov//s3?ref=v0.7.1" cf_org_name = local.cf_org_name cf_space_name = local.cf_space_name diff --git a/terraform/development/main.tf b/terraform/development/main.tf index ff6001152..767256c3f 100644 --- a/terraform/development/main.tf +++ b/terraform/development/main.tf @@ -11,7 +11,7 @@ data "cloudfoundry_space" "dev" { } module "logo_upload_bucket" { - source = "github.com/18f/terraform-cloudgov//s3?ref=v0.2.0" + source = "github.com/18f/terraform-cloudgov//s3?ref=v0.7.1" cf_org_name = local.cf_org_name cf_space_name = local.cf_space_name diff --git a/terraform/production/main.tf b/terraform/production/main.tf index c635ed2d4..450212cdf 100644 --- a/terraform/production/main.tf +++ b/terraform/production/main.tf @@ -7,7 +7,7 @@ locals { } module "redis" { - source = "github.com/18f/terraform-cloudgov//redis?ref=v0.2.0" + source = "github.com/18f/terraform-cloudgov//redis?ref=v0.7.1" cf_org_name = local.cf_org_name cf_space_name = local.cf_space_name @@ -17,7 +17,7 @@ module "redis" { } module "logo_upload_bucket" { - source = "github.com/18f/terraform-cloudgov//s3?ref=v0.2.0" + source = "github.com/18f/terraform-cloudgov//s3?ref=v0.7.1" cf_org_name = local.cf_org_name cf_space_name = local.cf_space_name @@ -50,7 +50,7 @@ module "api_network_route" { # https://cloud.gov/docs/services/external-domain-service/#how-to-create-an-instance-of-this-service ########################################################################### module "domain" { - source = "github.com/18f/terraform-cloudgov//domain?ref=v0.5.2" + source = "github.com/18f/terraform-cloudgov//domain?ref=v0.7.1" cf_org_name = local.cf_org_name cf_space_name = local.cf_space_name diff --git a/terraform/sandbox/main.tf b/terraform/sandbox/main.tf index 69457b5d5..74c16d808 100644 --- a/terraform/sandbox/main.tf +++ b/terraform/sandbox/main.tf @@ -7,7 +7,7 @@ locals { } module "redis" { - source = "github.com/18f/terraform-cloudgov//redis?ref=v0.2.0" + source = "github.com/18f/terraform-cloudgov//redis?ref=v0.7.1" cf_org_name = local.cf_org_name cf_space_name = local.cf_space_name @@ -17,7 +17,7 @@ module "redis" { } module "logo_upload_bucket" { - source = "github.com/18f/terraform-cloudgov//s3?ref=v0.2.0" + source = "github.com/18f/terraform-cloudgov//s3?ref=v0.7.1" cf_org_name = local.cf_org_name cf_space_name = local.cf_space_name diff --git a/terraform/staging/main.tf b/terraform/staging/main.tf index 4a07e9bd7..d0df6e81d 100644 --- a/terraform/staging/main.tf +++ b/terraform/staging/main.tf @@ -7,7 +7,7 @@ locals { } module "redis" { - source = "github.com/18f/terraform-cloudgov//redis?ref=v0.2.0" + source = "github.com/18f/terraform-cloudgov//redis?ref=v0.7.1" cf_org_name = local.cf_org_name cf_space_name = local.cf_space_name @@ -17,7 +17,7 @@ module "redis" { } module "logo_upload_bucket" { - source = "github.com/18f/terraform-cloudgov//s3?ref=v0.2.0" + source = "github.com/18f/terraform-cloudgov//s3?ref=v0.7.1" cf_org_name = local.cf_org_name cf_space_name = local.cf_space_name From 50e3560c6ff6c4835fd1a8dae218f5f1286d4fa6 Mon Sep 17 00:00:00 2001 From: Carlo Costino Date: Tue, 30 Jan 2024 11:06:13 -0500 Subject: [PATCH 4/5] Remove the profile attribute entirely This was what was apparently breaking our Terraform actions. I traced this to an undocumented breaking change with the AWS provider; more details can be seen here: https://discuss.hashicorp.com/t/error-error-configuring-terraform-aws-provider-failed-to-get-shared-config-profile-default/39417/2 Signed-off-by: Carlo Costino --- terraform/README.md | 2 ++ terraform/demo/providers.tf | 1 - terraform/development/reset.sh | 2 +- terraform/production/providers.tf | 1 - terraform/sandbox/providers.tf | 1 - terraform/staging/providers.tf | 1 - 6 files changed, 3 insertions(+), 5 deletions(-) diff --git a/terraform/README.md b/terraform/README.md index efab933fa..7390e3947 100644 --- a/terraform/README.md +++ b/terraform/README.md @@ -88,6 +88,8 @@ The below steps rely on you first configuring access to the Terraform state in s terraform plan ``` + If the `terraform init` command fails, you may need to run `terraform init -upgrade` to make sure new module versions are picked up. + 1. Apply changes with `terraform apply`. 1. Remove the space deployer service instance if it doesn't need to be used again, such as when manually running terraform once. diff --git a/terraform/demo/providers.tf b/terraform/demo/providers.tf index 46ec2f376..2ced7915f 100644 --- a/terraform/demo/providers.tf +++ b/terraform/demo/providers.tf @@ -12,7 +12,6 @@ terraform { key = "admin.tfstate.demo" encrypt = "true" region = "us-gov-west-1" - profile = "notify-terraform-backend" } } diff --git a/terraform/development/reset.sh b/terraform/development/reset.sh index d51d43eec..57c2f4d87 100755 --- a/terraform/development/reset.sh +++ b/terraform/development/reset.sh @@ -47,7 +47,7 @@ if [[ ! -s "secrets.auto.tfvars" ]]; then fi echo "Importing terraform state for $username" -terraform init +terraform init -upgrade key_name=$username-admin-dev-key diff --git a/terraform/production/providers.tf b/terraform/production/providers.tf index 9805aaf87..ed822db44 100644 --- a/terraform/production/providers.tf +++ b/terraform/production/providers.tf @@ -12,7 +12,6 @@ terraform { key = "admin.tfstate.prod" encrypt = "true" region = "us-gov-west-1" - profile = "notify-terraform-backend" } } diff --git a/terraform/sandbox/providers.tf b/terraform/sandbox/providers.tf index d24d5a326..09911edc4 100644 --- a/terraform/sandbox/providers.tf +++ b/terraform/sandbox/providers.tf @@ -12,7 +12,6 @@ terraform { key = "admin.tfstate.sandbox" encrypt = "true" region = "us-gov-west-1" - profile = "notify-terraform-backend" } } diff --git a/terraform/staging/providers.tf b/terraform/staging/providers.tf index a6f8f2a54..d6928e61e 100644 --- a/terraform/staging/providers.tf +++ b/terraform/staging/providers.tf @@ -12,7 +12,6 @@ terraform { key = "admin.tfstate.stage" encrypt = "true" region = "us-gov-west-1" - profile = "notify-terraform-backend" } } From 6af738e0de17d4b5272d1ba0ac05f1a4a64837a9 Mon Sep 17 00:00:00 2001 From: Carlo Costino Date: Tue, 30 Jan 2024 17:21:29 -0500 Subject: [PATCH 5/5] Add Login.gov configuration to prod and demo environments This changeset adds the required Login.gov environment variables to the production and demo environments so that deployments function correctly. NOTE: This will not fully enable Login.gov integration just yet; more configuration needs to be adjusted and the Login.gov app needs to be promoted to production itself. Signed-off-by: Carlo Costino --- .github/workflows/deploy-demo.yml | 14 ++++++++++++++ .github/workflows/deploy-prod.yml | 15 ++++++++++++++- 2 files changed, 28 insertions(+), 1 deletion(-) diff --git a/.github/workflows/deploy-demo.yml b/.github/workflows/deploy-demo.yml index c308cd71a..e1d76775a 100644 --- a/.github/workflows/deploy-demo.yml +++ b/.github/workflows/deploy-demo.yml @@ -55,6 +55,13 @@ jobs: NEW_RELIC_LICENSE_KEY: ${{ secrets.NEW_RELIC_LICENSE_KEY }} NR_BROWSER_KEY: ${{ secrets.NR_BROWSER_KEY }} LOGIN_PEM: ${{ secrets.LOGIN_PEM }} + LOGIN_DOT_GOV_CLIENT_ID: "urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov" + LOGIN_DOT_GOV_USER_INFO_URL: "https://idp.int.identitysandbox.gov/api/openid_connect/userinfo" + LOGIN_DOT_GOV_ACCESS_TOKEN_URL: "https://idp.int.identitysandbox.gov/api/openid_connect/token" + LOGIN_DOT_GOV_LOGOUT_URL: "https://idp.int.identitysandbox.gov/openid_connect/logout?client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&post_logout_redirect_uri=https://notify-demo.app.cloud.gov/sign-out" + LOGIN_DOT_GOV_BASE_LOGOUT_URL: "https://idp.int.identitysandbox.gov/openid_connect/logout?" + LOGIN_DOT_GOV_SIGNOUT_REDIRECT: "https://notify-demo.app.cloud.gov/sign-out" + LOGIN_DOT_GOV_INITIAL_SIGNIN_URL: "https://idp.int.identitysandbox.gov/openid_connect/authorize?acr_values=http%3A%2F%2Fidmanagement.gov%2Fns%2Fassurance%2Fial%2F1&client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&nonce=01234567890123456789012345&prompt=select_account&redirect_uri=https://notify-demo.app.cloud.gov/sign-in&response_type=code&scope=openid+email&state=abcdefghijklmnopabcdefghijklmnop" with: cf_username: ${{ secrets.CLOUDGOV_USERNAME }} cf_password: ${{ secrets.CLOUDGOV_PASSWORD }} @@ -69,6 +76,13 @@ jobs: --var NEW_RELIC_LICENSE_KEY="$NEW_RELIC_LICENSE_KEY" --var NR_BROWSER_KEY="$NR_BROWSER_KEY" --var LOGIN_PEM="$LOGIN_PEM" + --var LOGIN_DOT_GOV_CLIENT_ID="$LOGIN_DOT_GOV_CLIENT_ID" + --var LOGIN_DOT_GOV_USER_INFO_URL="$LOGIN_DOT_GOV_USER_INFO_URL" + --var LOGIN_DOT_GOV_ACCESS_TOKEN_URL="$LOGIN_DOT_GOV_ACCESS_TOKEN_URL" + --var LOGIN_DOT_GOV_LOGOUT_URL="$LOGIN_DOT_GOV_LOGOUT_URL" + --var LOGIN_DOT_GOV_BASE_LOGOUT_URL="$LOGIN_DOT_GOV_BASE_LOGOUT_URL" + --var LOGIN_DOT_GOV_SIGNOUT_REDIRECT="$LOGIN_DOT_GOV_SIGNOUT_REDIRECT" + --var LOGIN_DOT_GOV_INITIAL_SIGNIN_URL="$LOGIN_DOT_GOV_INITIAL_SIGNIN_URL" - name: Check for changes to egress config id: changed-egress-config diff --git a/.github/workflows/deploy-prod.yml b/.github/workflows/deploy-prod.yml index 3c1ab8b8a..a0aaa81c5 100644 --- a/.github/workflows/deploy-prod.yml +++ b/.github/workflows/deploy-prod.yml @@ -55,7 +55,13 @@ jobs: NEW_RELIC_LICENSE_KEY: ${{ secrets.NEW_RELIC_LICENSE_KEY }} NR_BROWSER_KEY: ${{ secrets.NR_BROWSER_KEY }} LOGIN_PEM: ${{ secrets.LOGIN_PEM }} - + LOGIN_DOT_GOV_CLIENT_ID: "urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov" + LOGIN_DOT_GOV_USER_INFO_URL: "https://secure.login.gov/api/openid_connect/userinfo" + LOGIN_DOT_GOV_ACCESS_TOKEN_URL: "https://secure.login.gov/api/openid_connect/token" + LOGIN_DOT_GOV_LOGOUT_URL: "https://secure.login.gov/openid_connect/logout?client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&post_logout_redirect_uri=https://beta.notify.gov/sign-out" + LOGIN_DOT_GOV_BASE_LOGOUT_URL: "https://secure.login.gov/openid_connect/logout?" + LOGIN_DOT_GOV_SIGNOUT_REDIRECT: "https://beta.notify.gov/sign-out" + LOGIN_DOT_GOV_INITIAL_SIGNIN_URL: "https://secure.login.gov/openid_connect/authorize?acr_values=http%3A%2F%2Fidmanagement.gov%2Fns%2Fassurance%2Fial%2F1&client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&nonce=01234567890123456789012345&prompt=select_account&redirect_uri=https://beta.notify.gov/sign-in&response_type=code&scope=openid+email&state=abcdefghijklmnopabcdefghijklmnop" with: cf_username: ${{ secrets.CLOUDGOV_USERNAME }} cf_password: ${{ secrets.CLOUDGOV_PASSWORD }} @@ -70,6 +76,13 @@ jobs: --var NEW_RELIC_LICENSE_KEY="$NEW_RELIC_LICENSE_KEY" --var NR_BROWSER_KEY="$NR_BROWSER_KEY" --var LOGIN_PEM="$LOGIN_PEM" + --var LOGIN_DOT_GOV_CLIENT_ID="$LOGIN_DOT_GOV_CLIENT_ID" + --var LOGIN_DOT_GOV_USER_INFO_URL="$LOGIN_DOT_GOV_USER_INFO_URL" + --var LOGIN_DOT_GOV_ACCESS_TOKEN_URL="$LOGIN_DOT_GOV_ACCESS_TOKEN_URL" + --var LOGIN_DOT_GOV_LOGOUT_URL="$LOGIN_DOT_GOV_LOGOUT_URL" + --var LOGIN_DOT_GOV_BASE_LOGOUT_URL="$LOGIN_DOT_GOV_BASE_LOGOUT_URL" + --var LOGIN_DOT_GOV_SIGNOUT_REDIRECT="$LOGIN_DOT_GOV_SIGNOUT_REDIRECT" + --var LOGIN_DOT_GOV_INITIAL_SIGNIN_URL="$LOGIN_DOT_GOV_INITIAL_SIGNIN_URL" - name: Check for changes to egress config id: changed-egress-config