Enable big query config in aks service

.env.development.yml

@@ -5,8 +5,5 @@ CLARITY_ID: i4a0ipfunv
 VWO_ID: 713156
 FAST_IMAGE_TIMEOUT: 0.25
 SIZE_IMAGES: 1
-BIGQUERY_TABLE_NAME: events
-BIGQUERY_PROJECT_ID: get-into-teaching
-BIGQUERY_DATASET: git_website_events_development
 GET_AN_ADVISER: 1
 GET_AN_ADVISER_FEEDBACK: 1

.env.preprod

@@ -7,8 +7,5 @@ VWO_ID=713156
 SKYLIGHT_ENV=test
 FAST_IMAGE_TIMEOUT=0.25
 SIZE_IMAGES=1
-BIGQUERY_TABLE_NAME=events
-BIGQUERY_PROJECT_ID=get-into-teaching
-BIGQUERY_DATASET=git_website_events_preprod
 GET_AN_ADVISER=1
 GET_AN_ADVISER_FEEDBACK=1

.env.production

@@ -6,8 +6,5 @@ VWO_ID=713156
 SKYLIGHT_ENV=production
 FAST_IMAGE_TIMEOUT=0.25
 SIZE_IMAGES=1
-BIGQUERY_TABLE_NAME=events
-BIGQUERY_PROJECT_ID=get-into-teaching
-BIGQUERY_DATASET=git_website_events_production
 GET_AN_ADVISER=1
 GET_AN_ADVISER_FEEDBACK=0

.env.rolling

@@ -6,8 +6,5 @@ VWO_ID=713156
 SKYLIGHT_ENV=dev
 FAST_IMAGE_TIMEOUT=0.25
 SIZE_IMAGES=1
-BIGQUERY_TABLE_NAME=events
-BIGQUERY_PROJECT_ID=get-into-teaching
-BIGQUERY_DATASET=git_website_events_rolling
 GET_AN_ADVISER=1
 GET_AN_ADVISER_FEEDBACK=1

.github/workflows/actions/deploy/action.yml

@@ -32,6 +32,11 @@ runs:
         with:
            creds: ${{ inputs.AZURE_CREDENTIALS }}
 
+      - uses: google-github-actions/auth@v2
+        with:
+          # project_id: get-into-teaching
+          workload_identity_provider: projects/574582782335/locations/global/workloadIdentityPools/get-into-teaching-app/providers/get-into-teaching-app
+
       - name: Get Short SHA
         id: sha
         shell: bash

.github/workflows/build.yml

@@ -436,6 +436,9 @@ jobs:
     runs-on: ubuntu-latest
     continue-on-error: true
     concurrency: Review_${{github.event.number}}
+    permissions:
+      id-token: write
+      pull-requests: write
     environment:
        name: review
     steps:
@@ -495,6 +498,8 @@ jobs:
     if: github.ref == 'refs/heads/master'
     concurrency: Development
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     environment:
       name: development
     outputs:
@@ -613,6 +618,8 @@ jobs:
     if: github.ref == 'refs/heads/master'
     concurrency: test
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     environment:
        name: test
     steps:
@@ -659,6 +666,8 @@ jobs:
     needs: [ build_base, test ]
     environment:
        name: test
+    permissions:
+      id-token: write
     services:
       postgres:
         image: postgres:13.10
@@ -729,6 +738,8 @@ jobs:
     runs-on: ubuntu-latest
     needs: [ integration, development ]
     concurrency: production
+    permissions:
+      id-token: write
     environment:
        name: production
     steps:

.github/workflows/destroy_review.yml

@@ -6,6 +6,8 @@ on:
 jobs:
   destroy:
     name: Destroy
+    permissions:
+      id-token: write
     environment:
        name: review
     runs-on: ubuntu-latest

config/initializers/dfe_analytics.rb

@@ -61,4 +61,6 @@
     Rails.application.config.action_controller.perform_caching &&
       ActionDispatch::FileHandler.new(Rails.root.join("public/cached_pages").to_s).attempt(rack_env).present?
   end
+
+  config.azure_federated_auth = ENV.include? "GOOGLE_CLOUD_CREDENTIALS"
 end

terraform/aks/application.tf

@@ -16,7 +16,10 @@ module "application_configuration" {
   is_rails_application = true
 
   config_variables = {
-    PGSSLMODE        = local.postgres_ssl_mode
+    PGSSLMODE           = local.postgres_ssl_mode
+    BIGQUERY_DATASET    = var.dataset_name
+    BIGQUERY_PROJECT_ID = "get-into-teaching"
+    BIGQUERY_TABLE_NAME = "events"
   }
   secret_variables = {
     DATABASE_URL = module.postgres.url
@@ -28,6 +31,7 @@ module "application_configuration" {
     APP_URL           = length(var.internet_hostnames) == 0 ? "" : "https://${var.internet_hostnames[0]}.education.gov.uk",
 #   keeping here as a reminder, but went be set in aks and need to confirm impact
     APP_ASSETS_URL    = length(var.asset_hostnames) == 0 ? "" : "https://${var.asset_hostnames[0]}.education.gov.uk"
+    GOOGLE_CLOUD_CREDENTIALS = var.enable_dfe_analytics_federated_auth ? module.dfe_analytics[0].google_cloud_credentials : null
   }
 }
 
@@ -152,4 +156,6 @@ module "worker_application" {
   enable_logit               = var.enable_logit
 
   enable_prometheus_monitoring  = var.enable_prometheus_monitoring
+
+  enable_gcp_wif = true
 }

terraform/aks/config/development.tfvars.json

@@ -6,5 +6,7 @@
     "enable_logit": true,
     "enable_prometheus_monitoring": true,
     "sidekiq_replicas" : 1,
-    "sidekiq_memory_max" : "1Gi"
+    "sidekiq_memory_max" : "1Gi",
+    "dataset_name": "git_website_events_development",
+    "enable_dfe_analytics_federated_auth": true
 }

terraform/aks/config/production.tfvars.json

@@ -17,5 +17,6 @@
     "enable_logit": true,
     "enable_prometheus_monitoring": true,
     "sidekiq_replicas" : 1,
-    "sidekiq_memory_max" : "1Gi"
+    "sidekiq_memory_max" : "1Gi",
+    "dataset_name": "git_website_events_production"
 }

terraform/aks/config/review.tfvars.json

@@ -6,5 +6,7 @@
     "enable_postgres_ssl": false,
     "enable_logit": true,
     "sidekiq_replicas" : 1,
-    "sidekiq_memory_max" : "1Gi"
+    "sidekiq_memory_max" : "1Gi",
+    "enable_dfe_analytics_federated_auth": true,
+    "dataset_name": "git_website_events_rolling"
 }

terraform/aks/dfe_analytics.tf

@@ -0,0 +1,15 @@
+provider "google" {
+  project = "get-into-teaching"
+}
+
+module "dfe_analytics" {
+  count  = var.enable_dfe_analytics_federated_auth ? 1 : 0
+  source = "./vendor/modules/aks//aks/dfe_analytics"
+
+  azure_resource_prefix = var.azure_resource_prefix
+  cluster               = var.cluster
+  namespace             = var.namespace
+  service_short         = var.service_short
+  environment           = local.environment
+  gcp_dataset           = var.dataset_name
+}

terraform/aks/variables.tf

@@ -40,6 +40,15 @@ variable "enable_postgres_backup_storage" {
 variable "docker_image" {
   description = "Docker image full name to identify it in the registry. Includes docker registry, repository and tag e.g.: ghcr.io/dfe-digital/teacher-pay-calculator:673f6309fd0c907014f44d6732496ecd92a2bcd0"
 }
+variable "enable_dfe_analytics_federated_auth" {
+  description = "Create the resources in Google cloud for federated authentication and enable in application"
+  default     = false
+}
+variable "dataset_name" {
+  description = "dfe analytics dataset name in Google Bigquery"
+
+  default     = null
+}
 variable "external_url" {
   default     = null
   description = "Healthcheck URL for StatusCake monitoring"