Add periodic drift-detection workflow#160
Merged
Merged
Conversation
The Detect Drift workflow runs a terraform plan with no build behind it, but the ECS deployment requires a container image (TF_VAR_TAGGED_IMAGE). The variable has no default and the task definition tracks it directly, so a drift plan either fails with "no value for required variable" or, if given a placeholder, reports permanent false drift on the task definition. Before planning, each environment reads the image that is currently deployed straight from its ECS task definition and passes it to the reusable drift workflow as TF_VAR_TAGGED_IMAGE. The image lookup is done explicitly in this repository rather than in the shared kosli-dev/tf workflow, so Kosli's own drift detection is unaffected. The logic lives in a local reusable workflow, detect-drift-env.yml, which is parameterized by AWS account and environment. detect-drift.yml holds only the schedule and a beta/prod matrix that calls it, so there is no duplication between environments and adding another is a two-line change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a scheduled Detect Drift workflow to this repository, matching the
setup already in
webandterraform-base-infra.The drift
terraform planruns with no build behind it, but the ECSdeployment requires a container image (
TF_VAR_TAGGED_IMAGE) that has nodefault and is tracked directly by the task definition. So before planning,
each environment reads the image that is currently deployed straight from
its ECS task definition and passes it to the shared
kosli-dev/tfdriftworkflow. This means the plan reflects real drift rather than failing on a
missing variable or reporting a phantom image change.
The logic lives in a local reusable workflow,
detect-drift-env.yml,parameterized by AWS account and environment.
detect-drift.ymlholds onlythe schedule and a beta/prod matrix that calls it, so there is no
duplication between environments.