📖 Migrate jobs from github-actions-moj-CoFBZ3xV EKS Cluster

[Gary-H9]

Proposal

Note

This ticket precedes this ticket to decommission the cluster.

As per this thread.

Migrate any workloads that run on the github-actions-moj-CoFBZ3xV cluster in analytical-platform-management-production.

Value / Purpose

Consolidate compute, reduce cost.

Definition of Done

• Establish what workloads are running on the cluster, what they are doing (e.g. is it building a container?) and what role they are using
• Liaise with owner to gather any requirements (e.g. can repos that interact with CT data run on GitHub hosted?) and inform of our intention to migrate and sunset offering
• Identify which jobs can move to GitHub Actions hosted runners (GHA) vs. self hosted runners (SHR)
• Create a role for each job, GitHub assumable for GHA and IRSA for SHR
• Create/update any shared GitHub Actions actions utilised by workloads
• Create any self hosted runners in APC
• Migrate workloads to their new location

[julialawrence]

Split this ticket into 2:

1. Identify and profile workloads (see proposal)
2. Step to retire

[jacobwoffenden]

jobs using management-infrastructure

https://github.com/search?q=org%3Aministryofjustice+OR+org%3Amoj-analytical-services+%22self-hosted%2C+management-infrastructure%22&type=code

jobs using management-ecr

https://github.com/search?q=org%3Aministryofjustice+OR+org%3Amoj-analytical-services+%22self-hosted%2C+management-ecr%22&type=code

[Emterry]

Spreadsheet for jobs using management-infrastructure and management-ecr https://docs.google.com/spreadsheets/d/1ZkTFF6MlbkZvk8sA7A9Cyd-JoJVcS6koE4FM2xuNZA4/edit?usp=sharing

Service accounts and roles on the cluster https://docs.google.com/document/d/10z0cGW0wTHP1rA0CPwKz5CcHobqceAD_s9FPdchKgBA/edit?usp=sharing

[Emterry]

update: completed spreadsheet with job search as mentioned above - didnt include archived repos but can add them in if required, been thinking on how to progress with migration with this repo https://github.com/ministryofjustice/analytical-platform-nginx-jupyter as a test start point as its owned by us. Ive added some initial questions to the google doc linked above if anyone needs to look at it before im back in on tuesday 12/11

[Emterry]

comms doc https://docs.google.com/document/d/1bkC6IjvBQ3x_5LLOLEZCb5C-GbKx6I1DSab2rnqR17Y/edit?tab=t.0
updated spreadsheet :https://docs.google.com/spreadsheets/d/1_Q5R0FP0G6g_c2C4ELdvsRcRAOXNkuSw5Po71XdrL80/edit?gid=372902673#gid=372902673

[BrianEllwood]

Update

Brian - Working on PR #6160 as changes requested

Emma - Working on PR #8739 for creating self hosted runner but currently blocked by another PR on APC

All the repositories in the management-infrastructure tab are part of a pr or do not require further action.

[BrianEllwood]

Asked Francesca about the ct-tact-list work in this slack thread

[BrianEllwood]

update from Francesca "I’m aware of the issue —
@Jacob Hamblin-Pyke and I were looking at it but we’re still stumped."

[BrianEllwood]

moved onto Make rstudio ecr-repo public and push to GHCR #6090

[BrianEllwood]

Outstanding PR's for Management infrastructure migrations

#6160

#6117

Work on ct-tact-list is blocked by issues with code being addressed by the code owner.

Draft communication to the users here

[Emterry]

outstanding pr's to be reviewed merged :

https://github.com/ministryofjustice/analytics-platform-aws-federated-login/pull/1555 - failing due to needing to be made public. I havnt added devcontainer - does it need it? maybe?
ministryofjustice/analytics-platform-control-panel#1398 - control panel image
#6117 - our joint pr

Comms : https://docs.google.com/document/d/1bkC6IjvBQ3x_5LLOLEZCb5C-GbKx6I1DSab2rnqR17Y/edit?tab=t.0

[BrianEllwood]

Just for clarity this is the roles and permissions PR that needs approval.

As there is quite a few its quite noisy

[BrianEllwood]

Task - create PR's to implement Migrations to Github Actions for Repositories where new role has been created, then contact users for approval to implement after christmas.

[BrianEllwood]

This is the current state of play for the repositories and prs to make the changes to migrate to Github hosted runners

create-a-derived-table-infrastructure - changes made and merged
data-engineering-database-access - all checks passed on changes in draft pr
analytics-platform-helm-chart - draft changes still failing checks
airflow-contracts-etl - to do
data-engineering-cleanup - to do
data-discovery - to do
create-a-derived-table - to do

Agreed that we should create a issue on the repositories and post coms in the Support channel

[BrianEllwood]

Comms sent out in slack

[BrianEllwood]

Issues created

https://github.com/ministryofjustice/data-engineering-cleanup/issues/37

https://github.com/moj-analytical-services/airflow-contracts-etl/issues/166

https://github.com/moj-analytical-services/data-engineering-database-access/issues/4697