Rebrand ESDIS hub for IEEE-GRSS webinar

[freitagb]

No description provided.

[github-actions]

Merging this PR will trigger the following deployment actions.

Support and Staging deployments

Cloud Provider	Cluster Name	Upgrade Support?	Reason for Support Redeploy	Upgrade Staging?	Reason for Staging Redeploy
aws	nasa-esdis	No		Yes	Following helm chart values files were modified: common.values.yaml

Production deployments

Cloud Provider	Cluster Name	Hub Name	Reason for Redeploy
aws	nasa-esdis	prod	Following helm chart values files were modified: common.values.yaml

[sgibson91]

Please note: If changing the URL, you will also need to update the Hub OAuth Callback URL here. A 2i2c engineer will also need to update the hub URLs in the GitHub OAuth application as well. Otherwise, logins will break.

[sgibson91]

Also the ingress URLs will need updating, otherwise our load balancer won't allow traffic to the new URL

https://github.com/freitagb/infrastructure/blob/eee5222f9921544a07ce9492625d3b7f10ceca63/config/clusters/nasa-esdis/prod.values.yaml#L6-L8

[sgibson91]

Is it really necessary to change the URL? This is not a simple operation, and I'm assuming this is temporary since it is for a webinar so we will have to do the reverse afterwards.

[freitagb]

we can skip the url change. Thanks @sgibson91

[sgibson91]

Output of terraform plan

Terraform used the selected providers to generate the following execution plan. Resource actions
are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_iam_policy.extra_user_policy["prod"] will be created
  + resource "aws_iam_policy" "extra_user_policy" {
      + arn         = (known after apply)
      + description = "Extra permissions granted to users on hub prod on nasa-esdis"
      + id          = (known after apply)
      + name        = "nasa-esdis-prod-extra-user-policy"
      + name_prefix = (known after apply)
      + path        = "/"
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "s3:PutObject",
                          + "s3:GetObject",
                          + "s3:ListBucketMultipartUploads",
                          + "s3:AbortMultipartUpload",
                          + "s3:ListBucketVersions",
                          + "s3:CreateBucket",
                          + "s3:ListBucket",
                          + "s3:DeleteObject",
                          + "s3:GetBucketLocation",
                          + "s3:ListMultipartUploadParts",
                        ]
                      + Effect   = "Allow"
                      + Resource = [
                          + "arn:aws:s3:::veda-data-store-staging",
                          + "arn:aws:s3:::veda-data-store-staging/*",
                          + "arn:aws:s3:::veda-nex-gddp-cmip6-public",
                          + "arn:aws:s3:::veda-nex-gddp-cmip6-public/*",
                          + "arn:aws:s3:::cmip6-staging",
                          + "arn:aws:s3:::cmip6-staging/*",
                          + "arn:aws:s3:::lp-prod-protected",
                          + "arn:aws:s3:::lp-prod-protected/*",
                          + "arn:aws:s3:::gesdisc-cumulus-prod-protected",
                          + "arn:aws:s3:::gesdisc-cumulus-prod-protected/*",
                          + "arn:aws:s3:::nsidc-cumulus-prod-protected",
                          + "arn:aws:s3:::nsidc-cumulus-prod-protected/*",
                          + "arn:aws:s3:::ornl-cumulus-prod-protected",
                          + "arn:aws:s3:::ornl-cumulus-prod-protected/*",
                          + "arn:aws:s3:::pangeo-forge-veda-output",
                          + "arn:aws:s3:::pangeo-forge-veda-output/*",
                          + "arn:aws:s3:::podaac-ops-cumulus-public",
                          + "arn:aws:s3:::podaac-ops-cumulus-public/*",
                          + "arn:aws:s3:::podaac-ops-cumulus-protected",
                          + "arn:aws:s3:::podaac-ops-cumulus-protected/*",
                          + "arn:aws:s3:::maap-ops-workspace",
                          + "arn:aws:s3:::maap-ops-workspace/*",
                          + "arn:aws:s3:::nasa-maap-data-store",
                          + "arn:aws:s3:::nasa-maap-data-store/*",
                          + "arn:aws::s3:::grss-veda-data-store",
                          + "arn:aws::s3:::grss-veda-data-store/*",
                          + "arn:aws:s3:::sentinel-cogs",
                          + "arn:aws:s3:::sentinel-cogs/*",
                        ]
                    },
                  + {
                      + Action   = "s3:ListAllMyBuckets"
                      + Effect   = "Allow"
                      + Resource = "*"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id   = (known after apply)
      + tags_all    = (known after apply)
    }

  # aws_iam_role_policy_attachment.extra_user_policy["prod"] will be created
  + resource "aws_iam_role_policy_attachment" "extra_user_policy" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = "nasa-esdis-prod"
    }

Plan: 2 to add, 0 to change, 0 to destroy.

[sgibson91]

tf failed to apply

aws_iam_policy.extra_user_policy["prod"]: Creating...
╷
│ Error: creating IAM Policy (nasa-esdis-prod-extra-user-policy): MalformedPolicyDocument: The policy failed legacy parsing
│       status code: 400, request id: 23b87fbe-f573-41c8-858c-1291abb6b9e9
│ 
│   with aws_iam_policy.extra_user_policy["prod"],
│   on irsa.tf line 37, in resource "aws_iam_policy" "extra_user_policy":
│   37: resource "aws_iam_policy" "extra_user_policy" {

EDIT: This was fixed by removing some extra colons in fa9819a (#3809). Terraform has now applied successfully.

[sgibson91]

Deployed to staging successfully

[github-actions]

🎉🎉🎉🎉

Monitor the deployment of the hubs here 👉 https://github.com/2i2c-org/infrastructure/actions/runs/8358297483