PLT-1445 Service module adoption for AB2D contracts, events and worker services by jscott-nava · Pull Request #1663 · CMSgov/ab2d

jscott-nava · 2025-12-18T17:45:50Z

🎫 Ticket

https://jira.cms.gov/browse/PLT-1445

🛠 Changes

This PR contains the changes required to migrate the AB2D contracts, events and worker services onto the CDAP service module.

The following two caveats should be noted:

Due to the use of a shared platform module the tags for the services are updated from either contracts or events to microservices. If this is not desired then microservice-specific platform modules could be passed in instead.
The events_service force_new_deployment flag is reverted from true to false which would indicate that during the previous tofu apply in the test environment this setting was overridden with an image tag which sets the flag to true.
This PR depends on the CDAP service module updates pending review in PLT-1445 Service module updates for AB2D adoption cdap#360; prior to merging this PR, the CDAP PR must be merged and then the module references in this PR updated with the new commit hash.
The unit-integration-test/sonarqube/test check on this PR failed (https://github.com/CMSgov/ab2d/actions/runs/20345958599/job/58458189335?pr=1663) with errors that appear to be unrelated to these changes. Please advise whether this test is flaky or whether it indicates an issue introduced by these changes.
A health_check_grace_period_seconds variable was added to the service module to prevent errors from setting this value to 300 for the worker service given that it is not associated with a load balancer; see [Bug]: Breaking change: Health check grace period is only valid for services configured to use load balancers hashicorp/terraform-provider-aws#31104 for more details.

ℹ️ Context

With the AB2D api service having already been migrated to the CDAP service module, this PR addresses service module adoption for the remaining three AB2D services.

🧪 Validation

Tofu plan output for 20-microservices (AB2D-TEST)

OpenTofu will perform the following actions:

  # module.contracts_service.aws_ecs_service.this will be updated in-place
  # (moved from aws_ecs_service.contracts)
  ~ resource "aws_ecs_service" "this" {
        id                                 = "arn:aws:ecs:us-east-1:xxxxxxxxxxxx:service/ab2d-test-microservices/ab2d-test-contracts"
        name                               = "ab2d-test-contracts"
      ~ tags                               = {
          - "service" = "contracts" -> null
        }
      ~ tags_all                           = {
          ~ "service"        = "contracts" -> "microservices"
            # (6 unchanged elements hidden)
        }
      ~ task_definition                    = "arn:aws:ecs:us-east-1:xxxxxxxxxxxx:task-definition/ab2d-test-contracts:30" -> (known after apply)
        # (16 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # module.contracts_service.aws_ecs_task_definition.this must be replaced
  # (moved from aws_ecs_task_definition.contracts)
-/+ resource "aws_ecs_task_definition" "this" {
      ~ arn                      = "arn:aws:ecs:us-east-1:xxxxxxxxxxxx:task-definition/ab2d-test-contracts:30" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:us-east-1:xxxxxxxxxxxx:task-definition/ab2d-test-contracts" -> (known after apply)
      ~ container_definitions    = jsonencode(
          ~ [
              ~ {
                  - essential              = true
                  ~ logConfiguration       = {
                      ~ options   = {
                          ~ awslogs-group         = "/aws/ecs/fargate/ab2d-test/ab2d_contracts" -> "/aws/ecs/fargate/ab2d-test/contracts"
                            # (3 unchanged attributes hidden)
                        }
                        # (1 unchanged attribute hidden)
                    }
                  ~ name                   = "contracts-service-container" -> "contracts"
                  - systemControls         = []
                  - volumesFrom            = []
                    # (6 unchanged attributes hidden)
                },
            ] # forces replacement
        )
      ~ enable_fault_injection   = false -> (known after apply)
      ~ id                       = "ab2d-test-contracts" -> (known after apply)
      ~ revision                 = 30 -> (known after apply)
      - tags                     = {} -> null
        # (10 unchanged attributes hidden)

        # (3 unchanged blocks hidden)
    }

  # module.events_service.aws_ecs_service.this will be updated in-place
  # (moved from aws_ecs_service.events)
  ~ resource "aws_ecs_service" "this" {
      ~ force_new_deployment               = true -> false
        id                                 = "arn:aws:ecs:us-east-1:xxxxxxxxxxxx:service/ab2d-test-microservices/ab2d-test-events"
        name                               = "ab2d-test-events"
      ~ tags                               = {
          - "service" = "events" -> null
        }
      ~ tags_all                           = {
          ~ "service"        = "events" -> "microservices"
            # (6 unchanged elements hidden)
        }
      ~ task_definition                    = "arn:aws:ecs:us-east-1:xxxxxxxxxxxx:task-definition/ab2d-test-events:18" -> (known after apply)
        # (15 unchanged attributes hidden)

        # (3 unchanged blocks hidden)
    }

  # module.events_service.aws_ecs_task_definition.this must be replaced
  # (moved from aws_ecs_task_definition.events)
-/+ resource "aws_ecs_task_definition" "this" {
      ~ arn                      = "arn:aws:ecs:us-east-1:xxxxxxxxxxxx:task-definition/ab2d-test-events:18" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:us-east-1:xxxxxxxxxxxx:task-definition/ab2d-test-events" -> (known after apply)
      ~ container_definitions    = jsonencode(
          ~ [
              ~ {
                  - essential              = true
                  ~ logConfiguration       = {
                      ~ options   = {
                          ~ awslogs-group         = "/aws/ecs/fargate/ab2d-test/ab2d_events" -> "/aws/ecs/fargate/ab2d-test/events"
                            # (3 unchanged attributes hidden)
                        }
                        # (1 unchanged attribute hidden)
                    }
                  ~ name                   = "events-service-container" -> "events"
                  - systemControls         = []
                  - volumesFrom            = []
                    # (6 unchanged attributes hidden)
                },
            ] # forces replacement
        )
      ~ enable_fault_injection   = false -> (known after apply)
      ~ id                       = "ab2d-test-events" -> (known after apply)
      ~ revision                 = 18 -> (known after apply)
      - tags                     = {} -> null
        # (10 unchanged attributes hidden)

        # (3 unchanged blocks hidden)
    }

Plan: 2 to add, 2 to change, 2 to destroy.

Tofu plan output for 30-worker (AB2D-TEST)

OpenTofu will perform the following actions:

  # module.service.aws_ecs_service.this will be updated in-place
  # (moved from aws_ecs_service.worker)
  ~ resource "aws_ecs_service" "this" {
        id                                 = "arn:aws:ecs:us-east-1:xxxxxxxxxxxx:service/ab2d-test-worker/ab2d-test-worker"
        name                               = "ab2d-test-worker"
      ~ platform_version                   = "LATEST" -> "1.4.0"
        tags                               = {}
        # (17 unchanged attributes hidden)

      ~ network_configuration {
          ~ subnets          = (sensitive value)
            # (2 unchanged attributes hidden)
        }

        # (2 unchanged blocks hidden)
    }

  # aws_ecs_task_definition.worker has moved to module.service.aws_ecs_task_definition.this
    resource "aws_ecs_task_definition" "this" {
        id                       = "ab2d-test-worker"
        tags                     = {}
        # (15 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

bennavapbc

Will likely want to merge #1666 first? cc @juliareynolds-nava

ops/services/20-microservices/contracts.tf

jscott-nava · 2026-01-09T19:52:14Z

Changes have been made both to this PR and the related CDAP service module PR - see the updated Tofu plans in the description.

ops/services/20-microservices/events.tf

ops/services/30-worker/main.tf

ops/services/20-microservices/contracts.tf

gsf · 2026-01-21T17:12:51Z

Due to the use of a shared platform module the tags for the services are updated from either contracts or events to microservices. If this is not desired then microservice-specific platform modules could be passed in instead.

Apologies for not catching this earlier, but I'm fairly certain that the ab2d team will want contracts and events to have tags specific to each service. Please do create separate platform instances for each.

bennavapbc · 2026-01-21T17:16:25Z

I'm fairly certain that the ab2d team will want contracts and events to have tags specific to each service.

Correct.

mjburling · 2026-01-21T22:10:20Z

Apologies for not catching this earlier, but I'm fairly certain that the ab2d team will want contracts and events to have tags specific to each service.

This probably ought to split 20-microservices into 20-events and 20-contracts. This is a holdover from the legacy microservices module from archived ab2d-ops repository. There's no reason for them to continue to be bundled together.

Please do create separate platform instances for each.

Re-declaring the platform module here won't help matters without modifying CDAP's service module to allow for tag overrides–tagging is controlled by the provider definitions in ../root.tofu.tf included in this root module.

juliareynolds-nava · 2026-01-22T16:54:39Z

ops/services/30-worker/main.tf

-    secrets : [
-      { name : "AB2D_BFD_KEYSTORE_PASSWORD", valueFrom : local.bfd_keystore_password_arn },
-      { name : "AB2D_BFD_KEYSTORE_BASE64", valueFrom : local.bfd_keystore_base64_arn },
-      { name : "AB2D_BFD_TRUSTSTORE_CERT", valueFrom : local.bfd_server_public_cert_arn },


AB2D is going to need this TRUSTSTORE cert value for the mtls V3 update.

mianava · 2026-02-04T20:45:41Z

ops/services/20-contracts/templates/config/iam/chatbot_policy.json

+            "Action": [
+                "chatbot:UpdateSlackChannelConfiguration",
+                "chatbot:UpdateChimeWebhookConfiguration",
+                "chatbot:Describe*",


Can this be refined: https://docs.aws.amazon.com/service-authorization/latest/reference/list_awschatbot.html

Probably, it was just copied over from the /20-microservices/ directory since I wasn't quite sure which service depended on it

## 🎫 Ticket https://jira.cms.gov/browse/PLT-1569 ## 🛠 Changes Adds a flag that excludes draft PRs from the pull request workflow. ## ℹ️ Context We don't want to be deploying _every_ change we commit to pull requests in the repo. ## 🧪 Validation With this added, the pull request workflow does not run, as seen in this example: #1663

ops/services/20-contracts/main.tf

mianava · 2026-02-11T22:14:49Z

ops/services/20-events/main.tf

+  cpu                   = 512
+  desired_count         = 1


is this the same for every environment?

It's taken from the old microservices directory that included both of these. So I would assume so.

ops/services/20-events/tofu.tf

mianava · 2026-02-11T22:24:46Z

ops/services/30-worker/main.tf

+  cluster_arn                       = module.cluster.this.arn
+  cpu                               = local.ecs_task_def_cpu_worker
+  desired_count                     = local.worker_desired_instances
+  execution_role_arn                = data.aws_iam_role.worker.arn
+  force_new_deployment              = anytrue([var.force_worker_deployment, var.worker_service_image_tag != null])
+  health_check_grace_period_seconds = null
+  image                             = local.worker_image_uri
+  memory                            = local.ecs_task_def_memory_worker
+  platform                          = module.platform
+  security_groups                   = [data.aws_security_group.worker.id]
+  subnets                           = local.writer_adjacent_subnets
+  task_role_arn                     = data.aws_iam_role.worker.arn


I recommend sorting these so settings like cpu, image, memory, healtcheck grace period, are together, IAM roles are together or with other relevant settings, and then very common objects like platform are at the bottom

Sure, I'll capture any of this cleanup work in a separate ticket.

ops/services/30-worker/main.tf

mianava · 2026-02-11T22:26:58Z

ops/services/30-worker/main.tf

+    {
+      name = "newrelic_logs"
+    },
+    {


Still relevant?

I'm going to group these "relevancy" comments together, but this is a month old PR that has surely seen things come and go as it has been open. If this is no longer relevant I would suggest we take it out in a different ticket and get this work over the line.

mianava

Noting this is a lift and set of existing resources and there might be future work around terraform style.

jscott-nava requested a review from a team December 18, 2025 17:46

jscott-nava marked this pull request as ready for review December 18, 2025 18:52

jscott-nava requested a review from a team as a code owner December 18, 2025 18:52

jscott-nava requested a review from gsf December 18, 2025 18:53

juliareynolds-nava previously approved these changes Dec 18, 2025

View reviewed changes

bennavapbc requested review from Sadibhatla and bennavapbc December 19, 2025 22:16

bennavapbc previously approved these changes Dec 31, 2025

View reviewed changes

jscott-nava dismissed stale reviews from bennavapbc and juliareynolds-nava via 42ecd0e January 8, 2026 22:48

jscott-nava force-pushed the jscott/PLT-1445 branch 2 times, most recently from 42ecd0e to e894326 Compare January 9, 2026 17:45

gsf reviewed Jan 9, 2026

View reviewed changes

ops/services/20-microservices/contracts.tf Outdated Show resolved Hide resolved

jscott-nava requested review from bennavapbc and gsf January 9, 2026 19:57

mjburling changed the title ~~[PLT-1445] Service module adoption for AB2D contracts, events and worker services~~ PLT-1445 Service module adoption for AB2D contracts, events and worker services Jan 12, 2026

mjburling reviewed Jan 12, 2026

View reviewed changes

ops/services/20-microservices/events.tf Outdated Show resolved Hide resolved

mjburling reviewed Jan 12, 2026

View reviewed changes

ops/services/30-worker/main.tf Outdated Show resolved Hide resolved

mjburling reviewed Jan 12, 2026

View reviewed changes

ops/services/20-microservices/contracts.tf Outdated Show resolved Hide resolved

jscott-nava force-pushed the jscott/PLT-1445 branch from e894326 to eb225ab Compare January 14, 2026 16:29

jscott-nava requested a review from mjburling January 14, 2026 16:48

jscott-nava force-pushed the jscott/PLT-1445 branch from bec829d to 83b643d Compare January 14, 2026 19:28

juliareynolds-nava previously approved these changes Jan 15, 2026

View reviewed changes

jscott-nava force-pushed the jscott/PLT-1445 branch from 1c9f025 to 66be8ae Compare January 20, 2026 16:34

jscott-nava dismissed juliareynolds-nava’s stale review via 9d36518 January 20, 2026 22:17

Migrating worker service onto CDAP service module.

61e20e7

jscott-nava added 8 commits January 22, 2026 08:36

Migrating AB2D contracts to CDAP service module.

0f92fe9

Migrating events service to CDAP service module.

fd045ce

Removing awslogs group and container name overrides.

4c8fe9d

Various review feedback updates.

e5b6213

Various review feedback updates.

0b563ea

Removing fargate_version to use default 1.4.0.

9fe8237

Updating CDAP service module commit hash.

94c1b0a

Adding subnets parameter to service module.

2415a0d

jscott-nava force-pushed the jscott/PLT-1445 branch from 9d36518 to 2415a0d Compare January 22, 2026 16:50

juliareynolds-nava reviewed Jan 22, 2026

View reviewed changes

jscott-nava marked this pull request as draft January 22, 2026 20:01

add new directories for separate contracts and events services

f2e092b

mianava reviewed Feb 4, 2026

View reviewed changes

gfreeman-navapbc added 3 commits February 4, 2026 13:02

add gate for draft PR on pull request

562624d

update ref in worker

5120b04

update to newest service module version

de34e08

gfreeman-navapbc mentioned this pull request Feb 5, 2026

PLT-1569: Add draft PR filter for pull request workflow #1696

Merged

gfreeman-navapbc added 2 commits February 11, 2026 12:52

update README, remove microservices directory

a4535fc

Merge branch 'main' into jscott/PLT-1445

f671a93

bennavapbc approved these changes Feb 11, 2026

View reviewed changes

smirnovaae approved these changes Feb 11, 2026

View reviewed changes

gfreeman-navapbc requested a review from juliareynolds-nava February 11, 2026 21:55

mianava reviewed Feb 11, 2026

View reviewed changes

mianava self-requested a review February 12, 2026 19:06

mianava approved these changes Feb 13, 2026

View reviewed changes

gfreeman-navapbc marked this pull request as ready for review February 17, 2026 18:49

gfreeman-navapbc merged commit ae91735 into main Feb 17, 2026
21 of 23 checks passed

gfreeman-navapbc deleted the jscott/PLT-1445 branch February 17, 2026 19:20

Conversation

jscott-nava commented Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🎫 Ticket

🛠 Changes

ℹ️ Context

🧪 Validation

Uh oh!

bennavapbc left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jscott-nava commented Jan 9, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gsf commented Jan 21, 2026

Uh oh!

bennavapbc commented Jan 21, 2026

Uh oh!

mjburling commented Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mianava left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

jscott-nava commented Dec 18, 2025 •

edited

Loading

mjburling commented Jan 21, 2026 •

edited

Loading