> **Page index:** https://km.oslo.systems/llms.txt lists every page on this site, with a link to its Markdown version.

# Configure infrastructure

Prepare an existing application for the new deployment pipeline by making some small infrastructure changes.

## Before you begin

- You have familiarized yourself with [the key points from the risk assessment analysis (ROS)](<https://github.com/oslokommune/golden-path-docs-internal/blob/main/oppsummering-ros-nytt-cicd-oppsett.md>)
- You have migrated to new CI/CD for infrastructure:
- [Prepare infrastructure repository](<https://km.oslo.systems/terraform-automation/migrate-to-latest-workflows/prepare-infrastructure-repository/index.md>)
- [Add plan workflow](<https://km.oslo.systems/terraform-automation/migrate-to-latest-workflows/add-plan-workflow/index.md>)
- [Add apply workflow](<https://km.oslo.systems/terraform-automation/migrate-to-latest-workflows/add-apply-workflow/index.md>)
- Your application uses the `app` or `cloudfront-static-website` Boilerplate template

## Step 1: Configure the `cicd-common` stack in `dev`

Add your application repository to `config_override.tf`. The configuration differs depending on your repository type.

- **Application repository**—the repository contains code for a single application, while the associated infrastructure lives in a separate IaC repository (for example, `pirates-iac`).
- **Application monorepo**—the repository contains code for many applications, while the associated infrastructure lives in a separate IaC repository (for example, `pirates-iac`).
- **Application repository with infrastructure**—the repository contains both application code and the associated infrastructure for a single application.

Select the tab that matches your repository type:

Make the following changes:

repo-iac/environments/dev/cicd-common/config\_override.tf

```
locals {
  trusted_repositories = [
    # ...
    {
      name = "<repo-name>"
      type = "app"
    }
  ]
}
```

Update these values:

| Field | Description | Example |
| --- | --- | --- |
| `<repo-name>` | The name of your application repository | `pirates-app-zebra` |

Make the following changes:

repo-iac/environments/dev/cicd-common/config\_override.tf

```
locals {
  trusted_repositories = [
    # ...
    {
      name = "<repo-name>"
      type = "app"
      apps = [
        # Add more as needed
        "<app-name>"
      ]
    }
  ]
}
```

Update these values:

| Field | Description | Example |
| --- | --- | --- |
| `<repo-name>` | The name of your application monorepo | `pirates-apps` |
| `<app-name>` | The name of your application | `too-tikki` |

Make the following changes:

repo-iac/environments/dev/cicd-common/config\_override.tf

```
locals {
  trusted_repositories = [
    # ...
    {
      name = "<repo-name>"
      type = "hybrid"
    }
  ]
}
```

Update these values:

| Field | Description | Example |
| --- | --- | --- |
| `<repo-name>` | The name of your application repository with infrastructure | `pirates-app-swordsmith` |

## Step 2: Configure the application stack

In a stack using an `app` or `cloudfront-static-website` template, enable the new deployment mechanism:

repo-iac/environments/dev/app-example/package-config.yml

```
DeploymentPipelineV2:
  Enable: true
```

Install the package:

repo-iac/environments/dev/app-example/

```
ok pkg install
```

> [!WARNING]
>
> **For existing ECS container applications: Avoid downtime**
>
> `DeploymentPipelineV2` sets the ECS container's image URI (`local.image_uri`) automatically based on an image tag that's read from SSM Parameter Store (`local.artifact_tag`). During initial setup, the tag will contain a placeholder value (`"null"`) because the new CI/CD pipeline hasn't run yet.
>
> **In critical environments, add a fallback value in `config_override.tf` to prevent downtime that can occur from trying to deploy a non-existent image:**
>
> ```
> locals {
>   image_uri = (
>     local.artifact_tag != "null" ?
>     "${local.account_id}.dkr.ecr.${local.region}.amazonaws.com/${local.environment}-artifact:${local.artifact_tag}" :
>     "<fallback-image-uri>"
>   )
> }
> ```
>
> Update these values (you can find your current image URI in the ECS console in AWS):
>
> | Field | Description | Example |
> | --- | --- | --- |
> | `<fallback-image-uri>` | The URI of an image to use on the first deploy | `123456789012.dkr.ecr.eu-west-1.amazonaws.com/my-repo:my-tag` |

## Step 3: Create a pull request

Create a pull request with your changes. GitHub Actions runs automatically and shows the planned changes in the pull request.

The plan contents depends on your set up, but based on a standard setup of a container application using Golden Path, the plan includes:

- A new SSM parameter for storing artifact references
- ECS service configured to have Terraform wait for container health checks to succeed through `wait_for_steady_state`
- IAM resources from the old CI/CD setup to be removed
- IAM resources for the new CI/CD setup to be added
- Changes to environment variables, Terraform outputs, and variables

Be sure to check that the `image_uri` in the task definition is either the image you provided in the workaround (see warning above), or otherwise an expected image (not an image tagged with `"null"`).

If you are unsure whether changes are safe to apply, don't hesitate to [contact Utviklerflyt](<https://km.oslo.systems/help/contact-us/index.md>).

## Step 4: Merge the pull request

Merge the pull request and let the Terraform apply workflow in GitHub Actions apply the changes.

## Step 5: Repeat for production

Repeat steps above for your production environment.

## Next steps

[Prepare app repository](<https://km.oslo.systems/application/migrate-to-latest-cicd/prepare-app-repository/index.md>) with secrets, branch rulesets, and deployment approval.