diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml new file mode 100644 index 00000000..a2153a70 --- /dev/null +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -0,0 +1,257 @@ +# Copyright (c) CloudBees, Inc. + +# Stages +# CD: deploy,validate,onboarding +# Nuke: wipeout + +apiVersion: automation.cloudbees.io/v1alpha1 +kind: workflow +name: ci + +on: + workflow_dispatch: + +env: + AWS_REGION_TF_BUCKET: "us-east-1" + BUCKET_NAME_TF_STATE: "cbci-eks-addon-tf-state-cd" + AWS_ROLE_TO_ASSUME: "infra-admin-ci" + TF_VAR_suffix: "ci-v11" + TF_VAR_aws_region: "us-west-2" + TF_AUTO_VARS_FILE: | + tags = { + "cb-owner" : "professional-services" + "cb-user" : "cb-platform" + "cb-purpose" : "cd" + } + trial_license = { + first_name = "CloudBees.io" + last_name = "Platform" + email = "ci.user@cloudbees.io" + company = "CloudBees Inc." + } + ci = true + +jobs: + init: + steps: + + - name: Configure AWS Credentials + uses: cloudbees-io/configure-aws-credentials@v1 + with: + aws-region: ${{ env.AWS_REGION_TF_BUCKET }} + aws-access-key-id: ${{ secrets.AWS_TF_CBCI_EKS_AccessKeyID }} + aws-secret-access-key: ${{ secrets.AWS_TF_CBCI_EKS_SecretAccessKey }} + role-to-assume: ${{ env.AWS_ROLE_TO_ASSUME }} + role-external-id: cloudbees + role-duration-seconds: "3600" + + #TODO: Add tags for the bucket + - name: Create Terraform Backend Bucket if not exists + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + shell: bash + run: | + set -x + aws s3api create-bucket \ + --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ + --region ${{ env.AWS_REGION_TF_BUCKET }} || echo "Bucket ${{ env.BUCKET_NAME_TF_STATE }} already exists" + + bp01: + env: + ROOT: 01-getting-started + TF_VAR_hosted_zone: bp01-cd.aws.ps.beescloud.com + STAGES: "wipeout" + needs: + - init + steps: + + - name: Configure AWS Credentials + uses: cloudbees-io/configure-aws-credentials@v1 + with: + aws-region: ${{ env.TF_VAR_aws_region }} + aws-access-key-id: ${{ secrets.AWS_TF_CBCI_EKS_AccessKeyID }} + aws-secret-access-key: ${{ secrets.AWS_TF_CBCI_EKS_SecretAccessKey }} + role-to-assume: ${{ env.AWS_ROLE_TO_ASSUME }} + role-external-id: cloudbees + role-duration-seconds: "3600" + + - name: Checkout code + uses: cloudbees-io/checkout@v1 + + - name: 01-getting-started - Set + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + shell: bash + run : | + cat <> blueprints/${{ env.ROOT }}/.auto.tfvars + ${{ env.TF_AUTO_VARS_FILE }} + EOT + cat blueprints/${{ env.ROOT }}/.auto.tfvars + cat <> blueprints/${{ env.ROOT }}/backend.tf + terraform { + backend "s3" { + bucket = "${{ env.BUCKET_NAME_TF_STATE }}" + key = "${{ env.ROOT }}/ci.terraform.tfstate" + region = "${{ env.AWS_REGION_TF_BUCKET }}" + } + } + EOT + + - name: 01-getting-started - Deploy + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'deploy') + shell: bash + run : | + set -x + aws kms delete-alias --alias-name alias/eks/cbci-bp01-${{ env.TF_VAR_suffix }}-eks --region ${{ env.TF_VAR_aws_region }} || echo "Alias alias/eks/cbci-bp01-${{ env.TF_VAR_suffix }}-eks does not exist" + aws kms delete-alias --alias-name alias/eks/cbci-bp01-${{ env.TF_VAR_suffix }} --region ${{ env.TF_VAR_aws_region }} || echo "Alias alias/eks/cbci-bp01-${{ env.TF_VAR_suffix }} does not exist" + CI=true make deploy + aws s3api put-object \ + --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ + --region ${{ env.AWS_REGION_TF_BUCKET }} \ + --key ${{ env.ROOT }}/${{ env.ROOT }}.terraform.output \ + --body blueprints/${{ env.ROOT }}/terraform.output + + - name: 01-getting-started - Validate + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'validate') + shell: bash + run : | + CI=true make validate + + - name: 01-getting-started - Destroy + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'destroy') + shell: bash + run : | + CI=true make destroy + + - name: 01-getting-started - Wipeout + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'wipeout') + shell: bash + run : | + terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy + + - name: 01-getting-started - Role Onboarding + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'onboarding') + env: + TARGET_ROLE: arn:aws:iam::324005994172:role/AWSReservedSSO_infra-admin_256addbf79cfacd1 + shell: bash + run : | + set -x + cd blueprints/${{ env.ROOT }} && eval $(terraform output --raw kubeconfig_export) + kubectl describe configmap aws-auth -n kube-system + eksctl create iamidentitymapping \ + --cluster $(terraform output --raw eks_cluster_name) \ + --region ${{ env.TF_VAR_aws_region }} \ + --arn ${{ env.TARGET_ROLE }} \ + --username k8s-admin-rol \ + --group system:masters + kubectl describe configmap aws-auth -n kube-system + + bp02: + env: + ROOT: 02-at-scale + TF_VAR_hosted_zone: bp02-cd.aws.ps.beescloud.com + STAGES: "wipeout" + needs: + - init + steps: + + - name: Configure AWS Credentials + uses: cloudbees-io/configure-aws-credentials@v1 + with: + aws-region: ${{ env.TF_VAR_aws_region }} + aws-access-key-id: ${{ secrets.AWS_TF_CBCI_EKS_AccessKeyID }} + aws-secret-access-key: ${{ secrets.AWS_TF_CBCI_EKS_SecretAccessKey }} + role-to-assume: ${{ env.AWS_ROLE_TO_ASSUME }} + role-external-id: cloudbees + role-duration-seconds: "3600" + + - name: Checkout code + uses: cloudbees-io/checkout@v1 + + - name: 02-at-scale - Set + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + shell: bash + run : | + cat <> blueprints/${{ env.ROOT }}/.auto.tfvars + ${{ env.TF_AUTO_VARS_FILE }} + dh_reg_secret_auth = { + username = "${{ secrets.AWS_TF_CBCI_EKS_DHUser }}" + password = "${{ secrets.AWS_TF_CBCI_EKS_DHPass }}" + email = "${{ secrets.AWS_TF_CBCI_EKS_DHMail }}" + } + EOT + cat blueprints/${{ env.ROOT }}/.auto.tfvars + cat <> blueprints/${{ env.ROOT }}/backend.tf + terraform { + backend "s3" { + bucket = "${{ env.BUCKET_NAME_TF_STATE }}" + key = "${{ env.ROOT }}/ci.terraform.tfstate" + region = "${{ env.AWS_REGION_TF_BUCKET }}" + } + } + EOT + + - name: 02-at-scale - Deploy + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'deploy') + shell: bash + run : | + set -x + aws kms delete-alias --alias-name alias/eks/cbci-bp02-${{ env.TF_VAR_suffix }}-eks --region ${{ env.TF_VAR_aws_region }} || echo "Alias alias/eks/cbci-bp02-${{ env.TF_VAR_suffix }}-eks does not exist" + aws kms delete-alias --alias-name alias/eks/cbci-bp02-${{ env.TF_VAR_suffix }} --region ${{ env.TF_VAR_aws_region }} || echo "Alias alias/eks/cbci-bp02-${{ env.TF_VAR_suffix }} does not exist" + CI=true make deploy + aws s3api put-object \ + --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ + --region ${{ env.AWS_REGION_TF_BUCKET }} \ + --key ${{ env.ROOT }}/${{ env.ROOT }}.terraform.output \ + --body blueprints/${{ env.ROOT }}/terraform.output + # TODO: Add vault init log to s3 + # cd blueprints/${{ env.ROOT }} && eval $(terraform output --raw kubeconfig_export) + # cd blueprints/${{ env.ROOT }} && eval $(terraform output --raw vault_init) + # aws s3api put-object \ + # --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ + # --region ${{ env.AWS_REGION_TF_BUCKET }} \ + # --key ${{ env.ROOT }}/${{ env.ROOT }}.vault.init.log \ + # --body $(cd blueprints/${{ env.ROOT }} && terraform output --raw vault_init_log_file) || echo "No vault-init.log found" + + - name: 02-at-scale - Validate + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'validate') + shell: bash + run : | + CI=true make validate + + - name: 02-at-scale - Destroy + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'destroy') + shell: bash + run : | + CI=true make destroy + + - name: 02-at-scale - Wipeout + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'wipeout') + shell: bash + run : | + terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy + + - name: 02-at-scale - Role Onboarding + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'onboarding') + env: + TARGET_ROLE: arn:aws:iam::324005994172:role/AWSReservedSSO_infra-admin_256addbf79cfacd1 + shell: bash + run : | + set -x + cd blueprints/${{ env.ROOT }} && eval $(terraform output --raw kubeconfig_export) + kubectl describe configmap aws-auth -n kube-system + eksctl create iamidentitymapping \ + --cluster $(terraform output --raw eks_cluster_name) \ + --region ${{ env.TF_VAR_aws_region }} \ + --arn ${{ env.TARGET_ROLE }} \ + --username k8s-admin-rol \ + --group system:masters + kubectl describe configmap aws-auth -n kube-system diff --git a/.cloudbees/workflows/bp-tf-ci.yaml b/.cloudbees/workflows/bp-tf-ci.yaml index 9e95fa3f..f00812e1 100644 --- a/.cloudbees/workflows/bp-tf-ci.yaml +++ b/.cloudbees/workflows/bp-tf-ci.yaml @@ -1,20 +1,29 @@ # Copyright (c) CloudBees, Inc. +# Stages +# CI: deploy,validate,destroy +# Troubleshooting: deploy,validate,onboarding +# Nuke (Delete Dangling resource): wipeout + apiVersion: automation.cloudbees.io/v1alpha1 kind: workflow name: ci on: - # Enable once Issue #83 is solved + # Enable once Issue #83 is solved (Disable Manual trigger. workflow_dispatch) + # It requires + # pull_request: # branches: # - 'main' workflow_dispatch: env: - AWS_REGION: "us-east-1" - BUCKET_NAME_TF_STATE: "cbci-eks-addon-tf-state-v2" + AWS_REGION_TF_BUCKET: "us-east-1" + BUCKET_NAME_TF_STATE: "cbci-eks-addon-tf-state-ci" AWS_ROLE_TO_ASSUME: "infra-admin-ci" + TF_VAR_suffix: "ci-v11" + TF_VAR_aws_region: "us-west-2" TF_AUTO_VARS_FILE: | tags = { "cb-owner" : "professional-services" @@ -27,7 +36,6 @@ env: email = "ci.user@cloudbees.io" company = "CloudBees Inc." } - suffix = "ci-v11" ci = true jobs: @@ -37,7 +45,7 @@ jobs: - name: Configure AWS Credentials uses: cloudbees-io/configure-aws-credentials@v1 with: - aws-region: ${{ env.AWS_REGION }} + aws-region: ${{ env.AWS_REGION_TF_BUCKET }} aws-access-key-id: ${{ secrets.AWS_TF_CBCI_EKS_AccessKeyID }} aws-secret-access-key: ${{ secrets.AWS_TF_CBCI_EKS_SecretAccessKey }} role-to-assume: ${{ env.AWS_ROLE_TO_ASSUME }} @@ -49,13 +57,16 @@ jobs: uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest shell: bash run: | + set -x aws s3api create-bucket \ --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ - --region ${{ env.AWS_REGION }} || echo "Bucket ${{ env.BUCKET_NAME_TF_STATE }} already exists" + --region ${{ env.AWS_REGION_TF_BUCKET }} || echo "Bucket ${{ env.BUCKET_NAME_TF_STATE }} already exists" bp01: env: - CLEAN_UP: "false" + ROOT: 01-getting-started + TF_VAR_hosted_zone: bp01-ci.aws.ps.beescloud.com + STAGES: "deploy,validate,destroy" needs: - init steps: @@ -63,7 +74,7 @@ jobs: - name: Configure AWS Credentials uses: cloudbees-io/configure-aws-credentials@v1 with: - aws-region: ${{ env.AWS_REGION }} + aws-region: ${{ env.TF_VAR_aws_region }} aws-access-key-id: ${{ secrets.AWS_TF_CBCI_EKS_AccessKeyID }} aws-secret-access-key: ${{ secrets.AWS_TF_CBCI_EKS_SecretAccessKey }} role-to-assume: ${{ env.AWS_ROLE_TO_ASSUME }} @@ -73,48 +84,83 @@ jobs: - name: Checkout code uses: cloudbees-io/checkout@v1 - - name: 01-getting-started - Deploy + - name: 01-getting-started - Set uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest - env: - ROOT: 01-getting-started - TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com shell: bash run : | cat <> blueprints/${{ env.ROOT }}/.auto.tfvars ${{ env.TF_AUTO_VARS_FILE }} EOT + cat blueprints/${{ env.ROOT }}/.auto.tfvars cat <> blueprints/${{ env.ROOT }}/backend.tf terraform { backend "s3" { bucket = "${{ env.BUCKET_NAME_TF_STATE }}" key = "${{ env.ROOT }}/ci.terraform.tfstate" - region = "${{ env.AWS_REGION }}" + region = "${{ env.AWS_REGION_TF_BUCKET }}" } } EOT - [ "${{ env.CLEAN_UP }}" = "true" ] && echo "Skipping... Clean up mode." || CI=true make deploy + + - name: 01-getting-started - Deploy + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'deploy') + shell: bash + run : | + set -x + aws kms delete-alias --alias-name alias/eks/cbci-bp01-${{ env.TF_VAR_suffix }}-eks --region ${{ env.TF_VAR_aws_region }} || echo "Alias alias/eks/cbci-bp01-${{ env.TF_VAR_suffix }}-eks does not exist" + aws kms delete-alias --alias-name alias/eks/cbci-bp01-${{ env.TF_VAR_suffix }} --region ${{ env.TF_VAR_aws_region }} || echo "Alias alias/eks/cbci-bp01-${{ env.TF_VAR_suffix }} does not exist" + CI=true make deploy + aws s3api put-object \ + --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ + --region ${{ env.AWS_REGION_TF_BUCKET }} \ + --key ${{ env.ROOT }}/${{ env.ROOT }}.terraform.output \ + --body blueprints/${{ env.ROOT }}/terraform.output - name: 01-getting-started - Validate uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest - env: - ROOT: 01-getting-started + if: contains(env.STAGES, 'validate') shell: bash run : | - [ "${{ env.CLEAN_UP }}" = "true" ] && echo "Skipping... Clean up mode." || CI=true make validate + CI=true make validate - name: 01-getting-started - Destroy uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'destroy') + shell: bash + run : | + CI=true make destroy + + - name: 01-getting-started - Wipeout + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'wipeout') + shell: bash + run : | + terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy + + - name: 01-getting-started - Role Onboarding + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'onboarding') env: - ROOT: 01-getting-started - TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com + TARGET_ROLE: arn:aws:iam::324005994172:role/AWSReservedSSO_infra-admin_256addbf79cfacd1 shell: bash run : | - [ "${{ env.CLEAN_UP }}" = "true" ] && terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy \ - || CI=true make destroy + set -x + cd blueprints/${{ env.ROOT }} && eval $(terraform output --raw kubeconfig_export) + kubectl describe configmap aws-auth -n kube-system + eksctl create iamidentitymapping \ + --cluster $(terraform output --raw eks_cluster_name) \ + --region ${{ env.TF_VAR_aws_region }} \ + --arn ${{ env.TARGET_ROLE }} \ + --username k8s-admin-rol \ + --group system:masters + kubectl describe configmap aws-auth -n kube-system bp02: env: - CLEAN_UP: "false" + ROOT: 02-at-scale + TF_VAR_hosted_zone: bp02-ci.aws.ps.beescloud.com + STAGES: "deploy,validate,destroy" needs: - init steps: @@ -122,7 +168,7 @@ jobs: - name: Configure AWS Credentials uses: cloudbees-io/configure-aws-credentials@v1 with: - aws-region: ${{ env.AWS_REGION }} + aws-region: ${{ env.TF_VAR_aws_region }} aws-access-key-id: ${{ secrets.AWS_TF_CBCI_EKS_AccessKeyID }} aws-secret-access-key: ${{ secrets.AWS_TF_CBCI_EKS_SecretAccessKey }} role-to-assume: ${{ env.AWS_ROLE_TO_ASSUME }} @@ -132,43 +178,79 @@ jobs: - name: Checkout code uses: cloudbees-io/checkout@v1 - - name: 02-at-scale - Deploy + - name: 02-at-scale - Set uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest - env: - ROOT: 02-at-scale - TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com shell: bash run : | cat <> blueprints/${{ env.ROOT }}/.auto.tfvars ${{ env.TF_AUTO_VARS_FILE }} - gh_user = "exampleUser" - gh_token = "ExampleToken1234" + dh_reg_secret_auth = { + username = "${{ secrets.AWS_TF_CBCI_EKS_DHUser }}" + password = "${{ secrets.AWS_TF_CBCI_EKS_DHPass }}" + email = "${{ secrets.AWS_TF_CBCI_EKS_DHMail }}" + } EOT + cat blueprints/${{ env.ROOT }}/.auto.tfvars cat <> blueprints/${{ env.ROOT }}/backend.tf terraform { backend "s3" { bucket = "${{ env.BUCKET_NAME_TF_STATE }}" key = "${{ env.ROOT }}/ci.terraform.tfstate" - region = "${{ env.AWS_REGION }}" + region = "${{ env.AWS_REGION_TF_BUCKET }}" } } EOT - [ "${{ env.CLEAN_UP }}" = "true" ] && echo "Skipping... Clean up mode." || CI=true make deploy + + - name: 02-at-scale - Deploy + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'deploy') + shell: bash + run : | + set -x + aws kms delete-alias --alias-name alias/eks/cbci-bp02-${{ env.TF_VAR_suffix }}-eks --region ${{ env.TF_VAR_aws_region }} || echo "Alias alias/eks/cbci-bp02-${{ env.TF_VAR_suffix }}-eks does not exist" + aws kms delete-alias --alias-name alias/eks/cbci-bp02-${{ env.TF_VAR_suffix }} --region ${{ env.TF_VAR_aws_region }} || echo "Alias alias/eks/cbci-bp02-${{ env.TF_VAR_suffix }} does not exist" + CI=true make deploy + aws s3api put-object \ + --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ + --region ${{ env.AWS_REGION_TF_BUCKET }} \ + --key ${{ env.ROOT }}/${{ env.ROOT }}.terraform.output \ + --body blueprints/${{ env.ROOT }}/terraform.output - name: 02-at-scale - Validate uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest - env: - ROOT: 02-at-scale + if: contains(env.STAGES, 'validate') shell: bash run : | - [ "${{ env.CLEAN_UP }}" = "true" ] && echo "Skipping... Clean up mode." || CI=true make validate + CI=true make validate - name: 02-at-scale - Destroy uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'destroy') + shell: bash + run : | + CI=true make destroy + + - name: 02-at-scale - Wipeout + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'wipeout') + shell: bash + run : | + terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy + + - name: 02-at-scale - Role Onboarding + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'onboarding') env: - ROOT: 02-at-scale - TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com + TARGET_ROLE: arn:aws:iam::324005994172:role/AWSReservedSSO_infra-admin_256addbf79cfacd1 shell: bash run : | - [ "${{ env.CLEAN_UP }}" = "true" ] && terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy \ - || CI=true make destroy + set -x + cd blueprints/${{ env.ROOT }} && eval $(terraform output --raw kubeconfig_export) + kubectl describe configmap aws-auth -n kube-system + eksctl create iamidentitymapping \ + --cluster $(terraform output --raw eks_cluster_name) \ + --region ${{ env.TF_VAR_aws_region }} \ + --arn ${{ env.TARGET_ROLE }} \ + --username k8s-admin-rol \ + --group system:masters + kubectl describe configmap aws-auth -n kube-system diff --git a/.docker/agent/agent.root.Dockerfile b/.docker/agent/agent.root.Dockerfile index 3cf92e30..010cb24f 100644 --- a/.docker/agent/agent.root.Dockerfile +++ b/.docker/agent/agent.root.Dockerfile @@ -7,6 +7,7 @@ FROM alpine:3.19.0 ENV TF_VERSION=1.6.6 \ KUBECTL_VERSION=1.29.0 \ VELERO_VERSION=1.13.0 \ + EKSCTL_VERSION=0.188.0 \ ARCH=amd64 RUN apk add --update --no-cache \ @@ -33,3 +34,8 @@ RUN curl -sLO https://github.com/vmware-tanzu/velero/releases/download/v${VELERO mv velero-v${VELERO_VERSION}-linux-${ARCH}/velero /usr/bin/velero && \ chmod +x /usr/bin/velero && \ rm velero-v${VELERO_VERSION}-linux-${ARCH}.tar.gz + +RUN curl -sLO "https://github.com/weaveworks/eksctl/releases/download/v${EKSCTL_VERSION}/eksctl_Linux_${ARCH}.tar.gz" && \ + tar -xzf eksctl_Linux_${ARCH}.tar.gz -C /usr/bin && \ + chmod +x /usr/bin/eksctl && \ + rm eksctl_Linux_${ARCH}.tar.gz diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 876bb7c7..ef123951 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -23,7 +23,7 @@ repos: - id: check-vcs-permalinks - repo: https://github.com/antonbabenko/pre-commit-terraform - rev: v1.81.0 + rev: v1.92.0 hooks: - id: terraform_fmt name: Format Terraform Configuration diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index ab816a58..8c49e7ad 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -5,7 +5,7 @@ This document provides guidelines for contributing to the CloudBees CI add-on fo ## Design principles - It follows the same approach as the [Terraform AWS EKS Blueprints for Terraform Patterns](https://aws-ia.github.io/terraform-aws-eks-blueprints/). -- The blueprints use a monorepo configuration; the required external repositories for the configuration are included within the same repository. For example, the [At scale blueprint](blueprints/02-at-scale) contains the repository for CasC bundles. +- The blueprints use a monorepo configuration where additional configuration repositories are included within the same project. This approach is managed using [Spare Checkouts](https://github.blog/open-source/git/bring-your-monorepo-down-to-size-with-sparse-checkout/). For example, the [At scale blueprint](blueprints/02-at-scale) contains the repository for CasC bundles and shared libraries. - Submit pull requests against the `develop` branch and release from the `main` branch. - `main` branch: - It is the stable branch and is used for releases. diff --git a/Makefile b/Makefile index 0746730f..5af64978 100644 --- a/Makefile +++ b/Makefile @@ -4,8 +4,8 @@ MAKEFLAGS += --no-print-directory CI ?= false BP_AGENT_USER := bp-agent MKFILEDIR := $(abspath $(dir $(lastword $(MAKEFILE_LIST)))) -CASC_ENDPOINT ?= https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git -CASC_BRANCH ?= main +CBCI_REPO ?= https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git +CBCI_BRANCH ?= main NUKE_DRY_RUN ?= true define helpers @@ -96,11 +96,11 @@ set-kube-env: agentCheck @$(call helpers,set-kube-env) @$(call helpers,INFO "Setting Kube environment finished succesfully.") -.PHONY: set-casc-branch -set-casc-location: ## Update Casc bundle location to the endpoint and branch passed as parameter. Example: CASC_ENDPOINT=https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git CASC_BRANCH=new-feat make set-casc-location -set-casc-location: agentCheck guard-CASC_ENDPOINT guard-CASC_BRANCH - @$(call helpers,set-casc-location $(CASC_ENDPOINT) $(CASC_BRANCH)) - @$(call helpers,INFO "Setting new Casc location to $(CASC_ENDPOINT) $(CASC_BRANCH) finished succesfully.") +.PHONY: set-cbci-location +set-cbci-location: ## Update cbci folder location per parameter. Example: CBCI_REPO=https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git CBCI_BRANCH=new-feat make set-cbci-location +set-cbci-location: agentCheck guard-CBCI_REPO guard-CBCI_BRANCH + @$(call helpers,set-cbci-location $(CBCI_REPO) $(CBCI_BRANCH)) + @$(call helpers,INFO "Setting new Casc location to $(CBCI_REPO) $(CBCI_BRANCH) finished succesfully.") .PHONY: run-aws-nuke run-aws-nuke: ## Run aws nuke by https://github.com/rebuy-de/aws-nuke. Example: NUKE_DRY_RUN=true make run-aws-nuke diff --git a/README.md b/README.md index 0ced2be1..1359fb05 100644 --- a/README.md +++ b/README.md @@ -19,8 +19,8 @@ The CloudBees CI [AWS partner add-on](https://aws-ia.github.io/terraform-aws-eks-blueprints-addons/main/aws-partner-addons/) streamlines the adoption and experimentation of CloudBees CI enterprise features by: -- Encapsulating the deployment of [CloudBees CI on modern platforms in AWS EKS](https://docs.cloudbees.com/docs/cloudbees-ci/latest/eks-install-guide/installing-eks-using-helm#_configuring_your_environment) into a Terraform module. -- Providing a series of [blueprints](https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon/tree/main/blueprints) that implement the CloudBees CI add-on module for use with [Amazon EKS blueprints for Terraform](https://aws-ia.github.io/terraform-aws-eks-blueprints-addons/main/), which are aligned with the [EKS Best Practices Guides](https://aws.github.io/aws-eks-best-practices/). +- Encapsulating the deployment of [CloudBees CI on modern platforms in AWS EKS](https://docs.cloudbees.com/docs/cloudbees-ci/latest/eks-install-guide/installing-eks-using-helm#_configuring_your_environment) and additional Kubernetes resources into a Terraform module. +- Providing a series of opinionated [blueprints](https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon/tree/main/blueprints) that implement the CloudBees CI add-on module for use with [Amazon EKS blueprints for Terraform](https://aws-ia.github.io/terraform-aws-eks-blueprints-addons/main/), which are aligned with the [EKS Best Practices Guides](https://aws.github.io/aws-eks-best-practices/). ## Usage @@ -95,10 +95,13 @@ The CloudBees CI add-on uses `helms release` for its resources definition, makin | cert_arn | AWS Certificate Manager (ACM) certificate for Amazon Resource Names (ARN). | `string` | n/a | yes | | hosted_zone | Amazon Route 53 hosted zone name. | `string` | n/a | yes | | trial_license | CloudBees CI trial license details for evaluation. | `map(string)` | n/a | yes | -| create_k8s_secrets | Create the Kubernetes cbci-secrets. It can be consumed by CloudBees CasC for the operations center. | `bool` | `false` | no | +| casc_secrets_file | Secrets .yml file path containing the names: values secrets. It is required when create_casc_secrets is enabled. | `string` | `"secrets-values.yml"` | no | +| create_casc_secrets | Create a Kubernetes basic secret for CloudBees CasC (cbci-sec-casc) and mount it into the operations center (/var/run/secrets/cbci). | `bool` | `false` | no | +| create_reg_secret | Create a Kubernetes dockerconfigjson secret for container registry authentication (cbci-sec-reg) for CI builds agents. | `bool` | `false` | no | | helm_config | CloudBees CI Helm chart configuration. | `any` | 
{
  "values": [
    ""
  ]
}
| no | -| k8s_secrets | Secrets .yml file as a string containing the names:values secrets. It is required when create_k8s_secrets is enabled. | `string` | `"secrets-values.yml"` | no | | prometheus_target | Creates a service monitor to discover the CloudBees CI Prometheus target dynamically. It is designed to be enabled with the AWS EKS Terraform Addon Kube Prometheus Stack. | `bool` | `false` | no | +| reg_secret_auth | Registry server authentication details for cbci-sec-reg secret. It is required when create_reg_secret is enabled. | `map(string)` | 
{
  "email": "foo.bar@acme.com",
  "password": "changeme1234",
  "server": "my-registry.acme:5000",
  "username": "foo"
}
| no | +| reg_secret_ns | Agent namespace to allocate cbci-sec-reg secret. It is required when create_reg_secret is enabled. | `string` | `"cbci"` | no | ### Outputs @@ -111,7 +114,8 @@ The CloudBees CI add-on uses `helms release` for its resources definition, makin | cbci_oc_ing | Operations center Ingress for the CloudBees CI add-on. | | cbci_oc_pod | Operations center pod for the CloudBees CI add-on. | | cbci_oc_url | Operations center URL for the CloudBees CI add-on using a subdomain and certificates. | -| cbci_secrets | Optional. Kubernetes secrets name for CloudBees CI. | +| cbci_sec_casc | Optional. Kubernetes secrets name for CloudBees CI Casc. | +| cbci_sec_registry | Optional. Kubernetes secrets name for CloudBees CI agents to autheticate to registry. | | merged_helm_config | (merged) Helm configuration for CloudBees CI. | diff --git a/blueprints/.k8s.env b/blueprints/.k8s.env index 80e44453..f3bab735 100644 --- a/blueprints/.k8s.env +++ b/blueprints/.k8s.env @@ -3,6 +3,6 @@ # K8s support: https://docs.cloudbees.com/docs/cloudbees-common/latest/supported-platforms/cloudbees-ci-cloud#_kubernetes vK8=1.28 # CloudBees CI Chart versions: https://artifacthub.io/packages/helm/cloudbees/cloudbees-core/ -vCBCI_Helm=3.18072.0+dc5abfae7856 +vCBCI_Helm=3.18306.0+b5ad27c80a6b # AWS Terraform EKS Blueprint Addons Module https://github.com/aws-ia/terraform-aws-eks-blueprints-addons/releases vEKSBpAddonsTFMod=1.15.1 diff --git a/blueprints/01-getting-started/README.md b/blueprints/01-getting-started/README.md index 23e8a1c1..0c11a238 100644 --- a/blueprints/01-getting-started/README.md +++ b/blueprints/01-getting-started/README.md @@ -19,7 +19,7 @@ This blueprint presents the minimum setup to run CloudBees CI on Amazon EKS; one - Instance type: [Graviton Processor](https://aws.amazon.com/ec2/graviton/) family. - Amazon Machine Image (AMI) type: [Amazon EKS-Optimized Amazon Linux 2023](https://aws.amazon.com/blogs/containers/amazon-eks-optimized-amazon-linux-2023-amis-now-available/) -### Kubernetes cluster +### Workloads ![K8sApps](img/getting-started.k8s.drawio.svg) @@ -51,6 +51,7 @@ This blueprint presents the minimum setup to run CloudBees CI on Amazon EKS; one | cbci_oc_pod | Operations center pod for the CloudBees CI add-on. | | cbci_oc_url | URL of the CloudBees CI operations center for the CloudBees CI add-on. | | eks_cluster_arn | Amazon EKS cluster ARN. | +| eks_cluster_name | Amazon EKS cluster Name. | | kubeconfig_add | Add kubeconfig to your local configuration to access the Kubernetes API. | | kubeconfig_export | Export the KUBECONFIG environment variable to access the Kubernetes API. | | vpc_arn | VPC ID. | diff --git a/blueprints/01-getting-started/img/getting-started.k8s.drawio.svg b/blueprints/01-getting-started/img/getting-started.k8s.drawio.svg index 2996fec8..2f732413 100644 --- a/blueprints/01-getting-started/img/getting-started.k8s.drawio.svg +++ b/blueprints/01-getting-started/img/getting-started.k8s.drawio.svg @@ -1,4 +1,4 @@ - + @@ -102,12 +102,12 @@ - - + + -
+
Amazon Route 53 @@ -117,14 +117,14 @@
- - Amazon Route... + + Amazon Rout... - - - + + + @@ -215,12 +215,12 @@ - - + + -
+
@@ -232,14 +232,19 @@
- + cbci - - - + + + + + + cjoc + + diff --git a/blueprints/01-getting-started/main.tf b/blueprints/01-getting-started/main.tf index d1a18a51..5fc4a90b 100644 --- a/blueprints/01-getting-started/main.tf +++ b/blueprints/01-getting-started/main.tf @@ -28,11 +28,12 @@ locals { # EKS: Add-ons ################################################################################ -# CloudBees CI Add-ons +# CloudBees CI Add-on module "eks_blueprints_addon_cbci" { - source = "cloudbees/cloudbees-ci-eks-addon/aws" - version = ">= 3.18072.0" + #source = "cloudbees/cloudbees-ci-eks-addon/aws" + #version = ">= 3.18072.0" + source = "../../" depends_on = [module.eks_blueprints_addons] diff --git a/blueprints/01-getting-started/outputs.tf b/blueprints/01-getting-started/outputs.tf index a74f5b03..971a3474 100644 --- a/blueprints/01-getting-started/outputs.tf +++ b/blueprints/01-getting-started/outputs.tf @@ -1,4 +1,3 @@ - output "kubeconfig_export" { description = "Export the KUBECONFIG environment variable to access the Kubernetes API." value = "export KUBECONFIG=${local.kubeconfig_file_path}" @@ -64,3 +63,8 @@ output "eks_cluster_arn" { description = "Amazon EKS cluster ARN." value = module.eks.cluster_arn } + +output "eks_cluster_name" { + description = "Amazon EKS cluster Name." + value = module.eks.cluster_name +} diff --git a/blueprints/02-at-scale/.auto.tfvars.example b/blueprints/02-at-scale/.auto.tfvars.example index 6aacc423..2444aca2 100644 --- a/blueprints/02-at-scale/.auto.tfvars.example +++ b/blueprints/02-at-scale/.auto.tfvars.example @@ -7,8 +7,11 @@ trial_license = { # Required. CloudBees CI Trial license details for evaluation. company = "Acme Inc." } -gh_user = "exampleUser" # Required. Default values can be used for demo. -gh_token = "ExampleToken1234" # Required. Default values can be used for demo. +dh_reg_secret_auth = { # Required. + username = "foo" + password = "d0ckerPass12" + email = "foo.bar@acme.com" +} # tags = { # Optional. Tags for the resources created. Default set to empty. Shared among all. # "cb-owner" : "team-services" diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index c1594163..286f4ce8 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -25,11 +25,12 @@ Once you have familiarized yourself with [CloudBees CI blueprint add-on: Get sta | [Helm Openldap](https://github.com/jp-gouin/helm-openldap/tree/master) | LDAP server for Kubernetes. | | [AWS Node Termination Handler](https://github.com/aws/aws-node-termination-handler) | Gracefully handles EC2 instance shutdown within Kubernetes. Note that this add-on is not compatible with managed instance groups. For more information, refer to [issue #23](https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon/issues/23). | | [Grafana Tempo](https://grafana.com/oss/tempo/) | Provides backend tracing for [Jenkins OpenTelemetry](https://plugins.jenkins.io/opentelemetry/). | + | [Hashicorp Vault](https://github.com/hashicorp/vault-helm) | Secrets management system that is integrated via [CloudBees HashiCorp Vault Plugin](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-secure-guide/hashicorp-vault-plugin). | -- Cloudbees CI uses [Configuration as Code (CasC)](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-oc/casc-intro) (refer to the [casc](casc) folder) to enable [exciting new features for streamlined DevOps](https://www.cloudbees.com/blog/cloudbees-ci-exciting-new-features-for-streamlined-devops) and other enterprise features, such as [CloudBees CI hibernation](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/managing-controllers#_hibernation_in_managed_masters). +- Cloudbees CI uses [Configuration as Code (CasC)](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-oc/casc-intro) (refer to the [casc](cbci/casc) folder) to enable [exciting new features for streamlined DevOps](https://www.cloudbees.com/blog/cloudbees-ci-exciting-new-features-for-streamlined-devops) and other enterprise features, such as [CloudBees CI hibernation](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/managing-controllers#hibernation-managed-controllers). - The operations center is using the [CasC Bundle Retriever](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-oc/bundle-retrieval-scm). - Managed controller configurations are managed from the operations center using [source control management (SCM)](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-controller/add-bundle#_adding_casc_bundles_from_an_scm_tool). - - The managed controllers are using [CasC bundle inheritance](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-controller/advanced#_configuring_bundle_inheritance_with_casc) (refer to the [parent](casc/mc/parent) folder). This "parent" bundle is inherited by two types of "child" controller bundles: `ha` and `none-ha`, to accommodate [considerations about HA controllers](https://docs.cloudbees.com/docs/cloudbees-ci/latest/ha/ha-considerations). + - The managed controllers are using [CasC bundle inheritance](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-controller/advanced#_configuring_bundle_inheritance_with_casc) (refer to the [parent](cbci/casc/mc/parent) folder). This "parent" bundle is inherited by two types of "child" controller bundles: `ha` and `none-ha`, to accommodate [considerations about HA controllers](https://docs.cloudbees.com/docs/cloudbees-ci/latest/ha/ha-considerations). > [!TIP] > A [resource group](https://docs.aws.amazon.com/ARG/latest/userguide/resource-groups.html) is also included, to get a full list of all resources created by this blueprint. @@ -38,20 +39,21 @@ Once you have familiarized yourself with [CloudBees CI blueprint add-on: Get sta This blueprint divides scalable node groups for different types of workloads: -- Shared node group services: For common/shared workloads using [Amazon EKS-Optimized Amazon Linux 2023](https://aws.amazon.com/blogs/containers/amazon-eks-optimized-amazon-linux-2023-amis-now-available/) Amazon Machine Image (AMI) type. +- Shared node group services (role: `shared`): For common/shared workloads using [Amazon EKS-Optimized Amazon Linux 2023](https://aws.amazon.com/blogs/containers/amazon-eks-optimized-amazon-linux-2023-amis-now-available/) Amazon Machine Image (AMI) type. - CloudBees CI node groups: - - Services instance type: [AWS Graviton Processor](https://aws.amazon.com/ec2/graviton/) and [Bottlerocket OS](https://aws.amazon.com/bottlerocket/) AMI type. - - It uses an [instance profile](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html) for operating with AWS Services. However, the recommended options are explained in [#56](https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon/issues/56). - - Ephemeral agents: - - Linux: [AWS Graviton Processor](https://aws.amazon.com/ec2/graviton/) and [Bottlerocket OS](https://aws.amazon.com/bottlerocket/) AMI type and includes on-demand and Spot capacity types. The Spot agent node groups follow the principles described in [Building for Cost Optimization and Resilience for EKS with Spot Instances](https://aws.amazon.com/blogs/compute/cost-optimization-and-resilience-eks-with-spot-instances/). - - Windows: Windows 2019 AMI type. + - CI services (role: `cb-apps`): + - Services instance type: [AWS Graviton Processor](https://aws.amazon.com/ec2/graviton/) and [Bottlerocket OS](https://aws.amazon.com/bottlerocket/) AMI type. + - It uses an [instance profile](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html) for operating with AWS services permissions (for example, S3 buckets). However, the recommended options are explained in [Issue 56](https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon/issues/56). + - CI agents (ephemeral): + - Linux: [AWS Graviton Processor](https://aws.amazon.com/ec2/graviton/) and [Bottlerocket OS](https://aws.amazon.com/bottlerocket/) AMI type and includes on-demand (role: `build-linux`) and Spot (role: `build-linux-spot`) capacity types. The Spot agent node groups follow the principles described in [Building for Cost Optimization and Resilience for EKS with Spot Instances](https://aws.amazon.com/blogs/compute/cost-optimization-and-resilience-eks-with-spot-instances/). + - Windows (role: `build-windows`): Windows 2019 AMI type. -> [!NOTE] -> If your user credentials do not include an AWS identity and IAM permissions, the credentials validation from the CloudBees CI UI will fail. +> [!IMPORTANT] +> The launch time for Linux containers is faster than Windows containers. This can be improved by using a cache container image strategy. Refer to [Speeding up Windows container launch times with EC2 Image builder and image cache strategy](https://aws.amazon.com/blogs/containers/speeding-up-windows-container-launch-times-with-ec2-image-builder-and-image-cache-strategy/) and more about [Windows Container Best Practices](https://aws.github.io/aws-eks-best-practices/windows/docs/ami/)). Another potential alternative is to use Windows VMs with a [shared agent](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/shared-agents). ![Architecture](img/at-scale.architect.drawio.svg) -### Kubernetes cluster +### Workloads ![K8sApps](img/at-scale.k8s.drawio.svg) @@ -66,8 +68,7 @@ This blueprint divides scalable node groups for different types of workloads: | trial_license | CloudBees CI trial license details for evaluation. | `map(string)` | n/a | yes | | aws_region | AWS region to deploy resources to. It requires at minimun 3 AZs. | `string` | `"us-west-2"` | no | | ci | Running in a CI service versus running locally. False when running locally, true when running in a CI service. | `bool` | `false` | no | -| gh_token | GitHub token for the CloudBees operations center credential GH-User-token, that is created via CloudBees CasC. | `string` | `"ExampleToken1234"` | no | -| gh_user | GitHub user for the CloudBees operations center credential GH-User-token, that is created via CloudBees CasC. | `string` | `"exampleUser"` | no | +| dh_reg_secret_auth | Docker Hub Registry server authentication details for cbci-sec-reg secret. | `map(string)` | 
{
  "email": "foo.bar@acme.com",
  "password": "changeme1234",
  "username": "foo"
}
| no | | suffix | Unique suffix to assign to all resources. When adding the suffix, changes are required in CloudBees CI for the validation phase. | `string` | `""` | no | | tags | Tags to apply to resources. | `map(string)` | `{}` | no | @@ -79,9 +80,10 @@ This blueprint divides scalable node groups for different types of workloads: | aws_backup_efs_protected_resource | AWS description for the Amazon EFS drive that is used to back up protected resources. | | aws_logstreams_fluentbit | AWS CloudWatch log streams from Fluent Bit. | | cbci_agent_linuxtempl_events | Retrieves a list of events related to Linux template agents. | +| cbci_agent_sec_reg | Retrieves the container registry secret deployed in the agents namespace. | | cbci_agent_windowstempl_events | Retrieves a list of events related to Windows template agents. | | cbci_agents_pods | Retrieves a list of agent pods running in the agents namespace. | -| cbci_controller_b_ws_cache_build | team-b hibernation monitor endpoint to the build workspace cache. It expects CBCI_ADMIN_TOKEN as the environment variable. | +| cbci_controller_b_s3_build | team-b hibernation monitor endpoint to the build s3-WScacheAndArtifacts. It expects CBCI_ADMIN_TOKEN as the environment variable. | | cbci_controller_c_hpa | team-c horizontal pod autoscaling. | | cbci_controller_c_windows_node_build | team-c hibernation monitor endpoint to the Windows build nodes. It expects CBCI_ADMIN_TOKEN as the environment variable. | | cbci_controllers_pods | Operations center pod for the CloudBees CI add-on. | @@ -98,6 +100,7 @@ This blueprint divides scalable node groups for different types of workloads: | efs_access_points | Amazon EFS access points. | | efs_arn | Amazon EFS ARN. | | eks_cluster_arn | Amazon EKS cluster ARN. | +| eks_cluster_name | Amazon EKS cluster Name. | | global_password | Random string that is used as the global password. | | grafana_dashboard | Provides access to Grafana dashboards. | | kubeconfig_add | Add kubeconfig to the local configuration to access the Kubernetes API. | @@ -107,12 +110,23 @@ This blueprint divides scalable node groups for different types of workloads: | s3_cbci_arn | CloudBees CI Amazon S3 bucket ARN. | | s3_cbci_name | CloudBees CI Amazon S3 bucket name. It is required by CloudBees CI for workspace caching and artifact management. | | s3_list_objects | Recursively lists all objects stored in the Amazon S3 bucket. | +| vault_configure | Configure Vault with initial secrets and creates approle for integration with CloudBees CI (role-id and secret-id). It requires unseal keys and the root token from the vault_init output. | +| vault_dashboard | Provides access to Hashicorp Vault dashboard. It requires the root token from the vault_init output. | +| vault_init | Inicialization of Vault Service. | +| vault_init_log_file | Vault Inicialization log file. | | velero_backup_on_demand | Takes an on-demand Velero backup from the schedule for the selected controller that is using block storage. | | velero_backup_schedule | Creates a Velero backup schedule for the selected controller that is using block storage, and then deletes the existing schedule, if it exists. | | velero_restore | Restores the selected controller that is using block storage from a backup. | | vpc_arn | VPC ID. | +## Prerequisites + +This blueprint uses [DockerHub](https://hub.docker.com/) as a container registry service. Note that an existing DockerHub account is required (username, password, and email). + +> [!TIP] +> Use `docker login` to validate username and password. + ## Deploy When preparing to deploy, you must complete the following steps: @@ -144,16 +158,15 @@ Once the resources have been created, a `kubeconfig` file is created in the [/k8 1. Complete the steps to [validate CloudBees CI](../01-getting-started/README.md#cloudbees-ci), if you have not done so already. -2. Authentication in this blueprint is based on LDAP using the `cn` user (available in [k8s/openldap-stack-values.yml](./k8s/openldap-stack-values.yml)) and the global password. The authorization level defines a set of permissions configured using [RBAC](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-secure-guide/rbac). Additionally, the operations center and controller use [single sign-on (SS0)](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-secure-guide/using-sso). Issue the following command to retrieve the global password: +2. Authentication in this blueprint is based on LDAP using the `cn` user (available in [k8s/openldap-stack-values.yml](./k8s/openldap-stack-values.yml)) and the global password. The authorization level defines a set of permissions configured using [RBAC](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-secure-guide/rbac). Additionally, the operations center and controller use [single sign-on (SS0)](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-secure-guide/using-sso), including a [fallback mechanism](https://docs.cloudbees.com/docs/cloudbees-ci-kb/latest/operations-center/how-ldap-plugin-works-on-cjoc-sso-context) that is enabled by default. Issue the following command to retrieve the global password (valid for all users): ```sh eval $(terraform output --raw global_password) ``` -> [!NOTE] -> There are differences in CloudBees CI permissions and folder restrictions when signed in as a user of the Admin group versus the Development group. For example, only Admin users have access to the agent validation jobs. + There are differences in CloudBees CI permissions and folder restrictions when signed in as a user of the Admin group versus the Development group. For example, only Admin users have access to the agent validation jobs. -1. CasC is enabled for the [operations center](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-oc/) (`cjoc`) and [controllers](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-controller/) (`team-b` and `team-c-ha`). `team-a` is not using CasC, to illustrate the difference between the two approaches. Issue the following command to verify that all controllers are in a `Running` state: +3. CasC is enabled for the [operations center](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-oc/) (`cjoc`) and [controllers](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-controller/) (`team-b` and `team-c-ha`). `team-a` is not using CasC, to illustrate the difference between the two approaches. Issue the following command to verify that all controllers are running: ```sh eval $(terraform output --raw cbci_controllers_pods) @@ -161,13 +174,77 @@ Once the resources have been created, a `kubeconfig` file is created in the [/k8 If successful, it should indicate that 2 replicas are running for `team-c-ha` since [CloudBees CI HA/HS](https://docs.cloudbees.com/docs/cloudbees-ci/latest/ha-install-guide/) is enabled on this controller. -2. Issue the following command to verify that horizontal pod autoscaling is enabled for `team-c-ha`: +4. Issue the following command to verify that horizontal pod autoscaling is enabled for `team-c-ha`: ```sh eval $(terraform output --raw cbci_controller_c_hpa) ``` -3. Issue the following command to retrieve an [API token](https://docs.cloudbees.com/docs/cloudbees-ci-api/latest/api-authentication) for the `admin_cbci_a` user with the correct permissions for the required actions: +#### Secrets management + +##### Kubernetes secret + +This blueprint Kubernetes secrets for different purposes. + +> [!NOTE] +> - Beyond the CloudBees CI add-on (used for demo purposes), Kubernetes secrets can be managed via [External Secret Operators](https://aws-ia.github.io/terraform-aws-eks-blueprints-addons/main/addons/external-secrets/). +> - Kubernetes secrets could be also be retrived as Jenkins Credentials via using the [Kubernetes Credentials Provider plugin](https://jenkinsci.github.io/kubernetes-credentials-provider-plugin/). + +###### CasC secrets + +The secrets key/value file defined in [k8s/secrets-values.yml](k8s/secrets-values.yml) is converted into a Kubernetes secret (`cbci-sec-casc`) and mounted into `/run/secrets/` for the operations center and controllers to be consumed via CloudBees CasC. Refer to [Configuration as Code - Handling Secrets - Kubernetes Secrets](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets) for more information. + +###### Container registry secrets + +DockerHub authentication is stored as Kubernetes secrets (`cbci-agent-sec-reg`) and mounted to [Kaniko agent containers](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/using-kaniko) to build and push images to this registry. The secret is created using the `dh_reg_secret_auth` variable. + +```sh + eval $(terraform output --raw cbci_agent_sec_reg) +``` + +> [!NOTE] +> ECR authentication is done via instance profile connected to `build-linux-spot` Node pools. + +##### HashiCorp Vault + +HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in this blueprint. + +1. Initialize Hashicorp Vault. Keep in a safe place Admin Token and Unseal Keys (saved in `k8s/vault-init.log`). + + ```sh + eval $(terraform output --raw vault_init) + ``` + +2. Run the configure Hashicorp Vault script. It configures Vault with initial secrets and creates `approle` for integration with CloudBees CI (role-id and secret-id) + + ```sh + eval $(terraform output --raw vault_configure) + ``` + +3. Access the HashiCorp Vault UI by issuing the following command. Enter the root token to log in from the _step 1_. + + ```sh + eval $(terraform output --raw vault_dashboard) + ``` + + If successful, the Vault web service should be available at `http://localhost:50003` and you can view the secrets that were created in _step 2_. + +4. Sign in to the CloudBees CI operations center as a user with the admin role. + +5. Navigate to **Manage Jenkins > Credentials Providers > HashiCorp Vault Credentials Provider** and complete the configuration for the CloudBees CI Vault Plugin by entering the role ID and secret ID for the `cbci-oc` application role from _step 1_. + +6. Select **Test Connection** to verify the inputs are correct. + +7. Move to `team-b` or `team-c-ha` to run the Pipeline (**admin > validations > vault-credentials**) and validate that credentials are fetched correctly from the Hashicorp Vault. + +> [!NOTE] +> Hashicorp Vault can be also be configured to be used for [Configuration as Code - Handling Secrets - Vault](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#hashicorp-vault-secret-source). + +#### Builds + +##### Build Node Pools + +1. For the following validations, builds will be triggered remotely. Start by issuing the following command to retrieve an [API token](https://docs.cloudbees.com/docs/cloudbees-ci-api/latest/api-authentication) for the `admin_cbci_a` user with the correct permissions for the required actions: ```sh eval $(terraform output --raw cbci_oc_export_admin_crumb) && \ @@ -181,31 +258,52 @@ Once the resources have been created, a `kubeconfig` file is created in the [/k8 eval $(terraform output --raw cbci_liveness_probe_ext) ``` -4. Once you have retrieved the API token, issue the following commands to remotely trigger builds using the [POST queue for hibernation API endpoint](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/managing-controllers#_post_queue_for_hibernation). If successful, an `HTTP/2 201` response is returned, indicating the REST API call has been correctly received by the CloudBees CI controller. +2. Once you have retrieved the API token, issue the following commands to trigger builds using the [POST queue for hibernation API endpoint](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/managing-controllers#_post_queue_for_hibernation). If successful, an `HTTP/2 201` response is returned, indicating the REST API call has been correctly received by the CloudBees CI controller. -- `ws-cache` pipeline from `team-b` using Linux Nodes Pools: + - For Linux node pools use: - ```sh - eval $(terraform output --raw cbci_controller_b_ws_cache_build) - ``` + ```sh + eval $(terraform output --raw cbci_controller_b_s3_build) + ``` -This pipeline uses [CloudBees Workspace Caching](https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-cache-step). Once the second build is complete, you can find the read cache operation at the beginning of the build logs and the write cache operation at the end of the build logs. + It triggers the `s3-WScacheAndArtifacts` Pipeline from the `team-b` controller. This pipeline validates S3 integrations in parallel for [CloudBees workspace caching](https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-cache-step) (using `linux-mavenAndKaniko-L`) and the [S3 artifact manager](https://plugins.jenkins.io/artifact-manager-s3/) (using `linux-mavenAndKaniko-XL`). -- `windows-build-nodes` pipeline from `team-c-ha` using Windows Nodes Pools: + Once the second build is complete, you can find the read cache operation at the beginning of the build logs and the write cache operation at the end of the build logs. - ```sh - eval $(terraform output --raw cbci_controller_c_windows_node_build) - ``` + The `linux-mavenAndKaniko-L` agent template is deployed over on-demand Linux nodes that have smaller instance types versus the `linux-mavenAndKaniko-XL` template that is deployed over Spot Linux nodes that have defined larger instance types. + + - For Windows node pool use: -The first build for a new Windows image container takes up to 10 minutes to run; subsequent builds should take seconds to run. + ```sh + eval $(terraform output --raw cbci_controller_c_windows_node_build) + ``` -7. Right after triggering the builds, issue the following to validate pod agent provisioning to build the pipeline code: + It triggers the `windows-build-nodes` Pipeline from the `team-c-ha` controller. + + Note that the first build for a new Windows image container can take up to 10 minutes to run; subsequent builds should take seconds to run. This behavior can be improved, as explained in the section [Architecture](#architecture). + +3. Right after triggering the builds, issue the following to validate pod agent provisioning to build the Pipeline code: ```sh eval $(terraform output --raw cbci_agents_pods) ``` -8. Check build logs by signing in to the `team-b` and `team-c-ha` controllers, respectively. Navigate to the pipeline jobs and select the first build, indicated by the `#1` build number. [CloudBees Pipeline Explorer](https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-pipeline-explorer-plugin) is enabled as a default. +4. Check build logs by signing in to the `team-b` and `team-c-ha` controllers, respectively. Navigate to the Pipeline jobs and select the first build, indicated by the `#1` build number. [CloudBees Pipeline Explorer](https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-pipeline-explorer-plugin) is enabled by default. + +##### Container Registry + +This blueprints use a couple of container registries for different purposes. + +- The public registry uses DockerHub. +- The private registry uses AWS ECR. + +> [!NOTE] +> Other Container Registry services can be used for the same purposes. + +Sign in to the CloudBees CI to `team-b` or `team-c-ha` controllers with admin access. Run the **admin > validations > kaniko** Pipeline and enter (using parameters) an existing DockerHub organization and an existing AWS ECR Repository to test that building and pushing to all repositories works as expected. + +> [!NOTE] +> Besides Kaniko, there are [other alternitives tools](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/using-kaniko#_alternatives). #### Back up and restore @@ -277,7 +375,7 @@ Grafana is used to visualize and query: eval $(terraform output --raw prometheus_dashboard) ``` - If successful, the Prometheus dashboard should be available at `http://localhost:50001` and you can view the configured alerts for CloudBees CI. + If successful, the Prometheus web service is available at `http://localhost:50001` and you can view the configured alerts for CloudBees CI. Additionally, check _Status_ > _Targets_ shows targets in `UP` status. 3. Issue the following command to access Grafana dashboards at `localhost:50002`. For the username, use `admin` and set the password using the `global_password` terraform variable: @@ -285,9 +383,9 @@ Grafana is used to visualize and query: eval $(terraform output --raw grafana_dashboard) ``` - If successful, the Grafana dashboard should be available at `http://localhost:50002`. + If successful, the Grafana web service is available `http://localhost:50002`. - - For Jenkins Metrics Dashboards navigate to **Dashboards > CloudBees CI**. Then, select the controller pod to view the metrics. The following image shows metrics for team-b. + - For Jenkins Metrics Dashboards navigate to **Home > Dashboards > CloudBees CI**. Then, select the controller pod to view the metrics. The following image shows metrics for team-b. ![CloudBees CI Dashboard](img/observability/cbci-dashboard.png) diff --git a/blueprints/02-at-scale/casc/mc/parent/items/admin-folder.yaml b/blueprints/02-at-scale/casc/mc/parent/items/admin-folder.yaml deleted file mode 100644 index 7f1e6fca..00000000 --- a/blueprints/02-at-scale/casc/mc/parent/items/admin-folder.yaml +++ /dev/null @@ -1,301 +0,0 @@ -removeStrategy: - rbac: SYNC - items: NONE -items: -- kind: folder - name: admin - description: '' - displayName: admin - items: - - kind: pipeline - name: loadTest - concurrentBuild: true - definition: - cpsFlowDefinition: - sandbox: true - script: |- - timeout(time: 1, unit: 'HOURS'){ - parallel([0, 1].collectEntries {b -> ["branch-$b", { - podTemplate (inheritFrom: 'linux-mavenAndGo') { - node(POD_LABEL) { - retry (3) { - stage('prep') { - sh 'curl https://ipinfo.io/' - } - stage('build') { - mockLoad 180 - } - stage('publish') { - archiveArtifacts allowEmptyArchive: true, artifacts: 'mock-artifact-*.txt' - fingerprint 'mock-artifact-*.txt' - junit 'mock-junit.xml' - } - } - } - } - }]}) - } - build job: JOB_NAME, wait: false - description: 'It emulates workload in a controller see https://plugins.jenkins.io/mock-load-builder/.' - displayName: loadTest - - kind: backupAndRestore - name: restore - buildersList: - - restoreBuilder: - ignoreConfirmationFile: true - preserveJenkinsHome: false - ignoreDigestCheck: false - store: - s3Store: - bucketName: "${sec_s3bucketName}" - sse: true - bucketFolder: cbci/backup - region: "${sec_awsRegion}" - description: 'Validates the restore functionality of the CloudBees Backup plugin.' - displayName: restore - - kind: folder - name: validations - description: 'Contains validations for integrations tests.' - displayName: validations - items: - - kind: pipeline - name: build-agents-talks - concurrentBuild: true - definition: - cpsFlowDefinition: - sandbox: true - script: |- - timeout(time: 1, unit: 'HOURS'){ - podTemplate (inheritFrom: 'linux-mavenAndGo') { - retry (3) { - node(POD_LABEL) { - stage('beginning') { - sh 'date > date.txt' - archiveArtifacts artifacts: 'date.txt', fingerprint: true - } - } - } - } - checkpoint 'middle' - podTemplate (inheritFrom: 'linux-maven-spot') { - retry (3) { - node(POD_LABEL) { - stage('end') { - dir ('unarchive'){ - unarchive mapping: ['date.txt': 'my-date.txt'] - sh 'cat my-date.txt' - } - } - } - } - } - } - description: 'It validates archives/unarchive s3 artifacts from different pods agents in the same build.' - displayName: build-agents-talks - - kind: pipeline - name: downstream-artifact - concurrentBuild: true - definition: - cpsFlowDefinition: - sandbox: true - script: |- - pipeline { - agent{ - label 'linux-maven-spot' - } - options { - retry(3) - timeout(time: 1, unit: 'HOURS') - } - environment { - ARTIFACT_SOURCE_JOB = 'upstream-artifact' - } - stages { - stage('Build Upstream') { - steps { - build 'upstream-artifact' - } - } - stage('Copy Artifacts') { - steps { - sh 'ls -la' - copyArtifacts fingerprintArtifacts: true, projectName: env.ARTIFACT_SOURCE_JOB, selector: lastSuccessful() - } - } - stage('Read Artifacts') { - steps { - sh 'ls -la' - sh 'cat f_2' - } - } - } - post { - failure { - echo "Check Manage Jenkins > AWS > Amazon S3 Bucket Access settings matches with your s3 name terraform output!" - } - } - } - description: 'It validates archives/unarchive s3 artifacts (https://plugins.jenkins.io/artifact-manager-s3/) from different pods agents in different build. It uses artifacts from upstream build.' - displayName: downstream-artifact - - kind: pipeline - name: upstream-artifact - concurrentBuild: true - definition: - cpsFlowDefinition: - sandbox: true - script: |- - pipeline { - options { - retry(3) - timeout(time: 1, unit: 'HOURS') - } - agent{ - label 'linux-mavenAndGo' - } - stages { - stage('Golang') { - stages { - stage ('Build'){ - steps { - container('go') { - sh ''' - echo "Build number ^${BUILD_NUMBER}" >> f_1 - go version >> f_1 - ''' - } - } - } - stage ('Archive f_1'){ - steps { - container('go') { - archiveArtifacts artifacts: 'f_1', fingerprint: true - } - } - } - } - } - stage('Busybox') { - stages { - stage ("Unarchive"){ - steps { - container('maven') { - dir ('unarchive'){ - sh 'ls -la' - unarchive mapping: [f_1: 'f_1'] - sh 'ls -la; cat f_1; mv f_1 f_2' - } - } - } - } - stage ('Build'){ - steps { - container('maven') { - dir ('unarchive'){ - sh 'mvn -version >> f_2' - } - } - } - } - stage ('Archive f_2'){ - steps { - container('maven') { - dir ('unarchive'){ - archiveArtifacts artifacts: 'f_2', fingerprint: true - } - } - } - } - } - } - } - post { - failure { - echo "Check Manage Jenkins > AWS > Amazon S3 Bucket Access settings matches with your s3 name terraform output!" - } - } - } - description: 'It validates archives/unarchive s3 artifacts (https://plugins.jenkins.io/artifact-manager-s3/) from different pods agents in different build. It creates artifacts for downstream build.' - displayName: upstream-artifact - - kind: pipeline - name: windows-builds-nodes - concurrentBuild: false - definition: - cpsFlowDefinition: - sandbox: true - script: | - pipeline { - options { - retry(3) - timeout(time: 1, unit: 'HOURS') - } - agent { - label 'windows-powershell' - } - stages { - stage('Test') { - steps { - container('shell') { - powershell 'Get-ChildItem Env: | Sort Name' - } - } - } - } - } - description: 'It validates the windows nodes builds.' - displayName: windows-builds-nodes - - kind: pipeline - name: ws-cache - concurrentBuild: true - definition: - cpsFlowDefinition: - sandbox: true - script: |- - pipeline { - options { - retry(3) - timeout(time: 1, unit: 'HOURS') - } - agent{ - label 'linux-mavenAndGo' - } - environment { - MAVEN_PROJECT = 'https://github.com/jglick/simple-maven-project-with-tests' - CACHE = 'ws-cache-maven' - } - stages { - stage('Checkout') { - steps { - git env.MAVEN_PROJECT - } - } - stage('Read') { - steps { - readCache name: env.CACHE - } - } - stage('Build') { - steps { - container('maven') { - sh 'mvn clean package -DskipTests -Dmaven.repo.local=./maven-repo' - } - } - } - } - post { - success { - writeCache name: env.CACHE, includes: 'maven-repo/**' - } - failure { - echo "Check Manage Jenkins > AWS > Amazon S3 Bucket Access settings matches with your s3 name terraform output!" - } - } - } - description: 'Pipeline that demonstrates the usage of CloudBees Workspace Caching: https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-cache-step.' - properties: - - envVars: {} - - itemRestrictions: - filter: false - properties: - - envVars: {} - - itemRestrictions: - filter: false diff --git a/blueprints/02-at-scale/casc/mc/parent/variables/variables.yaml b/blueprints/02-at-scale/casc/mc/parent/variables/variables.yaml deleted file mode 100644 index f4cec083..00000000 --- a/blueprints/02-at-scale/casc/mc/parent/variables/variables.yaml +++ /dev/null @@ -1,2 +0,0 @@ -variables: - - ot_endpoint: "http://tempo.kube-prometheus-stack.svc.cluster.local:4317" diff --git a/blueprints/02-at-scale/casc/oc/jcasc/security.yaml b/blueprints/02-at-scale/casc/oc/jcasc/security.yaml deleted file mode 100644 index 1eaa4f83..00000000 --- a/blueprints/02-at-scale/casc/oc/jcasc/security.yaml +++ /dev/null @@ -1,31 +0,0 @@ -jenkins: - securityRealm: - ldap: - configurations: - - managerDN: ${ldapManagerDN} - managerPasswordSecret: ${sec_globalPassword} - rootDN: ${ldapRootDN} - server: ${ldapServer} - userSearch: ${ldapUserSearch} - authorizationStrategy: "cloudBeesRoleBasedAccessControl" - remotingSecurity: - enabled: true - crumbIssuer: - standard: - excludeClientIPFromCrumb: true -credentials: - system: - domainCredentials: - - credentials: - - usernamePassword: - description: "GH-User-token" - id: "GH-User-token" - password: ${sec_githubUser} - scope: GLOBAL - username: ${sec_githubToken} - usernameSecret: true - - string: - description: "GH-ST-token" - id: "GH-ST-token" - scope: GLOBAL - secret: ${sec_githubToken} diff --git a/blueprints/02-at-scale/casc/oc/variables/variables.yaml b/blueprints/02-at-scale/casc/oc/variables/variables.yaml deleted file mode 100644 index 4ff2401e..00000000 --- a/blueprints/02-at-scale/casc/oc/variables/variables.yaml +++ /dev/null @@ -1,8 +0,0 @@ -variables: - - message: "Welcome to the CloudBees CI blueprint add-on: At scale!" - - scmCascMmStore: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - - cascBranch: main - - ldapManagerDN: "cn=admin,dc=acme,dc=org" - - ldapRootDN: "dc=acme,dc=org" - - ldapServer: "openldap-stack.auth.svc.cluster.local" - - ldapUserSearch: "cn={0}" diff --git a/blueprints/02-at-scale/casc/mc/ha/bundle.yaml b/blueprints/02-at-scale/cbci/casc/mc/ha/bundle.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/ha/bundle.yaml rename to blueprints/02-at-scale/cbci/casc/mc/ha/bundle.yaml diff --git a/blueprints/02-at-scale/casc/mc/ha/jcasc/main.yaml b/blueprints/02-at-scale/cbci/casc/mc/ha/jcasc/main.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/ha/jcasc/main.yaml rename to blueprints/02-at-scale/cbci/casc/mc/ha/jcasc/main.yaml diff --git a/blueprints/02-at-scale/casc/mc/none-ha/bundle.yaml b/blueprints/02-at-scale/cbci/casc/mc/none-ha/bundle.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/none-ha/bundle.yaml rename to blueprints/02-at-scale/cbci/casc/mc/none-ha/bundle.yaml diff --git a/blueprints/02-at-scale/casc/mc/none-ha/jcasc/main.yaml b/blueprints/02-at-scale/cbci/casc/mc/none-ha/jcasc/main.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/none-ha/jcasc/main.yaml rename to blueprints/02-at-scale/cbci/casc/mc/none-ha/jcasc/main.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/bundle.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/bundle.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/bundle.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/bundle.yaml diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml new file mode 100644 index 00000000..a407cf25 --- /dev/null +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml @@ -0,0 +1,290 @@ +removeStrategy: + rbac: SYNC + items: NONE +items: +- kind: folder + name: admin + description: '' + displayName: admin + items: + - kind: pipeline + name: loadTest + concurrentBuild: true + definition: + cpsFlowDefinition: + sandbox: true + script: |- + timeout(time: 1, unit: 'HOURS'){ + parallel([0, 1].collectEntries {b -> ["branch-$b", { + podTemplate (inheritFrom: 'linux-mavenAndKaniko-L') { + node(POD_LABEL) { + retry (3) { + stage('prep') { + sh 'curl https://ipinfo.io/' + } + stage('build') { + mockLoad 180 + } + stage('publish') { + archiveArtifacts allowEmptyArchive: true, artifacts: 'mock-artifact-*.txt' + fingerprint 'mock-artifact-*.txt' + junit 'mock-junit.xml' + } + } + } + } + }]}) + } + build job: JOB_NAME, wait: false + description: 'It emulates workload in a controller see https://plugins.jenkins.io/mock-load-builder/.' + displayName: loadTest + - kind: backupAndRestore + name: restore + label: linux-mavenAndKaniko-XL + buildersList: + - restoreBuilder: + ignoreConfirmationFile: true + preserveJenkinsHome: false + ignoreDigestCheck: false + store: + s3Store: + bucketName: "${sec_s3bucketName}" + sse: true + bucketFolder: "${s3bucketPreffix}/backup" + region: "${sec_awsRegion}" + description: 'Validates the restore functionality of the CloudBees Backup plugin.' + displayName: restore + - kind: folder + name: validations + description: 'Contains validations for integrations tests.' + displayName: validations + items: + - kind: pipeline + name: s3-WScacheAndArtifacts + concurrentBuild: true + definition: + cpsFlowDefinition: + sandbox: true + script: |- + @Library('common') _ + + pipeline { + agent none + options { + retry(3) + timeout(time: 1, unit: 'HOURS') + } + stages { + stage ("s3"){ + parallel { + stage('Workspace Cache') { + agent { + label "linux-mavenAndKaniko-L" + } + environment { + MAVEN_PROJECT = 'https://github.com/jglick/simple-maven-project-with-tests' + CACHE = 'ws-cache-maven' + } + stages { + stage('Checkout') { + steps { + git env.MAVEN_PROJECT + } + } + stage('Read') { + steps { + readCache name: env.CACHE + } + } + stage('Build') { + steps { + container('maven') { + mvnBuild(skipTests: true) + } + } + } + } + post { + success { + writeCache name: env.CACHE, includes: 'maven-repo/**' + } + } + } + stage('Artifacts') { + agent { + label "linux-mavenAndKaniko-XL" + } + stages { + stage('Maven') { + stages { + stage ('Build'){ + steps { + container('maven') { + sh ''' + echo "Build number ^${BUILD_NUMBER}" >> f_1 + mvn -version >> f_1 + ''' + } + } + } + stage ('Archive f_1'){ + steps { + container('kaniko') { + archiveArtifacts artifacts: 'f_1', fingerprint: true + } + } + } + } + } + stage('Kaniko') { + stages { + stage ("Unarchive"){ + steps { + container('maven') { + dir ('unarchive'){ + sh 'ls -la' + unarchive mapping: [f_1: 'f_1'] + sh 'ls -la; cat f_1; mv f_1 f_2' + } + } + } + } + stage ('Build'){ + steps { + container('kaniko') { + dir ('unarchive'){ + sh "ls -la /kaniko/executor >> f_2" + } + } + } + } + stage ('Archive f_2'){ + steps { + container('maven') { + dir ('unarchive'){ + archiveArtifacts artifacts: 'f_2', fingerprint: true + } + } + } + } + } + } + } + } + } + } + } + } + description: Pipeline that demonstrates the s3 integrations for CloudBees Workspace + Caching (https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-cache-step) + and s3 Artifact (https://plugins.jenkins.io/artifact-manager-s3/) are working + disabled: false + displayName: s3-WScacheAndArtifacts + resumeBlocked: false + - kind: pipeline + name: windows-builds-nodes + concurrentBuild: false + definition: + cpsFlowDefinition: + sandbox: true + script: | + pipeline { + options { + retry(3) + timeout(time: 1, unit: 'HOURS') + } + agent { + label 'windows-powershell' + } + stages { + stage('Test') { + steps { + container('shell') { + powershell 'Get-ChildItem Env: | Sort Name' + } + } + } + } + } + description: 'It validates the windows nodes builds.' + displayName: windows-builds-nodes + - kind: pipeline + name: vault-credentials + concurrentBuild: true + definition: + cpsFlowDefinition: + sandbox: true + script: | + pipeline { + agent any + environment { + U1=credentials('cbci-oc-secret-a') + S1=credentials('cbci-oc_secret-b') + } + stages { + stage('Print credentials') { + steps { + sh ''' + echo 'Printing credentials from Vault' + echo ^${U1} + echo ^${S1} + ''' + } + } + } + } + description: 'It validates that credentials from Vault are fetched correctly.' + - kind: pipeline + name: kaniko + concurrentBuild: true + definition: + cpsFlowDefinition: + sandbox: true + script: | + @Library('common') _ + + pipeline { + agent { + label 'linux-mavenAndKaniko-XL' + } + parameters { + string(name: 'TARGET_DH_ORG', description: 'DockerHub Organization to Push the image', defaultValue: 'example-org', ) + string(name: 'TARGET_ECR_URI', description: 'ECR URI', defaultValue: '99999999999.dkr.ecr.us-east-1.amazonaws.com/test-private-example', ) + } + stages { + stage('Public Registry') { + steps { + container(name: 'kaniko', shell: '/busybox/sh') { + getDockerfile("HelloWorld.Dockerfile") + sh '''#!/busybox/sh + /kaniko/executor --context `pwd` --destination ^${TARGET_DH_ORG}/cbci-bp02-kaniko:^${BUILD_ID} + ''' + } + } + } + stage('Private Registry') { + steps { + container(name: 'kaniko-ecr', shell: '/busybox/sh') { + getDockerfile("HelloWorld.Dockerfile") + sh '''#!/busybox/sh + /kaniko/executor --context `pwd` --destination=^${TARGET_ECR_URI}:^${BUILD_ID} + ''' + } + } + } + } + } + properties: + - parameters: + parameterDefinitions: + - string: + trim: false + defaultValue: example-org + name: TARGET_DH_ORG + description: DockerHub Organization to Push the image + - string: + trim: false + defaultValue: 99999999999.dkr.ecr.us-east-1.amazonaws.com/test-private-example + name: TARGET_ECR_URI + description: ECR URI + description: 'It validates Authentication to Push images to DockerHub and ECR.' diff --git a/blueprints/02-at-scale/casc/mc/parent/items/squad_x-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/squad_x-folder.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/items/squad_x-folder.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/items/squad_x-folder.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/items/squad_y-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/squad_y-folder.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/items/squad_y-folder.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/items/squad_y-folder.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/jcasc/k8s-agents.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml similarity index 53% rename from blueprints/02-at-scale/casc/mc/parent/jcasc/k8s-agents.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml index b4043907..882410ca 100644 --- a/blueprints/02-at-scale/casc/mc/parent/jcasc/k8s-agents.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml @@ -1,8 +1,8 @@ kube: podTemplatesConfiguration: templates: - - name: "linux-mavenAndGo" - label: "linux-mavenAndGo" + - name: "linux-mavenAndKaniko-L" + label: "linux-mavenAndKaniko-L" nodeUsageMode: "NORMAL" yaml: |- apiVersion: "v1" @@ -25,14 +25,27 @@ kube: - "99d" command: - "sleep" - image: "golang:alpine3.19" - name: "go" + image: "gcr.io/kaniko-project/executor:debug" + imagePullPolicy: Always + name: "kaniko" resources: limits: memory: "1Gi" requests: memory: "500Mi" cpu: "250m" + volumeMounts: + - name: jenkins-docker-cfg + mountPath: /kaniko/.docker + volumes: + - name: jenkins-docker-cfg + projected: + sources: + - secret: + name: ${regSecretsName} + items: + - key: .dockerconfigjson + path: config.json nodeSelector: kubernetes.io/os: linux role: "build-linux" @@ -41,8 +54,8 @@ kube: key: "dedicated" operator: "Equal" value: "build-linux" - - name: "linux-maven-spot" - label: "linux-maven-spot" + - name: "linux-mavenAndKaniko-XL" + label: "linux-mavenAndKaniko-XL" nodeUsageMode: "NORMAL" yaml: |- apiVersion: "v1" @@ -57,10 +70,48 @@ kube: name: "maven" resources: limits: - memory: "1Gi" + memory: "2Gi" + requests: + memory: "500Mi" + cpu: "250m" + - args: + - "99d" + command: + - "sleep" + image: "gcr.io/kaniko-project/executor:debug" + imagePullPolicy: Always + name: "kaniko" + resources: + limits: + memory: "2Gi" requests: memory: "500Mi" cpu: "250m" + volumeMounts: + - name: jenkins-docker-cfg + mountPath: /kaniko/.docker + - args: + - "99d" + command: + - "sleep" + image: "gcr.io/kaniko-project/executor:debug" + imagePullPolicy: Always + name: "kaniko-ecr" + resources: + limits: + memory: "2Gi" + requests: + memory: "500Mi" + cpu: "250m" + volumes: + - name: jenkins-docker-cfg + projected: + sources: + - secret: + name: ${regSecretsName} + items: + - key: .dockerconfigjson + path: config.json nodeSelector: kubernetes.io/os: linux role: "build-linux-spot" @@ -78,8 +129,20 @@ kube: containers: - name: jnlp image: jenkins/inbound-agent:windowsservercore-1809 + resources: + limits: + memory: "1Gi" + requests: + memory: "500Mi" + cpu: "250m" - name: shell image: mcr.microsoft.com/powershell:preview-windowsservercore-1809 + resources: + limits: + memory: "1Gi" + requests: + memory: "500Mi" + cpu: "250m" command: - powershell args: diff --git a/blueprints/02-at-scale/casc/mc/parent/jcasc/main.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml similarity index 74% rename from blueprints/02-at-scale/casc/mc/parent/jcasc/main.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml index 4484d079..301da1c9 100644 --- a/blueprints/02-at-scale/casc/mc/parent/jcasc/main.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml @@ -36,11 +36,25 @@ unclassified: gracePeriod: 3600 openTelemetry: endpoint: ${ot_endpoint} + cascItemsConfiguration: + variableInterpolationEnabledForAdmin: true + globalLibraries: + libraries: + - defaultVersion: ${sharedLibBranch} + name: "common" + retriever: + modernSCM: + libraryPath: ${sharedLibPath} + scm: + git: + remote: ${sharedLibRepo} aws: + awsCredentials: + region: "${sec_awsRegion}" s3: container: "${sec_s3bucketName}" disableSessionToken: false - prefix: "cbci/" + prefix: "${s3bucketPreffix}/" useHttp: false usePathStyleUrl: false useTransferAcceleration: false diff --git a/blueprints/02-at-scale/casc/mc/parent/jcasc/security.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/security.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/jcasc/security.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/security.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/jcasc/support.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/support.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/jcasc/support.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/support.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/plugins/plugins.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/plugins/plugins.yaml similarity index 96% rename from blueprints/02-at-scale/casc/mc/parent/plugins/plugins.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/plugins/plugins.yaml index 35a18419..b352508f 100644 --- a/blueprints/02-at-scale/casc/mc/parent/plugins/plugins.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/plugins/plugins.yaml @@ -7,6 +7,7 @@ plugins: - id: cloudbees-disk-usage-simple - id: cloudbees-groovy-view - id: cloudbees-jenkins-advisor + - id: cloudbees-hashicorp-vault - id: cloudbees-pipeline-explorer - id: cloudbees-prometheus - id: cloudbees-s3-cache diff --git a/blueprints/02-at-scale/casc/mc/parent/rbac/rbac.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/rbac/rbac.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/rbac/rbac.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/rbac/rbac.yaml diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml new file mode 100644 index 00000000..429fcc4d --- /dev/null +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml @@ -0,0 +1,7 @@ +variables: + - ot_endpoint: "http://tempo.kube-prometheus-stack.svc.cluster.local:4317" + - s3bucketPreffix: "cbci" + - regSecretsName: "cbci-sec-reg" + - sharedLibRepo: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" + - sharedLibBranch: develop + - sharedLibPath: "blueprints/02-at-scale/cbci/shared-lib" diff --git a/blueprints/02-at-scale/casc/oc/bundle.yaml b/blueprints/02-at-scale/cbci/casc/oc/bundle.yaml similarity index 100% rename from blueprints/02-at-scale/casc/oc/bundle.yaml rename to blueprints/02-at-scale/cbci/casc/oc/bundle.yaml diff --git a/blueprints/02-at-scale/casc/oc/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/oc/items/admin-folder.yaml similarity index 97% rename from blueprints/02-at-scale/casc/oc/items/admin-folder.yaml rename to blueprints/02-at-scale/cbci/casc/oc/items/admin-folder.yaml index b429d337..00735694 100644 --- a/blueprints/02-at-scale/casc/oc/items/admin-folder.yaml +++ b/blueprints/02-at-scale/cbci/casc/oc/items/admin-folder.yaml @@ -83,7 +83,7 @@ items: store: s3Store: bucketName: "${sec_s3bucketName}" - bucketFolder: cbci/backup + bucketFolder: "${s3bucketPreffix}/backup" region: "${sec_awsRegion}" itemSource: jenkinsRootItemSource: { diff --git a/blueprints/02-at-scale/casc/oc/items/root.yaml b/blueprints/02-at-scale/cbci/casc/oc/items/root.yaml similarity index 93% rename from blueprints/02-at-scale/casc/oc/items/root.yaml rename to blueprints/02-at-scale/cbci/casc/oc/items/root.yaml index 1af796d2..18c4dce4 100644 --- a/blueprints/02-at-scale/casc/oc/items/root.yaml +++ b/blueprints/02-at-scale/cbci/casc/oc/items/root.yaml @@ -35,7 +35,7 @@ items: volumes: - name: cbci-secrets secret: - secretName: cbci-secrets + secretName: ${cascSecretsName} containers: - name: jenkins env: @@ -53,7 +53,7 @@ items: "cloudbees.prometheus": "true" properties: - configurationAsCode: - bundle: "main/none-ha" + bundle: "develop/none-ha" # Casc, HA - kind: managedController name: team-c-ha @@ -82,7 +82,7 @@ items: volumes: - name: cbci-secrets secret: - secretName: cbci-secrets + secretName: ${cascSecretsName} containers: - name: jenkins env: @@ -100,4 +100,4 @@ items: "cloudbees.prometheus": "true" properties: - configurationAsCode: - bundle: "main/ha" + bundle: "develop/ha" diff --git a/blueprints/02-at-scale/casc/oc/jcasc/main.yaml b/blueprints/02-at-scale/cbci/casc/oc/jcasc/main.yaml similarity index 91% rename from blueprints/02-at-scale/casc/oc/jcasc/main.yaml rename to blueprints/02-at-scale/cbci/casc/oc/jcasc/main.yaml index 2983a2fe..36a52eb3 100644 --- a/blueprints/02-at-scale/casc/oc/jcasc/main.yaml +++ b/blueprints/02-at-scale/cbci/casc/oc/jcasc/main.yaml @@ -13,8 +13,7 @@ unclassified: defaultVersion: ${cascBranch} scmSource: git: - credentialsId: "GH-token" - remote: ${scmCascMmStore} + remote: ${cascRepo} traits: - "gitBranchDiscovery" - headWildcardFilter: @@ -22,7 +21,7 @@ unclassified: - sparseCheckoutPaths: extension: sparseCheckoutPaths: - - path: "/blueprints/02-at-scale/casc/mc/" + - path: ${cascPathController} cascAutoControllerProvisioning: provisionControllerOnCreation: true buildDiscarders: diff --git a/blueprints/02-at-scale/cbci/casc/oc/jcasc/security.yaml b/blueprints/02-at-scale/cbci/casc/oc/jcasc/security.yaml new file mode 100644 index 00000000..bdcb33ac --- /dev/null +++ b/blueprints/02-at-scale/cbci/casc/oc/jcasc/security.yaml @@ -0,0 +1,48 @@ +jenkins: + securityRealm: + ldap: + configurations: + - managerDN: ${ldapManagerDN} + managerPasswordSecret: ${sec_globalPassword} + rootDN: ${ldapRootDN} + server: ${ldapServer} + userSearch: ${ldapUserSearch} + authorizationStrategy: "cloudBeesRoleBasedAccessControl" + remotingSecurity: + enabled: true + crumbIssuer: + standard: + excludeClientIPFromCrumb: true +globalCredentialsConfiguration: + vaultGlobalConfiguration: + authentications: + - appRoleAuthentication: + id: "cbci-oc" + roleId: "REPLACE_ME" + secretId: "REPLACE_ME" + skipSslVerification: true + url: "${vault_url}" +credentials: + system: + cloudbeesHashicorpVault: + domainCredentials: + - credentials: + - vaultUsernamePassword: + description: "cbci-oc/secret-a" + id: "cbci-oc_secret-a" + passwordKey: "password" + usernameKey: "username" + vaultSecretEngine: + genericKV2SecretEngine: + authenticationId: "cbci-oc" + mountPath: "secret-v2" + path: "cbci-oc/secret-a" + - vaultSecretText: + description: "cbci-oc/secret-b" + id: "cbci-oc_secret-b" + secretKey: "secret" + vaultSecretEngine: + genericKV2SecretEngine: + authenticationId: "cbci-oc" + mountPath: "secret-v2" + path: "cbci-oc/secret-b" diff --git a/blueprints/02-at-scale/casc/oc/jcasc/support.yaml b/blueprints/02-at-scale/cbci/casc/oc/jcasc/support.yaml similarity index 100% rename from blueprints/02-at-scale/casc/oc/jcasc/support.yaml rename to blueprints/02-at-scale/cbci/casc/oc/jcasc/support.yaml diff --git a/blueprints/02-at-scale/casc/oc/plugins/plugins.yaml b/blueprints/02-at-scale/cbci/casc/oc/plugins/plugins.yaml similarity index 87% rename from blueprints/02-at-scale/casc/oc/plugins/plugins.yaml rename to blueprints/02-at-scale/cbci/casc/oc/plugins/plugins.yaml index 2d0fa386..0dea082a 100644 --- a/blueprints/02-at-scale/casc/oc/plugins/plugins.yaml +++ b/blueprints/02-at-scale/cbci/casc/oc/plugins/plugins.yaml @@ -2,6 +2,7 @@ plugins: - id: cloudbees-casc-client - id: cloudbees-casc-items-commons - id: cloudbees-casc-items-server + - id: cloudbees-hashicorp-vault - id: cloudbees-jenkins-advisor - id: cloudbees-prometheus - id: github diff --git a/blueprints/02-at-scale/casc/oc/rbac/rbac.yaml b/blueprints/02-at-scale/cbci/casc/oc/rbac/rbac.yaml similarity index 100% rename from blueprints/02-at-scale/casc/oc/rbac/rbac.yaml rename to blueprints/02-at-scale/cbci/casc/oc/rbac/rbac.yaml diff --git a/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml new file mode 100644 index 00000000..82f69637 --- /dev/null +++ b/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml @@ -0,0 +1,12 @@ +variables: + - message: "Welcome to the CloudBees CI blueprint add-on: At scale!" + - cascRepo: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" + - cascBranch: develop + - cascPathController: "/blueprints/02-at-scale/cbci/casc/mc/" + - ldapManagerDN: "cn=admin,dc=acme,dc=org" + - ldapRootDN: "dc=acme,dc=org" + - ldapServer: "openldap-stack.auth.svc.cluster.local" + - ldapUserSearch: "cn={0}" + - vault_url: "http://vault.vault.svc.cluster.local:8200" + - cascSecretsName: "cbci-sec-casc" + - s3bucketPreffix: "cbci" diff --git a/blueprints/02-at-scale/cbci/shared-lib/resources/dockerfiles/HelloWorld.Dockerfile b/blueprints/02-at-scale/cbci/shared-lib/resources/dockerfiles/HelloWorld.Dockerfile new file mode 100644 index 00000000..ccd1cb75 --- /dev/null +++ b/blueprints/02-at-scale/cbci/shared-lib/resources/dockerfiles/HelloWorld.Dockerfile @@ -0,0 +1,2 @@ +FROM alpine +CMD ["/bin/sh", "-c", "echo 'hello world'"] diff --git a/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy b/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy new file mode 100644 index 00000000..d4f0b973 --- /dev/null +++ b/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy @@ -0,0 +1,10 @@ +// vars/getDockerfile + +def call(String filePath){ + if (filePath?.trim()) { + Object dockerfileContent = libraryResource "dockerfiles/${filePath}" + writeFile file: 'Dockerfile', text: dockerfileContent + } else { + error 'filePath is empty. Please provide a valid location.' + } +} diff --git a/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.txt b/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.txt new file mode 100644 index 00000000..6b7c72ec --- /dev/null +++ b/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.txt @@ -0,0 +1,5 @@ +Get the Dockerfile passed as a parameter (filePath) from the Shared Library Resources and copy it into the workspace. + +``` +getDockerfile("HelloWorld.Dockerfile") +``` diff --git a/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.groovy b/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.groovy new file mode 100644 index 00000000..78aba80d --- /dev/null +++ b/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.groovy @@ -0,0 +1,10 @@ +// vars/mvnBuild + +def call(Map args = [:]) { + def skipTests = args.containsKey('skipTests') ? args.skipTests : error('mvnBuild: skipTests parameter is required') + if (skipTests) { + sh 'mvn clean package -DskipTests -Dmaven.repo.local=./maven-repo' + } else { + sh 'mvn clean package -Dmaven.repo.local=./maven-repo' + } +} diff --git a/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.txt b/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.txt new file mode 100644 index 00000000..bc6a27d5 --- /dev/null +++ b/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.txt @@ -0,0 +1,5 @@ +Execute mvn package target following best practices. + +``` +mvnBuild(skipTests: true) +``` diff --git a/blueprints/02-at-scale/img/at-scale.architect.drawio.svg b/blueprints/02-at-scale/img/at-scale.architect.drawio.svg index 2adc4ba9..1561c961 100644 --- a/blueprints/02-at-scale/img/at-scale.architect.drawio.svg +++ b/blueprints/02-at-scale/img/at-scale.architect.drawio.svg @@ -1,4 +1,4 @@ - + @@ -231,29 +231,6 @@ - - - - -
-
-
- - - Instance -
- profile - - -
-
-
- - - Instance... - - - @@ -871,7 +848,25 @@ - + + + + +
+
+
+ s3 +
+ Profile +
+
+
+ + + s3... + + + @@ -949,6 +944,45 @@ + + + + + +
+
+
+ Elastic Container +
+ Registry +
+
+
+ + + Elastic Co... + + + + + + + +
+
+
+ ECR +
+ Profile +
+
+
+ + + ECR... + + + diff --git a/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg b/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg index 2d02feff..57d4079d 100644 --- a/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg +++ b/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg @@ -1,4 +1,1093 @@ - - - -
do
do
AWS Cloud
AWS Cloud
4
4
/velero
/velero
Amazon S3 bucket
Amazon S3 b...
Metric servers
Metric serv...
Amazon EFS
CSI driver
Amazon EFS...
Amazon EBS
CSI driver
Amazon EBS...
Autoscaler
Autoscaler
AWS Load
Balancer
AWS Load...
Autoscaling
group
Autoscal...
Amazon EFS
Amazon EFS
Amazon EBS
Amazon E...
kube-system
kube-system
/cbci
/cbci
CloudWatch
CloudWatch
EKS
EKS
ALB
ALB
external-dns
external-dns
Backup/Restore
Backup/Restore
Long-term logs
Long-term logs
Fluent Bit
Fluent Bit
Amazon Route 53
hosted zone
Amazon Route 53...
auth
auth
Backup/Restore
Backup/Restore
Workspace
cache
Workspace...
Artifacts
Artifacts
/fluentbit
/fluentbit
kube-prometheus-stack
kube-prometheus-stack
Node Terminator
Handler
Node Termin...
bottle-rocket-operator
bottle-rocket-oper...
cbci-agents
(Ephemeral agents)
cbci-agents...
cbci
(Operations center & controller services)
cbci...


cbci-secrets
cbci-secrets
Hibernation
Monitor
Hibernatio...
Short-term logs
Short-term logsTempoPrometheusGrafana
velero
velero
cert-manager
cert-managerText is not SVG - cannot display + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
+
+ + AWS Cloud + +
+
+
+ + + AWS Cloud + + + + + + + + + + + +
+
+
+ + /velero + +
+
+
+ + + /velero + + + + + + + + +
+
+
+ Amazon S3 bucket +
+
+
+ + + Amazon S3 b... + + + + + + + + + +
+
+
+ + Metric servers +
+ +
+
+
+ + + Metric serv... + + + + + + + + + +
+
+
+ + Amazon EFS +
+ CSI driver + +
+
+
+ + + Amazon EFS... + + + + + + + + + +
+
+
+ + Amazon EBS +
+ CSI driver + +
+
+
+ + + Amazon EBS... + + + + + + + + + +
+
+
+ + Autoscaler +
+ +
+
+
+ + + Autoscaler + + + + + + + + + +
+
+
+ + AWS Load +
+ Balancer +
+ +
+
+
+ + + AWS Load... + + + + + + + + + + + +
+
+
+ Autoscaling +
+ group +
+
+
+ + + Autoscal... + + + + + + + + +
+
+
+ Amazon EFS +
+
+
+ + + Amazon EFS + + + + + + + + +
+
+
+ + Amazon EBS +
+ +
+
+
+ + + Amazon E... + + + + + + + +
+
+
+ + + kube-system + + +
+
+
+ + + kube-system + + + + + + + + + + + + + + + + + + + + + +
+
+
+ + /cbci + +
+
+
+ + + /cbci + + + + + + + + +
+
+
+ CloudWatch +
+
+
+ + + CloudWatch + + + + + + + + + + + +
+
+
+ EKS +
+
+
+ + + EKS + + + + + + + + +
+
+
+ ALB +
+
+
+ + + ALB + + + + + + +
+
+
+ + + external-dns + + +
+
+
+ + + external-dns + + + + + + + + +
+
+
+ + + Backup/Restore + + +
+
+
+ + + Backup/Restore + + + + + + + + + +
+
+
+ + + Long-term logs + + +
+
+
+ + + Long-term logs + + + + + + + + +
+
+
+ + + Fluent Bit + + +
+
+
+ + + Fluent Bit + + + + + + + + +
+
+
+ + Amazon Route 53 + +
+ + hosted zone + +
+
+
+ + + Amazon Route 53... + + + + + + +
+
+
+ + /fluentbit + +
+
+
+ + + /... + + + + + + + + +
+
+
+ + + kube-prometheus-stack + + +
+
+
+ + + kube-prometheus-stack + + + + + + + + + + +
+
+
+ + Node Terminator +
+ Handler +
+ +
+
+
+ + + Node Termin... + + + + + + +
+
+
+ + + bottle-rocket-operator + + +
+
+
+ + + bottle-rocket-oper... + + + + + + + + + +
+
+
+ + + Short-term logs + + +
+
+
+ + + Short-term logs + + + + + + +
+
+
+ + + + velero + + + +
+
+
+ + + velero + + + + + + +
+
+
+ + + + cert-manager + + + +
+
+
+ + + cert-manager + + + + + + + + +
+
+
+ + + + cbci-agents + +
+ + +
+
+
+ + + cbci-agents + + + + + + +
+
+
+ + + + cbci + +
+
+ + +
+
+
+ + + cbci... + + + + + + + + + + + +
+
+
+ + cbci-sec-reg + +
+
+
+ + + cbci-sec-reg + + + + + + + + + +
+
+
+ +
+ +
+
+
+ + + + + + + + + + + + +
+
+
+ +
+ +
+
+
+ + + + + + + + + +
+
+
+ + + + auth + + + +
+
+
+ + + auth + + + + + + + + + + + Tempo + + + + + + Prometheus + + + + + + Grafana + + + + + + + + + +
+
+
+ + + + vault + + + +
+
+
+ + + vault + + + + + + + +
+
+
+ + + + cbci + +
+ + +
+
+
+ + + cbci + + + + + + + +
+
+
+ + Workspace cache + +
+
+
+ + + Workspace cache + + + + + + + + + +
+
+
+ + + Backup/Restore + + +
+
+
+ + + Backup/Restore + + + + + + + +
+
+
+ + + Artifacts + + +
+
+
+ + + Artifacts + + + + + + + + + + + +
+
+
+ + cbci-sec-casc + +
+
+
+ + + cbci-sec-casc + + + + + + + cjoc + + + + + + team-b + + + + + + team-a + + + + + + + + + + +
+
+
+ + Hibernation + +
+ + Monitor + + +
+ +
+
+
+ + + Hibernati... + + + + + + + + + + team-c-ha + + + + + + + + + + +
+
+
+ + + + DockerHub +
+ Container Registry + +
+ + +
+
+
+ + + DockerHub... + + + + + + + + +
+
+
+ + + Elastic Container +
+ + Registry + +
+
+
+ + + Elastic Container... + + + + + + + +
+
+
+ + + Private Images + + +
+
+
+ + + Private Images + + + + + + + +
+
+
+ + + Public Images + + +
+
+
+ + + Public Images + + + + + + + + + + + + + Text is not SVG - cannot display + + + + diff --git a/blueprints/02-at-scale/k8s/cbci-values.yml b/blueprints/02-at-scale/k8s/cbci-values.yml index ccb45097..e0062df8 100644 --- a/blueprints/02-at-scale/k8s/cbci-values.yml +++ b/blueprints/02-at-scale/k8s/cbci-values.yml @@ -16,8 +16,8 @@ OperationsCenter: Retriever: Enabled: true scmRepo: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - scmBranch: main - scmBundlePath: blueprints/02-at-scale/casc/oc + scmBranch: develop + scmBundlePath: blueprints/02-at-scale/cbci/casc/oc scmPollingInterval: PT20M Persistence: StorageClass: efs diff --git a/blueprints/02-at-scale/k8s/secrets-values.yml b/blueprints/02-at-scale/k8s/secrets-values.yml index a3c69766..71ebebd4 100644 --- a/blueprints/02-at-scale/k8s/secrets-values.yml +++ b/blueprints/02-at-scale/k8s/secrets-values.yml @@ -1,10 +1,8 @@ # Copyright (c) CloudBees, Inc. -# IMPORTANT: Secrets must be parametrized. +# IMPORTANT: Secrets must be parametrized or encrypted if they are saved in SCM. sec_globalPassword: ${global_password} +sec_adminMail : ${adminMail} sec_s3bucketName: ${s3bucketName} sec_awsRegion: ${awsRegion} -sec_adminMail : ${adminMail} -sec_githubUser: ${githubUser} -sec_githubToken: ${githubToken} diff --git a/blueprints/02-at-scale/k8s/vault-config.sh b/blueprints/02-at-scale/k8s/vault-config.sh new file mode 100644 index 00000000..4f77929a --- /dev/null +++ b/blueprints/02-at-scale/k8s/vault-config.sh @@ -0,0 +1,38 @@ +#!/usr/bin/env bash + +# Copyright (c) CloudBees, Inc. + +set -xeuo pipefail + +# Vault namespace +vault_ns="${1:-vault}" +# App role name +approle="cbci-oc" + +# https://github.com/hashicorp/terraform-aws-hashicorp-vault-eks-addon?tab=readme-ov-file#usage +## Useal the vault +for i in {1..3}; do + read -r -p "INFO: Enter Unseal Key number $i [press Enter]: " key + if [ -z "$key" ]; then + echo "ERROR: Empty key is not allowed" && exit 1 + fi + kubectl exec -it vault-0 -n "$vault_ns" -- vault operator unseal "$key" +done +# https://developer.hashicorp.com/vault/tutorials/auth-methods/approle +## Login as admin using token +kubectl exec -it vault-0 -n "$vault_ns" -- vault login +## Create example secrets to be mapped from CloudBees CI +kubectl exec -it vault-0 -n "$vault_ns" -- vault secrets enable --version=2 --path=secret-v2 kv || echo "Path is already enabled" +kubectl exec -it vault-0 -n "$vault_ns" -- vault kv put "secret-v2/$approle/secret-a" username="userVaultExample" password="passw0rdVaultExample" +kubectl exec -it vault-0 -n "$vault_ns" -- vault kv put "secret-v2/$approle/secret-b" secret="secretVaultExample" +kubectl exec -it vault-0 -n "$vault_ns" -- vault auth enable approle || echo "Path is already in use at approle" +## Create App Role to connect cloudbees CI to Vault +kubectl exec -it vault-0 -n "$vault_ns" -- vault policy write "$approle" -<