From f6244ca4074bf08523c79086435442dd7e61cd5a Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 12 Jul 2024 23:15:22 +0200 Subject: [PATCH 001/180] upgrade to 2.452.3.2 --- blueprints/.k8s.env | 2 +- main.tf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/blueprints/.k8s.env b/blueprints/.k8s.env index 80e44453..f3bab735 100644 --- a/blueprints/.k8s.env +++ b/blueprints/.k8s.env @@ -3,6 +3,6 @@ # K8s support: https://docs.cloudbees.com/docs/cloudbees-common/latest/supported-platforms/cloudbees-ci-cloud#_kubernetes vK8=1.28 # CloudBees CI Chart versions: https://artifacthub.io/packages/helm/cloudbees/cloudbees-core/ -vCBCI_Helm=3.18072.0+dc5abfae7856 +vCBCI_Helm=3.18306.0+b5ad27c80a6b # AWS Terraform EKS Blueprint Addons Module https://github.com/aws-ia/terraform-aws-eks-blueprints-addons/releases vEKSBpAddonsTFMod=1.15.1 diff --git a/main.tf b/main.tf index fde317c2..4a53ac3d 100644 --- a/main.tf +++ b/main.tf @@ -108,7 +108,7 @@ resource "helm_release" "cloudbees_ci" { description = try(var.helm_config.description, null) chart = "cloudbees-core" #vCBCI_Helm# - version = try(var.helm_config.version, "3.18072.0+dc5abfae7856") + version = try(var.helm_config.version, "3.18306.0+b5ad27c80a6b") repository = try(var.helm_config.repository, "https://public-charts.artifacts.cloudbees.com/repository/public/") values = local.create_secret ? concat(var.helm_config.values, local.oc_secrets_mount, [templatefile("${path.module}/values.yml", local.cbci_template_values)]) : concat(var.helm_config.values, [templatefile("${path.module}/values.yml", local.cbci_template_values)]) timeout = try(var.helm_config.timeout, 1200) From f770c32de7f86344e71cb447608477c74ec361b1 Mon Sep 17 00:00:00 2001 From: "cloudbees-platform[bot]" <138695131+cloudbees-platform[bot]@users.noreply.github.com> Date: Fri, 12 Jul 2024 21:55:09 +0000 Subject: [PATCH 002/180] test --- .cloudbees/workflows/my-test.yaml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 .cloudbees/workflows/my-test.yaml diff --git a/.cloudbees/workflows/my-test.yaml b/.cloudbees/workflows/my-test.yaml new file mode 100644 index 00000000..a730b4a6 --- /dev/null +++ b/.cloudbees/workflows/my-test.yaml @@ -0,0 +1,20 @@ +apiVersion: automation.cloudbees.io/v1alpha1 +kind: workflow +name: My workflow + +on: + push: + branches: + - '**' + +jobs: + stage: + steps: + - name: Dump GitHub context + uses: docker://cgr.dev/chainguard/wolfi-base:latest + env: + CLOUDBEES_CONTEXT: ${{ toJSON(cloudbees) }} + run: | + echo "----- CONTEXT ------" + echo "cloudbees.scm.sha: ${{ cloudbees.scm.sha }}" + echo "$CLOUDBEES_CONTEXT" From 29bd2138a7a81e9cba0925aeb49e9a196895d054 Mon Sep 17 00:00:00 2001 From: "cloudbees-platform[bot]" <138695131+cloudbees-platform[bot]@users.noreply.github.com> Date: Fri, 12 Jul 2024 21:55:44 +0000 Subject: [PATCH 003/180] moving to manual --- .cloudbees/workflows/my-test.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.cloudbees/workflows/my-test.yaml b/.cloudbees/workflows/my-test.yaml index a730b4a6..d9a7aefd 100644 --- a/.cloudbees/workflows/my-test.yaml +++ b/.cloudbees/workflows/my-test.yaml @@ -3,9 +3,7 @@ kind: workflow name: My workflow on: - push: - branches: - - '**' + workflow_dispatch: jobs: stage: From 1ef5631e0e55fee37d0b928a03c7562cc81cea37 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 15 Jul 2024 17:21:26 +0200 Subject: [PATCH 004/180] Clarifying Container Launch performance on Windows --- blueprints/02-at-scale/README.md | 43 +++++++++++++++++++------------- 1 file changed, 25 insertions(+), 18 deletions(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index c1594163..ee153561 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -38,16 +38,17 @@ Once you have familiarized yourself with [CloudBees CI blueprint add-on: Get sta This blueprint divides scalable node groups for different types of workloads: -- Shared node group services: For common/shared workloads using [Amazon EKS-Optimized Amazon Linux 2023](https://aws.amazon.com/blogs/containers/amazon-eks-optimized-amazon-linux-2023-amis-now-available/) Amazon Machine Image (AMI) type. +- Shared node group services (role: `shared`): For common/shared workloads using [Amazon EKS-Optimized Amazon Linux 2023](https://aws.amazon.com/blogs/containers/amazon-eks-optimized-amazon-linux-2023-amis-now-available/) Amazon Machine Image (AMI) type. - CloudBees CI node groups: - - Services instance type: [AWS Graviton Processor](https://aws.amazon.com/ec2/graviton/) and [Bottlerocket OS](https://aws.amazon.com/bottlerocket/) AMI type. - - It uses an [instance profile](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html) for operating with AWS Services. However, the recommended options are explained in [#56](https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon/issues/56). - - Ephemeral agents: - - Linux: [AWS Graviton Processor](https://aws.amazon.com/ec2/graviton/) and [Bottlerocket OS](https://aws.amazon.com/bottlerocket/) AMI type and includes on-demand and Spot capacity types. The Spot agent node groups follow the principles described in [Building for Cost Optimization and Resilience for EKS with Spot Instances](https://aws.amazon.com/blogs/compute/cost-optimization-and-resilience-eks-with-spot-instances/). - - Windows: Windows 2019 AMI type. + - CI Services (role: `cb-apps`) + - Services instance type: [AWS Graviton Processor](https://aws.amazon.com/ec2/graviton/) and [Bottlerocket OS](https://aws.amazon.com/bottlerocket/) AMI type. + - It uses an [instance profile](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html) for operating with AWS Services permissions (eg. s3 Buckets). However, the recommended options are explained in [Issue 56](https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon/issues/56). + - CI Agents (Ephemeral): + - Linux: [AWS Graviton Processor](https://aws.amazon.com/ec2/graviton/) and [Bottlerocket OS](https://aws.amazon.com/bottlerocket/) AMI type and includes on-demand (role: `build-linux`) and Spot (role: `build-linux-spot`) capacity types. The Spot agent node groups follow the principles described in [Building for Cost Optimization and Resilience for EKS with Spot Instances](https://aws.amazon.com/blogs/compute/cost-optimization-and-resilience-eks-with-spot-instances/). + - Windows (role: `build-windows`): Windows 2019 AMI type. -> [!NOTE] -> If your user credentials do not include an AWS identity and IAM permissions, the credentials validation from the CloudBees CI UI will fail. +> [!IMPORTANT] +> It is known that Linux container lunch time are faster than Windows container. That reality can be improved by using a cache container image strategy (see [Speeding up Windows container launch times with EC2 Image builder and image cache strategy](https://aws.amazon.com/blogs/containers/speeding-up-windows-container-launch-times-with-ec2-image-builder-and-image-cache-strategy/) and more about [Windows Container Best Practices](https://aws.github.io/aws-eks-best-practices/windows/docs/ami/)). Alternatively to Windows Containes, it is possible to use Windows VMs using [Shared Agent](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/shared-agents). ![Architecture](img/at-scale.architect.drawio.svg) @@ -153,7 +154,7 @@ Once the resources have been created, a `kubeconfig` file is created in the [/k8 > [!NOTE] > There are differences in CloudBees CI permissions and folder restrictions when signed in as a user of the Admin group versus the Development group. For example, only Admin users have access to the agent validation jobs. -1. CasC is enabled for the [operations center](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-oc/) (`cjoc`) and [controllers](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-controller/) (`team-b` and `team-c-ha`). `team-a` is not using CasC, to illustrate the difference between the two approaches. Issue the following command to verify that all controllers are in a `Running` state: +3. CasC is enabled for the [operations center](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-oc/) (`cjoc`) and [controllers](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-controller/) (`team-b` and `team-c-ha`). `team-a` is not using CasC, to illustrate the difference between the two approaches. Issue the following command to verify that all controllers are in a `Running` state: ```sh eval $(terraform output --raw cbci_controllers_pods) @@ -161,13 +162,15 @@ Once the resources have been created, a `kubeconfig` file is created in the [/k8 If successful, it should indicate that 2 replicas are running for `team-c-ha` since [CloudBees CI HA/HS](https://docs.cloudbees.com/docs/cloudbees-ci/latest/ha-install-guide/) is enabled on this controller. -2. Issue the following command to verify that horizontal pod autoscaling is enabled for `team-c-ha`: +4. Issue the following command to verify that horizontal pod autoscaling is enabled for `team-c-ha`: ```sh eval $(terraform output --raw cbci_controller_c_hpa) ``` -3. Issue the following command to retrieve an [API token](https://docs.cloudbees.com/docs/cloudbees-ci-api/latest/api-authentication) for the `admin_cbci_a` user with the correct permissions for the required actions: +#### Builds + +1. For the following validations, builds will be triggered remotely. Start by issuing the following command to retrieve an [API token](https://docs.cloudbees.com/docs/cloudbees-ci-api/latest/api-authentication) for the `admin_cbci_a` user with the correct permissions for the required actions: ```sh eval $(terraform output --raw cbci_oc_export_admin_crumb) && \ @@ -181,31 +184,35 @@ Once the resources have been created, a `kubeconfig` file is created in the [/k8 eval $(terraform output --raw cbci_liveness_probe_ext) ``` -4. Once you have retrieved the API token, issue the following commands to remotely trigger builds using the [POST queue for hibernation API endpoint](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/managing-controllers#_post_queue_for_hibernation). If successful, an `HTTP/2 201` response is returned, indicating the REST API call has been correctly received by the CloudBees CI controller. +2. Once you have retrieved the API token, issue the following commands to trigger builds using the [POST queue for hibernation API endpoint](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/managing-controllers#_post_queue_for_hibernation). If successful, an `HTTP/2 201` response is returned, indicating the REST API call has been correctly received by the CloudBees CI controller. -- `ws-cache` pipeline from `team-b` using Linux Nodes Pools: +- For Linux node pools use: ```sh eval $(terraform output --raw cbci_controller_b_ws_cache_build) ``` -This pipeline uses [CloudBees Workspace Caching](https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-cache-step). Once the second build is complete, you can find the read cache operation at the beginning of the build logs and the write cache operation at the end of the build logs. + It triggers `ws-cache` pipeline from `team-b` controller. This pipeline uses [CloudBees Workspace Caching](https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-cache-step). Once the second build is complete, you can find the read cache operation at the beginning of the build logs and the write cache operation at the end of the build logs. -- `windows-build-nodes` pipeline from `team-c-ha` using Windows Nodes Pools: + Note that this pipeline uses the On-Demand Linux Node Pool but there is also Spot Linux Node Pool available. +- For Windows node pool use: + ```sh eval $(terraform output --raw cbci_controller_c_windows_node_build) ``` -The first build for a new Windows image container takes up to 10 minutes to run; subsequent builds should take seconds to run. + It triggers `windows-build-nodes` pipeline from `team-c-ha` controller. + + Note that the first build for a new Windows image container can take up to 10 minutes to run; subsequent builds should take seconds to run. This behavior can be improved as explained in the section [Architecture](#architecture). -7. Right after triggering the builds, issue the following to validate pod agent provisioning to build the pipeline code: +3. Right after triggering the builds, issue the following to validate pod agent provisioning to build the pipeline code: ```sh eval $(terraform output --raw cbci_agents_pods) ``` -8. Check build logs by signing in to the `team-b` and `team-c-ha` controllers, respectively. Navigate to the pipeline jobs and select the first build, indicated by the `#1` build number. [CloudBees Pipeline Explorer](https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-pipeline-explorer-plugin) is enabled as a default. +4. Check build logs by signing in to the `team-b` and `team-c-ha` controllers, respectively. Navigate to the pipeline jobs and select the first build, indicated by the `#1` build number. [CloudBees Pipeline Explorer](https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-pipeline-explorer-plugin) is enabled as a default. #### Back up and restore From e07a6a8389fc1d7959538d69e4016d9e79e00a4b Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Sun, 21 Jul 2024 18:21:19 +0200 Subject: [PATCH 005/180] Adding configuration for vault --- blueprints/02-at-scale/casc/mc/parent/jcasc/main.yaml | 2 +- .../casc/mc/parent/variables/variables.yaml | 1 + blueprints/02-at-scale/casc/oc/jcasc/security.yaml | 11 +++++++++++ .../02-at-scale/casc/oc/variables/variables.yaml | 1 + 4 files changed, 14 insertions(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/casc/mc/parent/jcasc/main.yaml b/blueprints/02-at-scale/casc/mc/parent/jcasc/main.yaml index 4484d079..ff7bd993 100644 --- a/blueprints/02-at-scale/casc/mc/parent/jcasc/main.yaml +++ b/blueprints/02-at-scale/casc/mc/parent/jcasc/main.yaml @@ -40,7 +40,7 @@ aws: s3: container: "${sec_s3bucketName}" disableSessionToken: false - prefix: "cbci/" + prefix: "${s3bucketPreffix}" useHttp: false usePathStyleUrl: false useTransferAcceleration: false diff --git a/blueprints/02-at-scale/casc/mc/parent/variables/variables.yaml b/blueprints/02-at-scale/casc/mc/parent/variables/variables.yaml index f4cec083..9bcb6e10 100644 --- a/blueprints/02-at-scale/casc/mc/parent/variables/variables.yaml +++ b/blueprints/02-at-scale/casc/mc/parent/variables/variables.yaml @@ -1,2 +1,3 @@ variables: - ot_endpoint: "http://tempo.kube-prometheus-stack.svc.cluster.local:4317" + - s3bucketPreffix: "cbci/" diff --git a/blueprints/02-at-scale/casc/oc/jcasc/security.yaml b/blueprints/02-at-scale/casc/oc/jcasc/security.yaml index 1eaa4f83..169d50f7 100644 --- a/blueprints/02-at-scale/casc/oc/jcasc/security.yaml +++ b/blueprints/02-at-scale/casc/oc/jcasc/security.yaml @@ -13,6 +13,17 @@ jenkins: crumbIssuer: standard: excludeClientIPFromCrumb: true +globalCredentialsConfiguration: + vaultGlobalConfiguration: + authentications: + - appRoleAuthentication: + id: "cloudbees" + roleId: "REPLACE_ME" + secretId: "REPLACE_ME" + clusterConsistency: + mode: RETRY + skipSslVerification: true + url: "${vault_url}" credentials: system: domainCredentials: diff --git a/blueprints/02-at-scale/casc/oc/variables/variables.yaml b/blueprints/02-at-scale/casc/oc/variables/variables.yaml index 4ff2401e..91cc2e3b 100644 --- a/blueprints/02-at-scale/casc/oc/variables/variables.yaml +++ b/blueprints/02-at-scale/casc/oc/variables/variables.yaml @@ -6,3 +6,4 @@ variables: - ldapRootDN: "dc=acme,dc=org" - ldapServer: "openldap-stack.auth.svc.cluster.local" - ldapUserSearch: "cn={0}" + - vault_url: "http://vault.vault.svc.cluster.local:8200" From 583349853dbe8ad7c5e99320f37cdd3a7fcfa971 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Sun, 21 Jul 2024 18:22:46 +0200 Subject: [PATCH 006/180] casc: testin vault branch --- blueprints/02-at-scale/casc/oc/items/root.yaml | 4 ++-- blueprints/02-at-scale/casc/oc/variables/variables.yaml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/blueprints/02-at-scale/casc/oc/items/root.yaml b/blueprints/02-at-scale/casc/oc/items/root.yaml index 1af796d2..73de0999 100644 --- a/blueprints/02-at-scale/casc/oc/items/root.yaml +++ b/blueprints/02-at-scale/casc/oc/items/root.yaml @@ -53,7 +53,7 @@ items: "cloudbees.prometheus": "true" properties: - configurationAsCode: - bundle: "main/none-ha" + bundle: "vault/none-ha" # Casc, HA - kind: managedController name: team-c-ha @@ -100,4 +100,4 @@ items: "cloudbees.prometheus": "true" properties: - configurationAsCode: - bundle: "main/ha" + bundle: "vault/ha" diff --git a/blueprints/02-at-scale/casc/oc/variables/variables.yaml b/blueprints/02-at-scale/casc/oc/variables/variables.yaml index 91cc2e3b..4634eb29 100644 --- a/blueprints/02-at-scale/casc/oc/variables/variables.yaml +++ b/blueprints/02-at-scale/casc/oc/variables/variables.yaml @@ -1,7 +1,7 @@ variables: - message: "Welcome to the CloudBees CI blueprint add-on: At scale!" - scmCascMmStore: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - - cascBranch: main + - cascBranch: vault - ldapManagerDN: "cn=admin,dc=acme,dc=org" - ldapRootDN: "dc=acme,dc=org" - ldapServer: "openldap-stack.auth.svc.cluster.local" From b27b7871d1cede0acde672251e2242a9df4903bf Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Sun, 21 Jul 2024 18:24:16 +0200 Subject: [PATCH 007/180] casc: comenting casc branch for testing --- .../02-at-scale/casc/oc/jcasc/security.yaml | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/blueprints/02-at-scale/casc/oc/jcasc/security.yaml b/blueprints/02-at-scale/casc/oc/jcasc/security.yaml index 169d50f7..69cd3c82 100644 --- a/blueprints/02-at-scale/casc/oc/jcasc/security.yaml +++ b/blueprints/02-at-scale/casc/oc/jcasc/security.yaml @@ -13,17 +13,17 @@ jenkins: crumbIssuer: standard: excludeClientIPFromCrumb: true -globalCredentialsConfiguration: - vaultGlobalConfiguration: - authentications: - - appRoleAuthentication: - id: "cloudbees" - roleId: "REPLACE_ME" - secretId: "REPLACE_ME" - clusterConsistency: - mode: RETRY - skipSslVerification: true - url: "${vault_url}" +# globalCredentialsConfiguration: +# vaultGlobalConfiguration: +# authentications: +# - appRoleAuthentication: +# id: "cloudbees" +# roleId: "REPLACE_ME" +# secretId: "REPLACE_ME" +# clusterConsistency: +# mode: RETRY +# skipSslVerification: true +# url: "${vault_url}" credentials: system: domainCredentials: From a7ea4751dcab6e324f7456c9aee567a726140f69 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Sun, 21 Jul 2024 23:49:28 +0200 Subject: [PATCH 008/180] casc: Adding Hashicorp Vault --- .../casc/mc/parent/plugins/plugins.yaml | 1 + .../02-at-scale/casc/oc/jcasc/security.yaml | 20 +++++++++---------- .../02-at-scale/casc/oc/plugins/plugins.yaml | 1 + 3 files changed, 11 insertions(+), 11 deletions(-) diff --git a/blueprints/02-at-scale/casc/mc/parent/plugins/plugins.yaml b/blueprints/02-at-scale/casc/mc/parent/plugins/plugins.yaml index 35a18419..b352508f 100644 --- a/blueprints/02-at-scale/casc/mc/parent/plugins/plugins.yaml +++ b/blueprints/02-at-scale/casc/mc/parent/plugins/plugins.yaml @@ -7,6 +7,7 @@ plugins: - id: cloudbees-disk-usage-simple - id: cloudbees-groovy-view - id: cloudbees-jenkins-advisor + - id: cloudbees-hashicorp-vault - id: cloudbees-pipeline-explorer - id: cloudbees-prometheus - id: cloudbees-s3-cache diff --git a/blueprints/02-at-scale/casc/oc/jcasc/security.yaml b/blueprints/02-at-scale/casc/oc/jcasc/security.yaml index 69cd3c82..205359ee 100644 --- a/blueprints/02-at-scale/casc/oc/jcasc/security.yaml +++ b/blueprints/02-at-scale/casc/oc/jcasc/security.yaml @@ -13,17 +13,15 @@ jenkins: crumbIssuer: standard: excludeClientIPFromCrumb: true -# globalCredentialsConfiguration: -# vaultGlobalConfiguration: -# authentications: -# - appRoleAuthentication: -# id: "cloudbees" -# roleId: "REPLACE_ME" -# secretId: "REPLACE_ME" -# clusterConsistency: -# mode: RETRY -# skipSslVerification: true -# url: "${vault_url}" +globalCredentialsConfiguration: + vaultGlobalConfiguration: + authentications: + - appRoleAuthentication: + id: "cloudbees" + roleId: "REPLACE_ME" + secretId: "REPLACE_ME" + skipSslVerification: true + url: "${vault_url}" credentials: system: domainCredentials: diff --git a/blueprints/02-at-scale/casc/oc/plugins/plugins.yaml b/blueprints/02-at-scale/casc/oc/plugins/plugins.yaml index 2d0fa386..0dea082a 100644 --- a/blueprints/02-at-scale/casc/oc/plugins/plugins.yaml +++ b/blueprints/02-at-scale/casc/oc/plugins/plugins.yaml @@ -2,6 +2,7 @@ plugins: - id: cloudbees-casc-client - id: cloudbees-casc-items-commons - id: cloudbees-casc-items-server + - id: cloudbees-hashicorp-vault - id: cloudbees-jenkins-advisor - id: cloudbees-prometheus - id: github From f1362d8280431b793af939763f58fdab38e8581c Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 22 Jul 2024 22:54:00 +0200 Subject: [PATCH 009/180] casc: adding cbci-oc --- blueprints/02-at-scale/casc/oc/jcasc/security.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/casc/oc/jcasc/security.yaml b/blueprints/02-at-scale/casc/oc/jcasc/security.yaml index 205359ee..d87d4e0c 100644 --- a/blueprints/02-at-scale/casc/oc/jcasc/security.yaml +++ b/blueprints/02-at-scale/casc/oc/jcasc/security.yaml @@ -17,7 +17,7 @@ globalCredentialsConfiguration: vaultGlobalConfiguration: authentications: - appRoleAuthentication: - id: "cloudbees" + id: "cbci-oc" roleId: "REPLACE_ME" secretId: "REPLACE_ME" skipSslVerification: true From 62f4c507f96f035a1e82ad18676d4cd17d796566 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 23 Jul 2024 00:24:55 +0200 Subject: [PATCH 010/180] casc: Adding credentials --- .../casc/mc/parent/items/admin-folder.yaml | 26 +++++++++++++++++++ .../02-at-scale/casc/oc/jcasc/security.yaml | 22 ++++++++++++++++ 2 files changed, 48 insertions(+) diff --git a/blueprints/02-at-scale/casc/mc/parent/items/admin-folder.yaml b/blueprints/02-at-scale/casc/mc/parent/items/admin-folder.yaml index 7f1e6fca..ceb55391 100644 --- a/blueprints/02-at-scale/casc/mc/parent/items/admin-folder.yaml +++ b/blueprints/02-at-scale/casc/mc/parent/items/admin-folder.yaml @@ -291,6 +291,32 @@ items: } } description: 'Pipeline that demonstrates the usage of CloudBees Workspace Caching: https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-cache-step.' + - kind: pipeline + name: vault-credentials + concurrentBuild: true + definition: + cpsFlowDefinition: + sandbox: true + script: | + pipeline { + agent any + environment { + U1=credentials('cbci-oc-secret-a') + S1=credentials('cbci-oc_secret-b') + } + stages { + stage('Print credentials') { + steps { + sh ''' + echo 'Printing credentials from Vault' + echo $U1 + echo $S1 + ''' + } + } + } + } + description: '' properties: - envVars: {} - itemRestrictions: diff --git a/blueprints/02-at-scale/casc/oc/jcasc/security.yaml b/blueprints/02-at-scale/casc/oc/jcasc/security.yaml index d87d4e0c..56f52732 100644 --- a/blueprints/02-at-scale/casc/oc/jcasc/security.yaml +++ b/blueprints/02-at-scale/casc/oc/jcasc/security.yaml @@ -38,3 +38,25 @@ credentials: id: "GH-ST-token" scope: GLOBAL secret: ${sec_githubToken} + cloudbeesHashicorpVault: + domainCredentials: + - credentials: + - vaultUsernamePassword: + description: "cbci-oc/secret-a" + id: "cbci-oc_secret-a" + passwordKey: "password" + usernameKey: "username" + vaultSecretEngine: + genericKV2SecretEngine: + authenticationId: "cbci-oc" + mountPath: "secret-v2" + path: "cbci-oc/secret-a" + - vaultSecretText: + description: "cbci-oc/secret-b" + id: "cbci-oc_secret-b" + secretKey: "secret" + vaultSecretEngine: + genericKV2SecretEngine: + authenticationId: "cbci-oc" + mountPath: "secret-v2" + path: "cbci-oc/secret-b" \ No newline at end of file From dd3655c645f610c2b479bdd3318ea51cc684bffa Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Wed, 24 Jul 2024 13:40:45 +0200 Subject: [PATCH 011/180] Vault integration test and validated --- .../img/getting-started.k8s.drawio.svg | 39 +- blueprints/01-getting-started/main.tf | 2 +- blueprints/02-at-scale/README.md | 37 +- .../02-at-scale/img/at-scale.k8s.drawio.svg | 1038 ++++++++++++++++- blueprints/02-at-scale/k8s/cbci-values.yml | 2 +- blueprints/02-at-scale/k8s/vault-config.sh | 39 + blueprints/02-at-scale/k8s/vault-values.yml | 43 + blueprints/02-at-scale/main.tf | 79 +- blueprints/02-at-scale/outputs.tf | 16 +- variables.tf | 2 +- 10 files changed, 1237 insertions(+), 60 deletions(-) create mode 100644 blueprints/02-at-scale/k8s/vault-config.sh create mode 100644 blueprints/02-at-scale/k8s/vault-values.yml diff --git a/blueprints/01-getting-started/img/getting-started.k8s.drawio.svg b/blueprints/01-getting-started/img/getting-started.k8s.drawio.svg index 2996fec8..eeb30b9f 100644 --- a/blueprints/01-getting-started/img/getting-started.k8s.drawio.svg +++ b/blueprints/01-getting-started/img/getting-started.k8s.drawio.svg @@ -1,4 +1,4 @@ - + @@ -102,12 +102,12 @@ - - + + -
+
Amazon Route 53 @@ -117,14 +117,14 @@
- - Amazon Route... + + Amazon Rout... - - - + + + @@ -215,12 +215,12 @@ - - + + -
+
@@ -232,14 +232,19 @@
- + cbci - - - + + + + + + cjoc + + @@ -249,4 +254,4 @@ - + \ No newline at end of file diff --git a/blueprints/01-getting-started/main.tf b/blueprints/01-getting-started/main.tf index d1a18a51..0c02bef7 100644 --- a/blueprints/01-getting-started/main.tf +++ b/blueprints/01-getting-started/main.tf @@ -28,7 +28,7 @@ locals { # EKS: Add-ons ################################################################################ -# CloudBees CI Add-ons +# CloudBees CI Add-on module "eks_blueprints_addon_cbci" { source = "cloudbees/cloudbees-ci-eks-addon/aws" diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index ee153561..0616db5f 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -25,6 +25,7 @@ Once you have familiarized yourself with [CloudBees CI blueprint add-on: Get sta | [Helm Openldap](https://github.com/jp-gouin/helm-openldap/tree/master) | LDAP server for Kubernetes. | | [AWS Node Termination Handler](https://github.com/aws/aws-node-termination-handler) | Gracefully handles EC2 instance shutdown within Kubernetes. Note that this add-on is not compatible with managed instance groups. For more information, refer to [issue #23](https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon/issues/23). | | [Grafana Tempo](https://grafana.com/oss/tempo/) | Provides backend tracing for [Jenkins OpenTelemetry](https://plugins.jenkins.io/opentelemetry/). | + | [Hashicorp Vault](https://github.com/hashicorp/vault-helm) | Secrets management system that is integrated via [CloudBees HashiCorp Vault Plugin](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-secure-guide/hashicorp-vault-plugin). | - Cloudbees CI uses [Configuration as Code (CasC)](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-oc/casc-intro) (refer to the [casc](casc) folder) to enable [exciting new features for streamlined DevOps](https://www.cloudbees.com/blog/cloudbees-ci-exciting-new-features-for-streamlined-devops) and other enterprise features, such as [CloudBees CI hibernation](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/managing-controllers#_hibernation_in_managed_masters). - The operations center is using the [CasC Bundle Retriever](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-oc/bundle-retrieval-scm). @@ -151,10 +152,10 @@ Once the resources have been created, a `kubeconfig` file is created in the [/k8 eval $(terraform output --raw global_password) ``` -> [!NOTE] -> There are differences in CloudBees CI permissions and folder restrictions when signed in as a user of the Admin group versus the Development group. For example, only Admin users have access to the agent validation jobs. + > [!NOTE] + > There are differences in CloudBees CI permissions and folder restrictions when signed in as a user of the Admin group versus the Development group. For example, only Admin users have access to the agent validation jobs. -3. CasC is enabled for the [operations center](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-oc/) (`cjoc`) and [controllers](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-controller/) (`team-b` and `team-c-ha`). `team-a` is not using CasC, to illustrate the difference between the two approaches. Issue the following command to verify that all controllers are in a `Running` state: +3. CasC is enabled for the [operations center](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-oc/) (`cjoc`) and [controllers](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-controller/) (`team-b` and `team-c-ha`). `team-a` is not using CasC, to illustrate the difference between the two approaches. Issue the following command to verify that all controllers are Running: ```sh eval $(terraform output --raw cbci_controllers_pods) @@ -168,6 +169,36 @@ Once the resources have been created, a `kubeconfig` file is created in the [/k8 eval $(terraform output --raw cbci_controller_c_hpa) ``` +#### Secrets Management + +##### Kubernetes Secret + +The secrets key/value file defined in [k8s/secrets-values.yml](k8s/secrets-values.yml) is converted into a Kubernetes secret (`cbci-secrets`) and mounted into /run/secrets/ for Operation Center and Controllers to be consumed via CloudBees Casc. See [Configuration as Code - Handling Secrets - Kubernetes Secrets](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets) for more information. Beyond the CloudBees CI Addon, Kubernetes secrets can be also created via [External Secret Operators](https://aws-ia.github.io/terraform-aws-eks-blueprints-addons/main/addons/external-secrets/). + +> [!NOTE] +> Kubernetes secrets can be also be retrived as Jenkins Credentials via using the [Kubernetes Credentials Provider plugin](https://jenkinsci.github.io/kubernetes-credentials-provider-plugin/). + +##### HashiCorp Vault + +HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in this blueprint. + +1. Run the configure Hashicorp Vault script. Keep in a safe place Admin Token and Unseal Keys (saved in `k8s/vault-init.log`) as well as Role ID and Secret ID for `cbci-oc` App Role. + + ```sh + eval $(terraform output --raw vault_configure) + ``` + +2. Access the HashiCorp Vault UI by issuing the following command. Enter the root token to log in from the _step 1_. + + ```sh + eval $(terraform output --raw vault_dashboard) + ``` + +3. Access with admin role to CloudBees CI Operation Center and complete the configuration for the CloudBees CI Vault Plugin by entering the Role ID and Secret ID for `cbci-oc` App Role from _step 1_ in _Manage Jenkins_ > _Credentials Providers_ > _HashiCorp Vault Credentials Provider_. Click on `Test Connection` to verify the inputs are right. Finally, move to `team-b` or `team-c-ha` to run the pipeline _admin_ > _validations_ > _vault-credentials_ and validate that credentials are fetched correctly from Hashicorp Vault. + +> [!NOTE] +> Hashicorp Vault can be also be configured to be used for [Configuration as Code - Handling Secrets - Vault](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#hashicorp-vault-secret-source). + #### Builds 1. For the following validations, builds will be triggered remotely. Start by issuing the following command to retrieve an [API token](https://docs.cloudbees.com/docs/cloudbees-ci-api/latest/api-authentication) for the `admin_cbci_a` user with the correct permissions for the required actions: diff --git a/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg b/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg index 2d02feff..7f04b4f6 100644 --- a/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg +++ b/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg @@ -1,4 +1,1034 @@ - - - -
do
do
AWS Cloud
AWS Cloud
4
4
/velero
/velero
Amazon S3 bucket
Amazon S3 b...
Metric servers
Metric serv...
Amazon EFS
CSI driver
Amazon EFS...
Amazon EBS
CSI driver
Amazon EBS...
Autoscaler
Autoscaler
AWS Load
Balancer
AWS Load...
Autoscaling
group
Autoscal...
Amazon EFS
Amazon EFS
Amazon EBS
Amazon E...
kube-system
kube-system
/cbci
/cbci
CloudWatch
CloudWatch
EKS
EKS
ALB
ALB
external-dns
external-dns
Backup/Restore
Backup/Restore
Long-term logs
Long-term logs
Fluent Bit
Fluent Bit
Amazon Route 53
hosted zone
Amazon Route 53...
auth
auth
Backup/Restore
Backup/Restore
Workspace
cache
Workspace...
Artifacts
Artifacts
/fluentbit
/fluentbit
kube-prometheus-stack
kube-prometheus-stack
Node Terminator
Handler
Node Termin...
bottle-rocket-operator
bottle-rocket-oper...
cbci-agents
(Ephemeral agents)
cbci-agents...
cbci
(Operations center & controller services)
cbci...


cbci-secrets
cbci-secrets
Hibernation
Monitor
Hibernatio...
Short-term logs
Short-term logsTempoPrometheusGrafana
velero
velero
cert-manager
cert-managerText is not SVG - cannot display + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
+
+ + AWS Cloud + +
+
+
+ + + AWS Cloud + + + + + + + +
+
+
+ 4 +
+
+
+ + + 4 + + + + + + + + +
+
+
+ do +
+
+
+
+ + + do + + + + + + + + + + + +
+
+
+ + /velero + +
+
+
+ + + /velero + + + + + + + + +
+
+
+ Amazon S3 bucket +
+
+
+ + + Amazon S3 bu... + + + + + + + + + +
+
+
+ + Metric servers +
+ +
+
+
+ + + Metric serve... + + + + + + + + + +
+
+
+ + Amazon EFS +
+ CSI driver + +
+
+
+ + + Amazon EFS... + + + + + + + + + +
+
+
+ + Amazon EBS +
+ CSI driver + +
+
+
+ + + Amazon EBS... + + + + + + + + + +
+
+
+ + Autoscaler +
+ +
+
+
+ + + Autoscaler + + + + + + + + + +
+
+
+ + AWS Load +
+ Balancer +
+ +
+
+
+ + + AWS Load... + + + + + + + + + + + +
+
+
+ Autoscaling +
+ group +
+
+
+ + + Autoscal... + + + + + + + + +
+
+
+ Amazon EFS +
+
+
+ + + Amazon EFS + + + + + + + + +
+
+
+ + Amazon EBS +
+ +
+
+
+ + + Amazon E... + + + + + + + +
+
+
+ + + kube-system + + +
+
+
+ + + kube-system + + + + + + + + + + + + + + + + + + + + + +
+
+
+ + /cbci + +
+
+
+ + + /cbci + + + + + + + + +
+
+
+ CloudWatch +
+
+
+ + + CloudWatch + + + + + + + + + + + +
+
+
+ EKS +
+
+
+ + + EKS + + + + + + + + +
+
+
+ ALB +
+
+
+ + + ALB + + + + + + + + +
+
+
+ + + external-dns + + +
+
+
+ + + external-dns + + + + + + + + + + +
+
+
+ + + Backup/Restore + + +
+
+
+ + + Backup/Restore + + + + + + + + + + +
+
+
+ + + Long-term logs + + +
+
+
+ + + Long-term logs + + + + + + + + + +
+
+
+ + + Fluent Bit + + +
+
+
+ + + Fluent Bit + + + + + + + + + +
+
+
+ + Amazon Route 53 + +
+ + hosted zone + +
+
+
+ + + Amazon Route 53... + + + + + + + +
+
+
+ + /fluentbit + +
+
+
+ + + /fluentbit + + + + + + + + + +
+
+
+ + + kube-prometheus-stack + + +
+
+
+ + + kube-prometheus-stack + + + + + + + + + + +
+
+
+ + Node Terminator +
+ Handler +
+ +
+
+
+ + + Node Termina... + + + + + + + + +
+
+
+ + + bottle-rocket-operator + + +
+
+
+ + + bottle-rocket-oper... + + + + + + + + + + + +
+
+
+ + + Short-term logs + + +
+
+
+ + + Short-term logs + + + + + + + +
+
+
+ + + + velero + + + +
+
+
+ + + velero + + + + + + + +
+
+
+ + + + cert-manager + + + +
+
+
+ + + cert-manager + + + + + + + + + + +
+
+
+ + + + cbci-agents + +
+ + +
+
+
+ + + cbci-agents + + + + + + + +
+
+
+ + + + cbci + +
+
+ + +
+
+
+ + + cbci... + + + + + + + + + + + + +
+
+
+ +
+ +
+
+
+ + + + + + + + + + + + +
+
+
+ +
+ +
+
+
+ + + + + + + + + + + + + + + +
+
+
+ + cbci-secrets + +
+
+
+ + + cbci-secrets + + + + + + + cjoc + + + + + + + + +
+
+
+ + Hibernation + +
+ + Monitor + + +
+ +
+
+
+ + + Hibernati... + + + + + + + team-b + + + + + + team-a + + + + + + + + + team-c-ha + + + + + + + +
+
+
+ + + + auth + + + +
+
+
+ + + auth + + + + + + + + + + + + + Tempo + + + + + + Prometheus + + + + + + Grafana + + + + + + + + + + +
+
+
+ + + + vault + + + +
+
+
+ + + vault + + + + + + + + + +
+
+
+ + + + cbci + +
+ + +
+
+
+ + + cbci + + + + + + + +
+
+
+ + Workspace cache + +
+
+
+ + + Workspace cache + + + + + + + + + +
+
+
+ + + Backup/Restore + + +
+
+
+ + + Backup/Restore + + + + + + + +
+
+
+ + + Artifacts + + +
+
+
+ + + Artifacts + + + + + + + + + + Text is not SVG - cannot display + + + + \ No newline at end of file diff --git a/blueprints/02-at-scale/k8s/cbci-values.yml b/blueprints/02-at-scale/k8s/cbci-values.yml index ccb45097..dbdadc85 100644 --- a/blueprints/02-at-scale/k8s/cbci-values.yml +++ b/blueprints/02-at-scale/k8s/cbci-values.yml @@ -16,7 +16,7 @@ OperationsCenter: Retriever: Enabled: true scmRepo: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - scmBranch: main + scmBranch: vault scmBundlePath: blueprints/02-at-scale/casc/oc scmPollingInterval: PT20M Persistence: diff --git a/blueprints/02-at-scale/k8s/vault-config.sh b/blueprints/02-at-scale/k8s/vault-config.sh new file mode 100644 index 00000000..578247e6 --- /dev/null +++ b/blueprints/02-at-scale/k8s/vault-config.sh @@ -0,0 +1,39 @@ +#!/usr/bin/env bash + +# Copyright (c) CloudBees, Inc. + +set -xeuo pipefail + +HERE="$( cd -P "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" + +# Vault namespace +vault_ns="${1:-vault}" +# App role name +approle="cbci-oc" + +# https://github.com/hashicorp/terraform-aws-hashicorp-vault-eks-addon?tab=readme-ov-file#usage +## Init vault +kubectl exec -it vault-0 -n "$vault_ns" -- vault operator init | tee "$HERE/vault-init.log" || echo "Vault already initialized" +## Useal the vault +for i in {1..3}; do + read -r -p "Enter Unseal Key number $i: " key + kubectl exec -it vault-0 -n "$vault_ns" -- vault operator unseal "$key" +done +# https://developer.hashicorp.com/vault/tutorials/auth-methods/approle +## Login as admin using token +kubectl exec -it vault-0 -n "$vault_ns" -- vault login +## Create the secrets to be mapped from CloudBees CI +kubectl exec -it vault-0 -n "$vault_ns" -- vault secrets enable --version=2 --path=secret-v2 kv || echo "Path is already enabled" +kubectl exec -it vault-0 -n "$vault_ns" -- vault kv put "secret-v2/$approle/secret-a" username="userVaultExample" password="passw0rdVaultExample" +kubectl exec -it vault-0 -n "$vault_ns" -- vault kv put "secret-v2/$approle/secret-b" secret="secretVaultExample" +kubectl exec -it vault-0 -n "$vault_ns" -- vault auth enable approle || echo "Path is already in use at approle" +## Create App Role to connect cloudbees CI to Vault +kubectl exec -it vault-0 -n "$vault_ns" -- vault policy write "$approle" -< Date: Wed, 24 Jul 2024 11:56:06 +0000 Subject: [PATCH 012/180] terraform-docs: automated action --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 0ced2be1..ce7f3b36 100644 --- a/README.md +++ b/README.md @@ -95,7 +95,7 @@ The CloudBees CI add-on uses `helms release` for its resources definition, makin | cert_arn | AWS Certificate Manager (ACM) certificate for Amazon Resource Names (ARN). | `string` | n/a | yes | | hosted_zone | Amazon Route 53 hosted zone name. | `string` | n/a | yes | | trial_license | CloudBees CI trial license details for evaluation. | `map(string)` | n/a | yes | -| create_k8s_secrets | Create the Kubernetes cbci-secrets. It can be consumed by CloudBees CasC for the operations center. | `bool` | `false` | no | +| create_k8s_secrets | Create the Kubernetes secret cbci-secrets and mount into the Operation Center /run/secrets/ path to be consumed by CloudBees CasC. | `bool` | `false` | no | | helm_config | CloudBees CI Helm chart configuration. | `any` | 
{
  "values": [
    ""
  ]
}
| no | | k8s_secrets | Secrets .yml file as a string containing the names:values secrets. It is required when create_k8s_secrets is enabled. | `string` | `"secrets-values.yml"` | no | | prometheus_target | Creates a service monitor to discover the CloudBees CI Prometheus target dynamically. It is designed to be enabled with the AWS EKS Terraform Addon Kube Prometheus Stack. | `bool` | `false` | no | From 6d2496faaecc78ab5eece08e9ebf4e1e46a0f985 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Wed, 24 Jul 2024 11:56:09 +0000 Subject: [PATCH 013/180] terraform-docs: automated action --- blueprints/02-at-scale/README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 0616db5f..df7a67ac 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -109,6 +109,8 @@ This blueprint divides scalable node groups for different types of workloads: | s3_cbci_arn | CloudBees CI Amazon S3 bucket ARN. | | s3_cbci_name | CloudBees CI Amazon S3 bucket name. It is required by CloudBees CI for workspace caching and artifact management. | | s3_list_objects | Recursively lists all objects stored in the Amazon S3 bucket. | +| vault_configure | Provides access to Hashicorp Vault dashboard. It requires the root token from the vault_init output. | +| vault_dashboard | Provides access to Hashicorp Vault dashboard. It requires the root token from the vault_init output. | | velero_backup_on_demand | Takes an on-demand Velero backup from the schedule for the selected controller that is using block storage. | | velero_backup_schedule | Creates a Velero backup schedule for the selected controller that is using block storage, and then deletes the existing schedule, if it exists. | | velero_restore | Restores the selected controller that is using block storage from a backup. | From 4f1a606bbbd05e55c3f83c4cfeab598ded06f592 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Wed, 24 Jul 2024 14:20:26 +0200 Subject: [PATCH 014/180] Addressing Summet comments --- blueprints/02-at-scale/k8s/vault-config.sh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/k8s/vault-config.sh b/blueprints/02-at-scale/k8s/vault-config.sh index 578247e6..d0c1e80c 100644 --- a/blueprints/02-at-scale/k8s/vault-config.sh +++ b/blueprints/02-at-scale/k8s/vault-config.sh @@ -16,7 +16,10 @@ approle="cbci-oc" kubectl exec -it vault-0 -n "$vault_ns" -- vault operator init | tee "$HERE/vault-init.log" || echo "Vault already initialized" ## Useal the vault for i in {1..3}; do - read -r -p "Enter Unseal Key number $i: " key + read -r -p "INFO: Enter Unseal Key number $i: [press Enter]" key + if [ -z "$key" ]; then + echo "ERROR: Empty key is not allowed" && exit 1 + fi kubectl exec -it vault-0 -n "$vault_ns" -- vault operator unseal "$key" done # https://developer.hashicorp.com/vault/tutorials/auth-methods/approle From d3af92a4e5a998991923d29d6cbe426ab81e66d4 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Wed, 24 Jul 2024 14:25:48 +0200 Subject: [PATCH 015/180] typo --- blueprints/02-at-scale/k8s/vault-config.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/k8s/vault-config.sh b/blueprints/02-at-scale/k8s/vault-config.sh index d0c1e80c..619d9a1a 100644 --- a/blueprints/02-at-scale/k8s/vault-config.sh +++ b/blueprints/02-at-scale/k8s/vault-config.sh @@ -16,7 +16,7 @@ approle="cbci-oc" kubectl exec -it vault-0 -n "$vault_ns" -- vault operator init | tee "$HERE/vault-init.log" || echo "Vault already initialized" ## Useal the vault for i in {1..3}; do - read -r -p "INFO: Enter Unseal Key number $i: [press Enter]" key + read -r -p "INFO: Enter Unseal Key number $i [press Enter]: " key if [ -z "$key" ]; then echo "ERROR: Empty key is not allowed" && exit 1 fi From d002b320ddb1e4e64e9f5ce1a72b3cd4c78535eb Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Wed, 24 Jul 2024 14:30:16 +0200 Subject: [PATCH 016/180] Passing pre-commit --- .../img/getting-started.k8s.drawio.svg | 2 +- blueprints/02-at-scale/README.md | 2 +- .../02-at-scale/casc/oc/jcasc/security.yaml | 2 +- .../02-at-scale/img/at-scale.k8s.drawio.svg | 2 +- blueprints/02-at-scale/main.tf | 32 +++++++++---------- blueprints/02-at-scale/outputs.tf | 2 +- 6 files changed, 21 insertions(+), 21 deletions(-) diff --git a/blueprints/01-getting-started/img/getting-started.k8s.drawio.svg b/blueprints/01-getting-started/img/getting-started.k8s.drawio.svg index eeb30b9f..2f732413 100644 --- a/blueprints/01-getting-started/img/getting-started.k8s.drawio.svg +++ b/blueprints/01-getting-started/img/getting-started.k8s.drawio.svg @@ -254,4 +254,4 @@ - \ No newline at end of file + diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index df7a67ac..3972c625 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -230,7 +230,7 @@ HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in t Note that this pipeline uses the On-Demand Linux Node Pool but there is also Spot Linux Node Pool available. - For Windows node pool use: - + ```sh eval $(terraform output --raw cbci_controller_c_windows_node_build) ``` diff --git a/blueprints/02-at-scale/casc/oc/jcasc/security.yaml b/blueprints/02-at-scale/casc/oc/jcasc/security.yaml index 56f52732..c94f6139 100644 --- a/blueprints/02-at-scale/casc/oc/jcasc/security.yaml +++ b/blueprints/02-at-scale/casc/oc/jcasc/security.yaml @@ -59,4 +59,4 @@ credentials: genericKV2SecretEngine: authenticationId: "cbci-oc" mountPath: "secret-v2" - path: "cbci-oc/secret-b" \ No newline at end of file + path: "cbci-oc/secret-b" diff --git a/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg b/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg index 7f04b4f6..c28bba14 100644 --- a/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg +++ b/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg @@ -1031,4 +1031,4 @@ - \ No newline at end of file + diff --git a/blueprints/02-at-scale/main.tf b/blueprints/02-at-scale/main.tf index 66318fc1..5add09c0 100644 --- a/blueprints/02-at-scale/main.tf +++ b/blueprints/02-at-scale/main.tf @@ -10,7 +10,7 @@ locals { # Infra ############ - name = var.suffix == "" ? "cbci-bp02" : "cbci-bp02-${var.suffix}" + name = var.suffix == "" ? "cbci-bp02" : "cbci-bp02-${var.suffix}" vpc_name = "${local.name}-vpc" cluster_name = "${local.name}-eks" efs_name = "${local.name}-efs" @@ -22,8 +22,8 @@ locals { kubeconfig_file = "kubeconfig_${local.name}.yaml" kubeconfig_file_path = abspath("k8s/${local.kubeconfig_file}") - vpc_cidr = "10.0.0.0/16" - azs = slice(data.aws_availability_zones.available.names, 0, 3) + vpc_cidr = "10.0.0.0/16" + azs = slice(data.aws_availability_zones.available.names, 0, 3) route53_zone_id = data.aws_route53_zone.this.id route53_zone_arn = data.aws_route53_zone.this.arn @@ -45,7 +45,7 @@ locals { fluentbit_s3_location = "${module.cbci_s3_bucket.s3_bucket_arn}/fluentbit" velero_s3_location = "${module.cbci_s3_bucket.s3_bucket_arn}/velero" - epoch_millis = time_static.epoch.unix * 1000 + epoch_millis = time_static.epoch.unix * 1000 cloudwatch_logs_expiration_days = 7 s3_objects_expiration_days = 90 @@ -58,7 +58,7 @@ locals { # K8s Apps ############ - global_password = random_string.global_pass_string.result + global_password = random_string.global_pass_string.result global_pass_jsonpath = "'{.data.sec_globalPassword}'" bottlerocket_bootstrap_extra_args = <<-EOT @@ -78,14 +78,14 @@ locals { velero_schedule_name = "schedule-${local.velero_controller_backup}" hibernation_monitor_url = "https://hibernation-${module.eks_blueprints_addon_cbci.cbci_namespace}.${module.eks_blueprints_addon_cbci.cbci_domain_name}" - cbci_admin_user = "admin_cbci_a" - cbci_agents_ns = "cbci-agents" + cbci_admin_user = "admin_cbci_a" + cbci_agents_ns = "cbci-agents" #K8S agent template name from the CasC bundle cbci_agent_linuxtempl = "linux-mavenAndGo" cbci_agent_windowstempl = "windows-powershell" - - vault_ns = "vault" - vault_config_file_path = abspath("k8s/vault-config.sh") + + vault_ns = "vault" + vault_config_file_path = abspath("k8s/vault-config.sh") } resource "random_string" "global_pass_string" { @@ -321,13 +321,13 @@ module "eks_blueprints_addons" { })] } aws-node-termination-handler = { - name = "aws-node-termination-handler" - namespace = "kube-system" + name = "aws-node-termination-handler" + namespace = "kube-system" create_namespace = false - chart = "aws-node-termination-handler" - chart_version = "0.21.0" - repository = "https://aws.github.io/eks-charts" - values = [file("k8s/aws-node-term-handler-values.yml")] + chart = "aws-node-termination-handler" + chart_version = "0.21.0" + repository = "https://aws.github.io/eks-charts" + values = [file("k8s/aws-node-term-handler-values.yml")] } grafana-tempo = { name = "tempo" diff --git a/blueprints/02-at-scale/outputs.tf b/blueprints/02-at-scale/outputs.tf index 63b769de..4de09e3b 100644 --- a/blueprints/02-at-scale/outputs.tf +++ b/blueprints/02-at-scale/outputs.tf @@ -188,4 +188,4 @@ output "vault_configure" { output "vault_dashboard" { description = "Provides access to Hashicorp Vault dashboard. It requires the root token from the vault_init output." value = "kubectl port-forward svc/vault 50003:8200 -n ${local.vault_ns}" -} \ No newline at end of file +} From 43f95ce57dbeb563a3b9af6e65fb70d17e4eb04a Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Wed, 24 Jul 2024 14:39:00 +0200 Subject: [PATCH 017/180] Casc. set develop as casc branch --- blueprints/02-at-scale/casc/oc/items/root.yaml | 4 ++-- blueprints/02-at-scale/casc/oc/variables/variables.yaml | 2 +- blueprints/02-at-scale/k8s/cbci-values.yml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/blueprints/02-at-scale/casc/oc/items/root.yaml b/blueprints/02-at-scale/casc/oc/items/root.yaml index 73de0999..4b5ffaae 100644 --- a/blueprints/02-at-scale/casc/oc/items/root.yaml +++ b/blueprints/02-at-scale/casc/oc/items/root.yaml @@ -53,7 +53,7 @@ items: "cloudbees.prometheus": "true" properties: - configurationAsCode: - bundle: "vault/none-ha" + bundle: "develop/none-ha" # Casc, HA - kind: managedController name: team-c-ha @@ -100,4 +100,4 @@ items: "cloudbees.prometheus": "true" properties: - configurationAsCode: - bundle: "vault/ha" + bundle: "develop/ha" diff --git a/blueprints/02-at-scale/casc/oc/variables/variables.yaml b/blueprints/02-at-scale/casc/oc/variables/variables.yaml index 4634eb29..cda92353 100644 --- a/blueprints/02-at-scale/casc/oc/variables/variables.yaml +++ b/blueprints/02-at-scale/casc/oc/variables/variables.yaml @@ -1,7 +1,7 @@ variables: - message: "Welcome to the CloudBees CI blueprint add-on: At scale!" - scmCascMmStore: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - - cascBranch: vault + - cascBranch: develop - ldapManagerDN: "cn=admin,dc=acme,dc=org" - ldapRootDN: "dc=acme,dc=org" - ldapServer: "openldap-stack.auth.svc.cluster.local" diff --git a/blueprints/02-at-scale/k8s/cbci-values.yml b/blueprints/02-at-scale/k8s/cbci-values.yml index dbdadc85..4d816231 100644 --- a/blueprints/02-at-scale/k8s/cbci-values.yml +++ b/blueprints/02-at-scale/k8s/cbci-values.yml @@ -16,7 +16,7 @@ OperationsCenter: Retriever: Enabled: true scmRepo: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - scmBranch: vault + scmBranch: develop scmBundlePath: blueprints/02-at-scale/casc/oc scmPollingInterval: PT20M Persistence: From 1019b7126ec48af417bd618d3426e7c692180c55 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 26 Jul 2024 17:21:51 +0200 Subject: [PATCH 018/180] casc: adapt names for secrets --- blueprints/02-at-scale/casc/oc/items/root.yaml | 8 ++++---- blueprints/02-at-scale/casc/oc/variables/variables.yaml | 3 ++- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/blueprints/02-at-scale/casc/oc/items/root.yaml b/blueprints/02-at-scale/casc/oc/items/root.yaml index 4b5ffaae..675ec005 100644 --- a/blueprints/02-at-scale/casc/oc/items/root.yaml +++ b/blueprints/02-at-scale/casc/oc/items/root.yaml @@ -35,7 +35,7 @@ items: volumes: - name: cbci-secrets secret: - secretName: cbci-secrets + secretName: ${cascSecretsName} containers: - name: jenkins env: @@ -53,7 +53,7 @@ items: "cloudbees.prometheus": "true" properties: - configurationAsCode: - bundle: "develop/none-ha" + bundle: "cbci-agents-sec-docker/none-ha" # Casc, HA - kind: managedController name: team-c-ha @@ -82,7 +82,7 @@ items: volumes: - name: cbci-secrets secret: - secretName: cbci-secrets + secretName: ${cascSecretsName} containers: - name: jenkins env: @@ -100,4 +100,4 @@ items: "cloudbees.prometheus": "true" properties: - configurationAsCode: - bundle: "develop/ha" + bundle: "cbci-agents-sec-docker/ha" diff --git a/blueprints/02-at-scale/casc/oc/variables/variables.yaml b/blueprints/02-at-scale/casc/oc/variables/variables.yaml index cda92353..5e01c6c5 100644 --- a/blueprints/02-at-scale/casc/oc/variables/variables.yaml +++ b/blueprints/02-at-scale/casc/oc/variables/variables.yaml @@ -1,9 +1,10 @@ variables: - message: "Welcome to the CloudBees CI blueprint add-on: At scale!" - scmCascMmStore: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - - cascBranch: develop + - cascBranch: cbci-agents-sec-docker - ldapManagerDN: "cn=admin,dc=acme,dc=org" - ldapRootDN: "dc=acme,dc=org" - ldapServer: "openldap-stack.auth.svc.cluster.local" - ldapUserSearch: "cn={0}" - vault_url: "http://vault.vault.svc.cluster.local:8200" + - cascSecretsName: "cbci-sec-casc" From 07455e150902952df12fced32d136468fb4db967 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Sun, 28 Jul 2024 08:41:37 +0200 Subject: [PATCH 019/180] casc: preparing agents for Kaniko --- .../casc/mc/parent/jcasc/k8s-agents.yaml | 64 +++++++++++++++++-- .../casc/mc/parent/variables/variables.yaml | 1 + 2 files changed, 58 insertions(+), 7 deletions(-) diff --git a/blueprints/02-at-scale/casc/mc/parent/jcasc/k8s-agents.yaml b/blueprints/02-at-scale/casc/mc/parent/jcasc/k8s-agents.yaml index b4043907..7a7b6203 100644 --- a/blueprints/02-at-scale/casc/mc/parent/jcasc/k8s-agents.yaml +++ b/blueprints/02-at-scale/casc/mc/parent/jcasc/k8s-agents.yaml @@ -1,8 +1,8 @@ kube: podTemplatesConfiguration: templates: - - name: "linux-mavenAndGo" - label: "linux-mavenAndGo" + - name: "linux-mavenAndKaniko" + label: "linux-mavenAndKaniko" nodeUsageMode: "NORMAL" yaml: |- apiVersion: "v1" @@ -25,14 +25,27 @@ kube: - "99d" command: - "sleep" - image: "golang:alpine3.19" - name: "go" + image: "gcr.io/kaniko-project/executor:debug" + imagePullPolicy: Always + name: "kaniko" resources: limits: memory: "1Gi" requests: memory: "500Mi" cpu: "250m" + volumeMounts: + - name: jenkins-docker-cfg + mountPath: /kaniko/.docker + volumes: + - name: jenkins-docker-cfg + projected: + sources: + - secret: + name: ${regSecretsName} + items: + - key: .dockerconfigjson + path: config.json nodeSelector: kubernetes.io/os: linux role: "build-linux" @@ -41,8 +54,8 @@ kube: key: "dedicated" operator: "Equal" value: "build-linux" - - name: "linux-maven-spot" - label: "linux-maven-spot" + - name: "linux-mavenAndKaniko-max" + label: "linux-mavenAndKaniko-max" nodeUsageMode: "NORMAL" yaml: |- apiVersion: "v1" @@ -57,10 +70,35 @@ kube: name: "maven" resources: limits: - memory: "1Gi" + memory: "2Gi" requests: memory: "500Mi" cpu: "250m" + - args: + - "99d" + command: + - "sleep" + image: "gcr.io/kaniko-project/executor:debug" + imagePullPolicy: Always + name: "kaniko" + resources: + limits: + memory: "2Gi" + requests: + memory: "500Mi" + cpu: "250m" + volumeMounts: + - name: jenkins-docker-cfg + mountPath: /kaniko/.docker + volumes: + - name: jenkins-docker-cfg + projected: + sources: + - secret: + name: ${regSecretsName} + items: + - key: .dockerconfigjson + path: config.json nodeSelector: kubernetes.io/os: linux role: "build-linux-spot" @@ -78,8 +116,20 @@ kube: containers: - name: jnlp image: jenkins/inbound-agent:windowsservercore-1809 + resources: + limits: + memory: "1Gi" + requests: + memory: "500Mi" + cpu: "250m" - name: shell image: mcr.microsoft.com/powershell:preview-windowsservercore-1809 + resources: + limits: + memory: "1Gi" + requests: + memory: "500Mi" + cpu: "250m" command: - powershell args: diff --git a/blueprints/02-at-scale/casc/mc/parent/variables/variables.yaml b/blueprints/02-at-scale/casc/mc/parent/variables/variables.yaml index 9bcb6e10..22630208 100644 --- a/blueprints/02-at-scale/casc/mc/parent/variables/variables.yaml +++ b/blueprints/02-at-scale/casc/mc/parent/variables/variables.yaml @@ -1,3 +1,4 @@ variables: - ot_endpoint: "http://tempo.kube-prometheus-stack.svc.cluster.local:4317" - s3bucketPreffix: "cbci/" + - regSecretsName: "cbci-sec-casc" \ No newline at end of file From 1f3e55e4175d2a3507da4c71639c19e6bf4f4f8d Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Sun, 28 Jul 2024 23:44:25 +0200 Subject: [PATCH 020/180] Casc: Moving folder inside cbci --- .../02-at-scale/{ => cbci}/casc/mc/ha/bundle.yaml | 0 .../{ => cbci}/casc/mc/ha/jcasc/main.yaml | 0 .../{ => cbci}/casc/mc/none-ha/bundle.yaml | 0 .../{ => cbci}/casc/mc/none-ha/jcasc/main.yaml | 0 .../{ => cbci}/casc/mc/parent/bundle.yaml | 0 .../casc/mc/parent/items/admin-folder.yaml | 0 .../casc/mc/parent/items/squad_x-folder.yaml | 0 .../casc/mc/parent/items/squad_y-folder.yaml | 0 .../casc/mc/parent/jcasc/k8s-agents.yaml | 0 .../{ => cbci}/casc/mc/parent/jcasc/main.yaml | 0 .../{ => cbci}/casc/mc/parent/jcasc/security.yaml | 0 .../{ => cbci}/casc/mc/parent/jcasc/support.yaml | 0 .../{ => cbci}/casc/mc/parent/plugins/plugins.yaml | 0 .../{ => cbci}/casc/mc/parent/rbac/rbac.yaml | 0 .../casc/mc/parent/variables/variables.yaml | 0 .../02-at-scale/{ => cbci}/casc/oc/bundle.yaml | 0 .../{ => cbci}/casc/oc/items/admin-folder.yaml | 0 .../02-at-scale/{ => cbci}/casc/oc/items/root.yaml | 0 .../02-at-scale/{ => cbci}/casc/oc/jcasc/main.yaml | 2 +- .../{ => cbci}/casc/oc/jcasc/security.yaml | 14 -------------- .../{ => cbci}/casc/oc/jcasc/support.yaml | 0 .../{ => cbci}/casc/oc/plugins/plugins.yaml | 0 .../02-at-scale/{ => cbci}/casc/oc/rbac/rbac.yaml | 0 .../{ => cbci}/casc/oc/variables/variables.yaml | 0 blueprints/02-at-scale/k8s/vault-config.sh | 2 +- 25 files changed, 2 insertions(+), 16 deletions(-) rename blueprints/02-at-scale/{ => cbci}/casc/mc/ha/bundle.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/ha/jcasc/main.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/none-ha/bundle.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/none-ha/jcasc/main.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/parent/bundle.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/parent/items/admin-folder.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/parent/items/squad_x-folder.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/parent/items/squad_y-folder.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/parent/jcasc/k8s-agents.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/parent/jcasc/main.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/parent/jcasc/security.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/parent/jcasc/support.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/parent/plugins/plugins.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/parent/rbac/rbac.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/parent/variables/variables.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/oc/bundle.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/oc/items/admin-folder.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/oc/items/root.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/oc/jcasc/main.yaml (95%) rename blueprints/02-at-scale/{ => cbci}/casc/oc/jcasc/security.yaml (77%) rename blueprints/02-at-scale/{ => cbci}/casc/oc/jcasc/support.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/oc/plugins/plugins.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/oc/rbac/rbac.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/oc/variables/variables.yaml (100%) diff --git a/blueprints/02-at-scale/casc/mc/ha/bundle.yaml b/blueprints/02-at-scale/cbci/casc/mc/ha/bundle.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/ha/bundle.yaml rename to blueprints/02-at-scale/cbci/casc/mc/ha/bundle.yaml diff --git a/blueprints/02-at-scale/casc/mc/ha/jcasc/main.yaml b/blueprints/02-at-scale/cbci/casc/mc/ha/jcasc/main.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/ha/jcasc/main.yaml rename to blueprints/02-at-scale/cbci/casc/mc/ha/jcasc/main.yaml diff --git a/blueprints/02-at-scale/casc/mc/none-ha/bundle.yaml b/blueprints/02-at-scale/cbci/casc/mc/none-ha/bundle.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/none-ha/bundle.yaml rename to blueprints/02-at-scale/cbci/casc/mc/none-ha/bundle.yaml diff --git a/blueprints/02-at-scale/casc/mc/none-ha/jcasc/main.yaml b/blueprints/02-at-scale/cbci/casc/mc/none-ha/jcasc/main.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/none-ha/jcasc/main.yaml rename to blueprints/02-at-scale/cbci/casc/mc/none-ha/jcasc/main.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/bundle.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/bundle.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/bundle.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/bundle.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/items/admin-folder.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/items/squad_x-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/squad_x-folder.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/items/squad_x-folder.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/items/squad_x-folder.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/items/squad_y-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/squad_y-folder.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/items/squad_y-folder.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/items/squad_y-folder.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/jcasc/k8s-agents.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/jcasc/k8s-agents.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/jcasc/main.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/jcasc/main.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/jcasc/security.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/security.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/jcasc/security.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/security.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/jcasc/support.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/support.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/jcasc/support.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/support.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/plugins/plugins.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/plugins/plugins.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/plugins/plugins.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/plugins/plugins.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/rbac/rbac.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/rbac/rbac.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/rbac/rbac.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/rbac/rbac.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/variables/variables.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml diff --git a/blueprints/02-at-scale/casc/oc/bundle.yaml b/blueprints/02-at-scale/cbci/casc/oc/bundle.yaml similarity index 100% rename from blueprints/02-at-scale/casc/oc/bundle.yaml rename to blueprints/02-at-scale/cbci/casc/oc/bundle.yaml diff --git a/blueprints/02-at-scale/casc/oc/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/oc/items/admin-folder.yaml similarity index 100% rename from blueprints/02-at-scale/casc/oc/items/admin-folder.yaml rename to blueprints/02-at-scale/cbci/casc/oc/items/admin-folder.yaml diff --git a/blueprints/02-at-scale/casc/oc/items/root.yaml b/blueprints/02-at-scale/cbci/casc/oc/items/root.yaml similarity index 100% rename from blueprints/02-at-scale/casc/oc/items/root.yaml rename to blueprints/02-at-scale/cbci/casc/oc/items/root.yaml diff --git a/blueprints/02-at-scale/casc/oc/jcasc/main.yaml b/blueprints/02-at-scale/cbci/casc/oc/jcasc/main.yaml similarity index 95% rename from blueprints/02-at-scale/casc/oc/jcasc/main.yaml rename to blueprints/02-at-scale/cbci/casc/oc/jcasc/main.yaml index 2983a2fe..2d246952 100644 --- a/blueprints/02-at-scale/casc/oc/jcasc/main.yaml +++ b/blueprints/02-at-scale/cbci/casc/oc/jcasc/main.yaml @@ -22,7 +22,7 @@ unclassified: - sparseCheckoutPaths: extension: sparseCheckoutPaths: - - path: "/blueprints/02-at-scale/casc/mc/" + - path: "/blueprints/02-at-scale/cbci/casc/mc/" cascAutoControllerProvisioning: provisionControllerOnCreation: true buildDiscarders: diff --git a/blueprints/02-at-scale/casc/oc/jcasc/security.yaml b/blueprints/02-at-scale/cbci/casc/oc/jcasc/security.yaml similarity index 77% rename from blueprints/02-at-scale/casc/oc/jcasc/security.yaml rename to blueprints/02-at-scale/cbci/casc/oc/jcasc/security.yaml index c94f6139..bdcb33ac 100644 --- a/blueprints/02-at-scale/casc/oc/jcasc/security.yaml +++ b/blueprints/02-at-scale/cbci/casc/oc/jcasc/security.yaml @@ -24,20 +24,6 @@ globalCredentialsConfiguration: url: "${vault_url}" credentials: system: - domainCredentials: - - credentials: - - usernamePassword: - description: "GH-User-token" - id: "GH-User-token" - password: ${sec_githubUser} - scope: GLOBAL - username: ${sec_githubToken} - usernameSecret: true - - string: - description: "GH-ST-token" - id: "GH-ST-token" - scope: GLOBAL - secret: ${sec_githubToken} cloudbeesHashicorpVault: domainCredentials: - credentials: diff --git a/blueprints/02-at-scale/casc/oc/jcasc/support.yaml b/blueprints/02-at-scale/cbci/casc/oc/jcasc/support.yaml similarity index 100% rename from blueprints/02-at-scale/casc/oc/jcasc/support.yaml rename to blueprints/02-at-scale/cbci/casc/oc/jcasc/support.yaml diff --git a/blueprints/02-at-scale/casc/oc/plugins/plugins.yaml b/blueprints/02-at-scale/cbci/casc/oc/plugins/plugins.yaml similarity index 100% rename from blueprints/02-at-scale/casc/oc/plugins/plugins.yaml rename to blueprints/02-at-scale/cbci/casc/oc/plugins/plugins.yaml diff --git a/blueprints/02-at-scale/casc/oc/rbac/rbac.yaml b/blueprints/02-at-scale/cbci/casc/oc/rbac/rbac.yaml similarity index 100% rename from blueprints/02-at-scale/casc/oc/rbac/rbac.yaml rename to blueprints/02-at-scale/cbci/casc/oc/rbac/rbac.yaml diff --git a/blueprints/02-at-scale/casc/oc/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml similarity index 100% rename from blueprints/02-at-scale/casc/oc/variables/variables.yaml rename to blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml diff --git a/blueprints/02-at-scale/k8s/vault-config.sh b/blueprints/02-at-scale/k8s/vault-config.sh index 619d9a1a..a09c0358 100644 --- a/blueprints/02-at-scale/k8s/vault-config.sh +++ b/blueprints/02-at-scale/k8s/vault-config.sh @@ -25,7 +25,7 @@ done # https://developer.hashicorp.com/vault/tutorials/auth-methods/approle ## Login as admin using token kubectl exec -it vault-0 -n "$vault_ns" -- vault login -## Create the secrets to be mapped from CloudBees CI +## Create example secrets to be mapped from CloudBees CI kubectl exec -it vault-0 -n "$vault_ns" -- vault secrets enable --version=2 --path=secret-v2 kv || echo "Path is already enabled" kubectl exec -it vault-0 -n "$vault_ns" -- vault kv put "secret-v2/$approle/secret-a" username="userVaultExample" password="passw0rdVaultExample" kubectl exec -it vault-0 -n "$vault_ns" -- vault kv put "secret-v2/$approle/secret-b" secret="secretVaultExample" From 128c2452e22c1466cc75764780ea736c229a12d8 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Sun, 28 Jul 2024 23:53:50 +0200 Subject: [PATCH 021/180] inrease pre-commit version --- .pre-commit-config.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 876bb7c7..cb59612c 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -23,7 +23,7 @@ repos: - id: check-vcs-permalinks - repo: https://github.com/antonbabenko/pre-commit-terraform - rev: v1.81.0 + rev: v1.92.0 hooks: - id: terraform_fmt name: Format Terraform Configuration @@ -33,7 +33,7 @@ repos: - --hook-config=--retry-once-with-cleanup=true - id: terraform_tflint args: - - '--args=--only=terraform_deprecated_interpolation' + #- '--args=--only=terraform_deprecated_interpolation' - '--args=--only=terraform_deprecated_index' - '--args=--only=terraform_unused_declarations' - '--args=--only=terraform_comment_syntax' From e673f67e941818754475984013e24a2c5e71d990 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 29 Jul 2024 13:13:31 +0200 Subject: [PATCH 022/180] casc: Adapting the new templates --- .../casc/mc/parent/items/admin-folder.yaml | 25 +++++-------------- .../cbci/casc/mc/parent/jcasc/k8s-agents.yaml | 8 +++--- .../casc/mc/parent/variables/variables.yaml | 2 +- 3 files changed, 11 insertions(+), 24 deletions(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml index ceb55391..66531624 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml @@ -16,7 +16,7 @@ items: script: |- timeout(time: 1, unit: 'HOURS'){ parallel([0, 1].collectEntries {b -> ["branch-$b", { - podTemplate (inheritFrom: 'linux-mavenAndGo') { + podTemplate (inheritFrom: 'linux-mavenAndKaniko-L') { node(POD_LABEL) { retry (3) { stage('prep') { @@ -101,7 +101,7 @@ items: script: |- pipeline { agent{ - label 'linux-maven-spot' + label 'linux-mavenAndKaniko-XL' } options { retry(3) @@ -129,11 +129,6 @@ items: } } } - post { - failure { - echo "Check Manage Jenkins > AWS > Amazon S3 Bucket Access settings matches with your s3 name terraform output!" - } - } } description: 'It validates archives/unarchive s3 artifacts (https://plugins.jenkins.io/artifact-manager-s3/) from different pods agents in different build. It uses artifacts from upstream build.' displayName: downstream-artifact @@ -150,14 +145,14 @@ items: timeout(time: 1, unit: 'HOURS') } agent{ - label 'linux-mavenAndGo' + label 'linux-mavenAndKaniko-L' } stages { stage('Golang') { stages { stage ('Build'){ steps { - container('go') { + container('kaniko') { sh ''' echo "Build number ^${BUILD_NUMBER}" >> f_1 go version >> f_1 @@ -167,7 +162,7 @@ items: } stage ('Archive f_1'){ steps { - container('go') { + container('kaniko') { archiveArtifacts artifacts: 'f_1', fingerprint: true } } @@ -208,11 +203,6 @@ items: } } } - post { - failure { - echo "Check Manage Jenkins > AWS > Amazon S3 Bucket Access settings matches with your s3 name terraform output!" - } - } } description: 'It validates archives/unarchive s3 artifacts (https://plugins.jenkins.io/artifact-manager-s3/) from different pods agents in different build. It creates artifacts for downstream build.' displayName: upstream-artifact @@ -256,7 +246,7 @@ items: timeout(time: 1, unit: 'HOURS') } agent{ - label 'linux-mavenAndGo' + label 'linux-mavenAndKaniko-L' } environment { MAVEN_PROJECT = 'https://github.com/jglick/simple-maven-project-with-tests' @@ -285,9 +275,6 @@ items: success { writeCache name: env.CACHE, includes: 'maven-repo/**' } - failure { - echo "Check Manage Jenkins > AWS > Amazon S3 Bucket Access settings matches with your s3 name terraform output!" - } } } description: 'Pipeline that demonstrates the usage of CloudBees Workspace Caching: https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-cache-step.' diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml index 7a7b6203..56157b6b 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml @@ -1,8 +1,8 @@ kube: podTemplatesConfiguration: templates: - - name: "linux-mavenAndKaniko" - label: "linux-mavenAndKaniko" + - name: "linux-mavenAndKaniko-L" + label: "linux-mavenAndKaniko-L" nodeUsageMode: "NORMAL" yaml: |- apiVersion: "v1" @@ -54,8 +54,8 @@ kube: key: "dedicated" operator: "Equal" value: "build-linux" - - name: "linux-mavenAndKaniko-max" - label: "linux-mavenAndKaniko-max" + - name: "linux-mavenAndKaniko-XL" + label: "linux-mavenAndKaniko-XL" nodeUsageMode: "NORMAL" yaml: |- apiVersion: "v1" diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml index 22630208..99faab96 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml @@ -1,4 +1,4 @@ variables: - ot_endpoint: "http://tempo.kube-prometheus-stack.svc.cluster.local:4317" - s3bucketPreffix: "cbci/" - - regSecretsName: "cbci-sec-casc" \ No newline at end of file + - regSecretsName: "cbci-sec-reg" \ No newline at end of file From 72d59bfb2e769751f50b84ae88479ea563146e8c Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 29 Jul 2024 16:09:06 +0200 Subject: [PATCH 023/180] casc: add items resolution --- blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml index ff7bd993..63905005 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml @@ -36,6 +36,9 @@ unclassified: gracePeriod: 3600 openTelemetry: endpoint: ${ot_endpoint} + cascItemsConfiguration: + variableInterpolationEnabledForAdmin: true + variableInterpolationEnabledForNonAdmin: true aws: s3: container: "${sec_s3bucketName}" From 0a2fe5ec24ab727c665775a6174cea1cda497457 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 29 Jul 2024 16:10:17 +0200 Subject: [PATCH 024/180] casc: Adapting templates to kaniko --- .../casc/mc/parent/items/admin-folder.yaml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml index 66531624..215fdf81 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml @@ -66,7 +66,7 @@ items: sandbox: true script: |- timeout(time: 1, unit: 'HOURS'){ - podTemplate (inheritFrom: 'linux-mavenAndGo') { + podTemplate (inheritFrom: 'linux-mavenAndKaniko-L') { retry (3) { node(POD_LABEL) { stage('beginning') { @@ -77,7 +77,7 @@ items: } } checkpoint 'middle' - podTemplate (inheritFrom: 'linux-maven-spot') { + podTemplate (inheritFrom: 'linux-mavenAndKaniko-XL') { retry (3) { node(POD_LABEL) { stage('end') { @@ -148,14 +148,14 @@ items: label 'linux-mavenAndKaniko-L' } stages { - stage('Golang') { + stage('Maven') { stages { stage ('Build'){ steps { - container('kaniko') { + container('maven') { sh ''' - echo "Build number ^${BUILD_NUMBER}" >> f_1 - go version >> f_1 + echo "Build number ^^${BUILD_NUMBER}" >> f_1 + mvn -version >> f_1 ''' } } @@ -169,7 +169,7 @@ items: } } } - stage('Busybox') { + stage('Kaniko') { stages { stage ("Unarchive"){ steps { @@ -184,9 +184,9 @@ items: } stage ('Build'){ steps { - container('maven') { + container('kaniko') { dir ('unarchive'){ - sh 'mvn -version >> f_2' + sh 'ls /kaniko/executor >> f_2' } } } From 50b6d0c16b324e991b1d4925706a986727b8cc59 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 29 Jul 2024 17:53:12 +0200 Subject: [PATCH 025/180] casc: Variable interpolation enable admin --- blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml index 63905005..af7e1576 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml @@ -38,7 +38,6 @@ unclassified: endpoint: ${ot_endpoint} cascItemsConfiguration: variableInterpolationEnabledForAdmin: true - variableInterpolationEnabledForNonAdmin: true aws: s3: container: "${sec_s3bucketName}" From 5ac56bcd37ba05fb6537263270834ad4167739c7 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 29 Jul 2024 19:51:04 +0200 Subject: [PATCH 026/180] casc: adding kaniko validations --- .../casc/mc/parent/items/admin-folder.yaml | 46 +++++++++++++++---- 1 file changed, 37 insertions(+), 9 deletions(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml index 215fdf81..39019666 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml @@ -303,12 +303,40 @@ items: } } } - description: '' - properties: - - envVars: {} - - itemRestrictions: - filter: false - properties: - - envVars: {} - - itemRestrictions: - filter: false + description: 'It validates that credentials from Vault are fetched correctly.' + - kind: pipeline + name: kaniko + concurrentBuild: true + definition: + cpsFlowDefinition: + sandbox: true + script: | + pipeline { + agent { + label 'linux-mavenAndKaniko-XL' + } + parameters { + string(name: 'TARGET_DH_ORG', description: 'DockerHub Organization to Push the image') + } + stages { + stage('Build with Kaniko') { + steps { + container(name: 'kaniko', shell: '/busybox/sh') { + sh '''#!/busybox/sh + echo "FROM jenkins/inbound-agent:latest" > Dockerfile + /kaniko/executor --context `pwd` --destination $TARGET_DH_ORG/hello-kaniko:latest + ''' + } + } + } + } + } + properties: + - parameters: + parameterDefinitions: + - string: + trim: false + name: TARGET_DH_ORG + description: DockerHub Organization to Push the image + resumeBlocked: false + description: 'It validates that Authentication for DockerHub and Kaniko is working fine.' From ec8e8ffcbe122601412b39bb9bd844136bfb1681 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 29 Jul 2024 19:54:15 +0200 Subject: [PATCH 027/180] [root] adapting for Kaniko crendentials --- README.md | 14 +++++++---- main.tf | 53 ++++++++++++++++++++++++++++++++-------- outputs.tf | 11 ++++++--- variables.tf | 69 ++++++++++++++++++++++++++++++++++++++++++++++------ 4 files changed, 122 insertions(+), 25 deletions(-) diff --git a/README.md b/README.md index ce7f3b36..90ec773f 100644 --- a/README.md +++ b/README.md @@ -19,8 +19,8 @@ The CloudBees CI [AWS partner add-on](https://aws-ia.github.io/terraform-aws-eks-blueprints-addons/main/aws-partner-addons/) streamlines the adoption and experimentation of CloudBees CI enterprise features by: -- Encapsulating the deployment of [CloudBees CI on modern platforms in AWS EKS](https://docs.cloudbees.com/docs/cloudbees-ci/latest/eks-install-guide/installing-eks-using-helm#_configuring_your_environment) into a Terraform module. -- Providing a series of [blueprints](https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon/tree/main/blueprints) that implement the CloudBees CI add-on module for use with [Amazon EKS blueprints for Terraform](https://aws-ia.github.io/terraform-aws-eks-blueprints-addons/main/), which are aligned with the [EKS Best Practices Guides](https://aws.github.io/aws-eks-best-practices/). +- Encapsulating the deployment of [CloudBees CI on modern platforms in AWS EKS](https://docs.cloudbees.com/docs/cloudbees-ci/latest/eks-install-guide/installing-eks-using-helm#_configuring_your_environment) and additional k8s resources into a Terraform module. +- Providing a series of opinionated [blueprints](https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon/tree/main/blueprints) that implement the CloudBees CI add-on module for use with [Amazon EKS blueprints for Terraform](https://aws-ia.github.io/terraform-aws-eks-blueprints-addons/main/), which are aligned with the [EKS Best Practices Guides](https://aws.github.io/aws-eks-best-practices/). ## Usage @@ -95,10 +95,13 @@ The CloudBees CI add-on uses `helms release` for its resources definition, makin | cert_arn | AWS Certificate Manager (ACM) certificate for Amazon Resource Names (ARN). | `string` | n/a | yes | | hosted_zone | Amazon Route 53 hosted zone name. | `string` | n/a | yes | | trial_license | CloudBees CI trial license details for evaluation. | `map(string)` | n/a | yes | -| create_k8s_secrets | Create the Kubernetes secret cbci-secrets and mount into the Operation Center /run/secrets/ path to be consumed by CloudBees CasC. | `bool` | `false` | no | +| casc_secrets_file | Secrets .yml file path containing the names:values secrets. It is required when create_casc_secrets is enabled. | `string` | `"secrets-values.yml"` | no | +| create_casc_secrets | Create a Kubernetes basic secret for CloudBees Configuration as Code (cbci-sec-casc) and mount it into the Operation Center /var/run/secrets/cbci. | `bool` | `false` | no | +| create_reg_secret | Create a Kubernetes dockerconfigjson secret for Container Registry authentication (cbci-sec-reg) for CI builds agents. | `bool` | `false` | no | | helm_config | CloudBees CI Helm chart configuration. | `any` | 
{
  "values": [
    ""
  ]
}
| no | -| k8s_secrets | Secrets .yml file as a string containing the names:values secrets. It is required when create_k8s_secrets is enabled. | `string` | `"secrets-values.yml"` | no | | prometheus_target | Creates a service monitor to discover the CloudBees CI Prometheus target dynamically. It is designed to be enabled with the AWS EKS Terraform Addon Kube Prometheus Stack. | `bool` | `false` | no | +| reg_secret_auth | Registry server authentication details for cbci-sec-reg secret. It is required when create_reg_secret is enabled. | `map(string)` | 
{
  "email": "foo.bar@acme.com",
  "password": "changeme1234",
  "server": "my-registry.acme:5000",
  "username": "foo"
}
| no | +| reg_secret_ns | Agent Namespace to allocate cbci-sec-reg secret. It is required when create_reg_secret is enabled. | `string` | `"cbci"` | no | ### Outputs @@ -111,7 +114,8 @@ The CloudBees CI add-on uses `helms release` for its resources definition, makin | cbci_oc_ing | Operations center Ingress for the CloudBees CI add-on. | | cbci_oc_pod | Operations center pod for the CloudBees CI add-on. | | cbci_oc_url | Operations center URL for the CloudBees CI add-on using a subdomain and certificates. | -| cbci_secrets | Optional. Kubernetes secrets name for CloudBees CI. | +| cbci_sec_casc | Optional. Kubernetes secrets name for CloudBees CI Casc. | +| cbci_sec_registry | Optional. Kubernetes secrets name for CloudBees CI agents to autheticate to registry. | | merged_helm_config | (merged) Helm configuration for CloudBees CI. | diff --git a/main.tf b/main.tf index 4a53ac3d..57cc87d9 100644 --- a/main.tf +++ b/main.tf @@ -1,9 +1,12 @@ # Copyright (c) CloudBees, Inc. locals { - cbci_ns = "cbci" - cbci_secrets_name = "cbci-secrets" - create_secret = alltrue([var.create_k8s_secrets, length(var.k8s_secrets) > 0]) + cbci_ns = "cbci" + cbci_sec_casc_name = "cbci-sec-casc" + cbci_sec_registry_name = "cbci-sec-reg" + create_secret_casc = alltrue([var.create_casc_secrets, length(var.casc_secrets_file) > 0]) + create_secret_reg = alltrue([var.create_reg_secret, length(var.reg_secret_ns) > 0, length(var.reg_secret_auth) > 0]) + #This section needs to be included in controllers to make use of the CBCI Casc Secrets oc_secrets_mount = [ <<-EOT OperationsCenter: @@ -13,7 +16,7 @@ locals { ExtraVolumes: - name: cbci-secrets secret: - secretName: ${local.cbci_secrets_name} + secretName: ${local.cbci_sec_casc_name} ExtraVolumeMounts: - name: cbci-secrets mountPath: /var/run/secrets/cbci @@ -48,15 +51,45 @@ resource "kubernetes_namespace" "cbci" { # Kubernetes Secrets to be passed to Casc # https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets -resource "kubernetes_secret" "oc_secrets" { - count = local.create_secret ? 1 : 0 +resource "kubernetes_secret" "cbci_sec_casc" { + count = local.create_secret_casc ? 1 : 0 metadata { - name = local.cbci_secrets_name + name = local.cbci_sec_casc_name namespace = kubernetes_namespace.cbci[0].metadata[0].name } - data = yamldecode(var.k8s_secrets) + type = "Opaque" + + data = yamldecode(var.casc_secrets_file) + +} + +# Kubernetes Secrets to authenticate with DockerHub +# https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/using-kaniko#_create_a_new_kubernetes_secret +resource "kubernetes_secret" "cbci_sec_reg" { + count = local.create_secret_reg ? 1 : 0 + # Agent namespace needs to be created before creating this secret + depends_on = [helm_release.cloudbees_ci] + metadata { + name = local.cbci_sec_registry_name + namespace = var.reg_secret_ns + } + + type = "kubernetes.io/dockerconfigjson" + + data = { + ".dockerconfigjson" = jsonencode({ + auths = { + "${var.reg_secret_auth["server"]}" = { + "username" = var.reg_secret_auth["username"] + "password" = var.reg_secret_auth["password"] + "email" = var.reg_secret_auth["email"] + "auth" = base64encode("${var.reg_secret_auth["username"]}:${var.reg_secret_auth["password"]}") + } + } + }) + } } resource "kubectl_manifest" "service_monitor_cb_controllers" { @@ -90,7 +123,7 @@ resource "kubernetes_labels" "oc_sm_label" { api_version = "v1" kind = "Service" - # This is true because the resources was already created by the + # This is true because the resources was already created by the helm_release force = "true" metadata { @@ -110,7 +143,7 @@ resource "helm_release" "cloudbees_ci" { #vCBCI_Helm# version = try(var.helm_config.version, "3.18306.0+b5ad27c80a6b") repository = try(var.helm_config.repository, "https://public-charts.artifacts.cloudbees.com/repository/public/") - values = local.create_secret ? concat(var.helm_config.values, local.oc_secrets_mount, [templatefile("${path.module}/values.yml", local.cbci_template_values)]) : concat(var.helm_config.values, [templatefile("${path.module}/values.yml", local.cbci_template_values)]) + values = local.create_secret_casc ? concat(var.helm_config.values, local.oc_secrets_mount, [templatefile("${path.module}/values.yml", local.cbci_template_values)]) : concat(var.helm_config.values, [templatefile("${path.module}/values.yml", local.cbci_template_values)]) timeout = try(var.helm_config.timeout, 1200) repository_key_file = try(var.helm_config.repository_key_file, null) repository_cert_file = try(var.helm_config.repository_cert_file, null) diff --git a/outputs.tf b/outputs.tf index 3cd7115c..2f349e3e 100644 --- a/outputs.tf +++ b/outputs.tf @@ -40,7 +40,12 @@ output "cbci_liveness_probe_ext" { value = "curl -sSf https://cjoc.${var.hosted_zone}/whoAmI/api/json?tree=authenticated > /dev/null" } -output "cbci_secrets" { - description = "Optional. Kubernetes secrets name for CloudBees CI." - value = local.create_secret ? kubernetes_secret.oc_secrets[0].metadata[0].name : "No secrets created" +output "cbci_sec_casc" { + description = "Optional. Kubernetes secrets name for CloudBees CI Casc." + value = local.create_secret_casc ? kubernetes_secret.cbci_sec_casc[0].metadata[0].name : "No secrets created" +} + +output "cbci_sec_registry" { + description = "Optional. Kubernetes secrets name for CloudBees CI agents to autheticate to registry." + value = local.create_secret_reg ? kubernetes_secret.cbci_sec_reg[0].metadata[0].name : "No secrets created" } diff --git a/variables.tf b/variables.tf index ee6fd9fa..0a06ceaa 100644 --- a/variables.tf +++ b/variables.tf @@ -15,9 +15,13 @@ variable "hosted_zone" { description = "Amazon Route 53 hosted zone name." type = string validation { - condition = trim(var.hosted_zone, " ") != "" + condition = length(trimspace(var.hosted_zone)) > 0 error_message = "Host name must not be an empty string." } + validation { + condition = can(regex("^([a-zA-Z0-9-]+\\.)+[a-zA-Z]+$", var.hosted_zone)) + error_message = "Host name must be a valid domain name." + } } variable "cert_arn" { @@ -25,26 +29,77 @@ variable "cert_arn" { type = string validation { - condition = can(regex("^arn", var.cert_arn)) - error_message = "The cert_arn should start with ARN." + condition = can(regex("^arn:aws:acm:", var.cert_arn)) + error_message = "The cert_arn should be a valid ACM certificate ARN." + } + validation { + condition = length(var.cert_arn) > 0 + error_message = "The cert_arn must not be an empty string." } } variable "trial_license" { description = "CloudBees CI trial license details for evaluation." type = map(string) + validation { + condition = contains(keys(var.trial_license), "first_name") && contains(keys(var.trial_license), "last_name") && contains(keys(var.trial_license), "email") && contains(keys(var.trial_license), "company") + error_message = "trial_license must contain the following keys: first_name, last_name, email, company." + } + validation { + condition = length(var.trial_license) == 4 + error_message = "The map must contain 4 keys." + } } -variable "create_k8s_secrets" { - description = "Create the Kubernetes secret cbci-secrets and mount into the Operation Center /run/secrets/ path to be consumed by CloudBees CasC." +variable "create_casc_secrets" { + description = "Create a Kubernetes basic secret for CloudBees Configuration as Code (cbci-sec-casc) and mount it into the Operation Center /var/run/secrets/cbci." default = false type = bool } -variable "k8s_secrets" { - description = "Secrets .yml file as a string containing the names:values secrets. It is required when create_k8s_secrets is enabled." +variable "casc_secrets_file" { + description = "Secrets .yml file path containing the names:values secrets. It is required when create_casc_secrets is enabled." default = "secrets-values.yml" type = string + validation { + condition = length(trimspace(var.casc_secrets_file)) > 0 + error_message = "Casc secret file must not be an empty string." + } +} + +variable "create_reg_secret" { + description = "Create a Kubernetes dockerconfigjson secret for Container Registry authentication (cbci-sec-reg) for CI builds agents." + default = false + type = bool +} + +variable "reg_secret_ns" { + description = "Agent Namespace to allocate cbci-sec-reg secret. It is required when create_reg_secret is enabled." + default = "cbci" + type = string + validation { + condition = length(trimspace(var.reg_secret_ns)) > 0 + error_message = "Agent Namespace must not be an empty string." + } +} + +variable "reg_secret_auth" { + description = "Registry server authentication details for cbci-sec-reg secret. It is required when create_reg_secret is enabled." + type = map(string) + default = { + server = "my-registry.acme:5000" + username = "foo" + password = "changeme1234" + email = "foo.bar@acme.com" + } + validation { + condition = contains(keys(var.reg_secret_auth), "server") && contains(keys(var.reg_secret_auth), "username") && contains(keys(var.reg_secret_auth), "password") && contains(keys(var.reg_secret_auth), "email") + error_message = "reg_server must contain the following keys: server, username, password and email." + } + validation { + condition = length(var.reg_secret_auth) == 4 + error_message = "reg_server must contain 4 keys." + } } variable "prometheus_target" { From 477eca6b5c0e05e745e2ebb5b520d7378baf64ed Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 29 Jul 2024 20:00:27 +0200 Subject: [PATCH 028/180] replace naming to Workload --- blueprints/01-getting-started/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/01-getting-started/README.md b/blueprints/01-getting-started/README.md index 23e8a1c1..b56ae0ff 100644 --- a/blueprints/01-getting-started/README.md +++ b/blueprints/01-getting-started/README.md @@ -19,7 +19,7 @@ This blueprint presents the minimum setup to run CloudBees CI on Amazon EKS; one - Instance type: [Graviton Processor](https://aws.amazon.com/ec2/graviton/) family. - Amazon Machine Image (AMI) type: [Amazon EKS-Optimized Amazon Linux 2023](https://aws.amazon.com/blogs/containers/amazon-eks-optimized-amazon-linux-2023-amis-now-available/) -### Kubernetes cluster +### Workloads ![K8sApps](img/getting-started.k8s.drawio.svg) From f4af3750bb13d0afaa1b13a3b66ff2800f5edeba Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 29 Jul 2024 20:00:48 +0200 Subject: [PATCH 029/180] Using cbci-agents-sec-docker as branch --- blueprints/02-at-scale/k8s/cbci-values.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/blueprints/02-at-scale/k8s/cbci-values.yml b/blueprints/02-at-scale/k8s/cbci-values.yml index 4d816231..10f899ac 100644 --- a/blueprints/02-at-scale/k8s/cbci-values.yml +++ b/blueprints/02-at-scale/k8s/cbci-values.yml @@ -16,8 +16,8 @@ OperationsCenter: Retriever: Enabled: true scmRepo: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - scmBranch: develop - scmBundlePath: blueprints/02-at-scale/casc/oc + scmBranch: cbci-agents-sec-docker + scmBundlePath: blueprints/02-at-scale/cbci/casc/oc scmPollingInterval: PT20M Persistence: StorageClass: efs From 9fe49a2130e539c4b7619b8d0d48ca2385e5a3e3 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 29 Jul 2024 20:05:06 +0200 Subject: [PATCH 030/180] [bp 02] Including Kaniko --- blueprints/02-at-scale/.auto.tfvars.example | 7 +- blueprints/02-at-scale/README.md | 35 +- .../02-at-scale/img/at-scale.k8s.drawio.svg | 511 ++++++++++-------- blueprints/02-at-scale/k8s/secrets-values.yml | 6 +- blueprints/02-at-scale/main.tf | 23 +- blueprints/02-at-scale/outputs.tf | 11 +- blueprints/02-at-scale/variables.tf | 49 +- 7 files changed, 374 insertions(+), 268 deletions(-) diff --git a/blueprints/02-at-scale/.auto.tfvars.example b/blueprints/02-at-scale/.auto.tfvars.example index 6aacc423..2444aca2 100644 --- a/blueprints/02-at-scale/.auto.tfvars.example +++ b/blueprints/02-at-scale/.auto.tfvars.example @@ -7,8 +7,11 @@ trial_license = { # Required. CloudBees CI Trial license details for evaluation. company = "Acme Inc." } -gh_user = "exampleUser" # Required. Default values can be used for demo. -gh_token = "ExampleToken1234" # Required. Default values can be used for demo. +dh_reg_secret_auth = { # Required. + username = "foo" + password = "d0ckerPass12" + email = "foo.bar@acme.com" +} # tags = { # Optional. Tags for the resources created. Default set to empty. Shared among all. # "cb-owner" : "team-services" diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 3972c625..5fa3a7bd 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -53,7 +53,7 @@ This blueprint divides scalable node groups for different types of workloads: ![Architecture](img/at-scale.architect.drawio.svg) -### Kubernetes cluster +### Workloads ![K8sApps](img/at-scale.k8s.drawio.svg) @@ -81,6 +81,7 @@ This blueprint divides scalable node groups for different types of workloads: | aws_backup_efs_protected_resource | AWS description for the Amazon EFS drive that is used to back up protected resources. | | aws_logstreams_fluentbit | AWS CloudWatch log streams from Fluent Bit. | | cbci_agent_linuxtempl_events | Retrieves a list of events related to Linux template agents. | +| cbci_agent_sec_reg | Retrieves the container registry secret deployed in the agents namespace. | | cbci_agent_windowstempl_events | Retrieves a list of events related to Windows template agents. | | cbci_agents_pods | Retrieves a list of agent pods running in the agents namespace. | | cbci_controller_b_ws_cache_build | team-b hibernation monitor endpoint to the build workspace cache. It expects CBCI_ADMIN_TOKEN as the environment variable. | @@ -117,6 +118,13 @@ This blueprint divides scalable node groups for different types of workloads: | vpc_arn | VPC ID. | +## Prerequisites + +This blueprint uses [DockerHub](https://hub.docker.com/) as a Container Registry Service. Then, an existing DockerHub account is required (username, password and email). + +> [!TIP] +> Use `docker login` to validate username and password. + ## Deploy When preparing to deploy, you must complete the following steps: @@ -148,14 +156,13 @@ Once the resources have been created, a `kubeconfig` file is created in the [/k8 1. Complete the steps to [validate CloudBees CI](../01-getting-started/README.md#cloudbees-ci), if you have not done so already. -2. Authentication in this blueprint is based on LDAP using the `cn` user (available in [k8s/openldap-stack-values.yml](./k8s/openldap-stack-values.yml)) and the global password. The authorization level defines a set of permissions configured using [RBAC](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-secure-guide/rbac). Additionally, the operations center and controller use [single sign-on (SS0)](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-secure-guide/using-sso). Issue the following command to retrieve the global password: +2. Authentication in this blueprint is based on LDAP using the `cn` user (available in [k8s/openldap-stack-values.yml](./k8s/openldap-stack-values.yml)) and the global password. The authorization level defines a set of permissions configured using [RBAC](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-secure-guide/rbac). Additionally, the operations center and controller use [single sign-on (SS0)](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-secure-guide/using-sso), including a [fallback mechanism](https://docs.cloudbees.com/docs/cloudbees-ci-kb/latest/operations-center/how-ldap-plugin-works-on-cjoc-sso-context) that is enabled by default. Issue the following command to retrieve the global password (valid for all users): ```sh eval $(terraform output --raw global_password) ``` - > [!NOTE] - > There are differences in CloudBees CI permissions and folder restrictions when signed in as a user of the Admin group versus the Development group. For example, only Admin users have access to the agent validation jobs. + There are differences in CloudBees CI permissions and folder restrictions when signed in as a user of the Admin group versus the Development group. For example, only Admin users have access to the agent validation jobs. 3. CasC is enabled for the [operations center](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-oc/) (`cjoc`) and [controllers](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-controller/) (`team-b` and `team-c-ha`). `team-a` is not using CasC, to illustrate the difference between the two approaches. Issue the following command to verify that all controllers are Running: @@ -175,10 +182,26 @@ Once the resources have been created, a `kubeconfig` file is created in the [/k8 ##### Kubernetes Secret -The secrets key/value file defined in [k8s/secrets-values.yml](k8s/secrets-values.yml) is converted into a Kubernetes secret (`cbci-secrets`) and mounted into /run/secrets/ for Operation Center and Controllers to be consumed via CloudBees Casc. See [Configuration as Code - Handling Secrets - Kubernetes Secrets](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets) for more information. Beyond the CloudBees CI Addon, Kubernetes secrets can be also created via [External Secret Operators](https://aws-ia.github.io/terraform-aws-eks-blueprints-addons/main/addons/external-secrets/). +Beyond the CloudBees CI Addon for demo purposes, Kubernetes secrets can be managed via [External Secret Operators](https://aws-ia.github.io/terraform-aws-eks-blueprints-addons/main/addons/external-secrets/). + +> [!NOTE] +> Kubernetes secrets could be also be retrived as Jenkins Credentials via using the [Kubernetes Credentials Provider plugin](https://jenkinsci.github.io/kubernetes-credentials-provider-plugin/). + +###### Casc Secrets + +The secrets key/value file defined in [k8s/secrets-values.yml](k8s/secrets-values.yml) is converted into a Kubernetes secret (`cbci-sec-casc`) and mounted into /run/secrets/ for Operation Center and Controllers to be consumed via CloudBees Casc. See [Configuration as Code - Handling Secrets - Kubernetes Secrets](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets) for more information. + +###### Container Registry Secrets + +DockerHub authentication is stored as Kubernetes secrets (`cbci-agent-sec-reg`) and mounted to [Kaniko agent containers](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/using-kaniko) to build and push images to the target container registry. + +```sh + eval $(terraform output --raw cbci_agent_sec_reg) +``` > [!NOTE] -> Kubernetes secrets can be also be retrived as Jenkins Credentials via using the [Kubernetes Credentials Provider plugin](https://jenkinsci.github.io/kubernetes-credentials-provider-plugin/). +> - This blueprint uses DockerHub as an example but different container registries services can be used. +> - Besides Kaniko, there are [other alternitives tools](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/using-kaniko#_alternatives). ##### HashiCorp Vault diff --git a/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg b/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg index c28bba14..7d1f7eb6 100644 --- a/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg +++ b/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg @@ -1,4 +1,4 @@ - + @@ -18,13 +18,13 @@ - - - - + + + + - -
+ +
@@ -39,11 +39,11 @@ - - + + - -
+ +
4 @@ -51,17 +51,17 @@
- + 4 - - + + - -
+ +
do @@ -70,20 +70,20 @@
- + do - - + + - - + + - -
+ +
@@ -93,16 +93,16 @@
- + /velero - + - +
@@ -112,16 +112,16 @@
- Amazon S3 bu... + Amazon S3 b... - + - +
@@ -134,16 +134,16 @@
- Metric serve... + Metric serv... - + - +
@@ -164,9 +164,9 @@ - + - +
@@ -187,9 +187,9 @@ - + - +
@@ -209,9 +209,9 @@ - + - +
@@ -233,12 +233,12 @@ - - - + + + - -
+ +
Autoscaling @@ -248,16 +248,16 @@
- + Autoscal... - + - +
@@ -273,9 +273,9 @@ - + - +
@@ -293,9 +293,9 @@ - + - +
@@ -319,19 +319,19 @@ - - - + + + - + - -
+ +
@@ -341,16 +341,16 @@
- + /cbci - + - +
@@ -367,12 +367,12 @@ - - - + + + - -
+ +
EKS @@ -380,16 +380,16 @@
- + EKS - - - + + + - +
@@ -405,9 +405,9 @@ - + - +
@@ -426,12 +426,12 @@ - + - + - +
@@ -453,9 +453,9 @@ - + - +
@@ -476,9 +476,9 @@ - + - +
@@ -499,9 +499,9 @@ - + - +
@@ -522,10 +522,10 @@ - + - -
+ +
@@ -535,17 +535,17 @@
- - /fluentbit + + /... - + - +
@@ -567,9 +567,9 @@ - + - +
@@ -584,15 +584,15 @@
- Node Termina... + Node Termin... - + - +
@@ -611,14 +611,14 @@ - + - - + + - -
+ +
@@ -630,15 +630,15 @@
- + Short-term logs - + - +
@@ -659,9 +659,9 @@ - + - +
@@ -682,13 +682,13 @@ - + - - + + - -
+ +
@@ -703,15 +703,15 @@
- + cbci-agents - + - +
@@ -734,36 +734,38 @@ - - - - - - + + + + + + + - -
+ +
-
+ cbci-sec-reg
- + + cbci-sec-reg + - - - - - - + + + + + - -
+ +
@@ -773,57 +775,21 @@
- - - - - - - - - - - - - - -
-
-
- - cbci-secrets - -
-
-
- - - cbci-secrets - + - - - - cjoc - - - - - - + + + + + + + - -
+ +
- - Hibernation - -
- - Monitor -
@@ -831,37 +797,16 @@
- - Hibernati... - + - - - - team-b - - - - - - team-a - - - - - - - - - team-c-ha - - - + + + - + - +
@@ -881,26 +826,26 @@ - - + + - + - - + + Tempo - + Prometheus - + Grafana @@ -910,9 +855,9 @@ - + - +
@@ -932,13 +877,12 @@ - - - - + + + - -
+ +
@@ -953,15 +897,15 @@
- + cbci - + - +
@@ -977,12 +921,12 @@ - - + + - + - +
@@ -1001,9 +945,9 @@ - + - +
@@ -1022,6 +966,121 @@ + + + + + + + + + + +
+
+
+ + cbci-sec-casc + +
+
+
+ + + cbci-sec-casc + + + + + + + cjoc + + + + + + team-b + + + + + + team-a + + + + + + + + + + + +
+
+
+ + Hibernation + +
+ + Monitor + + +
+ +
+
+
+ + + Hibernati... + + + + + + + + + + + + team-c-ha + + + + + + + + + + + + +
+
+
+ + + + Container Registry + +
+ + +
+
+
+ + + Container Registr... + + + @@ -1031,4 +1090,4 @@ - + \ No newline at end of file diff --git a/blueprints/02-at-scale/k8s/secrets-values.yml b/blueprints/02-at-scale/k8s/secrets-values.yml index a3c69766..71ebebd4 100644 --- a/blueprints/02-at-scale/k8s/secrets-values.yml +++ b/blueprints/02-at-scale/k8s/secrets-values.yml @@ -1,10 +1,8 @@ # Copyright (c) CloudBees, Inc. -# IMPORTANT: Secrets must be parametrized. +# IMPORTANT: Secrets must be parametrized or encrypted if they are saved in SCM. sec_globalPassword: ${global_password} +sec_adminMail : ${adminMail} sec_s3bucketName: ${s3bucketName} sec_awsRegion: ${awsRegion} -sec_adminMail : ${adminMail} -sec_githubUser: ${githubUser} -sec_githubToken: ${githubToken} diff --git a/blueprints/02-at-scale/main.tf b/blueprints/02-at-scale/main.tf index 5add09c0..07948ed6 100644 --- a/blueprints/02-at-scale/main.tf +++ b/blueprints/02-at-scale/main.tf @@ -81,7 +81,7 @@ locals { cbci_admin_user = "admin_cbci_a" cbci_agents_ns = "cbci-agents" #K8S agent template name from the CasC bundle - cbci_agent_linuxtempl = "linux-mavenAndGo" + cbci_agent_linuxtempl = "linux-mavenAndKaniko-1G" cbci_agent_windowstempl = "windows-powershell" vault_ns = "vault" @@ -106,8 +106,9 @@ resource "time_static" "epoch" { # CloudBees CI Add-on module "eks_blueprints_addon_cbci" { - source = "cloudbees/cloudbees-ci-eks-addon/aws" - version = ">= 3.18072.0" + # source = "cloudbees/cloudbees-ci-eks-addon/aws" + # version = ">= 3.18072.0" + source = "../../" depends_on = [module.eks_blueprints_addons] @@ -124,16 +125,24 @@ module "eks_blueprints_addon_cbci" { })] } - create_k8s_secrets = true - k8s_secrets = templatefile("k8s/secrets-values.yml", { + create_casc_secrets = true + casc_secrets_file = templatefile("k8s/secrets-values.yml", { global_password = local.global_password s3bucketName = local.bucket_name awsRegion = var.aws_region adminMail = var.trial_license["email"] - githubUser = var.gh_user - githubToken = var.gh_token }) + create_reg_secret = true + reg_secret_ns = local.cbci_agents_ns + #Note: This blueprint tests DockerHub as container registry but different registries can be used. + reg_secret_auth = { + server = "https://index.docker.io/v1/" + username = var.dh_reg_secret_auth["username"] + password = var.dh_reg_secret_auth["password"] + email = var.dh_reg_secret_auth["email"] + } + prometheus_target = true } diff --git a/blueprints/02-at-scale/outputs.tf b/blueprints/02-at-scale/outputs.tf index 4de09e3b..47ef561e 100644 --- a/blueprints/02-at-scale/outputs.tf +++ b/blueprints/02-at-scale/outputs.tf @@ -47,12 +47,12 @@ output "cbci_oc_url" { output "cbci_oc_export_admin_crumb" { description = "Exports the operations center cbci_admin_user crumb, to access the REST API when CSRF is enabled." - value = "export CBCI_ADMIN_CRUMB=$(curl -s '${module.eks_blueprints_addon_cbci.cbci_oc_url}/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,%22:%22,//crumb)' --cookie-jar /tmp/cookies.txt --user ${local.cbci_admin_user}:$(kubectl get secret ${module.eks_blueprints_addon_cbci.cbci_secrets} -n ${module.eks_blueprints_addon_cbci.cbci_namespace} -o jsonpath=${local.global_pass_jsonpath} | base64 -d))" + value = "export CBCI_ADMIN_CRUMB=$(curl -s '${module.eks_blueprints_addon_cbci.cbci_oc_url}/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,%22:%22,//crumb)' --cookie-jar /tmp/cookies.txt --user ${local.cbci_admin_user}:$(kubectl get secret ${module.eks_blueprints_addon_cbci.cbci_sec_casc} -n ${module.eks_blueprints_addon_cbci.cbci_namespace} -o jsonpath=${local.global_pass_jsonpath} | base64 -d))" } output "cbci_oc_export_admin_api_token" { description = "Exports the operations center cbci_admin_user API token to access the REST API when CSRF is enabled. It expects CBCI_ADMIN_CRUMB as the environment variable." - value = "export CBCI_ADMIN_TOKEN=$(curl -s '${module.eks_blueprints_addon_cbci.cbci_oc_url}/user/${local.cbci_admin_user}/descriptorByName/jenkins.security.ApiTokenProperty/generateNewToken' --user ${local.cbci_admin_user}:$(kubectl get secret ${module.eks_blueprints_addon_cbci.cbci_secrets} -n ${module.eks_blueprints_addon_cbci.cbci_namespace} -o jsonpath=${local.global_pass_jsonpath} | base64 -d) --data 'newTokenName=kb-token' --cookie /tmp/cookies.txt -H $CBCI_ADMIN_CRUMB | jq -r .data.tokenValue)" + value = "export CBCI_ADMIN_TOKEN=$(curl -s '${module.eks_blueprints_addon_cbci.cbci_oc_url}/user/${local.cbci_admin_user}/descriptorByName/jenkins.security.ApiTokenProperty/generateNewToken' --user ${local.cbci_admin_user}:$(kubectl get secret ${module.eks_blueprints_addon_cbci.cbci_sec_casc} -n ${module.eks_blueprints_addon_cbci.cbci_namespace} -o jsonpath=${local.global_pass_jsonpath} | base64 -d) --data 'newTokenName=kb-token' --cookie /tmp/cookies.txt -H $CBCI_ADMIN_CRUMB | jq -r .data.tokenValue)" } output "cbci_oc_take_backups" { @@ -95,6 +95,11 @@ output "cbci_agent_windowstempl_events" { value = "kubectl get events -n ${local.cbci_agents_ns} | grep -i pod/${local.cbci_agent_windowstempl}" } +output "cbci_agent_sec_reg" { + description = "Retrieves the container registry secret deployed in the agents namespace." + value = "kubectl get secret ${module.eks_blueprints_addon_cbci.cbci_sec_registry} -n ${local.cbci_agents_ns} -o jsonpath='{.data.*}' | base64 -d" +} + output "acm_certificate_arn" { description = "AWS Certificate Manager (ACM) certificate for Amazon Resource Names (ARN)." value = module.acm.acm_certificate_arn @@ -177,7 +182,7 @@ output "grafana_dashboard" { output "global_password" { description = "Random string that is used as the global password." - value = "kubectl get secret ${module.eks_blueprints_addon_cbci.cbci_secrets} -n ${module.eks_blueprints_addon_cbci.cbci_namespace} -o jsonpath=${local.global_pass_jsonpath} | base64 -d" + value = "kubectl get secret ${module.eks_blueprints_addon_cbci.cbci_sec_casc} -n ${module.eks_blueprints_addon_cbci.cbci_namespace} -o jsonpath=${local.global_pass_jsonpath} | base64 -d" } output "vault_configure" { diff --git a/blueprints/02-at-scale/variables.tf b/blueprints/02-at-scale/variables.tf index 9e75cdb2..a29be22a 100644 --- a/blueprints/02-at-scale/variables.tf +++ b/blueprints/02-at-scale/variables.tf @@ -1,9 +1,6 @@ - -variable "tags" { - description = "Tags to apply to resources." - default = {} - type = map(string) -} +############ +# Required +############ variable "hosted_zone" { description = "Amazon Route 53 hosted zone. CloudBees CI applications are configured to use subdomains in this hosted zone." @@ -15,6 +12,20 @@ variable "trial_license" { type = map(string) } +variable "dh_reg_secret_auth" { + description = "Docker Hub Registry server authentication details for cbci-sec-reg secret." + type = map(string) + default = { + username = "foo" + password = "changeme1234" + email = "foo.bar@acme.com" + } +} + +############ +# Optional +############ + variable "suffix" { description = "Unique suffix to assign to all resources. When adding the suffix, changes are required in CloudBees CI for the validation phase." default = "" @@ -25,27 +36,25 @@ variable "suffix" { } } -variable "gh_user" { - description = "GitHub user for the CloudBees operations center credential GH-User-token, that is created via CloudBees CasC." - default = "exampleUser" +#Check number of AZ: aws ec2 describe-availability-zones --region var.aws_region +variable "aws_region" { + description = "AWS region to deploy resources to. It requires at minimun 3 AZs." type = string + default = "us-west-2" } -variable "gh_token" { - description = "GitHub token for the CloudBees operations center credential GH-User-token, that is created via CloudBees CasC." - default = "ExampleToken1234" - type = string +variable "tags" { + description = "Tags to apply to resources." + default = {} + type = map(string) } +############ +# Others. Hidden +############ + variable "ci" { description = "Running in a CI service versus running locally. False when running locally, true when running in a CI service." default = false type = bool } - -#Check number of AZ: aws ec2 describe-availability-zones --region var.aws_region -variable "aws_region" { - description = "AWS region to deploy resources to. It requires at minimun 3 AZs." - type = string - default = "us-west-2" -} From c5a7b2689d0ca9579220238a3f65a2bb58eb549c Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 30 Jul 2024 13:49:51 +0200 Subject: [PATCH 031/180] casc: adding label and hello world name tag --- .../02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml index 39019666..c21beef8 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml @@ -40,6 +40,7 @@ items: displayName: loadTest - kind: backupAndRestore name: restore + label: linux-mavenAndKaniko-XL buildersList: - restoreBuilder: ignoreConfirmationFile: true @@ -324,7 +325,7 @@ items: container(name: 'kaniko', shell: '/busybox/sh') { sh '''#!/busybox/sh echo "FROM jenkins/inbound-agent:latest" > Dockerfile - /kaniko/executor --context `pwd` --destination $TARGET_DH_ORG/hello-kaniko:latest + /kaniko/executor --context `pwd` --destination $TARGET_DH_ORG/hello-world:cbci-bp02 ''' } } From 554918ef71ff829215420291f205e54b6a9d94da Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 30 Jul 2024 13:52:32 +0200 Subject: [PATCH 032/180] Note on L vs XL agent builds --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 5fa3a7bd..e5dab15d 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -250,7 +250,7 @@ HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in t It triggers `ws-cache` pipeline from `team-b` controller. This pipeline uses [CloudBees Workspace Caching](https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-cache-step). Once the second build is complete, you can find the read cache operation at the beginning of the build logs and the write cache operation at the end of the build logs. - Note that this pipeline uses the On-Demand Linux Node Pool but there is also Spot Linux Node Pool available. + Note that this pipeline uses `linux-mavenAndKaniko-L` agent template deployed over On-demand Linux Nodes that have smaller instance types. On the other hand, `linux-mavenAndKaniko-XL` is deployed over Spot Linux Nodes that have larger instance types. - For Windows node pool use: From 5b41e1919355f0778768ac646b6b3fdc60677418 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 30 Jul 2024 13:52:56 +0200 Subject: [PATCH 033/180] fixing agent template name --- blueprints/02-at-scale/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/main.tf b/blueprints/02-at-scale/main.tf index 07948ed6..19250cd0 100644 --- a/blueprints/02-at-scale/main.tf +++ b/blueprints/02-at-scale/main.tf @@ -81,7 +81,7 @@ locals { cbci_admin_user = "admin_cbci_a" cbci_agents_ns = "cbci-agents" #K8S agent template name from the CasC bundle - cbci_agent_linuxtempl = "linux-mavenAndKaniko-1G" + cbci_agent_linuxtempl = "linux-mavenAndKaniko-L" cbci_agent_windowstempl = "windows-powershell" vault_ns = "vault" From b59ebe8ff1e1202b8df797d6bb6d279eb0ace656 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 30 Jul 2024 17:22:06 +0200 Subject: [PATCH 034/180] casc: adding ecr --- .../cbci/casc/mc/parent/jcasc/k8s-agents.yaml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml index 56157b6b..a5086287 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml @@ -90,6 +90,24 @@ kube: volumeMounts: - name: jenkins-docker-cfg mountPath: /kaniko/.docker + - args: + - "99d" + command: + - "sleep" + image: "gcr.io/kaniko-project/executor:latest" + imagePullPolicy: Always + name: "kaniko-ecr" + resources: + limits: + memory: "2Gi" + requests: + memory: "500Mi" + cpu: "250m" + env: + - name: AWS_SDK_LOAD_CONFIG + value: true + - name: AWS_EC2_METADATA_DISABLED + value: true volumes: - name: jenkins-docker-cfg projected: From 27e929f258bd59897f78337633e5ca234b02ba70 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 30 Jul 2024 17:29:50 +0200 Subject: [PATCH 035/180] setting to debug --- .../02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml index a5086287..d63db2a6 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml @@ -94,7 +94,7 @@ kube: - "99d" command: - "sleep" - image: "gcr.io/kaniko-project/executor:latest" + image: "gcr.io/kaniko-project/executor:debug" imagePullPolicy: Always name: "kaniko-ecr" resources: From 6fe4760416d3045fc421c60a1925d757146f4608 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 30 Jul 2024 19:14:22 +0200 Subject: [PATCH 036/180] casc: cleaning template --- .../02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml index d63db2a6..a2f6a175 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml @@ -45,7 +45,7 @@ kube: name: ${regSecretsName} items: - key: .dockerconfigjson - path: config.json + path: config.json nodeSelector: kubernetes.io/os: linux role: "build-linux" @@ -103,11 +103,6 @@ kube: requests: memory: "500Mi" cpu: "250m" - env: - - name: AWS_SDK_LOAD_CONFIG - value: true - - name: AWS_EC2_METADATA_DISABLED - value: true volumes: - name: jenkins-docker-cfg projected: From 9ee5c71429dc20b975da214c1714d07e6d34fa6c Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 2 Aug 2024 14:14:52 +0200 Subject: [PATCH 037/180] Remove properties test --- .cloudbees/workflows/my-test.yaml | 18 ------------------ 1 file changed, 18 deletions(-) delete mode 100644 .cloudbees/workflows/my-test.yaml diff --git a/.cloudbees/workflows/my-test.yaml b/.cloudbees/workflows/my-test.yaml deleted file mode 100644 index d9a7aefd..00000000 --- a/.cloudbees/workflows/my-test.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: automation.cloudbees.io/v1alpha1 -kind: workflow -name: My workflow - -on: - workflow_dispatch: - -jobs: - stage: - steps: - - name: Dump GitHub context - uses: docker://cgr.dev/chainguard/wolfi-base:latest - env: - CLOUDBEES_CONTEXT: ${{ toJSON(cloudbees) }} - run: | - echo "----- CONTEXT ------" - echo "cloudbees.scm.sha: ${{ cloudbees.scm.sha }}" - echo "$CLOUDBEES_CONTEXT" From 90fcd3da9a9ca4750bde31bff6fa6fedb21a9dde Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 2 Aug 2024 14:16:31 +0200 Subject: [PATCH 038/180] Casc: s3: st path as variable --- .../02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml | 2 +- blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml | 2 +- blueprints/02-at-scale/cbci/casc/oc/items/admin-folder.yaml | 2 +- blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml | 1 + 4 files changed, 4 insertions(+), 3 deletions(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml index c21beef8..e26bb5ea 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml @@ -50,7 +50,7 @@ items: s3Store: bucketName: "${sec_s3bucketName}" sse: true - bucketFolder: cbci/backup + bucketFolder: "${s3bucketPreffix}/backup" region: "${sec_awsRegion}" description: 'Validates the restore functionality of the CloudBees Backup plugin.' displayName: restore diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml index af7e1576..b5506dbf 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml @@ -42,7 +42,7 @@ aws: s3: container: "${sec_s3bucketName}" disableSessionToken: false - prefix: "${s3bucketPreffix}" + prefix: "${s3bucketPreffix}/" useHttp: false usePathStyleUrl: false useTransferAcceleration: false diff --git a/blueprints/02-at-scale/cbci/casc/oc/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/oc/items/admin-folder.yaml index b429d337..00735694 100644 --- a/blueprints/02-at-scale/cbci/casc/oc/items/admin-folder.yaml +++ b/blueprints/02-at-scale/cbci/casc/oc/items/admin-folder.yaml @@ -83,7 +83,7 @@ items: store: s3Store: bucketName: "${sec_s3bucketName}" - bucketFolder: cbci/backup + bucketFolder: "${s3bucketPreffix}/backup" region: "${sec_awsRegion}" itemSource: jenkinsRootItemSource: { diff --git a/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml index 5e01c6c5..7d3b3e3f 100644 --- a/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml +++ b/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml @@ -8,3 +8,4 @@ variables: - ldapUserSearch: "cn={0}" - vault_url: "http://vault.vault.svc.cluster.local:8200" - cascSecretsName: "cbci-sec-casc" + - s3bucketPreffix: "cbci" From a8863db3a2fc730642d1bbc138db805180e914ce Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 2 Aug 2024 14:17:56 +0200 Subject: [PATCH 039/180] casc: run pre-commit --- .../02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml | 2 +- .../02-at-scale/cbci/casc/mc/parent/variables/variables.yaml | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml index a2f6a175..882410ca 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml @@ -45,7 +45,7 @@ kube: name: ${regSecretsName} items: - key: .dockerconfigjson - path: config.json + path: config.json nodeSelector: kubernetes.io/os: linux role: "build-linux" diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml index 99faab96..76d47a05 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml @@ -1,4 +1,5 @@ variables: - ot_endpoint: "http://tempo.kube-prometheus-stack.svc.cluster.local:4317" - - s3bucketPreffix: "cbci/" - - regSecretsName: "cbci-sec-reg" \ No newline at end of file + - s3bucketPreffix: "cbci" + - regSecretsName: "cbci-sec-reg" + From 3242f07850f0da3660472fc3afe1e468dd5b7ee7 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 2 Aug 2024 18:13:31 +0200 Subject: [PATCH 040/180] casc: simplifying jobs --- .../casc/mc/parent/items/admin-folder.yaml | 243 ++++++++---------- 1 file changed, 113 insertions(+), 130 deletions(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml index e26bb5ea..e0bd8106 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml @@ -59,40 +59,6 @@ items: description: 'Contains validations for integrations tests.' displayName: validations items: - - kind: pipeline - name: build-agents-talks - concurrentBuild: true - definition: - cpsFlowDefinition: - sandbox: true - script: |- - timeout(time: 1, unit: 'HOURS'){ - podTemplate (inheritFrom: 'linux-mavenAndKaniko-L') { - retry (3) { - node(POD_LABEL) { - stage('beginning') { - sh 'date > date.txt' - archiveArtifacts artifacts: 'date.txt', fingerprint: true - } - } - } - } - checkpoint 'middle' - podTemplate (inheritFrom: 'linux-mavenAndKaniko-XL') { - retry (3) { - node(POD_LABEL) { - stage('end') { - dir ('unarchive'){ - unarchive mapping: ['date.txt': 'my-date.txt'] - sh 'cat my-date.txt' - } - } - } - } - } - } - description: 'It validates archives/unarchive s3 artifacts from different pods agents in the same build.' - displayName: build-agents-talks - kind: pipeline name: downstream-artifact concurrentBuild: true @@ -134,69 +100,111 @@ items: description: 'It validates archives/unarchive s3 artifacts (https://plugins.jenkins.io/artifact-manager-s3/) from different pods agents in different build. It uses artifacts from upstream build.' displayName: downstream-artifact - kind: pipeline - name: upstream-artifact + name: ws-cache concurrentBuild: true definition: cpsFlowDefinition: sandbox: true script: |- pipeline { + agent none options { retry(3) timeout(time: 1, unit: 'HOURS') } - agent{ - label 'linux-mavenAndKaniko-L' - } stages { - stage('Maven') { - stages { - stage ('Build'){ - steps { - container('maven') { - sh ''' - echo "Build number ^^${BUILD_NUMBER}" >> f_1 - mvn -version >> f_1 - ''' - } + stage ("s3"){ + parallel { + stage('Workspace Cache') { + agent { + label "linux-mavenAndKaniko-L" } - } - stage ('Archive f_1'){ - steps { - container('kaniko') { - archiveArtifacts artifacts: 'f_1', fingerprint: true - } + environment { + MAVEN_PROJECT = 'https://github.com/jglick/simple-maven-project-with-tests' + CACHE = 'ws-cache-maven' } - } - } - } - stage('Kaniko') { - stages { - stage ("Unarchive"){ - steps { - container('maven') { - dir ('unarchive'){ - sh 'ls -la' - unarchive mapping: [f_1: 'f_1'] - sh 'ls -la; cat f_1; mv f_1 f_2' + stages { + stage('Checkout') { + steps { + git env.MAVEN_PROJECT } } - } - } - stage ('Build'){ - steps { - container('kaniko') { - dir ('unarchive'){ - sh 'ls /kaniko/executor >> f_2' + stage('Read') { + steps { + readCache name: env.CACHE + } + } + stage('Build') { + steps { + container('maven') { + sh 'mvn clean package -DskipTests -Dmaven.repo.local=./maven-repo' + } } } } + post { + success { + writeCache name: env.CACHE, includes: 'maven-repo/**' + } + } } - stage ('Archive f_2'){ - steps { - container('maven') { - dir ('unarchive'){ - archiveArtifacts artifacts: 'f_2', fingerprint: true + stage('Artifacts') { + agent { + label "linux-mavenAndKaniko-XL" + } + stages { + stage('Maven') { + stages { + stage ('Build'){ + steps { + container('maven') { + sh ''' + echo "Build number ^${BUILD_NUMBER}" >> f_1 + mvn -version >> f_1 + ''' + } + } + } + stage ('Archive f_1'){ + steps { + container('kaniko') { + archiveArtifacts artifacts: 'f_1', fingerprint: true + } + } + } + } + } + stage('Kaniko') { + stages { + stage ("Unarchive"){ + steps { + container('maven') { + dir ('unarchive'){ + sh 'ls -la' + unarchive mapping: [f_1: 'f_1'] + sh 'ls -la; cat f_1; mv f_1 f_2' + } + } + } + } + stage ('Build'){ + steps { + container('kaniko') { + dir ('unarchive'){ + sh "ls -la /kaniko/executor >> f_2" + } + } + } + } + stage ('Archive f_2'){ + steps { + container('maven') { + dir ('unarchive'){ + archiveArtifacts artifacts: 'f_2', fingerprint: true + } + } + } + } } } } @@ -205,8 +213,12 @@ items: } } } - description: 'It validates archives/unarchive s3 artifacts (https://plugins.jenkins.io/artifact-manager-s3/) from different pods agents in different build. It creates artifacts for downstream build.' - displayName: upstream-artifact + description: 'Pipeline that demonstrates the s3 integrations for CloudBees Workspace + Caching (https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-cache-step) + and s3 Artifact (https://plugins.jenkins.io/artifact-manager-s3/) are working' + disabled: false + displayName: ws-cache + resumeBlocked: false - kind: pipeline name: windows-builds-nodes concurrentBuild: false @@ -234,51 +246,6 @@ items: } description: 'It validates the windows nodes builds.' displayName: windows-builds-nodes - - kind: pipeline - name: ws-cache - concurrentBuild: true - definition: - cpsFlowDefinition: - sandbox: true - script: |- - pipeline { - options { - retry(3) - timeout(time: 1, unit: 'HOURS') - } - agent{ - label 'linux-mavenAndKaniko-L' - } - environment { - MAVEN_PROJECT = 'https://github.com/jglick/simple-maven-project-with-tests' - CACHE = 'ws-cache-maven' - } - stages { - stage('Checkout') { - steps { - git env.MAVEN_PROJECT - } - } - stage('Read') { - steps { - readCache name: env.CACHE - } - } - stage('Build') { - steps { - container('maven') { - sh 'mvn clean package -DskipTests -Dmaven.repo.local=./maven-repo' - } - } - } - } - post { - success { - writeCache name: env.CACHE, includes: 'maven-repo/**' - } - } - } - description: 'Pipeline that demonstrates the usage of CloudBees Workspace Caching: https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-cache-step.' - kind: pipeline name: vault-credentials concurrentBuild: true @@ -317,18 +284,29 @@ items: label 'linux-mavenAndKaniko-XL' } parameters { - string(name: 'TARGET_DH_ORG', description: 'DockerHub Organization to Push the image') + string(name: 'TARGET_DH_ORG', description: 'DockerHub Organization to Push the image', defaultValue: 'example-org', ) + string(name: 'TARGET_ECR_URI', description: 'ECR URI', defaultValue: '99999999999.dkr.ecr.us-east-1.amazonaws.com/test-private-example', ) } stages { - stage('Build with Kaniko') { + stage('Public Registry') { steps { container(name: 'kaniko', shell: '/busybox/sh') { sh '''#!/busybox/sh echo "FROM jenkins/inbound-agent:latest" > Dockerfile - /kaniko/executor --context `pwd` --destination $TARGET_DH_ORG/hello-world:cbci-bp02 + /kaniko/executor --context `pwd` --destination ${TARGET_DH_ORG}/cbci-bp02-kaniko:${BUILD_ID} ''' } } + } + stage('Private Registry') { + steps { + container(name: 'kaniko-ecr', shell: '/busybox/sh') { + sh '''#!/busybox/sh + echo "FROM jenkins/inbound-agent:latest" > Dockerfile + /kaniko/executor --context `pwd` --destination=${TARGET_ECR_URI}:${BUILD_ID} + ''' + } + } } } } @@ -337,7 +315,12 @@ items: parameterDefinitions: - string: trim: false + defaultValue: example-org name: TARGET_DH_ORG description: DockerHub Organization to Push the image - resumeBlocked: false - description: 'It validates that Authentication for DockerHub and Kaniko is working fine.' + - string: + trim: false + defaultValue: 99999999999.dkr.ecr.us-east-1.amazonaws.com/test-private-example + name: TARGET_ECR_URI + description: ECR URI + description: 'It validates Authentication to Push images to DockerHub and ECR.' From fb50690e7eafbf221c972c34534669e5ef46c355 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 2 Aug 2024 18:28:10 +0200 Subject: [PATCH 041/180] clean job ietms --- .../casc/mc/parent/items/admin-folder.yaml | 43 +------------------ 1 file changed, 1 insertion(+), 42 deletions(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml index e0bd8106..7e0e4075 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml @@ -60,47 +60,7 @@ items: displayName: validations items: - kind: pipeline - name: downstream-artifact - concurrentBuild: true - definition: - cpsFlowDefinition: - sandbox: true - script: |- - pipeline { - agent{ - label 'linux-mavenAndKaniko-XL' - } - options { - retry(3) - timeout(time: 1, unit: 'HOURS') - } - environment { - ARTIFACT_SOURCE_JOB = 'upstream-artifact' - } - stages { - stage('Build Upstream') { - steps { - build 'upstream-artifact' - } - } - stage('Copy Artifacts') { - steps { - sh 'ls -la' - copyArtifacts fingerprintArtifacts: true, projectName: env.ARTIFACT_SOURCE_JOB, selector: lastSuccessful() - } - } - stage('Read Artifacts') { - steps { - sh 'ls -la' - sh 'cat f_2' - } - } - } - } - description: 'It validates archives/unarchive s3 artifacts (https://plugins.jenkins.io/artifact-manager-s3/) from different pods agents in different build. It uses artifacts from upstream build.' - displayName: downstream-artifact - - kind: pipeline - name: ws-cache + name: s3-WScacheAndArtifacts concurrentBuild: true definition: cpsFlowDefinition: @@ -217,7 +177,6 @@ items: Caching (https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-cache-step) and s3 Artifact (https://plugins.jenkins.io/artifact-manager-s3/) are working' disabled: false - displayName: ws-cache resumeBlocked: false - kind: pipeline name: windows-builds-nodes From 1112e44cbb45e96f129998452a8a0927b1d3d19d Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 2 Aug 2024 19:56:04 +0200 Subject: [PATCH 042/180] Adding ECR instance profile --- blueprints/02-at-scale/main.tf | 102 ++++++++++++++++++++++++++------- 1 file changed, 82 insertions(+), 20 deletions(-) diff --git a/blueprints/02-at-scale/main.tf b/blueprints/02-at-scale/main.tf index 19250cd0..0efd3f3a 100644 --- a/blueprints/02-at-scale/main.tf +++ b/blueprints/02-at-scale/main.tf @@ -10,17 +10,20 @@ locals { # Infra ############ - name = var.suffix == "" ? "cbci-bp02" : "cbci-bp02-${var.suffix}" - vpc_name = "${local.name}-vpc" - cluster_name = "${local.name}-eks" - efs_name = "${local.name}-efs" - resource_group_name = "${local.name}-rg" - bucket_name = "${local.name}-s3" - cbci_instance_profile = "${local.name}-instance_profile" - cbci_iam_role = "${local.name}-iam_role_mn" - cbci_inline_policy = "${local.name}-iam_inline_policy" - kubeconfig_file = "kubeconfig_${local.name}.yaml" - kubeconfig_file_path = abspath("k8s/${local.kubeconfig_file}") + name = var.suffix == "" ? "cbci-bp02" : "cbci-bp02-${var.suffix}" + vpc_name = "${local.name}-vpc" + cluster_name = "${local.name}-eks" + efs_name = "${local.name}-efs" + resource_group_name = "${local.name}-rg" + bucket_name = "${local.name}-s3" + cbci_instance_profile_s3 = "${local.name}-instance_profile_s3" + cbci_iam_role_s3 = "${local.name}-iam_role_s3" + cbci_inline_policy_s3 = "${local.name}-iam_inline_policy_s3" + cbci_instance_profile_ecr = "${local.name}-instance_profile_ecr" + cbci_iam_role_ecr = "${local.name}-iam_role_ecr" + cbci_inline_policy_ecr = "${local.name}-iam_inline_policy_ecr" + kubeconfig_file = "kubeconfig_${local.name}.yaml" + kubeconfig_file_path = abspath("k8s/${local.kubeconfig_file}") vpc_cidr = "10.0.0.0/16" azs = slice(data.aws_availability_zones.available.names, 0, 3) @@ -459,7 +462,7 @@ module "eks" { storage = "enabled" } create_iam_role = false - iam_role_arn = aws_iam_role.managed_ng.arn + iam_role_arn = aws_iam_role.managed_ng_s3.arn ami_type = "BOTTLEROCKET_ARM_64" platform = "bottlerocket" enable_bootstrap_user_data = true @@ -475,6 +478,8 @@ module "eks" { labels = { role = "build-linux" } + create_iam_role = false + iam_role_arn = aws_iam_role.managed_ng_ecr.arn ami_type = "BOTTLEROCKET_ARM_64" platform = "bottlerocket" enable_bootstrap_user_data = true @@ -494,6 +499,8 @@ module "eks" { labels = { role = "build-linux-spot" } + create_iam_role = false + iam_role_arn = aws_iam_role.managed_ng_ecr.arn ami_type = "BOTTLEROCKET_ARM_64" platform = "bottlerocket" enable_bootstrap_user_data = true @@ -511,6 +518,8 @@ module "eks" { labels = { role = "build-linux-spot" } + create_iam_role = false + iam_role_arn = aws_iam_role.managed_ng_ecr.arn ami_type = "BOTTLEROCKET_ARM_64" platform = "bottlerocket" enable_bootstrap_user_data = true @@ -555,9 +564,9 @@ data "aws_iam_policy_document" "managed_ng_assume_role_policy" { } } -resource "aws_iam_role" "managed_ng" { - name = local.cbci_iam_role - description = "EKS Managed Node group IAM Role" +resource "aws_iam_role" "managed_ng_s3" { + name = local.cbci_iam_role_s3 + description = "EKS Managed Node group IAM Role s3" assume_role_policy = data.aws_iam_policy_document.managed_ng_assume_role_policy.json path = "/" force_detach_policies = true @@ -570,7 +579,7 @@ resource "aws_iam_role" "managed_ng" { ] # Additional Permissions for for EKS Managed Node Group per https://docs.aws.amazon.com/eks/latest/userguide/create-node-role.html inline_policy { - name = local.cbci_inline_policy + name = local.cbci_inline_policy_s3 policy = jsonencode( { "Version" : "2012-10-17", @@ -596,7 +605,60 @@ resource "aws_iam_role" "managed_ng" { "s3:prefix" : "${local.cbci_s3_prefix}/*" } } - }, + } + ] + } + ) + } + tags = var.tags +} + +resource "aws_iam_instance_profile" "managed_ng_s3" { + name = local.cbci_instance_profile_s3 + role = aws_iam_role.managed_ng_s3.name + path = "/" + + lifecycle { + create_before_destroy = true + } + + tags = var.tags +} + +resource "aws_iam_role" "managed_ng_ecr" { + name = local.cbci_iam_role_ecr + description = "EKS Managed Node group IAM Role ECR" + assume_role_policy = data.aws_iam_policy_document.managed_ng_assume_role_policy.json + path = "/" + force_detach_policies = true + # Mandatory for EKS Managed Node Group + managed_policy_arns = [ + "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy", + "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", + "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly" + ] + # Additional Permissions for for EKS Managed Node Group per https://docs.aws.amazon.com/eks/latest/userguide/create-node-role.html + inline_policy { + name = local.cbci_inline_policy_ecr + policy = jsonencode( + { + "Version" : "2012-10-17", + "Statement" : [ + { + "Sid" : "ecrKaniko", + "Effect" : "Allow", + "Action" : [ + "ecr:GetDownloadUrlForLayer", + "ecr:GetAuthorizationToken", + "ecr:InitiateLayerUpload", + "ecr:UploadLayerPart", + "ecr:CompleteLayerUpload", + "ecr:PutImage", + "ecr:BatchGetImage", + "ecr:BatchCheckLayerAvailability" + ], + "Resource" : "*" + } ] } ) @@ -604,9 +666,9 @@ resource "aws_iam_role" "managed_ng" { tags = var.tags } -resource "aws_iam_instance_profile" "managed_ng" { - name = local.cbci_instance_profile - role = aws_iam_role.managed_ng.name +resource "aws_iam_instance_profile" "managed_ng_ecr" { + name = local.cbci_instance_profile_ecr + role = aws_iam_role.managed_ng_ecr.name path = "/" lifecycle { From 5fd498c4672cde34b213a98f0e37ce3c04072f97 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 2 Aug 2024 19:56:35 +0200 Subject: [PATCH 043/180] Adding Container Registry section --- blueprints/02-at-scale/README.md | 56 +++++++++++++++++++++----------- 1 file changed, 37 insertions(+), 19 deletions(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index e5dab15d..c6724a24 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -68,8 +68,7 @@ This blueprint divides scalable node groups for different types of workloads: | trial_license | CloudBees CI trial license details for evaluation. | `map(string)` | n/a | yes | | aws_region | AWS region to deploy resources to. It requires at minimun 3 AZs. | `string` | `"us-west-2"` | no | | ci | Running in a CI service versus running locally. False when running locally, true when running in a CI service. | `bool` | `false` | no | -| gh_token | GitHub token for the CloudBees operations center credential GH-User-token, that is created via CloudBees CasC. | `string` | `"ExampleToken1234"` | no | -| gh_user | GitHub user for the CloudBees operations center credential GH-User-token, that is created via CloudBees CasC. | `string` | `"exampleUser"` | no | +| dh_reg_secret_auth | Docker Hub Registry server authentication details for cbci-sec-reg secret. | `map(string)` | 
{
  "email": "foo.bar@acme.com",
  "password": "changeme1234",
  "username": "foo"
}
| no | | suffix | Unique suffix to assign to all resources. When adding the suffix, changes are required in CloudBees CI for the validation phase. | `string` | `""` | no | | tags | Tags to apply to resources. | `map(string)` | `{}` | no | @@ -182,10 +181,11 @@ Once the resources have been created, a `kubeconfig` file is created in the [/k8 ##### Kubernetes Secret -Beyond the CloudBees CI Addon for demo purposes, Kubernetes secrets can be managed via [External Secret Operators](https://aws-ia.github.io/terraform-aws-eks-blueprints-addons/main/addons/external-secrets/). +This blueprint uses a couple of Kubernetes secrets for different purposes. > [!NOTE] -> Kubernetes secrets could be also be retrived as Jenkins Credentials via using the [Kubernetes Credentials Provider plugin](https://jenkinsci.github.io/kubernetes-credentials-provider-plugin/). +> - Beyond the CloudBees CI Addon (for demo purposes), Kubernetes secrets can be managed via [External Secret Operators](https://aws-ia.github.io/terraform-aws-eks-blueprints-addons/main/addons/external-secrets/). +> - Kubernetes secrets could be also be retrived as Jenkins Credentials via using the [Kubernetes Credentials Provider plugin](https://jenkinsci.github.io/kubernetes-credentials-provider-plugin/). ###### Casc Secrets @@ -193,15 +193,14 @@ The secrets key/value file defined in [k8s/secrets-values.yml](k8s/secrets-value ###### Container Registry Secrets -DockerHub authentication is stored as Kubernetes secrets (`cbci-agent-sec-reg`) and mounted to [Kaniko agent containers](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/using-kaniko) to build and push images to the target container registry. +DockerHub authentication is stored as Kubernetes secrets (`cbci-agent-sec-reg`) and mounted to [Kaniko agent containers](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/using-kaniko) to build and push images to this registry. The secret is created using the `dh_reg_secret_auth` variable. ```sh eval $(terraform output --raw cbci_agent_sec_reg) ``` > [!NOTE] -> - This blueprint uses DockerHub as an example but different container registries services can be used. -> - Besides Kaniko, there are [other alternitives tools](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/using-kaniko#_alternatives). +> ECR authentication is done via instance profile connected to `build-linux-spot` Node pools. ##### HashiCorp Vault @@ -226,6 +225,8 @@ HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in t #### Builds +##### Build Node Pools + 1. For the following validations, builds will be triggered remotely. Start by issuing the following command to retrieve an [API token](https://docs.cloudbees.com/docs/cloudbees-ci-api/latest/api-authentication) for the `admin_cbci_a` user with the correct permissions for the required actions: ```sh @@ -242,25 +243,27 @@ HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in t 2. Once you have retrieved the API token, issue the following commands to trigger builds using the [POST queue for hibernation API endpoint](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/managing-controllers#_post_queue_for_hibernation). If successful, an `HTTP/2 201` response is returned, indicating the REST API call has been correctly received by the CloudBees CI controller. -- For Linux node pools use: + - For Linux node pools use: - ```sh - eval $(terraform output --raw cbci_controller_b_ws_cache_build) - ``` + ```sh + eval $(terraform output --raw cbci_controller_b_s3_build) + ``` - It triggers `ws-cache` pipeline from `team-b` controller. This pipeline uses [CloudBees Workspace Caching](https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-cache-step). Once the second build is complete, you can find the read cache operation at the beginning of the build logs and the write cache operation at the end of the build logs. + It triggers `s3-WScacheAndArtifacts` pipeline from `team-b` controller. This pipeline validates a couple of s3 integrations in parallel: one for [CloudBees Workspace Caching](https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-cache-step) (using `linux-mavenAndKaniko-L`) and another for [s3 Artifact Manager](https://plugins.jenkins.io/artifact-manager-s3/) (using `linux-mavenAndKaniko-XL`). - Note that this pipeline uses `linux-mavenAndKaniko-L` agent template deployed over On-demand Linux Nodes that have smaller instance types. On the other hand, `linux-mavenAndKaniko-XL` is deployed over Spot Linux Nodes that have larger instance types. + Once the second build is complete, you can find the read cache operation at the beginning of the build logs and the write cache operation at the end of the build logs. -- For Windows node pool use: + The `linux-mavenAndKaniko-L` agent template is deployed over On-demand Linux Nodes that have smaller instance types vs the `linux-mavenAndKaniko-XL` template that is deployed over Spot Linux Nodes that have defined larger instance types. - ```sh - eval $(terraform output --raw cbci_controller_c_windows_node_build) - ``` + - For Windows node pool use: + + ```sh + eval $(terraform output --raw cbci_controller_c_windows_node_build) + ``` - It triggers `windows-build-nodes` pipeline from `team-c-ha` controller. + It triggers `windows-build-nodes` pipeline from `team-c-ha` controller. - Note that the first build for a new Windows image container can take up to 10 minutes to run; subsequent builds should take seconds to run. This behavior can be improved as explained in the section [Architecture](#architecture). + Note that the first build for a new Windows image container can take up to 10 minutes to run; subsequent builds should take seconds to run. This behavior can be improved as explained in the section [Architecture](#architecture). 3. Right after triggering the builds, issue the following to validate pod agent provisioning to build the pipeline code: @@ -270,6 +273,21 @@ HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in t 4. Check build logs by signing in to the `team-b` and `team-c-ha` controllers, respectively. Navigate to the pipeline jobs and select the first build, indicated by the `#1` build number. [CloudBees Pipeline Explorer](https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-pipeline-explorer-plugin) is enabled as a default. +##### Container Registry + +This blueprints uses a couple of container registries for different purposes. + +- The Public Registry uses DockerHub (It requires an existing DockerHub Organization). +- The Private Registry uses AWS ECR (It requires an existing ECR Repository). + +> [!NOTE] +> Other Container Registry services can be used for the same purporses. + +Access with admin role to CloudBees CI to `team-b` or `team-c-ha` to run the pipeline _admin_ > _validations_ > _kaniko_ enter as parameters an existing DockerHub Organization and an existing AWS ECR Repository to test that Build and Push towards every repository works fine. + +> [!NOTE] +> Besides Kaniko, there are [other alternitives tools](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/using-kaniko#_alternatives). + #### Back up and restore For backup and restore operations, you can use the [preconfigured CloudBees CI Cluster Operations job](#create-daily-backups-using-a-cloudbees-ci-cluster-operations-job) to automatically perform a daily backup, which can be used for Amazon EFS and Amazon EBS storage. From 8a4544e867e29d0ee42e4c84f3c5e17ef175b713 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 2 Aug 2024 20:20:15 +0200 Subject: [PATCH 044/180] chore: adapting output to new piepline name --- blueprints/02-at-scale/outputs.tf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/blueprints/02-at-scale/outputs.tf b/blueprints/02-at-scale/outputs.tf index 47ef561e..1c7da431 100644 --- a/blueprints/02-at-scale/outputs.tf +++ b/blueprints/02-at-scale/outputs.tf @@ -70,9 +70,9 @@ output "cbci_controller_c_hpa" { value = "kubectl get hpa team-c-ha -n ${module.eks_blueprints_addon_cbci.cbci_namespace}" } -output "cbci_controller_b_ws_cache_build" { - description = "team-b hibernation monitor endpoint to the build workspace cache. It expects CBCI_ADMIN_TOKEN as the environment variable." - value = "curl -i -XPOST -u ${local.cbci_admin_user}:$CBCI_ADMIN_TOKEN ${local.hibernation_monitor_url}/hibernation/queue/team-b/job/admin/job/validations/job/ws-cache/build" +output "cbci_controller_b_s3_build" { + description = "team-b hibernation monitor endpoint to the build s3-WScacheAndArtifacts. It expects CBCI_ADMIN_TOKEN as the environment variable." + value = "curl -i -XPOST -u ${local.cbci_admin_user}:$CBCI_ADMIN_TOKEN ${local.hibernation_monitor_url}/hibernation/queue/team-b/job/admin/job/validations/job/s3-WScacheAndArtifacts/build" } output "cbci_controller_c_windows_node_build" { From 757e6ed353e07a518ef23972669cf5a4b786f652 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 2 Aug 2024 20:21:42 +0200 Subject: [PATCH 045/180] Adding Container Registry modifications --- .../img/at-scale.architect.drawio.svg | 84 ++- .../02-at-scale/img/at-scale.k8s.drawio.svg | 478 +++++++++--------- 2 files changed, 298 insertions(+), 264 deletions(-) diff --git a/blueprints/02-at-scale/img/at-scale.architect.drawio.svg b/blueprints/02-at-scale/img/at-scale.architect.drawio.svg index 2adc4ba9..1561c961 100644 --- a/blueprints/02-at-scale/img/at-scale.architect.drawio.svg +++ b/blueprints/02-at-scale/img/at-scale.architect.drawio.svg @@ -1,4 +1,4 @@ - + @@ -231,29 +231,6 @@ - - - - -
-
-
- - - Instance -
- profile - - -
-
-
- - - Instance... - - - @@ -871,7 +848,25 @@ - + + + + +
+
+
+ s3 +
+ Profile +
+
+
+ + + s3... + + + @@ -949,6 +944,45 @@ + + + + + +
+
+
+ Elastic Container +
+ Registry +
+
+
+ + + Elastic Co... + + + + + + + +
+
+
+ ECR +
+ Profile +
+
+
+ + + ECR... + + + diff --git a/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg b/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg index 7d1f7eb6..2d4867e0 100644 --- a/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg +++ b/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg @@ -1,4 +1,4 @@ - + @@ -18,12 +18,12 @@ - + - - + + - +
@@ -40,50 +40,14 @@ - - - -
-
-
- 4 -
-
-
- - - 4 - - - - - - - - -
-
-
- do -
-
-
-
- - - do - - - - - + - + - -
+ +
@@ -93,16 +57,16 @@
- + /velero - + - +
@@ -119,9 +83,9 @@ - + - +
@@ -141,9 +105,9 @@ - + - +
@@ -164,9 +128,9 @@ - + - +
@@ -187,9 +151,9 @@ - + - +
@@ -209,9 +173,9 @@ - + - +
@@ -235,9 +199,9 @@ - + - +
@@ -255,9 +219,9 @@ - + - +
@@ -273,9 +237,9 @@ - + - +
@@ -293,9 +257,9 @@ - + - +
@@ -328,9 +292,9 @@ - + - +
@@ -348,9 +312,9 @@ - + - +
@@ -369,9 +333,9 @@ - + - +
@@ -385,11 +349,11 @@ - - - + + + - +
@@ -403,11 +367,9 @@ - - - + - +
@@ -425,13 +387,11 @@ - - + - - + - +
@@ -449,13 +409,12 @@ - - - - - + + + + - +
@@ -473,12 +432,11 @@ - - - + + - +
@@ -496,12 +454,11 @@ - - - - + + + - +
@@ -521,10 +478,9 @@ - - + - +
@@ -540,12 +496,11 @@ - - - - + + + - +
@@ -563,13 +518,13 @@ - - - - - + + + + + - +
@@ -588,12 +543,10 @@ - - - + - -
+ +
@@ -605,19 +558,17 @@
- + bottle-rocket-oper... - - - - - - + + + + - +
@@ -635,10 +586,9 @@ - - + - +
@@ -658,11 +608,10 @@ - - + - -
+ +
@@ -676,18 +625,16 @@
- + cert-manager - - - - - + + + - +
@@ -708,10 +655,9 @@ - - + - +
@@ -734,15 +680,13 @@ - - - - - - - + + + + + - +
@@ -758,13 +702,12 @@ - - - - - + + + + - +
@@ -778,15 +721,14 @@ - - - - - - - + + + + + + - +
@@ -800,13 +742,11 @@ - - - - - + + + - +
@@ -826,38 +766,35 @@ - + - - - + - - + + Tempo - + Prometheus - + Grafana - - - - - - + + + + + - +
@@ -877,11 +814,10 @@ - - - + + - +
@@ -902,10 +838,10 @@ - - + + - +
@@ -921,12 +857,12 @@ - + - - + + - +
@@ -944,10 +880,10 @@ - - + + - +
@@ -966,16 +902,13 @@ - - - - - - - - + + + + + - +
@@ -992,32 +925,31 @@ - + cjoc - + team-b - + team-a - - - - - - - + + + + + + - +
@@ -1040,33 +972,31 @@ - - - + + - - + team-c-ha - - - - - - - - + + + + + + - -
-
+ +
+
+ DockerHub +
Container Registry
@@ -1076,11 +1006,81 @@
- - Container Registr... + + DockerHub... + + + + + + + + +
+
+
+ + + Elastic Container +
+ + Registry + +
+
+
+ + + Elastic Container... + + + + +
+
+
+ + + Private Images + + +
+
+
+ + + Private Images + + + + + + + +
+
+
+ + + Public Images + + +
+
+
+ + + Public Images + + + + + + + From 21bc0deeb7d4adfb9d510a338da83ece3d40bd9d Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 2 Aug 2024 20:31:26 +0200 Subject: [PATCH 046/180] remove duplications --- blueprints/02-at-scale/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index c6724a24..d0e09f21 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -277,8 +277,8 @@ HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in t This blueprints uses a couple of container registries for different purposes. -- The Public Registry uses DockerHub (It requires an existing DockerHub Organization). -- The Private Registry uses AWS ECR (It requires an existing ECR Repository). +- The Public Registry uses DockerHub. +- The Private Registry uses AWS ECR. > [!NOTE] > Other Container Registry services can be used for the same purporses. From 78c2a3f9aa0f38865f3605e7b6bb343eaaf82897 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 2 Aug 2024 20:34:30 +0200 Subject: [PATCH 047/180] Using mabven kaniko for both --- blueprints/02-at-scale/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/main.tf b/blueprints/02-at-scale/main.tf index 0efd3f3a..dc541efb 100644 --- a/blueprints/02-at-scale/main.tf +++ b/blueprints/02-at-scale/main.tf @@ -84,7 +84,7 @@ locals { cbci_admin_user = "admin_cbci_a" cbci_agents_ns = "cbci-agents" #K8S agent template name from the CasC bundle - cbci_agent_linuxtempl = "linux-mavenAndKaniko-L" + cbci_agent_linuxtempl = "linux-mavenAndKaniko-" cbci_agent_windowstempl = "windows-powershell" vault_ns = "vault" From f96cca404ed55f78cdf857185ff0f35e8a29c60b Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 2 Aug 2024 21:34:50 +0200 Subject: [PATCH 048/180] Updating probes to Container Registry --- blueprints/helpers.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/blueprints/helpers.sh b/blueprints/helpers.sh index 7d487162..85f3dbb8 100755 --- a/blueprints/helpers.sh +++ b/blueprints/helpers.sh @@ -125,7 +125,7 @@ probes () { ERROR "Problem while getting Global Pass." fi until { eval "$(tf-output "$root" cbci_oc_export_admin_crumb)" && eval "$(tf-output "$root" cbci_oc_export_admin_api_token)" && [ -n "$CBCI_ADMIN_TOKEN" ]; }; do sleep $wait && echo "Waiting for Admin Token..."; done && INFO "Admin Token: $CBCI_ADMIN_TOKEN" - eval "$(tf-output "$root" cbci_controller_b_ws_cache_build)" > /tmp/controller-b-hibernation && + eval "$(tf-output "$root" cbci_controller_b_s3_build)" > /tmp/controller-b-hibernation && if grep "201\|202" /tmp/controller-b-hibernation; then INFO "Hibernation Post Queue Controller B OK." else @@ -141,9 +141,9 @@ probes () { INFO "Team C HPA is Ready." until [ "$(eval "$(tf-output "$root" cbci_agent_windowstempl_events)" | grep -c 'Allocated Resource vpc.amazonaws.com')" -ge 1 ]; do sleep $wait && echo "Waiting for Windows Template Pod to allocate resource vpc.amazonaws.com"; done ;\ eval "$(tf-output "$root" cbci_agent_windowstempl_events)" && INFO "Windows Template Example is OK." - until [ "$(eval "$(tf-output "$root" cbci_agent_linuxtempl_events)" | grep -c 'Created container maven')" -ge 1 ]; do sleep $wait && echo "Waiting for Linux Template Pod to create maven container"; done ;\ + until [ "$(eval "$(tf-output "$root" cbci_agent_linuxtempl_events)" | grep -c 'Created container maven')" -ge 2 ]; do sleep $wait && echo "Waiting for both Linux Template Pods (On demand and Spot) to create maven container"; done ;\ eval "$(tf-output "$root" cbci_agent_linuxtempl_events)" && INFO "Linux Template Example is OK." - until [ "$(eval "$(tf-output "$root" s3_list_objects)" | grep -c 'cbci/')" -ge 1 ]; do sleep $wait && echo "Waiting for WS Cache to be uploaded into s3 cbci"; done ;\ + until [ "$(eval "$(tf-output "$root" s3_list_objects)" | grep -c 'cbci/')" -ge 2 ]; do sleep $wait && echo "Waiting for WS Cache and Artifacts to be uploaded into s3 cbci"; done ;\ eval "$(tf-output "$root" s3_list_objects)" | grep 'cbci/' && INFO "CBCI s3 Permissions are configured correctly." eval "$(tf-output "$root" velero_backup_schedule)" && eval "$(tf-output "$root" velero_backup_on_demand)" > /tmp/velero-backup.txt && \ if grep 'Backup completed with status: Completed' /tmp/velero-backup.txt; then From 4b8ec003ceea3b39169c8ec4f9a99d8fc50895aa Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 2 Aug 2024 19:37:06 +0000 Subject: [PATCH 049/180] terraform-docs: automated action --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index d0e09f21..e9d4e3dd 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -83,7 +83,7 @@ This blueprint divides scalable node groups for different types of workloads: | cbci_agent_sec_reg | Retrieves the container registry secret deployed in the agents namespace. | | cbci_agent_windowstempl_events | Retrieves a list of events related to Windows template agents. | | cbci_agents_pods | Retrieves a list of agent pods running in the agents namespace. | -| cbci_controller_b_ws_cache_build | team-b hibernation monitor endpoint to the build workspace cache. It expects CBCI_ADMIN_TOKEN as the environment variable. | +| cbci_controller_b_s3_build | team-b hibernation monitor endpoint to the build s3-WScacheAndArtifacts. It expects CBCI_ADMIN_TOKEN as the environment variable. | | cbci_controller_c_hpa | team-c horizontal pod autoscaling. | | cbci_controller_c_windows_node_build | team-c hibernation monitor endpoint to the Windows build nodes. It expects CBCI_ADMIN_TOKEN as the environment variable. | | cbci_controllers_pods | Operations center pod for the CloudBees CI add-on. | From 7e0c6d36b9feeed541f31295ab3b11c7def3eb22 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Sat, 3 Aug 2024 01:19:35 +0200 Subject: [PATCH 050/180] Adding shared-lib --- .../02-at-scale/cbci/shared-libs/catalog.yaml | 4 +++ .../simple-java-maven-app/Jenkinsfile | 26 +++++++++++++++++++ .../simple-java-maven-app/template.yaml | 17 ++++++++++++ .../cbci/shared-libs/vars/mvnBuild.groovy | 8 ++++++ 4 files changed, 55 insertions(+) create mode 100644 blueprints/02-at-scale/cbci/shared-libs/catalog.yaml create mode 100644 blueprints/02-at-scale/cbci/shared-libs/templates/simple-java-maven-app/Jenkinsfile create mode 100644 blueprints/02-at-scale/cbci/shared-libs/templates/simple-java-maven-app/template.yaml create mode 100644 blueprints/02-at-scale/cbci/shared-libs/vars/mvnBuild.groovy diff --git a/blueprints/02-at-scale/cbci/shared-libs/catalog.yaml b/blueprints/02-at-scale/cbci/shared-libs/catalog.yaml new file mode 100644 index 00000000..90b928ed --- /dev/null +++ b/blueprints/02-at-scale/cbci/shared-libs/catalog.yaml @@ -0,0 +1,4 @@ +version: 1 +type: pipeline-template-catalog +name: cbBlogExamples +displayName: CloudBees Blog Post Examples \ No newline at end of file diff --git a/blueprints/02-at-scale/cbci/shared-libs/templates/simple-java-maven-app/Jenkinsfile b/blueprints/02-at-scale/cbci/shared-libs/templates/simple-java-maven-app/Jenkinsfile new file mode 100644 index 00000000..2bee10f9 --- /dev/null +++ b/blueprints/02-at-scale/cbci/shared-libs/templates/simple-java-maven-app/Jenkinsfile @@ -0,0 +1,26 @@ +/* groovylint-disable-next-line CompileStatic */ +pipeline { + + agent { + label "${k8_agent}" + } + + stages { + stage('Checkout') { + steps { + git credentialsId: "${github_creds}" , url: "${github_repo}" + } + } + stage('Build') { + steps { + mvnBuild() + } + } + } + + post { + success { + junit allowEmptyResults: true, testResults: 'target/surefire-reports/*.xml' + } + } +} diff --git a/blueprints/02-at-scale/cbci/shared-libs/templates/simple-java-maven-app/template.yaml b/blueprints/02-at-scale/cbci/shared-libs/templates/simple-java-maven-app/template.yaml new file mode 100644 index 00000000..6eec8e10 --- /dev/null +++ b/blueprints/02-at-scale/cbci/shared-libs/templates/simple-java-maven-app/template.yaml @@ -0,0 +1,17 @@ +version: 1 +type: pipeline-template + +name: Java Maven App Pipeline Job +description: Simple Java App With Maven +parameters: + - name: k8_agent + displayName: "Kubernetes Agent yaml" + allowedValues: ["linux-mavenAndKaniko-L", "linux-mavenAndKaniko-XL"] + type: string + - name: git_repo + displayName: "Git Repository URL" + type: string + - name: git_creds + displayName: "Git SCM Credentials" + type: credentials + defaultValue: git-creds-example \ No newline at end of file diff --git a/blueprints/02-at-scale/cbci/shared-libs/vars/mvnBuild.groovy b/blueprints/02-at-scale/cbci/shared-libs/vars/mvnBuild.groovy new file mode 100644 index 00000000..e4e0f3cc --- /dev/null +++ b/blueprints/02-at-scale/cbci/shared-libs/vars/mvnBuild.groovy @@ -0,0 +1,8 @@ + +def call(boolean skipTests = true) { + if (skipTests) { + sh 'mvn clean package -DskipTests -Dmaven.repo.local=./maven-repo' + } else { + sh 'mvn -Dmaven.test.failure.ignore=true install' + } +} From 3f458c706705d52d0b539f42fad848a0642a165d Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Sat, 3 Aug 2024 23:38:22 +0200 Subject: [PATCH 051/180] redoing the method --- .../cbci/shared-libs/vars/mvnBuild.groovy | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/blueprints/02-at-scale/cbci/shared-libs/vars/mvnBuild.groovy b/blueprints/02-at-scale/cbci/shared-libs/vars/mvnBuild.groovy index e4e0f3cc..85945af1 100644 --- a/blueprints/02-at-scale/cbci/shared-libs/vars/mvnBuild.groovy +++ b/blueprints/02-at-scale/cbci/shared-libs/vars/mvnBuild.groovy @@ -1,8 +1,9 @@ +// vars/mvnBuild -def call(boolean skipTests = true) { - if (skipTests) { - sh 'mvn clean package -DskipTests -Dmaven.repo.local=./maven-repo' - } else { - sh 'mvn -Dmaven.test.failure.ignore=true install' - } -} +def call(boolean skipTests=false){ + if (skipTests) { + sh 'mvn clean package -DskipTests -Dmaven.repo.local=./maven-repo' + } else { + sh 'mvn clean package -Dmaven.repo.local=./maven-repo' + } +} \ No newline at end of file From 927b06c3d43f1ae17cb6e048c91a2bf60b617d17 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Sat, 3 Aug 2024 23:38:33 +0200 Subject: [PATCH 052/180] test --- .../shared-libs/templates/simple-java-maven-app/Jenkinsfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/cbci/shared-libs/templates/simple-java-maven-app/Jenkinsfile b/blueprints/02-at-scale/cbci/shared-libs/templates/simple-java-maven-app/Jenkinsfile index 2bee10f9..febe23be 100644 --- a/blueprints/02-at-scale/cbci/shared-libs/templates/simple-java-maven-app/Jenkinsfile +++ b/blueprints/02-at-scale/cbci/shared-libs/templates/simple-java-maven-app/Jenkinsfile @@ -13,7 +13,7 @@ pipeline { } stage('Build') { steps { - mvnBuild() + mvnBuild(skipTests: true) } } } From 1d2553e55d998ca6d49749206edd93a2919232c0 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Sun, 4 Aug 2024 01:02:38 +0200 Subject: [PATCH 053/180] casc: Adjusting brach --- blueprints/02-at-scale/cbci/casc/oc/items/root.yaml | 4 ++-- blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml | 2 +- blueprints/02-at-scale/k8s/cbci-values.yml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/blueprints/02-at-scale/cbci/casc/oc/items/root.yaml b/blueprints/02-at-scale/cbci/casc/oc/items/root.yaml index 675ec005..b1c13a3b 100644 --- a/blueprints/02-at-scale/cbci/casc/oc/items/root.yaml +++ b/blueprints/02-at-scale/cbci/casc/oc/items/root.yaml @@ -53,7 +53,7 @@ items: "cloudbees.prometheus": "true" properties: - configurationAsCode: - bundle: "cbci-agents-sec-docker/none-ha" + bundle: "shared-lib/none-ha" # Casc, HA - kind: managedController name: team-c-ha @@ -100,4 +100,4 @@ items: "cloudbees.prometheus": "true" properties: - configurationAsCode: - bundle: "cbci-agents-sec-docker/ha" + bundle: "shared-lib/ha" diff --git a/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml index 7d3b3e3f..c351b367 100644 --- a/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml +++ b/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml @@ -1,7 +1,7 @@ variables: - message: "Welcome to the CloudBees CI blueprint add-on: At scale!" - scmCascMmStore: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - - cascBranch: cbci-agents-sec-docker + - cascBranch: shared-lib - ldapManagerDN: "cn=admin,dc=acme,dc=org" - ldapRootDN: "dc=acme,dc=org" - ldapServer: "openldap-stack.auth.svc.cluster.local" diff --git a/blueprints/02-at-scale/k8s/cbci-values.yml b/blueprints/02-at-scale/k8s/cbci-values.yml index 10f899ac..36265238 100644 --- a/blueprints/02-at-scale/k8s/cbci-values.yml +++ b/blueprints/02-at-scale/k8s/cbci-values.yml @@ -16,7 +16,7 @@ OperationsCenter: Retriever: Enabled: true scmRepo: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - scmBranch: cbci-agents-sec-docker + scmBranch: shared-lib scmBundlePath: blueprints/02-at-scale/cbci/casc/oc scmPollingInterval: PT20M Persistence: From 159b6213f6e5a0ab40aeee89abdb9bd540de004d Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Sun, 4 Aug 2024 01:56:56 +0200 Subject: [PATCH 054/180] casc: adding variables for controller path --- blueprints/02-at-scale/cbci/casc/oc/jcasc/main.yaml | 2 +- blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/cbci/casc/oc/jcasc/main.yaml b/blueprints/02-at-scale/cbci/casc/oc/jcasc/main.yaml index 2d246952..ca57ef23 100644 --- a/blueprints/02-at-scale/cbci/casc/oc/jcasc/main.yaml +++ b/blueprints/02-at-scale/cbci/casc/oc/jcasc/main.yaml @@ -22,7 +22,7 @@ unclassified: - sparseCheckoutPaths: extension: sparseCheckoutPaths: - - path: "/blueprints/02-at-scale/cbci/casc/mc/" + - path: ${cascControllerLocation} cascAutoControllerProvisioning: provisionControllerOnCreation: true buildDiscarders: diff --git a/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml index c351b367..500c4d06 100644 --- a/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml +++ b/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml @@ -2,6 +2,7 @@ variables: - message: "Welcome to the CloudBees CI blueprint add-on: At scale!" - scmCascMmStore: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - cascBranch: shared-lib + - cascControllerLocation: "/blueprints/02-at-scale/cbci/casc/mc/" - ldapManagerDN: "cn=admin,dc=acme,dc=org" - ldapRootDN: "dc=acme,dc=org" - ldapServer: "openldap-stack.auth.svc.cluster.local" From 38f04c2300bc88e3e14589eb229b140e3894d05f Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Sun, 4 Aug 2024 02:41:23 +0200 Subject: [PATCH 055/180] Shared Lib test --- .../cbci/casc/mc/parent/jcasc/main.yaml | 15 +++++++++++++++ .../cbci/casc/mc/parent/variables/variables.yaml | 4 +++- .../02-at-scale/cbci/casc/oc/jcasc/main.yaml | 4 ++-- .../cbci/casc/oc/variables/variables.yaml | 4 ++-- .../cbci/{shared-libs => shared-lib}/catalog.yaml | 0 .../templates/simple-java-maven-app/Jenkinsfile | 0 .../templates/simple-java-maven-app/template.yaml | 0 .../vars/mvnBuild.groovy | 0 8 files changed, 22 insertions(+), 5 deletions(-) rename blueprints/02-at-scale/cbci/{shared-libs => shared-lib}/catalog.yaml (100%) rename blueprints/02-at-scale/cbci/{shared-libs => shared-lib}/templates/simple-java-maven-app/Jenkinsfile (100%) rename blueprints/02-at-scale/cbci/{shared-libs => shared-lib}/templates/simple-java-maven-app/template.yaml (100%) rename blueprints/02-at-scale/cbci/{shared-libs => shared-lib}/vars/mvnBuild.groovy (100%) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml index b5506dbf..b42d322a 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml @@ -38,6 +38,21 @@ unclassified: endpoint: ${ot_endpoint} cascItemsConfiguration: variableInterpolationEnabledForAdmin: true + globalLibraries: + libraries: + - defaultVersion: ${sharedLibBranch} + name: "cbci-bp02" + retriever: + modernSCM: + scm: + git: + remote: ${sharedLibRepo} + traits: + - "gitBranchDiscovery" + - sparseCheckoutPaths: + extension: + sparseCheckoutPaths: + - path: ${sharedLibPath} aws: s3: container: "${sec_s3bucketName}" diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml index 76d47a05..79df4951 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml @@ -2,4 +2,6 @@ variables: - ot_endpoint: "http://tempo.kube-prometheus-stack.svc.cluster.local:4317" - s3bucketPreffix: "cbci" - regSecretsName: "cbci-sec-reg" - + - sharedLibRepo: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" + - sharedLibBranch: shared-lib + - sharedLibPath: "/blueprints/02-at-scale/cbci/shared-lib" \ No newline at end of file diff --git a/blueprints/02-at-scale/cbci/casc/oc/jcasc/main.yaml b/blueprints/02-at-scale/cbci/casc/oc/jcasc/main.yaml index ca57ef23..e39c83f7 100644 --- a/blueprints/02-at-scale/cbci/casc/oc/jcasc/main.yaml +++ b/blueprints/02-at-scale/cbci/casc/oc/jcasc/main.yaml @@ -14,7 +14,7 @@ unclassified: scmSource: git: credentialsId: "GH-token" - remote: ${scmCascMmStore} + remote: ${cascRepo} traits: - "gitBranchDiscovery" - headWildcardFilter: @@ -22,7 +22,7 @@ unclassified: - sparseCheckoutPaths: extension: sparseCheckoutPaths: - - path: ${cascControllerLocation} + - path: ${cascPathController} cascAutoControllerProvisioning: provisionControllerOnCreation: true buildDiscarders: diff --git a/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml index 500c4d06..358c559c 100644 --- a/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml +++ b/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml @@ -1,8 +1,8 @@ variables: - message: "Welcome to the CloudBees CI blueprint add-on: At scale!" - - scmCascMmStore: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" + - cascRepo: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - cascBranch: shared-lib - - cascControllerLocation: "/blueprints/02-at-scale/cbci/casc/mc/" + - cascPathController: "/blueprints/02-at-scale/cbci/casc/mc/" - ldapManagerDN: "cn=admin,dc=acme,dc=org" - ldapRootDN: "dc=acme,dc=org" - ldapServer: "openldap-stack.auth.svc.cluster.local" diff --git a/blueprints/02-at-scale/cbci/shared-libs/catalog.yaml b/blueprints/02-at-scale/cbci/shared-lib/catalog.yaml similarity index 100% rename from blueprints/02-at-scale/cbci/shared-libs/catalog.yaml rename to blueprints/02-at-scale/cbci/shared-lib/catalog.yaml diff --git a/blueprints/02-at-scale/cbci/shared-libs/templates/simple-java-maven-app/Jenkinsfile b/blueprints/02-at-scale/cbci/shared-lib/templates/simple-java-maven-app/Jenkinsfile similarity index 100% rename from blueprints/02-at-scale/cbci/shared-libs/templates/simple-java-maven-app/Jenkinsfile rename to blueprints/02-at-scale/cbci/shared-lib/templates/simple-java-maven-app/Jenkinsfile diff --git a/blueprints/02-at-scale/cbci/shared-libs/templates/simple-java-maven-app/template.yaml b/blueprints/02-at-scale/cbci/shared-lib/templates/simple-java-maven-app/template.yaml similarity index 100% rename from blueprints/02-at-scale/cbci/shared-libs/templates/simple-java-maven-app/template.yaml rename to blueprints/02-at-scale/cbci/shared-lib/templates/simple-java-maven-app/template.yaml diff --git a/blueprints/02-at-scale/cbci/shared-libs/vars/mvnBuild.groovy b/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.groovy similarity index 100% rename from blueprints/02-at-scale/cbci/shared-libs/vars/mvnBuild.groovy rename to blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.groovy From 6349cd0d407773c3f3d36e0a74eb2826d956278b Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 01:19:53 +0200 Subject: [PATCH 056/180] including the shared library load --- .../cbci/casc/mc/parent/items/admin-folder.yaml | 9 ++++++--- .../02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml | 11 +++-------- .../cbci/casc/mc/parent/variables/variables.yaml | 2 +- 3 files changed, 10 insertions(+), 12 deletions(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml index 7e0e4075..5323682c 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml @@ -66,6 +66,8 @@ items: cpsFlowDefinition: sandbox: true script: |- + @Library('common') _ + pipeline { agent none options { @@ -97,7 +99,7 @@ items: stage('Build') { steps { container('maven') { - sh 'mvn clean package -DskipTests -Dmaven.repo.local=./maven-repo' + mvnBuild (true) } } } @@ -173,10 +175,11 @@ items: } } } - description: 'Pipeline that demonstrates the s3 integrations for CloudBees Workspace + description: Pipeline that demonstrates the s3 integrations for CloudBees Workspace Caching (https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-cache-step) - and s3 Artifact (https://plugins.jenkins.io/artifact-manager-s3/) are working' + and s3 Artifact (https://plugins.jenkins.io/artifact-manager-s3/) are working disabled: false + displayName: s3-WScacheAndArtifacts resumeBlocked: false - kind: pipeline name: windows-builds-nodes diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml index b42d322a..58cef775 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml @@ -40,19 +40,14 @@ unclassified: variableInterpolationEnabledForAdmin: true globalLibraries: libraries: - - defaultVersion: ${sharedLibBranch} - name: "cbci-bp02" + - defaultVersion: ${sharedLibVersion} + name: "common" retriever: modernSCM: + libraryPath: ${sharedLibPath} scm: git: remote: ${sharedLibRepo} - traits: - - "gitBranchDiscovery" - - sparseCheckoutPaths: - extension: - sparseCheckoutPaths: - - path: ${sharedLibPath} aws: s3: container: "${sec_s3bucketName}" diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml index 79df4951..2490e797 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml @@ -3,5 +3,5 @@ variables: - s3bucketPreffix: "cbci" - regSecretsName: "cbci-sec-reg" - sharedLibRepo: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - - sharedLibBranch: shared-lib + - sharedLibVersion: shared-lib - sharedLibPath: "/blueprints/02-at-scale/cbci/shared-lib" \ No newline at end of file From 45e85bfd3dd2a5a5dd77798db014ddeab79a601f Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 01:20:10 +0200 Subject: [PATCH 057/180] remove not required credential --- blueprints/02-at-scale/cbci/casc/oc/jcasc/main.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/blueprints/02-at-scale/cbci/casc/oc/jcasc/main.yaml b/blueprints/02-at-scale/cbci/casc/oc/jcasc/main.yaml index e39c83f7..36a52eb3 100644 --- a/blueprints/02-at-scale/cbci/casc/oc/jcasc/main.yaml +++ b/blueprints/02-at-scale/cbci/casc/oc/jcasc/main.yaml @@ -13,7 +13,6 @@ unclassified: defaultVersion: ${cascBranch} scmSource: git: - credentialsId: "GH-token" remote: ${cascRepo} traits: - "gitBranchDiscovery" From c37f71ea74a52259ab54d6b4167210897dfea153 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 01:20:41 +0200 Subject: [PATCH 058/180] Adding a method to load dockerfiles --- .../shared-lib/resources/dockerfiles/HelloWorld.Dockerfile | 2 ++ .../02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy | 6 ++++++ 2 files changed, 8 insertions(+) create mode 100644 blueprints/02-at-scale/cbci/shared-lib/resources/dockerfiles/HelloWorld.Dockerfile create mode 100644 blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy diff --git a/blueprints/02-at-scale/cbci/shared-lib/resources/dockerfiles/HelloWorld.Dockerfile b/blueprints/02-at-scale/cbci/shared-lib/resources/dockerfiles/HelloWorld.Dockerfile new file mode 100644 index 00000000..d4cea434 --- /dev/null +++ b/blueprints/02-at-scale/cbci/shared-lib/resources/dockerfiles/HelloWorld.Dockerfile @@ -0,0 +1,2 @@ +FROM alpine +CMD ["/bin/sh", "-c", "echo 'hello world'"] \ No newline at end of file diff --git a/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy b/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy new file mode 100644 index 00000000..48085d35 --- /dev/null +++ b/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy @@ -0,0 +1,6 @@ +// vars/getDockerfile + +def call(String dockerfileLocation){ + dockerfileContent = libraryResource "dockerfiles/${dockerfileLocation}" + writeFile file: 'Dockerfile', text: dockerfileContent +} From e8b968561f082df62a3f01da350dc7fe0df1665e Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 01:33:20 +0200 Subject: [PATCH 059/180] Adding getdockerfile --- .../02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy b/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy index 48085d35..a3227c5a 100644 --- a/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy +++ b/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy @@ -1,6 +1,6 @@ // vars/getDockerfile -def call(String dockerfileLocation){ - dockerfileContent = libraryResource "dockerfiles/${dockerfileLocation}" +def call(String dockerfileName){ + dockerfileContent = libraryResource "dockerfiles/${dockerfileName}" writeFile file: 'Dockerfile', text: dockerfileContent } From 98a4661d1ed566ebd1d7b95949e480992fc6702e Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 01:39:52 +0200 Subject: [PATCH 060/180] Getting Dockerfile from sharedlibs --- .../cbci/casc/mc/parent/items/admin-folder.yaml | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml index 5323682c..cbdbf5a3 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml @@ -226,8 +226,8 @@ items: steps { sh ''' echo 'Printing credentials from Vault' - echo $U1 - echo $S1 + echo ^$U1 + echo ^$S1 ''' } } @@ -241,6 +241,8 @@ items: cpsFlowDefinition: sandbox: true script: | + @Library('common') _ + pipeline { agent { label 'linux-mavenAndKaniko-XL' @@ -253,9 +255,9 @@ items: stage('Public Registry') { steps { container(name: 'kaniko', shell: '/busybox/sh') { + getDockerfile("HelloWorld.Dockerfile") sh '''#!/busybox/sh - echo "FROM jenkins/inbound-agent:latest" > Dockerfile - /kaniko/executor --context `pwd` --destination ${TARGET_DH_ORG}/cbci-bp02-kaniko:${BUILD_ID} + /kaniko/executor --context `pwd` --destination ^${TARGET_DH_ORG}/cbci-bp02-kaniko:^${BUILD_ID} ''' } } @@ -263,9 +265,9 @@ items: stage('Private Registry') { steps { container(name: 'kaniko-ecr', shell: '/busybox/sh') { + getDockerfile("HelloWorld.Dockerfile") sh '''#!/busybox/sh - echo "FROM jenkins/inbound-agent:latest" > Dockerfile - /kaniko/executor --context `pwd` --destination=${TARGET_ECR_URI}:${BUILD_ID} + /kaniko/executor --context `pwd` --destination=^${TARGET_ECR_URI}:^${BUILD_ID} ''' } } From 8c0b99cfdf8f19021f05e03a89195c02585aa4b0 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 01:49:03 +0200 Subject: [PATCH 061/180] SharedLibrary Bp02 per branch --- Makefile | 14 +++++++------- .../cbci/casc/mc/parent/jcasc/main.yaml | 2 +- .../casc/mc/parent/variables/variables.yaml | 2 +- blueprints/helpers.sh | 17 +++++++++-------- 4 files changed, 18 insertions(+), 17 deletions(-) diff --git a/Makefile b/Makefile index 0746730f..5af64978 100644 --- a/Makefile +++ b/Makefile @@ -4,8 +4,8 @@ MAKEFLAGS += --no-print-directory CI ?= false BP_AGENT_USER := bp-agent MKFILEDIR := $(abspath $(dir $(lastword $(MAKEFILE_LIST)))) -CASC_ENDPOINT ?= https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git -CASC_BRANCH ?= main +CBCI_REPO ?= https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git +CBCI_BRANCH ?= main NUKE_DRY_RUN ?= true define helpers @@ -96,11 +96,11 @@ set-kube-env: agentCheck @$(call helpers,set-kube-env) @$(call helpers,INFO "Setting Kube environment finished succesfully.") -.PHONY: set-casc-branch -set-casc-location: ## Update Casc bundle location to the endpoint and branch passed as parameter. Example: CASC_ENDPOINT=https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git CASC_BRANCH=new-feat make set-casc-location -set-casc-location: agentCheck guard-CASC_ENDPOINT guard-CASC_BRANCH - @$(call helpers,set-casc-location $(CASC_ENDPOINT) $(CASC_BRANCH)) - @$(call helpers,INFO "Setting new Casc location to $(CASC_ENDPOINT) $(CASC_BRANCH) finished succesfully.") +.PHONY: set-cbci-location +set-cbci-location: ## Update cbci folder location per parameter. Example: CBCI_REPO=https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git CBCI_BRANCH=new-feat make set-cbci-location +set-cbci-location: agentCheck guard-CBCI_REPO guard-CBCI_BRANCH + @$(call helpers,set-cbci-location $(CBCI_REPO) $(CBCI_BRANCH)) + @$(call helpers,INFO "Setting new Casc location to $(CBCI_REPO) $(CBCI_BRANCH) finished succesfully.") .PHONY: run-aws-nuke run-aws-nuke: ## Run aws nuke by https://github.com/rebuy-de/aws-nuke. Example: NUKE_DRY_RUN=true make run-aws-nuke diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml index 58cef775..417330c2 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml @@ -40,7 +40,7 @@ unclassified: variableInterpolationEnabledForAdmin: true globalLibraries: libraries: - - defaultVersion: ${sharedLibVersion} + - defaultVersion: ${sharedLibBranch} name: "common" retriever: modernSCM: diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml index 2490e797..79df4951 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml @@ -3,5 +3,5 @@ variables: - s3bucketPreffix: "cbci" - regSecretsName: "cbci-sec-reg" - sharedLibRepo: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - - sharedLibVersion: shared-lib + - sharedLibBranch: shared-lib - sharedLibPath: "/blueprints/02-at-scale/cbci/shared-lib" \ No newline at end of file diff --git a/blueprints/helpers.sh b/blueprints/helpers.sh index 85f3dbb8..4be30e9c 100755 --- a/blueprints/helpers.sh +++ b/blueprints/helpers.sh @@ -187,17 +187,18 @@ set-kube-env () { done } -set-casc-location () { - local endpoint="$1" +set-cbci-location () { + local repo="$1" local branch="$2" - #Endpoint - sed -i "s|scmRepo: .*|scmRepo: \"$endpoint\"|g" "$SCRIPTDIR/02-at-scale/k8s/cbci-values.yml" - sed -i "s|scmCascMmStore: .*|scmCascMmStore: \"$endpoint\"|g" "$SCRIPTDIR/02-at-scale/casc/oc/variables/variables.yaml" + #Repo + sed -i "s|scmRepo: .*|scmRepo: \"$repo\"|g" "$SCRIPTDIR/02-at-scale/k8s/cbci-values.yml" + sed -i "s|scmCascMmStore: .*|scmCascMmStore: \"$repo\"|g" "$SCRIPTDIR/02-at-scale/cbci/casc/oc/variables/variables.yaml" #Branch sed -i "s|scmBranch: .*|scmBranch: $branch|g" "$SCRIPTDIR/02-at-scale/k8s/cbci-values.yml" - sed -i "s|cascBranch: .*|cascBranch: $branch|g" "$SCRIPTDIR/02-at-scale/casc/oc/variables/variables.yaml" - sed -i "s|bundle: \".*/none-ha\"|bundle: \"$branch/none-ha\"|g" "$SCRIPTDIR/02-at-scale/casc/oc/items/root.yaml" - sed -i "s|bundle: \".*/ha\"|bundle: \"$branch/ha\"|g" "$SCRIPTDIR/02-at-scale/casc/oc/items/root.yaml" + sed -i "s|cascBranch: .*|cascBranch: $branch|g" "$SCRIPTDIR/02-at-scale/cbci/casc/oc/variables/variables.yaml" + sed -i "s|sharedLibBranch: .*|sharedLibBranch: $branch|g" "$SCRIPTDIR/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml" + sed -i "s|bundle: \".*/none-ha\"|bundle: \"$branch/none-ha\"|g" "$SCRIPTDIR/02-at-scale/cbci/casc/oc/items/root.yaml" + sed -i "s|bundle: \".*/ha\"|bundle: \"$branch/ha\"|g" "$SCRIPTDIR/02-at-scale/cbci/casc/oc/items/root.yaml" } run-aws-nuke () { From 6747d1cd85c79adf08591e7d4d90925154413291 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 02:34:51 +0200 Subject: [PATCH 062/180] Removing Template catalog --- .../02-at-scale/cbci/shared-lib/catalog.yaml | 4 --- .../simple-java-maven-app/Jenkinsfile | 26 ------------------- .../simple-java-maven-app/template.yaml | 17 ------------ 3 files changed, 47 deletions(-) delete mode 100644 blueprints/02-at-scale/cbci/shared-lib/catalog.yaml delete mode 100644 blueprints/02-at-scale/cbci/shared-lib/templates/simple-java-maven-app/Jenkinsfile delete mode 100644 blueprints/02-at-scale/cbci/shared-lib/templates/simple-java-maven-app/template.yaml diff --git a/blueprints/02-at-scale/cbci/shared-lib/catalog.yaml b/blueprints/02-at-scale/cbci/shared-lib/catalog.yaml deleted file mode 100644 index 90b928ed..00000000 --- a/blueprints/02-at-scale/cbci/shared-lib/catalog.yaml +++ /dev/null @@ -1,4 +0,0 @@ -version: 1 -type: pipeline-template-catalog -name: cbBlogExamples -displayName: CloudBees Blog Post Examples \ No newline at end of file diff --git a/blueprints/02-at-scale/cbci/shared-lib/templates/simple-java-maven-app/Jenkinsfile b/blueprints/02-at-scale/cbci/shared-lib/templates/simple-java-maven-app/Jenkinsfile deleted file mode 100644 index febe23be..00000000 --- a/blueprints/02-at-scale/cbci/shared-lib/templates/simple-java-maven-app/Jenkinsfile +++ /dev/null @@ -1,26 +0,0 @@ -/* groovylint-disable-next-line CompileStatic */ -pipeline { - - agent { - label "${k8_agent}" - } - - stages { - stage('Checkout') { - steps { - git credentialsId: "${github_creds}" , url: "${github_repo}" - } - } - stage('Build') { - steps { - mvnBuild(skipTests: true) - } - } - } - - post { - success { - junit allowEmptyResults: true, testResults: 'target/surefire-reports/*.xml' - } - } -} diff --git a/blueprints/02-at-scale/cbci/shared-lib/templates/simple-java-maven-app/template.yaml b/blueprints/02-at-scale/cbci/shared-lib/templates/simple-java-maven-app/template.yaml deleted file mode 100644 index 6eec8e10..00000000 --- a/blueprints/02-at-scale/cbci/shared-lib/templates/simple-java-maven-app/template.yaml +++ /dev/null @@ -1,17 +0,0 @@ -version: 1 -type: pipeline-template - -name: Java Maven App Pipeline Job -description: Simple Java App With Maven -parameters: - - name: k8_agent - displayName: "Kubernetes Agent yaml" - allowedValues: ["linux-mavenAndKaniko-L", "linux-mavenAndKaniko-XL"] - type: string - - name: git_repo - displayName: "Git Repository URL" - type: string - - name: git_creds - displayName: "Git SCM Credentials" - type: credentials - defaultValue: git-creds-example \ No newline at end of file From 6be58f30c8c13e8a5123e7a24dcf8030d25944fd Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 02:49:56 +0200 Subject: [PATCH 063/180] Adding description and validation --- .../cbci/shared-lib/vars/getDockerfile.groovy | 10 +++++++--- .../02-at-scale/cbci/shared-lib/vars/getDockerfile.txt | 5 +++++ .../02-at-scale/cbci/shared-lib/vars/mvnBuild.groovy | 3 ++- .../02-at-scale/cbci/shared-lib/vars/mvnBuild.txt | 5 +++++ 4 files changed, 19 insertions(+), 4 deletions(-) create mode 100644 blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.txt create mode 100644 blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.txt diff --git a/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy b/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy index a3227c5a..1b59fcc0 100644 --- a/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy +++ b/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy @@ -1,6 +1,10 @@ // vars/getDockerfile -def call(String dockerfileName){ - dockerfileContent = libraryResource "dockerfiles/${dockerfileName}" - writeFile file: 'Dockerfile', text: dockerfileContent +def call(String dockerfileLocation){ + if (dockerfileLocation?.trim()) { + Object dockerfileContent = libraryResource "dockerfiles/${dockerfileLocation}" + writeFile file: 'Dockerfile', text: dockerfileContent + } else { + error 'dockerfileLocation is empty. Please provide a valid location.' + } } diff --git a/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.txt b/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.txt new file mode 100644 index 00000000..cd49267a --- /dev/null +++ b/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.txt @@ -0,0 +1,5 @@ +Get a Dockerfile definition from the Shared Library Resources and copy it into the workspace. + +``` +getDockerfile("HelloWorld.Dockerfile") +``` \ No newline at end of file diff --git a/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.groovy b/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.groovy index 85945af1..7d527d96 100644 --- a/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.groovy +++ b/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.groovy @@ -1,6 +1,7 @@ // vars/mvnBuild -def call(boolean skipTests=false){ +def call(Map args = [:]) { + def skipTests = args.containsKey('skipTests') ? args.skipTests : error('mvnBuild: skipTests parameter is required') if (skipTests) { sh 'mvn clean package -DskipTests -Dmaven.repo.local=./maven-repo' } else { diff --git a/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.txt b/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.txt new file mode 100644 index 00000000..4d3316e0 --- /dev/null +++ b/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.txt @@ -0,0 +1,5 @@ +Execute mvn package target following best practices. + +``` +mvnBuild(skipTests: true) +``` \ No newline at end of file From b38f7491c34ed3143cd966640d900ff3d49f6d36 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 02:53:01 +0200 Subject: [PATCH 064/180] typo --- blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.txt b/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.txt index 4d3316e0..99d24847 100644 --- a/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.txt +++ b/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.txt @@ -1,4 +1,4 @@ -Execute mvn package target following best practices. +Execute mvn package target following best practices. ``` mvnBuild(skipTests: true) From 2ae44f70944f977a8c5a2c7eda06cdcdf8cb67be Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 02:56:44 +0200 Subject: [PATCH 065/180] Fixing the path --- .../02-at-scale/cbci/casc/mc/parent/variables/variables.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml index 79df4951..e568d20b 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml @@ -4,4 +4,4 @@ variables: - regSecretsName: "cbci-sec-reg" - sharedLibRepo: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - sharedLibBranch: shared-lib - - sharedLibPath: "/blueprints/02-at-scale/cbci/shared-lib" \ No newline at end of file + - sharedLibPath: "blueprints/02-at-scale/cbci/shared-lib" \ No newline at end of file From fa118dff8fb166574baa077476a4f1d3e5cc9dcd Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 02:59:20 +0200 Subject: [PATCH 066/180] Fixing example --- .../02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml index cbdbf5a3..19de24fb 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml @@ -99,7 +99,7 @@ items: stage('Build') { steps { container('maven') { - mvnBuild (true) + mvnBuild(skipTests: true) } } } From d50185f03e6c6b30189cc5a4bc2691f47c83adc8 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 03:04:37 +0200 Subject: [PATCH 067/180] passing pre-commit files --- .../02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml | 4 ++-- .../02-at-scale/cbci/casc/mc/parent/variables/variables.yaml | 2 +- .../shared-lib/resources/dockerfiles/HelloWorld.Dockerfile | 2 +- blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.txt | 2 +- blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.groovy | 2 +- blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.txt | 2 +- blueprints/02-at-scale/img/at-scale.k8s.drawio.svg | 2 +- 7 files changed, 8 insertions(+), 8 deletions(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml index 19de24fb..ae227e9f 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml @@ -255,13 +255,13 @@ items: stage('Public Registry') { steps { container(name: 'kaniko', shell: '/busybox/sh') { - getDockerfile("HelloWorld.Dockerfile") + getDockerfile("HelloWorld.Dockerfile") sh '''#!/busybox/sh /kaniko/executor --context `pwd` --destination ^${TARGET_DH_ORG}/cbci-bp02-kaniko:^${BUILD_ID} ''' } } - } + } stage('Private Registry') { steps { container(name: 'kaniko-ecr', shell: '/busybox/sh') { diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml index e568d20b..05bf1dc9 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml @@ -4,4 +4,4 @@ variables: - regSecretsName: "cbci-sec-reg" - sharedLibRepo: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - sharedLibBranch: shared-lib - - sharedLibPath: "blueprints/02-at-scale/cbci/shared-lib" \ No newline at end of file + - sharedLibPath: "blueprints/02-at-scale/cbci/shared-lib" diff --git a/blueprints/02-at-scale/cbci/shared-lib/resources/dockerfiles/HelloWorld.Dockerfile b/blueprints/02-at-scale/cbci/shared-lib/resources/dockerfiles/HelloWorld.Dockerfile index d4cea434..ccd1cb75 100644 --- a/blueprints/02-at-scale/cbci/shared-lib/resources/dockerfiles/HelloWorld.Dockerfile +++ b/blueprints/02-at-scale/cbci/shared-lib/resources/dockerfiles/HelloWorld.Dockerfile @@ -1,2 +1,2 @@ FROM alpine -CMD ["/bin/sh", "-c", "echo 'hello world'"] \ No newline at end of file +CMD ["/bin/sh", "-c", "echo 'hello world'"] diff --git a/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.txt b/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.txt index cd49267a..c5392c5d 100644 --- a/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.txt +++ b/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.txt @@ -2,4 +2,4 @@ Get a Dockerfile definition from the Shared Library Resources and copy it into t ``` getDockerfile("HelloWorld.Dockerfile") -``` \ No newline at end of file +``` diff --git a/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.groovy b/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.groovy index 7d527d96..78aba80d 100644 --- a/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.groovy +++ b/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.groovy @@ -7,4 +7,4 @@ def call(Map args = [:]) { } else { sh 'mvn clean package -Dmaven.repo.local=./maven-repo' } -} \ No newline at end of file +} diff --git a/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.txt b/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.txt index 99d24847..bc6a27d5 100644 --- a/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.txt +++ b/blueprints/02-at-scale/cbci/shared-lib/vars/mvnBuild.txt @@ -2,4 +2,4 @@ Execute mvn package target following best practices. ``` mvnBuild(skipTests: true) -``` \ No newline at end of file +``` diff --git a/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg b/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg index 2d4867e0..57d4079d 100644 --- a/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg +++ b/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg @@ -1090,4 +1090,4 @@ - \ No newline at end of file + From 629e2ca0e2c5e31407328e46958dbb500a32a5d2 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 03:10:12 +0200 Subject: [PATCH 068/180] fixing death links --- blueprints/02-at-scale/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index e9d4e3dd..bbbdd4a9 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -27,10 +27,10 @@ Once you have familiarized yourself with [CloudBees CI blueprint add-on: Get sta | [Grafana Tempo](https://grafana.com/oss/tempo/) | Provides backend tracing for [Jenkins OpenTelemetry](https://plugins.jenkins.io/opentelemetry/). | | [Hashicorp Vault](https://github.com/hashicorp/vault-helm) | Secrets management system that is integrated via [CloudBees HashiCorp Vault Plugin](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-secure-guide/hashicorp-vault-plugin). | -- Cloudbees CI uses [Configuration as Code (CasC)](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-oc/casc-intro) (refer to the [casc](casc) folder) to enable [exciting new features for streamlined DevOps](https://www.cloudbees.com/blog/cloudbees-ci-exciting-new-features-for-streamlined-devops) and other enterprise features, such as [CloudBees CI hibernation](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/managing-controllers#_hibernation_in_managed_masters). +- Cloudbees CI uses [Configuration as Code (CasC)](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-oc/casc-intro) (refer to the [casc](cbci/casc) folder) to enable [exciting new features for streamlined DevOps](https://www.cloudbees.com/blog/cloudbees-ci-exciting-new-features-for-streamlined-devops) and other enterprise features, such as [CloudBees CI hibernation](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/managing-controllers#_hibernation_in_managed_masters). - The operations center is using the [CasC Bundle Retriever](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-oc/bundle-retrieval-scm). - Managed controller configurations are managed from the operations center using [source control management (SCM)](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-controller/add-bundle#_adding_casc_bundles_from_an_scm_tool). - - The managed controllers are using [CasC bundle inheritance](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-controller/advanced#_configuring_bundle_inheritance_with_casc) (refer to the [parent](casc/mc/parent) folder). This "parent" bundle is inherited by two types of "child" controller bundles: `ha` and `none-ha`, to accommodate [considerations about HA controllers](https://docs.cloudbees.com/docs/cloudbees-ci/latest/ha/ha-considerations). + - The managed controllers are using [CasC bundle inheritance](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-controller/advanced#_configuring_bundle_inheritance_with_casc) (refer to the [parent](cbci/casc/mc/parent) folder). This "parent" bundle is inherited by two types of "child" controller bundles: `ha` and `none-ha`, to accommodate [considerations about HA controllers](https://docs.cloudbees.com/docs/cloudbees-ci/latest/ha/ha-considerations). > [!TIP] > A [resource group](https://docs.aws.amazon.com/ARG/latest/userguide/resource-groups.html) is also included, to get a full list of all resources created by this blueprint. From 9020fd756ffc1454601028c2bb318213915f9ba9 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 16:38:56 +0200 Subject: [PATCH 069/180] Replace dockerfileLocation by fileName for clarity --- .../02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy | 8 ++++---- .../02-at-scale/cbci/shared-lib/vars/getDockerfile.txt | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy b/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy index 1b59fcc0..82f935c9 100644 --- a/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy +++ b/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy @@ -1,10 +1,10 @@ // vars/getDockerfile -def call(String dockerfileLocation){ - if (dockerfileLocation?.trim()) { - Object dockerfileContent = libraryResource "dockerfiles/${dockerfileLocation}" +def call(String fileName){ + if (fileName?.trim()) { + Object dockerfileContent = libraryResource "dockerfiles/${fileName}" writeFile file: 'Dockerfile', text: dockerfileContent } else { - error 'dockerfileLocation is empty. Please provide a valid location.' + error 'fileName is empty. Please provide a valid location.' } } diff --git a/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.txt b/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.txt index c5392c5d..d1e6afa4 100644 --- a/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.txt +++ b/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.txt @@ -1,4 +1,4 @@ -Get a Dockerfile definition from the Shared Library Resources and copy it into the workspace. +Get the Dockerfile passed as a parameter (fileName) from the Shared Library Resources and copy it into the workspace. ``` getDockerfile("HelloWorld.Dockerfile") From fb809e4213bdb7526b194df60cad1b4c37ff1795 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 16:40:33 +0200 Subject: [PATCH 070/180] Rename fileName to filePath --- .../02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy | 8 ++++---- .../02-at-scale/cbci/shared-lib/vars/getDockerfile.txt | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy b/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy index 82f935c9..d4f0b973 100644 --- a/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy +++ b/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.groovy @@ -1,10 +1,10 @@ // vars/getDockerfile -def call(String fileName){ - if (fileName?.trim()) { - Object dockerfileContent = libraryResource "dockerfiles/${fileName}" +def call(String filePath){ + if (filePath?.trim()) { + Object dockerfileContent = libraryResource "dockerfiles/${filePath}" writeFile file: 'Dockerfile', text: dockerfileContent } else { - error 'fileName is empty. Please provide a valid location.' + error 'filePath is empty. Please provide a valid location.' } } diff --git a/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.txt b/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.txt index d1e6afa4..6b7c72ec 100644 --- a/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.txt +++ b/blueprints/02-at-scale/cbci/shared-lib/vars/getDockerfile.txt @@ -1,4 +1,4 @@ -Get the Dockerfile passed as a parameter (fileName) from the Shared Library Resources and copy it into the workspace. +Get the Dockerfile passed as a parameter (filePath) from the Shared Library Resources and copy it into the workspace. ``` getDockerfile("HelloWorld.Dockerfile") From 6bb34a72503a4055301a5f443dd6069d5d69a0b2 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 17:16:05 +0200 Subject: [PATCH 071/180] Adding note on spare checkouts --- CONTRIBUTING.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index ab816a58..4e971ff0 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -5,7 +5,7 @@ This document provides guidelines for contributing to the CloudBees CI add-on fo ## Design principles - It follows the same approach as the [Terraform AWS EKS Blueprints for Terraform Patterns](https://aws-ia.github.io/terraform-aws-eks-blueprints/). -- The blueprints use a monorepo configuration; the required external repositories for the configuration are included within the same repository. For example, the [At scale blueprint](blueprints/02-at-scale) contains the repository for CasC bundles. +- The blueprints use a monorepo configuration where additional configuration repositories are included within the same project. This approach is managed using [Spare Checkouts](https://github.blog/open-source/git/bring-your-monorepo-down-to-size-with-sparse-checkout/). For example, the [At scale blueprint](blueprints/02-at-scale) contains the repository for CasC bundles and Shared Libraries. - Submit pull requests against the `develop` branch and release from the `main` branch. - `main` branch: - It is the stable branch and is used for releases. From 2eba03bc0f800ecc10f78ab302960199730e110e Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 17:23:00 +0200 Subject: [PATCH 072/180] fixing interpolation --- main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/main.tf b/main.tf index 57cc87d9..0690cfd7 100644 --- a/main.tf +++ b/main.tf @@ -81,7 +81,7 @@ resource "kubernetes_secret" "cbci_sec_reg" { data = { ".dockerconfigjson" = jsonencode({ auths = { - "${var.reg_secret_auth["server"]}" = { + (var.reg_secret_auth["server"]) = { "username" = var.reg_secret_auth["username"] "password" = var.reg_secret_auth["password"] "email" = var.reg_secret_auth["email"] From 961d5e74a698ff2df6d5cd9e92190c64ecece4f6 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 17:23:12 +0200 Subject: [PATCH 073/180] Adding interpolation checks --- .pre-commit-config.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index cb59612c..ef123951 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -33,7 +33,7 @@ repos: - --hook-config=--retry-once-with-cleanup=true - id: terraform_tflint args: - #- '--args=--only=terraform_deprecated_interpolation' + - '--args=--only=terraform_deprecated_interpolation' - '--args=--only=terraform_deprecated_index' - '--args=--only=terraform_unused_declarations' - '--args=--only=terraform_comment_syntax' From 1403e7b441e8842a4eb979e728a1f07e7a922178 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 17:48:26 +0200 Subject: [PATCH 074/180] Fixing Uppercase for validation message --- variables.tf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/variables.tf b/variables.tf index 0a06ceaa..453b4598 100644 --- a/variables.tf +++ b/variables.tf @@ -43,7 +43,7 @@ variable "trial_license" { type = map(string) validation { condition = contains(keys(var.trial_license), "first_name") && contains(keys(var.trial_license), "last_name") && contains(keys(var.trial_license), "email") && contains(keys(var.trial_license), "company") - error_message = "trial_license must contain the following keys: first_name, last_name, email, company." + error_message = "The trial_license must contain the following keys: first_name, last_name, email, company." } validation { condition = length(var.trial_license) == 4 @@ -94,11 +94,11 @@ variable "reg_secret_auth" { } validation { condition = contains(keys(var.reg_secret_auth), "server") && contains(keys(var.reg_secret_auth), "username") && contains(keys(var.reg_secret_auth), "password") && contains(keys(var.reg_secret_auth), "email") - error_message = "reg_server must contain the following keys: server, username, password and email." + error_message = "The reg_secret_auth must contain the following keys: server, username, password and email." } validation { condition = length(var.reg_secret_auth) == 4 - error_message = "reg_server must contain 4 keys." + error_message = "The reg_secret_auth must contain 4 keys." } } From 4824e26447fe1e37fd149ba19458e2a90c04177b Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 18:12:03 +0200 Subject: [PATCH 075/180] setting.branch correctly --- .../02-at-scale/cbci/casc/mc/parent/variables/variables.yaml | 2 +- blueprints/02-at-scale/cbci/casc/oc/items/root.yaml | 4 ++-- blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml | 2 +- blueprints/02-at-scale/k8s/cbci-values.yml | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml index 05bf1dc9..429fcc4d 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml @@ -3,5 +3,5 @@ variables: - s3bucketPreffix: "cbci" - regSecretsName: "cbci-sec-reg" - sharedLibRepo: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - - sharedLibBranch: shared-lib + - sharedLibBranch: develop - sharedLibPath: "blueprints/02-at-scale/cbci/shared-lib" diff --git a/blueprints/02-at-scale/cbci/casc/oc/items/root.yaml b/blueprints/02-at-scale/cbci/casc/oc/items/root.yaml index b1c13a3b..18c4dce4 100644 --- a/blueprints/02-at-scale/cbci/casc/oc/items/root.yaml +++ b/blueprints/02-at-scale/cbci/casc/oc/items/root.yaml @@ -53,7 +53,7 @@ items: "cloudbees.prometheus": "true" properties: - configurationAsCode: - bundle: "shared-lib/none-ha" + bundle: "develop/none-ha" # Casc, HA - kind: managedController name: team-c-ha @@ -100,4 +100,4 @@ items: "cloudbees.prometheus": "true" properties: - configurationAsCode: - bundle: "shared-lib/ha" + bundle: "develop/ha" diff --git a/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml index 358c559c..82f69637 100644 --- a/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml +++ b/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml @@ -1,7 +1,7 @@ variables: - message: "Welcome to the CloudBees CI blueprint add-on: At scale!" - cascRepo: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - - cascBranch: shared-lib + - cascBranch: develop - cascPathController: "/blueprints/02-at-scale/cbci/casc/mc/" - ldapManagerDN: "cn=admin,dc=acme,dc=org" - ldapRootDN: "dc=acme,dc=org" diff --git a/blueprints/02-at-scale/k8s/cbci-values.yml b/blueprints/02-at-scale/k8s/cbci-values.yml index 36265238..e0062df8 100644 --- a/blueprints/02-at-scale/k8s/cbci-values.yml +++ b/blueprints/02-at-scale/k8s/cbci-values.yml @@ -16,7 +16,7 @@ OperationsCenter: Retriever: Enabled: true scmRepo: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - scmBranch: shared-lib + scmBranch: develop scmBundlePath: blueprints/02-at-scale/cbci/casc/oc scmPollingInterval: PT20M Persistence: From 994b86dee0876538b5911ae116d13b01bc20183f Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 18:56:43 +0200 Subject: [PATCH 076/180] Update CONTRIBUTING.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- CONTRIBUTING.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 4e971ff0..8c49e7ad 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -5,7 +5,7 @@ This document provides guidelines for contributing to the CloudBees CI add-on fo ## Design principles - It follows the same approach as the [Terraform AWS EKS Blueprints for Terraform Patterns](https://aws-ia.github.io/terraform-aws-eks-blueprints/). -- The blueprints use a monorepo configuration where additional configuration repositories are included within the same project. This approach is managed using [Spare Checkouts](https://github.blog/open-source/git/bring-your-monorepo-down-to-size-with-sparse-checkout/). For example, the [At scale blueprint](blueprints/02-at-scale) contains the repository for CasC bundles and Shared Libraries. +- The blueprints use a monorepo configuration where additional configuration repositories are included within the same project. This approach is managed using [Spare Checkouts](https://github.blog/open-source/git/bring-your-monorepo-down-to-size-with-sparse-checkout/). For example, the [At scale blueprint](blueprints/02-at-scale) contains the repository for CasC bundles and shared libraries. - Submit pull requests against the `develop` branch and release from the `main` branch. - `main` branch: - It is the stable branch and is used for releases. From e84b4d3f3b82e4e515d0579f76eb4f4565f939f1 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 18:56:52 +0200 Subject: [PATCH 077/180] Update README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 90ec773f..eaa86073 100644 --- a/README.md +++ b/README.md @@ -19,7 +19,7 @@ The CloudBees CI [AWS partner add-on](https://aws-ia.github.io/terraform-aws-eks-blueprints-addons/main/aws-partner-addons/) streamlines the adoption and experimentation of CloudBees CI enterprise features by: -- Encapsulating the deployment of [CloudBees CI on modern platforms in AWS EKS](https://docs.cloudbees.com/docs/cloudbees-ci/latest/eks-install-guide/installing-eks-using-helm#_configuring_your_environment) and additional k8s resources into a Terraform module. +- Encapsulating the deployment of [CloudBees CI on modern platforms in AWS EKS](https://docs.cloudbees.com/docs/cloudbees-ci/latest/eks-install-guide/installing-eks-using-helm#_configuring_your_environment) and additional Kubernetes resources into a Terraform module. - Providing a series of opinionated [blueprints](https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon/tree/main/blueprints) that implement the CloudBees CI add-on module for use with [Amazon EKS blueprints for Terraform](https://aws-ia.github.io/terraform-aws-eks-blueprints-addons/main/), which are aligned with the [EKS Best Practices Guides](https://aws.github.io/aws-eks-best-practices/). ## Usage From ad2aaa99268bd76be273eb72f4d705c3cec6fe78 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 18:58:30 +0200 Subject: [PATCH 078/180] Update variables.tf Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- variables.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/variables.tf b/variables.tf index 453b4598..41484b1a 100644 --- a/variables.tf +++ b/variables.tf @@ -94,7 +94,7 @@ variable "reg_secret_auth" { } validation { condition = contains(keys(var.reg_secret_auth), "server") && contains(keys(var.reg_secret_auth), "username") && contains(keys(var.reg_secret_auth), "password") && contains(keys(var.reg_secret_auth), "email") - error_message = "The reg_secret_auth must contain the following keys: server, username, password and email." + error_message = "The reg_secret_auth must contain the following keys: server, username, password, and email." } validation { condition = length(var.reg_secret_auth) == 4 From 50b5e4d8ed1529007e9323086d8234f4b386f8e9 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 18:58:35 +0200 Subject: [PATCH 079/180] Update variables.tf Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- variables.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/variables.tf b/variables.tf index 41484b1a..4554caaf 100644 --- a/variables.tf +++ b/variables.tf @@ -79,7 +79,7 @@ variable "reg_secret_ns" { type = string validation { condition = length(trimspace(var.reg_secret_ns)) > 0 - error_message = "Agent Namespace must not be an empty string." + error_message = "Agent namespace must not be an empty string." } } From 6e6e6978f6ed159b103fccff1142f8e3fcc5a6a5 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 18:59:10 +0200 Subject: [PATCH 080/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index bbbdd4a9..3264bad9 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -27,7 +27,7 @@ Once you have familiarized yourself with [CloudBees CI blueprint add-on: Get sta | [Grafana Tempo](https://grafana.com/oss/tempo/) | Provides backend tracing for [Jenkins OpenTelemetry](https://plugins.jenkins.io/opentelemetry/). | | [Hashicorp Vault](https://github.com/hashicorp/vault-helm) | Secrets management system that is integrated via [CloudBees HashiCorp Vault Plugin](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-secure-guide/hashicorp-vault-plugin). | -- Cloudbees CI uses [Configuration as Code (CasC)](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-oc/casc-intro) (refer to the [casc](cbci/casc) folder) to enable [exciting new features for streamlined DevOps](https://www.cloudbees.com/blog/cloudbees-ci-exciting-new-features-for-streamlined-devops) and other enterprise features, such as [CloudBees CI hibernation](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/managing-controllers#_hibernation_in_managed_masters). +- Cloudbees CI uses [Configuration as Code (CasC)](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-oc/casc-intro) (refer to the [casc](cbci/casc) folder) to enable [exciting new features for streamlined DevOps](https://www.cloudbees.com/blog/cloudbees-ci-exciting-new-features-for-streamlined-devops) and other enterprise features, such as [CloudBees CI hibernation](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/managing-controllers#hibernation-managed-controllers). - The operations center is using the [CasC Bundle Retriever](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-oc/bundle-retrieval-scm). - Managed controller configurations are managed from the operations center using [source control management (SCM)](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-controller/add-bundle#_adding_casc_bundles_from_an_scm_tool). - The managed controllers are using [CasC bundle inheritance](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-controller/advanced#_configuring_bundle_inheritance_with_casc) (refer to the [parent](cbci/casc/mc/parent) folder). This "parent" bundle is inherited by two types of "child" controller bundles: `ha` and `none-ha`, to accommodate [considerations about HA controllers](https://docs.cloudbees.com/docs/cloudbees-ci/latest/ha/ha-considerations). From 88b6d505c5e2a5624b0591b6e7b0adb5f2178796 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 18:59:17 +0200 Subject: [PATCH 081/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 3264bad9..828a699b 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -41,7 +41,7 @@ This blueprint divides scalable node groups for different types of workloads: - Shared node group services (role: `shared`): For common/shared workloads using [Amazon EKS-Optimized Amazon Linux 2023](https://aws.amazon.com/blogs/containers/amazon-eks-optimized-amazon-linux-2023-amis-now-available/) Amazon Machine Image (AMI) type. - CloudBees CI node groups: - - CI Services (role: `cb-apps`) + - CI services (role: `cb-apps`): - Services instance type: [AWS Graviton Processor](https://aws.amazon.com/ec2/graviton/) and [Bottlerocket OS](https://aws.amazon.com/bottlerocket/) AMI type. - It uses an [instance profile](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html) for operating with AWS Services permissions (eg. s3 Buckets). However, the recommended options are explained in [Issue 56](https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon/issues/56). - CI Agents (Ephemeral): From 826d5aa5d83bb0e74f1a93c519512729266551d2 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 18:59:28 +0200 Subject: [PATCH 082/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 828a699b..f1fce515 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -43,7 +43,7 @@ This blueprint divides scalable node groups for different types of workloads: - CloudBees CI node groups: - CI services (role: `cb-apps`): - Services instance type: [AWS Graviton Processor](https://aws.amazon.com/ec2/graviton/) and [Bottlerocket OS](https://aws.amazon.com/bottlerocket/) AMI type. - - It uses an [instance profile](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html) for operating with AWS Services permissions (eg. s3 Buckets). However, the recommended options are explained in [Issue 56](https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon/issues/56). + - It uses an [instance profile](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html) for operating with AWS services permissions (for example, S3 buckets). However, the recommended options are explained in [Issue 56](https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon/issues/56). - CI Agents (Ephemeral): - Linux: [AWS Graviton Processor](https://aws.amazon.com/ec2/graviton/) and [Bottlerocket OS](https://aws.amazon.com/bottlerocket/) AMI type and includes on-demand (role: `build-linux`) and Spot (role: `build-linux-spot`) capacity types. The Spot agent node groups follow the principles described in [Building for Cost Optimization and Resilience for EKS with Spot Instances](https://aws.amazon.com/blogs/compute/cost-optimization-and-resilience-eks-with-spot-instances/). - Windows (role: `build-windows`): Windows 2019 AMI type. From af3a1eca7437ec96ae2d87428069398ff123cb0c Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 18:59:38 +0200 Subject: [PATCH 083/180] Update variables.tf Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- variables.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/variables.tf b/variables.tf index 4554caaf..07be5b3a 100644 --- a/variables.tf +++ b/variables.tf @@ -63,7 +63,7 @@ variable "casc_secrets_file" { type = string validation { condition = length(trimspace(var.casc_secrets_file)) > 0 - error_message = "Casc secret file must not be an empty string." + error_message = "CasC secret file must not be an empty string." } } From b3d51f0c48a98507ccdbc9a13b7ecf635000051d Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 18:59:45 +0200 Subject: [PATCH 084/180] Update variables.tf Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- variables.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/variables.tf b/variables.tf index 07be5b3a..c833fc14 100644 --- a/variables.tf +++ b/variables.tf @@ -68,7 +68,7 @@ variable "casc_secrets_file" { } variable "create_reg_secret" { - description = "Create a Kubernetes dockerconfigjson secret for Container Registry authentication (cbci-sec-reg) for CI builds agents." + description = "Create a Kubernetes dockerconfigjson secret for container registry authentication (cbci-sec-reg) for CI builds agents." default = false type = bool } From 189002cc1f75987860294a1955ada986175abb95 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 18:59:53 +0200 Subject: [PATCH 085/180] Update variables.tf Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- variables.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/variables.tf b/variables.tf index c833fc14..72ff851e 100644 --- a/variables.tf +++ b/variables.tf @@ -74,7 +74,7 @@ variable "create_reg_secret" { } variable "reg_secret_ns" { - description = "Agent Namespace to allocate cbci-sec-reg secret. It is required when create_reg_secret is enabled." + description = "Agent namespace to allocate cbci-sec-reg secret. It is required when create_reg_secret is enabled." default = "cbci" type = string validation { From 921f52ef55438c13277643833d2bb35eb3c695b4 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Mon, 5 Aug 2024 16:59:59 +0000 Subject: [PATCH 086/180] terraform-docs: automated action --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index eaa86073..a40ec22b 100644 --- a/README.md +++ b/README.md @@ -97,11 +97,11 @@ The CloudBees CI add-on uses `helms release` for its resources definition, makin | trial_license | CloudBees CI trial license details for evaluation. | `map(string)` | n/a | yes | | casc_secrets_file | Secrets .yml file path containing the names:values secrets. It is required when create_casc_secrets is enabled. | `string` | `"secrets-values.yml"` | no | | create_casc_secrets | Create a Kubernetes basic secret for CloudBees Configuration as Code (cbci-sec-casc) and mount it into the Operation Center /var/run/secrets/cbci. | `bool` | `false` | no | -| create_reg_secret | Create a Kubernetes dockerconfigjson secret for Container Registry authentication (cbci-sec-reg) for CI builds agents. | `bool` | `false` | no | +| create_reg_secret | Create a Kubernetes dockerconfigjson secret for container registry authentication (cbci-sec-reg) for CI builds agents. | `bool` | `false` | no | | helm_config | CloudBees CI Helm chart configuration. | `any` | 
{
  "values": [
    ""
  ]
}
| no | | prometheus_target | Creates a service monitor to discover the CloudBees CI Prometheus target dynamically. It is designed to be enabled with the AWS EKS Terraform Addon Kube Prometheus Stack. | `bool` | `false` | no | | reg_secret_auth | Registry server authentication details for cbci-sec-reg secret. It is required when create_reg_secret is enabled. | `map(string)` | 
{
  "email": "foo.bar@acme.com",
  "password": "changeme1234",
  "server": "my-registry.acme:5000",
  "username": "foo"
}
| no | -| reg_secret_ns | Agent Namespace to allocate cbci-sec-reg secret. It is required when create_reg_secret is enabled. | `string` | `"cbci"` | no | +| reg_secret_ns | Agent namespace to allocate cbci-sec-reg secret. It is required when create_reg_secret is enabled. | `string` | `"cbci"` | no | ### Outputs From 9ba5c72a65f986174970e9751d4acfeb75e955f5 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 19:14:29 +0200 Subject: [PATCH 087/180] adding stages list --- .cloudbees/workflows/bp-tf-ci-old.yaml | 174 +++++++++++++++++++++++++ .cloudbees/workflows/bp-tf-ci.yaml | 52 +++----- 2 files changed, 190 insertions(+), 36 deletions(-) create mode 100644 .cloudbees/workflows/bp-tf-ci-old.yaml diff --git a/.cloudbees/workflows/bp-tf-ci-old.yaml b/.cloudbees/workflows/bp-tf-ci-old.yaml new file mode 100644 index 00000000..9e95fa3f --- /dev/null +++ b/.cloudbees/workflows/bp-tf-ci-old.yaml @@ -0,0 +1,174 @@ +# Copyright (c) CloudBees, Inc. + +apiVersion: automation.cloudbees.io/v1alpha1 +kind: workflow +name: ci + +on: + # Enable once Issue #83 is solved + # pull_request: + # branches: + # - 'main' + workflow_dispatch: + +env: + AWS_REGION: "us-east-1" + BUCKET_NAME_TF_STATE: "cbci-eks-addon-tf-state-v2" + AWS_ROLE_TO_ASSUME: "infra-admin-ci" + TF_AUTO_VARS_FILE: | + tags = { + "cb-owner" : "professional-services" + "cb-user" : "cb-platform" + "cb-purpose" : "ci" + } + trial_license = { + first_name = "CloudBees.io" + last_name = "Platform" + email = "ci.user@cloudbees.io" + company = "CloudBees Inc." + } + suffix = "ci-v11" + ci = true + +jobs: + init: + steps: + + - name: Configure AWS Credentials + uses: cloudbees-io/configure-aws-credentials@v1 + with: + aws-region: ${{ env.AWS_REGION }} + aws-access-key-id: ${{ secrets.AWS_TF_CBCI_EKS_AccessKeyID }} + aws-secret-access-key: ${{ secrets.AWS_TF_CBCI_EKS_SecretAccessKey }} + role-to-assume: ${{ env.AWS_ROLE_TO_ASSUME }} + role-external-id: cloudbees + role-duration-seconds: "3600" + + #TODO: Add tags for the bucket + - name: Create Terraform Backend Bucket if not exists + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + shell: bash + run: | + aws s3api create-bucket \ + --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ + --region ${{ env.AWS_REGION }} || echo "Bucket ${{ env.BUCKET_NAME_TF_STATE }} already exists" + + bp01: + env: + CLEAN_UP: "false" + needs: + - init + steps: + + - name: Configure AWS Credentials + uses: cloudbees-io/configure-aws-credentials@v1 + with: + aws-region: ${{ env.AWS_REGION }} + aws-access-key-id: ${{ secrets.AWS_TF_CBCI_EKS_AccessKeyID }} + aws-secret-access-key: ${{ secrets.AWS_TF_CBCI_EKS_SecretAccessKey }} + role-to-assume: ${{ env.AWS_ROLE_TO_ASSUME }} + role-external-id: cloudbees + role-duration-seconds: "3600" + + - name: Checkout code + uses: cloudbees-io/checkout@v1 + + - name: 01-getting-started - Deploy + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + env: + ROOT: 01-getting-started + TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com + shell: bash + run : | + cat <> blueprints/${{ env.ROOT }}/.auto.tfvars + ${{ env.TF_AUTO_VARS_FILE }} + EOT + cat <> blueprints/${{ env.ROOT }}/backend.tf + terraform { + backend "s3" { + bucket = "${{ env.BUCKET_NAME_TF_STATE }}" + key = "${{ env.ROOT }}/ci.terraform.tfstate" + region = "${{ env.AWS_REGION }}" + } + } + EOT + [ "${{ env.CLEAN_UP }}" = "true" ] && echo "Skipping... Clean up mode." || CI=true make deploy + + - name: 01-getting-started - Validate + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + env: + ROOT: 01-getting-started + shell: bash + run : | + [ "${{ env.CLEAN_UP }}" = "true" ] && echo "Skipping... Clean up mode." || CI=true make validate + + - name: 01-getting-started - Destroy + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + env: + ROOT: 01-getting-started + TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com + shell: bash + run : | + [ "${{ env.CLEAN_UP }}" = "true" ] && terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy \ + || CI=true make destroy + + bp02: + env: + CLEAN_UP: "false" + needs: + - init + steps: + + - name: Configure AWS Credentials + uses: cloudbees-io/configure-aws-credentials@v1 + with: + aws-region: ${{ env.AWS_REGION }} + aws-access-key-id: ${{ secrets.AWS_TF_CBCI_EKS_AccessKeyID }} + aws-secret-access-key: ${{ secrets.AWS_TF_CBCI_EKS_SecretAccessKey }} + role-to-assume: ${{ env.AWS_ROLE_TO_ASSUME }} + role-external-id: cloudbees + role-duration-seconds: "3600" + + - name: Checkout code + uses: cloudbees-io/checkout@v1 + + - name: 02-at-scale - Deploy + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + env: + ROOT: 02-at-scale + TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com + shell: bash + run : | + cat <> blueprints/${{ env.ROOT }}/.auto.tfvars + ${{ env.TF_AUTO_VARS_FILE }} + gh_user = "exampleUser" + gh_token = "ExampleToken1234" + EOT + cat <> blueprints/${{ env.ROOT }}/backend.tf + terraform { + backend "s3" { + bucket = "${{ env.BUCKET_NAME_TF_STATE }}" + key = "${{ env.ROOT }}/ci.terraform.tfstate" + region = "${{ env.AWS_REGION }}" + } + } + EOT + [ "${{ env.CLEAN_UP }}" = "true" ] && echo "Skipping... Clean up mode." || CI=true make deploy + + - name: 02-at-scale - Validate + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + env: + ROOT: 02-at-scale + shell: bash + run : | + [ "${{ env.CLEAN_UP }}" = "true" ] && echo "Skipping... Clean up mode." || CI=true make validate + + - name: 02-at-scale - Destroy + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + env: + ROOT: 02-at-scale + TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com + shell: bash + run : | + [ "${{ env.CLEAN_UP }}" = "true" ] && terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy \ + || CI=true make destroy diff --git a/.cloudbees/workflows/bp-tf-ci.yaml b/.cloudbees/workflows/bp-tf-ci.yaml index 9e95fa3f..c4e2ec1c 100644 --- a/.cloudbees/workflows/bp-tf-ci.yaml +++ b/.cloudbees/workflows/bp-tf-ci.yaml @@ -55,7 +55,8 @@ jobs: bp01: env: - CLEAN_UP: "false" + # Add the stages to execute in the pipeline: deploy,validate,destroy + STAGES: "deploy,validate,destroy" needs: - init steps: @@ -75,46 +76,37 @@ jobs: - name: 01-getting-started - Deploy uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'deploy') env: ROOT: 01-getting-started TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com shell: bash run : | - cat <> blueprints/${{ env.ROOT }}/.auto.tfvars - ${{ env.TF_AUTO_VARS_FILE }} - EOT - cat <> blueprints/${{ env.ROOT }}/backend.tf - terraform { - backend "s3" { - bucket = "${{ env.BUCKET_NAME_TF_STATE }}" - key = "${{ env.ROOT }}/ci.terraform.tfstate" - region = "${{ env.AWS_REGION }}" - } - } - EOT - [ "${{ env.CLEAN_UP }}" = "true" ] && echo "Skipping... Clean up mode." || CI=true make deploy + echo "deploy" - name: 01-getting-started - Validate uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'validate') env: ROOT: 01-getting-started shell: bash run : | - [ "${{ env.CLEAN_UP }}" = "true" ] && echo "Skipping... Clean up mode." || CI=true make validate + echo "validate" - name: 01-getting-started - Destroy uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'destroy') env: ROOT: 01-getting-started TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com shell: bash run : | - [ "${{ env.CLEAN_UP }}" = "true" ] && terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy \ - || CI=true make destroy + echo "destroy" bp02: env: - CLEAN_UP: "false" + # Add the stages to execute in the pipeline: deploy,validate,destroy + STAGES: "deploy,validate,destroy" needs: - init steps: @@ -134,41 +126,29 @@ jobs: - name: 02-at-scale - Deploy uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'deploy') env: ROOT: 02-at-scale TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com shell: bash run : | - cat <> blueprints/${{ env.ROOT }}/.auto.tfvars - ${{ env.TF_AUTO_VARS_FILE }} - gh_user = "exampleUser" - gh_token = "ExampleToken1234" - EOT - cat <> blueprints/${{ env.ROOT }}/backend.tf - terraform { - backend "s3" { - bucket = "${{ env.BUCKET_NAME_TF_STATE }}" - key = "${{ env.ROOT }}/ci.terraform.tfstate" - region = "${{ env.AWS_REGION }}" - } - } - EOT - [ "${{ env.CLEAN_UP }}" = "true" ] && echo "Skipping... Clean up mode." || CI=true make deploy + echo "deploy" - name: 02-at-scale - Validate uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'validate') env: ROOT: 02-at-scale shell: bash run : | - [ "${{ env.CLEAN_UP }}" = "true" ] && echo "Skipping... Clean up mode." || CI=true make validate + echo "validate" - name: 02-at-scale - Destroy uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'destroy') env: ROOT: 02-at-scale TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com shell: bash run : | - [ "${{ env.CLEAN_UP }}" = "true" ] && terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy \ - || CI=true make destroy + echo "destroy" From 9fc4f17c52fe31c914cf6f4df5ae62c280fde9e7 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 19:18:43 +0200 Subject: [PATCH 088/180] test --- .cloudbees/workflows/bp-tf-ci.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-ci.yaml b/.cloudbees/workflows/bp-tf-ci.yaml index c4e2ec1c..e35d5406 100644 --- a/.cloudbees/workflows/bp-tf-ci.yaml +++ b/.cloudbees/workflows/bp-tf-ci.yaml @@ -56,7 +56,7 @@ jobs: bp01: env: # Add the stages to execute in the pipeline: deploy,validate,destroy - STAGES: "deploy,validate,destroy" + STAGES: "destroy" needs: - init steps: @@ -106,7 +106,7 @@ jobs: bp02: env: # Add the stages to execute in the pipeline: deploy,validate,destroy - STAGES: "deploy,validate,destroy" + STAGES: "deploy,validate" needs: - init steps: From d8931f46b0c06284a948fe0dcfe367bc592599dd Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 19:26:38 +0200 Subject: [PATCH 089/180] test upload --- .cloudbees/workflows/bp-tf-ci.yaml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.cloudbees/workflows/bp-tf-ci.yaml b/.cloudbees/workflows/bp-tf-ci.yaml index e35d5406..57a62784 100644 --- a/.cloudbees/workflows/bp-tf-ci.yaml +++ b/.cloudbees/workflows/bp-tf-ci.yaml @@ -56,7 +56,7 @@ jobs: bp01: env: # Add the stages to execute in the pipeline: deploy,validate,destroy - STAGES: "destroy" + STAGES: "deploy,validate" needs: - init steps: @@ -83,6 +83,12 @@ jobs: shell: bash run : | echo "deploy" + echo "hello" > hello.txt + aws s3api put-object \ + --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ + --region ${{ env.AWS_REGION }} + --key hello.txt \ + --body kubeconf/hello.txt - name: 01-getting-started - Validate uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest From fbab7541b73e862952e5407c5d1c270fa40c648e Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 19:39:27 +0200 Subject: [PATCH 090/180] fix command --- .cloudbees/workflows/bp-tf-ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.cloudbees/workflows/bp-tf-ci.yaml b/.cloudbees/workflows/bp-tf-ci.yaml index 57a62784..6b917f37 100644 --- a/.cloudbees/workflows/bp-tf-ci.yaml +++ b/.cloudbees/workflows/bp-tf-ci.yaml @@ -86,7 +86,7 @@ jobs: echo "hello" > hello.txt aws s3api put-object \ --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ - --region ${{ env.AWS_REGION }} + --region ${{ env.AWS_REGION }} \ --key hello.txt \ --body kubeconf/hello.txt From d0b3d9ce6c5bab3515fb43b88dad5bd89e81ef90 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 19:41:22 +0200 Subject: [PATCH 091/180] Update bp-tf-ci.yaml --- .cloudbees/workflows/bp-tf-ci.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-ci.yaml b/.cloudbees/workflows/bp-tf-ci.yaml index 6b917f37..50889157 100644 --- a/.cloudbees/workflows/bp-tf-ci.yaml +++ b/.cloudbees/workflows/bp-tf-ci.yaml @@ -87,8 +87,8 @@ jobs: aws s3api put-object \ --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ --region ${{ env.AWS_REGION }} \ - --key hello.txt \ - --body kubeconf/hello.txt + --key bp01/hello.txt \ + --body hello.txt - name: 01-getting-started - Validate uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest From 8cb5eb5a8d00ed98d218511fca827dbdd0c2d0dd Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 20:11:02 +0200 Subject: [PATCH 092/180] adding outputs for kubeconfig file --- blueprints/01-getting-started/outputs.tf | 4 ++++ blueprints/02-at-scale/outputs.tf | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/blueprints/01-getting-started/outputs.tf b/blueprints/01-getting-started/outputs.tf index a74f5b03..23d3cfa8 100644 --- a/blueprints/01-getting-started/outputs.tf +++ b/blueprints/01-getting-started/outputs.tf @@ -1,3 +1,7 @@ +output "kubeconfig_file" { + description = "Kubeconfig file path to access the Kubernetes API." + value = local.kubeconfig_file_path +} output "kubeconfig_export" { description = "Export the KUBECONFIG environment variable to access the Kubernetes API." diff --git a/blueprints/02-at-scale/outputs.tf b/blueprints/02-at-scale/outputs.tf index 1c7da431..5f0e5418 100644 --- a/blueprints/02-at-scale/outputs.tf +++ b/blueprints/02-at-scale/outputs.tf @@ -1,3 +1,7 @@ +output "kubeconfig_file" { + description = "Kubeconfig file path to access the Kubernetes API." + value = local.kubeconfig_file_path +} output "kubeconfig_export" { description = "Export the KUBECONFIG environment variable to access the Kubernetes API." From d6940758b054cad45b627c08313cd826f2288669 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 20:13:48 +0200 Subject: [PATCH 093/180] testing new approach --- .cloudbees/workflows/bp-tf-ci.yaml | 42 ++++++++++++++++++++++++++---- 1 file changed, 37 insertions(+), 5 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-ci.yaml b/.cloudbees/workflows/bp-tf-ci.yaml index 50889157..c5644a29 100644 --- a/.cloudbees/workflows/bp-tf-ci.yaml +++ b/.cloudbees/workflows/bp-tf-ci.yaml @@ -82,13 +82,24 @@ jobs: TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com shell: bash run : | - echo "deploy" - echo "hello" > hello.txt + cat <> blueprints/${{ env.ROOT }}/.auto.tfvars + ${{ env.TF_AUTO_VARS_FILE }} + EOT + cat <> blueprints/${{ env.ROOT }}/backend.tf + terraform { + backend "s3" { + bucket = "${{ env.BUCKET_NAME_TF_STATE }}" + key = "${{ env.ROOT }}/ci.terraform.tfstate" + region = "${{ env.AWS_REGION }}" + } + } + EOT + CI=true make deploy aws s3api put-object \ --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ --region ${{ env.AWS_REGION }} \ - --key bp01/hello.txt \ - --body hello.txt + --key ${{ env.ROOT }}/${{ env.ROOT }}.kubeconfig.yaml \ + --body ${{ cd blueprints/${{ env.ROOT }} && terraform output --raw kubeconfig_file }} - name: 01-getting-started - Validate uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest @@ -138,7 +149,28 @@ jobs: TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com shell: bash run : | - echo "deploy" + cat <> blueprints/${{ env.ROOT }}/.auto.tfvars + ${{ env.TF_AUTO_VARS_FILE }} + dh_reg_secret_auth = { + username = "foo" + password = "d0ckerPass12" + } + EOT + cat <> blueprints/${{ env.ROOT }}/backend.tf + terraform { + backend "s3" { + bucket = "${{ env.BUCKET_NAME_TF_STATE }}" + key = "${{ env.ROOT }}/ci.terraform.tfstate" + region = "${{ env.AWS_REGION }}" + } + } + EOT + CI=true make deploy + aws s3api put-object \ + --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ + --region ${{ env.AWS_REGION }} \ + --key ${{ env.ROOT }}/${{ env.ROOT }}.kubeconfig.yaml \ + --body ${{ cd blueprints/${{ env.ROOT }} && terraform output --raw kubeconfig_file }} - name: 02-at-scale - Validate uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest From 132f9d394be5e825f24f7b17f455f3efdbfb071a Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 20:18:30 +0200 Subject: [PATCH 094/180] Update bp-tf-ci.yaml --- .cloudbees/workflows/bp-tf-ci.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-ci.yaml b/.cloudbees/workflows/bp-tf-ci.yaml index c5644a29..dfe2ed34 100644 --- a/.cloudbees/workflows/bp-tf-ci.yaml +++ b/.cloudbees/workflows/bp-tf-ci.yaml @@ -99,7 +99,7 @@ jobs: --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ --region ${{ env.AWS_REGION }} \ --key ${{ env.ROOT }}/${{ env.ROOT }}.kubeconfig.yaml \ - --body ${{ cd blueprints/${{ env.ROOT }} && terraform output --raw kubeconfig_file }} + --body $(cd blueprints/${{ env.ROOT }} && terraform output --raw kubeconfig_file) - name: 01-getting-started - Validate uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest @@ -170,7 +170,7 @@ jobs: --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ --region ${{ env.AWS_REGION }} \ --key ${{ env.ROOT }}/${{ env.ROOT }}.kubeconfig.yaml \ - --body ${{ cd blueprints/${{ env.ROOT }} && terraform output --raw kubeconfig_file }} + --body $(cd blueprints/${{ env.ROOT }} && terraform output --raw kubeconfig_file) - name: 02-at-scale - Validate uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest From 209e54e54c11aa473f131d6cb652a45ff2ddd36c Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 20:33:42 +0200 Subject: [PATCH 095/180] adding Destroy and reconfigure --- .cloudbees/workflows/bp-tf-ci.yaml | 35 +++++++++++++++++++++++++----- 1 file changed, 29 insertions(+), 6 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-ci.yaml b/.cloudbees/workflows/bp-tf-ci.yaml index dfe2ed34..f58595c3 100644 --- a/.cloudbees/workflows/bp-tf-ci.yaml +++ b/.cloudbees/workflows/bp-tf-ci.yaml @@ -55,8 +55,8 @@ jobs: bp01: env: - # Add the stages to execute in the pipeline: deploy,validate,destroy - STAGES: "deploy,validate" + # Add the stages to execute in the pipeline: deploy,validate,destroy,reconfigure-destroy + STAGES: "reconfigure-destroy" needs: - init steps: @@ -118,12 +118,23 @@ jobs: TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com shell: bash run : | - echo "destroy" + CI=true make destroy + + # Use this to clean up failed deployments + - name: 01-getting-started - Reconfigure and Destroy + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'reconfigure-destroy') + env: + ROOT: 01-getting-started + TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com + shell: bash + run : | + terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy bp02: env: - # Add the stages to execute in the pipeline: deploy,validate,destroy - STAGES: "deploy,validate" + # Add the stages to execute in the pipeline: deploy,validate,destroy,reconfigure-destroy + STAGES: "reconfigure-destroy" needs: - init steps: @@ -154,6 +165,7 @@ jobs: dh_reg_secret_auth = { username = "foo" password = "d0ckerPass12" + email = "example@gmail.com" } EOT cat <> blueprints/${{ env.ROOT }}/backend.tf @@ -189,4 +201,15 @@ jobs: TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com shell: bash run : | - echo "destroy" + CI=true make destroy + + # Use this to clean up failed deployments + - name: 02-at-scale - Reconfigure and Destroy + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'reconfigure-destroy') + env: + ROOT: 02-at-scale + TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com + shell: bash + run : | + CI=true make destroy From 2515ac49335d20cfa8bdb37f4ff2304ed2a06204 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 20:35:03 +0200 Subject: [PATCH 096/180] Update bp-tf-ci.yaml --- .cloudbees/workflows/bp-tf-ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.cloudbees/workflows/bp-tf-ci.yaml b/.cloudbees/workflows/bp-tf-ci.yaml index f58595c3..762d318b 100644 --- a/.cloudbees/workflows/bp-tf-ci.yaml +++ b/.cloudbees/workflows/bp-tf-ci.yaml @@ -212,4 +212,4 @@ jobs: TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com shell: bash run : | - CI=true make destroy + terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy From f1eafa0b544f4df0c284259d281c681b8acc5a78 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 20:39:25 +0200 Subject: [PATCH 097/180] Adding wipeout --- .cloudbees/workflows/bp-tf-ci.yaml | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-ci.yaml b/.cloudbees/workflows/bp-tf-ci.yaml index 762d318b..b399336c 100644 --- a/.cloudbees/workflows/bp-tf-ci.yaml +++ b/.cloudbees/workflows/bp-tf-ci.yaml @@ -55,8 +55,8 @@ jobs: bp01: env: - # Add the stages to execute in the pipeline: deploy,validate,destroy,reconfigure-destroy - STAGES: "reconfigure-destroy" + # Add the stages to execute in the pipeline: deploy,validate,destroy,wipeout + STAGES: "wipeout" needs: - init steps: @@ -120,10 +120,9 @@ jobs: run : | CI=true make destroy - # Use this to clean up failed deployments - - name: 01-getting-started - Reconfigure and Destroy + - name: 01-getting-started - Wipeout Failed Deployment uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest - if: contains(env.STAGES, 'reconfigure-destroy') + if: contains(env.STAGES, 'wipeout') env: ROOT: 01-getting-started TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com @@ -133,8 +132,8 @@ jobs: bp02: env: - # Add the stages to execute in the pipeline: deploy,validate,destroy,reconfigure-destroy - STAGES: "reconfigure-destroy" + # Add the stages to execute in the pipeline: deploy,validate,destroy,wipeout + STAGES: "wipeout" needs: - init steps: @@ -203,10 +202,9 @@ jobs: run : | CI=true make destroy - # Use this to clean up failed deployments - - name: 02-at-scale - Reconfigure and Destroy + - name: 02-at-scale - Wipeout Failed Deployment uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest - if: contains(env.STAGES, 'reconfigure-destroy') + if: contains(env.STAGES, 'wipeout') env: ROOT: 02-at-scale TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com From 91cdef0fed565c2be95de0de1583b8caa95c1369 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:12:21 +0200 Subject: [PATCH 098/180] Fixing stages --- .cloudbees/workflows/bp-tf-ci.yaml | 54 ++++++++++++++++-------------- 1 file changed, 29 insertions(+), 25 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-ci.yaml b/.cloudbees/workflows/bp-tf-ci.yaml index b399336c..fa95fb74 100644 --- a/.cloudbees/workflows/bp-tf-ci.yaml +++ b/.cloudbees/workflows/bp-tf-ci.yaml @@ -55,6 +55,8 @@ jobs: bp01: env: + ROOT: 01-getting-started + TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com # Add the stages to execute in the pipeline: deploy,validate,destroy,wipeout STAGES: "wipeout" needs: @@ -74,12 +76,26 @@ jobs: - name: Checkout code uses: cloudbees-io/checkout@v1 + - name: 01-getting-started - Set + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + shell: bash + run : | + cat <> blueprints/${{ env.ROOT }}/.auto.tfvars + ${{ env.TF_AUTO_VARS_FILE }} + EOT + cat <> blueprints/${{ env.ROOT }}/backend.tf + terraform { + backend "s3" { + bucket = "${{ env.BUCKET_NAME_TF_STATE }}" + key = "${{ env.ROOT }}/ci.terraform.tfstate" + region = "${{ env.AWS_REGION }}" + } + } + EOT + - name: 01-getting-started - Deploy uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest if: contains(env.STAGES, 'deploy') - env: - ROOT: 01-getting-started - TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com shell: bash run : | cat <> blueprints/${{ env.ROOT }}/.auto.tfvars @@ -104,8 +120,6 @@ jobs: - name: 01-getting-started - Validate uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest if: contains(env.STAGES, 'validate') - env: - ROOT: 01-getting-started shell: bash run : | echo "validate" @@ -113,9 +127,6 @@ jobs: - name: 01-getting-started - Destroy uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest if: contains(env.STAGES, 'destroy') - env: - ROOT: 01-getting-started - TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com shell: bash run : | CI=true make destroy @@ -123,15 +134,14 @@ jobs: - name: 01-getting-started - Wipeout Failed Deployment uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest if: contains(env.STAGES, 'wipeout') - env: - ROOT: 01-getting-started - TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com shell: bash run : | terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy bp02: env: + ROOT: 02-at-scale + TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com # Add the stages to execute in the pipeline: deploy,validate,destroy,wipeout STAGES: "wipeout" needs: @@ -151,12 +161,8 @@ jobs: - name: Checkout code uses: cloudbees-io/checkout@v1 - - name: 02-at-scale - Deploy + - name: 02-at-scale - Set uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest - if: contains(env.STAGES, 'deploy') - env: - ROOT: 02-at-scale - TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com shell: bash run : | cat <> blueprints/${{ env.ROOT }}/.auto.tfvars @@ -176,6 +182,12 @@ jobs: } } EOT + + - name: 02-at-scale - Deploy + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'deploy') + shell: bash + run : | CI=true make deploy aws s3api put-object \ --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ @@ -186,18 +198,13 @@ jobs: - name: 02-at-scale - Validate uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest if: contains(env.STAGES, 'validate') - env: - ROOT: 02-at-scale shell: bash run : | - echo "validate" + CI=true make validate - name: 02-at-scale - Destroy uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest if: contains(env.STAGES, 'destroy') - env: - ROOT: 02-at-scale - TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com shell: bash run : | CI=true make destroy @@ -205,9 +212,6 @@ jobs: - name: 02-at-scale - Wipeout Failed Deployment uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest if: contains(env.STAGES, 'wipeout') - env: - ROOT: 02-at-scale - TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com shell: bash run : | terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy From 188ef1c0837facdd888487f184579ecd6335544f Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:13:35 +0200 Subject: [PATCH 099/180] cleaning --- .cloudbees/workflows/bp-tf-ci.yaml | 14 +------------- 1 file changed, 1 insertion(+), 13 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-ci.yaml b/.cloudbees/workflows/bp-tf-ci.yaml index fa95fb74..51bb68c0 100644 --- a/.cloudbees/workflows/bp-tf-ci.yaml +++ b/.cloudbees/workflows/bp-tf-ci.yaml @@ -98,18 +98,6 @@ jobs: if: contains(env.STAGES, 'deploy') shell: bash run : | - cat <> blueprints/${{ env.ROOT }}/.auto.tfvars - ${{ env.TF_AUTO_VARS_FILE }} - EOT - cat <> blueprints/${{ env.ROOT }}/backend.tf - terraform { - backend "s3" { - bucket = "${{ env.BUCKET_NAME_TF_STATE }}" - key = "${{ env.ROOT }}/ci.terraform.tfstate" - region = "${{ env.AWS_REGION }}" - } - } - EOT CI=true make deploy aws s3api put-object \ --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ @@ -122,7 +110,7 @@ jobs: if: contains(env.STAGES, 'validate') shell: bash run : | - echo "validate" + CI=true make validate - name: 01-getting-started - Destroy uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest From c839f38b51c57ac2a17a438808ec038a76e6abbc Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:19:19 +0200 Subject: [PATCH 100/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index f1fce515..c7b1a96c 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -44,7 +44,7 @@ This blueprint divides scalable node groups for different types of workloads: - CI services (role: `cb-apps`): - Services instance type: [AWS Graviton Processor](https://aws.amazon.com/ec2/graviton/) and [Bottlerocket OS](https://aws.amazon.com/bottlerocket/) AMI type. - It uses an [instance profile](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html) for operating with AWS services permissions (for example, S3 buckets). However, the recommended options are explained in [Issue 56](https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon/issues/56). - - CI Agents (Ephemeral): + - CI agents (ephemeral): - Linux: [AWS Graviton Processor](https://aws.amazon.com/ec2/graviton/) and [Bottlerocket OS](https://aws.amazon.com/bottlerocket/) AMI type and includes on-demand (role: `build-linux`) and Spot (role: `build-linux-spot`) capacity types. The Spot agent node groups follow the principles described in [Building for Cost Optimization and Resilience for EKS with Spot Instances](https://aws.amazon.com/blogs/compute/cost-optimization-and-resilience-eks-with-spot-instances/). - Windows (role: `build-windows`): Windows 2019 AMI type. From 9c22ee37b602d7fa2c3700da9f165c7dc6b14742 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:19:36 +0200 Subject: [PATCH 101/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index c7b1a96c..49b8ca0e 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -49,7 +49,7 @@ This blueprint divides scalable node groups for different types of workloads: - Windows (role: `build-windows`): Windows 2019 AMI type. > [!IMPORTANT] -> It is known that Linux container lunch time are faster than Windows container. That reality can be improved by using a cache container image strategy (see [Speeding up Windows container launch times with EC2 Image builder and image cache strategy](https://aws.amazon.com/blogs/containers/speeding-up-windows-container-launch-times-with-ec2-image-builder-and-image-cache-strategy/) and more about [Windows Container Best Practices](https://aws.github.io/aws-eks-best-practices/windows/docs/ami/)). Alternatively to Windows Containes, it is possible to use Windows VMs using [Shared Agent](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/shared-agents). +> The launch time for Linux containers is faster than Windows containers. This can be improved by using a cache container image strategy. Refer to [Speeding up Windows container launch times with EC2 Image builder and image cache strategy](https://aws.amazon.com/blogs/containers/speeding-up-windows-container-launch-times-with-ec2-image-builder-and-image-cache-strategy/) and more about [Windows Container Best Practices](https://aws.github.io/aws-eks-best-practices/windows/docs/ami/)). Another potential alternative is to use Windows VMs with a [shared agent](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/shared-agents). ![Architecture](img/at-scale.architect.drawio.svg) From 638b92aa1b41a7146c252dbe87b1a21cfe3e8531 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:19:50 +0200 Subject: [PATCH 102/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 49b8ca0e..1657ea46 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -119,7 +119,7 @@ This blueprint divides scalable node groups for different types of workloads: ## Prerequisites -This blueprint uses [DockerHub](https://hub.docker.com/) as a Container Registry Service. Then, an existing DockerHub account is required (username, password and email). +This blueprint uses [DockerHub](https://hub.docker.com/) as a container registry service. Note that an existing DockerHub account is required (username, password, and email). > [!TIP] > Use `docker login` to validate username and password. From 7493dadbf6df5a01ce9ef8561af1e6e3b867b1c6 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:20:11 +0200 Subject: [PATCH 103/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 1657ea46..6991cc9b 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -163,7 +163,7 @@ Once the resources have been created, a `kubeconfig` file is created in the [/k8 There are differences in CloudBees CI permissions and folder restrictions when signed in as a user of the Admin group versus the Development group. For example, only Admin users have access to the agent validation jobs. -3. CasC is enabled for the [operations center](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-oc/) (`cjoc`) and [controllers](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-controller/) (`team-b` and `team-c-ha`). `team-a` is not using CasC, to illustrate the difference between the two approaches. Issue the following command to verify that all controllers are Running: +3. CasC is enabled for the [operations center](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-oc/) (`cjoc`) and [controllers](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-controller/) (`team-b` and `team-c-ha`). `team-a` is not using CasC, to illustrate the difference between the two approaches. Issue the following command to verify that all controllers are running: ```sh eval $(terraform output --raw cbci_controllers_pods) From ae2b910c19047cd2fe02ce1c8a2f501100c0b322 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:20:58 +0200 Subject: [PATCH 104/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 6991cc9b..33acac4b 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -177,9 +177,9 @@ Once the resources have been created, a `kubeconfig` file is created in the [/k8 eval $(terraform output --raw cbci_controller_c_hpa) ``` -#### Secrets Management +#### Secrets management -##### Kubernetes Secret +##### Kubernetes secret This blueprint uses a couple of Kubernetes secrets for different purposes. From ef7e2fb8645c7129094da260b0c555fd20a1193c Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:21:16 +0200 Subject: [PATCH 105/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 33acac4b..14ea548e 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -181,7 +181,7 @@ Once the resources have been created, a `kubeconfig` file is created in the [/k8 ##### Kubernetes secret -This blueprint uses a couple of Kubernetes secrets for different purposes. +This blueprint Kubernetes secrets for different purposes. > [!NOTE] > - Beyond the CloudBees CI Addon (for demo purposes), Kubernetes secrets can be managed via [External Secret Operators](https://aws-ia.github.io/terraform-aws-eks-blueprints-addons/main/addons/external-secrets/). From f1315991e118d0c3fc9cab8d13f32f1a8e985f8f Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:21:34 +0200 Subject: [PATCH 106/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 14ea548e..7206b80e 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -184,7 +184,7 @@ Once the resources have been created, a `kubeconfig` file is created in the [/k8 This blueprint Kubernetes secrets for different purposes. > [!NOTE] -> - Beyond the CloudBees CI Addon (for demo purposes), Kubernetes secrets can be managed via [External Secret Operators](https://aws-ia.github.io/terraform-aws-eks-blueprints-addons/main/addons/external-secrets/). +> - Beyond the CloudBees CI add-on (used for demo purposes), Kubernetes secrets can be managed via [External Secret Operators](https://aws-ia.github.io/terraform-aws-eks-blueprints-addons/main/addons/external-secrets/). > - Kubernetes secrets could be also be retrived as Jenkins Credentials via using the [Kubernetes Credentials Provider plugin](https://jenkinsci.github.io/kubernetes-credentials-provider-plugin/). ###### Casc Secrets From 634d21f467ba5f057b559a1e54b24caefdf13cd5 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:21:46 +0200 Subject: [PATCH 107/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 7206b80e..47c02d52 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -187,7 +187,7 @@ This blueprint Kubernetes secrets for different purposes. > - Beyond the CloudBees CI add-on (used for demo purposes), Kubernetes secrets can be managed via [External Secret Operators](https://aws-ia.github.io/terraform-aws-eks-blueprints-addons/main/addons/external-secrets/). > - Kubernetes secrets could be also be retrived as Jenkins Credentials via using the [Kubernetes Credentials Provider plugin](https://jenkinsci.github.io/kubernetes-credentials-provider-plugin/). -###### Casc Secrets +###### CasC secrets The secrets key/value file defined in [k8s/secrets-values.yml](k8s/secrets-values.yml) is converted into a Kubernetes secret (`cbci-sec-casc`) and mounted into /run/secrets/ for Operation Center and Controllers to be consumed via CloudBees Casc. See [Configuration as Code - Handling Secrets - Kubernetes Secrets](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets) for more information. From ec697def42826276b79fbd62599ec1072a1f7894 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:22:00 +0200 Subject: [PATCH 108/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 47c02d52..990d3e96 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -189,7 +189,7 @@ This blueprint Kubernetes secrets for different purposes. ###### CasC secrets -The secrets key/value file defined in [k8s/secrets-values.yml](k8s/secrets-values.yml) is converted into a Kubernetes secret (`cbci-sec-casc`) and mounted into /run/secrets/ for Operation Center and Controllers to be consumed via CloudBees Casc. See [Configuration as Code - Handling Secrets - Kubernetes Secrets](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets) for more information. +The secrets key/value file defined in [k8s/secrets-values.yml](k8s/secrets-values.yml) is converted into a Kubernetes secret (`cbci-sec-casc`) and mounted into `/run/secrets/` for the operations center and controllers to be consumed via CloudBees CasC. Refer to [Configuration as Code - Handling Secrets - Kubernetes Secrets](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets) for more information. ###### Container Registry Secrets From aa7d574a5754100cb8f23b021986f9b0ffd65cde Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:22:56 +0200 Subject: [PATCH 109/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 990d3e96..353d294e 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -191,7 +191,7 @@ This blueprint Kubernetes secrets for different purposes. The secrets key/value file defined in [k8s/secrets-values.yml](k8s/secrets-values.yml) is converted into a Kubernetes secret (`cbci-sec-casc`) and mounted into `/run/secrets/` for the operations center and controllers to be consumed via CloudBees CasC. Refer to [Configuration as Code - Handling Secrets - Kubernetes Secrets](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets) for more information. -###### Container Registry Secrets +###### Container registry secrets DockerHub authentication is stored as Kubernetes secrets (`cbci-agent-sec-reg`) and mounted to [Kaniko agent containers](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/using-kaniko) to build and push images to this registry. The secret is created using the `dh_reg_secret_auth` variable. From 578fdaba13dddea598f6aea77814a295f7ce314e Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:23:07 +0200 Subject: [PATCH 110/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 353d294e..9595b22c 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -206,7 +206,7 @@ DockerHub authentication is stored as Kubernetes secrets (`cbci-agent-sec-reg`) HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in this blueprint. -1. Run the configure Hashicorp Vault script. Keep in a safe place Admin Token and Unseal Keys (saved in `k8s/vault-init.log`) as well as Role ID and Secret ID for `cbci-oc` App Role. +1. Run the configure Hashicorp Vault script. Store the admin token and unseal keys (saved in `k8s/vault-init.log`) and role ID and secret ID for the `cbci-oc` application role in a safe place. ```sh eval $(terraform output --raw vault_configure) From a823363cab8649396fa52ac5c92a9b04095f3eee Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:23:19 +0200 Subject: [PATCH 111/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 9595b22c..edaa6adb 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -212,7 +212,7 @@ HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in t eval $(terraform output --raw vault_configure) ``` -2. Access the HashiCorp Vault UI by issuing the following command. Enter the root token to log in from the _step 1_. +2. Issue the following command to access the HashiCorp Vault UI. Enter the root token to sign in from _step 1_. ```sh eval $(terraform output --raw vault_dashboard) From 685c7b5d7b116acd0893e1736604da276cfe0b57 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:23:33 +0200 Subject: [PATCH 112/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index edaa6adb..6e0cebea 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -218,7 +218,13 @@ HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in t eval $(terraform output --raw vault_dashboard) ``` -3. Access with admin role to CloudBees CI Operation Center and complete the configuration for the CloudBees CI Vault Plugin by entering the Role ID and Secret ID for `cbci-oc` App Role from _step 1_ in _Manage Jenkins_ > _Credentials Providers_ > _HashiCorp Vault Credentials Provider_. Click on `Test Connection` to verify the inputs are right. Finally, move to `team-b` or `team-c-ha` to run the pipeline _admin_ > _validations_ > _vault-credentials_ and validate that credentials are fetched correctly from Hashicorp Vault. +3. Sign in to the CloudBees CI operations center as a user with the admin role. + +4. Navigate to **Manage Jenkins > Credentials Providers > HashiCorp Vault Credentials Provider** and complete the configuration for the CloudBees CI Vault Plugin by entering the role ID and secret ID for the `cbci-oc` application role from _step 1_. + +5. Select **Test Connection** to verify the inputs are correct. + +6. Move to `team-b` or `team-c-ha` to run the Pipeline (**admin > validations > vault-credentials**) and validate that credentials are fetched correctly from the Hashicorp Vault. > [!NOTE] > Hashicorp Vault can be also be configured to be used for [Configuration as Code - Handling Secrets - Vault](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#hashicorp-vault-secret-source). From 306839985616c7f2226f6f209003a40c85952091 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:23:46 +0200 Subject: [PATCH 113/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 6e0cebea..5f0f997a 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -255,7 +255,7 @@ HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in t eval $(terraform output --raw cbci_controller_b_s3_build) ``` - It triggers `s3-WScacheAndArtifacts` pipeline from `team-b` controller. This pipeline validates a couple of s3 integrations in parallel: one for [CloudBees Workspace Caching](https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-cache-step) (using `linux-mavenAndKaniko-L`) and another for [s3 Artifact Manager](https://plugins.jenkins.io/artifact-manager-s3/) (using `linux-mavenAndKaniko-XL`). + It triggers the `s3-WScacheAndArtifacts` Pipeline from the `team-b` controller. This pipeline validates S3 integrations in parallel for [CloudBees workspace caching](https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-cache-step) (using `linux-mavenAndKaniko-L`) and the [S3 artifact manager](https://plugins.jenkins.io/artifact-manager-s3/) (using `linux-mavenAndKaniko-XL`). Once the second build is complete, you can find the read cache operation at the beginning of the build logs and the write cache operation at the end of the build logs. From 602def3b48969989deca3ca20e8a49149123ef6b Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:23:57 +0200 Subject: [PATCH 114/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 5f0f997a..feddfaba 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -259,7 +259,7 @@ HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in t Once the second build is complete, you can find the read cache operation at the beginning of the build logs and the write cache operation at the end of the build logs. - The `linux-mavenAndKaniko-L` agent template is deployed over On-demand Linux Nodes that have smaller instance types vs the `linux-mavenAndKaniko-XL` template that is deployed over Spot Linux Nodes that have defined larger instance types. + The `linux-mavenAndKaniko-L` agent template is deployed over on-demand Linux nodes that have smaller instance types versus the `linux-mavenAndKaniko-XL` template that is deployed over Spot Linux nodes that have defined larger instance types. - For Windows node pool use: From 7c30c5ac030b6d99a0e5cf59bd4be66bb9e1cb0b Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:24:07 +0200 Subject: [PATCH 115/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index feddfaba..1461bdb5 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -267,7 +267,7 @@ HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in t eval $(terraform output --raw cbci_controller_c_windows_node_build) ``` - It triggers `windows-build-nodes` pipeline from `team-c-ha` controller. + It triggers the `windows-build-nodes` Pipeline from the `team-c-ha` controller. Note that the first build for a new Windows image container can take up to 10 minutes to run; subsequent builds should take seconds to run. This behavior can be improved as explained in the section [Architecture](#architecture). From 6301a26e261a6ba955fbe7deeb86151777af2bfd Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:24:44 +0200 Subject: [PATCH 116/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 1461bdb5..de2b8ad8 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -269,7 +269,7 @@ HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in t It triggers the `windows-build-nodes` Pipeline from the `team-c-ha` controller. - Note that the first build for a new Windows image container can take up to 10 minutes to run; subsequent builds should take seconds to run. This behavior can be improved as explained in the section [Architecture](#architecture). + Note that the first build for a new Windows image container can take up to 10 minutes to run; subsequent builds should take seconds to run. This behavior can be improved, as explained in the section [Architecture](#architecture). 3. Right after triggering the builds, issue the following to validate pod agent provisioning to build the pipeline code: From c31fe0a2778cb7fb0fd3787b09db965a902ec6a7 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:25:08 +0200 Subject: [PATCH 117/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index de2b8ad8..8f231324 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -271,7 +271,7 @@ HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in t Note that the first build for a new Windows image container can take up to 10 minutes to run; subsequent builds should take seconds to run. This behavior can be improved, as explained in the section [Architecture](#architecture). -3. Right after triggering the builds, issue the following to validate pod agent provisioning to build the pipeline code: +3. Right after triggering the builds, issue the following to validate pod agent provisioning to build the Pipeline code: ```sh eval $(terraform output --raw cbci_agents_pods) From 1d5cc7f98645af497bec0dbdd0237aab403a0887 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:25:25 +0200 Subject: [PATCH 118/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 8f231324..44ce13bc 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -277,7 +277,7 @@ HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in t eval $(terraform output --raw cbci_agents_pods) ``` -4. Check build logs by signing in to the `team-b` and `team-c-ha` controllers, respectively. Navigate to the pipeline jobs and select the first build, indicated by the `#1` build number. [CloudBees Pipeline Explorer](https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-pipeline-explorer-plugin) is enabled as a default. +4. Check build logs by signing in to the `team-b` and `team-c-ha` controllers, respectively. Navigate to the Pipeline jobs and select the first build, indicated by the `#1` build number. [CloudBees Pipeline Explorer](https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-pipeline-explorer-plugin) is enabled by default. ##### Container Registry From 593fe61c4d2d7d188227fa1d1632ecedef8421c9 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:25:45 +0200 Subject: [PATCH 119/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 44ce13bc..ab1e4c95 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -281,7 +281,7 @@ HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in t ##### Container Registry -This blueprints uses a couple of container registries for different purposes. +This blueprints use a couple of container registries for different purposes. - The Public Registry uses DockerHub. - The Private Registry uses AWS ECR. From 8b78ea0e32fff311f6d2276ac242de524f64e75d Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:26:11 +0200 Subject: [PATCH 120/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index ab1e4c95..eaa21b8b 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -283,8 +283,8 @@ HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in t This blueprints use a couple of container registries for different purposes. -- The Public Registry uses DockerHub. -- The Private Registry uses AWS ECR. +- The public registry uses DockerHub. +- The private registry uses AWS ECR. > [!NOTE] > Other Container Registry services can be used for the same purporses. From eefd9bc7cf86c37d790159fb3dde6cac8b321de5 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:26:34 +0200 Subject: [PATCH 121/180] Update variables.tf Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- variables.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/variables.tf b/variables.tf index 72ff851e..2934384f 100644 --- a/variables.tf +++ b/variables.tf @@ -58,7 +58,7 @@ variable "create_casc_secrets" { } variable "casc_secrets_file" { - description = "Secrets .yml file path containing the names:values secrets. It is required when create_casc_secrets is enabled." + description = "Secrets .yml file path containing the names: values secrets. It is required when create_casc_secrets is enabled." default = "secrets-values.yml" type = string validation { From 4f3f3c63a40920daa7c2cc99a8d7cb613664a2b4 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Mon, 5 Aug 2024 20:26:55 +0000 Subject: [PATCH 122/180] terraform-docs: automated action --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index a40ec22b..28c9e837 100644 --- a/README.md +++ b/README.md @@ -95,7 +95,7 @@ The CloudBees CI add-on uses `helms release` for its resources definition, makin | cert_arn | AWS Certificate Manager (ACM) certificate for Amazon Resource Names (ARN). | `string` | n/a | yes | | hosted_zone | Amazon Route 53 hosted zone name. | `string` | n/a | yes | | trial_license | CloudBees CI trial license details for evaluation. | `map(string)` | n/a | yes | -| casc_secrets_file | Secrets .yml file path containing the names:values secrets. It is required when create_casc_secrets is enabled. | `string` | `"secrets-values.yml"` | no | +| casc_secrets_file | Secrets .yml file path containing the names: values secrets. It is required when create_casc_secrets is enabled. | `string` | `"secrets-values.yml"` | no | | create_casc_secrets | Create a Kubernetes basic secret for CloudBees Configuration as Code (cbci-sec-casc) and mount it into the Operation Center /var/run/secrets/cbci. | `bool` | `false` | no | | create_reg_secret | Create a Kubernetes dockerconfigjson secret for container registry authentication (cbci-sec-reg) for CI builds agents. | `bool` | `false` | no | | helm_config | CloudBees CI Helm chart configuration. | `any` | 
{
  "values": [
    ""
  ]
}
| no | From 87b01f29e7a65f7fccc6c8f8d796f557dc8f6a2c Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:27:02 +0200 Subject: [PATCH 123/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index eaa21b8b..3fd53f1f 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -287,7 +287,7 @@ This blueprints use a couple of container registries for different purposes. - The private registry uses AWS ECR. > [!NOTE] -> Other Container Registry services can be used for the same purporses. +> Other Container Registry services can be used for the same purposes. Access with admin role to CloudBees CI to `team-b` or `team-c-ha` to run the pipeline _admin_ > _validations_ > _kaniko_ enter as parameters an existing DockerHub Organization and an existing AWS ECR Repository to test that Build and Push towards every repository works fine. From 4f855b89f151c50256ccbcf6f480a543626d1083 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:27:34 +0200 Subject: [PATCH 124/180] Update variables.tf Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- variables.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/variables.tf b/variables.tf index 2934384f..ec2fa0fa 100644 --- a/variables.tf +++ b/variables.tf @@ -52,7 +52,7 @@ variable "trial_license" { } variable "create_casc_secrets" { - description = "Create a Kubernetes basic secret for CloudBees Configuration as Code (cbci-sec-casc) and mount it into the Operation Center /var/run/secrets/cbci." + description = "Create a Kubernetes basic secret for CloudBees CasC (cbci-sec-casc) and mount it into the operations center (/var/run/secrets/cbci)." default = false type = bool } From c2bb59cfbdd082b1e5fccf658d139ac34d6f4d11 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:27:50 +0200 Subject: [PATCH 125/180] Update blueprints/02-at-scale/README.md Co-authored-by: Kellie Freeman <80066741+kellie-freeman@users.noreply.github.com> --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 3fd53f1f..33ce8748 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -289,7 +289,7 @@ This blueprints use a couple of container registries for different purposes. > [!NOTE] > Other Container Registry services can be used for the same purposes. -Access with admin role to CloudBees CI to `team-b` or `team-c-ha` to run the pipeline _admin_ > _validations_ > _kaniko_ enter as parameters an existing DockerHub Organization and an existing AWS ECR Repository to test that Build and Push towards every repository works fine. +Sign in to the CloudBees CI to `team-b` or `team-c-ha` controllers with admin access. Run the **admin > validations > kaniko** Pipeline and enter (using parameters) an existing DockerHub organization and an existing AWS ECR Repository to test that building and pushing to all repositories works as expected. > [!NOTE] > Besides Kaniko, there are [other alternitives tools](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/using-kaniko#_alternatives). From a8ba851881cd0830dcadb06dc73c32f05d658b21 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Mon, 5 Aug 2024 20:28:06 +0000 Subject: [PATCH 126/180] terraform-docs: automated action --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 28c9e837..1359fb05 100644 --- a/README.md +++ b/README.md @@ -96,7 +96,7 @@ The CloudBees CI add-on uses `helms release` for its resources definition, makin | hosted_zone | Amazon Route 53 hosted zone name. | `string` | n/a | yes | | trial_license | CloudBees CI trial license details for evaluation. | `map(string)` | n/a | yes | | casc_secrets_file | Secrets .yml file path containing the names: values secrets. It is required when create_casc_secrets is enabled. | `string` | `"secrets-values.yml"` | no | -| create_casc_secrets | Create a Kubernetes basic secret for CloudBees Configuration as Code (cbci-sec-casc) and mount it into the Operation Center /var/run/secrets/cbci. | `bool` | `false` | no | +| create_casc_secrets | Create a Kubernetes basic secret for CloudBees CasC (cbci-sec-casc) and mount it into the operations center (/var/run/secrets/cbci). | `bool` | `false` | no | | create_reg_secret | Create a Kubernetes dockerconfigjson secret for container registry authentication (cbci-sec-reg) for CI builds agents. | `bool` | `false` | no | | helm_config | CloudBees CI Helm chart configuration. | `any` | 
{
  "values": [
    ""
  ]
}
| no | | prometheus_target | Creates a service monitor to discover the CloudBees CI Prometheus target dynamically. It is designed to be enabled with the AWS EKS Terraform Addon Kube Prometheus Stack. | `bool` | `false` | no | From fe446cb5d2c43b21f751a57c55688633ae6536a4 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:30:36 +0200 Subject: [PATCH 127/180] adding local test --- blueprints/01-getting-started/main.tf | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/blueprints/01-getting-started/main.tf b/blueprints/01-getting-started/main.tf index 0c02bef7..5fc4a90b 100644 --- a/blueprints/01-getting-started/main.tf +++ b/blueprints/01-getting-started/main.tf @@ -31,8 +31,9 @@ locals { # CloudBees CI Add-on module "eks_blueprints_addon_cbci" { - source = "cloudbees/cloudbees-ci-eks-addon/aws" - version = ">= 3.18072.0" + #source = "cloudbees/cloudbees-ci-eks-addon/aws" + #version = ">= 3.18072.0" + source = "../../" depends_on = [module.eks_blueprints_addons] From ff88f8ac1dc9898c9125f7dd99101ad2ea4cd4bf Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 22:59:52 +0200 Subject: [PATCH 128/180] renamig to CD and deploy --- .../{bp-tf-ci.yaml => bp-tf-cd.yaml} | 4 +- .cloudbees/workflows/bp-tf-ci-old.yaml | 174 ------------------ 2 files changed, 2 insertions(+), 176 deletions(-) rename .cloudbees/workflows/{bp-tf-ci.yaml => bp-tf-cd.yaml} (99%) delete mode 100644 .cloudbees/workflows/bp-tf-ci-old.yaml diff --git a/.cloudbees/workflows/bp-tf-ci.yaml b/.cloudbees/workflows/bp-tf-cd.yaml similarity index 99% rename from .cloudbees/workflows/bp-tf-ci.yaml rename to .cloudbees/workflows/bp-tf-cd.yaml index 51bb68c0..06978a91 100644 --- a/.cloudbees/workflows/bp-tf-ci.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -58,7 +58,7 @@ jobs: ROOT: 01-getting-started TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com # Add the stages to execute in the pipeline: deploy,validate,destroy,wipeout - STAGES: "wipeout" + STAGES: "deploy" needs: - init steps: @@ -131,7 +131,7 @@ jobs: ROOT: 02-at-scale TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com # Add the stages to execute in the pipeline: deploy,validate,destroy,wipeout - STAGES: "wipeout" + STAGES: "deploy" needs: - init steps: diff --git a/.cloudbees/workflows/bp-tf-ci-old.yaml b/.cloudbees/workflows/bp-tf-ci-old.yaml deleted file mode 100644 index 9e95fa3f..00000000 --- a/.cloudbees/workflows/bp-tf-ci-old.yaml +++ /dev/null @@ -1,174 +0,0 @@ -# Copyright (c) CloudBees, Inc. - -apiVersion: automation.cloudbees.io/v1alpha1 -kind: workflow -name: ci - -on: - # Enable once Issue #83 is solved - # pull_request: - # branches: - # - 'main' - workflow_dispatch: - -env: - AWS_REGION: "us-east-1" - BUCKET_NAME_TF_STATE: "cbci-eks-addon-tf-state-v2" - AWS_ROLE_TO_ASSUME: "infra-admin-ci" - TF_AUTO_VARS_FILE: | - tags = { - "cb-owner" : "professional-services" - "cb-user" : "cb-platform" - "cb-purpose" : "ci" - } - trial_license = { - first_name = "CloudBees.io" - last_name = "Platform" - email = "ci.user@cloudbees.io" - company = "CloudBees Inc." - } - suffix = "ci-v11" - ci = true - -jobs: - init: - steps: - - - name: Configure AWS Credentials - uses: cloudbees-io/configure-aws-credentials@v1 - with: - aws-region: ${{ env.AWS_REGION }} - aws-access-key-id: ${{ secrets.AWS_TF_CBCI_EKS_AccessKeyID }} - aws-secret-access-key: ${{ secrets.AWS_TF_CBCI_EKS_SecretAccessKey }} - role-to-assume: ${{ env.AWS_ROLE_TO_ASSUME }} - role-external-id: cloudbees - role-duration-seconds: "3600" - - #TODO: Add tags for the bucket - - name: Create Terraform Backend Bucket if not exists - uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest - shell: bash - run: | - aws s3api create-bucket \ - --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ - --region ${{ env.AWS_REGION }} || echo "Bucket ${{ env.BUCKET_NAME_TF_STATE }} already exists" - - bp01: - env: - CLEAN_UP: "false" - needs: - - init - steps: - - - name: Configure AWS Credentials - uses: cloudbees-io/configure-aws-credentials@v1 - with: - aws-region: ${{ env.AWS_REGION }} - aws-access-key-id: ${{ secrets.AWS_TF_CBCI_EKS_AccessKeyID }} - aws-secret-access-key: ${{ secrets.AWS_TF_CBCI_EKS_SecretAccessKey }} - role-to-assume: ${{ env.AWS_ROLE_TO_ASSUME }} - role-external-id: cloudbees - role-duration-seconds: "3600" - - - name: Checkout code - uses: cloudbees-io/checkout@v1 - - - name: 01-getting-started - Deploy - uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest - env: - ROOT: 01-getting-started - TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com - shell: bash - run : | - cat <> blueprints/${{ env.ROOT }}/.auto.tfvars - ${{ env.TF_AUTO_VARS_FILE }} - EOT - cat <> blueprints/${{ env.ROOT }}/backend.tf - terraform { - backend "s3" { - bucket = "${{ env.BUCKET_NAME_TF_STATE }}" - key = "${{ env.ROOT }}/ci.terraform.tfstate" - region = "${{ env.AWS_REGION }}" - } - } - EOT - [ "${{ env.CLEAN_UP }}" = "true" ] && echo "Skipping... Clean up mode." || CI=true make deploy - - - name: 01-getting-started - Validate - uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest - env: - ROOT: 01-getting-started - shell: bash - run : | - [ "${{ env.CLEAN_UP }}" = "true" ] && echo "Skipping... Clean up mode." || CI=true make validate - - - name: 01-getting-started - Destroy - uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest - env: - ROOT: 01-getting-started - TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com - shell: bash - run : | - [ "${{ env.CLEAN_UP }}" = "true" ] && terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy \ - || CI=true make destroy - - bp02: - env: - CLEAN_UP: "false" - needs: - - init - steps: - - - name: Configure AWS Credentials - uses: cloudbees-io/configure-aws-credentials@v1 - with: - aws-region: ${{ env.AWS_REGION }} - aws-access-key-id: ${{ secrets.AWS_TF_CBCI_EKS_AccessKeyID }} - aws-secret-access-key: ${{ secrets.AWS_TF_CBCI_EKS_SecretAccessKey }} - role-to-assume: ${{ env.AWS_ROLE_TO_ASSUME }} - role-external-id: cloudbees - role-duration-seconds: "3600" - - - name: Checkout code - uses: cloudbees-io/checkout@v1 - - - name: 02-at-scale - Deploy - uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest - env: - ROOT: 02-at-scale - TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com - shell: bash - run : | - cat <> blueprints/${{ env.ROOT }}/.auto.tfvars - ${{ env.TF_AUTO_VARS_FILE }} - gh_user = "exampleUser" - gh_token = "ExampleToken1234" - EOT - cat <> blueprints/${{ env.ROOT }}/backend.tf - terraform { - backend "s3" { - bucket = "${{ env.BUCKET_NAME_TF_STATE }}" - key = "${{ env.ROOT }}/ci.terraform.tfstate" - region = "${{ env.AWS_REGION }}" - } - } - EOT - [ "${{ env.CLEAN_UP }}" = "true" ] && echo "Skipping... Clean up mode." || CI=true make deploy - - - name: 02-at-scale - Validate - uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest - env: - ROOT: 02-at-scale - shell: bash - run : | - [ "${{ env.CLEAN_UP }}" = "true" ] && echo "Skipping... Clean up mode." || CI=true make validate - - - name: 02-at-scale - Destroy - uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest - env: - ROOT: 02-at-scale - TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com - shell: bash - run : | - [ "${{ env.CLEAN_UP }}" = "true" ] && terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy \ - || CI=true make destroy From 91d2244d7cf452eb5fd5014d3c167db0a49323e5 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 5 Aug 2024 23:57:31 +0200 Subject: [PATCH 129/180] Adding set -x --- .cloudbees/workflows/bp-tf-cd.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index 06978a91..51c98d67 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -49,6 +49,7 @@ jobs: uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest shell: bash run: | + set -x aws s3api create-bucket \ --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ --region ${{ env.AWS_REGION }} || echo "Bucket ${{ env.BUCKET_NAME_TF_STATE }} already exists" @@ -58,7 +59,7 @@ jobs: ROOT: 01-getting-started TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com # Add the stages to execute in the pipeline: deploy,validate,destroy,wipeout - STAGES: "deploy" + STAGES: "" needs: - init steps: @@ -177,6 +178,7 @@ jobs: shell: bash run : | CI=true make deploy + set -x aws s3api put-object \ --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ --region ${{ env.AWS_REGION }} \ From 6cea546b032997450e7ee0141458cdf2f3d12f42 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 00:06:59 +0200 Subject: [PATCH 130/180] Update bp-tf-cd.yaml --- .cloudbees/workflows/bp-tf-cd.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index 51c98d67..1c1bcefb 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -53,6 +53,7 @@ jobs: aws s3api create-bucket \ --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ --region ${{ env.AWS_REGION }} || echo "Bucket ${{ env.BUCKET_NAME_TF_STATE }} already exists" + aws kms delete-alias --alias-name alias/eks/cbci-bp01-ci-v11-eks --region us-west-2 bp01: env: @@ -132,7 +133,7 @@ jobs: ROOT: 02-at-scale TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com # Add the stages to execute in the pipeline: deploy,validate,destroy,wipeout - STAGES: "deploy" + STAGES: "" needs: - init steps: From 85b5b3aa5f3721caafe452e1f62ba0e9bbf0571c Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 00:27:33 +0200 Subject: [PATCH 131/180] Adding diffrent regions per BP vs Bucket, adding check to delete KMS alias --- .cloudbees/workflows/bp-tf-cd.yaml | 30 +++++++++++++++++------------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index 1c1bcefb..28eaa6f0 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -12,9 +12,11 @@ on: workflow_dispatch: env: - AWS_REGION: "us-east-1" + AWS_REGION_TF_BUCKET: "us-east-1" + AWS_REGION_BP: "us-west-2" BUCKET_NAME_TF_STATE: "cbci-eks-addon-tf-state-v2" AWS_ROLE_TO_ASSUME: "infra-admin-ci" + SUFFIX: "ci-v11" TF_AUTO_VARS_FILE: | tags = { "cb-owner" : "professional-services" @@ -27,7 +29,7 @@ env: email = "ci.user@cloudbees.io" company = "CloudBees Inc." } - suffix = "ci-v11" + suffix = "${{ env.SUFFIX }}" ci = true jobs: @@ -37,7 +39,7 @@ jobs: - name: Configure AWS Credentials uses: cloudbees-io/configure-aws-credentials@v1 with: - aws-region: ${{ env.AWS_REGION }} + aws-region: ${{ env.AWS_REGION_TF_BUCKET }} aws-access-key-id: ${{ secrets.AWS_TF_CBCI_EKS_AccessKeyID }} aws-secret-access-key: ${{ secrets.AWS_TF_CBCI_EKS_SecretAccessKey }} role-to-assume: ${{ env.AWS_ROLE_TO_ASSUME }} @@ -52,15 +54,14 @@ jobs: set -x aws s3api create-bucket \ --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ - --region ${{ env.AWS_REGION }} || echo "Bucket ${{ env.BUCKET_NAME_TF_STATE }} already exists" - aws kms delete-alias --alias-name alias/eks/cbci-bp01-ci-v11-eks --region us-west-2 + --region ${{ env.AWS_REGION_TF_BUCKET }} || echo "Bucket ${{ env.BUCKET_NAME_TF_STATE }} already exists" bp01: env: ROOT: 01-getting-started TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com # Add the stages to execute in the pipeline: deploy,validate,destroy,wipeout - STAGES: "" + STAGES: "deploy" needs: - init steps: @@ -68,7 +69,7 @@ jobs: - name: Configure AWS Credentials uses: cloudbees-io/configure-aws-credentials@v1 with: - aws-region: ${{ env.AWS_REGION }} + aws-region: ${{ env.AWS_REGION_BP }} aws-access-key-id: ${{ secrets.AWS_TF_CBCI_EKS_AccessKeyID }} aws-secret-access-key: ${{ secrets.AWS_TF_CBCI_EKS_SecretAccessKey }} role-to-assume: ${{ env.AWS_ROLE_TO_ASSUME }} @@ -90,7 +91,7 @@ jobs: backend "s3" { bucket = "${{ env.BUCKET_NAME_TF_STATE }}" key = "${{ env.ROOT }}/ci.terraform.tfstate" - region = "${{ env.AWS_REGION }}" + region = "${{ env.AWS_REGION_TF_BUCKET }}" } } EOT @@ -100,10 +101,12 @@ jobs: if: contains(env.STAGES, 'deploy') shell: bash run : | + set -x + aws kms delete-alias --alias-name alias/eks/cbci-bp01-${{ env.SUFFIX }}-eks --region ${{ env.AWS_REGION_BP }} || echo "Alias alias/eks/cbci-bp01-${{ env.SUFFIX }}-eks does not exist" CI=true make deploy aws s3api put-object \ --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ - --region ${{ env.AWS_REGION }} \ + --region ${{ env.AWS_REGION_TF_BUCKET }} \ --key ${{ env.ROOT }}/${{ env.ROOT }}.kubeconfig.yaml \ --body $(cd blueprints/${{ env.ROOT }} && terraform output --raw kubeconfig_file) @@ -141,7 +144,7 @@ jobs: - name: Configure AWS Credentials uses: cloudbees-io/configure-aws-credentials@v1 with: - aws-region: ${{ env.AWS_REGION }} + aws-region: ${{ env.AWS_REGION_BP }} aws-access-key-id: ${{ secrets.AWS_TF_CBCI_EKS_AccessKeyID }} aws-secret-access-key: ${{ secrets.AWS_TF_CBCI_EKS_SecretAccessKey }} role-to-assume: ${{ env.AWS_ROLE_TO_ASSUME }} @@ -168,7 +171,7 @@ jobs: backend "s3" { bucket = "${{ env.BUCKET_NAME_TF_STATE }}" key = "${{ env.ROOT }}/ci.terraform.tfstate" - region = "${{ env.AWS_REGION }}" + region = "${{ env.AWS_REGION_TF_BUCKET }}" } } EOT @@ -178,11 +181,12 @@ jobs: if: contains(env.STAGES, 'deploy') shell: bash run : | - CI=true make deploy set -x + aws kms delete-alias --alias-name alias/eks/cbci-bp02-${{ env.SUFFIX }}-eks --region ${{ env.AWS_REGION_BP }} || echo "Alias alias/eks/cbci-bp02-${{ env.SUFFIX }}-eks does not exist" + CI=true make deploy aws s3api put-object \ --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ - --region ${{ env.AWS_REGION }} \ + --region ${{ env.AWS_REGION_TF_BUCKET }} \ --key ${{ env.ROOT }}/${{ env.ROOT }}.kubeconfig.yaml \ --body $(cd blueprints/${{ env.ROOT }} && terraform output --raw kubeconfig_file) From c773e87e89e95c97018e897126c718cb72a6d5a1 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 00:31:05 +0200 Subject: [PATCH 132/180] adding TF suffix separated --- .cloudbees/workflows/bp-tf-cd.yaml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index 28eaa6f0..6daee48f 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -16,7 +16,7 @@ env: AWS_REGION_BP: "us-west-2" BUCKET_NAME_TF_STATE: "cbci-eks-addon-tf-state-v2" AWS_ROLE_TO_ASSUME: "infra-admin-ci" - SUFFIX: "ci-v11" + TF_VAR_suffix: "ci-v11" TF_AUTO_VARS_FILE: | tags = { "cb-owner" : "professional-services" @@ -29,7 +29,6 @@ env: email = "ci.user@cloudbees.io" company = "CloudBees Inc." } - suffix = "${{ env.SUFFIX }}" ci = true jobs: @@ -102,7 +101,7 @@ jobs: shell: bash run : | set -x - aws kms delete-alias --alias-name alias/eks/cbci-bp01-${{ env.SUFFIX }}-eks --region ${{ env.AWS_REGION_BP }} || echo "Alias alias/eks/cbci-bp01-${{ env.SUFFIX }}-eks does not exist" + aws kms delete-alias --alias-name alias/eks/cbci-bp01-${{ env.TF_VAR_suffix }}-eks --region ${{ env.AWS_REGION_BP }} || echo "Alias alias/eks/cbci-bp01-${{ env.TF_VAR_suffix }}-eks does not exist" CI=true make deploy aws s3api put-object \ --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ @@ -182,7 +181,7 @@ jobs: shell: bash run : | set -x - aws kms delete-alias --alias-name alias/eks/cbci-bp02-${{ env.SUFFIX }}-eks --region ${{ env.AWS_REGION_BP }} || echo "Alias alias/eks/cbci-bp02-${{ env.SUFFIX }}-eks does not exist" + aws kms delete-alias --alias-name alias/eks/cbci-bp02-${{ env.TF_VAR_suffix }}-eks --region ${{ env.TF_VAR_suffix }} || echo "Alias alias/eks/cbci-bp02-${{ env.SUFFIX }}-eks does not exist" CI=true make deploy aws s3api put-object \ --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ From 5e130b12b059bcb22a897a08bfd94d0ec2428d48 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 00:32:18 +0200 Subject: [PATCH 133/180] Adding set -x for files generation --- .cloudbees/workflows/bp-tf-cd.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index 6daee48f..7c6c541e 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -82,6 +82,7 @@ jobs: uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest shell: bash run : | + set -x cat <> blueprints/${{ env.ROOT }}/.auto.tfvars ${{ env.TF_AUTO_VARS_FILE }} EOT @@ -157,6 +158,7 @@ jobs: uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest shell: bash run : | + set -x cat <> blueprints/${{ env.ROOT }}/.auto.tfvars ${{ env.TF_AUTO_VARS_FILE }} dh_reg_secret_auth = { From 111b1c3537863aa2b7aae4bfee8de83cc6743f63 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 00:34:21 +0200 Subject: [PATCH 134/180] fixing variables --- .cloudbees/workflows/bp-tf-cd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index 7c6c541e..e2a8c83e 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -183,7 +183,7 @@ jobs: shell: bash run : | set -x - aws kms delete-alias --alias-name alias/eks/cbci-bp02-${{ env.TF_VAR_suffix }}-eks --region ${{ env.TF_VAR_suffix }} || echo "Alias alias/eks/cbci-bp02-${{ env.SUFFIX }}-eks does not exist" + aws kms delete-alias --alias-name alias/eks/cbci-bp02-${{ env.TF_VAR_suffix }}-eks --region ${{ env.AWS_REGION_BP }} || echo "Alias alias/eks/cbci-bp02-${{ env.TF_VAR_suffix }}-eks does not exist" CI=true make deploy aws s3api put-object \ --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ From 692a454a4fa692896ffcb0055dd80606e5215121 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 00:38:41 +0200 Subject: [PATCH 135/180] Fixing BP aws region --- .cloudbees/workflows/bp-tf-cd.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index e2a8c83e..22a2220c 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -13,10 +13,10 @@ on: env: AWS_REGION_TF_BUCKET: "us-east-1" - AWS_REGION_BP: "us-west-2" BUCKET_NAME_TF_STATE: "cbci-eks-addon-tf-state-v2" AWS_ROLE_TO_ASSUME: "infra-admin-ci" TF_VAR_suffix: "ci-v11" + TF_VAR_aws_region: "us-west-2" TF_AUTO_VARS_FILE: | tags = { "cb-owner" : "professional-services" @@ -68,7 +68,7 @@ jobs: - name: Configure AWS Credentials uses: cloudbees-io/configure-aws-credentials@v1 with: - aws-region: ${{ env.AWS_REGION_BP }} + aws-region: ${{ env.TF_VAR_aws_region }} aws-access-key-id: ${{ secrets.AWS_TF_CBCI_EKS_AccessKeyID }} aws-secret-access-key: ${{ secrets.AWS_TF_CBCI_EKS_SecretAccessKey }} role-to-assume: ${{ env.AWS_ROLE_TO_ASSUME }} @@ -102,7 +102,7 @@ jobs: shell: bash run : | set -x - aws kms delete-alias --alias-name alias/eks/cbci-bp01-${{ env.TF_VAR_suffix }}-eks --region ${{ env.AWS_REGION_BP }} || echo "Alias alias/eks/cbci-bp01-${{ env.TF_VAR_suffix }}-eks does not exist" + aws kms delete-alias --alias-name alias/eks/cbci-bp01-${{ env.TF_VAR_suffix }}-eks --region ${{ env.TF_VAR_aws_region }} || echo "Alias alias/eks/cbci-bp01-${{ env.TF_VAR_suffix }}-eks does not exist" CI=true make deploy aws s3api put-object \ --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ @@ -144,7 +144,7 @@ jobs: - name: Configure AWS Credentials uses: cloudbees-io/configure-aws-credentials@v1 with: - aws-region: ${{ env.AWS_REGION_BP }} + aws-region: ${{ env.TF_VAR_aws_region }} aws-access-key-id: ${{ secrets.AWS_TF_CBCI_EKS_AccessKeyID }} aws-secret-access-key: ${{ secrets.AWS_TF_CBCI_EKS_SecretAccessKey }} role-to-assume: ${{ env.AWS_ROLE_TO_ASSUME }} @@ -183,7 +183,7 @@ jobs: shell: bash run : | set -x - aws kms delete-alias --alias-name alias/eks/cbci-bp02-${{ env.TF_VAR_suffix }}-eks --region ${{ env.AWS_REGION_BP }} || echo "Alias alias/eks/cbci-bp02-${{ env.TF_VAR_suffix }}-eks does not exist" + aws kms delete-alias --alias-name alias/eks/cbci-bp02-${{ env.TF_VAR_suffix }}-eks --region ${{ env.TF_VAR_aws_region }} || echo "Alias alias/eks/cbci-bp02-${{ env.TF_VAR_suffix }}-eks does not exist" CI=true make deploy aws s3api put-object \ --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ From 6e6b9cfa43b226dc5242a825fd7f58de6173751c Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 00:46:05 +0200 Subject: [PATCH 136/180] adding other delete kms --- .cloudbees/workflows/bp-tf-cd.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index 22a2220c..39474919 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -103,6 +103,7 @@ jobs: run : | set -x aws kms delete-alias --alias-name alias/eks/cbci-bp01-${{ env.TF_VAR_suffix }}-eks --region ${{ env.TF_VAR_aws_region }} || echo "Alias alias/eks/cbci-bp01-${{ env.TF_VAR_suffix }}-eks does not exist" + aws kms delete-alias --alias-name alias/eks/cbci-bp01-${{ env.TF_VAR_suffix }} --region ${{ env.TF_VAR_aws_region }} || echo "Alias alias/eks/cbci-bp01-${{ env.TF_VAR_suffix }} does not exist" CI=true make deploy aws s3api put-object \ --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ @@ -184,6 +185,7 @@ jobs: run : | set -x aws kms delete-alias --alias-name alias/eks/cbci-bp02-${{ env.TF_VAR_suffix }}-eks --region ${{ env.TF_VAR_aws_region }} || echo "Alias alias/eks/cbci-bp02-${{ env.TF_VAR_suffix }}-eks does not exist" + aws kms delete-alias --alias-name alias/eks/cbci-bp02-${{ env.TF_VAR_suffix }} --region ${{ env.TF_VAR_aws_region }} || echo "Alias alias/eks/cbci-bp02-${{ env.TF_VAR_suffix }} does not exist" CI=true make deploy aws s3api put-object \ --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ From 43cb7b6fc86c9e618bee7c02e02126cf245f3380 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 00:56:53 +0200 Subject: [PATCH 137/180] setting STAGES: "deploy,validate,destroy" --- .cloudbees/workflows/bp-tf-cd.yaml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index 39474919..f022f76f 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -60,7 +60,7 @@ jobs: ROOT: 01-getting-started TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com # Add the stages to execute in the pipeline: deploy,validate,destroy,wipeout - STAGES: "deploy" + STAGES: "deploy,validate,destroy" needs: - init steps: @@ -82,10 +82,10 @@ jobs: uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest shell: bash run : | - set -x cat <> blueprints/${{ env.ROOT }}/.auto.tfvars ${{ env.TF_AUTO_VARS_FILE }} EOT + cat blueprints/${{ env.ROOT }}/.auto.tfvars cat <> blueprints/${{ env.ROOT }}/backend.tf terraform { backend "s3" { @@ -95,6 +95,7 @@ jobs: } } EOT + cat blueprints/${{ env.ROOT }}/backend.tf - name: 01-getting-started - Deploy uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest @@ -137,7 +138,7 @@ jobs: ROOT: 02-at-scale TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com # Add the stages to execute in the pipeline: deploy,validate,destroy,wipeout - STAGES: "" + STAGES: "deploy,validate,destroy" needs: - init steps: @@ -159,7 +160,6 @@ jobs: uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest shell: bash run : | - set -x cat <> blueprints/${{ env.ROOT }}/.auto.tfvars ${{ env.TF_AUTO_VARS_FILE }} dh_reg_secret_auth = { @@ -168,6 +168,7 @@ jobs: email = "example@gmail.com" } EOT + cat blueprints/${{ env.ROOT }}/.auto.tfvars cat <> blueprints/${{ env.ROOT }}/backend.tf terraform { backend "s3" { @@ -177,6 +178,7 @@ jobs: } } EOT + blueprints/${{ env.ROOT }}/backend.tf - name: 02-at-scale - Deploy uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest From a045e7bd2c0ef9032b1b233a23b685f49e30a6b6 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 01:32:53 +0200 Subject: [PATCH 138/180] Update bp-tf-cd.yaml --- .cloudbees/workflows/bp-tf-cd.yaml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index f022f76f..d7e76fc0 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -60,7 +60,7 @@ jobs: ROOT: 01-getting-started TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com # Add the stages to execute in the pipeline: deploy,validate,destroy,wipeout - STAGES: "deploy,validate,destroy" + STAGES: "deploy,users" needs: - init steps: @@ -132,13 +132,21 @@ jobs: shell: bash run : | terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy + + - name: 01-getting-started - Add users + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'users') + shell: bash + run : | + cd blueprints/${{ env.ROOT }} && eval $(terraform output --raw kubeconfig_export) + kubectl edit configmap aws-auth -n kube-system bp02: env: ROOT: 02-at-scale TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com # Add the stages to execute in the pipeline: deploy,validate,destroy,wipeout - STAGES: "deploy,validate,destroy" + STAGES: "" needs: - init steps: From 5b114e5955ee9991e52bbf4cd9cef01512cccf27 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 01:43:53 +0200 Subject: [PATCH 139/180] check config auth file --- .cloudbees/workflows/bp-tf-cd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index d7e76fc0..53685560 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -139,7 +139,7 @@ jobs: shell: bash run : | cd blueprints/${{ env.ROOT }} && eval $(terraform output --raw kubeconfig_export) - kubectl edit configmap aws-auth -n kube-system + kubectl get configmap aws-auth -n kube-system bp02: env: From 9601895390ae35443cdcf5ceb0bf76434507df5e Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 01:51:09 +0200 Subject: [PATCH 140/180] adding eksctl --- .docker/agent/agent.root.Dockerfile | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.docker/agent/agent.root.Dockerfile b/.docker/agent/agent.root.Dockerfile index 3cf92e30..d76fe578 100644 --- a/.docker/agent/agent.root.Dockerfile +++ b/.docker/agent/agent.root.Dockerfile @@ -7,6 +7,7 @@ FROM alpine:3.19.0 ENV TF_VERSION=1.6.6 \ KUBECTL_VERSION=1.29.0 \ VELERO_VERSION=1.13.0 \ + EKSCTL_VERSION=0.188.0 \ ARCH=amd64 RUN apk add --update --no-cache \ @@ -33,3 +34,8 @@ RUN curl -sLO https://github.com/vmware-tanzu/velero/releases/download/v${VELERO mv velero-v${VELERO_VERSION}-linux-${ARCH}/velero /usr/bin/velero && \ chmod +x /usr/bin/velero && \ rm velero-v${VELERO_VERSION}-linux-${ARCH}.tar.gz + +RUN curl -sLO "https://github.com/weaveworks/eksctl/releases/download/v${EKSCTL_VERSION}/eksctl_Linux_${ARCH}.tar.gz" && \ + tar -xzf eksctl_Linux_${ARCH}.tar.gz -C /usr/bin && \ + chmod +x /usr/bin/eksctl && \ + rm eksctl_Linux_${ARCH}.tar.gz \ No newline at end of file From c3fe3cb8519e9fbb9cbc922137d59319e609cf21 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 02:04:24 +0200 Subject: [PATCH 141/180] testing iamidentitymapping --- .cloudbees/workflows/bp-tf-cd.yaml | 11 ++++++++--- blueprints/01-getting-started/outputs.tf | 5 +++++ 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index 53685560..334445cd 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -95,7 +95,6 @@ jobs: } } EOT - cat blueprints/${{ env.ROOT }}/backend.tf - name: 01-getting-started - Deploy uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest @@ -138,9 +137,16 @@ jobs: if: contains(env.STAGES, 'users') shell: bash run : | + set -x cd blueprints/${{ env.ROOT }} && eval $(terraform output --raw kubeconfig_export) kubectl get configmap aws-auth -n kube-system - + eksctl create iamidentitymapping \ + --cluster $(terraform output --raw eks_cluster_name) \ + --arn arn:aws:iam::324005994172:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_infra-admin_256addbf79cfacd1 \ + --username k8s-admin \ + --group system:masters \ + kubectl get configmap aws-auth -n kube-system + bp02: env: ROOT: 02-at-scale @@ -186,7 +192,6 @@ jobs: } } EOT - blueprints/${{ env.ROOT }}/backend.tf - name: 02-at-scale - Deploy uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest diff --git a/blueprints/01-getting-started/outputs.tf b/blueprints/01-getting-started/outputs.tf index 23d3cfa8..f3cbd698 100644 --- a/blueprints/01-getting-started/outputs.tf +++ b/blueprints/01-getting-started/outputs.tf @@ -68,3 +68,8 @@ output "eks_cluster_arn" { description = "Amazon EKS cluster ARN." value = module.eks.cluster_arn } + +output "eks_cluster_name" { + description = "Amazon EKS cluster Name." + value = module.eks.cluster_name +} \ No newline at end of file From 3dfb69a8f50c21dcec7c29be940211828f2c66c5 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 02:09:19 +0200 Subject: [PATCH 142/180] fix --- .cloudbees/workflows/bp-tf-cd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index 334445cd..efbbbd86 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -144,7 +144,7 @@ jobs: --cluster $(terraform output --raw eks_cluster_name) \ --arn arn:aws:iam::324005994172:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_infra-admin_256addbf79cfacd1 \ --username k8s-admin \ - --group system:masters \ + --group system:masters kubectl get configmap aws-auth -n kube-system bp02: From 1a347fd152b4c62b2e4a5b120819f017bd0de0e6 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 02:15:11 +0200 Subject: [PATCH 143/180] Update bp-tf-cd.yaml --- .cloudbees/workflows/bp-tf-cd.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index efbbbd86..24b91353 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -140,13 +140,13 @@ jobs: set -x cd blueprints/${{ env.ROOT }} && eval $(terraform output --raw kubeconfig_export) kubectl get configmap aws-auth -n kube-system - eksctl create iamidentitymapping \ + #eksctl create iamidentitymapping \ --cluster $(terraform output --raw eks_cluster_name) \ --arn arn:aws:iam::324005994172:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_infra-admin_256addbf79cfacd1 \ --username k8s-admin \ --group system:masters - kubectl get configmap aws-auth -n kube-system - + #kubectl get configmap aws-auth -n kube-system + bp02: env: ROOT: 02-at-scale From e9581af3c88f2604997ea16a9aa3915812b8f73b Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 02:18:37 +0200 Subject: [PATCH 144/180] Update bp-tf-cd.yaml --- .cloudbees/workflows/bp-tf-cd.yaml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index 24b91353..9ee5672e 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -139,13 +139,13 @@ jobs: run : | set -x cd blueprints/${{ env.ROOT }} && eval $(terraform output --raw kubeconfig_export) - kubectl get configmap aws-auth -n kube-system - #eksctl create iamidentitymapping \ - --cluster $(terraform output --raw eks_cluster_name) \ - --arn arn:aws:iam::324005994172:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_infra-admin_256addbf79cfacd1 \ - --username k8s-admin \ - --group system:masters - #kubectl get configmap aws-auth -n kube-system + kubectl get configmap aws-auth -n kube-system -o yaml + # eksctl create iamidentitymapping \ + # --cluster $(terraform output --raw eks_cluster_name) \ + # --arn arn:aws:iam::324005994172:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_infra-admin_256addbf79cfacd1 \ + # --username k8s-admin \ + # --group system:masters + #kubectl get configmap aws-auth -n kube-system -o yaml bp02: env: From be254e63636260ed9300ea9b36a9bfa90ff42668 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 02:19:16 +0200 Subject: [PATCH 145/180] Update bp-tf-cd.yaml --- .cloudbees/workflows/bp-tf-cd.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index 9ee5672e..75dc7b42 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -140,12 +140,12 @@ jobs: set -x cd blueprints/${{ env.ROOT }} && eval $(terraform output --raw kubeconfig_export) kubectl get configmap aws-auth -n kube-system -o yaml - # eksctl create iamidentitymapping \ - # --cluster $(terraform output --raw eks_cluster_name) \ - # --arn arn:aws:iam::324005994172:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_infra-admin_256addbf79cfacd1 \ - # --username k8s-admin \ - # --group system:masters - #kubectl get configmap aws-auth -n kube-system -o yaml + eksctl create iamidentitymapping \ + --cluster $(terraform output --raw eks_cluster_name) \ + --arn arn:aws:iam::324005994172:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_infra-admin_256addbf79cfacd1 \ + --username k8s-admin \ + --group system:masters + kubectl get configmap aws-auth -n kube-system -o yaml bp02: env: From 161b05aaa8214c81ca8117189755a5322c09c1f4 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 02:38:48 +0200 Subject: [PATCH 146/180] testing --- .cloudbees/workflows/bp-tf-cd.yaml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index 75dc7b42..c2aaf715 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -132,6 +132,7 @@ jobs: run : | terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy + #https://repost.aws/knowledge-center/eks-api-server-unauthorized-error - name: 01-getting-started - Add users uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest if: contains(env.STAGES, 'users') @@ -142,9 +143,17 @@ jobs: kubectl get configmap aws-auth -n kube-system -o yaml eksctl create iamidentitymapping \ --cluster $(terraform output --raw eks_cluster_name) \ + --region ${{ env.TF_VAR_aws_region }} \ --arn arn:aws:iam::324005994172:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_infra-admin_256addbf79cfacd1 \ - --username k8s-admin \ + --username k8s-admin-rol \ --group system:masters + eksctl create iamidentitymapping \ + --cluster $(terraform output --raw eks_cluster_name) \ + --region ${{ env.TF_VAR_aws_region }} \ + --arn arn:aws:sts::324005994172:assumed-role/AWSReservedSSO_infra-admin_256addbf79cfacd1/crodriguezlopez@cloudbees.com \ + --username k8s-admin-user \ + --group system:masters \ + --no-duplicate-arns kubectl get configmap aws-auth -n kube-system -o yaml bp02: From 2cf3559281cd6f8eaee9363e6162337890960728 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 02:47:30 +0200 Subject: [PATCH 147/180] Update bp-tf-cd.yaml --- .cloudbees/workflows/bp-tf-cd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index c2aaf715..a38f007c 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -144,7 +144,7 @@ jobs: eksctl create iamidentitymapping \ --cluster $(terraform output --raw eks_cluster_name) \ --region ${{ env.TF_VAR_aws_region }} \ - --arn arn:aws:iam::324005994172:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_infra-admin_256addbf79cfacd1 \ + --arn arn:aws:iam::324005994172:role/AWSReservedSSO_infra-admin_256addbf79cfacd1 \ --username k8s-admin-rol \ --group system:masters eksctl create iamidentitymapping \ From 5621c529b6ee8ceb362e2e6b170c704fb365ac1d Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 03:01:30 +0200 Subject: [PATCH 148/180] Update bp-tf-cd.yaml --- .cloudbees/workflows/bp-tf-cd.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index a38f007c..e26d0f47 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -152,8 +152,7 @@ jobs: --region ${{ env.TF_VAR_aws_region }} \ --arn arn:aws:sts::324005994172:assumed-role/AWSReservedSSO_infra-admin_256addbf79cfacd1/crodriguezlopez@cloudbees.com \ --username k8s-admin-user \ - --group system:masters \ - --no-duplicate-arns + --group system:masters kubectl get configmap aws-auth -n kube-system -o yaml bp02: From 0da53ded48a425de728630bf28a10535e92c1a24 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 03:04:36 +0200 Subject: [PATCH 149/180] only rol --- .cloudbees/workflows/bp-tf-cd.yaml | 6 ------ 1 file changed, 6 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index e26d0f47..a6f5c986 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -147,12 +147,6 @@ jobs: --arn arn:aws:iam::324005994172:role/AWSReservedSSO_infra-admin_256addbf79cfacd1 \ --username k8s-admin-rol \ --group system:masters - eksctl create iamidentitymapping \ - --cluster $(terraform output --raw eks_cluster_name) \ - --region ${{ env.TF_VAR_aws_region }} \ - --arn arn:aws:sts::324005994172:assumed-role/AWSReservedSSO_infra-admin_256addbf79cfacd1/crodriguezlopez@cloudbees.com \ - --username k8s-admin-user \ - --group system:masters kubectl get configmap aws-auth -n kube-system -o yaml bp02: From 3645aaa025fa849bed96425266dcd7e5485a9729 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 03:24:06 +0200 Subject: [PATCH 150/180] adding users for deploy and uploading outputs --- .cloudbees/workflows/bp-tf-cd.yaml | 31 ++++++++++++++++++++++-------- 1 file changed, 23 insertions(+), 8 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index a6f5c986..0d60652a 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -108,8 +108,8 @@ jobs: aws s3api put-object \ --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ --region ${{ env.AWS_REGION_TF_BUCKET }} \ - --key ${{ env.ROOT }}/${{ env.ROOT }}.kubeconfig.yaml \ - --body $(cd blueprints/${{ env.ROOT }} && terraform output --raw kubeconfig_file) + --key ${{ env.ROOT }}/${{ env.ROOT }}.terraform.output \ + --body blueprints/${{ env.ROOT }}/terraform.output - name: 01-getting-started - Validate uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest @@ -132,7 +132,6 @@ jobs: run : | terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy - #https://repost.aws/knowledge-center/eks-api-server-unauthorized-error - name: 01-getting-started - Add users uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest if: contains(env.STAGES, 'users') @@ -140,21 +139,21 @@ jobs: run : | set -x cd blueprints/${{ env.ROOT }} && eval $(terraform output --raw kubeconfig_export) - kubectl get configmap aws-auth -n kube-system -o yaml + kubectl describe configmap aws-auth -n kube-system eksctl create iamidentitymapping \ --cluster $(terraform output --raw eks_cluster_name) \ --region ${{ env.TF_VAR_aws_region }} \ --arn arn:aws:iam::324005994172:role/AWSReservedSSO_infra-admin_256addbf79cfacd1 \ --username k8s-admin-rol \ --group system:masters - kubectl get configmap aws-auth -n kube-system -o yaml + kubectl describe configmap aws-auth -n kube-system bp02: env: ROOT: 02-at-scale TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com # Add the stages to execute in the pipeline: deploy,validate,destroy,wipeout - STAGES: "" + STAGES: "deploy,users" needs: - init steps: @@ -207,8 +206,8 @@ jobs: aws s3api put-object \ --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ --region ${{ env.AWS_REGION_TF_BUCKET }} \ - --key ${{ env.ROOT }}/${{ env.ROOT }}.kubeconfig.yaml \ - --body $(cd blueprints/${{ env.ROOT }} && terraform output --raw kubeconfig_file) + --key ${{ env.ROOT }}/${{ env.ROOT }}.terraform.output \ + --body blueprints/${{ env.ROOT }}/terraform.output - name: 02-at-scale - Validate uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest @@ -230,3 +229,19 @@ jobs: shell: bash run : | terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy + + - name: 02-at-scale - Add users + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'users') + shell: bash + run : | + set -x + cd blueprints/${{ env.ROOT }} && eval $(terraform output --raw kubeconfig_export) + kubectl describe configmap aws-auth -n kube-system + eksctl create iamidentitymapping \ + --cluster $(terraform output --raw eks_cluster_name) \ + --region ${{ env.TF_VAR_aws_region }} \ + --arn arn:aws:iam::324005994172:role/AWSReservedSSO_infra-admin_256addbf79cfacd1 \ + --username k8s-admin-rol \ + --group system:masters + kubectl describe configmap aws-auth -n kube-system \ No newline at end of file From 96def99eb49f43eeff5ba196c49edea4a56b4f05 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 03:31:02 +0200 Subject: [PATCH 151/180] Setting role as enviroment --- .cloudbees/workflows/bp-tf-cd.yaml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index 0d60652a..01a5fd00 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -135,6 +135,8 @@ jobs: - name: 01-getting-started - Add users uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest if: contains(env.STAGES, 'users') + env: + TARGET_ROLE: arn:aws:iam::324005994172:role/AWSReservedSSO_infra-admin_256addbf79cfacd1 shell: bash run : | set -x @@ -143,7 +145,7 @@ jobs: eksctl create iamidentitymapping \ --cluster $(terraform output --raw eks_cluster_name) \ --region ${{ env.TF_VAR_aws_region }} \ - --arn arn:aws:iam::324005994172:role/AWSReservedSSO_infra-admin_256addbf79cfacd1 \ + --arn ${{ env.TARGET_ROLE }} \ --username k8s-admin-rol \ --group system:masters kubectl describe configmap aws-auth -n kube-system @@ -230,9 +232,11 @@ jobs: run : | terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy - - name: 02-at-scale - Add users + - name: 02-at-scale - Add users uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest if: contains(env.STAGES, 'users') + env: + TARGET_ROLE: arn:aws:iam::324005994172:role/AWSReservedSSO_infra-admin_256addbf79cfacd1 shell: bash run : | set -x @@ -241,7 +245,7 @@ jobs: eksctl create iamidentitymapping \ --cluster $(terraform output --raw eks_cluster_name) \ --region ${{ env.TF_VAR_aws_region }} \ - --arn arn:aws:iam::324005994172:role/AWSReservedSSO_infra-admin_256addbf79cfacd1 \ + --arn ${{ env.TARGET_ROLE }} \ --username k8s-admin-rol \ --group system:masters kubectl describe configmap aws-auth -n kube-system \ No newline at end of file From 624720ee4c6e76b361922494621c8929a979f9de Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 03:36:42 +0200 Subject: [PATCH 152/180] Adding cluster name --- blueprints/02-at-scale/outputs.tf | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/blueprints/02-at-scale/outputs.tf b/blueprints/02-at-scale/outputs.tf index 5f0e5418..7ad8cdea 100644 --- a/blueprints/02-at-scale/outputs.tf +++ b/blueprints/02-at-scale/outputs.tf @@ -119,6 +119,11 @@ output "eks_cluster_arn" { value = module.eks.cluster_arn } +output "eks_cluster_name" { + description = "Amazon EKS cluster Name." + value = module.eks.cluster_name +} + output "s3_cbci_arn" { description = "CloudBees CI Amazon S3 bucket ARN." value = module.cbci_s3_bucket.s3_bucket_arn From 0a92cb5d8139ed6b1a75bc57f999688e62626ab7 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Tue, 6 Aug 2024 11:16:58 +0000 Subject: [PATCH 153/180] terraform-docs: automated action --- blueprints/01-getting-started/README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/blueprints/01-getting-started/README.md b/blueprints/01-getting-started/README.md index b56ae0ff..e93bfe82 100644 --- a/blueprints/01-getting-started/README.md +++ b/blueprints/01-getting-started/README.md @@ -51,8 +51,10 @@ This blueprint presents the minimum setup to run CloudBees CI on Amazon EKS; one | cbci_oc_pod | Operations center pod for the CloudBees CI add-on. | | cbci_oc_url | URL of the CloudBees CI operations center for the CloudBees CI add-on. | | eks_cluster_arn | Amazon EKS cluster ARN. | +| eks_cluster_name | Amazon EKS cluster Name. | | kubeconfig_add | Add kubeconfig to your local configuration to access the Kubernetes API. | | kubeconfig_export | Export the KUBECONFIG environment variable to access the Kubernetes API. | +| kubeconfig_file | Kubeconfig file path to access the Kubernetes API. | | vpc_arn | VPC ID. | From 8607594cd664e182ca18db3e6466d724a5d80c58 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Tue, 6 Aug 2024 11:16:59 +0000 Subject: [PATCH 154/180] terraform-docs: automated action --- blueprints/02-at-scale/README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index bbbdd4a9..53233cd6 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -100,10 +100,12 @@ This blueprint divides scalable node groups for different types of workloads: | efs_access_points | Amazon EFS access points. | | efs_arn | Amazon EFS ARN. | | eks_cluster_arn | Amazon EKS cluster ARN. | +| eks_cluster_name | Amazon EKS cluster Name. | | global_password | Random string that is used as the global password. | | grafana_dashboard | Provides access to Grafana dashboards. | | kubeconfig_add | Add kubeconfig to the local configuration to access the Kubernetes API. | | kubeconfig_export | Export the KUBECONFIG environment variable to access the Kubernetes API. | +| kubeconfig_file | Kubeconfig file path to access the Kubernetes API. | | prometheus_active_targets | Checks active Prometheus targets from the operations center. | | prometheus_dashboard | Provides access to Prometheus dashboards. | | s3_cbci_arn | CloudBees CI Amazon S3 bucket ARN. | From 8fa117b5a54b49c970d742fb566564e10f61a409 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 13:21:05 +0200 Subject: [PATCH 155/180] Renaming --- .cloudbees/workflows/bp-tf-cd.yaml | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index 01a5fd00..4fff27c8 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -1,5 +1,10 @@ # Copyright (c) CloudBees, Inc. +# Stages +# CI: deploy,validate,destroy +# CD: deploy,validate,onboarding +# Nuke: wipeout + apiVersion: automation.cloudbees.io/v1alpha1 kind: workflow name: ci @@ -59,8 +64,7 @@ jobs: env: ROOT: 01-getting-started TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com - # Add the stages to execute in the pipeline: deploy,validate,destroy,wipeout - STAGES: "deploy,users" + STAGES: "deploy,validate,onboarding" needs: - init steps: @@ -132,9 +136,9 @@ jobs: run : | terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy - - name: 01-getting-started - Add users + - name: 01-getting-started - Role Onboarding uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest - if: contains(env.STAGES, 'users') + if: contains(env.STAGES, 'onboarding') env: TARGET_ROLE: arn:aws:iam::324005994172:role/AWSReservedSSO_infra-admin_256addbf79cfacd1 shell: bash @@ -154,8 +158,7 @@ jobs: env: ROOT: 02-at-scale TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com - # Add the stages to execute in the pipeline: deploy,validate,destroy,wipeout - STAGES: "deploy,users" + STAGES: "deploy,validate,onboarding" needs: - init steps: @@ -232,9 +235,9 @@ jobs: run : | terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy - - name: 02-at-scale - Add users + - name: 02-at-scale - Role Onboarding uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest - if: contains(env.STAGES, 'users') + if: contains(env.STAGES, 'onboarding') env: TARGET_ROLE: arn:aws:iam::324005994172:role/AWSReservedSSO_infra-admin_256addbf79cfacd1 shell: bash From 07029f92e8a3603c9ee317682211c8fe8ec7f59e Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 17:04:26 +0200 Subject: [PATCH 156/180] fix: adding s3 region --- .cloudbees/workflows/bp-tf-ci.yaml | 256 ++++++++++++++++++ .../cbci/casc/mc/parent/jcasc/main.yaml | 2 + 2 files changed, 258 insertions(+) create mode 100644 .cloudbees/workflows/bp-tf-ci.yaml diff --git a/.cloudbees/workflows/bp-tf-ci.yaml b/.cloudbees/workflows/bp-tf-ci.yaml new file mode 100644 index 00000000..17de5331 --- /dev/null +++ b/.cloudbees/workflows/bp-tf-ci.yaml @@ -0,0 +1,256 @@ +# Copyright (c) CloudBees, Inc. + +# Stages +# CI: deploy,validate,destroy +# Troubleshooting: deploy,validate,onboarding +# Nuke (Delete Dangling resource): wipeout + +apiVersion: automation.cloudbees.io/v1alpha1 +kind: workflow +name: ci + +on: + # Enable once Issue #83 is solved (Disable Manual trigger. workflow_dispatch) + # It requires + + # pull_request: + # branches: + # - 'main' + workflow_dispatch: + +env: + AWS_REGION_TF_BUCKET: "us-east-1" + BUCKET_NAME_TF_STATE: "cbci-eks-addon-tf-state-v2" + AWS_ROLE_TO_ASSUME: "infra-admin-ci" + TF_VAR_suffix: "ci-v11" + TF_VAR_aws_region: "us-west-2" + TF_AUTO_VARS_FILE: | + tags = { + "cb-owner" : "professional-services" + "cb-user" : "cb-platform" + "cb-purpose" : "ci" + } + trial_license = { + first_name = "CloudBees.io" + last_name = "Platform" + email = "ci.user@cloudbees.io" + company = "CloudBees Inc." + } + ci = true + +jobs: + init: + steps: + + - name: Configure AWS Credentials + uses: cloudbees-io/configure-aws-credentials@v1 + with: + aws-region: ${{ env.AWS_REGION_TF_BUCKET }} + aws-access-key-id: ${{ secrets.AWS_TF_CBCI_EKS_AccessKeyID }} + aws-secret-access-key: ${{ secrets.AWS_TF_CBCI_EKS_SecretAccessKey }} + role-to-assume: ${{ env.AWS_ROLE_TO_ASSUME }} + role-external-id: cloudbees + role-duration-seconds: "3600" + + #TODO: Add tags for the bucket + - name: Create Terraform Backend Bucket if not exists + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + shell: bash + run: | + set -x + aws s3api create-bucket \ + --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ + --region ${{ env.AWS_REGION_TF_BUCKET }} || echo "Bucket ${{ env.BUCKET_NAME_TF_STATE }} already exists" + + bp01: + env: + ROOT: 01-getting-started + TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com + STAGES: "deploy,validate,destroy" + needs: + - init + steps: + + - name: Configure AWS Credentials + uses: cloudbees-io/configure-aws-credentials@v1 + with: + aws-region: ${{ env.TF_VAR_aws_region }} + aws-access-key-id: ${{ secrets.AWS_TF_CBCI_EKS_AccessKeyID }} + aws-secret-access-key: ${{ secrets.AWS_TF_CBCI_EKS_SecretAccessKey }} + role-to-assume: ${{ env.AWS_ROLE_TO_ASSUME }} + role-external-id: cloudbees + role-duration-seconds: "3600" + + - name: Checkout code + uses: cloudbees-io/checkout@v1 + + - name: 01-getting-started - Set + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + shell: bash + run : | + cat <> blueprints/${{ env.ROOT }}/.auto.tfvars + ${{ env.TF_AUTO_VARS_FILE }} + EOT + cat blueprints/${{ env.ROOT }}/.auto.tfvars + cat <> blueprints/${{ env.ROOT }}/backend.tf + terraform { + backend "s3" { + bucket = "${{ env.BUCKET_NAME_TF_STATE }}" + key = "${{ env.ROOT }}/ci.terraform.tfstate" + region = "${{ env.AWS_REGION_TF_BUCKET }}" + } + } + EOT + + - name: 01-getting-started - Deploy + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'deploy') + shell: bash + run : | + set -x + aws kms delete-alias --alias-name alias/eks/cbci-bp01-${{ env.TF_VAR_suffix }}-eks --region ${{ env.TF_VAR_aws_region }} || echo "Alias alias/eks/cbci-bp01-${{ env.TF_VAR_suffix }}-eks does not exist" + aws kms delete-alias --alias-name alias/eks/cbci-bp01-${{ env.TF_VAR_suffix }} --region ${{ env.TF_VAR_aws_region }} || echo "Alias alias/eks/cbci-bp01-${{ env.TF_VAR_suffix }} does not exist" + CI=true make deploy + aws s3api put-object \ + --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ + --region ${{ env.AWS_REGION_TF_BUCKET }} \ + --key ${{ env.ROOT }}/${{ env.ROOT }}.terraform.output \ + --body blueprints/${{ env.ROOT }}/terraform.output + + - name: 01-getting-started - Validate + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'validate') + shell: bash + run : | + CI=true make validate + + - name: 01-getting-started - Destroy + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'destroy') + shell: bash + run : | + CI=true make destroy + + - name: 01-getting-started - Wipeout Failed Deployment + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'wipeout') + shell: bash + run : | + terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy + + - name: 02-at-scale - Role Onboarding + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'onboarding') + env: + TARGET_ROLE: arn:aws:iam::324005994172:role/AWSReservedSSO_infra-admin_256addbf79cfacd1 + shell: bash + run : | + set -x + cd blueprints/${{ env.ROOT }} && eval $(terraform output --raw kubeconfig_export) + kubectl describe configmap aws-auth -n kube-system + eksctl create iamidentitymapping \ + --cluster $(terraform output --raw eks_cluster_name) \ + --region ${{ env.TF_VAR_aws_region }} \ + --arn ${{ env.TARGET_ROLE }} \ + --username k8s-admin-rol \ + --group system:masters + kubectl describe configmap aws-auth -n kube-system + + bp02: + env: + ROOT: 02-at-scale + TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com + STAGES: "deploy,validate,destroy" + needs: + - init + steps: + + - name: Configure AWS Credentials + uses: cloudbees-io/configure-aws-credentials@v1 + with: + aws-region: ${{ env.TF_VAR_aws_region }} + aws-access-key-id: ${{ secrets.AWS_TF_CBCI_EKS_AccessKeyID }} + aws-secret-access-key: ${{ secrets.AWS_TF_CBCI_EKS_SecretAccessKey }} + role-to-assume: ${{ env.AWS_ROLE_TO_ASSUME }} + role-external-id: cloudbees + role-duration-seconds: "3600" + + - name: Checkout code + uses: cloudbees-io/checkout@v1 + + - name: 02-at-scale - Set + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + shell: bash + run : | + cat <> blueprints/${{ env.ROOT }}/.auto.tfvars + ${{ env.TF_AUTO_VARS_FILE }} + dh_reg_secret_auth = { + username = "foo" + password = "d0ckerPass12" + email = "example@gmail.com" + } + EOT + cat blueprints/${{ env.ROOT }}/.auto.tfvars + cat <> blueprints/${{ env.ROOT }}/backend.tf + terraform { + backend "s3" { + bucket = "${{ env.BUCKET_NAME_TF_STATE }}" + key = "${{ env.ROOT }}/ci.terraform.tfstate" + region = "${{ env.AWS_REGION_TF_BUCKET }}" + } + } + EOT + + - name: 02-at-scale - Deploy + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'deploy') + shell: bash + run : | + set -x + aws kms delete-alias --alias-name alias/eks/cbci-bp02-${{ env.TF_VAR_suffix }}-eks --region ${{ env.TF_VAR_aws_region }} || echo "Alias alias/eks/cbci-bp02-${{ env.TF_VAR_suffix }}-eks does not exist" + aws kms delete-alias --alias-name alias/eks/cbci-bp02-${{ env.TF_VAR_suffix }} --region ${{ env.TF_VAR_aws_region }} || echo "Alias alias/eks/cbci-bp02-${{ env.TF_VAR_suffix }} does not exist" + CI=true make deploy + aws s3api put-object \ + --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ + --region ${{ env.AWS_REGION_TF_BUCKET }} \ + --key ${{ env.ROOT }}/${{ env.ROOT }}.terraform.output \ + --body blueprints/${{ env.ROOT }}/terraform.output + + - name: 02-at-scale - Validate + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'validate') + shell: bash + run : | + CI=true make validate + + - name: 02-at-scale - Destroy + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'destroy') + shell: bash + run : | + CI=true make destroy + + - name: 02-at-scale - Wipeout Failed Deployment + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'wipeout') + shell: bash + run : | + terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy + + - name: 02-at-scale - Role Onboarding + uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest + if: contains(env.STAGES, 'onboarding') + env: + TARGET_ROLE: arn:aws:iam::324005994172:role/AWSReservedSSO_infra-admin_256addbf79cfacd1 + shell: bash + run : | + set -x + cd blueprints/${{ env.ROOT }} && eval $(terraform output --raw kubeconfig_export) + kubectl describe configmap aws-auth -n kube-system + eksctl create iamidentitymapping \ + --cluster $(terraform output --raw eks_cluster_name) \ + --region ${{ env.TF_VAR_aws_region }} \ + --arn ${{ env.TARGET_ROLE }} \ + --username k8s-admin-rol \ + --group system:masters + kubectl describe configmap aws-auth -n kube-system diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml index 417330c2..301da1c9 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml @@ -49,6 +49,8 @@ unclassified: git: remote: ${sharedLibRepo} aws: + awsCredentials: + region: "${sec_awsRegion}" s3: container: "${sec_s3bucketName}" disableSessionToken: false From 5ed5d6816875a4abb3d87f58af615633d80407ee Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 17:21:08 +0200 Subject: [PATCH 157/180] vault. separate init from configuration --- blueprints/02-at-scale/k8s/vault-config.sh | 4 ---- blueprints/02-at-scale/outputs.tf | 7 ++++++- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/blueprints/02-at-scale/k8s/vault-config.sh b/blueprints/02-at-scale/k8s/vault-config.sh index a09c0358..4f77929a 100644 --- a/blueprints/02-at-scale/k8s/vault-config.sh +++ b/blueprints/02-at-scale/k8s/vault-config.sh @@ -4,16 +4,12 @@ set -xeuo pipefail -HERE="$( cd -P "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" - # Vault namespace vault_ns="${1:-vault}" # App role name approle="cbci-oc" # https://github.com/hashicorp/terraform-aws-hashicorp-vault-eks-addon?tab=readme-ov-file#usage -## Init vault -kubectl exec -it vault-0 -n "$vault_ns" -- vault operator init | tee "$HERE/vault-init.log" || echo "Vault already initialized" ## Useal the vault for i in {1..3}; do read -r -p "INFO: Enter Unseal Key number $i [press Enter]: " key diff --git a/blueprints/02-at-scale/outputs.tf b/blueprints/02-at-scale/outputs.tf index 7ad8cdea..99272ed0 100644 --- a/blueprints/02-at-scale/outputs.tf +++ b/blueprints/02-at-scale/outputs.tf @@ -194,8 +194,13 @@ output "global_password" { value = "kubectl get secret ${module.eks_blueprints_addon_cbci.cbci_sec_casc} -n ${module.eks_blueprints_addon_cbci.cbci_namespace} -o jsonpath=${local.global_pass_jsonpath} | base64 -d" } +output "vault_init" { + description = "Inicialization of Vault Service." + value = "kubectl exec -it vault-0 -n ${local.vault_ns} -- vault operator init | tee $HERE/vault-init.log || echo \"Vault is already initialized.\"" +} + output "vault_configure" { - description = "Provides access to Hashicorp Vault dashboard. It requires the root token from the vault_init output." + description = "Configure Vault with iniitla set of secrets. It requires unseal keys and the root token from the vault_init output." value = "bash ${local.vault_config_file_path} ${local.vault_ns}" } From 12ac7e87f8c64f5a2df1bb63717a46a05b4ba4bc Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 17:21:22 +0200 Subject: [PATCH 158/180] prepare CD pipeline --- .cloudbees/workflows/bp-tf-cd.yaml | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index 4fff27c8..ab03b68d 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -1,7 +1,6 @@ # Copyright (c) CloudBees, Inc. # Stages -# CI: deploy,validate,destroy # CD: deploy,validate,onboarding # Nuke: wipeout @@ -10,10 +9,6 @@ kind: workflow name: ci on: - # Enable once Issue #83 is solved - # pull_request: - # branches: - # - 'main' workflow_dispatch: env: @@ -64,7 +59,7 @@ jobs: env: ROOT: 01-getting-started TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com - STAGES: "deploy,validate,onboarding" + STAGES: "deploy,validate,destroy" needs: - init steps: @@ -158,7 +153,7 @@ jobs: env: ROOT: 02-at-scale TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com - STAGES: "deploy,validate,onboarding" + STAGES: "deploy,validate,destroy" needs: - init steps: From dca4deb7b37ca8902da11c2186198da58448de12 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Tue, 6 Aug 2024 15:21:44 +0000 Subject: [PATCH 159/180] terraform-docs: automated action --- blueprints/02-at-scale/README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 53233cd6..fb2df084 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -111,8 +111,9 @@ This blueprint divides scalable node groups for different types of workloads: | s3_cbci_arn | CloudBees CI Amazon S3 bucket ARN. | | s3_cbci_name | CloudBees CI Amazon S3 bucket name. It is required by CloudBees CI for workspace caching and artifact management. | | s3_list_objects | Recursively lists all objects stored in the Amazon S3 bucket. | -| vault_configure | Provides access to Hashicorp Vault dashboard. It requires the root token from the vault_init output. | +| vault_configure | Configure Vault with iniitla set of secrets. It requires unseal keys and the root token from the vault_init output. | | vault_dashboard | Provides access to Hashicorp Vault dashboard. It requires the root token from the vault_init output. | +| vault_init | Inicialization of Vault Service. | | velero_backup_on_demand | Takes an on-demand Velero backup from the schedule for the selected controller that is using block storage. | | velero_backup_schedule | Creates a Velero backup schedule for the selected controller that is using block storage, and then deletes the existing schedule, if it exists. | | velero_restore | Restores the selected controller that is using block storage from a backup. | From b664fc1b03574496b2d0784811236df395de3a49 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 17:39:24 +0200 Subject: [PATCH 160/180] Vault: Uploading vault iniitilization --- .cloudbees/workflows/bp-tf-cd.yaml | 6 ++++++ blueprints/02-at-scale/README.md | 12 +++++++++--- blueprints/02-at-scale/main.tf | 1 + blueprints/02-at-scale/outputs.tf | 4 ++-- 4 files changed, 18 insertions(+), 5 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index ab03b68d..4470226f 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -208,6 +208,12 @@ jobs: --region ${{ env.AWS_REGION_TF_BUCKET }} \ --key ${{ env.ROOT }}/${{ env.ROOT }}.terraform.output \ --body blueprints/${{ env.ROOT }}/terraform.output + cd blueprints/${{ env.ROOT }} && eval $(terraform output --raw vault_init) + aws s3api put-object \ + --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ + --region ${{ env.AWS_REGION_TF_BUCKET }} \ + --key ${{ env.ROOT }}/${{ env.ROOT }}.vault-init.log \ + --body blueprints/${{ env.ROOT }}/k8s/vault-init.log || echo "No vault-init.log found" - name: 02-at-scale - Validate uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 53233cd6..2f4cdab0 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -208,19 +208,25 @@ DockerHub authentication is stored as Kubernetes secrets (`cbci-agent-sec-reg`) HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in this blueprint. -1. Run the configure Hashicorp Vault script. Keep in a safe place Admin Token and Unseal Keys (saved in `k8s/vault-init.log`) as well as Role ID and Secret ID for `cbci-oc` App Role. +1. Initialize Hashicorp Vault. Keep in a safe place Admin Token and Unseal Keys (saved in `k8s/vault-init.log`). + + ```sh + eval $(terraform output --raw vault_init) + ``` + +2. Run the configure Hashicorp Vault script. It configures Vault with initial secrets and creates `approle` for integration with CloudBees CI (role-id and secret-id) ```sh eval $(terraform output --raw vault_configure) ``` -2. Access the HashiCorp Vault UI by issuing the following command. Enter the root token to log in from the _step 1_. +3. Access the HashiCorp Vault UI by issuing the following command. Enter the root token to log in from the _step 1_. ```sh eval $(terraform output --raw vault_dashboard) ``` -3. Access with admin role to CloudBees CI Operation Center and complete the configuration for the CloudBees CI Vault Plugin by entering the Role ID and Secret ID for `cbci-oc` App Role from _step 1_ in _Manage Jenkins_ > _Credentials Providers_ > _HashiCorp Vault Credentials Provider_. Click on `Test Connection` to verify the inputs are right. Finally, move to `team-b` or `team-c-ha` to run the pipeline _admin_ > _validations_ > _vault-credentials_ and validate that credentials are fetched correctly from Hashicorp Vault. +4. Access with admin role to CloudBees CI Operation Center and complete the configuration for the CloudBees CI Vault Plugin by entering the Role ID and Secret ID for `cbci-oc` App Role from _step 2_ in _Manage Jenkins_ > _Credentials Providers_ > _HashiCorp Vault Credentials Provider_. Click on `Test Connection` to verify the inputs are right. Finally, move to `team-b` or `team-c-ha` to run the pipeline _admin_ > _validations_ > _vault-credentials_ and validate that credentials are fetched correctly from Hashicorp Vault. > [!NOTE] > Hashicorp Vault can be also be configured to be used for [Configuration as Code - Handling Secrets - Vault](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#hashicorp-vault-secret-source). diff --git a/blueprints/02-at-scale/main.tf b/blueprints/02-at-scale/main.tf index dc541efb..3751f26e 100644 --- a/blueprints/02-at-scale/main.tf +++ b/blueprints/02-at-scale/main.tf @@ -89,6 +89,7 @@ locals { vault_ns = "vault" vault_config_file_path = abspath("k8s/vault-config.sh") + vault_init_file_path = abspath("k8s/vault-init.log") } resource "random_string" "global_pass_string" { diff --git a/blueprints/02-at-scale/outputs.tf b/blueprints/02-at-scale/outputs.tf index 99272ed0..d2c098b6 100644 --- a/blueprints/02-at-scale/outputs.tf +++ b/blueprints/02-at-scale/outputs.tf @@ -196,11 +196,11 @@ output "global_password" { output "vault_init" { description = "Inicialization of Vault Service." - value = "kubectl exec -it vault-0 -n ${local.vault_ns} -- vault operator init | tee $HERE/vault-init.log || echo \"Vault is already initialized.\"" + value = "kubectl exec -it vault-0 -n ${local.vault_ns} -- vault operator init | tee ${local.vault_init_file_path} || echo \"Vault is already initialized.\"" } output "vault_configure" { - description = "Configure Vault with iniitla set of secrets. It requires unseal keys and the root token from the vault_init output." + description = "Configure Vault with initial secrets and creates approle for integration with CloudBees CI (role-id and secret-id). It requires unseal keys and the root token from the vault_init output." value = "bash ${local.vault_config_file_path} ${local.vault_ns}" } From b053b39c78baf1f7aec666fa8eb5c3794e56509b Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 17:42:17 +0200 Subject: [PATCH 161/180] casc: switch to cb-platform --- .../02-at-scale/cbci/casc/mc/parent/variables/variables.yaml | 2 +- blueprints/02-at-scale/cbci/casc/oc/items/root.yaml | 4 ++-- blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml | 2 +- blueprints/02-at-scale/k8s/cbci-values.yml | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml index 429fcc4d..51c51f17 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml @@ -3,5 +3,5 @@ variables: - s3bucketPreffix: "cbci" - regSecretsName: "cbci-sec-reg" - sharedLibRepo: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - - sharedLibBranch: develop + - sharedLibBranch: cb-platform - sharedLibPath: "blueprints/02-at-scale/cbci/shared-lib" diff --git a/blueprints/02-at-scale/cbci/casc/oc/items/root.yaml b/blueprints/02-at-scale/cbci/casc/oc/items/root.yaml index 18c4dce4..30723991 100644 --- a/blueprints/02-at-scale/cbci/casc/oc/items/root.yaml +++ b/blueprints/02-at-scale/cbci/casc/oc/items/root.yaml @@ -53,7 +53,7 @@ items: "cloudbees.prometheus": "true" properties: - configurationAsCode: - bundle: "develop/none-ha" + bundle: "cb-platform/none-ha" # Casc, HA - kind: managedController name: team-c-ha @@ -100,4 +100,4 @@ items: "cloudbees.prometheus": "true" properties: - configurationAsCode: - bundle: "develop/ha" + bundle: "cb-platform/ha" diff --git a/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml index 82f69637..bd3cf94a 100644 --- a/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml +++ b/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml @@ -1,7 +1,7 @@ variables: - message: "Welcome to the CloudBees CI blueprint add-on: At scale!" - cascRepo: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - - cascBranch: develop + - cascBranch: cb-platform - cascPathController: "/blueprints/02-at-scale/cbci/casc/mc/" - ldapManagerDN: "cn=admin,dc=acme,dc=org" - ldapRootDN: "dc=acme,dc=org" diff --git a/blueprints/02-at-scale/k8s/cbci-values.yml b/blueprints/02-at-scale/k8s/cbci-values.yml index e0062df8..354dc86f 100644 --- a/blueprints/02-at-scale/k8s/cbci-values.yml +++ b/blueprints/02-at-scale/k8s/cbci-values.yml @@ -16,7 +16,7 @@ OperationsCenter: Retriever: Enabled: true scmRepo: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - scmBranch: develop + scmBranch: cb-platform scmBundlePath: blueprints/02-at-scale/cbci/casc/oc scmPollingInterval: PT20M Persistence: From 78e7f7678555208ba2353d1dc2472a6eed577b43 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 17:48:59 +0200 Subject: [PATCH 162/180] fix: remove kubeconfig file as it is not needed --- blueprints/01-getting-started/outputs.tf | 5 ----- blueprints/02-at-scale/outputs.tf | 5 ----- 2 files changed, 10 deletions(-) diff --git a/blueprints/01-getting-started/outputs.tf b/blueprints/01-getting-started/outputs.tf index f3cbd698..ab9d17be 100644 --- a/blueprints/01-getting-started/outputs.tf +++ b/blueprints/01-getting-started/outputs.tf @@ -1,8 +1,3 @@ -output "kubeconfig_file" { - description = "Kubeconfig file path to access the Kubernetes API." - value = local.kubeconfig_file_path -} - output "kubeconfig_export" { description = "Export the KUBECONFIG environment variable to access the Kubernetes API." value = "export KUBECONFIG=${local.kubeconfig_file_path}" diff --git a/blueprints/02-at-scale/outputs.tf b/blueprints/02-at-scale/outputs.tf index d2c098b6..6fe68139 100644 --- a/blueprints/02-at-scale/outputs.tf +++ b/blueprints/02-at-scale/outputs.tf @@ -1,8 +1,3 @@ -output "kubeconfig_file" { - description = "Kubeconfig file path to access the Kubernetes API." - value = local.kubeconfig_file_path -} - output "kubeconfig_export" { description = "Export the KUBECONFIG environment variable to access the Kubernetes API." value = "export KUBECONFIG=${local.kubeconfig_file_path}" From ce47abc7ef6349403d03aa07ff240b40b38ec068 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 17:54:53 +0200 Subject: [PATCH 163/180] Vault init log file for CD --- .cloudbees/workflows/bp-tf-cd.yaml | 4 ++-- blueprints/02-at-scale/outputs.tf | 5 +++++ 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index 4470226f..b2e51c42 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -212,8 +212,8 @@ jobs: aws s3api put-object \ --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ --region ${{ env.AWS_REGION_TF_BUCKET }} \ - --key ${{ env.ROOT }}/${{ env.ROOT }}.vault-init.log \ - --body blueprints/${{ env.ROOT }}/k8s/vault-init.log || echo "No vault-init.log found" + --key ${{ env.ROOT }}/${{ env.ROOT }}.vault.init.log \ + --body $(cd blueprints/${{ env.ROOT }} && terraform output --raw vault_init_log_file) || echo "No vault-init.log found" - name: 02-at-scale - Validate uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest diff --git a/blueprints/02-at-scale/outputs.tf b/blueprints/02-at-scale/outputs.tf index 6fe68139..a06889ca 100644 --- a/blueprints/02-at-scale/outputs.tf +++ b/blueprints/02-at-scale/outputs.tf @@ -194,6 +194,11 @@ output "vault_init" { value = "kubectl exec -it vault-0 -n ${local.vault_ns} -- vault operator init | tee ${local.vault_init_file_path} || echo \"Vault is already initialized.\"" } +output "vault_init_log_file" { + description = "Vault Inicialization log file." + value = local.vault_init_file_path +} + output "vault_configure" { description = "Configure Vault with initial secrets and creates approle for integration with CloudBees CI (role-id and secret-id). It requires unseal keys and the root token from the vault_init output." value = "bash ${local.vault_config_file_path} ${local.vault_ns}" From b921a7497f1799294f47b234e14c5c351f4e8453 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 17:57:43 +0200 Subject: [PATCH 164/180] Passing pre-commit --- .cloudbees/workflows/bp-tf-cd.yaml | 6 +++--- .cloudbees/workflows/bp-tf-ci.yaml | 6 +++--- .docker/agent/agent.root.Dockerfile | 2 +- blueprints/01-getting-started/README.md | 1 - blueprints/01-getting-started/outputs.tf | 2 +- blueprints/02-at-scale/README.md | 4 ++-- 6 files changed, 10 insertions(+), 11 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index b2e51c42..b3f3e986 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -130,7 +130,7 @@ jobs: shell: bash run : | terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy - + - name: 01-getting-started - Role Onboarding uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest if: contains(env.STAGES, 'onboarding') @@ -228,7 +228,7 @@ jobs: shell: bash run : | CI=true make destroy - + - name: 02-at-scale - Wipeout Failed Deployment uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest if: contains(env.STAGES, 'wipeout') @@ -252,4 +252,4 @@ jobs: --arn ${{ env.TARGET_ROLE }} \ --username k8s-admin-rol \ --group system:masters - kubectl describe configmap aws-auth -n kube-system \ No newline at end of file + kubectl describe configmap aws-auth -n kube-system diff --git a/.cloudbees/workflows/bp-tf-ci.yaml b/.cloudbees/workflows/bp-tf-ci.yaml index 17de5331..14d2073a 100644 --- a/.cloudbees/workflows/bp-tf-ci.yaml +++ b/.cloudbees/workflows/bp-tf-ci.yaml @@ -11,7 +11,7 @@ name: ci on: # Enable once Issue #83 is solved (Disable Manual trigger. workflow_dispatch) - # It requires + # It requires # pull_request: # branches: @@ -229,14 +229,14 @@ jobs: shell: bash run : | CI=true make destroy - + - name: 02-at-scale - Wipeout Failed Deployment uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest if: contains(env.STAGES, 'wipeout') shell: bash run : | terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy - + - name: 02-at-scale - Role Onboarding uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest if: contains(env.STAGES, 'onboarding') diff --git a/.docker/agent/agent.root.Dockerfile b/.docker/agent/agent.root.Dockerfile index d76fe578..010cb24f 100644 --- a/.docker/agent/agent.root.Dockerfile +++ b/.docker/agent/agent.root.Dockerfile @@ -38,4 +38,4 @@ RUN curl -sLO https://github.com/vmware-tanzu/velero/releases/download/v${VELERO RUN curl -sLO "https://github.com/weaveworks/eksctl/releases/download/v${EKSCTL_VERSION}/eksctl_Linux_${ARCH}.tar.gz" && \ tar -xzf eksctl_Linux_${ARCH}.tar.gz -C /usr/bin && \ chmod +x /usr/bin/eksctl && \ - rm eksctl_Linux_${ARCH}.tar.gz \ No newline at end of file + rm eksctl_Linux_${ARCH}.tar.gz diff --git a/blueprints/01-getting-started/README.md b/blueprints/01-getting-started/README.md index e93bfe82..0c11a238 100644 --- a/blueprints/01-getting-started/README.md +++ b/blueprints/01-getting-started/README.md @@ -54,7 +54,6 @@ This blueprint presents the minimum setup to run CloudBees CI on Amazon EKS; one | eks_cluster_name | Amazon EKS cluster Name. | | kubeconfig_add | Add kubeconfig to your local configuration to access the Kubernetes API. | | kubeconfig_export | Export the KUBECONFIG environment variable to access the Kubernetes API. | -| kubeconfig_file | Kubeconfig file path to access the Kubernetes API. | | vpc_arn | VPC ID. | diff --git a/blueprints/01-getting-started/outputs.tf b/blueprints/01-getting-started/outputs.tf index ab9d17be..971a3474 100644 --- a/blueprints/01-getting-started/outputs.tf +++ b/blueprints/01-getting-started/outputs.tf @@ -67,4 +67,4 @@ output "eks_cluster_arn" { output "eks_cluster_name" { description = "Amazon EKS cluster Name." value = module.eks.cluster_name -} \ No newline at end of file +} diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index fc8ac2fe..9bbacd64 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -105,15 +105,15 @@ This blueprint divides scalable node groups for different types of workloads: | grafana_dashboard | Provides access to Grafana dashboards. | | kubeconfig_add | Add kubeconfig to the local configuration to access the Kubernetes API. | | kubeconfig_export | Export the KUBECONFIG environment variable to access the Kubernetes API. | -| kubeconfig_file | Kubeconfig file path to access the Kubernetes API. | | prometheus_active_targets | Checks active Prometheus targets from the operations center. | | prometheus_dashboard | Provides access to Prometheus dashboards. | | s3_cbci_arn | CloudBees CI Amazon S3 bucket ARN. | | s3_cbci_name | CloudBees CI Amazon S3 bucket name. It is required by CloudBees CI for workspace caching and artifact management. | | s3_list_objects | Recursively lists all objects stored in the Amazon S3 bucket. | -| vault_configure | Configure Vault with iniitla set of secrets. It requires unseal keys and the root token from the vault_init output. | +| vault_configure | Configure Vault with initial secrets and creates approle for integration with CloudBees CI (role-id and secret-id). It requires unseal keys and the root token from the vault_init output. | | vault_dashboard | Provides access to Hashicorp Vault dashboard. It requires the root token from the vault_init output. | | vault_init | Inicialization of Vault Service. | +| vault_init_log_file | Vault Inicialization log file. | | velero_backup_on_demand | Takes an on-demand Velero backup from the schedule for the selected controller that is using block storage. | | velero_backup_schedule | Creates a Velero backup schedule for the selected controller that is using block storage, and then deletes the existing schedule, if it exists. | | velero_restore | Restores the selected controller that is using block storage from a backup. | From f64e9fd5d2b600364f9b6df9646c374e5708d02f Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 18:06:08 +0200 Subject: [PATCH 165/180] Adding secrets for DockerHub --- .cloudbees/workflows/bp-tf-cd.yaml | 6 +++--- .cloudbees/workflows/bp-tf-ci.yaml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index b3f3e986..883be464 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -178,9 +178,9 @@ jobs: cat <> blueprints/${{ env.ROOT }}/.auto.tfvars ${{ env.TF_AUTO_VARS_FILE }} dh_reg_secret_auth = { - username = "foo" - password = "d0ckerPass12" - email = "example@gmail.com" + username = "${{ secrets.AWS_TF_CBCI_EKS_DHUser }}" + password = "${{ secrets.AWS_TF_CBCI_EKS_DHPass }}" + email = "${{ secrets.AWS_TF_CBCI_EKS_DHMail }}" } EOT cat blueprints/${{ env.ROOT }}/.auto.tfvars diff --git a/.cloudbees/workflows/bp-tf-ci.yaml b/.cloudbees/workflows/bp-tf-ci.yaml index 14d2073a..b59dcf99 100644 --- a/.cloudbees/workflows/bp-tf-ci.yaml +++ b/.cloudbees/workflows/bp-tf-ci.yaml @@ -185,9 +185,9 @@ jobs: cat <> blueprints/${{ env.ROOT }}/.auto.tfvars ${{ env.TF_AUTO_VARS_FILE }} dh_reg_secret_auth = { - username = "foo" - password = "d0ckerPass12" - email = "example@gmail.com" + username = "${{ secrets.AWS_TF_CBCI_EKS_DHUser }}" + password = "${{ secrets.AWS_TF_CBCI_EKS_DHPass }}" + email = "${{ secrets.AWS_TF_CBCI_EKS_DHMail }}" } EOT cat blueprints/${{ env.ROOT }}/.auto.tfvars From 90476916c9a99fcaf2c5dd207b0153ca60e36528 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 18:06:57 +0200 Subject: [PATCH 166/180] set deploy and validate --- .cloudbees/workflows/bp-tf-cd.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index 883be464..2cc1d113 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -59,7 +59,7 @@ jobs: env: ROOT: 01-getting-started TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com - STAGES: "deploy,validate,destroy" + STAGES: "" needs: - init steps: @@ -153,7 +153,7 @@ jobs: env: ROOT: 02-at-scale TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com - STAGES: "deploy,validate,destroy" + STAGES: "deploy,validate" needs: - init steps: From 1b368808290fc36e4ee1f8e19fa321eff5146052 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 18:12:58 +0200 Subject: [PATCH 167/180] adding onboarding to stages --- .cloudbees/workflows/bp-tf-cd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index 2cc1d113..192be6f8 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -153,7 +153,7 @@ jobs: env: ROOT: 02-at-scale TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com - STAGES: "deploy,validate" + STAGES: "deploy,validate,onboarding" needs: - init steps: From f6fec8a68467dae15b6dcfa8355b01d4f82e1b37 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 18:19:28 +0200 Subject: [PATCH 168/180] adding kubeconfig for vault init --- .cloudbees/workflows/bp-tf-cd.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index 192be6f8..1a76f43d 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -208,6 +208,7 @@ jobs: --region ${{ env.AWS_REGION_TF_BUCKET }} \ --key ${{ env.ROOT }}/${{ env.ROOT }}.terraform.output \ --body blueprints/${{ env.ROOT }}/terraform.output + cd blueprints/${{ env.ROOT }} && eval $(terraform output --raw kubeconfig_export) cd blueprints/${{ env.ROOT }} && eval $(terraform output --raw vault_init) aws s3api put-object \ --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ From ff403a5df9e1e79074443a384ecf461a5aafd39d Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 18:20:55 +0200 Subject: [PATCH 169/180] Update outputs.tf --- blueprints/02-at-scale/outputs.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/outputs.tf b/blueprints/02-at-scale/outputs.tf index a06889ca..d57b8239 100644 --- a/blueprints/02-at-scale/outputs.tf +++ b/blueprints/02-at-scale/outputs.tf @@ -191,7 +191,7 @@ output "global_password" { output "vault_init" { description = "Inicialization of Vault Service." - value = "kubectl exec -it vault-0 -n ${local.vault_ns} -- vault operator init | tee ${local.vault_init_file_path} || echo \"Vault is already initialized.\"" + value = "kubectl exec -it vault-0 -n ${local.vault_ns} -- vault operator init | tee ${local.vault_init_file_path} || echo \"Vault initialization failed.\"" } output "vault_init_log_file" { From 22af91f45cda11145e670e32da26ed295b9cbe5e Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 18:38:26 +0200 Subject: [PATCH 170/180] set cd for this pipeline --- .cloudbees/workflows/bp-tf-cd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index 1a76f43d..0d72076c 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -21,7 +21,7 @@ env: tags = { "cb-owner" : "professional-services" "cb-user" : "cb-platform" - "cb-purpose" : "ci" + "cb-purpose" : "cd" } trial_license = { first_name = "CloudBees.io" From 9e8d60e6aa7d933006b19ca1fb511a220cd1fb2c Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 18:44:07 +0200 Subject: [PATCH 171/180] typo --- .cloudbees/workflows/bp-tf-ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.cloudbees/workflows/bp-tf-ci.yaml b/.cloudbees/workflows/bp-tf-ci.yaml index b59dcf99..fac1d86a 100644 --- a/.cloudbees/workflows/bp-tf-ci.yaml +++ b/.cloudbees/workflows/bp-tf-ci.yaml @@ -138,7 +138,7 @@ jobs: run : | terraform -chdir=blueprints/${{ env.ROOT }} init -reconfigure && CI=true make destroy - - name: 02-at-scale - Role Onboarding + - name: 01-getting-started - Role Onboarding uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest if: contains(env.STAGES, 'onboarding') env: From 3a55738740370e346f42e1926465cf88438f28ea Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 18:48:23 +0200 Subject: [PATCH 172/180] wipeout --- .cloudbees/workflows/bp-tf-cd.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index 0d72076c..e5727a74 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -59,7 +59,7 @@ jobs: env: ROOT: 01-getting-started TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com - STAGES: "" + STAGES: "wipeout" needs: - init steps: @@ -153,7 +153,7 @@ jobs: env: ROOT: 02-at-scale TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com - STAGES: "deploy,validate,onboarding" + STAGES: "wipeout" needs: - init steps: From 225eb7ad0d0687532d677bb5e52c79e7b7dd0b15 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 18:50:05 +0200 Subject: [PATCH 173/180] passing pre-commit --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index a323590b..83f1952d 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -227,7 +227,7 @@ HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in t eval $(terraform output --raw vault_dashboard) ``` -4. Sign in to the CloudBees CI operations center as a user with the admin role. +4. Sign in to the CloudBees CI operations center as a user with the admin role. 5. Navigate to **Manage Jenkins > Credentials Providers > HashiCorp Vault Credentials Provider** and complete the configuration for the CloudBees CI Vault Plugin by entering the role ID and secret ID for the `cbci-oc` application role from _step 1_. From 5e37d40030c52a48d3bc3e73c497acddcb4a7ed6 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 18:54:15 +0200 Subject: [PATCH 174/180] clarifying wipeout stage --- .cloudbees/workflows/bp-tf-cd.yaml | 4 ++-- .cloudbees/workflows/bp-tf-ci.yaml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index e5727a74..e945926f 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -124,7 +124,7 @@ jobs: run : | CI=true make destroy - - name: 01-getting-started - Wipeout Failed Deployment + - name: 01-getting-started - Wipeout uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest if: contains(env.STAGES, 'wipeout') shell: bash @@ -230,7 +230,7 @@ jobs: run : | CI=true make destroy - - name: 02-at-scale - Wipeout Failed Deployment + - name: 02-at-scale - Wipeout uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest if: contains(env.STAGES, 'wipeout') shell: bash diff --git a/.cloudbees/workflows/bp-tf-ci.yaml b/.cloudbees/workflows/bp-tf-ci.yaml index fac1d86a..8e57b247 100644 --- a/.cloudbees/workflows/bp-tf-ci.yaml +++ b/.cloudbees/workflows/bp-tf-ci.yaml @@ -131,7 +131,7 @@ jobs: run : | CI=true make destroy - - name: 01-getting-started - Wipeout Failed Deployment + - name: 01-getting-started - Wipeout uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest if: contains(env.STAGES, 'wipeout') shell: bash @@ -230,7 +230,7 @@ jobs: run : | CI=true make destroy - - name: 02-at-scale - Wipeout Failed Deployment + - name: 02-at-scale - Wipeout uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest if: contains(env.STAGES, 'wipeout') shell: bash From 4cae399d0ecdac4d7d1d2a4d8c55e578e02a57bb Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 19:16:14 +0200 Subject: [PATCH 175/180] [ci/cd] setting different buckets names --- .cloudbees/workflows/bp-tf-cd.yaml | 17 +++++++++-------- .cloudbees/workflows/bp-tf-ci.yaml | 2 +- 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index e945926f..75e20a3b 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -13,7 +13,7 @@ on: env: AWS_REGION_TF_BUCKET: "us-east-1" - BUCKET_NAME_TF_STATE: "cbci-eks-addon-tf-state-v2" + BUCKET_NAME_TF_STATE: "cbci-eks-addon-tf-state-cd" AWS_ROLE_TO_ASSUME: "infra-admin-ci" TF_VAR_suffix: "ci-v11" TF_VAR_aws_region: "us-west-2" @@ -208,13 +208,14 @@ jobs: --region ${{ env.AWS_REGION_TF_BUCKET }} \ --key ${{ env.ROOT }}/${{ env.ROOT }}.terraform.output \ --body blueprints/${{ env.ROOT }}/terraform.output - cd blueprints/${{ env.ROOT }} && eval $(terraform output --raw kubeconfig_export) - cd blueprints/${{ env.ROOT }} && eval $(terraform output --raw vault_init) - aws s3api put-object \ - --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ - --region ${{ env.AWS_REGION_TF_BUCKET }} \ - --key ${{ env.ROOT }}/${{ env.ROOT }}.vault.init.log \ - --body $(cd blueprints/${{ env.ROOT }} && terraform output --raw vault_init_log_file) || echo "No vault-init.log found" + # TODO: Add vault init log to s3 + # cd blueprints/${{ env.ROOT }} && eval $(terraform output --raw kubeconfig_export) + # cd blueprints/${{ env.ROOT }} && eval $(terraform output --raw vault_init) + # aws s3api put-object \ + # --bucket ${{ env.BUCKET_NAME_TF_STATE }} \ + # --region ${{ env.AWS_REGION_TF_BUCKET }} \ + # --key ${{ env.ROOT }}/${{ env.ROOT }}.vault.init.log \ + # --body $(cd blueprints/${{ env.ROOT }} && terraform output --raw vault_init_log_file) || echo "No vault-init.log found" - name: 02-at-scale - Validate uses: docker://public.ecr.aws/r1n1q0e5/cloudbees-labs/tf-aws-cb-ci-eks-addon-agent:latest diff --git a/.cloudbees/workflows/bp-tf-ci.yaml b/.cloudbees/workflows/bp-tf-ci.yaml index 8e57b247..0494c760 100644 --- a/.cloudbees/workflows/bp-tf-ci.yaml +++ b/.cloudbees/workflows/bp-tf-ci.yaml @@ -20,7 +20,7 @@ on: env: AWS_REGION_TF_BUCKET: "us-east-1" - BUCKET_NAME_TF_STATE: "cbci-eks-addon-tf-state-v2" + BUCKET_NAME_TF_STATE: "cbci-eks-addon-tf-state-ci" AWS_ROLE_TO_ASSUME: "infra-admin-ci" TF_VAR_suffix: "ci-v11" TF_VAR_aws_region: "us-west-2" From 73ec14bba167a1a0b015193e9cae22b2339a03be Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 20:01:07 +0200 Subject: [PATCH 176/180] creating separete domains for ci vs cd --- .cloudbees/workflows/bp-tf-cd.yaml | 4 ++-- .cloudbees/workflows/bp-tf-ci.yaml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index 75e20a3b..6c7eb1e9 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -58,7 +58,7 @@ jobs: bp01: env: ROOT: 01-getting-started - TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com + TF_VAR_hosted_zone: bp01-cd.aws.ps.beescloud.com STAGES: "wipeout" needs: - init @@ -152,7 +152,7 @@ jobs: bp02: env: ROOT: 02-at-scale - TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com + TF_VAR_hosted_zone: bp02-cd.aws.ps.beescloud.com STAGES: "wipeout" needs: - init diff --git a/.cloudbees/workflows/bp-tf-ci.yaml b/.cloudbees/workflows/bp-tf-ci.yaml index 0494c760..f00812e1 100644 --- a/.cloudbees/workflows/bp-tf-ci.yaml +++ b/.cloudbees/workflows/bp-tf-ci.yaml @@ -65,7 +65,7 @@ jobs: bp01: env: ROOT: 01-getting-started - TF_VAR_hosted_zone: bp01.aws.ps.beescloud.com + TF_VAR_hosted_zone: bp01-ci.aws.ps.beescloud.com STAGES: "deploy,validate,destroy" needs: - init @@ -159,7 +159,7 @@ jobs: bp02: env: ROOT: 02-at-scale - TF_VAR_hosted_zone: bp02.aws.ps.beescloud.com + TF_VAR_hosted_zone: bp02-ci.aws.ps.beescloud.com STAGES: "deploy,validate,destroy" needs: - init From c4bb91bcd3f28134b8ca8f6da457ba433531135e Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 22:55:40 +0200 Subject: [PATCH 177/180] casc: set develop branch --- .../02-at-scale/cbci/casc/mc/parent/variables/variables.yaml | 2 +- blueprints/02-at-scale/cbci/casc/oc/items/root.yaml | 4 ++-- blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml | 2 +- blueprints/02-at-scale/k8s/cbci-values.yml | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml index 51c51f17..429fcc4d 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml @@ -3,5 +3,5 @@ variables: - s3bucketPreffix: "cbci" - regSecretsName: "cbci-sec-reg" - sharedLibRepo: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - - sharedLibBranch: cb-platform + - sharedLibBranch: develop - sharedLibPath: "blueprints/02-at-scale/cbci/shared-lib" diff --git a/blueprints/02-at-scale/cbci/casc/oc/items/root.yaml b/blueprints/02-at-scale/cbci/casc/oc/items/root.yaml index 30723991..18c4dce4 100644 --- a/blueprints/02-at-scale/cbci/casc/oc/items/root.yaml +++ b/blueprints/02-at-scale/cbci/casc/oc/items/root.yaml @@ -53,7 +53,7 @@ items: "cloudbees.prometheus": "true" properties: - configurationAsCode: - bundle: "cb-platform/none-ha" + bundle: "develop/none-ha" # Casc, HA - kind: managedController name: team-c-ha @@ -100,4 +100,4 @@ items: "cloudbees.prometheus": "true" properties: - configurationAsCode: - bundle: "cb-platform/ha" + bundle: "develop/ha" diff --git a/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml index bd3cf94a..82f69637 100644 --- a/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml +++ b/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml @@ -1,7 +1,7 @@ variables: - message: "Welcome to the CloudBees CI blueprint add-on: At scale!" - cascRepo: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - - cascBranch: cb-platform + - cascBranch: develop - cascPathController: "/blueprints/02-at-scale/cbci/casc/mc/" - ldapManagerDN: "cn=admin,dc=acme,dc=org" - ldapRootDN: "dc=acme,dc=org" diff --git a/blueprints/02-at-scale/k8s/cbci-values.yml b/blueprints/02-at-scale/k8s/cbci-values.yml index 354dc86f..e0062df8 100644 --- a/blueprints/02-at-scale/k8s/cbci-values.yml +++ b/blueprints/02-at-scale/k8s/cbci-values.yml @@ -16,7 +16,7 @@ OperationsCenter: Retriever: Enabled: true scmRepo: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - scmBranch: cb-platform + scmBranch: develop scmBundlePath: blueprints/02-at-scale/cbci/casc/oc scmPollingInterval: PT20M Persistence: From 11056210265434889f381d417433962ff028c9db Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 6 Aug 2024 23:55:43 +0200 Subject: [PATCH 178/180] test variables escape --- .../02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml index ae227e9f..a407cf25 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml @@ -226,8 +226,8 @@ items: steps { sh ''' echo 'Printing credentials from Vault' - echo ^$U1 - echo ^$S1 + echo ^${U1} + echo ^${S1} ''' } } From c5ad1c21adc5c18b8f67d1828032bb24544875da Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Wed, 7 Aug 2024 00:21:38 +0200 Subject: [PATCH 179/180] corrections on readme --- blueprints/02-at-scale/README.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 83f1952d..286f4ce8 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -227,6 +227,8 @@ HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in t eval $(terraform output --raw vault_dashboard) ``` + If successful, the Vault web service should be available at `http://localhost:50003` and you can view the secrets that were created in _step 2_. + 4. Sign in to the CloudBees CI operations center as a user with the admin role. 5. Navigate to **Manage Jenkins > Credentials Providers > HashiCorp Vault Credentials Provider** and complete the configuration for the CloudBees CI Vault Plugin by entering the role ID and secret ID for the `cbci-oc` application role from _step 1_. @@ -373,7 +375,7 @@ Grafana is used to visualize and query: eval $(terraform output --raw prometheus_dashboard) ``` - If successful, the Prometheus dashboard should be available at `http://localhost:50001` and you can view the configured alerts for CloudBees CI. + If successful, the Prometheus web service is available at `http://localhost:50001` and you can view the configured alerts for CloudBees CI. Additionally, check _Status_ > _Targets_ shows targets in `UP` status. 3. Issue the following command to access Grafana dashboards at `localhost:50002`. For the username, use `admin` and set the password using the `global_password` terraform variable: @@ -381,9 +383,9 @@ Grafana is used to visualize and query: eval $(terraform output --raw grafana_dashboard) ``` - If successful, the Grafana dashboard should be available at `http://localhost:50002`. + If successful, the Grafana web service is available `http://localhost:50002`. - - For Jenkins Metrics Dashboards navigate to **Dashboards > CloudBees CI**. Then, select the controller pod to view the metrics. The following image shows metrics for team-b. + - For Jenkins Metrics Dashboards navigate to **Home > Dashboards > CloudBees CI**. Then, select the controller pod to view the metrics. The following image shows metrics for team-b. ![CloudBees CI Dashboard](img/observability/cbci-dashboard.png) From c514248954a93ac53a9d977af00fb3859e64bd90 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Wed, 7 Aug 2024 00:23:39 +0200 Subject: [PATCH 180/180] passed precommit --- .cloudbees/workflows/bp-tf-cd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.cloudbees/workflows/bp-tf-cd.yaml b/.cloudbees/workflows/bp-tf-cd.yaml index 6c7eb1e9..a2153a70 100644 --- a/.cloudbees/workflows/bp-tf-cd.yaml +++ b/.cloudbees/workflows/bp-tf-cd.yaml @@ -208,7 +208,7 @@ jobs: --region ${{ env.AWS_REGION_TF_BUCKET }} \ --key ${{ env.ROOT }}/${{ env.ROOT }}.terraform.output \ --body blueprints/${{ env.ROOT }}/terraform.output - # TODO: Add vault init log to s3 + # TODO: Add vault init log to s3 # cd blueprints/${{ env.ROOT }} && eval $(terraform output --raw kubeconfig_export) # cd blueprints/${{ env.ROOT }} && eval $(terraform output --raw vault_init) # aws s3api put-object \