Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Refactor cicd pipeline #764

Open
wants to merge 4 commits into
base: develop
Choose a base branch
from

Conversation

matthewfala
Copy link
Contributor

@matthewfala matthewfala commented Nov 3, 2023

This refactor allows for the sync tasks to be located on both production accounts and other accounts like the scanner account.

Also it serves as an abstraction for the CICD pipeline, to allow for the setup to be tested on test accounts.

Issue #, if available:

Description of changes:

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

@matthewfala matthewfala requested a review from a team as a code owner November 3, 2023 05:53
@matthewfala matthewfala changed the title Refactor cicd pipeline CVE Scanner: Refactor cicd pipeline Nov 3, 2023
@matthewfala matthewfala changed the title CVE Scanner: Refactor cicd pipeline Refactor cicd pipeline Dec 6, 2023
Signed-off-by: Matthew Fala <[email protected]>
# Clear up testing resources
- python ./load_tests/load_test.py delete_testing_resources
- |
for i in {1..2}; do
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we make this 2 as a configure retry parameter ?

for i in {1..2}; do
python ./load_tests/load_test.py ${PLATFORM} && break \
|| (
if [ $i == 2 ]; then
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same 2 here.

phases:
install:
runtime-versions:
golang: 1.16
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is there 1.x ?? reduce future upgrade effort >

@@ -18,8 +18,8 @@
TESTING_RESOURCES_STACK_NAME = os.environ['TESTING_RESOURCES_STACK_NAME']
PREFIX = os.environ['PREFIX']
EKS_CLUSTER_NAME = os.environ['EKS_CLUSTER_NAME']
LOGGER_RUN_TIME_IN_SECOND = 600
BUFFER_TIME_IN_SECOND = 1000
LOGGER_RUN_TIME_IN_SECOND = int(os.getenv("LOAD_TEST_RUN_TIME_IN_SECONDS", "600"))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we keep above ?? and do soemthing like

DEFAULT_LOGGER_RUN_TIME_IN_SECOND = 600
LOGGER_RUN_TIME_IN_SECOND = int(os.getenv("LOAD_TEST_RUN_TIME_IN_SECONDS", DEFAULT_LOGGER_RUN_TIME_IN_SECOND))
``

Comment on lines +449 to +460
if (output == "cloudwatch" or output == "all"):
# Delete associated cloudwatch log streams
if os.getenv('CW_LOG_GROUP_NAME') != None:
client = session.client('logs')
response = client.describe_log_streams(
logGroupName=os.getenv('CW_LOG_GROUP_NAME')
)
for stream in response["logStreams"]:
client.delete_log_stream(
logGroupName=os.environ['CW_LOG_GROUP_NAME'],
logStreamName=stream["logStreamName"]
)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we pull this out into a separate method ?

s3 = session.resource('s3')
bucket = s3.Bucket(os.environ['S3_BUCKET_NAME'])
bucket.objects.filter(Prefix=(output.lower() + "-test/")).delete()


def generate_daemonset_config(throughput):
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

consider break this method into smaller one for readability line 532 - 609 , it too long to read :)

# Clear up testing resources
- python ./load_tests/load_test.py delete_testing_resources
- |
for i in {1..2}; do
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why add retries like this? IIRC I added retries in the python code already, which I think is better than using bash.

@@ -36,7 +36,7 @@ phases:
fi

# Push the image to ECR
- './scripts/publish.sh cicd-publish ${REGION_TO_PUSH}'
- './scripts/publish.sh cicd-publish private-ecr'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why make this change?

@@ -11,7 +11,7 @@ phases:
commands:
# Enforce STS regional endpoints
- export AWS_STS_REGIONAL_ENDPOINTS=regional
- './scripts/publish.sh cicd-publish-ssm ${AWS_REGION}'
- './scripts/publish.sh cicd-publish-ssm'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants