From 43f95ce57dbeb563a3b9af6e65fb70d17e4eb04a Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Wed, 24 Jul 2024 14:39:00 +0200 Subject: [PATCH 01/33] Casc. set develop as casc branch --- blueprints/02-at-scale/casc/oc/items/root.yaml | 4 ++-- blueprints/02-at-scale/casc/oc/variables/variables.yaml | 2 +- blueprints/02-at-scale/k8s/cbci-values.yml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/blueprints/02-at-scale/casc/oc/items/root.yaml b/blueprints/02-at-scale/casc/oc/items/root.yaml index 73de0999..4b5ffaae 100644 --- a/blueprints/02-at-scale/casc/oc/items/root.yaml +++ b/blueprints/02-at-scale/casc/oc/items/root.yaml @@ -53,7 +53,7 @@ items: "cloudbees.prometheus": "true" properties: - configurationAsCode: - bundle: "vault/none-ha" + bundle: "develop/none-ha" # Casc, HA - kind: managedController name: team-c-ha @@ -100,4 +100,4 @@ items: "cloudbees.prometheus": "true" properties: - configurationAsCode: - bundle: "vault/ha" + bundle: "develop/ha" diff --git a/blueprints/02-at-scale/casc/oc/variables/variables.yaml b/blueprints/02-at-scale/casc/oc/variables/variables.yaml index 4634eb29..cda92353 100644 --- a/blueprints/02-at-scale/casc/oc/variables/variables.yaml +++ b/blueprints/02-at-scale/casc/oc/variables/variables.yaml @@ -1,7 +1,7 @@ variables: - message: "Welcome to the CloudBees CI blueprint add-on: At scale!" - scmCascMmStore: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - - cascBranch: vault + - cascBranch: develop - ldapManagerDN: "cn=admin,dc=acme,dc=org" - ldapRootDN: "dc=acme,dc=org" - ldapServer: "openldap-stack.auth.svc.cluster.local" diff --git a/blueprints/02-at-scale/k8s/cbci-values.yml b/blueprints/02-at-scale/k8s/cbci-values.yml index dbdadc85..4d816231 100644 --- a/blueprints/02-at-scale/k8s/cbci-values.yml +++ b/blueprints/02-at-scale/k8s/cbci-values.yml @@ -16,7 +16,7 @@ OperationsCenter: Retriever: Enabled: true scmRepo: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - scmBranch: vault + scmBranch: develop scmBundlePath: blueprints/02-at-scale/casc/oc scmPollingInterval: PT20M Persistence: From 1019b7126ec48af417bd618d3426e7c692180c55 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 26 Jul 2024 17:21:51 +0200 Subject: [PATCH 02/33] casc: adapt names for secrets --- blueprints/02-at-scale/casc/oc/items/root.yaml | 8 ++++---- blueprints/02-at-scale/casc/oc/variables/variables.yaml | 3 ++- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/blueprints/02-at-scale/casc/oc/items/root.yaml b/blueprints/02-at-scale/casc/oc/items/root.yaml index 4b5ffaae..675ec005 100644 --- a/blueprints/02-at-scale/casc/oc/items/root.yaml +++ b/blueprints/02-at-scale/casc/oc/items/root.yaml @@ -35,7 +35,7 @@ items: volumes: - name: cbci-secrets secret: - secretName: cbci-secrets + secretName: ${cascSecretsName} containers: - name: jenkins env: @@ -53,7 +53,7 @@ items: "cloudbees.prometheus": "true" properties: - configurationAsCode: - bundle: "develop/none-ha" + bundle: "cbci-agents-sec-docker/none-ha" # Casc, HA - kind: managedController name: team-c-ha @@ -82,7 +82,7 @@ items: volumes: - name: cbci-secrets secret: - secretName: cbci-secrets + secretName: ${cascSecretsName} containers: - name: jenkins env: @@ -100,4 +100,4 @@ items: "cloudbees.prometheus": "true" properties: - configurationAsCode: - bundle: "develop/ha" + bundle: "cbci-agents-sec-docker/ha" diff --git a/blueprints/02-at-scale/casc/oc/variables/variables.yaml b/blueprints/02-at-scale/casc/oc/variables/variables.yaml index cda92353..5e01c6c5 100644 --- a/blueprints/02-at-scale/casc/oc/variables/variables.yaml +++ b/blueprints/02-at-scale/casc/oc/variables/variables.yaml @@ -1,9 +1,10 @@ variables: - message: "Welcome to the CloudBees CI blueprint add-on: At scale!" - scmCascMmStore: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - - cascBranch: develop + - cascBranch: cbci-agents-sec-docker - ldapManagerDN: "cn=admin,dc=acme,dc=org" - ldapRootDN: "dc=acme,dc=org" - ldapServer: "openldap-stack.auth.svc.cluster.local" - ldapUserSearch: "cn={0}" - vault_url: "http://vault.vault.svc.cluster.local:8200" + - cascSecretsName: "cbci-sec-casc" From 07455e150902952df12fced32d136468fb4db967 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Sun, 28 Jul 2024 08:41:37 +0200 Subject: [PATCH 03/33] casc: preparing agents for Kaniko --- .../casc/mc/parent/jcasc/k8s-agents.yaml | 64 +++++++++++++++++-- .../casc/mc/parent/variables/variables.yaml | 1 + 2 files changed, 58 insertions(+), 7 deletions(-) diff --git a/blueprints/02-at-scale/casc/mc/parent/jcasc/k8s-agents.yaml b/blueprints/02-at-scale/casc/mc/parent/jcasc/k8s-agents.yaml index b4043907..7a7b6203 100644 --- a/blueprints/02-at-scale/casc/mc/parent/jcasc/k8s-agents.yaml +++ b/blueprints/02-at-scale/casc/mc/parent/jcasc/k8s-agents.yaml @@ -1,8 +1,8 @@ kube: podTemplatesConfiguration: templates: - - name: "linux-mavenAndGo" - label: "linux-mavenAndGo" + - name: "linux-mavenAndKaniko" + label: "linux-mavenAndKaniko" nodeUsageMode: "NORMAL" yaml: |- apiVersion: "v1" @@ -25,14 +25,27 @@ kube: - "99d" command: - "sleep" - image: "golang:alpine3.19" - name: "go" + image: "gcr.io/kaniko-project/executor:debug" + imagePullPolicy: Always + name: "kaniko" resources: limits: memory: "1Gi" requests: memory: "500Mi" cpu: "250m" + volumeMounts: + - name: jenkins-docker-cfg + mountPath: /kaniko/.docker + volumes: + - name: jenkins-docker-cfg + projected: + sources: + - secret: + name: ${regSecretsName} + items: + - key: .dockerconfigjson + path: config.json nodeSelector: kubernetes.io/os: linux role: "build-linux" @@ -41,8 +54,8 @@ kube: key: "dedicated" operator: "Equal" value: "build-linux" - - name: "linux-maven-spot" - label: "linux-maven-spot" + - name: "linux-mavenAndKaniko-max" + label: "linux-mavenAndKaniko-max" nodeUsageMode: "NORMAL" yaml: |- apiVersion: "v1" @@ -57,10 +70,35 @@ kube: name: "maven" resources: limits: - memory: "1Gi" + memory: "2Gi" requests: memory: "500Mi" cpu: "250m" + - args: + - "99d" + command: + - "sleep" + image: "gcr.io/kaniko-project/executor:debug" + imagePullPolicy: Always + name: "kaniko" + resources: + limits: + memory: "2Gi" + requests: + memory: "500Mi" + cpu: "250m" + volumeMounts: + - name: jenkins-docker-cfg + mountPath: /kaniko/.docker + volumes: + - name: jenkins-docker-cfg + projected: + sources: + - secret: + name: ${regSecretsName} + items: + - key: .dockerconfigjson + path: config.json nodeSelector: kubernetes.io/os: linux role: "build-linux-spot" @@ -78,8 +116,20 @@ kube: containers: - name: jnlp image: jenkins/inbound-agent:windowsservercore-1809 + resources: + limits: + memory: "1Gi" + requests: + memory: "500Mi" + cpu: "250m" - name: shell image: mcr.microsoft.com/powershell:preview-windowsservercore-1809 + resources: + limits: + memory: "1Gi" + requests: + memory: "500Mi" + cpu: "250m" command: - powershell args: diff --git a/blueprints/02-at-scale/casc/mc/parent/variables/variables.yaml b/blueprints/02-at-scale/casc/mc/parent/variables/variables.yaml index 9bcb6e10..22630208 100644 --- a/blueprints/02-at-scale/casc/mc/parent/variables/variables.yaml +++ b/blueprints/02-at-scale/casc/mc/parent/variables/variables.yaml @@ -1,3 +1,4 @@ variables: - ot_endpoint: "http://tempo.kube-prometheus-stack.svc.cluster.local:4317" - s3bucketPreffix: "cbci/" + - regSecretsName: "cbci-sec-casc" \ No newline at end of file From 1f3e55e4175d2a3507da4c71639c19e6bf4f4f8d Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Sun, 28 Jul 2024 23:44:25 +0200 Subject: [PATCH 04/33] Casc: Moving folder inside cbci --- .../02-at-scale/{ => cbci}/casc/mc/ha/bundle.yaml | 0 .../{ => cbci}/casc/mc/ha/jcasc/main.yaml | 0 .../{ => cbci}/casc/mc/none-ha/bundle.yaml | 0 .../{ => cbci}/casc/mc/none-ha/jcasc/main.yaml | 0 .../{ => cbci}/casc/mc/parent/bundle.yaml | 0 .../casc/mc/parent/items/admin-folder.yaml | 0 .../casc/mc/parent/items/squad_x-folder.yaml | 0 .../casc/mc/parent/items/squad_y-folder.yaml | 0 .../casc/mc/parent/jcasc/k8s-agents.yaml | 0 .../{ => cbci}/casc/mc/parent/jcasc/main.yaml | 0 .../{ => cbci}/casc/mc/parent/jcasc/security.yaml | 0 .../{ => cbci}/casc/mc/parent/jcasc/support.yaml | 0 .../{ => cbci}/casc/mc/parent/plugins/plugins.yaml | 0 .../{ => cbci}/casc/mc/parent/rbac/rbac.yaml | 0 .../casc/mc/parent/variables/variables.yaml | 0 .../02-at-scale/{ => cbci}/casc/oc/bundle.yaml | 0 .../{ => cbci}/casc/oc/items/admin-folder.yaml | 0 .../02-at-scale/{ => cbci}/casc/oc/items/root.yaml | 0 .../02-at-scale/{ => cbci}/casc/oc/jcasc/main.yaml | 2 +- .../{ => cbci}/casc/oc/jcasc/security.yaml | 14 -------------- .../{ => cbci}/casc/oc/jcasc/support.yaml | 0 .../{ => cbci}/casc/oc/plugins/plugins.yaml | 0 .../02-at-scale/{ => cbci}/casc/oc/rbac/rbac.yaml | 0 .../{ => cbci}/casc/oc/variables/variables.yaml | 0 blueprints/02-at-scale/k8s/vault-config.sh | 2 +- 25 files changed, 2 insertions(+), 16 deletions(-) rename blueprints/02-at-scale/{ => cbci}/casc/mc/ha/bundle.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/ha/jcasc/main.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/none-ha/bundle.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/none-ha/jcasc/main.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/parent/bundle.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/parent/items/admin-folder.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/parent/items/squad_x-folder.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/parent/items/squad_y-folder.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/parent/jcasc/k8s-agents.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/parent/jcasc/main.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/parent/jcasc/security.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/parent/jcasc/support.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/parent/plugins/plugins.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/parent/rbac/rbac.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/mc/parent/variables/variables.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/oc/bundle.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/oc/items/admin-folder.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/oc/items/root.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/oc/jcasc/main.yaml (95%) rename blueprints/02-at-scale/{ => cbci}/casc/oc/jcasc/security.yaml (77%) rename blueprints/02-at-scale/{ => cbci}/casc/oc/jcasc/support.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/oc/plugins/plugins.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/oc/rbac/rbac.yaml (100%) rename blueprints/02-at-scale/{ => cbci}/casc/oc/variables/variables.yaml (100%) diff --git a/blueprints/02-at-scale/casc/mc/ha/bundle.yaml b/blueprints/02-at-scale/cbci/casc/mc/ha/bundle.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/ha/bundle.yaml rename to blueprints/02-at-scale/cbci/casc/mc/ha/bundle.yaml diff --git a/blueprints/02-at-scale/casc/mc/ha/jcasc/main.yaml b/blueprints/02-at-scale/cbci/casc/mc/ha/jcasc/main.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/ha/jcasc/main.yaml rename to blueprints/02-at-scale/cbci/casc/mc/ha/jcasc/main.yaml diff --git a/blueprints/02-at-scale/casc/mc/none-ha/bundle.yaml b/blueprints/02-at-scale/cbci/casc/mc/none-ha/bundle.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/none-ha/bundle.yaml rename to blueprints/02-at-scale/cbci/casc/mc/none-ha/bundle.yaml diff --git a/blueprints/02-at-scale/casc/mc/none-ha/jcasc/main.yaml b/blueprints/02-at-scale/cbci/casc/mc/none-ha/jcasc/main.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/none-ha/jcasc/main.yaml rename to blueprints/02-at-scale/cbci/casc/mc/none-ha/jcasc/main.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/bundle.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/bundle.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/bundle.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/bundle.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/items/admin-folder.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/items/squad_x-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/squad_x-folder.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/items/squad_x-folder.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/items/squad_x-folder.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/items/squad_y-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/squad_y-folder.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/items/squad_y-folder.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/items/squad_y-folder.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/jcasc/k8s-agents.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/jcasc/k8s-agents.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/jcasc/main.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/jcasc/main.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/jcasc/security.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/security.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/jcasc/security.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/security.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/jcasc/support.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/support.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/jcasc/support.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/support.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/plugins/plugins.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/plugins/plugins.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/plugins/plugins.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/plugins/plugins.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/rbac/rbac.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/rbac/rbac.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/rbac/rbac.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/rbac/rbac.yaml diff --git a/blueprints/02-at-scale/casc/mc/parent/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml similarity index 100% rename from blueprints/02-at-scale/casc/mc/parent/variables/variables.yaml rename to blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml diff --git a/blueprints/02-at-scale/casc/oc/bundle.yaml b/blueprints/02-at-scale/cbci/casc/oc/bundle.yaml similarity index 100% rename from blueprints/02-at-scale/casc/oc/bundle.yaml rename to blueprints/02-at-scale/cbci/casc/oc/bundle.yaml diff --git a/blueprints/02-at-scale/casc/oc/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/oc/items/admin-folder.yaml similarity index 100% rename from blueprints/02-at-scale/casc/oc/items/admin-folder.yaml rename to blueprints/02-at-scale/cbci/casc/oc/items/admin-folder.yaml diff --git a/blueprints/02-at-scale/casc/oc/items/root.yaml b/blueprints/02-at-scale/cbci/casc/oc/items/root.yaml similarity index 100% rename from blueprints/02-at-scale/casc/oc/items/root.yaml rename to blueprints/02-at-scale/cbci/casc/oc/items/root.yaml diff --git a/blueprints/02-at-scale/casc/oc/jcasc/main.yaml b/blueprints/02-at-scale/cbci/casc/oc/jcasc/main.yaml similarity index 95% rename from blueprints/02-at-scale/casc/oc/jcasc/main.yaml rename to blueprints/02-at-scale/cbci/casc/oc/jcasc/main.yaml index 2983a2fe..2d246952 100644 --- a/blueprints/02-at-scale/casc/oc/jcasc/main.yaml +++ b/blueprints/02-at-scale/cbci/casc/oc/jcasc/main.yaml @@ -22,7 +22,7 @@ unclassified: - sparseCheckoutPaths: extension: sparseCheckoutPaths: - - path: "/blueprints/02-at-scale/casc/mc/" + - path: "/blueprints/02-at-scale/cbci/casc/mc/" cascAutoControllerProvisioning: provisionControllerOnCreation: true buildDiscarders: diff --git a/blueprints/02-at-scale/casc/oc/jcasc/security.yaml b/blueprints/02-at-scale/cbci/casc/oc/jcasc/security.yaml similarity index 77% rename from blueprints/02-at-scale/casc/oc/jcasc/security.yaml rename to blueprints/02-at-scale/cbci/casc/oc/jcasc/security.yaml index c94f6139..bdcb33ac 100644 --- a/blueprints/02-at-scale/casc/oc/jcasc/security.yaml +++ b/blueprints/02-at-scale/cbci/casc/oc/jcasc/security.yaml @@ -24,20 +24,6 @@ globalCredentialsConfiguration: url: "${vault_url}" credentials: system: - domainCredentials: - - credentials: - - usernamePassword: - description: "GH-User-token" - id: "GH-User-token" - password: ${sec_githubUser} - scope: GLOBAL - username: ${sec_githubToken} - usernameSecret: true - - string: - description: "GH-ST-token" - id: "GH-ST-token" - scope: GLOBAL - secret: ${sec_githubToken} cloudbeesHashicorpVault: domainCredentials: - credentials: diff --git a/blueprints/02-at-scale/casc/oc/jcasc/support.yaml b/blueprints/02-at-scale/cbci/casc/oc/jcasc/support.yaml similarity index 100% rename from blueprints/02-at-scale/casc/oc/jcasc/support.yaml rename to blueprints/02-at-scale/cbci/casc/oc/jcasc/support.yaml diff --git a/blueprints/02-at-scale/casc/oc/plugins/plugins.yaml b/blueprints/02-at-scale/cbci/casc/oc/plugins/plugins.yaml similarity index 100% rename from blueprints/02-at-scale/casc/oc/plugins/plugins.yaml rename to blueprints/02-at-scale/cbci/casc/oc/plugins/plugins.yaml diff --git a/blueprints/02-at-scale/casc/oc/rbac/rbac.yaml b/blueprints/02-at-scale/cbci/casc/oc/rbac/rbac.yaml similarity index 100% rename from blueprints/02-at-scale/casc/oc/rbac/rbac.yaml rename to blueprints/02-at-scale/cbci/casc/oc/rbac/rbac.yaml diff --git a/blueprints/02-at-scale/casc/oc/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml similarity index 100% rename from blueprints/02-at-scale/casc/oc/variables/variables.yaml rename to blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml diff --git a/blueprints/02-at-scale/k8s/vault-config.sh b/blueprints/02-at-scale/k8s/vault-config.sh index 619d9a1a..a09c0358 100644 --- a/blueprints/02-at-scale/k8s/vault-config.sh +++ b/blueprints/02-at-scale/k8s/vault-config.sh @@ -25,7 +25,7 @@ done # https://developer.hashicorp.com/vault/tutorials/auth-methods/approle ## Login as admin using token kubectl exec -it vault-0 -n "$vault_ns" -- vault login -## Create the secrets to be mapped from CloudBees CI +## Create example secrets to be mapped from CloudBees CI kubectl exec -it vault-0 -n "$vault_ns" -- vault secrets enable --version=2 --path=secret-v2 kv || echo "Path is already enabled" kubectl exec -it vault-0 -n "$vault_ns" -- vault kv put "secret-v2/$approle/secret-a" username="userVaultExample" password="passw0rdVaultExample" kubectl exec -it vault-0 -n "$vault_ns" -- vault kv put "secret-v2/$approle/secret-b" secret="secretVaultExample" From 128c2452e22c1466cc75764780ea736c229a12d8 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Sun, 28 Jul 2024 23:53:50 +0200 Subject: [PATCH 05/33] inrease pre-commit version --- .pre-commit-config.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 876bb7c7..cb59612c 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -23,7 +23,7 @@ repos: - id: check-vcs-permalinks - repo: https://github.com/antonbabenko/pre-commit-terraform - rev: v1.81.0 + rev: v1.92.0 hooks: - id: terraform_fmt name: Format Terraform Configuration @@ -33,7 +33,7 @@ repos: - --hook-config=--retry-once-with-cleanup=true - id: terraform_tflint args: - - '--args=--only=terraform_deprecated_interpolation' + #- '--args=--only=terraform_deprecated_interpolation' - '--args=--only=terraform_deprecated_index' - '--args=--only=terraform_unused_declarations' - '--args=--only=terraform_comment_syntax' From e673f67e941818754475984013e24a2c5e71d990 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 29 Jul 2024 13:13:31 +0200 Subject: [PATCH 06/33] casc: Adapting the new templates --- .../casc/mc/parent/items/admin-folder.yaml | 25 +++++-------------- .../cbci/casc/mc/parent/jcasc/k8s-agents.yaml | 8 +++--- .../casc/mc/parent/variables/variables.yaml | 2 +- 3 files changed, 11 insertions(+), 24 deletions(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml index ceb55391..66531624 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml @@ -16,7 +16,7 @@ items: script: |- timeout(time: 1, unit: 'HOURS'){ parallel([0, 1].collectEntries {b -> ["branch-$b", { - podTemplate (inheritFrom: 'linux-mavenAndGo') { + podTemplate (inheritFrom: 'linux-mavenAndKaniko-L') { node(POD_LABEL) { retry (3) { stage('prep') { @@ -101,7 +101,7 @@ items: script: |- pipeline { agent{ - label 'linux-maven-spot' + label 'linux-mavenAndKaniko-XL' } options { retry(3) @@ -129,11 +129,6 @@ items: } } } - post { - failure { - echo "Check Manage Jenkins > AWS > Amazon S3 Bucket Access settings matches with your s3 name terraform output!" - } - } } description: 'It validates archives/unarchive s3 artifacts (https://plugins.jenkins.io/artifact-manager-s3/) from different pods agents in different build. It uses artifacts from upstream build.' displayName: downstream-artifact @@ -150,14 +145,14 @@ items: timeout(time: 1, unit: 'HOURS') } agent{ - label 'linux-mavenAndGo' + label 'linux-mavenAndKaniko-L' } stages { stage('Golang') { stages { stage ('Build'){ steps { - container('go') { + container('kaniko') { sh ''' echo "Build number ^${BUILD_NUMBER}" >> f_1 go version >> f_1 @@ -167,7 +162,7 @@ items: } stage ('Archive f_1'){ steps { - container('go') { + container('kaniko') { archiveArtifacts artifacts: 'f_1', fingerprint: true } } @@ -208,11 +203,6 @@ items: } } } - post { - failure { - echo "Check Manage Jenkins > AWS > Amazon S3 Bucket Access settings matches with your s3 name terraform output!" - } - } } description: 'It validates archives/unarchive s3 artifacts (https://plugins.jenkins.io/artifact-manager-s3/) from different pods agents in different build. It creates artifacts for downstream build.' displayName: upstream-artifact @@ -256,7 +246,7 @@ items: timeout(time: 1, unit: 'HOURS') } agent{ - label 'linux-mavenAndGo' + label 'linux-mavenAndKaniko-L' } environment { MAVEN_PROJECT = 'https://github.com/jglick/simple-maven-project-with-tests' @@ -285,9 +275,6 @@ items: success { writeCache name: env.CACHE, includes: 'maven-repo/**' } - failure { - echo "Check Manage Jenkins > AWS > Amazon S3 Bucket Access settings matches with your s3 name terraform output!" - } } } description: 'Pipeline that demonstrates the usage of CloudBees Workspace Caching: https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-cache-step.' diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml index 7a7b6203..56157b6b 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml @@ -1,8 +1,8 @@ kube: podTemplatesConfiguration: templates: - - name: "linux-mavenAndKaniko" - label: "linux-mavenAndKaniko" + - name: "linux-mavenAndKaniko-L" + label: "linux-mavenAndKaniko-L" nodeUsageMode: "NORMAL" yaml: |- apiVersion: "v1" @@ -54,8 +54,8 @@ kube: key: "dedicated" operator: "Equal" value: "build-linux" - - name: "linux-mavenAndKaniko-max" - label: "linux-mavenAndKaniko-max" + - name: "linux-mavenAndKaniko-XL" + label: "linux-mavenAndKaniko-XL" nodeUsageMode: "NORMAL" yaml: |- apiVersion: "v1" diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml index 22630208..99faab96 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml @@ -1,4 +1,4 @@ variables: - ot_endpoint: "http://tempo.kube-prometheus-stack.svc.cluster.local:4317" - s3bucketPreffix: "cbci/" - - regSecretsName: "cbci-sec-casc" \ No newline at end of file + - regSecretsName: "cbci-sec-reg" \ No newline at end of file From 72d59bfb2e769751f50b84ae88479ea563146e8c Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 29 Jul 2024 16:09:06 +0200 Subject: [PATCH 07/33] casc: add items resolution --- blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml index ff7bd993..63905005 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml @@ -36,6 +36,9 @@ unclassified: gracePeriod: 3600 openTelemetry: endpoint: ${ot_endpoint} + cascItemsConfiguration: + variableInterpolationEnabledForAdmin: true + variableInterpolationEnabledForNonAdmin: true aws: s3: container: "${sec_s3bucketName}" From 0a2fe5ec24ab727c665775a6174cea1cda497457 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 29 Jul 2024 16:10:17 +0200 Subject: [PATCH 08/33] casc: Adapting templates to kaniko --- .../casc/mc/parent/items/admin-folder.yaml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml index 66531624..215fdf81 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml @@ -66,7 +66,7 @@ items: sandbox: true script: |- timeout(time: 1, unit: 'HOURS'){ - podTemplate (inheritFrom: 'linux-mavenAndGo') { + podTemplate (inheritFrom: 'linux-mavenAndKaniko-L') { retry (3) { node(POD_LABEL) { stage('beginning') { @@ -77,7 +77,7 @@ items: } } checkpoint 'middle' - podTemplate (inheritFrom: 'linux-maven-spot') { + podTemplate (inheritFrom: 'linux-mavenAndKaniko-XL') { retry (3) { node(POD_LABEL) { stage('end') { @@ -148,14 +148,14 @@ items: label 'linux-mavenAndKaniko-L' } stages { - stage('Golang') { + stage('Maven') { stages { stage ('Build'){ steps { - container('kaniko') { + container('maven') { sh ''' - echo "Build number ^${BUILD_NUMBER}" >> f_1 - go version >> f_1 + echo "Build number ^^${BUILD_NUMBER}" >> f_1 + mvn -version >> f_1 ''' } } @@ -169,7 +169,7 @@ items: } } } - stage('Busybox') { + stage('Kaniko') { stages { stage ("Unarchive"){ steps { @@ -184,9 +184,9 @@ items: } stage ('Build'){ steps { - container('maven') { + container('kaniko') { dir ('unarchive'){ - sh 'mvn -version >> f_2' + sh 'ls /kaniko/executor >> f_2' } } } From 50b6d0c16b324e991b1d4925706a986727b8cc59 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 29 Jul 2024 17:53:12 +0200 Subject: [PATCH 09/33] casc: Variable interpolation enable admin --- blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml index 63905005..af7e1576 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml @@ -38,7 +38,6 @@ unclassified: endpoint: ${ot_endpoint} cascItemsConfiguration: variableInterpolationEnabledForAdmin: true - variableInterpolationEnabledForNonAdmin: true aws: s3: container: "${sec_s3bucketName}" From 5ac56bcd37ba05fb6537263270834ad4167739c7 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 29 Jul 2024 19:51:04 +0200 Subject: [PATCH 10/33] casc: adding kaniko validations --- .../casc/mc/parent/items/admin-folder.yaml | 46 +++++++++++++++---- 1 file changed, 37 insertions(+), 9 deletions(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml index 215fdf81..39019666 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml @@ -303,12 +303,40 @@ items: } } } - description: '' - properties: - - envVars: {} - - itemRestrictions: - filter: false - properties: - - envVars: {} - - itemRestrictions: - filter: false + description: 'It validates that credentials from Vault are fetched correctly.' + - kind: pipeline + name: kaniko + concurrentBuild: true + definition: + cpsFlowDefinition: + sandbox: true + script: | + pipeline { + agent { + label 'linux-mavenAndKaniko-XL' + } + parameters { + string(name: 'TARGET_DH_ORG', description: 'DockerHub Organization to Push the image') + } + stages { + stage('Build with Kaniko') { + steps { + container(name: 'kaniko', shell: '/busybox/sh') { + sh '''#!/busybox/sh + echo "FROM jenkins/inbound-agent:latest" > Dockerfile + /kaniko/executor --context `pwd` --destination $TARGET_DH_ORG/hello-kaniko:latest + ''' + } + } + } + } + } + properties: + - parameters: + parameterDefinitions: + - string: + trim: false + name: TARGET_DH_ORG + description: DockerHub Organization to Push the image + resumeBlocked: false + description: 'It validates that Authentication for DockerHub and Kaniko is working fine.' From ec8e8ffcbe122601412b39bb9bd844136bfb1681 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 29 Jul 2024 19:54:15 +0200 Subject: [PATCH 11/33] [root] adapting for Kaniko crendentials --- README.md | 14 +++++++---- main.tf | 53 ++++++++++++++++++++++++++++++++-------- outputs.tf | 11 ++++++--- variables.tf | 69 ++++++++++++++++++++++++++++++++++++++++++++++------ 4 files changed, 122 insertions(+), 25 deletions(-) diff --git a/README.md b/README.md index ce7f3b36..90ec773f 100644 --- a/README.md +++ b/README.md @@ -19,8 +19,8 @@ The CloudBees CI [AWS partner add-on](https://aws-ia.github.io/terraform-aws-eks-blueprints-addons/main/aws-partner-addons/) streamlines the adoption and experimentation of CloudBees CI enterprise features by: -- Encapsulating the deployment of [CloudBees CI on modern platforms in AWS EKS](https://docs.cloudbees.com/docs/cloudbees-ci/latest/eks-install-guide/installing-eks-using-helm#_configuring_your_environment) into a Terraform module. -- Providing a series of [blueprints](https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon/tree/main/blueprints) that implement the CloudBees CI add-on module for use with [Amazon EKS blueprints for Terraform](https://aws-ia.github.io/terraform-aws-eks-blueprints-addons/main/), which are aligned with the [EKS Best Practices Guides](https://aws.github.io/aws-eks-best-practices/). +- Encapsulating the deployment of [CloudBees CI on modern platforms in AWS EKS](https://docs.cloudbees.com/docs/cloudbees-ci/latest/eks-install-guide/installing-eks-using-helm#_configuring_your_environment) and additional k8s resources into a Terraform module. +- Providing a series of opinionated [blueprints](https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon/tree/main/blueprints) that implement the CloudBees CI add-on module for use with [Amazon EKS blueprints for Terraform](https://aws-ia.github.io/terraform-aws-eks-blueprints-addons/main/), which are aligned with the [EKS Best Practices Guides](https://aws.github.io/aws-eks-best-practices/). ## Usage @@ -95,10 +95,13 @@ The CloudBees CI add-on uses `helms release` for its resources definition, makin | cert_arn | AWS Certificate Manager (ACM) certificate for Amazon Resource Names (ARN). | `string` | n/a | yes | | hosted_zone | Amazon Route 53 hosted zone name. | `string` | n/a | yes | | trial_license | CloudBees CI trial license details for evaluation. | `map(string)` | n/a | yes | -| create_k8s_secrets | Create the Kubernetes secret cbci-secrets and mount into the Operation Center /run/secrets/ path to be consumed by CloudBees CasC. | `bool` | `false` | no | +| casc_secrets_file | Secrets .yml file path containing the names:values secrets. It is required when create_casc_secrets is enabled. | `string` | `"secrets-values.yml"` | no | +| create_casc_secrets | Create a Kubernetes basic secret for CloudBees Configuration as Code (cbci-sec-casc) and mount it into the Operation Center /var/run/secrets/cbci. | `bool` | `false` | no | +| create_reg_secret | Create a Kubernetes dockerconfigjson secret for Container Registry authentication (cbci-sec-reg) for CI builds agents. | `bool` | `false` | no | | helm_config | CloudBees CI Helm chart configuration. | `any` | 
{
  "values": [
    ""
  ]
}
| no | -| k8s_secrets | Secrets .yml file as a string containing the names:values secrets. It is required when create_k8s_secrets is enabled. | `string` | `"secrets-values.yml"` | no | | prometheus_target | Creates a service monitor to discover the CloudBees CI Prometheus target dynamically. It is designed to be enabled with the AWS EKS Terraform Addon Kube Prometheus Stack. | `bool` | `false` | no | +| reg_secret_auth | Registry server authentication details for cbci-sec-reg secret. It is required when create_reg_secret is enabled. | `map(string)` | 
{
  "email": "foo.bar@acme.com",
  "password": "changeme1234",
  "server": "my-registry.acme:5000",
  "username": "foo"
}
| no | +| reg_secret_ns | Agent Namespace to allocate cbci-sec-reg secret. It is required when create_reg_secret is enabled. | `string` | `"cbci"` | no | ### Outputs @@ -111,7 +114,8 @@ The CloudBees CI add-on uses `helms release` for its resources definition, makin | cbci_oc_ing | Operations center Ingress for the CloudBees CI add-on. | | cbci_oc_pod | Operations center pod for the CloudBees CI add-on. | | cbci_oc_url | Operations center URL for the CloudBees CI add-on using a subdomain and certificates. | -| cbci_secrets | Optional. Kubernetes secrets name for CloudBees CI. | +| cbci_sec_casc | Optional. Kubernetes secrets name for CloudBees CI Casc. | +| cbci_sec_registry | Optional. Kubernetes secrets name for CloudBees CI agents to autheticate to registry. | | merged_helm_config | (merged) Helm configuration for CloudBees CI. | diff --git a/main.tf b/main.tf index 4a53ac3d..57cc87d9 100644 --- a/main.tf +++ b/main.tf @@ -1,9 +1,12 @@ # Copyright (c) CloudBees, Inc. locals { - cbci_ns = "cbci" - cbci_secrets_name = "cbci-secrets" - create_secret = alltrue([var.create_k8s_secrets, length(var.k8s_secrets) > 0]) + cbci_ns = "cbci" + cbci_sec_casc_name = "cbci-sec-casc" + cbci_sec_registry_name = "cbci-sec-reg" + create_secret_casc = alltrue([var.create_casc_secrets, length(var.casc_secrets_file) > 0]) + create_secret_reg = alltrue([var.create_reg_secret, length(var.reg_secret_ns) > 0, length(var.reg_secret_auth) > 0]) + #This section needs to be included in controllers to make use of the CBCI Casc Secrets oc_secrets_mount = [ <<-EOT OperationsCenter: @@ -13,7 +16,7 @@ locals { ExtraVolumes: - name: cbci-secrets secret: - secretName: ${local.cbci_secrets_name} + secretName: ${local.cbci_sec_casc_name} ExtraVolumeMounts: - name: cbci-secrets mountPath: /var/run/secrets/cbci @@ -48,15 +51,45 @@ resource "kubernetes_namespace" "cbci" { # Kubernetes Secrets to be passed to Casc # https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets -resource "kubernetes_secret" "oc_secrets" { - count = local.create_secret ? 1 : 0 +resource "kubernetes_secret" "cbci_sec_casc" { + count = local.create_secret_casc ? 1 : 0 metadata { - name = local.cbci_secrets_name + name = local.cbci_sec_casc_name namespace = kubernetes_namespace.cbci[0].metadata[0].name } - data = yamldecode(var.k8s_secrets) + type = "Opaque" + + data = yamldecode(var.casc_secrets_file) + +} + +# Kubernetes Secrets to authenticate with DockerHub +# https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/using-kaniko#_create_a_new_kubernetes_secret +resource "kubernetes_secret" "cbci_sec_reg" { + count = local.create_secret_reg ? 1 : 0 + # Agent namespace needs to be created before creating this secret + depends_on = [helm_release.cloudbees_ci] + metadata { + name = local.cbci_sec_registry_name + namespace = var.reg_secret_ns + } + + type = "kubernetes.io/dockerconfigjson" + + data = { + ".dockerconfigjson" = jsonencode({ + auths = { + "${var.reg_secret_auth["server"]}" = { + "username" = var.reg_secret_auth["username"] + "password" = var.reg_secret_auth["password"] + "email" = var.reg_secret_auth["email"] + "auth" = base64encode("${var.reg_secret_auth["username"]}:${var.reg_secret_auth["password"]}") + } + } + }) + } } resource "kubectl_manifest" "service_monitor_cb_controllers" { @@ -90,7 +123,7 @@ resource "kubernetes_labels" "oc_sm_label" { api_version = "v1" kind = "Service" - # This is true because the resources was already created by the + # This is true because the resources was already created by the helm_release force = "true" metadata { @@ -110,7 +143,7 @@ resource "helm_release" "cloudbees_ci" { #vCBCI_Helm# version = try(var.helm_config.version, "3.18306.0+b5ad27c80a6b") repository = try(var.helm_config.repository, "https://public-charts.artifacts.cloudbees.com/repository/public/") - values = local.create_secret ? concat(var.helm_config.values, local.oc_secrets_mount, [templatefile("${path.module}/values.yml", local.cbci_template_values)]) : concat(var.helm_config.values, [templatefile("${path.module}/values.yml", local.cbci_template_values)]) + values = local.create_secret_casc ? concat(var.helm_config.values, local.oc_secrets_mount, [templatefile("${path.module}/values.yml", local.cbci_template_values)]) : concat(var.helm_config.values, [templatefile("${path.module}/values.yml", local.cbci_template_values)]) timeout = try(var.helm_config.timeout, 1200) repository_key_file = try(var.helm_config.repository_key_file, null) repository_cert_file = try(var.helm_config.repository_cert_file, null) diff --git a/outputs.tf b/outputs.tf index 3cd7115c..2f349e3e 100644 --- a/outputs.tf +++ b/outputs.tf @@ -40,7 +40,12 @@ output "cbci_liveness_probe_ext" { value = "curl -sSf https://cjoc.${var.hosted_zone}/whoAmI/api/json?tree=authenticated > /dev/null" } -output "cbci_secrets" { - description = "Optional. Kubernetes secrets name for CloudBees CI." - value = local.create_secret ? kubernetes_secret.oc_secrets[0].metadata[0].name : "No secrets created" +output "cbci_sec_casc" { + description = "Optional. Kubernetes secrets name for CloudBees CI Casc." + value = local.create_secret_casc ? kubernetes_secret.cbci_sec_casc[0].metadata[0].name : "No secrets created" +} + +output "cbci_sec_registry" { + description = "Optional. Kubernetes secrets name for CloudBees CI agents to autheticate to registry." + value = local.create_secret_reg ? kubernetes_secret.cbci_sec_reg[0].metadata[0].name : "No secrets created" } diff --git a/variables.tf b/variables.tf index ee6fd9fa..0a06ceaa 100644 --- a/variables.tf +++ b/variables.tf @@ -15,9 +15,13 @@ variable "hosted_zone" { description = "Amazon Route 53 hosted zone name." type = string validation { - condition = trim(var.hosted_zone, " ") != "" + condition = length(trimspace(var.hosted_zone)) > 0 error_message = "Host name must not be an empty string." } + validation { + condition = can(regex("^([a-zA-Z0-9-]+\\.)+[a-zA-Z]+$", var.hosted_zone)) + error_message = "Host name must be a valid domain name." + } } variable "cert_arn" { @@ -25,26 +29,77 @@ variable "cert_arn" { type = string validation { - condition = can(regex("^arn", var.cert_arn)) - error_message = "The cert_arn should start with ARN." + condition = can(regex("^arn:aws:acm:", var.cert_arn)) + error_message = "The cert_arn should be a valid ACM certificate ARN." + } + validation { + condition = length(var.cert_arn) > 0 + error_message = "The cert_arn must not be an empty string." } } variable "trial_license" { description = "CloudBees CI trial license details for evaluation." type = map(string) + validation { + condition = contains(keys(var.trial_license), "first_name") && contains(keys(var.trial_license), "last_name") && contains(keys(var.trial_license), "email") && contains(keys(var.trial_license), "company") + error_message = "trial_license must contain the following keys: first_name, last_name, email, company." + } + validation { + condition = length(var.trial_license) == 4 + error_message = "The map must contain 4 keys." + } } -variable "create_k8s_secrets" { - description = "Create the Kubernetes secret cbci-secrets and mount into the Operation Center /run/secrets/ path to be consumed by CloudBees CasC." +variable "create_casc_secrets" { + description = "Create a Kubernetes basic secret for CloudBees Configuration as Code (cbci-sec-casc) and mount it into the Operation Center /var/run/secrets/cbci." default = false type = bool } -variable "k8s_secrets" { - description = "Secrets .yml file as a string containing the names:values secrets. It is required when create_k8s_secrets is enabled." +variable "casc_secrets_file" { + description = "Secrets .yml file path containing the names:values secrets. It is required when create_casc_secrets is enabled." default = "secrets-values.yml" type = string + validation { + condition = length(trimspace(var.casc_secrets_file)) > 0 + error_message = "Casc secret file must not be an empty string." + } +} + +variable "create_reg_secret" { + description = "Create a Kubernetes dockerconfigjson secret for Container Registry authentication (cbci-sec-reg) for CI builds agents." + default = false + type = bool +} + +variable "reg_secret_ns" { + description = "Agent Namespace to allocate cbci-sec-reg secret. It is required when create_reg_secret is enabled." + default = "cbci" + type = string + validation { + condition = length(trimspace(var.reg_secret_ns)) > 0 + error_message = "Agent Namespace must not be an empty string." + } +} + +variable "reg_secret_auth" { + description = "Registry server authentication details for cbci-sec-reg secret. It is required when create_reg_secret is enabled." + type = map(string) + default = { + server = "my-registry.acme:5000" + username = "foo" + password = "changeme1234" + email = "foo.bar@acme.com" + } + validation { + condition = contains(keys(var.reg_secret_auth), "server") && contains(keys(var.reg_secret_auth), "username") && contains(keys(var.reg_secret_auth), "password") && contains(keys(var.reg_secret_auth), "email") + error_message = "reg_server must contain the following keys: server, username, password and email." + } + validation { + condition = length(var.reg_secret_auth) == 4 + error_message = "reg_server must contain 4 keys." + } } variable "prometheus_target" { From 477eca6b5c0e05e745e2ebb5b520d7378baf64ed Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 29 Jul 2024 20:00:27 +0200 Subject: [PATCH 12/33] replace naming to Workload --- blueprints/01-getting-started/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/01-getting-started/README.md b/blueprints/01-getting-started/README.md index 23e8a1c1..b56ae0ff 100644 --- a/blueprints/01-getting-started/README.md +++ b/blueprints/01-getting-started/README.md @@ -19,7 +19,7 @@ This blueprint presents the minimum setup to run CloudBees CI on Amazon EKS; one - Instance type: [Graviton Processor](https://aws.amazon.com/ec2/graviton/) family. - Amazon Machine Image (AMI) type: [Amazon EKS-Optimized Amazon Linux 2023](https://aws.amazon.com/blogs/containers/amazon-eks-optimized-amazon-linux-2023-amis-now-available/) -### Kubernetes cluster +### Workloads ![K8sApps](img/getting-started.k8s.drawio.svg) From f4af3750bb13d0afaa1b13a3b66ff2800f5edeba Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 29 Jul 2024 20:00:48 +0200 Subject: [PATCH 13/33] Using cbci-agents-sec-docker as branch --- blueprints/02-at-scale/k8s/cbci-values.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/blueprints/02-at-scale/k8s/cbci-values.yml b/blueprints/02-at-scale/k8s/cbci-values.yml index 4d816231..10f899ac 100644 --- a/blueprints/02-at-scale/k8s/cbci-values.yml +++ b/blueprints/02-at-scale/k8s/cbci-values.yml @@ -16,8 +16,8 @@ OperationsCenter: Retriever: Enabled: true scmRepo: "https://github.com/cloudbees/terraform-aws-cloudbees-ci-eks-addon.git" - scmBranch: develop - scmBundlePath: blueprints/02-at-scale/casc/oc + scmBranch: cbci-agents-sec-docker + scmBundlePath: blueprints/02-at-scale/cbci/casc/oc scmPollingInterval: PT20M Persistence: StorageClass: efs From 9fe49a2130e539c4b7619b8d0d48ca2385e5a3e3 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Mon, 29 Jul 2024 20:05:06 +0200 Subject: [PATCH 14/33] [bp 02] Including Kaniko --- blueprints/02-at-scale/.auto.tfvars.example | 7 +- blueprints/02-at-scale/README.md | 35 +- .../02-at-scale/img/at-scale.k8s.drawio.svg | 511 ++++++++++-------- blueprints/02-at-scale/k8s/secrets-values.yml | 6 +- blueprints/02-at-scale/main.tf | 23 +- blueprints/02-at-scale/outputs.tf | 11 +- blueprints/02-at-scale/variables.tf | 49 +- 7 files changed, 374 insertions(+), 268 deletions(-) diff --git a/blueprints/02-at-scale/.auto.tfvars.example b/blueprints/02-at-scale/.auto.tfvars.example index 6aacc423..2444aca2 100644 --- a/blueprints/02-at-scale/.auto.tfvars.example +++ b/blueprints/02-at-scale/.auto.tfvars.example @@ -7,8 +7,11 @@ trial_license = { # Required. CloudBees CI Trial license details for evaluation. company = "Acme Inc." } -gh_user = "exampleUser" # Required. Default values can be used for demo. -gh_token = "ExampleToken1234" # Required. Default values can be used for demo. +dh_reg_secret_auth = { # Required. + username = "foo" + password = "d0ckerPass12" + email = "foo.bar@acme.com" +} # tags = { # Optional. Tags for the resources created. Default set to empty. Shared among all. # "cb-owner" : "team-services" diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 3972c625..5fa3a7bd 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -53,7 +53,7 @@ This blueprint divides scalable node groups for different types of workloads: ![Architecture](img/at-scale.architect.drawio.svg) -### Kubernetes cluster +### Workloads ![K8sApps](img/at-scale.k8s.drawio.svg) @@ -81,6 +81,7 @@ This blueprint divides scalable node groups for different types of workloads: | aws_backup_efs_protected_resource | AWS description for the Amazon EFS drive that is used to back up protected resources. | | aws_logstreams_fluentbit | AWS CloudWatch log streams from Fluent Bit. | | cbci_agent_linuxtempl_events | Retrieves a list of events related to Linux template agents. | +| cbci_agent_sec_reg | Retrieves the container registry secret deployed in the agents namespace. | | cbci_agent_windowstempl_events | Retrieves a list of events related to Windows template agents. | | cbci_agents_pods | Retrieves a list of agent pods running in the agents namespace. | | cbci_controller_b_ws_cache_build | team-b hibernation monitor endpoint to the build workspace cache. It expects CBCI_ADMIN_TOKEN as the environment variable. | @@ -117,6 +118,13 @@ This blueprint divides scalable node groups for different types of workloads: | vpc_arn | VPC ID. | +## Prerequisites + +This blueprint uses [DockerHub](https://hub.docker.com/) as a Container Registry Service. Then, an existing DockerHub account is required (username, password and email). + +> [!TIP] +> Use `docker login` to validate username and password. + ## Deploy When preparing to deploy, you must complete the following steps: @@ -148,14 +156,13 @@ Once the resources have been created, a `kubeconfig` file is created in the [/k8 1. Complete the steps to [validate CloudBees CI](../01-getting-started/README.md#cloudbees-ci), if you have not done so already. -2. Authentication in this blueprint is based on LDAP using the `cn` user (available in [k8s/openldap-stack-values.yml](./k8s/openldap-stack-values.yml)) and the global password. The authorization level defines a set of permissions configured using [RBAC](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-secure-guide/rbac). Additionally, the operations center and controller use [single sign-on (SS0)](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-secure-guide/using-sso). Issue the following command to retrieve the global password: +2. Authentication in this blueprint is based on LDAP using the `cn` user (available in [k8s/openldap-stack-values.yml](./k8s/openldap-stack-values.yml)) and the global password. The authorization level defines a set of permissions configured using [RBAC](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-secure-guide/rbac). Additionally, the operations center and controller use [single sign-on (SS0)](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-secure-guide/using-sso), including a [fallback mechanism](https://docs.cloudbees.com/docs/cloudbees-ci-kb/latest/operations-center/how-ldap-plugin-works-on-cjoc-sso-context) that is enabled by default. Issue the following command to retrieve the global password (valid for all users): ```sh eval $(terraform output --raw global_password) ``` - > [!NOTE] - > There are differences in CloudBees CI permissions and folder restrictions when signed in as a user of the Admin group versus the Development group. For example, only Admin users have access to the agent validation jobs. + There are differences in CloudBees CI permissions and folder restrictions when signed in as a user of the Admin group versus the Development group. For example, only Admin users have access to the agent validation jobs. 3. CasC is enabled for the [operations center](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-oc/) (`cjoc`) and [controllers](https://docs.cloudbees.com/docs/cloudbees-ci/latest/casc-controller/) (`team-b` and `team-c-ha`). `team-a` is not using CasC, to illustrate the difference between the two approaches. Issue the following command to verify that all controllers are Running: @@ -175,10 +182,26 @@ Once the resources have been created, a `kubeconfig` file is created in the [/k8 ##### Kubernetes Secret -The secrets key/value file defined in [k8s/secrets-values.yml](k8s/secrets-values.yml) is converted into a Kubernetes secret (`cbci-secrets`) and mounted into /run/secrets/ for Operation Center and Controllers to be consumed via CloudBees Casc. See [Configuration as Code - Handling Secrets - Kubernetes Secrets](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets) for more information. Beyond the CloudBees CI Addon, Kubernetes secrets can be also created via [External Secret Operators](https://aws-ia.github.io/terraform-aws-eks-blueprints-addons/main/addons/external-secrets/). +Beyond the CloudBees CI Addon for demo purposes, Kubernetes secrets can be managed via [External Secret Operators](https://aws-ia.github.io/terraform-aws-eks-blueprints-addons/main/addons/external-secrets/). + +> [!NOTE] +> Kubernetes secrets could be also be retrived as Jenkins Credentials via using the [Kubernetes Credentials Provider plugin](https://jenkinsci.github.io/kubernetes-credentials-provider-plugin/). + +###### Casc Secrets + +The secrets key/value file defined in [k8s/secrets-values.yml](k8s/secrets-values.yml) is converted into a Kubernetes secret (`cbci-sec-casc`) and mounted into /run/secrets/ for Operation Center and Controllers to be consumed via CloudBees Casc. See [Configuration as Code - Handling Secrets - Kubernetes Secrets](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets) for more information. + +###### Container Registry Secrets + +DockerHub authentication is stored as Kubernetes secrets (`cbci-agent-sec-reg`) and mounted to [Kaniko agent containers](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/using-kaniko) to build and push images to the target container registry. + +```sh + eval $(terraform output --raw cbci_agent_sec_reg) +``` > [!NOTE] -> Kubernetes secrets can be also be retrived as Jenkins Credentials via using the [Kubernetes Credentials Provider plugin](https://jenkinsci.github.io/kubernetes-credentials-provider-plugin/). +> - This blueprint uses DockerHub as an example but different container registries services can be used. +> - Besides Kaniko, there are [other alternitives tools](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/using-kaniko#_alternatives). ##### HashiCorp Vault diff --git a/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg b/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg index c28bba14..7d1f7eb6 100644 --- a/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg +++ b/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg @@ -1,4 +1,4 @@ - + @@ -18,13 +18,13 @@ - - - - + + + + - -
+ +
@@ -39,11 +39,11 @@ - - + + - -
+ +
4 @@ -51,17 +51,17 @@
- + 4 - - + + - -
+ +
do @@ -70,20 +70,20 @@
- + do - - + + - - + + - -
+ +
@@ -93,16 +93,16 @@
- + /velero - + - +
@@ -112,16 +112,16 @@
- Amazon S3 bu... + Amazon S3 b... - + - +
@@ -134,16 +134,16 @@
- Metric serve... + Metric serv... - + - +
@@ -164,9 +164,9 @@ - + - +
@@ -187,9 +187,9 @@ - + - +
@@ -209,9 +209,9 @@ - + - +
@@ -233,12 +233,12 @@ - - - + + + - -
+ +
Autoscaling @@ -248,16 +248,16 @@
- + Autoscal... - + - +
@@ -273,9 +273,9 @@ - + - +
@@ -293,9 +293,9 @@ - + - +
@@ -319,19 +319,19 @@ - - - + + + - + - -
+ +
@@ -341,16 +341,16 @@
- + /cbci - + - +
@@ -367,12 +367,12 @@ - - - + + + - -
+ +
EKS @@ -380,16 +380,16 @@
- + EKS - - - + + + - +
@@ -405,9 +405,9 @@ - + - +
@@ -426,12 +426,12 @@ - + - + - +
@@ -453,9 +453,9 @@ - + - +
@@ -476,9 +476,9 @@ - + - +
@@ -499,9 +499,9 @@ - + - +
@@ -522,10 +522,10 @@ - + - -
+ +
@@ -535,17 +535,17 @@
- - /fluentbit + + /... - + - +
@@ -567,9 +567,9 @@ - + - +
@@ -584,15 +584,15 @@
- Node Termina... + Node Termin... - + - +
@@ -611,14 +611,14 @@ - + - - + + - -
+ +
@@ -630,15 +630,15 @@
- + Short-term logs - + - +
@@ -659,9 +659,9 @@ - + - +
@@ -682,13 +682,13 @@ - + - - + + - -
+ +
@@ -703,15 +703,15 @@
- + cbci-agents - + - +
@@ -734,36 +734,38 @@ - - - - - - + + + + + + + - -
+ +
-
+ cbci-sec-reg
- + + cbci-sec-reg + - - - - - - + + + + + - -
+ +
@@ -773,57 +775,21 @@
- - - - - - - - - - - - - - -
-
-
- - cbci-secrets - -
-
-
- - - cbci-secrets - + - - - - cjoc - - - - - - + + + + + + + - -
+ +
- - Hibernation - -
- - Monitor -
@@ -831,37 +797,16 @@
- - Hibernati... - + - - - - team-b - - - - - - team-a - - - - - - - - - team-c-ha - - - + + + - + - +
@@ -881,26 +826,26 @@ - - + + - + - - + + Tempo - + Prometheus - + Grafana @@ -910,9 +855,9 @@ - + - +
@@ -932,13 +877,12 @@ - - - - + + + - -
+ +
@@ -953,15 +897,15 @@
- + cbci - + - +
@@ -977,12 +921,12 @@ - - + + - + - +
@@ -1001,9 +945,9 @@ - + - +
@@ -1022,6 +966,121 @@ + + + + + + + + + + +
+
+
+ + cbci-sec-casc + +
+
+
+ + + cbci-sec-casc + + + + + + + cjoc + + + + + + team-b + + + + + + team-a + + + + + + + + + + + +
+
+
+ + Hibernation + +
+ + Monitor + + +
+ +
+
+
+ + + Hibernati... + + + + + + + + + + + + team-c-ha + + + + + + + + + + + + +
+
+
+ + + + Container Registry + +
+ + +
+
+
+ + + Container Registr... + + + @@ -1031,4 +1090,4 @@ - + \ No newline at end of file diff --git a/blueprints/02-at-scale/k8s/secrets-values.yml b/blueprints/02-at-scale/k8s/secrets-values.yml index a3c69766..71ebebd4 100644 --- a/blueprints/02-at-scale/k8s/secrets-values.yml +++ b/blueprints/02-at-scale/k8s/secrets-values.yml @@ -1,10 +1,8 @@ # Copyright (c) CloudBees, Inc. -# IMPORTANT: Secrets must be parametrized. +# IMPORTANT: Secrets must be parametrized or encrypted if they are saved in SCM. sec_globalPassword: ${global_password} +sec_adminMail : ${adminMail} sec_s3bucketName: ${s3bucketName} sec_awsRegion: ${awsRegion} -sec_adminMail : ${adminMail} -sec_githubUser: ${githubUser} -sec_githubToken: ${githubToken} diff --git a/blueprints/02-at-scale/main.tf b/blueprints/02-at-scale/main.tf index 5add09c0..07948ed6 100644 --- a/blueprints/02-at-scale/main.tf +++ b/blueprints/02-at-scale/main.tf @@ -81,7 +81,7 @@ locals { cbci_admin_user = "admin_cbci_a" cbci_agents_ns = "cbci-agents" #K8S agent template name from the CasC bundle - cbci_agent_linuxtempl = "linux-mavenAndGo" + cbci_agent_linuxtempl = "linux-mavenAndKaniko-1G" cbci_agent_windowstempl = "windows-powershell" vault_ns = "vault" @@ -106,8 +106,9 @@ resource "time_static" "epoch" { # CloudBees CI Add-on module "eks_blueprints_addon_cbci" { - source = "cloudbees/cloudbees-ci-eks-addon/aws" - version = ">= 3.18072.0" + # source = "cloudbees/cloudbees-ci-eks-addon/aws" + # version = ">= 3.18072.0" + source = "../../" depends_on = [module.eks_blueprints_addons] @@ -124,16 +125,24 @@ module "eks_blueprints_addon_cbci" { })] } - create_k8s_secrets = true - k8s_secrets = templatefile("k8s/secrets-values.yml", { + create_casc_secrets = true + casc_secrets_file = templatefile("k8s/secrets-values.yml", { global_password = local.global_password s3bucketName = local.bucket_name awsRegion = var.aws_region adminMail = var.trial_license["email"] - githubUser = var.gh_user - githubToken = var.gh_token }) + create_reg_secret = true + reg_secret_ns = local.cbci_agents_ns + #Note: This blueprint tests DockerHub as container registry but different registries can be used. + reg_secret_auth = { + server = "https://index.docker.io/v1/" + username = var.dh_reg_secret_auth["username"] + password = var.dh_reg_secret_auth["password"] + email = var.dh_reg_secret_auth["email"] + } + prometheus_target = true } diff --git a/blueprints/02-at-scale/outputs.tf b/blueprints/02-at-scale/outputs.tf index 4de09e3b..47ef561e 100644 --- a/blueprints/02-at-scale/outputs.tf +++ b/blueprints/02-at-scale/outputs.tf @@ -47,12 +47,12 @@ output "cbci_oc_url" { output "cbci_oc_export_admin_crumb" { description = "Exports the operations center cbci_admin_user crumb, to access the REST API when CSRF is enabled." - value = "export CBCI_ADMIN_CRUMB=$(curl -s '${module.eks_blueprints_addon_cbci.cbci_oc_url}/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,%22:%22,//crumb)' --cookie-jar /tmp/cookies.txt --user ${local.cbci_admin_user}:$(kubectl get secret ${module.eks_blueprints_addon_cbci.cbci_secrets} -n ${module.eks_blueprints_addon_cbci.cbci_namespace} -o jsonpath=${local.global_pass_jsonpath} | base64 -d))" + value = "export CBCI_ADMIN_CRUMB=$(curl -s '${module.eks_blueprints_addon_cbci.cbci_oc_url}/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,%22:%22,//crumb)' --cookie-jar /tmp/cookies.txt --user ${local.cbci_admin_user}:$(kubectl get secret ${module.eks_blueprints_addon_cbci.cbci_sec_casc} -n ${module.eks_blueprints_addon_cbci.cbci_namespace} -o jsonpath=${local.global_pass_jsonpath} | base64 -d))" } output "cbci_oc_export_admin_api_token" { description = "Exports the operations center cbci_admin_user API token to access the REST API when CSRF is enabled. It expects CBCI_ADMIN_CRUMB as the environment variable." - value = "export CBCI_ADMIN_TOKEN=$(curl -s '${module.eks_blueprints_addon_cbci.cbci_oc_url}/user/${local.cbci_admin_user}/descriptorByName/jenkins.security.ApiTokenProperty/generateNewToken' --user ${local.cbci_admin_user}:$(kubectl get secret ${module.eks_blueprints_addon_cbci.cbci_secrets} -n ${module.eks_blueprints_addon_cbci.cbci_namespace} -o jsonpath=${local.global_pass_jsonpath} | base64 -d) --data 'newTokenName=kb-token' --cookie /tmp/cookies.txt -H $CBCI_ADMIN_CRUMB | jq -r .data.tokenValue)" + value = "export CBCI_ADMIN_TOKEN=$(curl -s '${module.eks_blueprints_addon_cbci.cbci_oc_url}/user/${local.cbci_admin_user}/descriptorByName/jenkins.security.ApiTokenProperty/generateNewToken' --user ${local.cbci_admin_user}:$(kubectl get secret ${module.eks_blueprints_addon_cbci.cbci_sec_casc} -n ${module.eks_blueprints_addon_cbci.cbci_namespace} -o jsonpath=${local.global_pass_jsonpath} | base64 -d) --data 'newTokenName=kb-token' --cookie /tmp/cookies.txt -H $CBCI_ADMIN_CRUMB | jq -r .data.tokenValue)" } output "cbci_oc_take_backups" { @@ -95,6 +95,11 @@ output "cbci_agent_windowstempl_events" { value = "kubectl get events -n ${local.cbci_agents_ns} | grep -i pod/${local.cbci_agent_windowstempl}" } +output "cbci_agent_sec_reg" { + description = "Retrieves the container registry secret deployed in the agents namespace." + value = "kubectl get secret ${module.eks_blueprints_addon_cbci.cbci_sec_registry} -n ${local.cbci_agents_ns} -o jsonpath='{.data.*}' | base64 -d" +} + output "acm_certificate_arn" { description = "AWS Certificate Manager (ACM) certificate for Amazon Resource Names (ARN)." value = module.acm.acm_certificate_arn @@ -177,7 +182,7 @@ output "grafana_dashboard" { output "global_password" { description = "Random string that is used as the global password." - value = "kubectl get secret ${module.eks_blueprints_addon_cbci.cbci_secrets} -n ${module.eks_blueprints_addon_cbci.cbci_namespace} -o jsonpath=${local.global_pass_jsonpath} | base64 -d" + value = "kubectl get secret ${module.eks_blueprints_addon_cbci.cbci_sec_casc} -n ${module.eks_blueprints_addon_cbci.cbci_namespace} -o jsonpath=${local.global_pass_jsonpath} | base64 -d" } output "vault_configure" { diff --git a/blueprints/02-at-scale/variables.tf b/blueprints/02-at-scale/variables.tf index 9e75cdb2..a29be22a 100644 --- a/blueprints/02-at-scale/variables.tf +++ b/blueprints/02-at-scale/variables.tf @@ -1,9 +1,6 @@ - -variable "tags" { - description = "Tags to apply to resources." - default = {} - type = map(string) -} +############ +# Required +############ variable "hosted_zone" { description = "Amazon Route 53 hosted zone. CloudBees CI applications are configured to use subdomains in this hosted zone." @@ -15,6 +12,20 @@ variable "trial_license" { type = map(string) } +variable "dh_reg_secret_auth" { + description = "Docker Hub Registry server authentication details for cbci-sec-reg secret." + type = map(string) + default = { + username = "foo" + password = "changeme1234" + email = "foo.bar@acme.com" + } +} + +############ +# Optional +############ + variable "suffix" { description = "Unique suffix to assign to all resources. When adding the suffix, changes are required in CloudBees CI for the validation phase." default = "" @@ -25,27 +36,25 @@ variable "suffix" { } } -variable "gh_user" { - description = "GitHub user for the CloudBees operations center credential GH-User-token, that is created via CloudBees CasC." - default = "exampleUser" +#Check number of AZ: aws ec2 describe-availability-zones --region var.aws_region +variable "aws_region" { + description = "AWS region to deploy resources to. It requires at minimun 3 AZs." type = string + default = "us-west-2" } -variable "gh_token" { - description = "GitHub token for the CloudBees operations center credential GH-User-token, that is created via CloudBees CasC." - default = "ExampleToken1234" - type = string +variable "tags" { + description = "Tags to apply to resources." + default = {} + type = map(string) } +############ +# Others. Hidden +############ + variable "ci" { description = "Running in a CI service versus running locally. False when running locally, true when running in a CI service." default = false type = bool } - -#Check number of AZ: aws ec2 describe-availability-zones --region var.aws_region -variable "aws_region" { - description = "AWS region to deploy resources to. It requires at minimun 3 AZs." - type = string - default = "us-west-2" -} From c5a7b2689d0ca9579220238a3f65a2bb58eb549c Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 30 Jul 2024 13:49:51 +0200 Subject: [PATCH 15/33] casc: adding label and hello world name tag --- .../02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml index 39019666..c21beef8 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml @@ -40,6 +40,7 @@ items: displayName: loadTest - kind: backupAndRestore name: restore + label: linux-mavenAndKaniko-XL buildersList: - restoreBuilder: ignoreConfirmationFile: true @@ -324,7 +325,7 @@ items: container(name: 'kaniko', shell: '/busybox/sh') { sh '''#!/busybox/sh echo "FROM jenkins/inbound-agent:latest" > Dockerfile - /kaniko/executor --context `pwd` --destination $TARGET_DH_ORG/hello-kaniko:latest + /kaniko/executor --context `pwd` --destination $TARGET_DH_ORG/hello-world:cbci-bp02 ''' } } From 554918ef71ff829215420291f205e54b6a9d94da Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 30 Jul 2024 13:52:32 +0200 Subject: [PATCH 16/33] Note on L vs XL agent builds --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index 5fa3a7bd..e5dab15d 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -250,7 +250,7 @@ HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in t It triggers `ws-cache` pipeline from `team-b` controller. This pipeline uses [CloudBees Workspace Caching](https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-cache-step). Once the second build is complete, you can find the read cache operation at the beginning of the build logs and the write cache operation at the end of the build logs. - Note that this pipeline uses the On-Demand Linux Node Pool but there is also Spot Linux Node Pool available. + Note that this pipeline uses `linux-mavenAndKaniko-L` agent template deployed over On-demand Linux Nodes that have smaller instance types. On the other hand, `linux-mavenAndKaniko-XL` is deployed over Spot Linux Nodes that have larger instance types. - For Windows node pool use: From 5b41e1919355f0778768ac646b6b3fdc60677418 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 30 Jul 2024 13:52:56 +0200 Subject: [PATCH 17/33] fixing agent template name --- blueprints/02-at-scale/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/main.tf b/blueprints/02-at-scale/main.tf index 07948ed6..19250cd0 100644 --- a/blueprints/02-at-scale/main.tf +++ b/blueprints/02-at-scale/main.tf @@ -81,7 +81,7 @@ locals { cbci_admin_user = "admin_cbci_a" cbci_agents_ns = "cbci-agents" #K8S agent template name from the CasC bundle - cbci_agent_linuxtempl = "linux-mavenAndKaniko-1G" + cbci_agent_linuxtempl = "linux-mavenAndKaniko-L" cbci_agent_windowstempl = "windows-powershell" vault_ns = "vault" From b59ebe8ff1e1202b8df797d6bb6d279eb0ace656 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 30 Jul 2024 17:22:06 +0200 Subject: [PATCH 18/33] casc: adding ecr --- .../cbci/casc/mc/parent/jcasc/k8s-agents.yaml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml index 56157b6b..a5086287 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml @@ -90,6 +90,24 @@ kube: volumeMounts: - name: jenkins-docker-cfg mountPath: /kaniko/.docker + - args: + - "99d" + command: + - "sleep" + image: "gcr.io/kaniko-project/executor:latest" + imagePullPolicy: Always + name: "kaniko-ecr" + resources: + limits: + memory: "2Gi" + requests: + memory: "500Mi" + cpu: "250m" + env: + - name: AWS_SDK_LOAD_CONFIG + value: true + - name: AWS_EC2_METADATA_DISABLED + value: true volumes: - name: jenkins-docker-cfg projected: From 27e929f258bd59897f78337633e5ca234b02ba70 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 30 Jul 2024 17:29:50 +0200 Subject: [PATCH 19/33] setting to debug --- .../02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml index a5086287..d63db2a6 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml @@ -94,7 +94,7 @@ kube: - "99d" command: - "sleep" - image: "gcr.io/kaniko-project/executor:latest" + image: "gcr.io/kaniko-project/executor:debug" imagePullPolicy: Always name: "kaniko-ecr" resources: From 6fe4760416d3045fc421c60a1925d757146f4608 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Tue, 30 Jul 2024 19:14:22 +0200 Subject: [PATCH 20/33] casc: cleaning template --- .../02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml index d63db2a6..a2f6a175 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml @@ -45,7 +45,7 @@ kube: name: ${regSecretsName} items: - key: .dockerconfigjson - path: config.json + path: config.json nodeSelector: kubernetes.io/os: linux role: "build-linux" @@ -103,11 +103,6 @@ kube: requests: memory: "500Mi" cpu: "250m" - env: - - name: AWS_SDK_LOAD_CONFIG - value: true - - name: AWS_EC2_METADATA_DISABLED - value: true volumes: - name: jenkins-docker-cfg projected: From 9ee5c71429dc20b975da214c1714d07e6d34fa6c Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 2 Aug 2024 14:14:52 +0200 Subject: [PATCH 21/33] Remove properties test --- .cloudbees/workflows/my-test.yaml | 18 ------------------ 1 file changed, 18 deletions(-) delete mode 100644 .cloudbees/workflows/my-test.yaml diff --git a/.cloudbees/workflows/my-test.yaml b/.cloudbees/workflows/my-test.yaml deleted file mode 100644 index d9a7aefd..00000000 --- a/.cloudbees/workflows/my-test.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: automation.cloudbees.io/v1alpha1 -kind: workflow -name: My workflow - -on: - workflow_dispatch: - -jobs: - stage: - steps: - - name: Dump GitHub context - uses: docker://cgr.dev/chainguard/wolfi-base:latest - env: - CLOUDBEES_CONTEXT: ${{ toJSON(cloudbees) }} - run: | - echo "----- CONTEXT ------" - echo "cloudbees.scm.sha: ${{ cloudbees.scm.sha }}" - echo "$CLOUDBEES_CONTEXT" From 90fcd3da9a9ca4750bde31bff6fa6fedb21a9dde Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 2 Aug 2024 14:16:31 +0200 Subject: [PATCH 22/33] Casc: s3: st path as variable --- .../02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml | 2 +- blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml | 2 +- blueprints/02-at-scale/cbci/casc/oc/items/admin-folder.yaml | 2 +- blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml | 1 + 4 files changed, 4 insertions(+), 3 deletions(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml index c21beef8..e26bb5ea 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml @@ -50,7 +50,7 @@ items: s3Store: bucketName: "${sec_s3bucketName}" sse: true - bucketFolder: cbci/backup + bucketFolder: "${s3bucketPreffix}/backup" region: "${sec_awsRegion}" description: 'Validates the restore functionality of the CloudBees Backup plugin.' displayName: restore diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml index af7e1576..b5506dbf 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/main.yaml @@ -42,7 +42,7 @@ aws: s3: container: "${sec_s3bucketName}" disableSessionToken: false - prefix: "${s3bucketPreffix}" + prefix: "${s3bucketPreffix}/" useHttp: false usePathStyleUrl: false useTransferAcceleration: false diff --git a/blueprints/02-at-scale/cbci/casc/oc/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/oc/items/admin-folder.yaml index b429d337..00735694 100644 --- a/blueprints/02-at-scale/cbci/casc/oc/items/admin-folder.yaml +++ b/blueprints/02-at-scale/cbci/casc/oc/items/admin-folder.yaml @@ -83,7 +83,7 @@ items: store: s3Store: bucketName: "${sec_s3bucketName}" - bucketFolder: cbci/backup + bucketFolder: "${s3bucketPreffix}/backup" region: "${sec_awsRegion}" itemSource: jenkinsRootItemSource: { diff --git a/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml index 5e01c6c5..7d3b3e3f 100644 --- a/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml +++ b/blueprints/02-at-scale/cbci/casc/oc/variables/variables.yaml @@ -8,3 +8,4 @@ variables: - ldapUserSearch: "cn={0}" - vault_url: "http://vault.vault.svc.cluster.local:8200" - cascSecretsName: "cbci-sec-casc" + - s3bucketPreffix: "cbci" From a8863db3a2fc730642d1bbc138db805180e914ce Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 2 Aug 2024 14:17:56 +0200 Subject: [PATCH 23/33] casc: run pre-commit --- .../02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml | 2 +- .../02-at-scale/cbci/casc/mc/parent/variables/variables.yaml | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml index a2f6a175..882410ca 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/jcasc/k8s-agents.yaml @@ -45,7 +45,7 @@ kube: name: ${regSecretsName} items: - key: .dockerconfigjson - path: config.json + path: config.json nodeSelector: kubernetes.io/os: linux role: "build-linux" diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml index 99faab96..76d47a05 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/variables/variables.yaml @@ -1,4 +1,5 @@ variables: - ot_endpoint: "http://tempo.kube-prometheus-stack.svc.cluster.local:4317" - - s3bucketPreffix: "cbci/" - - regSecretsName: "cbci-sec-reg" \ No newline at end of file + - s3bucketPreffix: "cbci" + - regSecretsName: "cbci-sec-reg" + From 3242f07850f0da3660472fc3afe1e468dd5b7ee7 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 2 Aug 2024 18:13:31 +0200 Subject: [PATCH 24/33] casc: simplifying jobs --- .../casc/mc/parent/items/admin-folder.yaml | 243 ++++++++---------- 1 file changed, 113 insertions(+), 130 deletions(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml index e26bb5ea..e0bd8106 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml @@ -59,40 +59,6 @@ items: description: 'Contains validations for integrations tests.' displayName: validations items: - - kind: pipeline - name: build-agents-talks - concurrentBuild: true - definition: - cpsFlowDefinition: - sandbox: true - script: |- - timeout(time: 1, unit: 'HOURS'){ - podTemplate (inheritFrom: 'linux-mavenAndKaniko-L') { - retry (3) { - node(POD_LABEL) { - stage('beginning') { - sh 'date > date.txt' - archiveArtifacts artifacts: 'date.txt', fingerprint: true - } - } - } - } - checkpoint 'middle' - podTemplate (inheritFrom: 'linux-mavenAndKaniko-XL') { - retry (3) { - node(POD_LABEL) { - stage('end') { - dir ('unarchive'){ - unarchive mapping: ['date.txt': 'my-date.txt'] - sh 'cat my-date.txt' - } - } - } - } - } - } - description: 'It validates archives/unarchive s3 artifacts from different pods agents in the same build.' - displayName: build-agents-talks - kind: pipeline name: downstream-artifact concurrentBuild: true @@ -134,69 +100,111 @@ items: description: 'It validates archives/unarchive s3 artifacts (https://plugins.jenkins.io/artifact-manager-s3/) from different pods agents in different build. It uses artifacts from upstream build.' displayName: downstream-artifact - kind: pipeline - name: upstream-artifact + name: ws-cache concurrentBuild: true definition: cpsFlowDefinition: sandbox: true script: |- pipeline { + agent none options { retry(3) timeout(time: 1, unit: 'HOURS') } - agent{ - label 'linux-mavenAndKaniko-L' - } stages { - stage('Maven') { - stages { - stage ('Build'){ - steps { - container('maven') { - sh ''' - echo "Build number ^^${BUILD_NUMBER}" >> f_1 - mvn -version >> f_1 - ''' - } + stage ("s3"){ + parallel { + stage('Workspace Cache') { + agent { + label "linux-mavenAndKaniko-L" } - } - stage ('Archive f_1'){ - steps { - container('kaniko') { - archiveArtifacts artifacts: 'f_1', fingerprint: true - } + environment { + MAVEN_PROJECT = 'https://github.com/jglick/simple-maven-project-with-tests' + CACHE = 'ws-cache-maven' } - } - } - } - stage('Kaniko') { - stages { - stage ("Unarchive"){ - steps { - container('maven') { - dir ('unarchive'){ - sh 'ls -la' - unarchive mapping: [f_1: 'f_1'] - sh 'ls -la; cat f_1; mv f_1 f_2' + stages { + stage('Checkout') { + steps { + git env.MAVEN_PROJECT } } - } - } - stage ('Build'){ - steps { - container('kaniko') { - dir ('unarchive'){ - sh 'ls /kaniko/executor >> f_2' + stage('Read') { + steps { + readCache name: env.CACHE + } + } + stage('Build') { + steps { + container('maven') { + sh 'mvn clean package -DskipTests -Dmaven.repo.local=./maven-repo' + } } } } + post { + success { + writeCache name: env.CACHE, includes: 'maven-repo/**' + } + } } - stage ('Archive f_2'){ - steps { - container('maven') { - dir ('unarchive'){ - archiveArtifacts artifacts: 'f_2', fingerprint: true + stage('Artifacts') { + agent { + label "linux-mavenAndKaniko-XL" + } + stages { + stage('Maven') { + stages { + stage ('Build'){ + steps { + container('maven') { + sh ''' + echo "Build number ^${BUILD_NUMBER}" >> f_1 + mvn -version >> f_1 + ''' + } + } + } + stage ('Archive f_1'){ + steps { + container('kaniko') { + archiveArtifacts artifacts: 'f_1', fingerprint: true + } + } + } + } + } + stage('Kaniko') { + stages { + stage ("Unarchive"){ + steps { + container('maven') { + dir ('unarchive'){ + sh 'ls -la' + unarchive mapping: [f_1: 'f_1'] + sh 'ls -la; cat f_1; mv f_1 f_2' + } + } + } + } + stage ('Build'){ + steps { + container('kaniko') { + dir ('unarchive'){ + sh "ls -la /kaniko/executor >> f_2" + } + } + } + } + stage ('Archive f_2'){ + steps { + container('maven') { + dir ('unarchive'){ + archiveArtifacts artifacts: 'f_2', fingerprint: true + } + } + } + } } } } @@ -205,8 +213,12 @@ items: } } } - description: 'It validates archives/unarchive s3 artifacts (https://plugins.jenkins.io/artifact-manager-s3/) from different pods agents in different build. It creates artifacts for downstream build.' - displayName: upstream-artifact + description: 'Pipeline that demonstrates the s3 integrations for CloudBees Workspace + Caching (https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-cache-step) + and s3 Artifact (https://plugins.jenkins.io/artifact-manager-s3/) are working' + disabled: false + displayName: ws-cache + resumeBlocked: false - kind: pipeline name: windows-builds-nodes concurrentBuild: false @@ -234,51 +246,6 @@ items: } description: 'It validates the windows nodes builds.' displayName: windows-builds-nodes - - kind: pipeline - name: ws-cache - concurrentBuild: true - definition: - cpsFlowDefinition: - sandbox: true - script: |- - pipeline { - options { - retry(3) - timeout(time: 1, unit: 'HOURS') - } - agent{ - label 'linux-mavenAndKaniko-L' - } - environment { - MAVEN_PROJECT = 'https://github.com/jglick/simple-maven-project-with-tests' - CACHE = 'ws-cache-maven' - } - stages { - stage('Checkout') { - steps { - git env.MAVEN_PROJECT - } - } - stage('Read') { - steps { - readCache name: env.CACHE - } - } - stage('Build') { - steps { - container('maven') { - sh 'mvn clean package -DskipTests -Dmaven.repo.local=./maven-repo' - } - } - } - } - post { - success { - writeCache name: env.CACHE, includes: 'maven-repo/**' - } - } - } - description: 'Pipeline that demonstrates the usage of CloudBees Workspace Caching: https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-cache-step.' - kind: pipeline name: vault-credentials concurrentBuild: true @@ -317,18 +284,29 @@ items: label 'linux-mavenAndKaniko-XL' } parameters { - string(name: 'TARGET_DH_ORG', description: 'DockerHub Organization to Push the image') + string(name: 'TARGET_DH_ORG', description: 'DockerHub Organization to Push the image', defaultValue: 'example-org', ) + string(name: 'TARGET_ECR_URI', description: 'ECR URI', defaultValue: '99999999999.dkr.ecr.us-east-1.amazonaws.com/test-private-example', ) } stages { - stage('Build with Kaniko') { + stage('Public Registry') { steps { container(name: 'kaniko', shell: '/busybox/sh') { sh '''#!/busybox/sh echo "FROM jenkins/inbound-agent:latest" > Dockerfile - /kaniko/executor --context `pwd` --destination $TARGET_DH_ORG/hello-world:cbci-bp02 + /kaniko/executor --context `pwd` --destination ${TARGET_DH_ORG}/cbci-bp02-kaniko:${BUILD_ID} ''' } } + } + stage('Private Registry') { + steps { + container(name: 'kaniko-ecr', shell: '/busybox/sh') { + sh '''#!/busybox/sh + echo "FROM jenkins/inbound-agent:latest" > Dockerfile + /kaniko/executor --context `pwd` --destination=${TARGET_ECR_URI}:${BUILD_ID} + ''' + } + } } } } @@ -337,7 +315,12 @@ items: parameterDefinitions: - string: trim: false + defaultValue: example-org name: TARGET_DH_ORG description: DockerHub Organization to Push the image - resumeBlocked: false - description: 'It validates that Authentication for DockerHub and Kaniko is working fine.' + - string: + trim: false + defaultValue: 99999999999.dkr.ecr.us-east-1.amazonaws.com/test-private-example + name: TARGET_ECR_URI + description: ECR URI + description: 'It validates Authentication to Push images to DockerHub and ECR.' From fb50690e7eafbf221c972c34534669e5ef46c355 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 2 Aug 2024 18:28:10 +0200 Subject: [PATCH 25/33] clean job ietms --- .../casc/mc/parent/items/admin-folder.yaml | 43 +------------------ 1 file changed, 1 insertion(+), 42 deletions(-) diff --git a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml index e0bd8106..7e0e4075 100644 --- a/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml +++ b/blueprints/02-at-scale/cbci/casc/mc/parent/items/admin-folder.yaml @@ -60,47 +60,7 @@ items: displayName: validations items: - kind: pipeline - name: downstream-artifact - concurrentBuild: true - definition: - cpsFlowDefinition: - sandbox: true - script: |- - pipeline { - agent{ - label 'linux-mavenAndKaniko-XL' - } - options { - retry(3) - timeout(time: 1, unit: 'HOURS') - } - environment { - ARTIFACT_SOURCE_JOB = 'upstream-artifact' - } - stages { - stage('Build Upstream') { - steps { - build 'upstream-artifact' - } - } - stage('Copy Artifacts') { - steps { - sh 'ls -la' - copyArtifacts fingerprintArtifacts: true, projectName: env.ARTIFACT_SOURCE_JOB, selector: lastSuccessful() - } - } - stage('Read Artifacts') { - steps { - sh 'ls -la' - sh 'cat f_2' - } - } - } - } - description: 'It validates archives/unarchive s3 artifacts (https://plugins.jenkins.io/artifact-manager-s3/) from different pods agents in different build. It uses artifacts from upstream build.' - displayName: downstream-artifact - - kind: pipeline - name: ws-cache + name: s3-WScacheAndArtifacts concurrentBuild: true definition: cpsFlowDefinition: @@ -217,7 +177,6 @@ items: Caching (https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-cache-step) and s3 Artifact (https://plugins.jenkins.io/artifact-manager-s3/) are working' disabled: false - displayName: ws-cache resumeBlocked: false - kind: pipeline name: windows-builds-nodes From 1112e44cbb45e96f129998452a8a0927b1d3d19d Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 2 Aug 2024 19:56:04 +0200 Subject: [PATCH 26/33] Adding ECR instance profile --- blueprints/02-at-scale/main.tf | 102 ++++++++++++++++++++++++++------- 1 file changed, 82 insertions(+), 20 deletions(-) diff --git a/blueprints/02-at-scale/main.tf b/blueprints/02-at-scale/main.tf index 19250cd0..0efd3f3a 100644 --- a/blueprints/02-at-scale/main.tf +++ b/blueprints/02-at-scale/main.tf @@ -10,17 +10,20 @@ locals { # Infra ############ - name = var.suffix == "" ? "cbci-bp02" : "cbci-bp02-${var.suffix}" - vpc_name = "${local.name}-vpc" - cluster_name = "${local.name}-eks" - efs_name = "${local.name}-efs" - resource_group_name = "${local.name}-rg" - bucket_name = "${local.name}-s3" - cbci_instance_profile = "${local.name}-instance_profile" - cbci_iam_role = "${local.name}-iam_role_mn" - cbci_inline_policy = "${local.name}-iam_inline_policy" - kubeconfig_file = "kubeconfig_${local.name}.yaml" - kubeconfig_file_path = abspath("k8s/${local.kubeconfig_file}") + name = var.suffix == "" ? "cbci-bp02" : "cbci-bp02-${var.suffix}" + vpc_name = "${local.name}-vpc" + cluster_name = "${local.name}-eks" + efs_name = "${local.name}-efs" + resource_group_name = "${local.name}-rg" + bucket_name = "${local.name}-s3" + cbci_instance_profile_s3 = "${local.name}-instance_profile_s3" + cbci_iam_role_s3 = "${local.name}-iam_role_s3" + cbci_inline_policy_s3 = "${local.name}-iam_inline_policy_s3" + cbci_instance_profile_ecr = "${local.name}-instance_profile_ecr" + cbci_iam_role_ecr = "${local.name}-iam_role_ecr" + cbci_inline_policy_ecr = "${local.name}-iam_inline_policy_ecr" + kubeconfig_file = "kubeconfig_${local.name}.yaml" + kubeconfig_file_path = abspath("k8s/${local.kubeconfig_file}") vpc_cidr = "10.0.0.0/16" azs = slice(data.aws_availability_zones.available.names, 0, 3) @@ -459,7 +462,7 @@ module "eks" { storage = "enabled" } create_iam_role = false - iam_role_arn = aws_iam_role.managed_ng.arn + iam_role_arn = aws_iam_role.managed_ng_s3.arn ami_type = "BOTTLEROCKET_ARM_64" platform = "bottlerocket" enable_bootstrap_user_data = true @@ -475,6 +478,8 @@ module "eks" { labels = { role = "build-linux" } + create_iam_role = false + iam_role_arn = aws_iam_role.managed_ng_ecr.arn ami_type = "BOTTLEROCKET_ARM_64" platform = "bottlerocket" enable_bootstrap_user_data = true @@ -494,6 +499,8 @@ module "eks" { labels = { role = "build-linux-spot" } + create_iam_role = false + iam_role_arn = aws_iam_role.managed_ng_ecr.arn ami_type = "BOTTLEROCKET_ARM_64" platform = "bottlerocket" enable_bootstrap_user_data = true @@ -511,6 +518,8 @@ module "eks" { labels = { role = "build-linux-spot" } + create_iam_role = false + iam_role_arn = aws_iam_role.managed_ng_ecr.arn ami_type = "BOTTLEROCKET_ARM_64" platform = "bottlerocket" enable_bootstrap_user_data = true @@ -555,9 +564,9 @@ data "aws_iam_policy_document" "managed_ng_assume_role_policy" { } } -resource "aws_iam_role" "managed_ng" { - name = local.cbci_iam_role - description = "EKS Managed Node group IAM Role" +resource "aws_iam_role" "managed_ng_s3" { + name = local.cbci_iam_role_s3 + description = "EKS Managed Node group IAM Role s3" assume_role_policy = data.aws_iam_policy_document.managed_ng_assume_role_policy.json path = "/" force_detach_policies = true @@ -570,7 +579,7 @@ resource "aws_iam_role" "managed_ng" { ] # Additional Permissions for for EKS Managed Node Group per https://docs.aws.amazon.com/eks/latest/userguide/create-node-role.html inline_policy { - name = local.cbci_inline_policy + name = local.cbci_inline_policy_s3 policy = jsonencode( { "Version" : "2012-10-17", @@ -596,7 +605,60 @@ resource "aws_iam_role" "managed_ng" { "s3:prefix" : "${local.cbci_s3_prefix}/*" } } - }, + } + ] + } + ) + } + tags = var.tags +} + +resource "aws_iam_instance_profile" "managed_ng_s3" { + name = local.cbci_instance_profile_s3 + role = aws_iam_role.managed_ng_s3.name + path = "/" + + lifecycle { + create_before_destroy = true + } + + tags = var.tags +} + +resource "aws_iam_role" "managed_ng_ecr" { + name = local.cbci_iam_role_ecr + description = "EKS Managed Node group IAM Role ECR" + assume_role_policy = data.aws_iam_policy_document.managed_ng_assume_role_policy.json + path = "/" + force_detach_policies = true + # Mandatory for EKS Managed Node Group + managed_policy_arns = [ + "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy", + "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", + "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly" + ] + # Additional Permissions for for EKS Managed Node Group per https://docs.aws.amazon.com/eks/latest/userguide/create-node-role.html + inline_policy { + name = local.cbci_inline_policy_ecr + policy = jsonencode( + { + "Version" : "2012-10-17", + "Statement" : [ + { + "Sid" : "ecrKaniko", + "Effect" : "Allow", + "Action" : [ + "ecr:GetDownloadUrlForLayer", + "ecr:GetAuthorizationToken", + "ecr:InitiateLayerUpload", + "ecr:UploadLayerPart", + "ecr:CompleteLayerUpload", + "ecr:PutImage", + "ecr:BatchGetImage", + "ecr:BatchCheckLayerAvailability" + ], + "Resource" : "*" + } ] } ) @@ -604,9 +666,9 @@ resource "aws_iam_role" "managed_ng" { tags = var.tags } -resource "aws_iam_instance_profile" "managed_ng" { - name = local.cbci_instance_profile - role = aws_iam_role.managed_ng.name +resource "aws_iam_instance_profile" "managed_ng_ecr" { + name = local.cbci_instance_profile_ecr + role = aws_iam_role.managed_ng_ecr.name path = "/" lifecycle { From 5fd498c4672cde34b213a98f0e37ce3c04072f97 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 2 Aug 2024 19:56:35 +0200 Subject: [PATCH 27/33] Adding Container Registry section --- blueprints/02-at-scale/README.md | 56 +++++++++++++++++++++----------- 1 file changed, 37 insertions(+), 19 deletions(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index e5dab15d..c6724a24 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -68,8 +68,7 @@ This blueprint divides scalable node groups for different types of workloads: | trial_license | CloudBees CI trial license details for evaluation. | `map(string)` | n/a | yes | | aws_region | AWS region to deploy resources to. It requires at minimun 3 AZs. | `string` | `"us-west-2"` | no | | ci | Running in a CI service versus running locally. False when running locally, true when running in a CI service. | `bool` | `false` | no | -| gh_token | GitHub token for the CloudBees operations center credential GH-User-token, that is created via CloudBees CasC. | `string` | `"ExampleToken1234"` | no | -| gh_user | GitHub user for the CloudBees operations center credential GH-User-token, that is created via CloudBees CasC. | `string` | `"exampleUser"` | no | +| dh_reg_secret_auth | Docker Hub Registry server authentication details for cbci-sec-reg secret. | `map(string)` | 
{
  "email": "foo.bar@acme.com",
  "password": "changeme1234",
  "username": "foo"
}
| no | | suffix | Unique suffix to assign to all resources. When adding the suffix, changes are required in CloudBees CI for the validation phase. | `string` | `""` | no | | tags | Tags to apply to resources. | `map(string)` | `{}` | no | @@ -182,10 +181,11 @@ Once the resources have been created, a `kubeconfig` file is created in the [/k8 ##### Kubernetes Secret -Beyond the CloudBees CI Addon for demo purposes, Kubernetes secrets can be managed via [External Secret Operators](https://aws-ia.github.io/terraform-aws-eks-blueprints-addons/main/addons/external-secrets/). +This blueprint uses a couple of Kubernetes secrets for different purposes. > [!NOTE] -> Kubernetes secrets could be also be retrived as Jenkins Credentials via using the [Kubernetes Credentials Provider plugin](https://jenkinsci.github.io/kubernetes-credentials-provider-plugin/). +> - Beyond the CloudBees CI Addon (for demo purposes), Kubernetes secrets can be managed via [External Secret Operators](https://aws-ia.github.io/terraform-aws-eks-blueprints-addons/main/addons/external-secrets/). +> - Kubernetes secrets could be also be retrived as Jenkins Credentials via using the [Kubernetes Credentials Provider plugin](https://jenkinsci.github.io/kubernetes-credentials-provider-plugin/). ###### Casc Secrets @@ -193,15 +193,14 @@ The secrets key/value file defined in [k8s/secrets-values.yml](k8s/secrets-value ###### Container Registry Secrets -DockerHub authentication is stored as Kubernetes secrets (`cbci-agent-sec-reg`) and mounted to [Kaniko agent containers](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/using-kaniko) to build and push images to the target container registry. +DockerHub authentication is stored as Kubernetes secrets (`cbci-agent-sec-reg`) and mounted to [Kaniko agent containers](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/using-kaniko) to build and push images to this registry. The secret is created using the `dh_reg_secret_auth` variable. ```sh eval $(terraform output --raw cbci_agent_sec_reg) ``` > [!NOTE] -> - This blueprint uses DockerHub as an example but different container registries services can be used. -> - Besides Kaniko, there are [other alternitives tools](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/using-kaniko#_alternatives). +> ECR authentication is done via instance profile connected to `build-linux-spot` Node pools. ##### HashiCorp Vault @@ -226,6 +225,8 @@ HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in t #### Builds +##### Build Node Pools + 1. For the following validations, builds will be triggered remotely. Start by issuing the following command to retrieve an [API token](https://docs.cloudbees.com/docs/cloudbees-ci-api/latest/api-authentication) for the `admin_cbci_a` user with the correct permissions for the required actions: ```sh @@ -242,25 +243,27 @@ HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in t 2. Once you have retrieved the API token, issue the following commands to trigger builds using the [POST queue for hibernation API endpoint](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/managing-controllers#_post_queue_for_hibernation). If successful, an `HTTP/2 201` response is returned, indicating the REST API call has been correctly received by the CloudBees CI controller. -- For Linux node pools use: + - For Linux node pools use: - ```sh - eval $(terraform output --raw cbci_controller_b_ws_cache_build) - ``` + ```sh + eval $(terraform output --raw cbci_controller_b_s3_build) + ``` - It triggers `ws-cache` pipeline from `team-b` controller. This pipeline uses [CloudBees Workspace Caching](https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-cache-step). Once the second build is complete, you can find the read cache operation at the beginning of the build logs and the write cache operation at the end of the build logs. + It triggers `s3-WScacheAndArtifacts` pipeline from `team-b` controller. This pipeline validates a couple of s3 integrations in parallel: one for [CloudBees Workspace Caching](https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-cache-step) (using `linux-mavenAndKaniko-L`) and another for [s3 Artifact Manager](https://plugins.jenkins.io/artifact-manager-s3/) (using `linux-mavenAndKaniko-XL`). - Note that this pipeline uses `linux-mavenAndKaniko-L` agent template deployed over On-demand Linux Nodes that have smaller instance types. On the other hand, `linux-mavenAndKaniko-XL` is deployed over Spot Linux Nodes that have larger instance types. + Once the second build is complete, you can find the read cache operation at the beginning of the build logs and the write cache operation at the end of the build logs. -- For Windows node pool use: + The `linux-mavenAndKaniko-L` agent template is deployed over On-demand Linux Nodes that have smaller instance types vs the `linux-mavenAndKaniko-XL` template that is deployed over Spot Linux Nodes that have defined larger instance types. - ```sh - eval $(terraform output --raw cbci_controller_c_windows_node_build) - ``` + - For Windows node pool use: + + ```sh + eval $(terraform output --raw cbci_controller_c_windows_node_build) + ``` - It triggers `windows-build-nodes` pipeline from `team-c-ha` controller. + It triggers `windows-build-nodes` pipeline from `team-c-ha` controller. - Note that the first build for a new Windows image container can take up to 10 minutes to run; subsequent builds should take seconds to run. This behavior can be improved as explained in the section [Architecture](#architecture). + Note that the first build for a new Windows image container can take up to 10 minutes to run; subsequent builds should take seconds to run. This behavior can be improved as explained in the section [Architecture](#architecture). 3. Right after triggering the builds, issue the following to validate pod agent provisioning to build the pipeline code: @@ -270,6 +273,21 @@ HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in t 4. Check build logs by signing in to the `team-b` and `team-c-ha` controllers, respectively. Navigate to the pipeline jobs and select the first build, indicated by the `#1` build number. [CloudBees Pipeline Explorer](https://docs.cloudbees.com/docs/cloudbees-ci/latest/pipelines/cloudbees-pipeline-explorer-plugin) is enabled as a default. +##### Container Registry + +This blueprints uses a couple of container registries for different purposes. + +- The Public Registry uses DockerHub (It requires an existing DockerHub Organization). +- The Private Registry uses AWS ECR (It requires an existing ECR Repository). + +> [!NOTE] +> Other Container Registry services can be used for the same purporses. + +Access with admin role to CloudBees CI to `team-b` or `team-c-ha` to run the pipeline _admin_ > _validations_ > _kaniko_ enter as parameters an existing DockerHub Organization and an existing AWS ECR Repository to test that Build and Push towards every repository works fine. + +> [!NOTE] +> Besides Kaniko, there are [other alternitives tools](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/using-kaniko#_alternatives). + #### Back up and restore For backup and restore operations, you can use the [preconfigured CloudBees CI Cluster Operations job](#create-daily-backups-using-a-cloudbees-ci-cluster-operations-job) to automatically perform a daily backup, which can be used for Amazon EFS and Amazon EBS storage. From 8a4544e867e29d0ee42e4c84f3c5e17ef175b713 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 2 Aug 2024 20:20:15 +0200 Subject: [PATCH 28/33] chore: adapting output to new piepline name --- blueprints/02-at-scale/outputs.tf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/blueprints/02-at-scale/outputs.tf b/blueprints/02-at-scale/outputs.tf index 47ef561e..1c7da431 100644 --- a/blueprints/02-at-scale/outputs.tf +++ b/blueprints/02-at-scale/outputs.tf @@ -70,9 +70,9 @@ output "cbci_controller_c_hpa" { value = "kubectl get hpa team-c-ha -n ${module.eks_blueprints_addon_cbci.cbci_namespace}" } -output "cbci_controller_b_ws_cache_build" { - description = "team-b hibernation monitor endpoint to the build workspace cache. It expects CBCI_ADMIN_TOKEN as the environment variable." - value = "curl -i -XPOST -u ${local.cbci_admin_user}:$CBCI_ADMIN_TOKEN ${local.hibernation_monitor_url}/hibernation/queue/team-b/job/admin/job/validations/job/ws-cache/build" +output "cbci_controller_b_s3_build" { + description = "team-b hibernation monitor endpoint to the build s3-WScacheAndArtifacts. It expects CBCI_ADMIN_TOKEN as the environment variable." + value = "curl -i -XPOST -u ${local.cbci_admin_user}:$CBCI_ADMIN_TOKEN ${local.hibernation_monitor_url}/hibernation/queue/team-b/job/admin/job/validations/job/s3-WScacheAndArtifacts/build" } output "cbci_controller_c_windows_node_build" { From 757e6ed353e07a518ef23972669cf5a4b786f652 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 2 Aug 2024 20:21:42 +0200 Subject: [PATCH 29/33] Adding Container Registry modifications --- .../img/at-scale.architect.drawio.svg | 84 ++- .../02-at-scale/img/at-scale.k8s.drawio.svg | 478 +++++++++--------- 2 files changed, 298 insertions(+), 264 deletions(-) diff --git a/blueprints/02-at-scale/img/at-scale.architect.drawio.svg b/blueprints/02-at-scale/img/at-scale.architect.drawio.svg index 2adc4ba9..1561c961 100644 --- a/blueprints/02-at-scale/img/at-scale.architect.drawio.svg +++ b/blueprints/02-at-scale/img/at-scale.architect.drawio.svg @@ -1,4 +1,4 @@ - + @@ -231,29 +231,6 @@ - - - - -
-
-
- - - Instance -
- profile - - -
-
-
- - - Instance... - - - @@ -871,7 +848,25 @@ - + + + + +
+
+
+ s3 +
+ Profile +
+
+
+ + + s3... + + + @@ -949,6 +944,45 @@ + + + + + +
+
+
+ Elastic Container +
+ Registry +
+
+
+ + + Elastic Co... + + + + + + + +
+
+
+ ECR +
+ Profile +
+
+
+ + + ECR... + + + diff --git a/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg b/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg index 7d1f7eb6..2d4867e0 100644 --- a/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg +++ b/blueprints/02-at-scale/img/at-scale.k8s.drawio.svg @@ -1,4 +1,4 @@ - + @@ -18,12 +18,12 @@ - + - - + + - +
@@ -40,50 +40,14 @@ - - - -
-
-
- 4 -
-
-
- - - 4 - - - - - - - - -
-
-
- do -
-
-
-
- - - do - - - - - + - + - -
+ +
@@ -93,16 +57,16 @@
- + /velero - + - +
@@ -119,9 +83,9 @@ - + - +
@@ -141,9 +105,9 @@ - + - +
@@ -164,9 +128,9 @@ - + - +
@@ -187,9 +151,9 @@ - + - +
@@ -209,9 +173,9 @@ - + - +
@@ -235,9 +199,9 @@ - + - +
@@ -255,9 +219,9 @@ - + - +
@@ -273,9 +237,9 @@ - + - +
@@ -293,9 +257,9 @@ - + - +
@@ -328,9 +292,9 @@ - + - +
@@ -348,9 +312,9 @@ - + - +
@@ -369,9 +333,9 @@ - + - +
@@ -385,11 +349,11 @@ - - - + + + - +
@@ -403,11 +367,9 @@ - - - + - +
@@ -425,13 +387,11 @@ - - + - - + - +
@@ -449,13 +409,12 @@ - - - - - + + + + - +
@@ -473,12 +432,11 @@ - - - + + - +
@@ -496,12 +454,11 @@ - - - - + + + - +
@@ -521,10 +478,9 @@ - - + - +
@@ -540,12 +496,11 @@ - - - - + + + - +
@@ -563,13 +518,13 @@ - - - - - + + + + + - +
@@ -588,12 +543,10 @@ - - - + - -
+ +
@@ -605,19 +558,17 @@
- + bottle-rocket-oper... - - - - - - + + + + - +
@@ -635,10 +586,9 @@ - - + - +
@@ -658,11 +608,10 @@ - - + - -
+ +
@@ -676,18 +625,16 @@
- + cert-manager - - - - - + + + - +
@@ -708,10 +655,9 @@ - - + - +
@@ -734,15 +680,13 @@ - - - - - - - + + + + + - +
@@ -758,13 +702,12 @@ - - - - - + + + + - +
@@ -778,15 +721,14 @@ - - - - - - - + + + + + + - +
@@ -800,13 +742,11 @@ - - - - - + + + - +
@@ -826,38 +766,35 @@ - + - - - + - - + + Tempo - + Prometheus - + Grafana - - - - - - + + + + + - +
@@ -877,11 +814,10 @@ - - - + + - +
@@ -902,10 +838,10 @@ - - + + - +
@@ -921,12 +857,12 @@ - + - - + + - +
@@ -944,10 +880,10 @@ - - + + - +
@@ -966,16 +902,13 @@ - - - - - - - - + + + + + - +
@@ -992,32 +925,31 @@ - + cjoc - + team-b - + team-a - - - - - - - + + + + + + - +
@@ -1040,33 +972,31 @@ - - - + + - - + team-c-ha - - - - - - - - + + + + + + - -
-
+ +
+
+ DockerHub +
Container Registry
@@ -1076,11 +1006,81 @@
- - Container Registr... + + DockerHub... + + + + + + + + +
+
+
+ + + Elastic Container +
+ + Registry + +
+
+
+ + + Elastic Container... + + + + +
+
+
+ + + Private Images + + +
+
+
+ + + Private Images + + + + + + + +
+
+
+ + + Public Images + + +
+
+
+ + + Public Images + + + + + + + From 21bc0deeb7d4adfb9d510a338da83ece3d40bd9d Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 2 Aug 2024 20:31:26 +0200 Subject: [PATCH 30/33] remove duplications --- blueprints/02-at-scale/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index c6724a24..d0e09f21 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -277,8 +277,8 @@ HashiCorp Vault is used as a credential provider for CloudBees CI Pipelines in t This blueprints uses a couple of container registries for different purposes. -- The Public Registry uses DockerHub (It requires an existing DockerHub Organization). -- The Private Registry uses AWS ECR (It requires an existing ECR Repository). +- The Public Registry uses DockerHub. +- The Private Registry uses AWS ECR. > [!NOTE] > Other Container Registry services can be used for the same purporses. From 78c2a3f9aa0f38865f3605e7b6bb343eaaf82897 Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 2 Aug 2024 20:34:30 +0200 Subject: [PATCH 31/33] Using mabven kaniko for both --- blueprints/02-at-scale/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/main.tf b/blueprints/02-at-scale/main.tf index 0efd3f3a..dc541efb 100644 --- a/blueprints/02-at-scale/main.tf +++ b/blueprints/02-at-scale/main.tf @@ -84,7 +84,7 @@ locals { cbci_admin_user = "admin_cbci_a" cbci_agents_ns = "cbci-agents" #K8S agent template name from the CasC bundle - cbci_agent_linuxtempl = "linux-mavenAndKaniko-L" + cbci_agent_linuxtempl = "linux-mavenAndKaniko-" cbci_agent_windowstempl = "windows-powershell" vault_ns = "vault" From f96cca404ed55f78cdf857185ff0f35e8a29c60b Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Lopez Date: Fri, 2 Aug 2024 21:34:50 +0200 Subject: [PATCH 32/33] Updating probes to Container Registry --- blueprints/helpers.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/blueprints/helpers.sh b/blueprints/helpers.sh index 7d487162..85f3dbb8 100755 --- a/blueprints/helpers.sh +++ b/blueprints/helpers.sh @@ -125,7 +125,7 @@ probes () { ERROR "Problem while getting Global Pass." fi until { eval "$(tf-output "$root" cbci_oc_export_admin_crumb)" && eval "$(tf-output "$root" cbci_oc_export_admin_api_token)" && [ -n "$CBCI_ADMIN_TOKEN" ]; }; do sleep $wait && echo "Waiting for Admin Token..."; done && INFO "Admin Token: $CBCI_ADMIN_TOKEN" - eval "$(tf-output "$root" cbci_controller_b_ws_cache_build)" > /tmp/controller-b-hibernation && + eval "$(tf-output "$root" cbci_controller_b_s3_build)" > /tmp/controller-b-hibernation && if grep "201\|202" /tmp/controller-b-hibernation; then INFO "Hibernation Post Queue Controller B OK." else @@ -141,9 +141,9 @@ probes () { INFO "Team C HPA is Ready." until [ "$(eval "$(tf-output "$root" cbci_agent_windowstempl_events)" | grep -c 'Allocated Resource vpc.amazonaws.com')" -ge 1 ]; do sleep $wait && echo "Waiting for Windows Template Pod to allocate resource vpc.amazonaws.com"; done ;\ eval "$(tf-output "$root" cbci_agent_windowstempl_events)" && INFO "Windows Template Example is OK." - until [ "$(eval "$(tf-output "$root" cbci_agent_linuxtempl_events)" | grep -c 'Created container maven')" -ge 1 ]; do sleep $wait && echo "Waiting for Linux Template Pod to create maven container"; done ;\ + until [ "$(eval "$(tf-output "$root" cbci_agent_linuxtempl_events)" | grep -c 'Created container maven')" -ge 2 ]; do sleep $wait && echo "Waiting for both Linux Template Pods (On demand and Spot) to create maven container"; done ;\ eval "$(tf-output "$root" cbci_agent_linuxtempl_events)" && INFO "Linux Template Example is OK." - until [ "$(eval "$(tf-output "$root" s3_list_objects)" | grep -c 'cbci/')" -ge 1 ]; do sleep $wait && echo "Waiting for WS Cache to be uploaded into s3 cbci"; done ;\ + until [ "$(eval "$(tf-output "$root" s3_list_objects)" | grep -c 'cbci/')" -ge 2 ]; do sleep $wait && echo "Waiting for WS Cache and Artifacts to be uploaded into s3 cbci"; done ;\ eval "$(tf-output "$root" s3_list_objects)" | grep 'cbci/' && INFO "CBCI s3 Permissions are configured correctly." eval "$(tf-output "$root" velero_backup_schedule)" && eval "$(tf-output "$root" velero_backup_on_demand)" > /tmp/velero-backup.txt && \ if grep 'Backup completed with status: Completed' /tmp/velero-backup.txt; then From 4b8ec003ceea3b39169c8ec4f9a99d8fc50895aa Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 2 Aug 2024 19:37:06 +0000 Subject: [PATCH 33/33] terraform-docs: automated action --- blueprints/02-at-scale/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blueprints/02-at-scale/README.md b/blueprints/02-at-scale/README.md index d0e09f21..e9d4e3dd 100644 --- a/blueprints/02-at-scale/README.md +++ b/blueprints/02-at-scale/README.md @@ -83,7 +83,7 @@ This blueprint divides scalable node groups for different types of workloads: | cbci_agent_sec_reg | Retrieves the container registry secret deployed in the agents namespace. | | cbci_agent_windowstempl_events | Retrieves a list of events related to Windows template agents. | | cbci_agents_pods | Retrieves a list of agent pods running in the agents namespace. | -| cbci_controller_b_ws_cache_build | team-b hibernation monitor endpoint to the build workspace cache. It expects CBCI_ADMIN_TOKEN as the environment variable. | +| cbci_controller_b_s3_build | team-b hibernation monitor endpoint to the build s3-WScacheAndArtifacts. It expects CBCI_ADMIN_TOKEN as the environment variable. | | cbci_controller_c_hpa | team-c horizontal pod autoscaling. | | cbci_controller_c_windows_node_build | team-c hibernation monitor endpoint to the Windows build nodes. It expects CBCI_ADMIN_TOKEN as the environment variable. | | cbci_controllers_pods | Operations center pod for the CloudBees CI add-on. |