Skip to content

Commit f81b04d

Browse files
create1stcreate1st
authored
Add K8S pipeline (#4)
K8S pipeline
1 parent 0887e0c commit f81b04d

File tree

9 files changed

+135
-58
lines changed

9 files changed

+135
-58
lines changed

‎.buildkite/pipeline-aws-ops.yaml

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,38 @@
11
env:
2-
ACTION_AWS_ROTATE_SECRETS: 'rotate-secrets'
2+
BUILDKITE_CLEAN_CHECKOUT: true
33

4-
PROFILE_DEV: 'dev'
4+
AWS_ACTION_ROTATE_SECRETS: 'rotate-secrets'
55

6-
AGENT_DEVOPS: 'dev-ops'
6+
AWS_IAM_ACCOUNT_DEV: 'AWS_IAM_ACCOUNT_DEV'
7+
8+
BK_AGENT_DEVOPS: 'dev-aws-ops'
79
steps:
8-
- block: 'DevOps'
10+
- block: ':aws: DevOps'
911
fields:
1012
- select: 'Select operation'
1113
options:
1214
- label: 'Rotate secrets'
1315
value: ${ACTION_AWS_ROTATE_SECRETS}
14-
key: DEVOPS_ACTION
16+
key: AWS_ACTION
1517
requires: true
1618
- select: 'Select environment'
1719
options:
1820
- label: 'Development'
19-
value: ${PROFILE_DEV}
20-
key: DEVOPS_PROFILE
21+
value: ${AWS_IAM_ACCOUNT_DEV}
22+
key: AWS_IAM_ACCOUNT
2123
requires: true
2224
- text: 'Reason?'
23-
key: DEVOPS_ACTION_REASON
25+
key: BK_ACTION_REASON
2426
required: true
2527

26-
- label: 'DevOps Apply'
28+
- label: ':aws: DevOps Apply'
2729
branches: 'main'
2830
command: '.buildkite/scripts/aws-ops.sh'
2931
agents:
30-
queue: ${AGENT_DEVOPS}
32+
queue: ${BK_AGENT_DEVOPS}
3133

32-
- label: 'Annotate build'
34+
- label: ':buildkite: Annotate build'
3335
branches: 'main'
3436
command: '.buildkite/scripts/bk-annotate.sh'
3537
agents:
36-
queue: ${AGENT_DEVOPS}
38+
queue: ${BK_AGENT_DEVOPS}

‎.buildkite/pipeline-k8s-ops.yaml

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
env:
2+
BUILDKITE_CLEAN_CHECKOUT: true
3+
4+
K8S_ACTION_START: 'start'
5+
K8S_ACTION_STOP: 'stop'
6+
7+
AWS_IAM_ACCOUNT_DEV: 'AWS_IAM_ACCOUNT_DEV'
8+
9+
BK_AGENT_DEVOPS: 'dev-k8s-ops'
10+
steps:
11+
- block: ':k8s: DevOps'
12+
# branches: "main"
13+
fields:
14+
- select: 'Select operation'
15+
options:
16+
- label: 'Start'
17+
value: ${K8S_ACTION_START}
18+
- label: 'Stop'
19+
value: ${K8S_ACTION_STOP}
20+
key: K8S_ACTION
21+
requires: true
22+
- select: 'Select environment'
23+
options:
24+
- label: 'Development'
25+
value: ${AWS_IAM_ACCOUNT_DEV}
26+
key: AWS_IAM_ACCOUNT
27+
requires: true
28+
- text: 'Reason?'
29+
key: BK_ACTION_REASON
30+
required: true
31+
32+
- label: ':k8s: Starting action'
33+
command: '.buildkite/scripts/k8s-ops.sh'
34+
agents:
35+
queue: ${BK_AGENT_DEVOPS}
36+
37+
- label: ':buildkite: Annotate build'
38+
# branches: 'main'
39+
command: '.buildkite/scripts/bk-annotate.sh'
40+
agents:
41+
queue: ${BK_AGENT_DEVOPS}

‎.buildkite/pipeline.yaml

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,23 @@
11
env:
2+
BUILDKITE_CLEAN_CHECKOUT: true
3+
24
INFRA_PATH: 'infrastructure'
3-
AGENT_GLOBAL: 'global'
5+
6+
BK_AGENT_GLOBAL: 'global'
47
steps:
5-
- label: "Triggering pipelines"
8+
- label: ":buildkite: Triggering pipelines"
69
plugins:
710
- chronotc/monorepo-diff#1.3.2:
811
diff: "git diff --name-only HEAD~1" # ".buildkite/scripts/diff-against-last-successful-build.sh"
912
watch:
1013
- path: infrastructure/terraform/
1114
config:
1215
command: "buildkite-agent pipeline upload ${INFRA_PATH}/.buildkite/pipeline.yaml"
13-
label: "Triggered infrastructure update"
16+
label: ":terraform: Triggered infrastructure update"
1417
env:
1518
- INFRA_PATH
1619
agents:
17-
queue: ${AGENT_GLOBAL}
20+
queue: ${BK_AGENT_GLOBAL}
1821

1922
# wait: ~
2023

‎.buildkite/scripts/aws-assume-role.sh

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
#!/bin/bash
2+
3+
set -uexo pipefail
4+
5+
AWS_SECRET_ID="docker-localstack-aws-secret"
6+
AWS_IAM_ROLE_NAME="docker-localstack-aws-role"
7+
8+
AWS_IAM_ACCOUNT=$(buildkite-agent meta-data get "AWS_IAM_ACCOUNT")
9+
10+
echo "Assuming role: '${AWS_IAM_ACCOUNT}'"
11+
echo "Build: ${BUILDKITE_BUILD_NUMBER}"
12+
13+
AWS_IAM_ROLE="arn:aws:iam::${AWS_IAM_ACCOUNT}:role/${AWS_IAM_ROLE_NAME}"
14+
AWS_IAM_ROLE_JSON=$(aws sts assume-role --role-arn ${AWS_IAM_ROLE} --role-session-name "buildkite-pipeline-devops-build-${BUILDKITE_BUILD_NUMBER}" --query Credentials)
15+
export AWS_SESSION_TOKEN=$(echo ${AWS_IAM_ROLE_JSON} | jq -r .Credentials.SessionToken)
16+
export AWS_ACCESS_KEY_ID=$(echo ${AWS_IAM_ROLE_JSON} | jq -r .Credentials.AccessKeyId)
17+
export AWS_SECRET_ACCESS_KEY=$(echo ${AWS_IAM_ROLE_JSON} | jq -r .Credentials.SecretAccessKey)
18+
19+
echo "Using AWS credentials:"
20+
echo " AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN}"
21+
echo " AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}"
22+
echo " AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}"

‎.buildkite/scripts/aws-ops.sh

Lines changed: 7 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -2,53 +2,24 @@
22

33
set -uexo pipefail
44

5-
AWS_SECRET_ID="docker-localstack-secret"
6-
AWS_ROLE_NAME="docker-localstack-role"
7-
AWS_IAM_ACCOUNT_DEV="AWS_IAM_ACCOUNT_DEV"
5+
AWS_ACTION_ROTATE_SECRETS="rotate-secrets"
86

9-
PROFILE_DEV="dev"
7+
AWS_ACTION=$(buildkite-agent meta-data get "AWS_ACTION")
108

11-
ACTION_AWS_ROTATE_SECRETS="rotate-secrets"
9+
echo "Executing '${AWS_ACTION}'"
1210

13-
PROFILE=$(buildkite-agent meta-data get "DEVOPS_PROFILE")
14-
ACTION=$(buildkite-agent meta-data get "DEVOPS_ACTION")
11+
.buildkite/scripts/aws-assume-role.sh
1512

16-
echo "Executing '${ACTION}' on '${PROFILE}'"
17-
18-
case ${PROFILE} in
19-
${PROFILE_DEV})
20-
AWS_IAM_ACCOUNT=${AWS_IAM_ACCOUNT_DEV}
21-
;;
22-
23-
*)
24-
echo "Unknown profile: '${PROFILE}'"
25-
exit 1
26-
;;
27-
esac
28-
29-
echo "Build: ${BUILDKITE_BUILD_NUMBER}"
30-
31-
AWS_IAM_ROLE="arn:aws:iam::${AWS_IAM_ACCOUNT}:role/${AWS_ROLE_NAME}"
32-
AWS_ROLE_JSON=$(aws sts assume-role --role-arn ${AWS_IAM_ROLE} --role-session-name "buildkite-pipeline-devops-build-${BUILDKITE_BUILD_NUMBER}" --query Credentials)
33-
export AWS_SESSION_TOKEN=$(echo ${AWS_ROLE_JSON} | jq -r .Credentials.SessionToken)
34-
export AWS_ACCESS_KEY_ID=$(echo ${AWS_ROLE_JSON} | jq -r .Credentials.AccessKeyId)
35-
export AWS_SECRET_ACCESS_KEY=$(echo ${AWS_ROLE_JSON} | jq -r .Credentials.SecretAccessKey)
36-
37-
echo "Using AWS credentials:"
38-
echo " AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN}"
39-
echo " AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}"
40-
echo " AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}"
41-
42-
case ${ACTION} in
43-
${ACTION_AWS_ROTATE_SECRETS})
13+
case ${AWS_ACTION} in
14+
${AWS_ACTION_ROTATE_SECRETS})
4415
AWS_SECRET_VALUE_JSON=$(aws secretsmanager get-secret-value --secret-id ${AWS_SECRET_ID})
4516
AWS_SECRET_VALUE=$(echo ${AWS_SECRET_VALUE_JSON} | jq -r ".SecretString | fromjson | .password")
4617
# modify resources using ${AWS_SECRET_VALUE}
4718
aws secretsmanager rotate-secret --secret-id ${AWS_SECRET_ID}
4819
;;
4920

5021
*)
51-
echo "Unsupported operation: '${ACTION}'"
22+
echo "Unsupported operation: '${AWS_ACTION}'"
5223
exit 1
5324
;;
5425
esac

‎.buildkite/scripts/bk-annotate.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,6 @@
22

33
set -uexo pipefail
44

5-
REASON=$(buildkite-agent meta-data get "DEVOPS_ACTION_REASON")
5+
REASON=$(buildkite-agent meta-data get "BK_ACTION_REASON")
66

77
echo ${REASON} | buildkite-agent annotate --append

‎.buildkite/scripts/k8s-ops.sh

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
#!/bin/bash
2+
3+
set -uexo pipefail
4+
5+
K8S_CLUSTER_NAME="docker-localstack-k8s-cluster"
6+
K8S_NODE_GROUP_NAME="docker-localstack-k8s-node-group"
7+
K8S_NODE_GROUP_SIZE="docker-localstack-k8s-node-group"
8+
9+
K8S_ACTION_START="start"
10+
K8S_ACTION_STOP="stop"
11+
12+
K8S_ACTION=$(buildkite-agent meta-data get "K8S_ACTION")
13+
14+
echo "Executing '${K8S_ACTION}'"
15+
16+
.buildkite/scripts/aws-assume-role.sh
17+
18+
case ${K8S_ACTION} in
19+
${K8S_ACTION_STOP})
20+
eksctl get cluster
21+
eksctl get nodegroup --cluster ${K8S_CLUSTER_NAME}
22+
eksctl scale nodegroup --cluster ${K8S_CLUSTER_NAME} --name ${K8S_NODE_GROUP_NAME} --nodes 0
23+
;;
24+
25+
${K8S_ACTION_START})
26+
eksctl get cluster
27+
eksctl get nodegroup --cluster ${K8S_CLUSTER_NAME}
28+
eksctl scale nodegroup --cluster ${K8S_CLUSTER_NAME} --name ${K8S_NODE_GROUP_NAME} --nodes ${K8S_NODE_GROUP_SIZE}
29+
;;
30+
31+
*)
32+
echo "Unsupported operation: '${K8S_ACTION}'"
33+
exit 1
34+
;;
35+
esac

‎README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,15 @@ export TF_CLI_ARGS_apply="-no-color"
1010
export TF_CLI_ARGS_plan="-no-color"
1111
bk run -E SSH_AUTH_SOCK="$SSH_AUTH_SOCK"
1212
bk run .buildkite/pipeline-aws-ops.yaml
13+
bk run .buildkite/pipeline-k8s-ops.yaml
1314
```
1415

1516
### Buildkite
1617
* https://github.com/chronotc/monorepo-diff-buildkite-plugin
1718
* https://github.com/buildkite-plugins/docker-compose-buildkite-plugin
1819
* https://github.com/buildkite-plugins/artifacts-buildkite-plugin
20+
* https://github.com/cultureamp/aws-assume-role-buildkite-plugin
21+
https://github.com/buildkite-plugins/ecr-buildkite-plugin
1922

2023
### Docker
2124

‎infrastructure/.buildkite/pipeline.yaml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ env:
33

44
PROFILE_DEV: 'dev'
55

6-
AGENT_DEV: 'dev'
6+
BK_AGENT_INFRA: 'infra'
77
steps:
88
- label: ':terraform: Validate'
99
plugins:
@@ -12,7 +12,7 @@ steps:
1212
pull: validate
1313
run: validate
1414
agents:
15-
queue: ${AGENT_DEV}
15+
queue: ${BK_AGENT_INFRA}
1616
env:
1717
INFRA_PATH: ${INFRA_PATH:-.}
1818

@@ -23,7 +23,7 @@ steps:
2323
pull: fmt
2424
run: fmt
2525
agents:
26-
queue: ${AGENT_DEV}
26+
queue: ${BK_AGENT_INFRA}
2727
env:
2828
INFRA_PATH: ${INFRA_PATH:-.}
2929

@@ -38,7 +38,7 @@ steps:
3838
from: ${INFRA_PATH:-.}/tf-plan-dev
3939
to: tf-plan-dev
4040
agents:
41-
queue: ${AGENT_DEV}
41+
queue: ${BK_AGENT_INFRA}
4242
env:
4343
PROFILE: ${PROFILE_DEV}
4444
INFRA_PATH: ${INFRA_PATH:-.}
@@ -58,7 +58,7 @@ steps:
5858
from: tf-plan-dev
5959
to: ${INFRA_PATH:-.}/tf-plan-dev
6060
agents:
61-
queue: ${AGENT_DEV}
61+
queue: ${BK_AGENT_INFRA}
6262
env:
6363
PROFILE: ${PROFILE_DEV}
6464
INFRA_PATH: ${INFRA_PATH:-.}

0 commit comments

Comments
 (0)