Skip to content

add parameters to embedded-linux-pipeline: accessLoggingBucket, artif… #67

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 15, 2024
Merged

add parameters to embedded-linux-pipeline: accessLoggingBucket, artif… #67

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 39 additions & 18 deletions lib/build-image-pipeline.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,13 @@ export interface BuildImagePipelineProps extends cdk.StackProps {
readonly dataBucket: s3.IBucket;
/** The ECR Repository to push to. */
readonly repository: IRepository;
/** Access logging bucket to use */
readonly accessLoggingBucket?: s3.Bucket;
/** Access logging prefix to use */
readonly serverAccessLogsPrefix?: string;
/** Artifact bucket to use */
readonly artifactBucket?: s3.Bucket;

}

/**
Expand Down Expand Up @@ -98,24 +105,38 @@ export class BuildImagePipelineStack extends cdk.Stack {
input: sourceOutput,
});

const accessLoggingBucket = new s3.Bucket(this, 'ArtifactAccessLogging', {
versioned: true,
enforceSSL: true,
});
const encryptionKey = new kms.Key(this, 'PipelineArtifactKey', {
removalPolicy: RemovalPolicy.DESTROY,
enableKeyRotation: true,
});
const artifactBucket = new s3.Bucket(this, 'PipelineArtifacts', {
versioned: true,
enforceSSL: true,
serverAccessLogsBucket: accessLoggingBucket,
encryptionKey,
encryption: s3.BucketEncryption.KMS,
blockPublicAccess: new s3.BlockPublicAccess(
s3.BlockPublicAccess.BLOCK_ALL
),
});
let accessLoggingBucket: s3.IBucket;

if (props.accessLoggingBucket){
accessLoggingBucket = props.accessLoggingBucket;
} else {
accessLoggingBucket = new s3.Bucket(this, 'ArtifactAccessLogging', {
versioned: true,
enforceSSL: true,
});
}

let artifactBucket: s3.IBucket;

if (props.artifactBucket){
artifactBucket = props.artifactBucket;
} else {
const encryptionKey = new kms.Key(this, 'PipelineArtifactKey', {
removalPolicy: RemovalPolicy.DESTROY,
enableKeyRotation: true,
});
artifactBucket = new s3.Bucket(this, 'PipelineArtifacts', {
versioned: true,
enforceSSL: true,
serverAccessLogsBucket: accessLoggingBucket,
serverAccessLogsPrefix: props.serverAccessLogsPrefix,
encryptionKey,
encryption: s3.BucketEncryption.KMS,
blockPublicAccess: new s3.BlockPublicAccess(
s3.BlockPublicAccess.BLOCK_ALL
),
});
}

const pipeline = new codepipeline.Pipeline(this, 'BuildImagePipeline', {
artifactBucket,
Expand Down
108 changes: 74 additions & 34 deletions lib/embedded-linux-pipeline.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,17 @@ export interface EmbeddedLinuxPipelineProps extends cdk.StackProps {
readonly layerRepoName?: string;
/** Additional policy statements to add to the build project. */
readonly buildPolicyAdditions?: iam.PolicyStatement[];
}
/** Access logging bucket to use */
readonly accessLoggingBucket?: s3.Bucket;
/** Access logging prefix to use */
readonly serverAccessLogsPrefix?: string;
/** Artifact bucket to use */
readonly artifactBucket?: s3.Bucket;
/** Output bucket to use */
readonly outputBucket?: s3.Bucket | VMImportBucket;
/** Prefix for S3 object within bucket */
readonly subDirectoryName?: string;
}

/**
* The stack for creating a build pipeline.
Expand Down Expand Up @@ -80,11 +90,16 @@ export class EmbeddedLinuxPipelineStack extends cdk.Stack {
let outputBucket: s3.IBucket | VMImportBucket;
let environmentVariables = {};
let scriptAsset!: Asset;
let accessLoggingBucket: s3.IBucket;

const accessLoggingBucket = new s3.Bucket(this, 'ArtifactAccessLogging', {
versioned: true,
enforceSSL: true,
});
if (props.accessLoggingBucket){
accessLoggingBucket = props.accessLoggingBucket;
} else {
accessLoggingBucket = new s3.Bucket(this, 'ArtifactAccessLogging', {
versioned: true,
enforceSSL: true,
});
}

if (props.projectKind && props.projectKind == ProjectKind.PokyAmi) {
scriptAsset = new Asset(this, 'CreateAMIScript', {
Expand All @@ -99,14 +114,18 @@ export class EmbeddedLinuxPipelineStack extends cdk.Stack {
enableKeyRotation: true,
}
);

outputBucket = new VMImportBucket(this, 'PipelineOutput', {
versioned: true,
enforceSSL: true,
encryptionKey: outputBucketEncryptionKey,
encryptionKeyArn: outputBucketEncryptionKey.keyArn,
serverAccessLogsBucket: accessLoggingBucket,
});
if (props.outputBucket){
outputBucket = props.outputBucket;
} else {
outputBucket = new VMImportBucket(this, 'PipelineOutput', {
versioned: true,
enforceSSL: true,
encryptionKey: outputBucketEncryptionKey,
encryptionKeyArn: outputBucketEncryptionKey.keyArn,
serverAccessLogsBucket: accessLoggingBucket,
serverAccessLogsPrefix: props.serverAccessLogsPrefix,
});
}
environmentVariables = {
IMPORT_BUCKET: {
type: BuildEnvironmentVariableType.PLAINTEXT,
Expand All @@ -122,28 +141,38 @@ export class EmbeddedLinuxPipelineStack extends cdk.Stack {
},
};
} else {
outputBucket = new s3.Bucket(this, 'PipelineOutput', {
if (props.outputBucket){
outputBucket = props.outputBucket;
} else {
outputBucket = new s3.Bucket(this, 'PipelineOutput', {
versioned: true,
enforceSSL: true,
serverAccessLogsBucket: accessLoggingBucket,
});
}
}

let artifactBucket: s3.IBucket;

if (props.artifactBucket){
artifactBucket = props.artifactBucket;
} else {
const encryptionKey = new kms.Key(this, 'PipelineArtifactKey', {
removalPolicy: RemovalPolicy.DESTROY,
enableKeyRotation: true,
});
artifactBucket = new s3.Bucket(this, 'PipelineArtifacts', {
versioned: true,
enforceSSL: true,
serverAccessLogsBucket: accessLoggingBucket,
encryptionKey,
encryption: s3.BucketEncryption.KMS,
blockPublicAccess: new s3.BlockPublicAccess(
s3.BlockPublicAccess.BLOCK_ALL
),
});
}

const encryptionKey = new kms.Key(this, 'PipelineArtifactKey', {
removalPolicy: RemovalPolicy.DESTROY,
enableKeyRotation: true,
});
const artifactBucket = new s3.Bucket(this, 'PipelineArtifacts', {
versioned: true,
enforceSSL: true,
serverAccessLogsBucket: accessLoggingBucket,
encryptionKey,
encryption: s3.BucketEncryption.KMS,
blockPublicAccess: new s3.BlockPublicAccess(
s3.BlockPublicAccess.BLOCK_ALL
),
});

/** Create our CodePipeline Actions. */
const sourceRepo = new SourceRepo(this, 'SourceRepo', {
...props,
Expand Down Expand Up @@ -236,11 +265,22 @@ export class EmbeddedLinuxPipelineStack extends cdk.Stack {
project,
});

const artifactAction = new codepipeline_actions.S3DeployAction({
actionName: 'Artifact',
input: buildOutput,
bucket: outputBucket,
});
let artifactAction: codepipeline_actions.S3DeployAction;

if (props.subDirectoryName){
artifactAction = new codepipeline_actions.S3DeployAction({
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Only some things get into the final bucket with this action. There is also some things in the build spec files.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What do you mean by "some things" ?
By setting the subDirectoryName all uploaded artifacts go into a sub dir...

actionName: 'Artifact',
input: buildOutput,
bucket: outputBucket,
objectKey: props.subDirectoryName
});
} else {
artifactAction = new codepipeline_actions.S3DeployAction({
actionName: 'Artifact',
input: buildOutput,
bucket: outputBucket,
});
}

/** Here we create the logic to check for presence of ECR image on the CodePipeline automatic triggering upon resource creation,
* and stop the execution if the image does not exist. */
Expand Down