ciinabox-ecs 0.3.2 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 290615a87906adae6078212fa7b2b73f1675f0a64eec2820e7652d24e1f29ae9
-  data.tar.gz: 99e29c42c55cb2265b560ad944bb405d382c1ec981d80b03e5421a28dc32d22a
+  metadata.gz: 6cb8948addbd8934d3ce023ebe42cdc62c351543cd18e3bab5bcede51b721cd8
+  data.tar.gz: b9580c6df69c88aae63efa127df2c2f7776f5d43be0e3786571f2377813a120b
 SHA512:
-  metadata.gz: f4f836716a32b0307e092446ba77a288f8d45a0518372f28ec8efe0700f94261ce3565266666f8449c17ebc25c262d8660c376a955ca0d58d7ef950542f8f1f1
-  data.tar.gz: 6de2338585808d75804ca6592089ebced3e930c3d529aab78c06648f91470eafc9222756d26852b33305c450b6dd84fbf70d0936258efc7d5e643b9a3b3074bc
+  metadata.gz: dfaf07f44c8c9df46e421deede422ec11d8c487127164e3976b42afeb662cd395b00e261d2efd34c9efd19a136e02956fdc635f85cd0e4973667f0e44af04f28
+  data.tar.gz: 3a56e95ab477129ef96d2bfbb47c33ef08606c3eea4f4260410f76f3debf1c3de3bcb635f706392955cd7a4060442b70cdf72b1b1a9d61b1570eb377396a933b

data/README.md

@@ -234,6 +234,23 @@ A common update would be to lock down ip access to your ciinabox environment
   ....
   ```
 
+  or using AWS IP Prefix Lists
+
+  ```yaml
+  ....
+  #Environment Access
+  #add list of public IP addresses you want to access the environment from
+  #default to public access probably best to change this
+  opsIpPrefixLists:
+    - pl-12345
+    - pl-abcde
+  #add list of public IP addresses for your developers to access the environment
+  #default to public access probably best to change this
+  devIpPrefixLists:
+    - pl-11111
+  ....
+  ```
+
 2. update your ciinabox
   ```bash
   $ ciinabox-ecs generate deploy update [ciinabox_name]

data/templates/ecs-services.rb

@@ -137,20 +137,23 @@ CloudFormation {
     ])
   }
 
-  if defined? webHooks
-    rules = []
-    webHooks.each do |ip|
-      rules << { IpProtocol: 'tcp', FromPort: '443', ToPort: '443', CidrIp: ip }
-    end
-  else
-    rules = [{ IpProtocol: 'tcp', FromPort: '443', ToPort: '443', CidrIp: '192.168.1.1/32' }]
+  webHooks = webHooks || []
+  webHooksIpPrefixLists = webHooksIpPrefixLists || []
+
+  rules = []
+  webHooks.each do |ip|
+    rules << { IpProtocol: 'tcp', FromPort: '443', ToPort: '443', CidrIp: ip }
+  end
+
+  webHooksIpPrefixLists.each do |list|
+    rules << { IpProtocol: 'tcp', FromPort: '443', ToPort: '443', SourcePrefixListId: list }
   end
 
   Resource("SecurityGroupWebHooks") {
     Type 'AWS::EC2::SecurityGroup'
     Property('VpcId', Ref('VPC'))
     Property('GroupDescription', 'WebHooks like github')
-    Property('SecurityGroupIngress', rules)
+    Property('SecurityGroupIngress', rules) if rules.any?
   }
 
   Resource('ToolsSSLCertificate') {
@@ -261,6 +264,14 @@ CloudFormation {
     end
   end
 
+  log_group_retention = log_group_retention || 90
+
+  Resource("LogGroup") {
+    Type "AWS::Logs::LogGroup"
+    Property("LogGroupName", "/ciinabox/#{ciinabox_name}/proxy")
+    Property("RetentionInDays", log_group_retention)
+  }
+
   volumes = []
   mount_points = []
 
@@ -290,6 +301,14 @@ CloudFormation {
                 HostPort: 8080,
                 ContainerPort: 80
             }],
+            LogConfiguration: {
+              LogDriver: 'awslogs',
+              Options: {
+                'awslogs-group' => Ref("LogGroup"),
+                "awslogs-region" => Ref("AWS::Region"),
+                "awslogs-stream-prefix" => "proxy"
+              }
+            },
             Essential: true,
             MountPoints: mount_points
         }

data/templates/services/jenkins.rb

@@ -1,189 +1,219 @@
 require 'cfndsl'
 require_relative '../../ext/helper'
 
-if !defined? timezone
-  timezone = 'GMT'
-end
-
-if !defined? internal_elb
-  internal_elb = nil
-end
-
-if !defined? volatile_jenkins_slave
-  volatile_jenkins_slave = false
-end
-
-# Prefixing application images allows us to 'vendorize' ciinabox into client's account by setting
-# ciinabox_repo to ${account_no}.dkr.ecr.${region}.amazonaws.com
-if not defined? ciinabox_repo
-    ciinabox_repo = 'ghcr.io/base2services'
-end
-image = "#{ciinabox_repo}/ciinabox-jenkins:lts"
-
-jenkins_java_opts = ''
-memory = 2048
-slave_memory = 2048
-cpu = 300
-container_port = 0
-service = lookup_service('jenkins', services)
-virtual_host = "jenkins.#{dns_domain}"
-if defined? internal_elb and internal_elb
-  virtual_host = "#{virtual_host},internal-jenkins.#{dns_domain}"
-end
-port_mappings = []
-
-if defined? service
-  service = {} if service.nil?
-  jenkins_java_opts = service['JAVA_OPTS'] || ''
-  image = service['ContainerImage'] || image
-  memory = service['ContainerMemory'] || 2048
-  slave_memory = service['SlaveContainerMemory'] || 2048
-  cpu = service['ContainerCPU'] || 300
-
-  if service['InstancePort']
-    port_mappings << {
-        HostPort: service['InstancePort'],
-        ContainerPort: service['InstancePort']
-    }
-    container_port = service['InstancePort']
-    virtual_host = "jenkins.#{dns_domain},internal-jenkins.#{dns_domain}"
+CloudFormation {
+  AWSTemplateFormatVersion "2010-09-09"
+  Description "ciinabox - ECS Service Jenkins v#{ciinabox_version}"
+
+  Parameter("ECSCluster") {Type 'String'}
+  Parameter("ECSRole") {Type 'String'}
+  Parameter("ServiceELB") {Type 'String'}
+  Parameter('InternalELB') {Type 'String'} if internal_elb
+
+  if !defined? timezone
+    timezone = 'GMT'
   end
 
-end
+  if !defined? internal_elb
+    internal_elb = nil
+  end
 
-# container volumes and container definitions depending on feature flags
-volumes = [
-    {
-        Name: 'timezone',
-        Host: {
-            SourcePath: '/etc/localtime'
-        }
-    },
-    {
-        Name: 'jenkins_data',
-        Host: {
-            SourcePath: '/data/jenkins'
-        }
-    }]
-
-container_definitions = [
-    {
-        Name: 'jenkins',
-        Links: [],
-        Memory: memory,
-        Cpu: cpu,
-        Image: image,
-        PortMappings: port_mappings,
-        Environment: [
-            {
-                Name: 'JAVA_OPTS',
-                Value: "#{jenkins_java_opts} -Duser.timezone=#{timezone}"
-            },
-            {
-                Name: 'VIRTUAL_HOST',
-                Value: virtual_host
-            },
-            {
-                Name: 'VIRTUAL_PORT',
-                Value: '8080'
-            }
-        ],
-        Essential: true,
+  if !defined? volatile_jenkins_slave
+    volatile_jenkins_slave = false
+  end
+
+  # Prefixing application images allows us to 'vendorize' ciinabox into client's account by setting
+  # ciinabox_repo to ${account_no}.dkr.ecr.${region}.amazonaws.com
+  if not defined? ciinabox_repo
+      ciinabox_repo = 'ghcr.io/base2services'
+  end
+  image = "#{ciinabox_repo}/ciinabox-jenkins:lts"
+
+  jenkins_java_opts = ''
+  memory = 2048
+  slave_memory = 2048
+  cpu = 300
+  container_port = 0
+  service = lookup_service('jenkins', services)
+  virtual_host = "jenkins.#{dns_domain}"
+  if defined? internal_elb and internal_elb
+    virtual_host = "#{virtual_host},internal-jenkins.#{dns_domain}"
+  end
+  port_mappings = []
+
+  if defined? service
+    service = {} if service.nil?
+    jenkins_java_opts = service['JAVA_OPTS'] || ''
+    image = service['ContainerImage'] || image
+    memory = service['ContainerMemory'] || 2048
+    slave_memory = service['SlaveContainerMemory'] || 2048
+    cpu = service['ContainerCPU'] || 300
+
+    if service['InstancePort']
+      port_mappings << {
+          HostPort: service['InstancePort'],
+          ContainerPort: service['InstancePort']
+      }
+      container_port = service['InstancePort']
+      virtual_host = "jenkins.#{dns_domain},internal-jenkins.#{dns_domain}"
+    end
+
+  end
+
+  # container volumes and container definitions depending on feature flags
+  volumes = [
+      {
+          Name: 'timezone',
+          Host: {
+              SourcePath: '/etc/localtime'
+          }
+      },
+      {
+          Name: 'jenkins_data',
+          Host: {
+              SourcePath: '/data/jenkins'
+          }
+      }]
+
+  container_definitions = [
+      {
+          Name: 'jenkins',
+          Links: [],
+          Memory: memory,
+          Cpu: cpu,
+          Image: image,
+          PortMappings: port_mappings,
+          Environment: [
+              {
+                  Name: 'JAVA_OPTS',
+                  Value: "#{jenkins_java_opts} -Duser.timezone=#{timezone}"
+              },
+              {
+                  Name: 'VIRTUAL_HOST',
+                  Value: virtual_host
+              },
+              {
+                  Name: 'VIRTUAL_PORT',
+                  Value: '8080'
+              }
+          ],
+          LogConfiguration: {
+              LogDriver: 'awslogs',
+              Options: {
+                  'awslogs-group' => Ref("LogGroup"),
+                  "awslogs-region" => Ref("AWS::Region"),
+                  "awslogs-stream-prefix" => "jenkins"
+              }
+          },
+          Essential: true,
+          MountPoints: [
+              {
+                  ContainerPath: '/etc/localtime',
+                  SourceVolume: 'timezone',
+                  ReadOnly: true
+              },
+              {
+                  ContainerPath: '/var/jenkins_home',
+                  SourceVolume: 'jenkins_data',
+                  ReadOnly: false
+              }
+          ]
+      }
+  ]
+
+  # If docker in docker slave is enabled
+  if defined? include_diind_slave and include_diind_slave
+    container_definitions[0][:Links] << 'jenkins-docker-dind-slave'
+    dind_definition = {
+        Name: 'jenkins-docker-dind-slave',
+        Memory: slave_memory,
+        Image: "#{ciinabox_repo}/ciinabox-docker-slave:#{docker_slave_version}",
+        Environment: [{Name: 'RUN_DOCKER_IN_DOCKER', Value: 1}],
+        LogConfiguration: {
+          LogDriver: 'awslogs',
+          Options: {
+            'awslogs-group' => Ref("LogGroup"),
+            "awslogs-region" => Ref("AWS::Region"),
+            "awslogs-stream-prefix" => "jenkins-docker-dind-slave"
+          }
+        },
+        Essential: false,
+        Privileged: true
+    }
+    dind_definition[:Environment] << { Name: 'USE_ECR_CREDENTIAL_HELPER', Value: 1 } if docker_slave_enable_ecr_credentials_helper
+    if not volatile_jenkins_slave
+      dind_definition[:MountPoints] = [
+          {
+              ContainerPath: '/var/lib/docker',
+              SourceVolume: 'jenkins_dind_data',
+              ReadOnly: false
+          }
+      ]
+      volumes << {
+          Name: 'jenkins_dind_data',
+          Host: {
+              SourcePath: '/data/jenkins-diind'
+          }
+      }
+    end
+    container_definitions << dind_definition
+
+  end
+
+  # If docker outside of docker slave is enabled
+  if defined? include_dood_slave and include_dood_slave
+    container_definitions[0][:Links] << 'jenkins-docker-dood-slave'
+    dood_definition =  {
+        Name: 'jenkins-docker-dood-slave',
+        Memory: slave_memory,
+        Image: "#{ciinabox_repo}/ciinabox-docker-slave:#{docker_slave_version}",
+        Environment: [{Name: 'RUN_DOCKER_IN_DOCKER', Value: 0}],
+        LogConfiguration: {
+          LogDriver: 'awslogs',
+          Options: {
+            'awslogs-group' => Ref("LogGroup"),
+            "awslogs-region" => Ref("AWS::Region"),
+            "awslogs-stream-prefix" => "jenkins-docker-dood-slave"
+          }
+        },
         MountPoints: [
             {
-                ContainerPath: '/etc/localtime',
-                SourceVolume: 'timezone',
-                ReadOnly: true
+                ContainerPath: '/var/run/docker.sock',
+                SourceVolume: 'docker_socket',
+                ReadOnly: false
             },
             {
-                ContainerPath: '/var/jenkins_home',
-                SourceVolume: 'jenkins_data',
+                ContainerPath: '/data/jenkins-dood',
+                SourceVolume: 'jenkins_dood_data',
                 ReadOnly: false
             }
-        ]
+        ],
+        Essential: false,
+        Privileged: false
     }
-]
-
-# If docker in docker slave is enabled
-if defined? include_diind_slave and include_diind_slave
-  container_definitions[0][:Links] << 'jenkins-docker-dind-slave'
-  dind_definition = {
-      Name: 'jenkins-docker-dind-slave',
-      Memory: slave_memory,
-      Image: "#{ciinabox_repo}/ciinabox-docker-slave:#{docker_slave_version}",
-      Environment: [{Name: 'RUN_DOCKER_IN_DOCKER', Value: 1}],
-      Essential: false,
-      Privileged: true
-  }
-  dind_definition[:Environment] << { Name: 'USE_ECR_CREDENTIAL_HELPER', Value: 1 } if docker_slave_enable_ecr_credentials_helper
-  if not volatile_jenkins_slave
-    dind_definition[:MountPoints] = [
-        {
-            ContainerPath: '/var/lib/docker',
-            SourceVolume: 'jenkins_dind_data',
-            ReadOnly: false
+    dood_definition[:Environment] << { Name: 'USE_ECR_CREDENTIAL_HELPER', Value: 1 } if docker_slave_enable_ecr_credentials_helper
+    container_definitions << dood_definition
+    volumes << {
+        Name: 'jenkins_dood_data',
+        Host: {
+            SourcePath: '/data/jenkins-dood'
         }
-    ]
+    }
     volumes << {
-        Name: 'jenkins_dind_data',
+        Name: 'docker_socket',
         Host: {
-            SourcePath: '/data/jenkins-diind'
+            SourcePath: '/var/run/docker.sock'
         }
     }
   end
-  container_definitions << dind_definition
-
-end
-
-# If docker outside of docker slave is enabled
-if defined? include_dood_slave and include_dood_slave
-  container_definitions[0][:Links] << 'jenkins-docker-dood-slave'
-  dood_definition =  {
-      Name: 'jenkins-docker-dood-slave',
-      Memory: slave_memory,
-      Image: "#{ciinabox_repo}/ciinabox-docker-slave:#{docker_slave_version}",
-      Environment: [{Name: 'RUN_DOCKER_IN_DOCKER', Value: 0}],
-      MountPoints: [
-          {
-              ContainerPath: '/var/run/docker.sock',
-              SourceVolume: 'docker_socket',
-              ReadOnly: false
-          },
-          {
-              ContainerPath: '/data/jenkins-dood',
-              SourceVolume: 'jenkins_dood_data',
-              ReadOnly: false
-          }
-      ],
-      Essential: false,
-      Privileged: false
-  }
-  dood_definition[:Environment] << { Name: 'USE_ECR_CREDENTIAL_HELPER', Value: 1 } if docker_slave_enable_ecr_credentials_helper
-  container_definitions << dood_definition
-  volumes << {
-      Name: 'jenkins_dood_data',
-      Host: {
-          SourcePath: '/data/jenkins-dood'
-      }
-  }
-  volumes << {
-      Name: 'docker_socket',
-      Host: {
-          SourcePath: '/var/run/docker.sock'
-      }
-  }
-end
-
 
-CloudFormation {
+  log_group_retention = log_group_retention || 90
 
-  AWSTemplateFormatVersion "2010-09-09"
-  Description "ciinabox - ECS Service Jenkins v#{ciinabox_version}"
-
-  Parameter("ECSCluster") {Type 'String'}
-  Parameter("ECSRole") {Type 'String'}
-  Parameter("ServiceELB") {Type 'String'}
-  Parameter('InternalELB') {Type 'String'} if internal_elb
+  Resource("LogGroup") {
+    Type "AWS::Logs::LogGroup"
+    Property("LogGroupName", "/ciinabox/#{ciinabox_name}/jenkins")
+    Property("RetentionInDays", log_group_retention)
+  }
 
   Resource('JenkinsTask') {
     Type "AWS::ECS::TaskDefinition"

data/templates/vpc.rb

@@ -158,6 +158,9 @@ CloudFormation {
   end
 
   rules = []
+
+  opsAccess = opsAccess || []
+
   opsAccess.each do |ip|
     rules << { IpProtocol: 'tcp', FromPort: '22', ToPort: '22', CidrIp: ip }
     rules << { IpProtocol: 'tcp', FromPort: '80', ToPort: '80', CidrIp: ip }
@@ -167,14 +170,24 @@ CloudFormation {
     rules << { IpProtocol: 'tcp', FromPort: '50000', ToPort: '50000', CidrIp: ip }
   end
 
+  opsIpPrefixLists = opsIpPrefixLists || []
+
+  opsIpPrefixLists.each do |list|
+    rules << { IpProtocol: 'tcp', FromPort: '80', ToPort: '80', SourcePrefixListId: list }
+    rules << { IpProtocol: 'tcp', FromPort: '443', ToPort: '443', SourcePrefixListId: list }
+  end
+
   Resource("SecurityGroupOps") {
     Type 'AWS::EC2::SecurityGroup'
     Property('VpcId', Ref('VPC'))
     Property('GroupDescription', 'Ops External Access')
-    Property('SecurityGroupIngress', rules)
+    Property('SecurityGroupIngress', rules) if rules.any?
   }
 
   rules = []
+
+  devAccess = devAccess || []
+
   devAccess.each do |ip|
     rules << { IpProtocol: 'tcp', FromPort: '22', ToPort: '22', CidrIp: ip }
     rules << { IpProtocol: 'tcp', FromPort: '80', ToPort: '80', CidrIp: ip }
@@ -184,11 +197,18 @@ CloudFormation {
     rules << { IpProtocol: 'tcp', FromPort: '50000', ToPort: '50000', CidrIp: ip }
   end
 
+  devIpPrefixLists = devIpPrefixLists || []
+
+  devIpPrefixLists.each do |list|
+    rules << { IpProtocol: 'tcp', FromPort: '80', ToPort: '80', SourcePrefixListId: list }
+    rules << { IpProtocol: 'tcp', FromPort: '443', ToPort: '443', SourcePrefixListId: list }
+  end
+
   Resource("SecurityGroupDev") {
     Type 'AWS::EC2::SecurityGroup'
     Property('VpcId', Ref('VPC'))
     Property('GroupDescription', 'Dev Team Access')
-    Property('SecurityGroupIngress', rules)
+    Property('SecurityGroupIngress', rules) if rules.any?
   }
 
 
@@ -286,4 +306,4 @@ CloudFormation {
     Value(Ref('SecurityGroupDev'))
   }
 
-}
+}

data/templates/vpn.rb

@@ -41,6 +41,9 @@ CloudFormation do
   security_groups << Ref('VpnSecurityGroupOps')
 
   rules = []
+  
+  devAccess = devAccess || []
+
   devAccess.each do |ip|
     rules << { IpProtocol: 'tcp', FromPort: '443', ToPort: '443', CidrIp: ip }
     rules << { IpProtocol: 'tcp', FromPort: '9443', ToPort: '9443', CidrIp: ip }
@@ -48,11 +51,20 @@ CloudFormation do
     rules << { IpProtocol: 'udp', FromPort: '1194', ToPort: '1194', CidrIp: ip }
   end
 
+  devIpPrefixLists = devIpPrefixLists || []
+
+  devIpPrefixLists.each do |list|
+    rules << { IpProtocol: 'tcp', FromPort: '443', ToPort: '443', SourcePrefixListId: list }
+    rules << { IpProtocol: 'tcp', FromPort: '9443', ToPort: '9443', SourcePrefixListId: list }
+    rules << { IpProtocol: 'tcp', FromPort: '943', ToPort: '943', SourcePrefixListId: list }
+    rules << { IpProtocol: 'udp', FromPort: '1194', ToPort: '1194', SourcePrefixListId: list }
+  end
+
   Resource("VpnSecurityGroupDev") {
     Type 'AWS::EC2::SecurityGroup'
     Property('VpcId', Ref('VPC'))
     Property('GroupDescription', 'Dev Team Access')
-    Property('SecurityGroupIngress', rules)
+    Property('SecurityGroupIngress', rules) if rules.any?
   }
 
   security_groups << Ref('VpnSecurityGroupDev')

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ciinabox-ecs
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.4.1
 platform: ruby
 authors:
 - Base2Services
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-06-08 00:00:00.000000000 Z
+date: 2021-09-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -169,7 +169,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.19
+rubygems_version: 3.1.6
 signing_key: 
 specification_version: 4
 summary: Manage ciinabox on Aws Ecs